
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Configurable API for managing and publishing document-oriented content
Manage and expose document-oriented content through a configurable RESTful API.
POST
, PUT
and DELETE
asynchronous webhooks for distributed architecture?embed=shippingAddresses
?data.name=Thomas&data.address.city=London
?sort=name,-birthday
?page=4&perPage=20
States represent the different stages in a document lifecycle, like published
, draft
and archived
. To each state is associated specific role-based permissions, defining allowed HTTP methods :
Method | Possible actions on the state |
---|---|
GET | view and query the documents |
POST | create a new document |
PUT | edit an existing document or put a document in this state |
DELETE | delete the state for the document |
A document can be in different states at the same time, for example:
published
version, visible on the website and the mobile app by everyonewaiting_for_approval
version that has to be validated by an admindraft
version an editor is already working on.A document can migrate from a state to another, for example:
ticket
for your customers error reporting.customer
role is allowed to POST /docs/tickets
in the default state submitted
support
role is allowed to PUT /docs/tickets
in the states replied
or read
You can create any number of states:
published
draft
waiting_for_approval
approved
rejected
populationA
populationB
submitted
read
replied
You can create any number of roles:
admin
editor
manager
customer
user
public
visitor
The resource is the document template, it describes the fields and validation rules.
A document is an instance of a resource. It has an id
and a value for each defined state, which is encapsulated in a property named data
.
let doc = {
id: new ObjectId("58205e4fa5dc6c3b381a0e9b"),
states: {
published: {
createdAt: "2016-11-07 10:58:23.950Z",
createdBy: "58277c406d6157a751399052",
data: {
title: "Hello World",
content: "I'm the published version"
}
},
draft: {
createdAt: "2016-11-07 11:22:12.950Z",
createdBy: "58277c406d6157a751399052",
data: {
title: "Hello World",
content: "I'm the draft version"
}
},
}
}
Relationships between resources are resolved:
embed
set to true
embed={rel}
parameter is passed in the query stringBecause there are no JOIN
in MongoDB, embedding documents requires the execution of supplementary queries. For performance reason, the results are memoized during the request lifetime.
You can configure webhooks that are triggered when an request processed by campsi/api match a specific scope (action, state, resource). Once triggered, the webhook send an asynchronous HTTP request to the endpoint uri
specified in its configuration.
todo distributed architecture example
First, start Redis and MongoDB containers by running:
docker compose up -d
To stop the containers, run:
docker compose down
To restart the containers, run:
docker compose restart
Once the containers are running, you can start the server by running:
npm run test
--schema "path/to/the/schema.json" # specifies the json schema to use
--port 3000 # set the HTTP port to listen to
--data "/mnt/nfs/data" # repository for upload
Property | Type | Description |
---|---|---|
name | String | unique identifier of your api |
title | String | title of the API |
description | String | markdown description |
roles | <Role> | roles hashmap |
types | <ResourceType> | resource types hashmap |
resources | <Resource> | resources hasmap |
Property | Type | Description |
---|---|---|
label | String | unique identifier of your api |
auth | Boolean | title of the API |
admin | Boolean | markdown descripition |
Property | Type | Description |
---|---|---|
defaultState | String | name of the state any request will default to |
states | <State> | hashmap of the states |
permissions | <Role, <State, Method>> | Allowed HTTP methods by role and by state |
Property | type | Description |
---|---|---|
name | String | name of the state any request will default to |
label | String | hashmap of the states |
validate | Boolean | wether the data has to be valid to be saved or not |
Property | type | Description |
---|---|---|
title | String | readable title |
description | String | markdown description |
type | String | name of the ResourceType |
fields | [Object] | list of the fields composing the model |
hooks | [Hook] | list of hooks bound to the resource |
rels | <Rel> | hashmap of relationships |
Property | type | Description |
---|---|---|
path | String | property path |
resource | String | name of the resource it points to (self reference is OK) |
embed | Boolean | resolve relation automatically |
fields | [String] | list of the fields that gets embedded |
Property | type | Description |
---|---|---|
name | String | hook identifier |
uri | String | todo support parameter |
method | String | one of POST GET PUT DELETE |
payload | Boolean | if true and method is POST or PUT , send the data |
on | [String] | list of actions |
states | [String] | list of states |
retry | Number | number of time the HTTP client tries to reach the endpoint |
timeout | Number | number of seconds before the HTTP client hangs up |
headers | <String,String> | hashmap of the request headers |
FAQs
Configurable API for managing and publishing document-oriented content
The npm package campsi receives a total of 0 weekly downloads. As such, campsi popularity was classified as not popular.
We found that campsi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.