
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
public-api-proxy
Advanced tools
The abstraction layer between the public api and integration-hub that accounts for data mapping and traffic shuffling
The public api proxy is built with babel. The npm start script will run the compiled code directly, while invoking nodemon app.js will use the babel require hook for simplicity as you don't have to worry about making sure the build step is being ran.
Each route should be in a routes folder under the desired resource. hapi-router will load routes dynamically. Routes should be separated by the action being performed on the resource.
Example: Creating a tax has a route for sending the contract, and a route for checking the status of the asynchronous operation. Those routes could potentially be in a create.js file in the taxes/routes directory.
All handler code should typically remain in the handler function of the route object. If extensive logic is needed and would otherwise make the route object hard to read/change, move the handler function into a controller.js file.
Schemas, unless trivial, should live in a schemas folder to keep route definitions as minimal and clean as possible.
You should also take note that any route withe the api tag will return a wrapped response on a successful transaction consisting of the url that was called and the response in a data property. Errors will be sent to the user without being wrapped.
There are 2 steps required in order for the swagger plugins to pick up new routes and render them correctly:
{
method: {String|Array<string>},
path: String,
config: {
description: ''
tags: ['api', ...], // Tags should also include the primary resource (e.g. hub-taxes, mkt-units, etc)
// Note: the primary resource tag must also be added to the ui plugin (see step 2)
validate: {
/*
* Any validation for the route, query, or payload parameter/properties
*/
}
response: {
schema: Joi.object().description('')
}
},
handler: // Any function that takes the req[uest] and the reply
}
defaultTags section of the desired api hapi-swaggered-ui plugin config:server/plugins/hapiSwaggeredUiHubApi.jsserver/plugins/hapiSwaggeredUiMktApi.js{
register: require('@leisurelink/hapi-swaggered-ui'),
options: {
...
defaultTags: [
'hub-pmcs',
'hub-promotions',
//Add new primary resource route tags here to include in documentation
]
...
}
}
To add a new plugin, you can take 1 of 2 steps
plugins collections in plugins/index.js and then run npm run build. Use this step if the plugin requires no extra configurationWith trying to keep confusion at a minimum, index.js files only responsibility should be to gather all other files in the directory and export them back out. Think of index files as a manifest for the directory.
If a directory contains only one file and only ever contains one file, remove the directory and just name the js file the same as the directory.
This helps avoid the scenario when developing of having 10 different index.js files open at once and cycling through all of them to find the one you want
A convenience function has been implemented in mod.js that takes a directory, usually __dirname, requires all the .js or .json files in that directory (excluding index.js, and returns an object keyed by the file name. Index files should be as simple as
import load from 'mod.js'
export default load(__dirname);
Unit Tests should be separated by the same structure as the file they're testing, so if testing taxes routes, the test directory would be tests/supply/v2/pmcs/taxes/{filename}.tests.js
The server object is a global defined in tests/server.tests.js to avoid the problem of walking the directory structure and requiring the server in every test file.
FAQs
The abstraction layer between the public api and integration-hub that accounts for data mapping and traffic shuffling
We found that public-api-proxy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.