Merge pull request #6 from opengovsg/mockinfo

Implement MockInfo

index.js

@@ -26,6 +26,7 @@ const app = config(express(), {
       assertEndpoint: process.env.CORPPASS_ASSERT_ENDPOINT,
     },
   },
+  port: PORT,
   showLoginPage: process.env.SHOW_LOGIN_PAGE === 'true',
 })
 

lib/assertions.js

@@ -8,6 +8,8 @@ const readFrom = p => fs.readFileSync(path.resolve(__dirname, p), 'utf8')
 const TEMPLATE = readFrom('../static/saml/unsigned-assertion.xml')
 const corpPassTemplate = readFrom('../static/saml/corppass.xml')
 
+const myinfo = JSON.parse(readFrom('../static/myinfo.json'))
+
 const identities = {
   singPass: [
     'S8979373D',
@@ -45,6 +47,7 @@ const identities = {
     'F1612358R',
     'F1612354N',
     'F1612357U',
+    ...Object.keys(myinfo.personas),
   ],
   corpPass: [
     { NRIC: 'S8979373D', UEN: '123456789A' },
@@ -75,4 +78,5 @@ module.exports = {
     create: makeCorpPass,
   },
   identities,
+  myinfo,
 }

lib/crypto.js

@@ -1,3 +1,4 @@
+const crypto = require('crypto')
 const fs = require('fs')
 const path = require('path')
 const { SignedXml } = require('xml-crypto')
@@ -13,6 +14,30 @@ module.exports = (serviceProvider) => {
     keyEncryptionAlgorighm: 'http://www.w3.org/2001/04/xmlenc#rsa-1_5',
   }
 
+  const baseString = function baseString ({
+    httpMethod,
+    url,
+    appId,
+    clientId,
+    singpassEserviceId,
+    nonce,
+    requestedAttributes,
+    timestamp,
+  }) {
+    return httpMethod.toUpperCase() +
+      // url string replacement was dictated by MyInfo docs - no explanation
+      // was provided for why this is necessary
+      '&' + url.replace('.api.gov.sg', '.e.api.gov.sg') +
+      '&apex_l2_eg_app_id=' + appId +
+      '&apex_l2_eg_nonce=' + nonce +
+      '&apex_l2_eg_signature_method=SHA256withRSA' +
+      '&apex_l2_eg_timestamp=' + timestamp +
+      '&apex_l2_eg_version=1.0' +
+      '&attributes=' + requestedAttributes +
+      '&client_id=' + clientId +
+      '&singpassEserviceId=' + singpassEserviceId
+  }
+
   return {
     verifySignature (xml, serviceProviderCertPath) {
       const [ signature ] =
@@ -53,5 +78,12 @@ module.exports = (serviceProvider) => {
           : resolve(`<saml:EncryptedAssertion>${data}</saml:EncryptedAssertion>`)
       )
     }),
+
+    verifyMyInfoSignature (signature, baseStringFields) {
+      const verifier = crypto.createVerify('RSA-SHA256')
+      verifier.update(baseString(baseStringFields))
+      verifier.end()
+      return verifier.verify(serviceProvider.pubKey, signature, 'base64')
+    },
   }
 }

lib/express.js

@@ -1,5 +1,7 @@
+const _ = require('lodash')
 const bodyParser = require('body-parser')
 const fs = require('fs')
+const { pick, partition } = require('lodash')
 const morgan = require('morgan')
 const { render } = require('mustache')
 const path = require('path')
@@ -16,23 +18,26 @@ const dom = xmlString => domParser.parseFromString(xmlString)
 const TEMPLATE = fs.readFileSync(path.resolve(__dirname, '../static/saml/unsigned-response.xml'), 'utf8')
 const LOGIN_TEMPLATE = fs.readFileSync(path.resolve(__dirname, '../static/html/login-page.html'), 'utf8')
 
-function config (app, { showLoginPage, serviceProvider, idpConfig }) {
-  const { verifySignature, sign, promiseToEncryptAssertion } = crypto(serviceProvider)
+function config (app, { showLoginPage, serviceProvider, idpConfig, port }) {
+  const { verifySignature, verifyMyInfoSignature, sign, promiseToEncryptAssertion } = crypto(serviceProvider)
   app.use(morgan('combined'))
 
   for (const idp of ['singPass', 'corpPass']) {
     app.get(`/${idp.toLowerCase()}/logininitial`, (req, res) => {
       const relayState = encodeURIComponent(req.query.Target)
       if (showLoginPage) {
         const identities = assertions.identities[idp]
-        const someValues = identities
+        const values = identities
           .map((id, index) => {
             const samlArt = samlArtifact(idpConfig[idp].id, index)
             const assertURL =
               `${idpConfig[idp].assertEndpoint}?SAMLart=${samlArt}&RelayState=${relayState}`
+            if (assertions.myinfo.personas[id]) {
+              id += ' [MyInfo]'
+            }
             return { id, assertURL }
           })
-        const response = render(LOGIN_TEMPLATE, someValues)
+        const response = render(LOGIN_TEMPLATE, values)
         res.send(response)
       } else {
         const samlArt = samlArtifact(idpConfig[idp].id)
@@ -80,6 +85,67 @@ function config (app, { showLoginPage, serviceProvider, idpConfig }) {
       }
     )
   }
+
+  const lookupPerson = allowedAttributes => (req, res) => {
+    const requestedAttributes = (req.query.attributes || '').split(',')
+
+    const [attributes, disallowedAttributes] = partition(
+      requestedAttributes,
+      v => allowedAttributes.includes(v)
+    )
+
+    if (disallowedAttributes.length > 0) {
+      res.status(401).send({ code: 401, message: 'Disallowed', fields: disallowedAttributes.join(',') })
+    } else {
+      const persona = assertions.myinfo.personas[req.params.uinfin]
+      res.status(persona ? 200 : 404)
+        .send(
+          persona
+            ? pick(persona, attributes)
+            : { code: 404, message: 'UIN/FIN does not exist in MyInfo.', fields: '' }
+        )
+    }
+  }
+
+  const allowedAttributes = assertions.myinfo.attributes
+
+  app.get(
+    '/myinfo/person-basic/:uinfin/',
+    (req, res, next) => {
+      const [, authHeader] = req.get('Authorization').split(' ')
+      const authHeaderFieldPairs = _(authHeader)
+        .replace(/"/g, '')
+        .replace(/apex_l2_eg_/g, '')
+        .split(',')
+        .map(v => v.replace('=', '~').split('~'))
+
+      const authHeaderFields = _(authHeaderFieldPairs)
+        .fromPairs()
+        .mapKeys((v, k) => _.camelCase(k))
+        .value()
+
+      authHeaderFields.clientId = authHeaderFields.appId
+      authHeaderFields.singpassEserviceId = authHeaderFields.appId.replace(/^[^-]+-/, '')
+
+      authHeaderFields.httpMethod = req.method
+      // HACK: kludge the URL together
+      const hostPort = ['localhost', '127.0.0.1'].includes(req.hostname)
+        ? `${req.hostname}:${port}`
+        : req.hostname
+
+      authHeaderFields.url = `http://${hostPort}${req.baseUrl}${req.path}`
+      authHeaderFields.requestedAttributes = req.query.attributes
+
+      if (verifyMyInfoSignature(authHeaderFields.signature, authHeaderFields)) {
+        next()
+      } else {
+        res.status(403).send({ code: 403, message: 'Digital Service is invalid', fields: '' })
+      }
+    },
+    lookupPerson(allowedAttributes.basic)
+  )
+  app.get('/myinfo/person/:uinfin/', lookupPerson([...allowedAttributes.basic, ...allowedAttributes.income]))
+
   return app
 }
 

package.json

@@ -31,6 +31,7 @@
   "dependencies": {
     "base-64": "^0.1.0",
     "express": "^4.16.3",
+    "lodash": "^4.17.11",
     "morgan": "^1.9.1",
     "mustache": "^2.3.2",
     "xml-crypto": "^1.1.1",