split/monofile
1
0
Fork 0
mirror of https://github.com/mollersuite/monofile.git synced 2024-10-06 12:06:26 -07:00
Code Issues Actions Packages Projects Releases 1 Wiki Activity

This builds but probably doesn't work yet

Browse source
This commit is contained in:
split / May 2024-05-24 21:36:08 +00:00 committed by GitHub
parent c85de0e86a
commit 594efc49e0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
15 changed files with 147 additions and 126 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.env.example
View file

@ -18,4 +18,6 @@ MAIL__PORT=
MAIL__SECURE=
MAIL__SEND_FROM=
MAIL__USER=
MAIL__PASS=
MAIL__PASS=
JWT_SECRET=

86
src/server/lib/auth.ts
View file

@ -7,27 +7,35 @@ import { AuthSchemas } from "./schemas/index.js"
import DbFile from "./dbfile.js"
import * as jose from "jose"
import { AccountResolvable } from "./accounts.js"
import config from "./config.js"
export let AuthTokenTO: { [key: string]: NodeJS.Timeout } = {}
export type TokenPermission = z.infer<typeof AuthSchemas.Scope>
export type Scope = z.infer<typeof AuthSchemas.Scope>
export type TokenType = z.infer<typeof AuthSchemas.TokenType>
export type AuthToken = z.infer<typeof AuthSchemas.AuthToken>
export type TokenResolvable = string | AuthToken
export const Db = new DbFile<AuthToken[]>("tokens", [])
export function resolve(token: TokenResolvable) {
let resolved = typeof token == "object" ? token : Db.data.find(e => e.id == token)
if (resolved && (resolved.expire == null || Date.now() < resolved.expire))
return resolved
}
export function create(
account: AccountResolvable,
expire: number | null = 24 * 60 * 60 * 1000,
type: TokenType = "User",
tokenPermissions?: TokenPermission[]
scopes?: Scope[]
) {
let token = AuthSchemas.AuthToken.parse({
account,
id: crypto.randomUUID(),
expire: typeof expire == "number" ? Date.now() + expire : null,
type,
tokenPermissions:
type != "User" ? tokenPermissions || ["user"] : undefined,
scopes:
type != "User" ? scopes || ["user"] : undefined
})
Db.data.push(token)
@ -35,59 +43,75 @@ export function create(
Db.save()
return token.token
return token
}
export function tokenFor(ctx: Context) {
return (
getCookie(ctx, "auth") ||
(ctx.req.header("authorization")?.startsWith("Bearer ")
export async function getJwtId(jwt: string) {
let result = await jose.jwtVerify(jwt, config.jwtSecret).catch(e => null)
return result ? result.payload.jti : undefined
}
export function makeJwt(_token: TokenResolvable) {
let token = resolve(_token)!
let jwt = new jose.SignJWT({
exp: token.expire || undefined,
sub: token.account,
jti: token.id,
...(token.type != "User" ? { scope: token.scopes } : {})
})
return jwt.sign(config.jwtSecret)
}
export async function tokenFor(ctx: Context) {
let token =
getCookie(ctx, "auth")
|| (ctx.req.header("authorization")?.startsWith("Bearer ")
? ctx.req.header("authorization")?.split(" ")[1]
: undefined)
)
if (!token) return
let jti = await getJwtId(token)
return jti
}
function getToken(token: string) {
return Db.data.find(
(e) => e.token == token && (e.expire == null || Date.now() < e.expire)
)
export function validate(token: TokenResolvable) {
return resolve(token)?.account
}
export function validate(token: string) {
return getToken(token)?.account
export function getType(token: TokenResolvable) {
return resolve(token)?.type
}
export function getType(token: string): TokenType | undefined {
return getToken(token)?.type
}
export function getPermissions(token: string): TokenPermission[] | undefined {
let tok = getToken(token)
if (tok && "tokenPermissions" in tok)
return tok.tokenPermissions
export function getScopes(token: TokenResolvable): Scope[] | undefined {
let tok = resolve(token)
if (tok && "scopes" in tok)
return tok.scopes
}
export function tokenTimer(token: AuthToken) {
if (!token.expire) return
if (Date.now() >= token.expire) {
invalidate(token.token)
invalidate(token)
return
}
AuthTokenTO[token.token] = setTimeout(
() => invalidate(token.token),
AuthTokenTO[token.id] = setTimeout(
() => invalidate(token),
token.expire - Date.now()
)
}
export function invalidate(token: string) {
if (AuthTokenTO[token]) {
clearTimeout(AuthTokenTO[token])
export function invalidate(_token: TokenResolvable) {
let token = resolve(_token)!
if (AuthTokenTO[token.id]) {
clearTimeout(AuthTokenTO[token.id])
}
Db.data.splice(
Db.data.findIndex((e) => e.token == token),
Db.data.indexOf(token),
1
)
Db.save()

6
src/server/lib/config.ts
View file

@ -26,7 +26,9 @@ export interface Configuration {
}
user: string
pass: string
}
},
jwtSecret: Buffer
}
export interface ClientConfiguration {
@ -72,4 +74,6 @@ export default {
user: process.env.MAIL__USER,
pass: process.env.MAIL__PASS,
},
jwtSecret: Buffer.from(process.env.JWT_SECRET!)
} as Configuration

60
src/server/lib/middleware.ts
View file

@ -1,5 +1,5 @@
import * as Accounts from "./accounts.js"
import type { Context, Handler as RequestHandler } from "hono"
import type { Context, Hono, Handler as RequestHandler } from "hono"
import ServeError from "../lib/errors.js"
import * as auth from "./auth.js"
import { setCookie } from "hono/cookie"
@ -9,8 +9,8 @@ import { codes } from "./codes.js"
/**
* @description Middleware which adds an account, if any, to ctx.get("account")
*/
export const getAccount: RequestHandler = function (ctx, next) {
let account = Accounts.getFromToken(auth.tokenFor(ctx)!)
export const getAccount: RequestHandler = async function (ctx, next) {
let account = Accounts.getFromToken((await auth.tokenFor(ctx))!)
if (account?.suspension)
setCookie(ctx, "auth", "")
ctx.set("account", account)
@ -22,10 +22,10 @@ export const getAccount: RequestHandler = function (ctx, next) {
*/
export const getTarget: RequestHandler = async (ctx, next) => {
let tok = auth.tokenFor(ctx)
let tok = await auth.tokenFor(ctx)
let permissions
if (tok && auth.getType(tok) != "User")
permissions = auth.getPermissions(tok)
permissions = auth.getScopes(tok)
let actor = ctx.get("account")
@ -59,10 +59,10 @@ export const getTarget: RequestHandler = async (ctx, next) => {
* @description Blocks routes with a target user set to the account performing the action from bot tokens which do not have the manage_account permission
*/
export const accountMgmtRoute: RequestHandler = async (ctx,next) => {
let tok = auth.tokenFor(ctx)
let tok = await auth.tokenFor(ctx)
let permissions
if (tok && auth.getType(tok) != "User")
permissions = auth.getPermissions(tok)
permissions = auth.getScopes(tok)
if (
(
@ -110,26 +110,27 @@ export const requiresAdmin: RequestHandler = function (ctx, next) {
* @param tokenPermissions Permissions which your route requires.
* @returns Express middleware
*/
export const requiresPermissions = function (
...tokenPermissions: auth.TokenPermission[]
export const requiresScopes = function (
...wantsScopes: auth.Scope[]
): RequestHandler {
return function (ctx, next) {
let token = auth.tokenFor(ctx)!
return async function (ctx, next) {
let token = (await auth.tokenFor(ctx))!
let type = auth.getType(token)
if (type != "User") {
let permissions = auth.getPermissions(token)
let scopes = auth.getScopes(token)
if (!permissions) return ServeError(ctx, 403, "insufficient permissions")
if (!scopes) return ServeError(ctx, 403, "insufficient permissions")
else {
for (let v of tokenPermissions) {
if (!permissions.includes(v as auth.TokenPermission)) {
for (let v of wantsScopes) {
if (!scopes.includes(v)) {
return ServeError(ctx, 403, "insufficient permissions")
}
}
return next()
}
} else return next()
}
return next()
}
}
@ -137,8 +138,8 @@ export const requiresPermissions = function (
* @description Blocks requests based on whether or not the token being used to access the route is of type `User`.
*/
export const noAPIAccess: RequestHandler = function (ctx, next) {
if (auth.getType(auth.tokenFor(ctx)!) == "App")
export const noAPIAccess: RequestHandler = async function (ctx, next) {
if (auth.getType((await auth.tokenFor(ctx))!) == "App")
return ServeError(ctx, 403, "apps are not allowed to access this endpoint")
else return next()
}
@ -150,8 +151,8 @@ export const noAPIAccess: RequestHandler = function (ctx, next) {
export const assertAPI = function (
condition: (ctx: Context) => boolean
): RequestHandler {
return function (ctx, next) {
let reqToken = auth.tokenFor(ctx)!
return async function (ctx, next) {
let reqToken = (await auth.tokenFor(ctx))!
if (
auth.getType(reqToken) != "User" &&
condition(ctx)
@ -184,9 +185,9 @@ export function scheme(scheme: z.ZodTypeAny, transformer: (ctx: Context) => Prom
// Not really middleware but a utility
export const login = (ctx: Context, account: string) => {
export const login = async (ctx: Context, account: string) => {
let token = auth.create(account, 3 * 24 * 60 * 60 * 1000)
setCookie(ctx, "auth", token, {
setCookie(ctx, "auth", await auth.makeJwt(token), {
path: "/",
sameSite: "Strict",
secure: true,
@ -205,4 +206,15 @@ export const verifyPoi = (user: string, poi?: string, wantsMfaPoi: boolean = fal
poiCode.terminate()
return true
}
}
export const mirror = (apiRoot: Hono, ctx: Context, url: string, init: Partial<RequestInit>) => apiRoot.fetch(
new Request(
(new URL(url, ctx.req.raw.url)).href,
{
...ctx.req.raw,
...init
}
),
ctx.env
)

6
src/server/lib/schemas/auth.ts
View file

@ -17,7 +17,7 @@ export const TokenType = z.enum([
const BaseAuthToken = z.object({
account: z.string(),
token: z.string(),
id: z.string(),
expire: z.number()
.nullable()
.refine(e => e == null || e > Date.now(), "expiration must be after now"),
@ -31,10 +31,10 @@ export const AuthToken = z.discriminatedUnion("type",[
}),
BaseAuthToken.extend({
type: z.literal("ApiKey"),
tokenPermissions: z.array(Scope).default(["user"])
scopes: z.array(Scope).default(["user"])
}),
BaseAuthToken.extend({
type: z.literal("App"),
tokenPermissions: z.array(Scope).default(["user"])
scopes: z.array(Scope).default(["user"])
})
])

8
src/server/routes/api/v0/adminRoutes.ts
View file

@ -7,7 +7,7 @@ import {
getAccount,
requiresAccount,
requiresAdmin,
requiresPermissions,
requiresScopes,
} from "../../../lib/middleware.js"
import Files from "../../../lib/files.js"
@ -20,7 +20,7 @@ adminRoutes
.use(getAccount)
.use(requiresAccount)
.use(requiresAdmin)
.use(requiresPermissions("manage_server"))
.use(requiresScopes("manage_server"))
export default function (files: Files) {
adminRoutes.post("/reset", async (ctx) => {
@ -42,7 +42,7 @@ export default function (files: Files) {
Accounts.password.set(targetAccount.id, body.password)
auth.Db.data.filter((e) => e.account == targetAccount?.id).forEach(
(v) => {
auth.invalidate(v.token)
auth.invalidate(v.id)
}
)
@ -107,7 +107,7 @@ export default function (files: Files) {
let accId = targetAccount.id
auth.Db.data.filter((e) => e.account == accId).forEach((v) => {
auth.invalidate(v.token)
auth.invalidate(v.id)
})
let cpl = () =>

35
src/server/routes/api/v0/authRoutes.ts
View file

@ -5,9 +5,10 @@ import * as auth from "../../../lib/auth.js"
import { sendMail } from "../../../lib/mail.js"
import {
getAccount,
login,
noAPIAccess,
requiresAccount,
requiresPermissions,
requiresScopes,
} from "../../../lib/middleware.js"
import { accountRatelimit } from "../../../lib/ratelimit.js"
import config from "../../../lib/config.js"
@ -58,13 +59,7 @@ export default function (files: Files) {
assign token
*/
setCookie(ctx, "auth", auth.create(acc.id, 3 * 24 * 60 * 60 * 1000), {
path: "/",
sameSite: "Strict",
secure: true,
httpOnly: true,
maxAge: 3 * 24 * 60 * 60 * 1000,
})
login(ctx, acc.id)
return ctx.text("")
})
@ -116,11 +111,7 @@ export default function (files: Files) {
assign token
*/
setCookie(
ctx,
"auth",
auth.create(newAcc, 3 * 24 * 60 * 60 * 1000)
)
login(ctx, newAcc)
return ctx.text("")
})
.catch(() => ServeError(ctx, 500, "internal server error"))
@ -138,7 +129,7 @@ export default function (files: Files) {
authRoutes.post(
"/dfv",
requiresAccount,
requiresPermissions("manage_files"),
requiresScopes("manage_files"),
// Used body-parser
async (ctx) => {
const body = await ctx.req.json()
@ -171,7 +162,7 @@ export default function (files: Files) {
let accId = acc.id
auth.Db.data.filter((e) => e.account == accId).forEach((v) => {
auth.invalidate(v.token)
auth.invalidate(v.id)
})
let cpl = () =>
@ -462,7 +453,7 @@ export default function (files: Files) {
}
if (typeof ctx.req.param("code") == "string" && vcode) {
setCookie(ctx, "auth", auth.create(vcode, 3 * 24 * 60 * 60 * 1000))
login(ctx, vcode)
let e = pwReset.get(vcode)?.expiry
if (e) clearTimeout(e)
pwReset.delete(vcode)
@ -491,7 +482,7 @@ export default function (files: Files) {
Accounts.password.set(accId, body.password)
auth.Db.data.filter((e) => e.account == accId).forEach((v) => {
auth.invalidate(v.token)
auth.invalidate(v.id)
})
if (acc.email) {
@ -518,7 +509,7 @@ export default function (files: Files) {
let accId = acc.id
auth.Db.data.filter((e) => e.account == accId).forEach((v) => {
auth.invalidate(v.token)
auth.invalidate(v.id)
})
return ctx.text("logged out all sessions")
@ -528,10 +519,10 @@ export default function (files: Files) {
authRoutes.get(
"/me",
requiresAccount,
requiresPermissions("user"),
requiresScopes("user"),
async (ctx) => {
let acc = ctx.get("account") as Accounts.Account
let sessionToken = auth.tokenFor(ctx)!
let sessionToken = (await auth.tokenFor(ctx))!
let accId = acc.id
return ctx.json({
...acc,
@ -542,12 +533,12 @@ export default function (files: Files) {
(e.expire == null || e.expire > Date.now())
).length,
sessionExpires: auth.Db.data.find(
(e) => e.token == sessionToken
(e) => e.id == sessionToken
)?.expire,
password: undefined,
email:
auth.getType(sessionToken) == "User" ||
auth.getPermissions(sessionToken)?.includes("email")
auth.getScopes(sessionToken)?.includes("email")
? acc.email
: undefined,
})

6
src/server/routes/api/v0/fileApiRoutes.ts
View file

@ -5,7 +5,7 @@ import Files from "../../../lib/files.js"
import {
getAccount,
requiresAccount,
requiresPermissions,
requiresScopes,
} from "../../../lib/middleware.js"
export let fileApiRoutes = new Hono<{
@ -20,7 +20,7 @@ export default function (files: Files) {
fileApiRoutes.get(
"/list",
requiresAccount,
requiresPermissions("user"),
requiresScopes("user"),
async (ctx) => {
let acc = ctx.get("account") as Accounts.Account
@ -49,7 +49,7 @@ export default function (files: Files) {
fileApiRoutes.post(
"/manage",
requiresPermissions("manage_files"),
requiresScopes("manage_files"),
async (ctx) => {
let acc = ctx.get("account") as Accounts.Account
const body = await ctx.req.json()

14
src/server/routes/api/v0/primaryApi.ts
View file

@ -4,7 +4,7 @@ import * as auth from "../../../lib/auth.js"
import RangeParser, { type Range } from "range-parser"
import ServeError from "../../../lib/errors.js"
import Files, { WebError } from "../../../lib/files.js"
import { getAccount, requiresPermissions } from "../../../lib/middleware.js"
import { getAccount, mirror, requiresScopes } from "../../../lib/middleware.js"
import {Readable} from "node:stream"
import type {ReadableStream as StreamWebReadable} from "node:stream/web"
import formidable from "formidable"
@ -37,17 +37,7 @@ export default function (files: Files, apiRoot: Hono) {
primaryApi.get("/cpt/:fileId/*", fileReader(apiRoot))
primaryApi.post("/upload", async (ctx) =>
apiRoot.fetch(
new Request(
(new URL(
`/api/v1/file`, ctx.req.raw.url)).href,
{
...ctx.req.raw,
method: "PUT"
}
),
ctx.env
)
mirror(apiRoot, ctx, "/api/v1/file", {method: "PUT"})
)
return primaryApi

10
src/server/routes/api/v1/account/access.ts
View file

@ -16,7 +16,7 @@ import {
login,
noAPIAccess,
requiresAccount,
requiresPermissions,
requiresScopes,
scheme,
} from "../../../../lib/middleware.js"
import ServeError from "../../../../lib/errors.js"
@ -41,7 +41,7 @@ function getTargetToken(ctx: Context<HonoEnv, "/:token", BlankInput>) {
return auth.Db.data.find(
e =>
e.account == ctx.get("target").id
&& e.token == ctx.req.param("token")
&& e.id == ctx.req.param("token")
)
}
@ -79,7 +79,7 @@ export default function (files: Files) {
&& ctx.get("parsedScheme").has(e.type)
)
targets.forEach(e => auth.invalidate(e.token))
targets.forEach(e => auth.invalidate(e.id))
return ctx.text(`deleted ${targets.length} tokens`)
}
@ -90,7 +90,7 @@ export default function (files: Files) {
})
router.delete("/:token", async (ctx) => {
auth.invalidate(ctx.get("targetToken").token)
auth.invalidate(ctx.get("targetToken").id)
return ctx.text(`deleted token ${ctx.req.param("token")}`)
})
@ -116,7 +116,7 @@ export default function (files: Files) {
? AuthSchemas.Scope.options
: Array.from(new Set(params.scopes))
)
return ctx.text(token)
return ctx.text(await auth.makeJwt(token.id))
}
)

10
src/server/routes/api/v1/account/index.ts
View file

@ -17,7 +17,7 @@ import {
login,
noAPIAccess,
requiresAccount,
requiresPermissions,
requiresScopes,
scheme,
verifyPoi,
} from "../../../../lib/middleware.js"
@ -190,7 +190,7 @@ const validators: {
if (params.suspension)
auth.Db.data
.filter(e => e.account == target.id)
.forEach(e => auth.invalidate(e.token))
.forEach(e => auth.invalidate(e.id))
return params.suspension || undefined
}
},
@ -338,7 +338,7 @@ export default function (files: Files) {
return ServeError(ctx, 403, "invalid proof of identity provided")
auth.Db.data.filter((e) => e.account == target?.id).forEach((token) => {
auth.invalidate(token.token)
auth.invalidate(token.id)
})
await Accounts.deleteAccount(target.id)
@ -357,14 +357,14 @@ export default function (files: Files) {
router.get("/:user", async (ctx) => {
let acc = ctx.get("target")
let sessionToken = auth.tokenFor(ctx)!
let sessionToken = (await auth.tokenFor(ctx))!
return ctx.json({
...acc,
password: undefined,
email:
auth.getType(sessionToken) == "User" ||
auth.getPermissions(sessionToken)?.includes("email")
auth.getScopes(sessionToken)?.includes("email")
? acc.email
: undefined,
activeSessions: auth.Db.data.filter(

2
src/server/routes/api/v1/account/prove.ts
View file

@ -16,7 +16,7 @@ import {
login,
noAPIAccess,
requiresAccount,
requiresPermissions,
requiresScopes,
requiresTarget,
scheme,
} from "../../../../lib/middleware.js"

4
src/server/routes/api/v1/file/index.ts
View file

@ -4,7 +4,7 @@ import * as auth from "../../../../lib/auth.js"
import RangeParser, { type Range } from "range-parser"
import ServeError from "../../../../lib/errors.js"
import Files, { WebError } from "../../../../lib/files.js"
import { getAccount, requiresAccount, requiresPermissions, scheme } from "../../../../lib/middleware.js"
import { getAccount, requiresAccount, requiresScopes, scheme } from "../../../../lib/middleware.js"
import {Readable} from "node:stream"
import type {ReadableStream as StreamWebReadable} from "node:stream/web"
import formidable from "formidable"
@ -28,7 +28,7 @@ export default function(files: Files) {
router.on(
["PUT", "POST"],
"/",
requiresPermissions("manage_files"),
requiresScopes("manage_files"),
(ctx) => { return new Promise((resolve,reject) => {
ctx.env.incoming.removeAllListeners("data") // remove hono's buffering

8
src/server/routes/api/v1/file/individual.ts
View file

@ -4,7 +4,7 @@ import * as auth from "../../../../lib/auth.js"
import RangeParser, { type Range } from "range-parser"
import ServeError from "../../../../lib/errors.js"
import Files, { WebError } from "../../../../lib/files.js"
import { getAccount, requiresPermissions } from "../../../../lib/middleware.js"
import { getAccount, requiresScopes } from "../../../../lib/middleware.js"
import {Readable} from "node:stream"
import type {ReadableStream as StreamWebReadable} from "node:stream/web"
import formidable from "formidable"
@ -50,10 +50,12 @@ export default function(files: Files, apiRoot: Hono) {
return ServeError(ctx, 403, "you do not own this file")
}
let token = (await auth.tokenFor(ctx))!
if (
auth.getType(auth.tokenFor(ctx)!) != "User" &&
auth.getType(token) != "User" &&
auth
.getPermissions(auth.tokenFor(ctx)!)!
.getScopes(token)!
.includes("private")
) {
return ServeError(ctx, 403, "insufficient permissions")

14
src/server/routes/api/v1/session.ts
View file

@ -58,17 +58,13 @@ export default function (files: Files) {
return ctx.text("logged in")
})
router.get("/", requiresAccount, ctx => {
let sessionToken = auth.tokenFor(ctx)
return ctx.json({
expiry: auth.Db.data.find(
(e) => e.token == sessionToken
)?.expire,
})
router.get("/", requiresAccount, async ctx => {
let sessionToken = (await auth.tokenFor(ctx))!
return ctx.redirect(`/api/v1`)
})
router.delete("/", requiresAccount, (ctx) => {
auth.invalidate(auth.tokenFor(ctx)!)
router.delete("/", requiresAccount, async ctx => {
auth.invalidate((await auth.tokenFor(ctx))!)
return ctx.text("logged out")
})