423 lines
16 KiB
TypeScript
423 lines
16 KiB
TypeScript
import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
|
||
import { db } from '../db/index.js';
|
||
import { ensureAuthSchema } from './schema.js';
|
||
import { hashPassword, verifyPassword } from './passwords.js';
|
||
import { systemUsername, type AuthUser, type UserRole } from '../../auth.js';
|
||
|
||
export const SESSION_COOKIE = '__Host-ec_session';
|
||
export const SESSION_LIFETIME_MS = 12 * 60 * 60_000;
|
||
export const SESSION_IDLE_MS = 30 * 60_000;
|
||
const digest = (value: string) => createHash('sha256').update(value).digest('hex');
|
||
function database() {
|
||
const handle = db();
|
||
ensureAuthSchema(handle);
|
||
return handle;
|
||
}
|
||
type UserRow = {
|
||
id: string;
|
||
username: string;
|
||
display_name: string;
|
||
password_hash: string;
|
||
role: UserRole;
|
||
disabled: number;
|
||
must_change_password: number;
|
||
created_at: number;
|
||
updated_at: number;
|
||
last_login_at: number | null;
|
||
};
|
||
export class AuthError extends Error {
|
||
constructor(
|
||
message: string,
|
||
public status = 400
|
||
) {
|
||
super(message);
|
||
}
|
||
}
|
||
function present(row: UserRow): AuthUser {
|
||
return {
|
||
id: row.id,
|
||
username: row.username,
|
||
displayName: row.display_name,
|
||
role: row.role,
|
||
disabled: !!row.disabled,
|
||
mustChangePassword: !!row.must_change_password,
|
||
createdAt: new Date(row.created_at).toISOString(),
|
||
updatedAt: new Date(row.updated_at).toISOString(),
|
||
lastLoginAt: row.last_login_at === null ? null : new Date(row.last_login_at).toISOString()
|
||
};
|
||
}
|
||
function userRow(id: string) {
|
||
return database().prepare('SELECT * FROM auth_users WHERE id=?').get(id) as UserRow | undefined;
|
||
}
|
||
export function getUser(id: string): AuthUser | null {
|
||
const row = userRow(id);
|
||
return row ? present(row) : null;
|
||
}
|
||
export function listUsers(): AuthUser[] {
|
||
return (
|
||
database().prepare('SELECT * FROM auth_users ORDER BY username').all() as UserRow[]
|
||
).map(present);
|
||
}
|
||
export function setupRequired(): boolean {
|
||
return !database().prepare('SELECT 1 FROM auth_users LIMIT 1').get();
|
||
}
|
||
function username(value: unknown): string {
|
||
if (typeof value !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{2,63}$/.test(value))
|
||
throw new AuthError('Usernames need 3–64 letters, numbers, dots, underscores or hyphens.');
|
||
const normalized = value.toLowerCase();
|
||
if (normalized === systemUsername.toLowerCase())
|
||
throw new AuthError(
|
||
`${systemUsername} is reserved for system actions. Choose another username.`
|
||
);
|
||
return normalized;
|
||
}
|
||
function displayName(value: unknown, fallback: string): string {
|
||
const name = value === undefined ? fallback : value;
|
||
if (
|
||
typeof name !== 'string' ||
|
||
!name.trim() ||
|
||
name.length > 100 ||
|
||
// eslint-disable-next-line no-control-regex -- Reject control characters in display names.
|
||
/[\x00-\x1f\x7f]/.test(name)
|
||
)
|
||
throw new AuthError('Display name must contain 1–100 printable characters.');
|
||
return name.trim();
|
||
}
|
||
function role(value: unknown): UserRole {
|
||
if (!['admin', 'operator', 'viewer'].includes(value as string))
|
||
throw new AuthError('Choose administrator, operator or viewer.');
|
||
return value as UserRole;
|
||
}
|
||
export function recordAudit(
|
||
actorId: string | null,
|
||
action: string,
|
||
targetId: string | null = null,
|
||
details: Record<string, unknown> = {}
|
||
): void {
|
||
database()
|
||
.prepare(
|
||
'INSERT INTO auth_audit(actor_id,action,target_id,details,created_at) VALUES(?,?,?,?,?)'
|
||
)
|
||
.run(actorId, action, targetId, JSON.stringify(details), Date.now());
|
||
}
|
||
export function listAuthAudit() {
|
||
return database()
|
||
.prepare(
|
||
`SELECT a.id,a.actor_id AS actorId,u.username AS actor,a.action,a.target_id AS targetId,a.details,a.created_at AS createdAt
|
||
FROM auth_audit a LEFT JOIN auth_users u ON u.id=a.actor_id ORDER BY a.id DESC LIMIT 200`
|
||
)
|
||
.all();
|
||
}
|
||
|
||
/** Persistent fixed windows are consumed before hashing, including failed setup. */
|
||
export function consumeAuthAttempt(clientAddress: string, account: string, kind = 'login'): void {
|
||
const now = Date.now();
|
||
const windowMs = 15 * 60_000;
|
||
const ipKey = digest(`${kind}:ip:${clientAddress}`);
|
||
const accountKey = digest(`${kind}:account:${account.toLowerCase()}`);
|
||
database()
|
||
.transaction(() => {
|
||
database()
|
||
.prepare('DELETE FROM auth_rate_limits WHERE window_start < ?')
|
||
.run(now - 24 * 60 * 60_000);
|
||
for (const [key, limit] of [
|
||
[ipKey, 30],
|
||
[accountKey, 10]
|
||
] as const) {
|
||
const previous = database()
|
||
.prepare('SELECT window_start,attempts FROM auth_rate_limits WHERE key=?')
|
||
.get(key) as { window_start: number; attempts: number } | undefined;
|
||
if (
|
||
previous &&
|
||
previous.window_start > now - windowMs &&
|
||
previous.attempts >= limit
|
||
)
|
||
throw new AuthError('Too many attempts. Try again in 15 minutes.', 429);
|
||
}
|
||
for (const key of [ipKey, accountKey])
|
||
database()
|
||
.prepare(
|
||
`INSERT INTO auth_rate_limits(key,window_start,attempts) VALUES(?,?,1)
|
||
ON CONFLICT(key) DO UPDATE SET attempts=CASE WHEN window_start <= ? THEN 1 ELSE attempts+1 END,
|
||
window_start=CASE WHEN window_start <= ? THEN excluded.window_start ELSE window_start END`
|
||
)
|
||
.run(key, now, now - windowMs, now - windowMs);
|
||
})
|
||
.immediate();
|
||
}
|
||
|
||
function insertUser(input: {
|
||
username: string;
|
||
displayName: string;
|
||
role: UserRole;
|
||
passwordHash: string;
|
||
mustChangePassword: boolean;
|
||
}): AuthUser {
|
||
if (database().prepare('SELECT 1 FROM auth_users WHERE username=?').get(input.username))
|
||
throw new AuthError('That username is already in use.', 409);
|
||
const id = randomUUID();
|
||
const now = Date.now();
|
||
database()
|
||
.prepare(
|
||
`INSERT INTO auth_users(id,username,display_name,password_hash,role,must_change_password,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?)`
|
||
)
|
||
.run(
|
||
id,
|
||
input.username,
|
||
input.displayName,
|
||
input.passwordHash,
|
||
input.role,
|
||
Number(input.mustChangePassword),
|
||
now,
|
||
now
|
||
);
|
||
return getUser(id)!;
|
||
}
|
||
export interface AuthResult {
|
||
user: AuthUser;
|
||
session: { token: string; expiresAt: number };
|
||
}
|
||
export async function bootstrapAdmin(
|
||
input: Record<string, unknown>,
|
||
clientAddress: string
|
||
): Promise<AuthResult> {
|
||
consumeAuthAttempt(clientAddress, 'bootstrap', 'setup');
|
||
if (!setupRequired()) throw new AuthError('Initial setup is already complete.', 409);
|
||
const expected = process.env.EC_SETUP_TOKEN;
|
||
if (!expected || expected.length < 32)
|
||
throw new AuthError(
|
||
'The controller owner must configure EC_SETUP_TOKEN with at least 32 characters before setup.',
|
||
503
|
||
);
|
||
if (
|
||
typeof input.token !== 'string' ||
|
||
!timingSafeEqual(
|
||
Buffer.from(digest(input.token), 'hex'),
|
||
Buffer.from(digest(expected), 'hex')
|
||
)
|
||
)
|
||
throw new AuthError('Invalid setup token.', 401);
|
||
const name = username(input.username);
|
||
const label = displayName(input.displayName, name);
|
||
const passwordHash = await hashPassword(input.password);
|
||
return database()
|
||
.transaction(() => {
|
||
if (!setupRequired()) throw new AuthError('Initial setup is already complete.', 409);
|
||
const user = insertUser({
|
||
username: name,
|
||
displayName: label,
|
||
passwordHash,
|
||
role: 'admin',
|
||
mustChangePassword: false
|
||
});
|
||
recordAudit(user.id, 'setup', user.id);
|
||
return { user, session: createSession(user.id) };
|
||
})
|
||
.immediate();
|
||
}
|
||
export async function authenticatePassword(
|
||
input: Record<string, unknown>,
|
||
clientAddress: string
|
||
): Promise<AuthResult> {
|
||
const name =
|
||
typeof input.username === 'string' ? input.username.slice(0, 64).toLowerCase() : '';
|
||
consumeAuthAttempt(clientAddress, name);
|
||
const row = database().prepare('SELECT * FROM auth_users WHERE username=?').get(name) as
|
||
UserRow | undefined;
|
||
const valid = await verifyPassword(input.password, row?.password_hash ?? null);
|
||
const result = database()
|
||
.transaction(() => {
|
||
const current = row ? userRow(row.id) : undefined;
|
||
if (
|
||
!valid ||
|
||
!current ||
|
||
current.disabled ||
|
||
current.password_hash !== row?.password_hash
|
||
) {
|
||
recordAudit(null, 'login.failed');
|
||
return null;
|
||
}
|
||
database()
|
||
.prepare('UPDATE auth_users SET last_login_at=? WHERE id=?')
|
||
.run(Date.now(), current.id);
|
||
recordAudit(current.id, 'login', current.id);
|
||
return { user: getUser(current.id)!, session: createSession(current.id) };
|
||
})
|
||
.immediate();
|
||
if (!result) throw new AuthError('Invalid username or password.', 401);
|
||
return result;
|
||
}
|
||
|
||
export function createSession(userId: string): { token: string; expiresAt: number } {
|
||
const now = Date.now();
|
||
const user = userRow(userId);
|
||
if (!user || user.disabled) throw new AuthError('Account is unavailable.', 401);
|
||
const token = randomBytes(32).toString('base64url');
|
||
const expiresAt = now + SESSION_LIFETIME_MS;
|
||
database()
|
||
.prepare('DELETE FROM auth_sessions WHERE expires_at <= ? OR last_seen_at <= ?')
|
||
.run(now, now - SESSION_IDLE_MS);
|
||
database()
|
||
.prepare(
|
||
'INSERT INTO auth_sessions(token_hash,user_id,created_at,expires_at,last_seen_at) VALUES(?,?,?,?,?)'
|
||
)
|
||
.run(digest(token), userId, now, expiresAt, now);
|
||
return { token, expiresAt };
|
||
}
|
||
export function readSession(
|
||
token: string | undefined,
|
||
touch = true
|
||
): { user: AuthUser; tokenHash: string; expiresAt: number } | null {
|
||
if (!token || !/^[A-Za-z0-9_-]{43}$/.test(token)) return null;
|
||
return readSessionHash(digest(token), touch);
|
||
}
|
||
export function readSessionHash(
|
||
tokenHash: string,
|
||
touch = false
|
||
): { user: AuthUser; tokenHash: string; expiresAt: number } | null {
|
||
const now = Date.now();
|
||
const row = database()
|
||
.prepare(
|
||
`SELECT u.*,s.expires_at,s.last_seen_at FROM auth_sessions s JOIN auth_users u ON u.id=s.user_id
|
||
WHERE s.token_hash=? AND s.expires_at>? AND s.last_seen_at>? AND u.disabled=0`
|
||
)
|
||
.get(tokenHash, now, now - SESSION_IDLE_MS) as
|
||
(UserRow & { expires_at: number; last_seen_at: number }) | undefined;
|
||
if (!row) return null;
|
||
if (touch && row.last_seen_at < now - 60_000)
|
||
database()
|
||
.prepare('UPDATE auth_sessions SET last_seen_at=? WHERE token_hash=?')
|
||
.run(now, tokenHash);
|
||
return { user: present(row), tokenHash, expiresAt: row.expires_at };
|
||
}
|
||
export function revokeSession(token: string | undefined): void {
|
||
if (token)
|
||
database().prepare('DELETE FROM auth_sessions WHERE token_hash=?').run(digest(token));
|
||
}
|
||
export function revokeUserSessions(actorId: string, userId: string): void {
|
||
database().transaction(() => {
|
||
requireAdministrator(actorId);
|
||
if (!userRow(userId)) throw new AuthError('User not found.', 404);
|
||
database().prepare('DELETE FROM auth_sessions WHERE user_id=?').run(userId);
|
||
recordAudit(actorId, 'sessions.revoked', userId);
|
||
})();
|
||
}
|
||
function requireAdministrator(actorId: string) {
|
||
const actor = userRow(actorId);
|
||
if (!actor || actor.disabled || actor.role !== 'admin' || actor.must_change_password)
|
||
throw new AuthError('Administrator access is required.', 403);
|
||
}
|
||
export async function createUser(
|
||
actorId: string,
|
||
input: Record<string, unknown>
|
||
): Promise<AuthUser> {
|
||
requireAdministrator(actorId);
|
||
const name = username(input.username),
|
||
label = displayName(input.displayName, name),
|
||
userRole = role(input.role);
|
||
const passwordHash = await hashPassword(input.password);
|
||
return database()
|
||
.transaction(() => {
|
||
requireAdministrator(actorId);
|
||
const user = insertUser({
|
||
username: name,
|
||
displayName: label,
|
||
role: userRole,
|
||
passwordHash,
|
||
mustChangePassword: true
|
||
});
|
||
recordAudit(actorId, 'user.created', user.id, { role: userRole });
|
||
return user;
|
||
})
|
||
.immediate();
|
||
}
|
||
export async function updateUser(
|
||
actorId: string,
|
||
id: string,
|
||
input: Record<string, unknown>
|
||
): Promise<AuthUser> {
|
||
requireAdministrator(actorId);
|
||
if (input.disabled !== undefined && typeof input.disabled !== 'boolean')
|
||
throw new AuthError('Disabled must be true or false.');
|
||
if (input.password !== undefined && actorId === id)
|
||
throw new AuthError('Change your own password from Account using your current password.');
|
||
const passwordHash = input.password === undefined ? null : await hashPassword(input.password);
|
||
return database()
|
||
.transaction(() => {
|
||
requireAdministrator(actorId);
|
||
const current = userRow(id);
|
||
if (!current) throw new AuthError('User not found.', 404);
|
||
const nextRole = input.role === undefined ? current.role : role(input.role);
|
||
const disabled =
|
||
input.disabled === undefined ? current.disabled : Number(input.disabled);
|
||
const label = displayName(input.displayName, current.display_name);
|
||
if (
|
||
current.role === 'admin' &&
|
||
!current.disabled &&
|
||
(nextRole !== 'admin' || disabled)
|
||
) {
|
||
const other = database()
|
||
.prepare(
|
||
"SELECT 1 FROM auth_users WHERE role='admin' AND disabled=0 AND id!=? LIMIT 1"
|
||
)
|
||
.get(id);
|
||
if (!other) throw new AuthError('Keep at least one enabled administrator.', 409);
|
||
}
|
||
database()
|
||
.prepare(
|
||
`UPDATE auth_users SET display_name=?,role=?,disabled=?,password_hash=?,must_change_password=?,updated_at=? WHERE id=?`
|
||
)
|
||
.run(
|
||
label,
|
||
nextRole,
|
||
disabled,
|
||
passwordHash ?? current.password_hash,
|
||
passwordHash ? 1 : current.must_change_password,
|
||
Date.now(),
|
||
id
|
||
);
|
||
if (passwordHash || disabled !== current.disabled || nextRole !== current.role)
|
||
database().prepare('DELETE FROM auth_sessions WHERE user_id=?').run(id);
|
||
recordAudit(actorId, 'user.updated', id, {
|
||
role: nextRole,
|
||
disabled: !!disabled,
|
||
passwordReset: !!passwordHash
|
||
});
|
||
return getUser(id)!;
|
||
})
|
||
.immediate();
|
||
}
|
||
export async function changePassword(
|
||
userId: string,
|
||
currentPassword: unknown,
|
||
newPassword: unknown
|
||
): Promise<AuthResult> {
|
||
const original = userRow(userId);
|
||
if (
|
||
!original ||
|
||
original.disabled ||
|
||
!(await verifyPassword(currentPassword, original.password_hash))
|
||
)
|
||
throw new AuthError('Current password is incorrect.', 400);
|
||
if (currentPassword === newPassword) throw new AuthError('Choose a different password.');
|
||
const passwordHash = await hashPassword(newPassword);
|
||
return database()
|
||
.transaction(() => {
|
||
const current = userRow(userId);
|
||
if (!current || current.disabled || current.password_hash !== original.password_hash)
|
||
throw new AuthError(
|
||
'Account changed during password verification. Sign in again.',
|
||
409
|
||
);
|
||
database()
|
||
.prepare(
|
||
'UPDATE auth_users SET password_hash=?,must_change_password=0,updated_at=? WHERE id=?'
|
||
)
|
||
.run(passwordHash, Date.now(), userId);
|
||
database().prepare('DELETE FROM auth_sessions WHERE user_id=?').run(userId);
|
||
recordAudit(userId, 'password.changed', userId);
|
||
return { user: getUser(userId)!, session: createSession(userId) };
|
||
})
|
||
.immediate();
|
||
}
|