{"action":"created","comment":{"url":"https://api.github.com/repos/wikimedia/restbase/pulls/comments/40745625","id":40745625,"diff_hunk":"@@ -84,6 +97,57 @@ var securityDefinitionCreators = {\n                 });\n             }\n         };\n+    },\n+    header_match: function(definition) {\n+        var errorMessage = definition['x-error-message']\n+            || 'This client is not allowed to use the endpoint';\n+        var whitelistMap = {};\n+        Object.keys(definition['x-whitelists']).forEach(function(whitelistName) {\n+            whitelistMap[whitelistName]\n+                = constructInternalRequestRegex(definition['x-whitelists'][whitelistName]);\n+        });\n+\n+        return {\n+            prepareRequest: function() {\n+            },\n+            checkPermissions: function(restbase, req, permissions) {\n+                if (restbase._rootReq.uri === '#internal-startup') {\n+                    // Skip a check on requests made by RESTBase during startup\n+                    return;\n+                }\n+\n+                permissions.forEach(function(requirementDefinition) {\n+                    // Check if requirement is limited to some method\n+                    if (requirementDefinition.method\n+                            && requirementDefinition.method !== req.method) {\n+                        return;\n+                    }\n+\n+                    var headerMatchRequirement = requirementDefinition.value;\n+                    var headerName = headerMatchRequirement.header;\n+                    var headerValue = req.headers && req.headers[headerName]\n+                            || restbase._rootReq.headers && restbase._rootReq.headers[headerName];\n+\n+                    headerMatchRequirement.patterns.forEach(function(permission) {","path":"lib/auth.js","position":57,"original_position":57,"commit_id":"a8f51cc9a06a09b9481f4db714c5c87c04355dc2","original_commit_id":"a8f51cc9a06a09b9481f4db714c5c87c04355dc2","user":{"login":"gwicke","id":1225898,"avatar_url":"https://avatars.githubusercontent.com/u/1225898?v=3","gravatar_id":"","url":"https://api.github.com/users/gwicke","html_url":"https://github.com/gwicke","followers_url":"https://api.github.com/users/gwicke/followers","following_url":"https://api.github.com/users/gwicke/following{/other_user}","gists_url":"https://api.github.com/users/gwicke/gists{/gist_id}","starred_url":"https://api.github.com/users/gwicke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gwicke/subscriptions","organizations_url":"https://api.github.com/users/gwicke/orgs","repos_url":"https://api.github.com/users/gwicke/repos","events_url":"https://api.github.com/users/gwicke/events{/privacy}","received_events_url":"https://api.github.com/users/gwicke/received_events","type":"User","site_admin":false},"body":"The use of 'permission' seems to be a bit confusing here. Do you think 'pattern' would be clearer?","created_at":"2015-09-29T23:56:41Z","updated_at":"2015-09-29T23:56:41Z","html_url":"https://github.com/wikimedia/restbase/pull/336#discussion_r40745625","pull_request_url":"https://api.github.com/repos/wikimedia/restbase/pulls/336","_links":{"self":{"href":"https://api.github.com/repos/wikimedia/restbase/pulls/comments/40745625"},"html":{"href":"https://github.com/wikimedia/restbase/pull/336#discussion_r40745625"},"pull_request":{"href":"https://api.github.com/repos/wikimedia/restbase/pulls/336"}}},"pull_request":{"url":"https://api.github.com/repos/wikimedia/restbase/pulls/336","id":45040137,"html_url":"https://github.com/wikimedia/restbase/pull/336","diff_url":"https://github.com/wikimedia/restbase/pull/336.diff","patch_url":"https://github.com/wikimedia/restbase/pull/336.patch","issue_url":"https://api.github.com/repos/wikimedia/restbase/issues/336","number":336,"state":"open","locked":false,"title":"Check client IP on requests to POST storage","user":{"login":"Pchelolo","id":814754,"avatar_url":"https://avatars.githubusercontent.com/u/814754?v=3","gravatar_id":"","url":"https://api.github.com/users/Pchelolo","html_url":"https://github.com/Pchelolo","followers_url":"https://api.github.com/users/Pchelolo/followers","following_url":"https://api.github.com/users/Pchelolo/following{/other_user}","gists_url":"https://api.github.com/users/Pchelolo/gists{/gist_id}","starred_url":"https://api.github.com/users/Pchelolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Pchelolo/subscriptions","organizations_url":"https://api.github.com/users/Pchelolo/orgs","repos_url":"https://api.github.com/users/Pchelolo/repos","events_url":"https://api.github.com/users/Pchelolo/events{/privacy}","received_events_url":"https://api.github.com/users/Pchelolo/received_events","type":"User","site_admin":false},"body":"This PR is very tightly coupled with https://github.com/wikimedia/restbase/pull/332. \r\n\r\nIt's more a prototype to start the discussion, than a final implementation. A couple of notes:\r\n1. The `client_ip` securityDefinition is set on the `/sys` subspec, so it doesn't get to the publicly exposed spec, leaving it valid (this securityDefinition is invalid from swagger perspective) while we can still use it on the /sys level. When we need to add such a feature on /api level we can move it (and rename to x-securityDefinitions).\r\n2. If we state, that RB works as a proxy, the correct way to work with an `x-forwarded-for` header would be to add request's `remoteAddress` to the incoming header's proxy list, or set it as a client ip if no header was passed. \r\n3. RB can make requests upon startup and these shouldn't be checked.\r\n4. Parallel access checks are only valid for GET and HEAD, other methods should use sequential checks.","created_at":"2015-09-15T11:59:04Z","updated_at":"2015-09-29T23:56:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"35f7a8e809ee4249b56ad98aee8e670fe9eb55c8","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/wikimedia/restbase/pulls/336/commits","review_comments_url":"https://api.github.com/repos/wikimedia/restbase/pulls/336/comments","review_comment_url":"https://api.github.com/repos/wikimedia/restbase/pulls/comments{/number}","comments_url":"https://api.github.com/repos/wikimedia/restbase/issues/336/comments","statuses_url":"https://api.github.com/repos/wikimedia/restbase/statuses/a8f51cc9a06a09b9481f4db714c5c87c04355dc2","head":{"label":"Pchelolo:client_ip","ref":"client_ip","sha":"a8f51cc9a06a09b9481f4db714c5c87c04355dc2","user":{"login":"Pchelolo","id":814754,"avatar_url":"https://avatars.githubusercontent.com/u/814754?v=3","gravatar_id":"","url":"https://api.github.com/users/Pchelolo","html_url":"https://github.com/Pchelolo","followers_url":"https://api.github.com/users/Pchelolo/followers","following_url":"https://api.github.com/users/Pchelolo/following{/other_user}","gists_url":"https://api.github.com/users/Pchelolo/gists{/gist_id}","starred_url":"https://api.github.com/users/Pchelolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Pchelolo/subscriptions","organizations_url":"https://api.github.com/users/Pchelolo/orgs","repos_url":"https://api.github.com/users/Pchelolo/repos","events_url":"https://api.github.com/users/Pchelolo/events{/privacy}","received_events_url":"https://api.github.com/users/Pchelolo/received_events","type":"User","site_admin":false},"repo":{"id":37933525,"name":"restbase","full_name":"Pchelolo/restbase","owner":{"login":"Pchelolo","id":814754,"avatar_url":"https://avatars.githubusercontent.com/u/814754?v=3","gravatar_id":"","url":"https://api.github.com/users/Pchelolo","html_url":"https://github.com/Pchelolo","followers_url":"https://api.github.com/users/Pchelolo/followers","following_url":"https://api.github.com/users/Pchelolo/following{/other_user}","gists_url":"https://api.github.com/users/Pchelolo/gists{/gist_id}","starred_url":"https://api.github.com/users/Pchelolo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Pchelolo/subscriptions","organizations_url":"https://api.github.com/users/Pchelolo/orgs","repos_url":"https://api.github.com/users/Pchelolo/repos","events_url":"https://api.github.com/users/Pchelolo/events{/privacy}","received_events_url":"https://api.github.com/users/Pchelolo/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/Pchelolo/restbase","description":"Distributed storage with REST API & dispatcher for backend services","fork":true,"url":"https://api.github.com/repos/Pchelolo/restbase","forks_url":"https://api.github.com/repos/Pchelolo/restbase/forks","keys_url":"https://api.github.com/repos/Pchelolo/restbase/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Pchelolo/restbase/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Pchelolo/restbase/teams","hooks_url":"https://api.github.com/repos/Pchelolo/restbase/hooks","issue_events_url":"https://api.github.com/repos/Pchelolo/restbase/issues/events{/number}","events_url":"https://api.github.com/repos/Pchelolo/restbase/events","assignees_url":"https://api.github.com/repos/Pchelolo/restbase/assignees{/user}","branches_url":"https://api.github.com/repos/Pchelolo/restbase/branches{/branch}","tags_url":"https://api.github.com/repos/Pchelolo/restbase/tags","blobs_url":"https://api.github.com/repos/Pchelolo/restbase/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Pchelolo/restbase/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Pchelolo/restbase/git/refs{/sha}","trees_url":"https://api.github.com/repos/Pchelolo/restbase/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Pchelolo/restbase/statuses/{sha}","languages_url":"https://api.github.com/repos/Pchelolo/restbase/languages","stargazers_url":"https://api.github.com/repos/Pchelolo/restbase/stargazers","contributors_url":"https://api.github.com/repos/Pchelolo/restbase/contributors","subscribers_url":"https://api.github.com/repos/Pchelolo/restbase/subscribers","subscription_url":"https://api.github.com/repos/Pchelolo/restbase/subscription","commits_url":"https://api.github.com/repos/Pchelolo/restbase/commits{/sha}","git_commits_url":"https://api.github.com/repos/Pchelolo/restbase/git/commits{/sha}","comments_url":"https://api.github.com/repos/Pchelolo/restbase/comments{/number}","issue_comment_url":"https://api.github.com/repos/Pchelolo/restbase/issues/comments{/number}","contents_url":"https://api.github.com/repos/Pchelolo/restbase/contents/{+path}","compare_url":"https://api.github.com/repos/Pchelolo/restbase/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Pchelolo/restbase/merges","archive_url":"https://api.github.com/repos/Pchelolo/restbase/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Pchelolo/restbase/downloads","issues_url":"https://api.github.com/repos/Pchelolo/restbase/issues{/number}","pulls_url":"https://api.github.com/repos/Pchelolo/restbase/pulls{/number}","milestones_url":"https://api.github.com/repos/Pchelolo/restbase/milestones{/number}","notifications_url":"https://api.github.com/repos/Pchelolo/restbase/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Pchelolo/restbase/labels{/name}","releases_url":"https://api.github.com/repos/Pchelolo/restbase/releases{/id}","created_at":"2015-06-23T17:22:56Z","updated_at":"2015-06-23T17:22:57Z","pushed_at":"2015-09-25T13:57:38Z","git_url":"git://github.com/Pchelolo/restbase.git","ssh_url":"git@github.com:Pchelolo/restbase.git","clone_url":"https://github.com/Pchelolo/restbase.git","svn_url":"https://github.com/Pchelolo/restbase","homepage":"https://www.mediawiki.org/wiki/RESTBase","size":2441,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"wikimedia:master","ref":"master","sha":"c2e131d6a6952f4ff9257999bd20d51ba771144e","user":{"login":"wikimedia","id":56668,"avatar_url":"https://avatars.githubusercontent.com/u/56668?v=3","gravatar_id":"","url":"https://api.github.com/users/wikimedia","html_url":"https://github.com/wikimedia","followers_url":"https://api.github.com/users/wikimedia/followers","following_url":"https://api.github.com/users/wikimedia/following{/other_user}","gists_url":"https://api.github.com/users/wikimedia/gists{/gist_id}","starred_url":"https://api.github.com/users/wikimedia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wikimedia/subscriptions","organizations_url":"https://api.github.com/users/wikimedia/orgs","repos_url":"https://api.github.com/users/wikimedia/repos","events_url":"https://api.github.com/users/wikimedia/events{/privacy}","received_events_url":"https://api.github.com/users/wikimedia/received_events","type":"Organization","site_admin":false},"repo":{"id":19002414,"name":"restbase","full_name":"wikimedia/restbase","owner":{"login":"wikimedia","id":56668,"avatar_url":"https://avatars.githubusercontent.com/u/56668?v=3","gravatar_id":"","url":"https://api.github.com/users/wikimedia","html_url":"https://github.com/wikimedia","followers_url":"https://api.github.com/users/wikimedia/followers","following_url":"https://api.github.com/users/wikimedia/following{/other_user}","gists_url":"https://api.github.com/users/wikimedia/gists{/gist_id}","starred_url":"https://api.github.com/users/wikimedia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wikimedia/subscriptions","organizations_url":"https://api.github.com/users/wikimedia/orgs","repos_url":"https://api.github.com/users/wikimedia/repos","events_url":"https://api.github.com/users/wikimedia/events{/privacy}","received_events_url":"https://api.github.com/users/wikimedia/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/wikimedia/restbase","description":"Distributed storage with REST API & dispatcher for backend services","fork":false,"url":"https://api.github.com/repos/wikimedia/restbase","forks_url":"https://api.github.com/repos/wikimedia/restbase/forks","keys_url":"https://api.github.com/repos/wikimedia/restbase/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wikimedia/restbase/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wikimedia/restbase/teams","hooks_url":"https://api.github.com/repos/wikimedia/restbase/hooks","issue_events_url":"https://api.github.com/repos/wikimedia/restbase/issues/events{/number}","events_url":"https://api.github.com/repos/wikimedia/restbase/events","assignees_url":"https://api.github.com/repos/wikimedia/restbase/assignees{/user}","branches_url":"https://api.github.com/repos/wikimedia/restbase/branches{/branch}","tags_url":"https://api.github.com/repos/wikimedia/restbase/tags","blobs_url":"https://api.github.com/repos/wikimedia/restbase/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wikimedia/restbase/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wikimedia/restbase/git/refs{/sha}","trees_url":"https://api.github.com/repos/wikimedia/restbase/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wikimedia/restbase/statuses/{sha}","languages_url":"https://api.github.com/repos/wikimedia/restbase/languages","stargazers_url":"https://api.github.com/repos/wikimedia/restbase/stargazers","contributors_url":"https://api.github.com/repos/wikimedia/restbase/contributors","subscribers_url":"https://api.github.com/repos/wikimedia/restbase/subscribers","subscription_url":"https://api.github.com/repos/wikimedia/restbase/subscription","commits_url":"https://api.github.com/repos/wikimedia/restbase/commits{/sha}","git_commits_url":"https://api.github.com/repos/wikimedia/restbase/git/commits{/sha}","comments_url":"https://api.github.com/repos/wikimedia/restbase/comments{/number}","issue_comment_url":"https://api.github.com/repos/wikimedia/restbase/issues/comments{/number}","contents_url":"https://api.github.com/repos/wikimedia/restbase/contents/{+path}","compare_url":"https://api.github.com/repos/wikimedia/restbase/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wikimedia/restbase/merges","archive_url":"https://api.github.com/repos/wikimedia/restbase/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wikimedia/restbase/downloads","issues_url":"https://api.github.com/repos/wikimedia/restbase/issues{/number}","pulls_url":"https://api.github.com/repos/wikimedia/restbase/pulls{/number}","milestones_url":"https://api.github.com/repos/wikimedia/restbase/milestones{/number}","notifications_url":"https://api.github.com/repos/wikimedia/restbase/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wikimedia/restbase/labels{/name}","releases_url":"https://api.github.com/repos/wikimedia/restbase/releases{/id}","created_at":"2014-04-21T18:35:00Z","updated_at":"2015-09-22T12:31:51Z","pushed_at":"2015-09-29T22:52:54Z","git_url":"git://github.com/wikimedia/restbase.git","ssh_url":"git@github.com:wikimedia/restbase.git","clone_url":"https://github.com/wikimedia/restbase.git","svn_url":"https://github.com/wikimedia/restbase","homepage":"https://www.mediawiki.org/wiki/RESTBase","size":5289,"stargazers_count":31,"watchers_count":31,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":28,"mirror_url":null,"open_issues_count":8,"forks":28,"open_issues":8,"watchers":31,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/wikimedia/restbase/pulls/336"},"html":{"href":"https://github.com/wikimedia/restbase/pull/336"},"issue":{"href":"https://api.github.com/repos/wikimedia/restbase/issues/336"},"comments":{"href":"https://api.github.com/repos/wikimedia/restbase/issues/336/comments"},"review_comments":{"href":"https://api.github.com/repos/wikimedia/restbase/pulls/336/comments"},"review_comment":{"href":"https://api.github.com/repos/wikimedia/restbase/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/wikimedia/restbase/pulls/336/commits"},"statuses":{"href":"https://api.github.com/repos/wikimedia/restbase/statuses/a8f51cc9a06a09b9481f4db714c5c87c04355dc2"}}}}