2021-10-23 03:35:13 -05:00
|
|
|
const basicAuth = require("express-basic-auth");
|
2021-07-27 12:47:13 -05:00
|
|
|
const passwordHash = require("./password-hash");
|
|
|
|
const { R } = require("redbean-node");
|
2021-08-02 11:08:46 -05:00
|
|
|
const { setting } = require("./util-server");
|
2023-02-15 15:53:49 -06:00
|
|
|
const { loginRateLimiter, apiRateLimiter } = require("./rate-limiter");
|
2023-02-14 18:39:29 -06:00
|
|
|
const { Settings } = require("./settings");
|
|
|
|
const dayjs = require("dayjs");
|
2021-07-27 11:52:31 -05:00
|
|
|
|
|
|
|
/**
|
2022-04-20 13:56:40 -05:00
|
|
|
* Login to web app
|
|
|
|
* @param {string} username
|
|
|
|
* @param {string} password
|
|
|
|
* @returns {Promise<(Bean|null)>}
|
2021-07-27 11:52:31 -05:00
|
|
|
*/
|
|
|
|
exports.login = async function (username, password) {
|
2022-03-29 04:38:48 -05:00
|
|
|
if (typeof username !== "string" || typeof password !== "string") {
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
2023-01-01 08:19:00 -06:00
|
|
|
let user = await R.findOne("user", " username = ? AND active = 1 ", [
|
2021-07-27 12:47:13 -05:00
|
|
|
username,
|
2021-10-23 03:35:13 -05:00
|
|
|
]);
|
2021-07-27 11:52:31 -05:00
|
|
|
|
|
|
|
if (user && passwordHash.verify(password, user.password)) {
|
|
|
|
// Upgrade the hash to bcrypt
|
|
|
|
if (passwordHash.needRehash(user.password)) {
|
|
|
|
await R.exec("UPDATE `user` SET password = ? WHERE id = ? ", [
|
|
|
|
passwordHash.generate(password),
|
2021-07-27 12:47:13 -05:00
|
|
|
user.id,
|
2021-07-27 11:52:31 -05:00
|
|
|
]);
|
|
|
|
}
|
|
|
|
return user;
|
|
|
|
}
|
2021-07-27 12:47:13 -05:00
|
|
|
|
|
|
|
return null;
|
2021-10-23 03:35:13 -05:00
|
|
|
};
|
2021-07-27 11:52:31 -05:00
|
|
|
|
2023-02-14 18:39:29 -06:00
|
|
|
/**
|
|
|
|
* Validate a provided API key
|
2023-02-15 15:53:49 -06:00
|
|
|
* @param {string} key API key to verify
|
2023-02-14 18:39:29 -06:00
|
|
|
*/
|
2023-02-15 15:53:49 -06:00
|
|
|
async function verifyAPIKey(key) {
|
2023-02-14 18:39:29 -06:00
|
|
|
if (typeof key !== "string") {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2023-02-26 10:47:34 -06:00
|
|
|
// uk prefix + key ID is before _
|
|
|
|
let index = key.substring(2, key.indexOf("_"));
|
|
|
|
let clear = key.substring(key.indexOf("_") + 1, key.length);
|
2023-02-14 18:39:29 -06:00
|
|
|
|
|
|
|
let hash = await R.findOne("api_key", " id=? ", [ index ]);
|
|
|
|
|
2023-02-15 05:15:15 -06:00
|
|
|
if (hash === null) {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2023-02-14 18:39:29 -06:00
|
|
|
let current = dayjs();
|
|
|
|
let expiry = dayjs(hash.expires);
|
2023-02-15 05:15:15 -06:00
|
|
|
if (expiry.diff(current) < 0 || !hash.active) {
|
2023-02-14 18:39:29 -06:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
return hash && passwordHash.verify(clear, hash.key);
|
|
|
|
}
|
|
|
|
|
2022-04-20 13:56:40 -05:00
|
|
|
/**
|
2023-02-15 15:53:49 -06:00
|
|
|
* Callback for basic auth authorizers
|
|
|
|
* @callback authCallback
|
2022-04-20 13:56:40 -05:00
|
|
|
* @param {any} err Any error encountered
|
|
|
|
* @param {boolean} authorized Is the client authorized?
|
|
|
|
*/
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Custom authorizer for express-basic-auth
|
|
|
|
* @param {string} username
|
|
|
|
* @param {string} password
|
2023-02-15 15:53:49 -06:00
|
|
|
* @param {authCallback} callback
|
2022-04-20 13:56:40 -05:00
|
|
|
*/
|
2023-02-15 15:53:49 -06:00
|
|
|
function apiAuthorizer(username, password, callback) {
|
|
|
|
// API Rate Limit
|
|
|
|
apiRateLimiter.pass(null, 0).then((pass) => {
|
|
|
|
if (pass) {
|
|
|
|
verifyAPIKey(password).then((valid) => {
|
|
|
|
callback(null, valid);
|
|
|
|
// Only allow a set number of api requests per minute
|
|
|
|
// (currently set to 60)
|
|
|
|
apiRateLimiter.removeTokens(1);
|
|
|
|
});
|
|
|
|
} else {
|
|
|
|
callback(null, false);
|
|
|
|
}
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Custom authorizer for express-basic-auth
|
|
|
|
* @param {string} username
|
|
|
|
* @param {string} password
|
|
|
|
* @param {authCallback} callback
|
|
|
|
*/
|
|
|
|
function userAuthorizer(username, password, callback) {
|
2022-03-24 05:02:34 -05:00
|
|
|
// Login Rate Limit
|
|
|
|
loginRateLimiter.pass(null, 0).then((pass) => {
|
|
|
|
if (pass) {
|
|
|
|
exports.login(username, password).then((user) => {
|
|
|
|
callback(null, user != null);
|
2021-10-23 03:35:13 -05:00
|
|
|
|
2022-03-24 05:02:34 -05:00
|
|
|
if (user == null) {
|
|
|
|
loginRateLimiter.removeTokens(1);
|
2021-10-23 03:35:13 -05:00
|
|
|
}
|
|
|
|
});
|
2022-03-24 05:02:34 -05:00
|
|
|
} else {
|
|
|
|
callback(null, false);
|
2021-10-23 03:35:13 -05:00
|
|
|
}
|
|
|
|
});
|
2021-07-27 11:52:31 -05:00
|
|
|
}
|
|
|
|
|
2023-01-05 16:19:05 -06:00
|
|
|
/**
|
|
|
|
* Use basic auth if auth is not disabled
|
|
|
|
* @param {express.Request} req Express request object
|
|
|
|
* @param {express.Response} res Express response object
|
|
|
|
* @param {express.NextFunction} next
|
|
|
|
*/
|
2022-03-24 05:02:34 -05:00
|
|
|
exports.basicAuth = async function (req, res, next) {
|
|
|
|
const middleware = basicAuth({
|
2023-02-15 15:53:49 -06:00
|
|
|
authorizer: userAuthorizer,
|
2022-03-24 05:02:34 -05:00
|
|
|
authorizeAsync: true,
|
|
|
|
challenge: true,
|
|
|
|
});
|
|
|
|
|
|
|
|
const disabledAuth = await setting("disableAuth");
|
|
|
|
|
|
|
|
if (!disabledAuth) {
|
|
|
|
middleware(req, res, next);
|
|
|
|
} else {
|
|
|
|
next();
|
|
|
|
}
|
|
|
|
};
|
2023-02-14 18:39:29 -06:00
|
|
|
|
|
|
|
/**
|
2023-02-26 10:47:34 -06:00
|
|
|
* Use use API Key if API keys enabled, else use basic auth
|
2023-02-14 18:39:29 -06:00
|
|
|
* @param {express.Request} req Express request object
|
|
|
|
* @param {express.Response} res Express response object
|
|
|
|
* @param {express.NextFunction} next
|
|
|
|
*/
|
|
|
|
exports.apiAuth = async function (req, res, next) {
|
|
|
|
if (!await Settings.get("disableAuth")) {
|
|
|
|
let usingAPIKeys = await Settings.get("apiKeysEnabled");
|
2023-02-15 15:53:49 -06:00
|
|
|
let middleware;
|
|
|
|
if (usingAPIKeys) {
|
|
|
|
middleware = basicAuth({
|
|
|
|
authorizer: apiAuthorizer,
|
|
|
|
authorizeAsync: true,
|
|
|
|
challenge: true,
|
|
|
|
});
|
|
|
|
} else {
|
|
|
|
middleware = basicAuth({
|
|
|
|
authorizer: userAuthorizer,
|
|
|
|
authorizeAsync: true,
|
|
|
|
challenge: true,
|
|
|
|
});
|
|
|
|
}
|
|
|
|
middleware(req, res, next);
|
2023-02-14 18:39:29 -06:00
|
|
|
} else {
|
|
|
|
next();
|
|
|
|
}
|
|
|
|
};
|