Merge pull request #60 from nikolabjelo/master

Adding a preshared key to the gateway as a short term security measure (HOTFIX ONLY)

server/.env.example

@@ -1,3 +1,8 @@
+TEAMS_API_PRESHARED=THIS_IS_VERY_SECRET
+USERS_API_PRESHARED=THIS_IS_VERY_SECRET
+EVENTS_API_PRESHARED=THIS_IS_VERY_SECRET
+KEYVAULT_API_PRESHARED=THIS_IS_VERY_SECRET
+
 GRAPHQL_API_URL=https://app-api.advancedalgos.net/graphql
 TEAMS_API_URL=https://teams-api.advancedalgos.net/graphql
 USERS_API_URL=https://users-api.advancedalgos.net/graphql

server/src/createRemoteSchema.js

@@ -13,9 +13,12 @@ import {
 import { capitalize } from './utils'
 import logger from './logger'
 
-export const createRemoteSchema = async (uri) => {
+export const createRemoteSchema = async (uri, preshared_key) => {
   const makeDatabaseServiceLink = () => createHttpLink({
     uri: uri,
+    headers: {
+      preshared: preshared_key
+    },
     fetch
   })
   const databaseServiceSchemaDefinition = await introspectSchema(makeDatabaseServiceLink())
@@ -39,10 +42,10 @@ export const createRemoteSchema = async (uri) => {
   })
 }
 
-export const createTransformedRemoteSchema = async (prefix, uri) => {
+export const createTransformedRemoteSchema = async (prefix, uri, preshared_key) => {
   var schema
   try {
-    schema = await createRemoteSchema(uri)
+    schema = await createRemoteSchema(uri, preshared_key)
   } catch (error) {
     logger.error(`An error occured while fetching ${prefix}, ${uri} schema. Details: ${error}`)
     return false

server/src/index.js

@@ -34,10 +34,22 @@ async function getUserId (authId) {
 }
 
 async function run () {
-  const transformedTeamsSchema = await createTransformedRemoteSchema('teams_', process.env.TEAMS_API_URL)
-  const transformedUsersSchema = await createTransformedRemoteSchema('users_', process.env.USERS_API_URL)
-  const transformedEventsSchema = await createTransformedRemoteSchema('events_', process.env.EVENTS_API_URL)
-  const transformedKeyVaultSchema = await createTransformedRemoteSchema('keyVault_', process.env.KEYVAULT_API_URL)
+  const transformedTeamsSchema = await createTransformedRemoteSchema(
+    'teams_',
+    process.env.TEAMS_API_URL,
+    process.env.TEAMS_API_PRESHARED)
+  const transformedUsersSchema = await createTransformedRemoteSchema(
+    'users_',
+    process.env.USERS_API_URL,
+    process.env.USERS_API_PRESHARED)
+  const transformedEventsSchema = await createTransformedRemoteSchema(
+    'events_',
+    process.env.EVENTS_API_URL,
+    process.env.EVENTS_API_PRESHARED)
+  const transformedKeyVaultSchema = await createTransformedRemoteSchema(
+    'keyVault_',
+    process.env.KEYVAULT_API_URL,
+    process.env.KEYVAULT_API_PRESHARED)
 
   var schemas = []
   var resolvers = {}