laf Documentation

To use database-proxy on your server, you need to set up an Accessor (e.g., MongoAccessor), a Policy containing your access control rules, and a Proxy instance. The proxy handles parameter parsing, validation against rules, and execution.

const app = require('express')()
const { Proxy, MongoAccessor, Policy } = require('database-proxy')
const { MongoClient } = require('mongodb')

app.use(express.json())

// design the access control policy rules
const rules = {
    categories: {
        "read": true,
        "update": "!uid",
        "add": "!uid",
        "remove": "!uid"
    }
}

const client = new MongoClient('mongodb://localhost:27017')
client.connect()

// create an accessor
const accessor = new MongoAccessor(client)

// create a policy
const policy = new Policy(accessor)
policy.load(rules)

// create an proxy
const proxy = new Proxy(accessor, policy)

app.post('/proxy', async (req, res) => {
  const { uid } = parseToken(req.headers['authorization'])

  const injections = {
    uid: uid
  }

  // parse params
  const params = proxy.parseParams(req.body)

  // validate query
  const result = await proxy.validate(params, injections)
  if (result.errors) {
    return res.send({
      code: 1,
      error: result.errors
    })
  }

  // execute query
  const data = await proxy.execute(params)
  return res.send({
    code: 0,
    data
  })
})

app.listen(8080, () => console.log('listening on 8080'))

When working with data that uses a logical delete flag (e.g., del_flag), you can configure how queries interact with deleted records:

• Default Un-deleted View: To default queries to only show non-deleted data, use default: 0. Note that this does not prevent a user from explicitly querying deleted data if they provide a different del_flag value.
• Strictly Prohibit Deleted Data: To prevent users from accessing deleted records entirely, set required: true and a condition that excludes the deleted state (e.g., condition: "$value != 1").
• Override: Use override to force a specific value for the deletion flag.

// Default to non-deleted (del_flag: 0)
query: {
  del_flag: { default: 0 }
}

// Force user to only query non-deleted data
query: {
  del_flag: {
    condition: "$value != 1",
    required: true
  }
}

// Force the query to use a specific del_flag value
query: {
  del_flag: { override: 1 }
}

To develop the runtime-nodejs service locally, you must proxy traffic from your running laf cluster to your local machine using Telepresence. This allows you to test cloud functions and database access proxying in a local environment that behaves as if it were inside the cluster.

Prerequisites

• A laf cluster installed (configured in ~/.kube/config).
• Telepresence installed.
• A running application appid in the laf cluster.
• Node.js version >= 18.0.0.

Setup and Execution Steps

1. Navigate to the runtime directory.
2. Connect to the laf-system namespace using Telepresence.
3. Set your appid environment variable.
4. Intercept the traffic for your specific appid and map it to local port 8000.
5. Install dependencies, build, and start the service.

Cleanup

When finished, leave the intercepted application and uninstall Telepresence components to restore your network state.

cd runtimes/nodejs

# Connect to the cluster
telepresence connect -n laf-system

# Set your appid
export appid=your-app-id

# Proxy app cluster traffic to local
telepresence intercept $appid -p 8000:8000 -e $(pwd)/.env

# Verify intercept is active
telepresence list

# Install and start local service
npm install
npm run build
npm start