1 /*
2  *  Make.org Core API
3  *  Copyright (C) 2018 Make.org
4  *
5  * This program is free software: you can redistribute it and/or modify
6  *  it under the terms of the GNU Affero General Public License as
7  *  published by the Free Software Foundation, either version 3 of the
8  *  License, or (at your option) any later version.
9  *
10  *  This program is distributed in the hope that it will be useful,
11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  *  GNU Affero General Public License for more details.
14  *
15  *  You should have received a copy of the GNU Affero General Public License
16  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
17  *
18  */
19 
20 package org.make.api.technical
21 
22 import com.google.common.io.{Files => GFiles}
23 import akka.http.scaladsl.model._
24 import akka.http.scaladsl.model.headers._
25 import akka.http.scaladsl.server.AuthenticationFailedRejection.{CredentialsMissing, CredentialsRejected}
26 import akka.http.scaladsl.server._
27 import akka.http.scaladsl.server.directives.BasicDirectives
28 import de.heikoseeberger.akkahttpcirce.ErrorAccumulatingCirceSupport
29 import enumeratum.values.{StringEnum, StringEnumEntry}
30 import kamon.instrumentation.akka.http.TracingDirectives
31 import org.make.api.MakeApi
32 import org.make.api.Predef._
33 import org.make.api.extensions.MakeSettingsComponent
34 import org.make.api.operation.OperationServiceComponent
35 import org.make.api.question.QuestionServiceComponent
36 import org.make.api.sessionhistory.SessionHistoryCoordinatorServiceComponent
37 import org.make.api.technical.MakeDirectives.MakeDirectivesDependencies
38 import org.make.api.technical.auth.{MakeAuthentication, MakeDataHandlerComponent, TokenResponse}
39 import org.make.api.technical.directives.ValidationDirectives
40 import org.make.api.technical.directives.FutureDirectivesExtensions._
41 import org.make.api.technical.monitoring.MonitoringUtils
42 import org.make.api.technical.security.{SecurityConfigurationComponent, SecurityHelper}
43 import org.make.api.technical.storage.Content
44 import org.make.api.technical.storage.Content.FileContent
45 import org.make.api.technical.tracing.Tracing
46 import org.make.core.Validation.{validateField, validateUploadFileName}
47 import org.make.core.auth.{Token, UserRights}
48 import org.make.core.operation.{OperationId, SimpleOidcConfiguration}
49 import org.make.core.question.QuestionId
50 import org.make.core.reference.Country
51 import org.make.core.session.{SessionId, VisitorId}
52 import org.make.core.user.Role.{RoleAdmin, RoleModerator, RoleOperator, RoleSuperAdmin}
53 import org.make.core.user.{Role, UserId}
54 import org.make.core._
55 import scalaoauth2.provider.AuthInfo
56 
57 import java.io.File
58 import java.net.URLDecoder
59 import java.nio.file.Files
60 import java.time.ZonedDateTime
61 import scala.concurrent.Future
62 import scala.concurrent.duration.DurationInt
63 import scala.util.{Failure, Success, Try}
64 
65 trait MakeDirectives
66     extends Directives
67     with ErrorAccumulatingCirceSupport
68     with CirceFormatters
69     with TracingDirectives
70     with ValidationDirectives {
71   this: MakeDirectivesDependencies =>
72   import MakeDirectives._
73 
74   lazy val authorizedUris: Seq[String] = makeSettings.authorizedCorsUri
75   lazy val mandatoryConnection: Boolean = makeSettings.mandatoryConnection
76 
77   def requestId: Directive1[String] = BasicDirectives.provide(idGenerator.nextId())
78 
79   def startTime: Directive1[Long] = BasicDirectives.provide(System.currentTimeMillis())
80 
81   def optionalCookieValue(cookieName: String, applicationName: Option[ApplicationName]): Directive1[Option[String]] = {
82     if (usesCookies(applicationName)) {
83       optionalCookie(cookieName).map(_.map(_.value))
84     } else {
85       provide(None)
86     }
87   }
88 
89   /**
90     * sessionId is set in cookie and header
91     * for web app and native app respectively
92     */
93   def maybeSessionId(applicationName: Option[ApplicationName]): Directive1[Option[SessionId]] = {
94     (for {
95       maybeCookieSessionId <- optionalCookieValue(makeSettings.SessionCookie.name, applicationName)
96       maybeHeaderSessionId <- optionalNonEmptySanitizedHeaderValueByName(`X-Session-Id`.name)
97     } yield maybeCookieSessionId.orElse(maybeHeaderSessionId)).map(_.map(SessionId(_)))
98   }
99 
100   def getCurrentSessionId(applicationName: Option[ApplicationName]): Directive1[SessionId] = {
101     maybeSessionId(applicationName).flatMap {
102       case None => provide(idGenerator.nextSessionId())
103       case Some(id) =>
104         val newSessionId = idGenerator.nextSessionId()
105         onComplete(sessionHistoryCoordinatorService.getCurrentSessionId(id, newSessionId)).flatMap {
106           case Success(currentSessionId) => provide(currentSessionId)
107           case Failure(e)                => failWith(e)
108         }
109     }
110   }
111 
112   /**
113     * visitorId is set in cookie and header
114     * for web app and native app respectively
115     */
116   def visitorId: Directive1[String] = {
117     for {
118       maybeCookieVisitorId <- optionalCookie(makeSettings.VisitorCookie.name)
119       maybeVisitorId       <- optionalNonEmptySanitizedHeaderValueByName(`X-Visitor-Id`.name)
120     } yield maybeCookieVisitorId.map(_.value).orElse(maybeVisitorId).getOrElse(idGenerator.nextVisitorId().value)
121   }
122 
123   def visitorCreatedAt: Directive1[ZonedDateTime] =
124     for {
125       maybeCookieValue <- optionalCookie(makeSettings.VisitorCookie.createdAtName)
126       maybeHeaderValue <- optionalNonEmptyHeaderValueByName(`X-Visitor-CreatedAt`.name)
127     } yield {
128       maybeCookieValue
129         .map(_.value)
130         .orElse(maybeHeaderValue)
131         .flatMap(creation => Try(ZonedDateTime.parse(creation)).toOption)
132         .getOrElse(DateHelper.now())
133     }
134 
135   def checkEndpointAccess(userRights: Option[UserRights], endpointType: EndpointType): Directive0 = {
136     if (mandatoryConnection) {
137       checkMandatoryConnectionEndpointAccess(userRights, endpointType)
138     } else {
139       pass
140     }
141   }
142 
143   def checkMandatoryConnectionEndpointAccess(userRights: Option[UserRights], endpointType: EndpointType): Directive0 = {
144     endpointType match {
145       case EndpointType.Public   => pass
146       case EndpointType.CoreOnly => reject(AuthorizationFailedRejection)
147       case EndpointType.Regular =>
148         userRights match {
149           case Some(UserRights(_, _, _, true, _)) => pass
150           // Reject request if email is not verified
151           case Some(UserRights(_, _, _, false, _)) => reject(EmailNotVerifiedRejection)
152           case None =>
153             reject(AuthenticationFailedRejection(cause = CredentialsMissing, challenge = HttpChallenges.oAuth2(realm)))
154         }
155     }
156   }
157 
158   private def checkGetParametersHeader(headerValues: Option[Map[String, String]]): Directive0 = {
159     val getParametersHeaderAllowedValues = Set(
160       "source",
161       "utm_campaign",
162       "utm_content",
163       "utm_medium",
164       "utm_source",
165       "utm_term",
166       "country",
167       "introCard",
168       "pushProposal",
169       "question",
170       "signUpCard",
171       "firstProposal",
172       "widgetId",
173       "language",
174       "questionSlug",
175       "hash"
176     )
177 
178     headerValues match {
179       case None => pass
180       case Some(values) =>
181         if ((values.keySet & getParametersHeaderAllowedValues).size != values.keySet.size)
182           reject(GetParametersRejection)
183         else pass
184     }
185   }
186 
187   def addMaybeRefreshedSecureCookie(
188     applicationName: Option[ApplicationName],
189     tokenRefreshed: Option[Token]
190   ): Directive0 = {
191     addDefaultCookies(
192       applicationName,
193       Seq(
194         tokenRefreshed.map(
195           token =>
196             HttpCookie(
197               name = makeSettings.SecureCookie.name,
198               value = token.accessToken,
199               secure = makeSettings.SecureCookie.isSecure,
200               httpOnly = true,
201               // In order to have auto-refresh work we need to keep this cookie until the refresh token expires
202               // Since the refresh is not mandatory, we need to take the one with the longest lifetime
203               maxAge = Some(Math.max(token.refreshExpiresIn, token.expiresIn)),
204               path = Some("/")
205             ).withSameSite(SameSite.Strict)
206         ),
207         tokenRefreshed.map(
208           token =>
209             HttpCookie(
210               name = makeSettings.SecureCookie.expirationName,
211               value = DateHelper.format(token.createdAt.getOrElse(DateHelper.now()).plusSeconds(token.refreshExpiresIn)),
212               secure = makeSettings.SecureCookie.isSecure,
213               httpOnly = false,
214               maxAge = Some(365.days.toSeconds),
215               path = Some("/")
216             ).withSameSite(SameSite.Strict)
217         )
218       ).collect { case Some(cookie) => cookie }
219     )
220   }
221 
222   def addCorsHeaders(origin: Option[String]): Directive0 = {
223     respondWithDefaultHeaders {
224       defaultCorsHeaders(origin)
225     }
226   }
227 
228   def addSecurityHeaders(): Directive0 = {
229     respondWithDefaultHeaders {
230       Seq[HttpHeader](
231         `X-Content-Type-Options`("nosniff"),
232         `Strict-Transport-Security`("max-age=31536000; includeSubDomains"),
233         `Content-Security-Policy`(
234           "default-src 'self';" +
235             "script-src 'self' 'unsafe-inline' https://*.google.com;" +
236             "connect-src 'self' https://*.googleapis.com https://*.google.com https://*.gstatic.com;" +
237             "style-src 'self' 'unsafe-inline' https://stackpath.bootstrapcdn.com https://fonts.googleapis.com;" +
238             "img-src 'self' https://*.googleusercontent.com https://*.gstatic.com;" +
239             "frame-src https://accounts.google.com;"
240         ) // script and style used by authentication/index.html
241       )
242     }
243   }
244 
245   def addMakeHeaders(
246     applicationName: Option[ApplicationName],
247     requestId: String,
248     routeName: String,
249     sessionId: String,
250     visitorId: String,
251     visitorCreatedAt: ZonedDateTime,
252     startTime: Long,
253     externalId: String,
254     anonymize: Boolean
255   ): Directive0 = {
256     if (anonymize) {
257       respondWithDefaultHeaders {
258         Seq[HttpHeader](
259           `X-Route-Time`(startTime),
260           `X-Request-Id`(requestId),
261           `X-Route-Name`(routeName),
262           `X-Make-External-Id`(externalId)
263         )
264       }
265     } else {
266       val sessionExpirationDate =
267         DateHelper.format(DateHelper.now().plusSeconds(makeSettings.SessionCookie.lifetime.toSeconds))
268       respondWithDefaultHeaders {
269         Seq[HttpHeader](
270           `X-Route-Time`(startTime),
271           `X-Request-Id`(requestId),
272           `X-Route-Name`(routeName),
273           `X-Make-External-Id`(externalId),
274           `X-Session-Id`(sessionId),
275           `X-Session-Id-Expiration`(sessionExpirationDate),
276           `X-Visitor-Id`(visitorId),
277           `X-Visitor-CreatedAt`(DateHelper.format(visitorCreatedAt))
278         )
279       }.tflatMap { _ =>
280         addDefaultCookies(
281           applicationName,
282           Seq(
283             HttpCookie(
284               name = makeSettings.SessionCookie.name,
285               value = sessionId,
286               secure = makeSettings.SessionCookie.isSecure,
287               httpOnly = true,
288               maxAge = Some(makeSettings.SessionCookie.lifetime.toSeconds),
289               path = Some("/")
290             ).withSameSite(SameSite.Strict),
291             HttpCookie(
292               name = makeSettings.SessionCookie.expirationName,
293               value = sessionExpirationDate,
294               secure = makeSettings.SessionCookie.isSecure,
295               httpOnly = false,
296               maxAge = None,
297               path = Some("/")
298             ).withSameSite(SameSite.Strict),
299             HttpCookie(
300               name = makeSettings.VisitorCookie.name,
301               value = visitorId,
302               secure = makeSettings.VisitorCookie.isSecure,
303               httpOnly = true,
304               maxAge = Some(365.days.toSeconds),
305               path = Some("/")
306             ).withSameSite(SameSite.Strict),
307             HttpCookie(
308               name = makeSettings.VisitorCookie.createdAtName,
309               value = DateHelper.format(visitorCreatedAt),
310               secure = makeSettings.VisitorCookie.isSecure,
311               httpOnly = true,
312               maxAge = Some(365.days.toSeconds),
313               path = Some("/")
314             ).withSameSite(SameSite.Strict)
315           )
316         )
317       }
318     }
319   }
320 
321   private def connectIfNecessary(
322     sessionId: SessionId,
323     maybeUserId: Option[UserId],
324     requestContext: org.make.core.RequestContext
325   ): Unit = {
326     maybeUserId.foreach(userId => sessionHistoryCoordinatorService.convertSession(sessionId, userId, requestContext))
327   }
328 
329   def checkTokenExpirationIfNoCookieIsDefined(
330     maybeUser: Option[AuthInfo[UserRights]],
331     applicationName: Option[ApplicationName]
332   ): Directive0 = {
333     mapInnerRoute { route =>
334       maybeUser match {
335         // If a user has been found, the token is valid and the route can continue
336         case Some(_) => route
337         case _ =>
338           secureCookieValue(applicationName) {
339             // If the make-secure cookie is used, then rely on the cookie and auto-refresh mecanism
340             case Some(_) => route
341             case None =>
342               optionalHeaderValueByType(Authorization) {
343                 // If there is a OAuth2 bearer token, then it is either not found or expired
344                 case Some(Authorization(OAuth2BearerToken(_))) =>
345                   reject(AuthenticationFailedRejection(CredentialsRejected, HttpChallenges.oAuth2(realm)))
346                 // If no authentication is sent or it is not OAuth, continue
347                 case _ => route
348               }
349           }
350       }
351     }
352   }
353 
354   private def parseGetParametersHeader(maybeGetParametersRaw: Option[String]): Option[Map[String, String]] = {
355     maybeGetParametersRaw.map(
356       _.split("&")
357         .map(_.split("=", 2))
358         .map {
359           case Array(key, value) => key -> value
360           case Array(key)        => key -> ""
361         }
362         .toMap
363     )
364   }
365 
366   def makeOperation(
367     name: String,
368     endpointType: EndpointType = EndpointType.Regular,
369     anonymize: Boolean = false
370   ): Directive1[org.make.core.RequestContext] = {
371     val slugifiedName: String = SlugHelper(name)
372     Tracing.entrypoint(slugifiedName)
373 
374     for {
375       requestId <- requestId
376       _         <- operationName(slugifiedName)
377       origin    <- optionNonEmptyURLHeaderValueByName(Origin.name)
378       _         <- addCorsHeaders(origin)
379       _         <- encodeResponse
380       startTime <- startTime
381       maybeApplicationName <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-App-Name`.name)
382         .map(_.flatMap(ApplicationName.withValueOpt))
383       visitorId        <- visitorId
384       visitorCreatedAt <- visitorCreatedAt
385       externalId       <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-External-Id`.name).map(_.getOrElse(requestId))
386       currentSessionId <- getCurrentSessionId(maybeApplicationName)
387       _ <- addMakeHeaders(
388         maybeApplicationName,
389         requestId,
390         slugifiedName,
391         currentSessionId.value,
392         visitorId,
393         visitorCreatedAt,
394         startTime,
395         externalId,
396         anonymize
397       )
398       _                     <- addSecurityHeaders()
399       _                     <- handleExceptions(MakeApi.exceptionHandler(slugifiedName, requestId))
400       _                     <- handleRejections(MakeApi.rejectionHandler)
401       maybeTokenRefreshed   <- makeTriggerAuthRefreshFromCookie(maybeApplicationName)
402       _                     <- addMaybeRefreshedSecureCookie(maybeApplicationName, maybeTokenRefreshed)
403       _                     <- makeAuthCookieHandlers(maybeTokenRefreshed, maybeApplicationName)
404       maybeIpAddress        <- extractIpAndHash
405       maybeUser             <- optionalMakeOAuth2
406       _                     <- checkTokenExpirationIfNoCookieIsDefined(maybeUser, maybeApplicationName)
407       _                     <- checkEndpointAccess(maybeUser.map(_.user), endpointType)
408       maybeUserAgent        <- optionalNonEmptyHeaderValueByName(`User-Agent`.name)
409       maybeOperation        <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Operation`.name)
410       maybeSource           <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Source`.name)
411       maybeLocation         <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Location`.name)
412       maybeQuestion         <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Question`.name)
413       maybeQuestionSlug     <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Question-Slug`.name)
414       maybeCountry          <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Country`.name)
415       maybeDetectedCountry  <- optionalNonEmptySanitizedHeaderValueByName(`X-Detected-Country`.name)
416       maybeLanguage         <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Language`.name)
417       maybeQuestionLanguage <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Question-Language`.name)
418       maybeProposalLanguage <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Proposal-Language`.name)
419       maybeClientLanguage   <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Client-Language`.name)
420       maybeHostName         <- optionalNonEmptySanitizedHeaderValueByName(`X-Hostname`.name)
421       maybeGetParametersRaw <- optionalNonEmptyHeaderValueByName(`X-Get-Parameters`.name)
422       maybeGetParameters    <- provide(parseGetParametersHeader(maybeGetParametersRaw))
423       _                     <- checkGetParametersHeader(maybeGetParameters)
424       maybeQuestionId       <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Question-Id`.name)
425       maybeReferrer         <- optionalNonEmptySanitizedHeaderValueByName(`X-Make-Referrer`.name)
426       maybeCustomData       <- optionalNonEmptyHeaderValueByName(`X-Make-Custom-Data`.name)
427     } yield {
428       val requestContext = RequestContext(
429         userId = maybeUser.map(_.user.userId),
430         requestId = requestId,
431         sessionId = currentSessionId,
432         visitorId = Some(VisitorId(visitorId)),
433         visitorCreatedAt = Some(visitorCreatedAt),
434         externalId = externalId,
435         operationId = maybeOperation.map(OperationId(_)),
436         source = maybeSource,
437         location = maybeLocation,
438         questionContext = RequestContextQuestion(
439           question = maybeQuestion,
440           questionSlug = maybeQuestionSlug,
441           questionId = maybeQuestionId.map(QuestionId(_))
442         ),
443         languageContext = RequestContextLanguage(
444           language = maybeLanguage.map(reference.Language(_)),
445           questionLanguage = maybeQuestionLanguage.map(reference.Language(_)),
446           proposalLanguage = maybeProposalLanguage.map(reference.Language(_)),
447           clientLanguage = maybeClientLanguage.map(reference.Language(_))
448         ),
449         country = maybeCountry.map(Country(_)),
450         detectedCountry = maybeDetectedCountry.map(Country(_)),
451         hostname = maybeHostName,
452         ipAddress = maybeIpAddress.map(_.ip),
453         ipAddressHash = maybeIpAddress.map(_.hash),
454         getParameters = maybeGetParameters,
455         userAgent = maybeUserAgent,
456         applicationName = maybeApplicationName,
457         referrer = maybeReferrer,
458         customData = maybeCustomData
459           .map(
460             customData =>
461               URLDecoder
462                 .decode(customData, "UTF-8")
463                 .split(",")
464                 .map(_.split("=", 2))
465                 .map {
466                   case Array(key, value) => key.trim -> value.trim
467                   case Array(key)        => key.trim -> ""
468                 }
469                 .toMap
470           )
471           .getOrElse(Map.empty)
472       )
473       MonitoringUtils.logRequest(name, requestContext, origin)
474       connectIfNecessary(currentSessionId, maybeUser.map(_.user.userId), requestContext)
475       requestContext
476     }
477   }
478 
479   def getMakeHttpOrigin(mayBeOriginValue: Option[String]): Option[HttpOrigin] = {
480     mayBeOriginValue.flatMap { origin =>
481       if (authorizedUris.contains(origin)) {
482         val originUri = Uri(origin)
483         Some(HttpOrigin(originUri.scheme, Host(originUri.authority.host, originUri.authority.port)))
484       } else {
485         None
486       }
487     }
488   }
489 
490   def defaultCorsHeaders(originValue: Option[String]): Seq[HttpHeader] = {
491 
492     val mayBeOriginValue: Option[HttpOrigin] = getMakeHttpOrigin(originValue)
493 
494     Seq[ModeledHeader](
495       `Access-Control-Allow-Methods`(
496         HttpMethods.POST,
497         HttpMethods.GET,
498         HttpMethods.PUT,
499         HttpMethods.PATCH,
500         HttpMethods.DELETE
501       ),
502       `Access-Control-Allow-Credentials`(true),
503       `Access-Control-Expose-Headers`(
504         Seq(
505           `X-Request-Id`.name,
506           `X-Route-Name`.name,
507           `X-Route-Time`.name,
508           `X-Make-External-Id`.name,
509           `X-Session-Id`.name,
510           `X-Session-Id-Expiration`.name,
511           `X-Total-Count`.name,
512           `X-Visitor-CreatedAt`.name,
513           `X-Visitor-Id`.name
514         )
515       )
516     ) ++ mayBeOriginValue.map { httpOrigin =>
517       `Access-Control-Allow-Origin`(origin = httpOrigin)
518     }
519 
520   }
521 
522   def makeAuthCookieHandlers(maybeRefreshedToken: Option[Token], applicationName: Option[ApplicationName]): Directive0 =
523     mapInnerRoute { route =>
524       secureCookieValue(applicationName) {
525         case Some(secureCookie) =>
526           val credentials: OAuth2BearerToken = maybeRefreshedToken match {
527             case Some(refreshedToken) => OAuth2BearerToken(refreshedToken.accessToken)
528             case None                 => OAuth2BearerToken(secureCookie)
529           }
530           mapRequest((request: HttpRequest) => request.addCredentials(credentials)) {
531             route
532           }
533         case None => route
534       }
535     }
536 
537   def makeTriggerAuthRefreshFromCookie(applicationName: Option[ApplicationName]): Directive1[Option[Token]] =
538     secureCookieValue(applicationName).flatMap {
539       case Some(secureCookie) =>
540         oauth2DataHandler.refreshIfTokenIsExpired(secureCookie).asDirective
541       case None => provide[Option[Token]](None)
542     }
543 
544   def corsHeaders(): Directive0 =
545     mapInnerRoute { route =>
546       optionNonEmptyURLHeaderValueByName(Origin.name) { mayBeOriginHeaderValue =>
547         respondWithDefaultHeaders(defaultCorsHeaders(mayBeOriginHeaderValue)) {
548           optionalHeaderValueByType(`Access-Control-Request-Headers`) {
549             case Some(requestHeader) =>
550               respondWithDefaultHeader(`Access-Control-Allow-Headers`(requestHeader.value)) {
551                 route
552               }
553             case None => route
554           }
555         }
556       }
557     }
558 
559   private val SupportedImageExtensions = Set("jpg", "jpeg", "jfif", "pjpeg", "pjp", "png", "webp", "svg")
560 
561   def uploadImageAsync(
562     imageFieldName: String,
563     uploadFile: (String, String, Content) => Future[String],
564     sizeLimit: Option[Long]
565   ): Directive[(String, File)] =
566     sizeLimit
567       .fold(withoutSizeLimit)(withSizeLimit)
568       .tflatMap { _ =>
569         storeUploadedFile(
570           imageFieldName,
571           fileInfo => Files.createTempFile("makeapi", GFiles.getFileExtension(fileInfo.fileName)).toFile
572         )
573       }
574       .tflatMap {
575         case (info, file) =>
576           file.deleteOnExit()
577           val contentType = info.contentType
578           Validation.validate(
579             validateField(imageFieldName, "invalid_format", contentType.mediaType.isImage, "File must be an image"),
580             validateUploadFileName(info.fileName)
581           )
582           val fileExtension = GFiles.getFileExtension(info.fileName)
583           if (!SupportedImageExtensions.contains(fileExtension))
584             failWith(
585               ValidationFailedError(
586                 Seq(
587                   ValidationError("file_extension", "unsupported", Some(s"Image type '$fileExtension' not supported"))
588                 )
589               )
590             )
591           else
592             uploadFile(info.fileName, contentType.value, FileContent(file)).asDirective.map((_, file))
593       }
594 
595   def uploadPDFAsync(
596     pdfFieldName: String,
597     uploadFile: (String, String, Content) => Future[String]
598   ): Directive[(String, File)] =
599     withSizeLimit(16777216).tflatMap { _ =>
600       storeUploadedFile(
601         pdfFieldName,
602         fileInfo => Files.createTempFile("makeapi", GFiles.getFileExtension(fileInfo.fileName)).toFile
603       )
604     }.tflatMap {
605       case (info, file) =>
606         file.deleteOnExit()
607         val contentType = info.contentType
608         Validation.validate(
609           validateField(
610             pdfFieldName,
611             "invalid_format",
612             contentType.mediaType == MediaTypes.`application/pdf`,
613             "File must be a pdf"
614           ),
615           validateUploadFileName(info.fileName)
616         )
617         uploadFile(info.fileName, contentType.value, FileContent(file)).asDirective.map((_, file))
618     }
619 
620   def setMakeSecure(applicationName: Option[ApplicationName], token: TokenResponse, userId: UserId): Directive0 = {
621     var alreadySet = false
622     mapResponseHeaders { responseHeaders =>
623       alreadySet = responseHeaders.exists {
624         case `Set-Cookie`(cookie) => cookie.name == makeSettings.SecureCookie.name
625         case _                    => false
626       }
627       responseHeaders
628     }
629     if (!alreadySet) {
630       addCookies(
631         applicationName,
632         Seq(
633           HttpCookie(
634             name = makeSettings.SecureCookie.name,
635             value = token.accessToken,
636             secure = makeSettings.SecureCookie.isSecure,
637             httpOnly = true,
638             // In order to have auto-refresh work we need to keep this cookie until the refresh token expires
639             // Since the refresh is not mandatory, we need to take the one with the longest lifetime
640             maxAge = Some(Math.max(token.refreshExpiresIn.getOrElse(token.expiresIn), token.expiresIn)),
641             path = Some("/")
642           ).withSameSite(SameSite.Strict),
643           HttpCookie(
644             name = makeSettings.SecureCookie.expirationName,
645             value = DateHelper.format(
646               ZonedDateTime
647                 .parse(token.createdAt)
648                 .plusSeconds(token.refreshExpiresIn.getOrElse(token.expiresIn))
649             ),
650             secure = makeSettings.SecureCookie.isSecure,
651             httpOnly = false,
652             maxAge = Some(365.days.toSeconds),
653             path = Some("/")
654           ).withSameSite(SameSite.Strict),
655           HttpCookie(
656             name = makeSettings.UserIdCookie.name,
657             value = userId.value,
658             secure = makeSettings.UserIdCookie.isSecure,
659             httpOnly = true,
660             maxAge = Some(365.days.toSeconds),
661             path = Some("/")
662           ).withSameSite(SameSite.Strict)
663         )
664       )
665     } else {
666       Directive.Empty
667     }
668   }
669 
670   val addCookies: (Option[ApplicationName], Seq[HttpCookie]) => Directive0 =
671     addCookiesHeaders(respondWithHeaders)
672 
673   val addDefaultCookies: (Option[ApplicationName], Seq[HttpCookie]) => Directive0 =
674     addCookiesHeaders(respondWithDefaultHeaders)
675 
676   private def addCookiesHeaders(
677     f: Seq[HttpHeader] => Directive0
678   ): (Option[ApplicationName], Seq[HttpCookie]) => Directive0 = { (applicationName, cookies) =>
679     if (usesCookies(applicationName)) {
680       f(cookies.map(`Set-Cookie`.apply))
681     } else {
682       Directive.Empty
683     }
684   }
685 
686   def usesCookies(applicationName: Option[ApplicationName]): Boolean = {
687     applicationName match {
688       case Some(ApplicationName.Backoffice | ApplicationName.AssemblyBackoffice | ApplicationName.Widget) => false
689       case _                                                                                              => true
690     }
691   }
692 
693   def extractIpAndHash: Directive1[Option[IpAndHash]] = {
694     extractClientIP.map(
695       _.toOption.map(
696         addr =>
697           IpAndHash(
698             IpAndHash.obfuscateIp(addr.getHostAddress),
699             SecurityHelper.generateHash(addr.getHostAddress, securityConfiguration.secureHashSalt)
700           )
701       )
702     )
703   }
704 
705   implicit def stringEnumPathMatcher[A <: StringEnumEntry](stringEnum: StringEnum[A]): PathMatcher1[A] =
706     Segment.flatMap(stringEnum.withValueOpt)
707 }
708 
709 object MakeDirectives {
710   type MakeDirectivesDependencies = IdGeneratorComponent
711     with MakeSettingsComponent
712     with MakeAuthentication
713     with SessionHistoryCoordinatorServiceComponent
714     with SecurityConfigurationComponent
715     with MakeDataHandlerComponent
716 
717   def optionalNonEmptyHeaderValueByName(headerName: String): Directive1[Option[String]] = {
718     optionalHeaderValueByName(headerName).map {
719       case Some("") => None
720       case other    => other
721     }
722   }
723 
724   def optionalNonEmptySanitizedHeaderValueByName(headerName: String): Directive1[Option[String]] =
725     optionalNonEmptyHeaderValueByName(headerName).map(_.flatMap(sanitize))
726 
727   def optionNonEmptyURLHeaderValueByName(headerName: String): Directive1[Option[String]] =
728     optionalNonEmptyHeaderValueByName(headerName).map(_.flatMap(url))
729 
730   def url(value: String): Option[String] = Try(new java.net.URI(value).toURL).toOption.map(_ => value)
731 
732   def sanitize(value: String): Option[String] =
733     Some(value.replaceAll("[^a-zA-Z0-9/#_ -]", "").take(100)).filterNot(_.isEmpty)
734 }
735 
736 sealed trait EndpointType
737 
738 object EndpointType {
739   // represents an endpoint that can be called connected or unconnected
740   case object Public extends EndpointType
741   // Represents an endpoints that requires connection if mandatory-connection is activated in the configuration
742   case object Regular extends EndpointType
743   // Represents an endpoint forbidden if connection is mandatory
744   case object CoreOnly extends EndpointType
745 }
746 
747 final case class `X-Request-Id`(override val value: String) extends ModeledCustomHeader[`X-Request-Id`] {
748   override def companion: ModeledCustomHeaderCompanion[`X-Request-Id`] = `X-Request-Id`
749   override def renderInRequests: Boolean = true
750   override def renderInResponses: Boolean = true
751 }
752 
753 object `X-Request-Id` extends ModeledCustomHeaderCompanion[`X-Request-Id`] {
754   override val name: String = "x-request-id"
755   override def parse(value: String): Try[`X-Request-Id`] = Success(new `X-Request-Id`(value))
756 }
757 
758 final case class `X-Route-Name`(override val value: String) extends ModeledCustomHeader[`X-Route-Name`] {
759   override def renderInRequests: Boolean = true
760   override def renderInResponses: Boolean = true
761   override def companion: ModeledCustomHeaderCompanion[`X-Route-Name`] = `X-Route-Name`
762 }
763 
764 object `X-Route-Name` extends ModeledCustomHeaderCompanion[`X-Route-Name`] {
765   override val name: String = "x-route-name"
766   override def parse(value: String): Try[`X-Route-Name`] = Success(new `X-Route-Name`(value))
767 }
768 
769 final case class `X-Route-Time`(override val value: String) extends ModeledCustomHeader[`X-Route-Time`] {
770   override def companion: ModeledCustomHeaderCompanion[`X-Route-Time`] = `X-Route-Time`
771   override def renderInRequests: Boolean = true
772   override def renderInResponses: Boolean = true
773 }
774 
775 object `X-Route-Time` extends ModeledCustomHeaderCompanion[`X-Route-Time`] {
776   override val name: String = "x-route-time"
777   override def parse(value: String): Try[`X-Route-Time`] =
778     Failure(new NotImplementedError("Please use the apply from long instead"))
779   def apply(startTimeMillis: Long): `X-Route-Time` =
780     new `X-Route-Time`((System.currentTimeMillis() - startTimeMillis).toString)
781 }
782 
783 final case class `X-Make-External-Id`(override val value: String) extends ModeledCustomHeader[`X-Make-External-Id`] {
784   override def companion: ModeledCustomHeaderCompanion[`X-Make-External-Id`] = `X-Make-External-Id`
785   override def renderInRequests: Boolean = true
786   override def renderInResponses: Boolean = true
787 }
788 
789 object `X-Make-External-Id` extends ModeledCustomHeaderCompanion[`X-Make-External-Id`] {
790   override val name: String = "x-make-external-id"
791 
792   override def parse(value: String): Try[`X-Make-External-Id`] = Success(new `X-Make-External-Id`(value))
793 }
794 
795 final case class `X-Content-Type-Options`(override val value: String)
796     extends ModeledCustomHeader[`X-Content-Type-Options`] {
797   override def companion: ModeledCustomHeaderCompanion[`X-Content-Type-Options`] = `X-Content-Type-Options`
798   override def renderInRequests: Boolean = true
799   override def renderInResponses: Boolean = true
800 }
801 
802 object `X-Content-Type-Options` extends ModeledCustomHeaderCompanion[`X-Content-Type-Options`] {
803   override val name: String = "x-content-type-options"
804 
805   override def parse(value: String): Try[`X-Content-Type-Options`] = Success(new `X-Content-Type-Options`(value))
806 }
807 
808 final case class `Strict-Transport-Security`(override val value: String)
809     extends ModeledCustomHeader[`Strict-Transport-Security`] {
810   override def companion: ModeledCustomHeaderCompanion[`Strict-Transport-Security`] = `Strict-Transport-Security`
811   override def renderInRequests: Boolean = true
812   override def renderInResponses: Boolean = true
813 }
814 
815 object `Strict-Transport-Security` extends ModeledCustomHeaderCompanion[`Strict-Transport-Security`] {
816   override val name: String = "strict-transport-security"
817 
818   override def parse(value: String): Try[`Strict-Transport-Security`] = Success(new `Strict-Transport-Security`(value))
819 }
820 
821 final case class `Content-Security-Policy`(override val value: String)
822     extends ModeledCustomHeader[`Content-Security-Policy`] {
823   override def companion: ModeledCustomHeaderCompanion[`Content-Security-Policy`] = `Content-Security-Policy`
824   override def renderInRequests: Boolean = true
825   override def renderInResponses: Boolean = true
826 }
827 
828 object `Content-Security-Policy` extends ModeledCustomHeaderCompanion[`Content-Security-Policy`] {
829   override val name: String = "content-security-policy"
830 
831   override def parse(value: String): Try[`Content-Security-Policy`] = Success(new `Content-Security-Policy`(value))
832 }
833 
834 trait MakeAuthenticationDirectives extends MakeAuthentication {
835   this: MakeDirectivesDependencies with QuestionServiceComponent with OperationServiceComponent =>
836 
837   private def requireRole(user: UserRights, roles: Role*): Directive0 = {
838     authorize(user.roles.toSet.intersect(roles.toSet).nonEmpty)
839   }
840 
841   def requireOperatorRole(user: UserRights): Directive0 = {
842     requireRole(user, RoleOperator, RoleSuperAdmin)
843   }
844 
845   def requireModerationRole(user: UserRights): Directive0 = {
846     requireRole(user, RoleModerator, RoleAdmin, RoleOperator, RoleSuperAdmin)
847   }
848 
849   def requireRightsOnQuestion(user: UserRights, questionIds: IterableOnce[QuestionId]): Directive0 = {
850     authorize(user.roles.contains(RoleAdmin) || questionIds.iterator.forall(user.availableQuestions.contains))
851   }
852 
853   def requireAdminRole(user: UserRights): Directive0 = {
854     requireRole(user, RoleAdmin, RoleOperator, RoleSuperAdmin)
855   }
856 
857   def requireSuperAdminRole(user: UserRights): Directive0 = {
858     requireRole(user, RoleSuperAdmin)
859   }
860 
861   def logoutCookies(): Seq[HttpCookie] = Seq(
862     HttpCookie(
863       name = makeSettings.SessionCookie.name,
864       value = idGenerator.nextSessionId().value,
865       secure = makeSettings.SessionCookie.isSecure,
866       httpOnly = true,
867       maxAge = Some(makeSettings.SessionCookie.lifetime.toSeconds),
868       path = Some("/")
869     ).withSameSite(SameSite.Strict),
870     HttpCookie(
871       name = makeSettings.SessionCookie.expirationName,
872       value = DateHelper
873         .format(DateHelper.now().plusSeconds(makeSettings.SessionCookie.lifetime.toSeconds)),
874       secure = makeSettings.SessionCookie.isSecure,
875       httpOnly = false,
876       maxAge = None,
877       path = Some("/")
878     ).withSameSite(SameSite.Strict),
879     HttpCookie(
880       name = makeSettings.SecureCookie.name,
881       value = "",
882       secure = makeSettings.SecureCookie.isSecure,
883       httpOnly = true,
884       maxAge = Some(0),
885       path = Some("/")
886     ).withSameSite(SameSite.Strict),
887     HttpCookie(
888       name = makeSettings.SecureCookie.expirationName,
889       value = "",
890       secure = makeSettings.SecureCookie.isSecure,
891       httpOnly = false,
892       maxAge = Some(0),
893       path = Some("/")
894     ).withSameSite(SameSite.Strict)
895   )
896 
897 }
898 
899 case object EmailNotVerifiedRejection extends Rejection
900 
901 final case class OidcAuthenticationNeededRejection(
902   statusCode: StatusCode,
903   oidcConfiguration: Option[SimpleOidcConfiguration]
904 ) extends Rejection
905 
906 case object GetParametersRejection extends Rejection
907 
908 final case class `X-Make-Operation`(override val value: String) extends ModeledCustomHeader[`X-Make-Operation`] {
909   override def companion: ModeledCustomHeaderCompanion[`X-Make-Operation`] = `X-Make-Operation`
910   override def renderInRequests: Boolean = true
911   override def renderInResponses: Boolean = false
912 }
913 
914 object `X-Make-Operation` extends ModeledCustomHeaderCompanion[`X-Make-Operation`] {
915   override val name: String = "x-make-operation"
916   override def parse(value: String): Try[`X-Make-Operation`] = Success(new `X-Make-Operation`(value))
917 }
918 
919 final case class `X-Make-Source`(override val value: String) extends ModeledCustomHeader[`X-Make-Source`] {
920   override def companion: ModeledCustomHeaderCompanion[`X-Make-Source`] = `X-Make-Source`
921   override def renderInRequests: Boolean = true
922   override def renderInResponses: Boolean = false
923 }
924 
925 object `X-Make-Source` extends ModeledCustomHeaderCompanion[`X-Make-Source`] {
926   override val name: String = "x-make-source"
927   override def parse(value: String): Try[`X-Make-Source`] = Success(new `X-Make-Source`(value))
928 }
929 
930 final case class `X-Make-Location`(override val value: String) extends ModeledCustomHeader[`X-Make-Location`] {
931   override def companion: ModeledCustomHeaderCompanion[`X-Make-Location`] = `X-Make-Location`
932   override def renderInRequests: Boolean = true
933   override def renderInResponses: Boolean = false
934 }
935 
936 object `X-Make-Location` extends ModeledCustomHeaderCompanion[`X-Make-Location`] {
937   override val name: String = "x-make-location"
938   override def parse(value: String): Try[`X-Make-Location`] = Success(new `X-Make-Location`(value))
939 }
940 
941 final case class `X-Make-Question`(override val value: String) extends ModeledCustomHeader[`X-Make-Question`] {
942   override def companion: ModeledCustomHeaderCompanion[`X-Make-Question`] = `X-Make-Question`
943   override def renderInRequests: Boolean = true
944   override def renderInResponses: Boolean = false
945 }
946 
947 object `X-Make-Question` extends ModeledCustomHeaderCompanion[`X-Make-Question`] {
948   override val name: String = "x-make-question"
949   override def parse(value: String): Try[`X-Make-Question`] = Success(new `X-Make-Question`(value))
950 }
951 
952 final case class `X-Make-Question-Slug`(override val value: String)
953     extends ModeledCustomHeader[`X-Make-Question-Slug`] {
954   override def companion: ModeledCustomHeaderCompanion[`X-Make-Question-Slug`] = `X-Make-Question-Slug`
955   override def renderInRequests: Boolean = true
956   override def renderInResponses: Boolean = false
957 }
958 
959 object `X-Make-Question-Slug` extends ModeledCustomHeaderCompanion[`X-Make-Question-Slug`] {
960   override val name: String = "x-make-question-slug"
961   override def parse(value: String): Try[`X-Make-Question-Slug`] = Success(new `X-Make-Question-Slug`(value))
962 }
963 
964 final case class `X-Make-Language`(override val value: String) extends ModeledCustomHeader[`X-Make-Language`] {
965   override def companion: ModeledCustomHeaderCompanion[`X-Make-Language`] = `X-Make-Language`
966   override def renderInRequests: Boolean = true
967   override def renderInResponses: Boolean = false
968 }
969 
970 object `X-Make-Language` extends ModeledCustomHeaderCompanion[`X-Make-Language`] {
971   override val name: String = "x-make-language"
972   override def parse(value: String): Try[`X-Make-Language`] = Success(new `X-Make-Language`(value))
973 }
974 
975 final case class `X-Make-Question-Language`(override val value: String)
976     extends ModeledCustomHeader[`X-Make-Question-Language`] {
977   override def companion: ModeledCustomHeaderCompanion[`X-Make-Question-Language`] = `X-Make-Question-Language`
978   override def renderInRequests: Boolean = true
979   override def renderInResponses: Boolean = false
980 }
981 
982 object `X-Make-Question-Language` extends ModeledCustomHeaderCompanion[`X-Make-Question-Language`] {
983   override val name: String = "x-make-question-language"
984   override def parse(value: String): Try[`X-Make-Question-Language`] = Success(new `X-Make-Question-Language`(value))
985 }
986 
987 final case class `X-Make-Proposal-Language`(override val value: String)
988     extends ModeledCustomHeader[`X-Make-Proposal-Language`] {
989   override def companion: ModeledCustomHeaderCompanion[`X-Make-Proposal-Language`] = `X-Make-Proposal-Language`
990   override def renderInRequests: Boolean = true
991   override def renderInResponses: Boolean = false
992 }
993 
994 object `X-Make-Proposal-Language` extends ModeledCustomHeaderCompanion[`X-Make-Proposal-Language`] {
995   override val name: String = "x-make-proposal-language"
996   override def parse(value: String): Try[`X-Make-Proposal-Language`] = Success(new `X-Make-Proposal-Language`(value))
997 }
998 
999 final case class `X-Make-Client-Language`(override val value: String)
1000     extends ModeledCustomHeader[`X-Make-Client-Language`] {
1001   override def companion: ModeledCustomHeaderCompanion[`X-Make-Client-Language`] = `X-Make-Client-Language`
1002   override def renderInRequests: Boolean = true
1003   override def renderInResponses: Boolean = false
1004 }
1005 
1006 object `X-Make-Client-Language` extends ModeledCustomHeaderCompanion[`X-Make-Client-Language`] {
1007   override val name: String = "x-make-client-language"
1008   override def parse(value: String): Try[`X-Make-Client-Language`] = Success(new `X-Make-Client-Language`(value))
1009 }
1010 
1011 final case class `X-Make-Country`(override val value: String) extends ModeledCustomHeader[`X-Make-Country`] {
1012   override def companion: ModeledCustomHeaderCompanion[`X-Make-Country`] = `X-Make-Country`
1013   override def renderInRequests: Boolean = true
1014   override def renderInResponses: Boolean = false
1015 }
1016 
1017 object `X-Make-Country` extends ModeledCustomHeaderCompanion[`X-Make-Country`] {
1018   override val name: String = "x-make-country"
1019   override def parse(value: String): Try[`X-Make-Country`] = Success(new `X-Make-Country`(value))
1020 }
1021 
1022 final case class `X-Detected-Country`(override val value: String) extends ModeledCustomHeader[`X-Detected-Country`] {
1023   override def companion: ModeledCustomHeaderCompanion[`X-Detected-Country`] = `X-Detected-Country`
1024   override def renderInRequests: Boolean = true
1025   override def renderInResponses: Boolean = false
1026 }
1027 
1028 object `X-Detected-Country` extends ModeledCustomHeaderCompanion[`X-Detected-Country`] {
1029   override val name: String = "x-detected-country"
1030   override def parse(value: String): Try[`X-Detected-Country`] = Success(new `X-Detected-Country`(value))
1031 }
1032 
1033 final case class `X-Hostname`(override val value: String) extends ModeledCustomHeader[`X-Hostname`] {
1034   override def companion: ModeledCustomHeaderCompanion[`X-Hostname`] = `X-Hostname`
1035   override def renderInRequests: Boolean = true
1036   override def renderInResponses: Boolean = false
1037 }
1038 
1039 object `X-Hostname` extends ModeledCustomHeaderCompanion[`X-Hostname`] {
1040   override val name: String = "x-hostname"
1041   override def parse(value: String): Try[`X-Hostname`] = Success(new `X-Hostname`(value))
1042 }
1043 
1044 final case class `X-Get-Parameters`(override val value: String) extends ModeledCustomHeader[`X-Get-Parameters`] {
1045   override def companion: ModeledCustomHeaderCompanion[`X-Get-Parameters`] = `X-Get-Parameters`
1046   override def renderInRequests: Boolean = true
1047   override def renderInResponses: Boolean = false
1048 }
1049 
1050 object `X-Get-Parameters` extends ModeledCustomHeaderCompanion[`X-Get-Parameters`] {
1051   override val name: String = "x-get-parameters"
1052   override def parse(value: String): Try[`X-Get-Parameters`] = Success(new `X-Get-Parameters`(value))
1053 }
1054 
1055 final case class `X-Session-Id`(override val value: String) extends ModeledCustomHeader[`X-Session-Id`] {
1056   override def companion: ModeledCustomHeaderCompanion[`X-Session-Id`] = `X-Session-Id`
1057   override def renderInRequests: Boolean = true
1058   override def renderInResponses: Boolean = true
1059 }
1060 
1061 object `X-Session-Id` extends ModeledCustomHeaderCompanion[`X-Session-Id`] {
1062   override val name: String = "x-session-id"
1063   override def parse(value: String): Try[`X-Session-Id`] = Success(new `X-Session-Id`(value))
1064 }
1065 
1066 final case class `X-Session-Id-Expiration`(override val value: String)
1067     extends ModeledCustomHeader[`X-Session-Id-Expiration`] {
1068 
1069   override def companion: ModeledCustomHeaderCompanion[`X-Session-Id-Expiration`] =
1070     `X-Session-Id-Expiration`
1071   override def renderInRequests: Boolean = false
1072   override def renderInResponses: Boolean = true
1073 }
1074 
1075 object `X-Session-Id-Expiration` extends ModeledCustomHeaderCompanion[`X-Session-Id-Expiration`] {
1076   override val name: String = "x-session-id-expiration"
1077   override def parse(value: String): Try[`X-Session-Id-Expiration`] = Success(new `X-Session-Id-Expiration`(value))
1078 }
1079 
1080 final case class `X-Total-Count`(override val value: String) extends ModeledCustomHeader[`X-Total-Count`] {
1081   override def companion: ModeledCustomHeaderCompanion[`X-Total-Count`] = `X-Total-Count`
1082   override def renderInRequests: Boolean = true
1083   override def renderInResponses: Boolean = true
1084 }
1085 
1086 object `X-Total-Count` extends ModeledCustomHeaderCompanion[`X-Total-Count`] {
1087   val name: String = "x-total-count"
1088   def parse(value: String): Try[`X-Total-Count`] = Success(new `X-Total-Count`(value))
1089 }
1090 
1091 final case class `X-Visitor-Id`(override val value: String) extends ModeledCustomHeader[`X-Visitor-Id`] {
1092   override def companion: ModeledCustomHeaderCompanion[`X-Visitor-Id`] = `X-Visitor-Id`
1093   override def renderInRequests: Boolean = true
1094   override def renderInResponses: Boolean = true
1095 }
1096 
1097 object `X-Visitor-Id` extends ModeledCustomHeaderCompanion[`X-Visitor-Id`] {
1098   override val name: String = "x-visitor-id"
1099   override def parse(value: String): Try[`X-Visitor-Id`] = Success(new `X-Visitor-Id`(value))
1100 }
1101 
1102 final case class `X-Visitor-CreatedAt`(override val value: String) extends ModeledCustomHeader[`X-Visitor-CreatedAt`] {
1103   override def companion: ModeledCustomHeaderCompanion[`X-Visitor-CreatedAt`] = `X-Visitor-CreatedAt`
1104   override def renderInRequests: Boolean = true
1105   override def renderInResponses: Boolean = true
1106 }
1107 
1108 object `X-Visitor-CreatedAt` extends ModeledCustomHeaderCompanion[`X-Visitor-CreatedAt`] {
1109   override val name: String = "x-visitor-created-at"
1110   override def parse(value: String): Try[`X-Visitor-CreatedAt`] = Success(new `X-Visitor-CreatedAt`(value))
1111 }
1112 
1113 final case class `X-Make-Question-Id`(override val value: String) extends ModeledCustomHeader[`X-Make-Question-Id`] {
1114   override def companion: ModeledCustomHeaderCompanion[`X-Make-Question-Id`] = `X-Make-Question-Id`
1115   override def renderInRequests: Boolean = true
1116   override def renderInResponses: Boolean = false
1117 }
1118 
1119 object `X-Make-Question-Id` extends ModeledCustomHeaderCompanion[`X-Make-Question-Id`] {
1120   override val name: String = "x-make-question-id"
1121   override def parse(value: String): Try[`X-Make-Question-Id`] = Success(new `X-Make-Question-Id`(value))
1122 }
1123 
1124 final case class `X-Make-App-Name`(override val value: String) extends ModeledCustomHeader[`X-Make-App-Name`] {
1125   override def companion: ModeledCustomHeaderCompanion[`X-Make-App-Name`] = `X-Make-App-Name`
1126   override def renderInRequests: Boolean = true
1127   override def renderInResponses: Boolean = false
1128 }
1129 
1130 object `X-Make-App-Name` extends ModeledCustomHeaderCompanion[`X-Make-App-Name`] {
1131   override val name: String = "x-make-app-name"
1132   override def parse(value: String): Try[`X-Make-App-Name`] = Success(new `X-Make-App-Name`(value))
1133 }
1134 
1135 final case class `X-Make-Referrer`(override val value: String) extends ModeledCustomHeader[`X-Make-Referrer`] {
1136   override def companion: ModeledCustomHeaderCompanion[`X-Make-Referrer`] = `X-Make-Referrer`
1137   override def renderInRequests: Boolean = true
1138   override def renderInResponses: Boolean = false
1139 }
1140 
1141 object `X-Make-Referrer` extends ModeledCustomHeaderCompanion[`X-Make-Referrer`] {
1142   override val name: String = "x-make-referrer"
1143   override def parse(value: String): Try[`X-Make-Referrer`] = Success(new `X-Make-Referrer`(value))
1144 }
1145 
1146 final case class `X-Make-Custom-Data`(override val value: String) extends ModeledCustomHeader[`X-Make-Custom-Data`] {
1147   override def companion: ModeledCustomHeaderCompanion[`X-Make-Custom-Data`] = `X-Make-Custom-Data`
1148   override def renderInRequests: Boolean = true
1149   override def renderInResponses: Boolean = false
1150 }
1151 
1152 object `X-Make-Custom-Data` extends ModeledCustomHeaderCompanion[`X-Make-Custom-Data`] {
1153   override val name: String = "x-make-custom-data"
1154   override def parse(value: String): Try[`X-Make-Custom-Data`] = Success(new `X-Make-Custom-Data`(value))
1155 }