feat(proxy): ⚡ Adds an option to opt out from token fowrarding

libs/proxy/CHANGELOG.md

@@ -27,6 +27,22 @@
 
 <!-- /TOC -->
 
+## 0.7.0 (2022-05-18)
+
+### Features
+
+- Adds an option to opt out from token fowrarding (per service).
+
+```typescript
+services: [
+  {
+    id: 'THIRD_PARTY_SERVICE',
+    url: 'https://some-service.com/some-endpoint',
+    forwardToken: false,
+  },
+];
+```
+
 ## 0.6.0 (2021-11-4)
 
 ### Features

libs/proxy/README.md

@@ -74,6 +74,22 @@ Whether synchronously or asynchronously, the module takes two parameters (both o
 
 > A service can also take an optional `config`, which is the same signature as the parent one, allowing you to override configuration for that particular service !
 
+### Token forwarding
+
+By default, OAuth token are forwarded to the service call being proxied. You can disable this by setting the `forwardToken` property to `false` in the service configuration.
+
+```typescript
+services: [
+  {
+    id: 'THIRD_PARTY_SERVICE',
+    url: 'https://some-service.com/some-endpoint',
+    forwardToken: false,
+  },
+];
+```
+
+> ⚠ Be careful to only forward tokens to internal services. Don't forward the token to third party services.
+
 ### Default module configuration
 
 If you do not provide any, the default proxy configuration for this module can be found in [proxy.constants.ts](./src/proxy.constants.ts), under `defaultProxyOptions`

libs/proxy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finastra/nestjs-proxy",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "contributors": [
     "David Boclé <david.bocle@finastra.com>"
   ],

libs/proxy/src/interfaces/proxy.interface.ts

@@ -5,6 +5,7 @@ export interface Service {
   id: string;
   url: string;
   config?: server.ServerOptions;
+  forwardToken?: boolean;
 }
 
 export interface ProxyModuleOptions {

libs/proxy/src/services/proxy.service.spec.ts

@@ -17,6 +17,11 @@ const services = [
     id: 'test',
     url: 'https://test.io/subpath',
   },
+  {
+    id: 'THIRD_PARTY_SERVICE',
+    url: 'https://some-service.com/some-endpoint',
+    forwardToken: false,
+  },
 ];
 const mockProxyModuleOptions = {
   services,
@@ -119,6 +124,23 @@ describe('ProxyService', () => {
       expect((spy.mock.calls[0][2] as any).headers).toHaveProperty('authorization');
     });
 
+    it('should not call proxy with token', () => {
+      const req = createMock<Request>();
+      const res = createMock<Response>();
+      req.query = {
+        serviceId: services[1].id,
+      };
+      req.user = {
+        authTokens: {
+          accessToken: 'test',
+        },
+      };
+
+      const spy = jest.spyOn(proxy, 'web');
+      service.proxyRequest(req, res);
+      expect((spy.mock.calls[0][2] as any).headers).not.toHaveProperty('authorization');
+    });
+
     it('should send a 500 if error comes from proxy', done => {
       const req = createMock<Request>();
       const res = createMock<Response>();

libs/proxy/src/services/proxy.service.ts

@@ -40,7 +40,13 @@ export class ProxyService {
       if (services.has(serviceId)) {
         const service = services.get(serviceId);
         const baseUrl = service.url;
-        return this.doProxy(req, res, target ? concatPath(baseUrl, prefix, target) : baseUrl, token, service.config);
+        return this.doProxy(
+          req,
+          res,
+          target ? concatPath(baseUrl, prefix, target) : baseUrl,
+          service.forwardToken === false ? null : token,
+          service.config,
+        );
       } else {
         const error = `Could not find serviceId ${serviceId}`;
         this.logger.warn(error);

src/configs/proxy-config.service.ts

@@ -17,6 +17,7 @@ export class ProxyConfigService implements ProxyModuleOptionsFactory {
       {
         id: 'jsonplaceholder',
         url: 'https://jsonplaceholder.typicode.com',
+        forwardToken: false,
       },
     ];