@antelopejs/dms-frontend 0.0.1

package/templates/vue/server/render-token.mjs

@@ -0,0 +1,81 @@
+// Verification for the service token that guards the HTML render route.
+//
+// Lives apart from server.mjs so the file stays under the size the linter
+// allows, and so the three concerns the check actually has -- signature,
+// claims, replay -- are named rather than run together in one function.
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+const RENDER_TOKEN_LIFETIME_SECONDS = 5 * 60;
+const RENDER_REPLAY_LIMIT = 10_000;
+
+/** jti -> exp, for tokens already spent. Pruned on every accepted token. */
+const usedRenderTokens = new Map();
+
+/**
+ * Constant-time check of the token's HMAC. The length comparison guards
+ * timingSafeEqual, which throws on mismatched lengths -- it is not itself a
+ * timing leak, since the length of a base64url HMAC is fixed.
+ */
+function signatureValid(parts, secret) {
+  const expected = createHmac("sha256", secret)
+    .update(`${parts[0]}.${parts[1]}`)
+    .digest("base64url");
+  if (expected.length !== parts[2].length) return false;
+  return timingSafeEqual(Buffer.from(expected), Buffer.from(parts[2]));
+}
+
+/**
+ * The claims this service will accept. `exp - iat` is bounded so a token
+ * minted with a far-future expiry cannot outlive the intended window.
+ */
+function claimsValid(payload, now) {
+  return (
+    payload.namespace === "html-render-service" &&
+    payload.purpose === "html-render" &&
+    payload.aud === "dms-frontend" &&
+    typeof payload.jti === "string" &&
+    payload.jti.length >= 16 &&
+    Number.isSafeInteger(payload.iat) &&
+    Number.isSafeInteger(payload.exp) &&
+    payload.exp > now &&
+    payload.exp - payload.iat <= RENDER_TOKEN_LIFETIME_SECONDS &&
+    payload.iat <= now
+  );
+}
+
+/**
+ * Records a token as spent, dropping expired entries first and evicting the
+ * oldest if the map is at its cap, so a flood of tokens cannot grow it without
+ * bound.
+ */
+function rememberToken(payload, now) {
+  for (const [jti, expiresAt] of usedRenderTokens)
+    if (expiresAt <= now) usedRenderTokens.delete(jti);
+  while (usedRenderTokens.size >= RENDER_REPLAY_LIMIT)
+    usedRenderTokens.delete(usedRenderTokens.keys().next().value);
+  usedRenderTokens.set(payload.jti, payload.exp);
+}
+
+/**
+ * @param {string | undefined} token the x-dms-service-token header
+ * @returns {boolean} whether the token is well-formed, signed, unexpired and
+ *   not already spent. A token accepted here is immediately marked as spent.
+ */
+export function validRenderToken(token) {
+  const secret = process.env.DMS_HTML_RENDER_SECRET;
+  if (!token || !secret) return false;
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  if (!signatureValid(parts, secret)) return false;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url"));
+    const now = Math.floor(Date.now() / 1000);
+    if (!claimsValid(payload, now)) return false;
+    if (usedRenderTokens.has(payload.jti)) return false;
+    rememberToken(payload, now);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/templates/vue/server/tester.mjs

@@ -0,0 +1,228 @@
+import { body, json, RequestBodyError } from "./auth/backend.mjs";
+import { isSameOrigin } from "./auth/client-ip.mjs";
+import { readSession } from "./auth/session.mjs";
+
+const RESPONSE_LIMIT = 64 * 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+const METHODS = new Set([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+]);
+const BLOCKED_HEADERS = new Set([
+  "host",
+  "cookie",
+  "cookie2",
+  "set-cookie",
+  "set-cookie2",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "content-length",
+  "expect",
+  "forwarded",
+  "origin",
+  "referer",
+  "via",
+  "authorization",
+]);
+const CONTROL_HEADER =
+  /^(?:sec-|proxy-|x-forwarded-|x-dms-|x-inertia|x-http-method|x-method-override|x-original-|x-rewrite-)/i;
+// oxlint-disable-next-line eslint/no-control-regex -- URL paths must reject literal control characters before forwarding.
+const UNSAFE_PATH = /[\\#\u0000-\u0020\u007f]/;
+// oxlint-disable-next-line eslint/no-control-regex -- Decoded path segments need the same boundary after every decoding pass.
+const UNSAFE_DECODED_SEGMENT = /[\\/#\u0000-\u0020\u007f]/;
+
+function invalidInput() {
+  throw new RequestBodyError(400, "Invalid tester request");
+}
+
+function validatePathSegment(segment) {
+  let decoded = segment;
+  for (;;) {
+    if ([".", ".."].includes(decoded) || UNSAFE_DECODED_SEGMENT.test(decoded))
+      return invalidInput();
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return invalidInput();
+    }
+    if (next === decoded) break;
+    decoded = next;
+  }
+}
+
+function targetUrl(path) {
+  if (
+    typeof path !== "string" ||
+    !path.startsWith("/") ||
+    path.startsWith("//") ||
+    UNSAFE_PATH.test(path)
+  )
+    return invalidInput();
+  path.split("?", 1)[0].split("/").forEach(validatePathSegment);
+  const base = new URL(process.env.DMS_BACKEND_URL);
+  if (
+    !["http:", "https:"].includes(base.protocol) ||
+    base.username ||
+    base.password
+  )
+    throw new Error("Invalid backend configuration");
+  const target = new URL(path, base);
+  if (target.origin !== base.origin || target.hash) return invalidInput();
+  return target;
+}
+
+function filteredHeaders(input, allowAuthorization = false) {
+  const source = new Headers(input);
+  const connection = new Set(
+    (source.get("connection") ?? "")
+      .toLowerCase()
+      .split(",")
+      .map((name) => name.trim()),
+  );
+  return new Headers(
+    [...source].filter(
+      ([name]) =>
+        !connection.has(name) &&
+        !CONTROL_HEADER.test(name) &&
+        (!BLOCKED_HEADERS.has(name) ||
+          (allowAuthorization && name === "authorization")),
+    ),
+  );
+}
+
+function validateInput(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    return invalidInput();
+  if (!METHODS.has(input.method) || typeof input.useSession !== "boolean")
+    return invalidInput();
+  if (
+    !input.headers ||
+    typeof input.headers !== "object" ||
+    Array.isArray(input.headers)
+  )
+    return invalidInput();
+  if (Object.values(input.headers).some((value) => typeof value !== "string"))
+    return invalidInput();
+  if (
+    input.body !== undefined &&
+    (typeof input.body !== "string" || ["GET", "HEAD"].includes(input.method))
+  )
+    return invalidInput();
+  try {
+    new Headers(input.headers);
+  } catch {
+    return invalidInput();
+  }
+  return targetUrl(input.path);
+}
+
+async function limitedText(response) {
+  if (!response.body) return "";
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > RESPONSE_LIMIT) throw new Error("Backend response too large");
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+async function isOwner(session, signal) {
+  const response = await fetch(targetUrl("/api/auth/me"), {
+    headers: {
+      authorization: `Bearer ${session.accessToken}`,
+      "x-antelopejs-namespace": "default",
+    },
+    redirect: "manual",
+    signal,
+  });
+  const text = await limitedText(response);
+  if (!response.ok) return false;
+  return JSON.parse(text)?.owner === true;
+}
+
+function redact(value, session) {
+  const secrets = [session.accessToken, session.refreshToken].filter(
+    (secret) => typeof secret === "string" && secret.length,
+  );
+  return secrets.reduce((result, secret) => {
+    const variants = [
+      secret,
+      encodeURIComponent(secret),
+      JSON.stringify(secret).slice(1, -1),
+    ];
+    return variants.reduce(
+      (text, variant) => text.replaceAll(variant, "[REDACTED]"),
+      result,
+    );
+  }, value);
+}
+
+async function forward(input, target, session, signal) {
+  const headers = filteredHeaders(input.headers, true);
+  if (input.useSession && !headers.has("authorization")) {
+    headers.set("authorization", `Bearer ${session.accessToken}`);
+    if (!headers.has("x-antelopejs-namespace"))
+      headers.set("x-antelopejs-namespace", "default");
+  }
+  const requestOptions = {
+    method: input.method,
+    headers,
+    redirect: "manual",
+    signal,
+  };
+  if (input.body !== undefined) requestOptions.body = input.body;
+  const upstream = await fetch(target, requestOptions);
+  const responseHeaders = Object.fromEntries(
+    [...filteredHeaders(upstream.headers)].map(([name, value]) => [
+      redact(name, session),
+      redact(value, session),
+    ]),
+  );
+  return {
+    status: upstream.status,
+    headers: responseHeaders,
+    body: redact(await limitedText(upstream), session),
+  };
+}
+
+/** Forwards owner-only API tester requests without returning private session credentials. */
+export async function handleTester(request, response) {
+  response.setHeader("cache-control", "no-store");
+  if (request.method !== "POST") {
+    response.setHeader("allow", "POST");
+    return json(response, 405, { error: "Method Not Allowed" });
+  }
+  if (!isSameOrigin(request))
+    return json(response, 403, { error: "Forbidden" });
+  try {
+    const session = readSession(request);
+    if (!session?.accessToken)
+      return json(response, 401, { error: "Not authenticated" });
+    const input = await body(request);
+    const target = validateInput(input);
+    const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    if (!(await isOwner(session, signal)))
+      return json(response, 403, { error: "Forbidden" });
+    return json(response, 200, await forward(input, target, session, signal));
+  } catch (error) {
+    const status = error instanceof RequestBodyError ? error.status : 502;
+    return json(response, status, {
+      error:
+        status === 502 ? "DMS tester request failed" : "Invalid tester request",
+    });
+  }
+}