pedwfrontend/pages/api/proxy/[...route].js

import axios from "axios";
import https from "https";
import CryptoJS from "crypto-js";
import HmacSHA256 from "crypto-js/hmac-sha256";
import { rest } from "lodash";

const PROXY_RELAY_URL =
    "https://" +
    (process.env.RELAYURI || "dev-pedw-ns.servicebus.windows.net") +
    "/" +
    (process.env.RELAYPATH || "dev-pedw-hc") +
    "/";

const getSASToken = () => {
    var m_ResourceURI =
        process.env.RELAYURI || "dev-pedw-ns.servicebus.windows.net";
    var m_Path = process.env.RELAYPATH || "dev-pedw-hc";
    var m_SasKey =
        process.env.SASKEY || "Ml0Y/S/nfRcmIrHFRkO4jNm2J3iH52TSxPiak7+E1+Y=";
    var m_SasKeyName = process.env.SASKEYNAME || "devpedwnspolicy";

    var encodedResourceUri = encodeURIComponent(
        "https://" + m_ResourceURI + "/" + m_Path + "/"
    );

    var t0 = new Date(1970, 1, 1, 0, 0, 0, 0);
    var t1 = new Date();
    var expireInSeconds =
        +(31 * 24 * 3600) + 3600 + (((t1.getTime() - t0.getTime()) / 1000) | 0);

    //the line below is a hack that converts to UTF8
    var plainSignature = JSON.parse(
        JSON.stringify(encodedResourceUri + "\n" + expireInSeconds)
    );

    var hash = CryptoJS.HmacSHA256(plainSignature, m_SasKey);
    var base64HashValue = CryptoJS.enc.Base64.stringify(hash);

    var token =
        "SharedAccessSignature sr=" +
        encodedResourceUri +
        "&sig=" +
        encodeURIComponent(base64HashValue) +
        "&se=" +
        expireInSeconds +
        "&skn=" +
        m_SasKeyName;

    return token;
};

function checkProxyPath(queryPath) {
    const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;

    const wordKey = WORDKEY;
    var hashlink = CryptoJS.HmacSHA256(
        decodeURI(queryPath),
        CryptoJS.enc.Hex.parse(wordKey)
    );

    hashlink = hashlink.toString();

    return hashlink;
}

export default async function ApiProxy(req, res) {
    var data = JSON.stringify(req.body);
    const SASToken = getSASToken();

    var configNoData = {
        method: req.method,
        //url: PROXY_RELAY_URL + updateFormCollection + "(" + incidentId + ")",
        url:
            PROXY_RELAY_URL +
            req.url.split("&hash=")[0].split("/api/proxy/")[1],
        headers: {
            "OData-MaxVersion": "4.0",
            "OData-Version": "4.0",
            "Accept": "application/json",
            "Prefer":
                'odata.include-annotations="*",return=representation,odata.maxpagesize=10',
            "Authorization": SASToken,
            "Content-Type": "application/json",
        },
    };

    var config = {
        method: req.method,
        url: PROXY_RELAY_URL + req.query.route[0],
        headers: {
            "OData-MaxVersion": "4.0",
            "OData-Version": "4.0",
            "Accept": "application/json",
            "Prefer": 'odata.include-annotations="*",return=representation',
            "Authorization": SASToken,
            "Content-Type": "application/json",
        },
        data: data,
    };

    var configDocument = {
        method: req.method,
        url:
            PROXY_RELAY_URL +
            req.url.split("&hash=")[0].split("/api/proxy/")[1],
        headers: {
            "OData-MaxVersion": "4.0",
            "OData-Version": "4.0",
            "Accept": "application/json",
            "Prefer": 'odata.include-annotations="*",return=representation',
            "Authorization": SASToken,
            "Content-Type": "application/json",
        },
        responseType: "arraybuffer",
    };

    let hashCheckPath = req.url.split("&hash=")[0];
    let hashCheckValue = req.url.split("&hash=")[1];
    let hashFromRequest = checkProxyPath(hashCheckPath);

    if (hashCheckValue == hashFromRequest) {
        return new Promise((resolve, reject) => {
            let hasDocument =
                hashCheckPath.indexOf("/download") > 0 ? true : false;

            axios(
                req.method == "GET"
                    ? hasDocument
                        ? configDocument
                        : configNoData
                    : config
            )
                .then((response) => {
                    res.statusCode = 200;
                    if (hasDocument) {
                        res.setHeader(
                            "Content-disposition",
                            "attachment; filename=" +
                                response.headers["content-disposition"].split(
                                    "filename="
                                )[1]
                        );
                        res.end(response.data);
                    } else {
                        res.setHeader("Content-Type", "application/json");
                        // res.setHeader("Cache-Control", "max-age=1800000");
                        res.end(JSON.stringify(response.data));
                    }
                    resolve();
                })
                .catch((error) => {
                    console.log("proxy response error", error);
                    // res.json(error);
                    res.status(405).end();
                    return resolve();
                });
        });
    } else {
        res.status(405).end();
        return resolve();
    }
}