fix delete-collection method, read auth from postman export file

akto-api-security · Dec 27, 2023 · 49d235a · 49d235a
1 parent 2a6ee4e
commit 49d235a
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 7 deletions.
diff --git a/apps/dashboard/src/main/java/com/akto/action/ApiCollectionsAction.java b/apps/dashboard/src/main/java/com/akto/action/ApiCollectionsAction.java
@@ -5,10 +5,8 @@
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
-import com.akto.dao.APISpecDao;
-import com.akto.dao.ApiCollectionsDao;
-import com.akto.dao.SensitiveParamInfoDao;
-import com.akto.dao.SingleTypeInfoDao;
+
+import com.akto.dao.*;
 import com.akto.dao.context.Context;
 import com.akto.dto.ApiCollection;
 import com.akto.util.Constants;
@@ -105,7 +103,10 @@ public String deleteMultipleCollections() {
         ApiCollectionsDao.instance.deleteAll(Filters.in("_id", apiCollectionIds));
         SingleTypeInfoDao.instance.deleteAll(Filters.in("apiCollectionId", apiCollectionIds));
         APISpecDao.instance.deleteAll(Filters.in("apiCollectionId", apiCollectionIds));
-        SensitiveParamInfoDao.instance.deleteAll(Filters.in("apiCollectionId", apiCollectionIds));                    
+        SensitiveParamInfoDao.instance.deleteAll(Filters.in("apiCollectionId", apiCollectionIds));
+        SampleDataDao.instance.deleteAll(Filters.in("_id.apiCollectionId", apiCollectionIds));
+        TrafficInfoDao.instance.deleteAll(Filters.in("_id.apiCollectionId", apiCollectionIds));
+        ApiInfoDao.instance.deleteAll(Filters.in("_id.apiCollectionId", apiCollectionIds));
 
         return SUCCESS.toUpperCase();
     }

diff --git a/apps/dashboard/src/main/java/com/akto/action/PostmanAction.java b/apps/dashboard/src/main/java/com/akto/action/PostmanAction.java
@@ -445,6 +445,7 @@ private static List<String> generateMessages(JsonNode collectionDetailsObj, int
         int accountId = Context.accountId.get();
         List<String> msgs = new ArrayList<>();
         Map<String, String> variablesMap = Utils.getVariableMap((ArrayNode) collectionDetailsObj.get("variable"));
+        Map<String, String> authMap = Utils.getAuthMap(collectionDetailsObj.get("auth"), variablesMap);
         ArrayList<JsonNode> jsonNodes = new ArrayList<>();
         Utils.fetchApisRecursively((ArrayNode) collectionDetailsObj.get("item"), jsonNodes);
         if(jsonNodes.size() == 0) {
@@ -455,7 +456,7 @@ private static List<String> generateMessages(JsonNode collectionDetailsObj, int
         for(JsonNode item: jsonNodes){
             String apiName = item.get("name").asText();
             loggerMaker.infoAndAddToDb(String.format("Processing api %s if collection %s", apiName, collectionName), LogDb.DASHBOARD);
-            Map<String, String> apiInAktoFormat = Utils.convertApiInAktoFormat(item, variablesMap, String.valueOf(accountId), allowReplay);
+            Map<String, String> apiInAktoFormat = Utils.convertApiInAktoFormat(item, variablesMap, String.valueOf(accountId), allowReplay, authMap);
             if(apiInAktoFormat != null){
                 try{
                     apiInAktoFormat.put("akto_vxlan_id", String.valueOf(aktoCollectionId));

diff --git a/apps/dashboard/src/main/java/com/akto/utils/Utils.java b/apps/dashboard/src/main/java/com/akto/utils/Utils.java
@@ -38,6 +38,38 @@ public class Utils {
 
     private static final LoggerMaker loggerMaker = new LoggerMaker(Utils.class);
     private final static ObjectMapper mapper = new ObjectMapper();
+
+    public static Map<String, String> getAuthMap(JsonNode auth, Map<String, String> variableMap) {
+        Map<String,String> result = new HashMap<>();
+
+        if (auth == null) {
+            return result;
+        }
+
+        try {
+            String authType = auth.get("type").asText().toLowerCase();
+
+            switch (authType) {
+                case "bearer":
+                    ArrayNode authParams = (ArrayNode) auth.get("bearer");
+                    for (JsonNode authHeader : authParams) {
+                        String tokenKey = authHeader.get("key").asText();
+                        if (tokenKey.equals("token")) {
+                            String tokenValue = authHeader.get("value").asText();
+                            String replacedTokenValue = replaceVariables(tokenValue, variableMap);
+
+                            result.put("Authorization", "Bearer " + replacedTokenValue);
+
+                        }
+                    }
+            }
+        } catch (Exception e) {
+            loggerMaker.errorAndAddToDb("Unable to parse auth from postman file: " + e.getMessage(), LogDb.DASHBOARD);
+        }
+
+        return result;
+    }
+
     public static Map<String, String> getVariableMap(ArrayNode variables){
         Map<String,String> result = new HashMap<>();
         if(variables == null){
@@ -85,11 +117,17 @@ public static String replaceVariables(String payload, Map<String, String> variab
         return sb.toString();
     }
 
-    public static Map<String, String> convertApiInAktoFormat(JsonNode apiInfo, Map<String, String> variables, String accountId, boolean allowReplay) {
+    public static Map<String, String> convertApiInAktoFormat(JsonNode apiInfo, Map<String, String> variables, String accountId, boolean allowReplay, Map<String, String> authMap) {
         try {
             JsonNode request = apiInfo.get("request");
+
             String apiName = apiInfo.get("name").asText();
 
+            JsonNode authApiNode = request.get("auth");
+            if (authApiNode != null) {
+                authMap = getAuthMap(authApiNode, variables);
+            }
+
             Map<String, String> result = new HashMap<>();
             result.put("akto_account_id", accountId);
             result.put("path", getPath(request, variables));
@@ -100,6 +138,7 @@ public static Map<String, String> convertApiInAktoFormat(JsonNode apiInfo, Map<S
 
             ArrayNode requestHeadersNode = (ArrayNode) request.get("header");
             Map<String, String> requestHeadersMap = getHeaders(requestHeadersNode, variables);
+            requestHeadersMap.putAll(authMap);
             String requestHeadersString =  mapper.writeValueAsString(requestHeadersMap);
             result.put("requestHeaders", requestHeadersString);