Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@vodafoneuk/aim-mocking
Advanced tools
Api Interceptor Middleware - localized cache lib and middleware for dalmatian and other api calls
AIM is a mocking middleware that is based on Express and can mock and record APIs. It operates only on the server-side and does not modify the client-side code. Therefore, you don't need to worry if the mocks are different from the production or other environments, as AIM behaves in the same way as your production environment.
The main advantage of using AIM over other tools is that it does not require mapping files or written code to map your request and serve back the mock files. This leads to lower maintenance costs. AIM can automatically detect which mock to return based on the request.
When you make an API request, it is normally proxied to your back-end server. AIM essentially sits in between. As long as it is disabled, it is not doing anything. Once it is enabled, you have a few options to choose from:
AIM does not allow using both modes simultaneously to avoid confusion about which data is real and which is mocked.
If Mocking mode is enabled, and mocks do not exist, AIM will provide guidelines on how to fix the problem and which files to create, and/or create mocks manually.
AIM is a unique type of middleware because it requires passing the application to it in order to maintain good control over it. If implemented differently, the setup process would be much more complex since AIM needs to proxy requests.
Currently, AIM is only capable of mocking JSON responses. The default response status for mocks is always 200, but it can be changed as needed.
session
: allows multiple people to work on mock files with different data. AIM recognises who you are based on the session of first connect and returns the same in-memory session later on.ConfigController
: provides dynamic configuration inside AIM.
Cache
= mocks: AIM supports only the cache interface.proxy
/ setupProxy
: onProxyRequest
and onProxyResponse
are the functions where AIM actually sits and can manipulate requests, responses, and data.cacheController
: helps to return correct mocks.All mock responses can be recognised via the __cacheMeta
object added to the response. Some of its properties can be modified to provide a better and more realistic mocking experience.
"__cacheMeta": { // used for visualising body and query parameters for debugging purpose, main ingredients for the hash
"status": 400, // can be modified
"delay": 5000, // property in mocks to delay response time
"hash": {
"body": {},
"query": {}
}
}
AIM is a NX monorepo that includes three packages:
Running yarn start:playground
will execute tests and scenarios that showcase how AIM works. You can also import these scenarios into your Postman.
You can import AIM.postman_collection.json
in Postman while running the playground to experiment with AIM API via Postman.
@vodafoneuk/aim-mocking
and @vodafoneuk/aim-mocking-logger
With npm:
npm install @vodafoneuk/aim-mocking @vodafoneuk/aim-mocking-logger
With yarn:
yarn add @vodafoneuk/aim-mocking @vodafoneuk/aim-mocking-logger
Implement into express app
import Aim from '@vodafoneuk/aim-mocking'
import express from 'express'
const app = express()
Aim(app, yourConfig)
Configuration is specific to your project. It is important to remember that it is not dynamic; AIM behaviour is controlled through API calls to AIM itself.
export interface AimConfig {
/** Debug options */
debug?: {
setup?: boolean
cache?: boolean
config?: boolean
autofix?: boolean
onProxyRequest?: boolean
onProxyError?: boolean
onProxyResponse?: boolean
configEndpoints?: boolean
cacheController?: boolean
fileInterface?: boolean
scenarioList?: boolean
}
/** List of ignored paths that are already included in "proxy" config. */
ignoredPaths?: string[]
/** Aim internal api endpoints prefix */
apisConfigurationEndpointsPrefix?: string
/** Proxy configuration for paths that AIM should intercept, mock and record */
proxy: Record<string, AimProxyConfig>
/** Request body keys that should be ignored when calculating a hash */
hashIgnoredReqBodyKeys?: string[]
/** Request query keys that should be ignored when calculating a hash */
hashIgnoredReqQueryKeys?: string[]
/** Request url parts that should be ignored when calculating a hash */
hashIgnoredReqPathPatterns?: string[]
/** Function to rewrite request url in order to remove some parts from mock file name */
rewriteMockPathName?: null | ((str: string) => string)
/** Storage interface to use, only "file" is supported atm */
storageInterface?: 'file'
/** Location where the mocks will be stored. It is recommended to not change this value */
storageInterfaceRootPath?: string
enableAutofix?: boolean
}
Below are not default values! If you are unsure of what each option does, please do not copy it.
AimMiddleware(app, {
ignoredPaths: [],
hashIgnoredReqBodyKeys: ['customerId', 'time', 'customer.name', 'customer.type'],
hashIgnoredReqQueryKeys: ['perpage'],
hashIgnoredReqPathPatterns: [],
rewriteMockPathName: (requestPath: string) => {
return requestPath.replace(/api\//, '')
},
proxy: {
'/api': {
// Ask AIM to proxy back to your own server
// This is useful if you want to use your own proxy instead of AIM
// which will be removed in production code
target: 'http://localhost:3000',
secure: false,
changeOrigin: true,
},
},
})
publish
action.Author: Vodafone UK
Current lead maintainer: Radek Swiat
See all contributors here
FAQs
Api Interceptor Middleware - localized cache lib and middleware for dalmatian and other api calls
We found that @vodafoneuk/aim-mocking demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.