@axium/server 0.37.0 → 0.37.2

package/dist/acl.d.ts

@@ -19,6 +19,7 @@ export type PermissionsFor<TB extends TableName> = Omit<kysely.Selectable<db.Sch
 export type Result<TB extends TableName> = AccessControlInternal & PermissionsFor<TB>;
 export type WithACL<TB extends TargetName> = kysely.Selectable<db.Schema[TB]> & {
     userId: string;
+    parentId?: string | null;
     acl: Result<`acl.${TB}`>[];
 };
 export interface ACLSelectionOptions {

package/dist/api/register.js

@@ -64,7 +64,7 @@ async function POST(request) {
         deviceType: registrationInfo.credentialDeviceType,
         backedUp: registrationInfo.credentialBackedUp,
     }).catch(withError('Failed to create passkey', 500));
-    return await createSessionData(userId);
+    return await createSessionData(userId, request);
 }
 addRoute({
     path: '/api/register',

package/dist/api/users.js

@@ -100,7 +100,7 @@ addRoute({
     path: '/api/users/:id/auth',
     params,
     async OPTIONS(request, { id: userId }) {
-        const { type } = await parseBody(request, UserAuthOptions);
+        const { type, client } = await parseBody(request, UserAuthOptions);
         const user = await getUser(userId).catch(withError('User does not exist', 404));
         if (user.isSuspended)
             error(403, 'User is suspended');
@@ -111,7 +111,7 @@ addRoute({
             rpID: config.auth.rp_id,
             allowCredentials: passkeys.map(passkey => pick(passkey, 'id', 'transports')),
         });
-        challenges.set(userId, { data: options.challenge, type });
+        challenges.set(userId, { data: options.challenge, type, client });
         return options;
     },
     async POST(request, { id: userId }) {
@@ -119,7 +119,7 @@ addRoute({
         const auth = challenges.get(userId);
         if (!auth)
             error(404, 'No challenge');
-        const { data: expectedChallenge, type } = auth;
+        const { data: expectedChallenge, type, client } = auth;
         challenges.delete(userId);
         const passkey = await getPasskey(response.id).catch(withError('Passkey does not exist', 404));
         if (passkey.userId !== userId)
@@ -137,14 +137,13 @@ addRoute({
             error(401, 'Verification failed');
         switch (type) {
             case 'login':
-                return await createSessionData(userId);
+                return await createSessionData(userId, request);
             case 'client_login':
-                /** @todo tag in DB so users can manage easier */
-                return await createSessionData(userId, { noCookie: true });
+                return await createSessionData(userId, request, { noCookie: true, clientUA: client });
             case 'action':
                 if ((Date.now() - passkey.createdAt.getTime()) / 60_000 < config.auth.passkey_probation)
                     error(403, 'You can not authorize sensitive actions with a newly created passkey');
-                return await createSessionData(userId, { elevated: true });
+                return await createSessionData(userId, request, { elevated: true });
         }
     },
 });
@@ -266,6 +265,6 @@ addRoute({
     async POST(request, { id: userId }) {
         const { token } = await parseBody(request, z.object({ token: z.string() }));
         await useVerification('login', userId, token).catch(withError('Invalid or expired verification token', 400));
-        return await createSessionData(userId);
+        return await createSessionData(userId, request);
     },
 });

package/dist/auth.d.ts

@@ -8,7 +8,7 @@ export declare function updateUser({ id, ...user }: WithRequired<Insertable<Sche
 export interface SessionInternal extends Session {
     token: string;
 }
-export declare function createSession(userId: string, elevated?: boolean): Promise<SessionInternal>;
+export declare function createSession(userId: string, name: string | null, elevated?: boolean): Promise<SessionInternal>;
 export interface SessionAndUser extends SessionInternal {
     user: UserInternal;
 }
@@ -41,9 +41,9 @@ export interface ItemAuthResult<TB extends acl.TargetName> {
     user?: UserInternal;
     session?: SessionInternal;
 }
-export declare function authSessionForItem<const TB extends acl.TargetName>(itemType: TB, itemId: string, permissions: Partial<acl.PermissionsFor<`acl.${TB}`>>, session?: SessionAndUser | null): Promise<ItemAuthResult<TB>>;
+export declare function authSessionForItem<const TB extends acl.TargetName>(itemType: TB, itemId: string, permissions: Partial<acl.PermissionsFor<`acl.${TB}`>>, session?: SessionAndUser | null, recursive?: boolean): Promise<ItemAuthResult<TB>>;
 /**
  * Authenticate a request against an "item" which has an ACL table.
  * This will fetch the item, ACLs, users, and the authenticating session.
  */
-export declare function authRequestForItem<const TB extends acl.TargetName>(request: Request, itemType: TB, itemId: string, permissions: Partial<acl.PermissionsFor<`acl.${TB}`>>): Promise<ItemAuthResult<TB>>;
+export declare function authRequestForItem<const TB extends acl.TargetName>(request: Request, itemType: TB, itemId: string, permissions: Partial<acl.PermissionsFor<`acl.${TB}`>>, recursive?: boolean): Promise<ItemAuthResult<TB>>;

package/dist/auth.js

@@ -13,10 +13,11 @@ export async function updateUser({ id, ...user }) {
 }
 const in30days = () => new Date(Date.now() + 2592000000);
 const in10minutes = () => new Date(Date.now() + 600000);
-export async function createSession(userId, elevated = false) {
+export async function createSession(userId, name, elevated = false) {
     const session = {
         id: randomUUID(),
         userId,
+        name,
         token: randomBytes(64).toString('base64'),
         expires: elevated ? in10minutes() : in30days(),
         elevated,
@@ -110,7 +111,7 @@ export async function checkAuthForUser(request, userId, sensitive = false) {
         error(403, 'This token can not be used for sensitive actions');
     return Object.assign(session, { accessor: session.user });
 }
-export async function authSessionForItem(itemType, itemId, permissions, session) {
+export async function authSessionForItem(itemType, itemId, permissions, session, recursive = false) {
     const { userId, user } = session ?? {};
     // Note: we need to do casting because of TS limitations with generics
     const item = (await db
@@ -137,21 +138,42 @@ export async function authSessionForItem(itemType, itemId, permissions, session)
     if (userId == item.userId)
         return result;
     result.fromACL = true;
-    if (!item.acl || !item.acl.length)
-        error(403, 'Item is not shared with you');
-    const missing = Array.from(acl.check(item.acl, permissions));
-    if (missing.length)
-        error(403, 'Missing permissions: ' + missing.join(', '));
-    return result;
+    let current = item;
+    for (let i = 0; i < 25; i++) {
+        try {
+            if (!current.acl || !current.acl.length)
+                error(403, 'Item is not shared with you');
+            const missing = Array.from(acl.check(current.acl, permissions));
+            if (missing.length)
+                error(403, 'Missing permissions: ' + missing.join(', '));
+            return result;
+        }
+        catch (e) {
+            if (!current.parentId || !recursive)
+                throw e;
+            current = (await db
+                .selectFrom(itemType)
+                .selectAll()
+                .where('id', '=', current.parentId)
+                .$if(!!userId, eb => eb.select(acl.from(itemType, { user })))
+                .executeTakeFirstOrThrow()
+                .catch(e => {
+                if (e.message.includes('no rows'))
+                    error(404, itemType + ' not found');
+                throw e;
+            }));
+        }
+    }
+    error(403, 'You do not have permissions for any of the last 25 parent items');
 }
 /**
  * Authenticate a request against an "item" which has an ACL table.
  * This will fetch the item, ACLs, users, and the authenticating session.
  */
-export async function authRequestForItem(request, itemType, itemId, permissions) {
+export async function authRequestForItem(request, itemType, itemId, permissions, recursive = false) {
     const token = getToken(request, false);
     if (!token)
         error(401, 'Missing token');
     const session = await getSessionAndUser(token).catch(() => null);
-    return await authSessionForItem(itemType, itemId, permissions, session);
+    return await authSessionForItem(itemType, itemId, permissions, session, recursive);
 }

package/dist/db/schema.json

@@ -77,6 +77,16 @@
                     }
                 }
             }
+        },
+        {
+            "delta": true,
+            "alter_tables": {
+                "sessions": {
+                    "add_columns": {
+                        "name": { "type": "text" }
+                    }
+                }
+            }
         }
     ],
     "wipe": ["users", "verifications", "passkeys", "sessions", "audit_log"]

package/dist/requests.d.ts

@@ -35,11 +35,13 @@ export declare function json(data: object, init?: ResponseInit): Response;
 export declare function parseBody<const Schema extends z.ZodType>(request: Request, schema: Schema): Promise<z.infer<Schema>>;
 export declare function parseSearch<const Schema extends z.ZodType>(request: Request, schema: Schema): z.infer<Schema>;
 export declare function getToken(request: Request, sensitive?: boolean): string | undefined;
+export declare function getPrettyUA(request: Request, uaOverride?: string): Promise<string | null>;
 export interface CreateSessionOptions {
     elevated?: boolean;
     noCookie?: boolean;
+    clientUA?: string;
 }
-export declare function createSessionData(userId: string, { elevated, noCookie }?: CreateSessionOptions): Promise<Response>;
+export declare function createSessionData(userId: string, request: Request, { elevated, noCookie, clientUA }?: CreateSessionOptions): Promise<Response>;
 export declare function stripUser(user: UserInternal, includeProtected?: boolean): User;
 export declare function withError(text: string, code?: number): (e: Error | ResponseError) => never;
 export declare function handleAPIRequest(request: Request, params: Record<string, any>, route: ServerRoute): Promise<Response>;

package/dist/requests.js

@@ -62,8 +62,29 @@ export function getToken(request, sensitive = false) {
         return cookie.parse(request.headers.get('cookie') || '')[sensitive ? 'elevated_token' : 'session_token'];
     }
 }
-export async function createSessionData(userId, { elevated = false, noCookie } = {}) {
-    const { token, expires } = await createSession(userId, elevated);
+const uaParserExtension = {
+    browser: [[/(axium[- ]client)\/([\d.]+)/i], ['name', 'version']],
+};
+export async function getPrettyUA(request, uaOverride) {
+    const uaString = uaOverride || request.headers.get('User-Agent') || '';
+    try {
+        const { UAParser } = await import('ua-parser-js');
+        const ua = UAParser(uaString, uaParserExtension);
+        return [
+            ua.browser.name,
+            ua.browser.name && /axium[- ]client/i.test(ua.browser.name) ? ua.browser.version : ua.browser.major,
+            ua.os.name && ' on ' + ua.os.name,
+        ]
+            .filter(p => p)
+            .join(' ');
+    }
+    catch {
+        return null;
+    }
+}
+export async function createSessionData(userId, request, { elevated = false, noCookie, clientUA } = {}) {
+    const name = await getPrettyUA(request, clientUA);
+    const { token, expires } = await createSession(userId, name, elevated);
     const response = json({ userId, token: elevated ? '[[redacted:elevated]]' : token }, { status: 201 });
     if (noCookie)
         return response;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.37.0",
+	"version": "0.37.2",
 	"author": "James Prevett <axium@jamespre.dev>",
 	"funding": {
 		"type": "individual",
@@ -66,5 +66,8 @@
 	"devDependencies": {
 		"@sveltejs/adapter-node": "^5.2.12",
 		"vite-plugin-mkcert": "^1.17.8"
+	},
+	"optionalDependencies": {
+		"ua-parser-js": "^2.0.9"
 	}
 }

package/routes/login/client/+page.ts

@@ -13,12 +13,14 @@ export async function load({ parent, url }: Omit<PageLoadEvent, 'parent'> & { pa
 	const port = parseInt(url.searchParams.get('port') ?? '!');
 	const localCallback = new URL('http://localhost');
 
+	const client = url.searchParams.get('client') ?? '';
+
 	let options,
 		error: string | null = null;
 	try {
 		if (Number.isNaN(port)) throw new Error('Invalid port number provided by local client');
 		localCallback.port = port.toString();
-		options = await fetchAPI('OPTIONS', 'users/:id/auth', { type: 'client_login' }, session.userId);
+		options = await fetchAPI('OPTIONS', 'users/:id/auth', { type: 'client_login', client }, session.userId);
 	} catch (e: any) {
 		error = e.message;
 	}