Dev

.github/workflows/ci-cd.yml

@@ -0,0 +1,27 @@
+---
+name: "CI/CD: Continuous integration and continuous deployment"
+on: [pull_request]
+permissions:
+  contents: read
+
+jobs:
+  build-check:
+    name: 'Build & check format'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "lts/*"
+          cache: "npm"
+
+      - name: Install NPM dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Check code formatting
+        run: npm run format:check
+
+

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: "Code analysis"
+on:
+  push:
+    branches: [ "production" ]
+  pull_request:
+    branches: [ "production" ]
+  schedule:
+    - cron: '0 8 * * *'
+jobs:
+  analyze:
+    name: Analyze code
+    runs-on: 'ubuntu-latest'
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: JavaScript
+          build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/dependency-scan.yml

@@ -0,0 +1,14 @@
+name: 'Dependency scan'
+on: [pull_request]
+permissions:
+  contents: read
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v4
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: critical

.prettierignore

@@ -0,0 +1,4 @@
+node_modules
+dist
+build
+coverage

.prettierrc

@@ -6,4 +6,4 @@
   "bracketSpacing": true,
   "trailingComma": "es5",
   "tabWidth": 2
-}
+}

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:12-alpine
+FROM node:14-alpine
 
 RUN apk --no-cache add curl
 

package.json

@@ -15,7 +15,9 @@
     "codestyle": "prettier \"src/**/*.{ts,js,json}\" --write",
     "test": "node scripts/test.js",
     "test:ci": "CI=true node scripts/test.js",
-    "test:staged": "CI=true node scripts/test.js --bail --findRelatedTests"
+    "test:staged": "CI=true node scripts/test.js --bail --findRelatedTests",
+    "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,css,md}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,css,md}\""
   },
   "lint-staged": {
     "*.{ts,js}": [
@@ -54,6 +56,7 @@
     "date-fns": "^1.30.1",
     "dotenv": "^6.2.0",
     "express": "^4.17.1",
+    "express-rate-limit": "5.5.1",
     "express-react-views": "^0.11.0",
     "express-session": "^1.17.2",
     "forever": "^0.15.3",
@@ -79,7 +82,7 @@
     "uuid": "^7.0.3"
   },
   "devDependencies": {
-    "@graphql-codegen/cli": "1.8.3",
+    "@graphql-codegen/cli": "^1.21.8",
     "@graphql-codegen/import-types-preset": "1.8.3",
     "@graphql-codegen/typescript": "1.8.3",
     "@graphql-codegen/typescript-resolvers": "1.8.3",
@@ -95,13 +98,21 @@
     "jest": "^24.3.1",
     "jest-haste-map": "^24.5.0",
     "jest-resolve": "^24.5.0",
-    "lint-staged": "^8.1.5",
+    "lint-staged": "^9.0.0",
     "nodemon": "^1.18.10",
-    "prettier": "^2.3.0",
+    "prettier": "^2.8.8",
     "ts-jest": "^24.1.0",
     "ts-node-dev": "^1.1.6",
     "tslint": "^6.1.3",
     "tslint-config-prettier": "^1.18.0",
     "tslint-plugin-prettier": "^2.0.1"
+  },
+  "resolutions": {
+    "underscore": "^1.12.1",
+    "minimist": "^1.2.6",
+    "json-schema": "^0.4.0",
+    "@babel/traverse": "^7.23.2",
+    "form-data": "^4.0.4",
+    "sha.js": "^2.4.12"
   }
 }

src/auth/groupAssignments.ts

@@ -1,3 +1,4 @@
+import validator from 'validator'
 import {
   IUserInfo,
   requestGroups,
@@ -13,6 +14,10 @@ export async function assignUserToGroups(userInfo: IUserInfo): Promise<IUserInfo
     return userInfo
   }
 
+  if (!validator.isEmail(userInfo.email)) {
+    return userInfo
+  }
+
   const settings = await getSettings()
   const domainGroups = settings.domain_groups
   const autoDomainGroups = settings.auto_domain_groups
@@ -31,7 +36,11 @@ export async function assignUserToGroups(userInfo: IUserInfo): Promise<IUserInfo
   )
 
   const sessionGroups = userInfo.groups
-  const emailDomainGroups = assignGroups.filter((dg) => userInfo.email.endsWith(dg.domain))
+  const parsedDomains = userInfo.email.split('@')
+  const emailDomain = parsedDomains[parsedDomains.length - 1]?.toLowerCase()
+  const emailDomainGroups = assignGroups.filter(
+    (dg) => emailDomain === dg.domain.toLowerCase()
+  )
   const groupAssignments = uniq(flatten(emailDomainGroups.map(({ groups }) => groups)))
   const assignToGroups = difference(groupAssignments, sessionGroups)
 

src/constants.ts

@@ -1,5 +1,6 @@
 import { mapValues, orderBy } from 'lodash'
 import fs from 'fs-extra'
+import 'dotenv/config'
 
 const SECRETS_PATH = '/run/secrets/'
 

src/creators/createAreaJourneysResponse.ts

@@ -6,6 +6,7 @@ import {
 } from '../types/generated/schema-types'
 import { CachedFetcher } from '../types/CachedFetcher'
 import { cacheFetch } from '../cache'
+import { ForbiddenError } from 'apollo-server-errors'
 import { groupBy, map } from 'lodash'
 import { createAreaJourneyObject } from '../objects/createAreaJourneyObject'
 import { createBBoxString } from '../utils/createBBoxString'
@@ -47,7 +48,9 @@ export const createAreaJourneysResponse = async (
       (events: Vehicles[]) => createAreaJourneyObject(events)
     )
   }
-
+  if (speedFilter && !user) {
+    throw new ForbiddenError('Authentication required. Please login.')
+  }
   // Cache for when a link containing an area query is shared.
   const cacheKey = `area_journeys_${createBBoxString(bbox)}_${minTime}_${maxTime}_${date}_${
     !!user && unsignedEvents ? 'unsigned' : ''
@@ -58,10 +61,6 @@ export const createAreaJourneysResponse = async (
     return []
   }
 
-  if (speedFilter && !user) {
-    return []
-  }
-
   let hslGroup: boolean = false
   if (user) {
     if (requireUser(user, 'HSL')) {

src/datasources/HFPDataSource.ts

@@ -309,7 +309,7 @@ ORDER BY tst DESC;
   ): Promise<Vehicles[]> {
     const { minLat, maxLat, minLng, maxLng } = bbox
     const speedInMetersPerSecond = speedFilter / 3.6
-
+    maxTime = maxTime.clone().add(4, 'hours')
     const createQuery = (table) => {
       return this.db.raw(
         `

src/objects/createCancellation.ts

@@ -15,7 +15,7 @@ export function createCancellation(cancellation: DBCancellation): Cancellation {
   const cancellationData: CancellationDataType | null = cancellation.data || null
 
   return {
-    id: cancellation.id,
+    id: cancellation.id.toString(),
     routeId: cancellation.route_id,
     direction: getDirection(cancellation.direction_id),
     departureDate: cancellation.start_date,

src/objects/createJourneyEventObject.ts

@@ -356,6 +356,15 @@ export function createPassengerCountEventObject(
   const vehicleLoad = authorized ? event.vehicle_load : null
   const totalPassengersIn = authorized ? event.total_passengers_in : null
   const totalPassengersOut = authorized ? event.total_passengers_out : null
+  const bikesIn = authorized ? event.bikes_in : null
+  const bikesOut = authorized ? event.bikes_out : null
+
+  const wheelchairsIn = authorized ? event.wheelchairs_in : null
+  const wheelchairsOut = authorized ? event.wheelchairs_out : null
+  const pramsIn = authorized ? event.prams_in : null
+  const pramsOut = authorized ? event.prams_out : null
+  const otherIn = authorized ? event.other_in : null
+  const otherOut = authorized ? event.other_out : null
   let vehicleLoadRatioText = 'empty'
 
   if (event.vehicle_load_ratio && event.vehicle_load_ratio >= 0.05) {
@@ -397,6 +406,14 @@ export function createPassengerCountEventObject(
     totalPassengersIn,
     totalPassengersOut,
     vehicleLoadRatioText,
+    bikesIn,
+    bikesOut,
+    wheelchairsIn,
+    wheelchairsOut,
+    pramsIn,
+    pramsOut,
+    otherIn,
+    otherOut,
     _sort: unix,
   }
 }

src/operators.json

@@ -4,7 +4,7 @@
   "6": "Oy Pohjolan Liikenne Ab",
   "7": "Sipoon Linja Oy",
   "10": "Oy Liikenne Ab",
-  "12": "Helsingin Bussiliikenne Oy",
+  "12": "Koiviston Auto Helsinki Oy",
   "17": "Tammelundin Liikenne Oy",
   "18": "Oy Pohjolan Kaupunkiliikenne Ab",
   "19": "Etelä-Suomen Linjaliikenne Oy",
@@ -38,6 +38,7 @@
   "59": "Tilausliikenne Nikkanen Helsinki Oy",
   "60": "Suomenlinnan Liikenne Oy",
   "61": "TTS Työtehoseura",
+  "64": "Taksikuljetus Harri Vuolle Oy",
   "89": "Metropolia",
   "90": "VR Oy",
   "93": "VR-laiturilukijat",

src/schema/Alerts.ts

@@ -164,7 +164,7 @@ export const Alerts = gql`
   }
 
   type Cancellation {
-    id: Int!
+    id: ID!
     routeId: String!
     direction: Direction!
     departureDate: Date!

src/schema/Journey.ts

@@ -89,6 +89,14 @@ export const Journey = gql`
     totalPassengersIn: Int
     totalPassengersOut: Int
     vehicleLoadRatioText: String
+    bikesIn: Int
+    bikesOut: Int
+    wheelchairsIn: Int
+    wheelchairsOut: Int
+    pramsIn: Int
+    pramsOut: Int
+    otherIn: Int
+    otherOut: Int
     _sort: Int
   }
 

src/server.ts

@@ -1,5 +1,6 @@
 import moment from 'moment-timezone'
 import express from 'express'
+import rateLimit from 'express-rate-limit'
 import cors from 'cors'
 import { json } from 'body-parser'
 import { ADMIN_GROUP_NAME, COOKIE_SECRET, SECURE_COOKIE, TZ } from './constants'
@@ -18,6 +19,7 @@ import { getUserFromReq, requireUserMiddleware } from './auth/requireUser'
 import { adminController } from './admin/adminController'
 import { cleanup } from './utils/cleanup'
 import { getKnex } from './knex'
+
 // Set the default timezone for the app
 moment.tz.setDefault(TZ)
 
@@ -63,13 +65,18 @@ type RequestContext = {
 
   const app = express()
 
+  const limiter = rateLimit({
+    windowMs: 1 * 60 * 1000,
+    max: 200,
+  })
+
   app.use(
     cors({
       credentials: true,
       origin: ORIGIN,
     })
   )
-
+  app.use(limiter)
   app.use(json({ limit: '50mb' }))
 
   app.engine('js', createEngine({ transformViews: false }))

src/types/EventsDb.ts

@@ -169,6 +169,14 @@ export type PassengerCount = {
   vehicle_load_ratio: Maybe<number>
   total_passengers_in: Maybe<number>
   total_passengers_out: Maybe<number>
+  bikes_in: Maybe<number>
+  bikes_out: Maybe<number>
+  wheelchairs_in: Maybe<number>
+  wheelchairs_out: Maybe<number>
+  prams_in: Maybe<number>
+  prams_out: Maybe<number>
+  other_in: Maybe<number>
+  other_out: Maybe<number>
 }
 
 export type EventsType =