From f9ee6b5d3b8deefff790d4d5fd52eb413884e6e5 Mon Sep 17 00:00:00 2001 From: George Date: Mon, 19 Oct 2026 12:01:26 -0500 Subject: [PATCH] feat(api): modo solo lectura (SAPB1_SL_READ_ONLY) que rechaza toda escritura hacia el Service Layer Co-Authored-By: Claude Sonnet 5.5 --- apps/api/.env.example | 2 ++ apps/api/src/config/env.schema.ts | 6 ++++ apps/api/src/sl/sl-proxy.service.spec.ts | 37 ++++++++++++++++++++++++ apps/api/src/sl/sl-proxy.service.ts | 8 +++++ 4 files changed, 53 insertions(+) diff --git a/apps/api/.env.example b/apps/api/.env.example index 832b524..005ee16 100644 --- a/apps/api/.env.example +++ b/apps/api/.env.example @@ -22,6 +22,8 @@ SAPB1_SL_TIMEOUT_MS=15000 # Peticiones simultáneas hacia el Service Layer (el resto se encola). En el servidor # de prueba, 1 era lo óptimo (~20 req/s); con 2 o más se degradaba. Medir en cada cliente. SAPB1_SL_MAX_CONCURRENCY=1 +# true = modo solo lectura: el proxy rechaza toda escritura (crear, modificar, acciones). Para una base donde no se debe guardar nada. +SAPB1_SL_READ_ONLY=false # Confianza TLS (elegir según el caso): # 1) Certificado válido de una CA pública -> dejar vacío. diff --git a/apps/api/src/config/env.schema.ts b/apps/api/src/config/env.schema.ts index 50b44bd..b6713d9 100644 --- a/apps/api/src/config/env.schema.ts +++ b/apps/api/src/config/env.schema.ts @@ -50,6 +50,12 @@ export const envSchema = z // CA adicional de confianza (PEM): certificado autofirmado del Service // Layer o CA de un firewall que inspecciona SSL. Opcional. SAPB1_SL_CA_FILE: z.preprocess(emptyToUndefined, z.string().optional()), + // Modo solo lectura: el proxy rechaza toda creación, modificación y acción (las consultas siguen). Para una base + // donde no se debe guardar nada (la de un cliente en revisión). + SAPB1_SL_READ_ONLY: z + .enum(['true', 'false']) + .default('false') + .transform((v) => v === 'true'), SAPB1_SL_VERIFY_SSL: z .enum(['true', 'false']) .default('true') diff --git a/apps/api/src/sl/sl-proxy.service.spec.ts b/apps/api/src/sl/sl-proxy.service.spec.ts index cb1798c..b0f8e84 100644 --- a/apps/api/src/sl/sl-proxy.service.spec.ts +++ b/apps/api/src/sl/sl-proxy.service.spec.ts @@ -1,6 +1,7 @@ import { ForbiddenException } from '@nestjs/common'; import { vi } from 'vitest'; import type { AuditService } from '../audit/audit.service.js'; +import type { AppConfigService } from '../config/app-config.service.js'; import type { AuthUser } from '../auth/auth.types.js'; import type { PermissionsService } from '../permissions/permissions.service.js'; import type { SapClientService } from '../sap/sap-client.service.js'; @@ -114,3 +115,39 @@ describe('SlProxyService: auditoría', () => { }); }); }); + +describe('SlProxyService: modo solo lectura', () => { + const make = (readOnly: boolean) => { + const request = vi.fn(async () => ({ data: { value: [] } })); + const record = vi.fn(async () => undefined); + const service = new SlProxyService( + { request } as unknown as SapClientService, + { getPaths: async () => ['*'] } as unknown as PermissionsService, + { record } as unknown as AuditService, + { get: (k: string) => (k === 'SAPB1_SL_READ_ONLY' ? readOnly : undefined) } as unknown as AppConfigService, + ); + return { service, request, record }; + }; + + it('rechaza crear, modificar y las acciones sin llegar a SAP, y lo audita', async () => { + const { service, request, record } = make(true); + await expect(service.create(user, 'Orders', { CardCode: 'C1' }, {}, '10.0.0.5')).rejects.toThrow('solo lectura'); + await expect(service.update(user, 'Orders', '1', { Comments: 'x' }, {}, '10.0.0.5')).rejects.toThrow('solo lectura'); + await expect(service.action(user, 'IncomingPayments', '1', 'Cancel', '10.0.0.5')).rejects.toThrow('solo lectura'); + expect(request).not.toHaveBeenCalled(); + expect(record).toHaveBeenCalledWith(expect.objectContaining({ action: 'sl_denied', outcome: 'denied' })); + }); + + it('las consultas y las acciones de solo consulta (series) siguen funcionando', async () => { + const { service, request } = make(true); + await service.list(user, 'Orders', {}, {}); + await service.create(user, 'SeriesService_GetDocumentSeries', { DocumentTypeParams: { Document: '30' } }, {}, '10.0.0.5'); + expect(request).toHaveBeenCalledTimes(2); + }); + + it('sin el modo solo lectura todo sigue igual', async () => { + const { service, request } = make(false); + await service.create(user, 'Orders', { CardCode: 'C1' }, {}, '10.0.0.5'); + expect(request).toHaveBeenCalledTimes(1); + }); +}); diff --git a/apps/api/src/sl/sl-proxy.service.ts b/apps/api/src/sl/sl-proxy.service.ts index d9fedda..e2771d6 100644 --- a/apps/api/src/sl/sl-proxy.service.ts +++ b/apps/api/src/sl/sl-proxy.service.ts @@ -8,6 +8,7 @@ import { import { isPathAllowed } from '@basic-erp/sap-types'; import { AuditService, keyOfCreated, summarizeBody } from '../audit/audit.service.js'; import type { AuthUser } from '../auth/auth.types.js'; +import { AppConfigService } from '../config/app-config.service.js'; import { PermissionsService } from '../permissions/permissions.service.js'; import { SapClientService } from '../sap/sap-client.service.js'; import { @@ -36,6 +37,7 @@ export class SlProxyService { private readonly sap: SapClientService, private readonly permissions: PermissionsService, private readonly audit: AuditService, + private readonly config?: AppConfigService, ) {} async list(user: AuthUser, name: string, query: ListQuery, headers: Headers) { @@ -116,6 +118,12 @@ export class SlProxyService { if (!resource.methods.includes(method)) { throw new MethodNotAllowedException(`${method} no está permitido para ${resource.name}`); } + // Una escritura real (no una acción de solo consulta, `write: null`) no pasa si la base está en solo lectura. + if (method !== 'GET' && resource.write !== null && this.config?.get('SAPB1_SL_READ_ONLY')) { + this.logger.warn(`${user.webUser}: ${method} ${resource.name} rechazado (modo solo lectura)`); + await this.audit.record({ action: 'sl_denied', webUser: user.webUser, ip, resource: resource.name, outcome: 'denied', detail: { method, reason: 'read_only' } }); + throw new ForbiddenException('La base está en modo solo lectura: no se puede guardar.'); + } const required = method === 'GET' ? resource.read : resource.write; if (required !== null) { const patterns = await this.permissions.getPaths(user.webUser);