@camera.ui/server 0.0.49 → 0.0.50-internal.0

package/src/api/utils/cert.ts

@@ -0,0 +1,254 @@
+import forge from 'node-forge';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { isIPv4, isIPv6 } from 'node:net';
+import { join } from 'node:path';
+import { container } from 'tsyringe';
+
+import { DEFAULTS, HOST_CERT_FILENAME, HOST_KEY_FILENAME, OLD_ROOT_CERT_FILENAME, OLD_ROOT_KEY_FILENAME, ROOT_CERT_FILENAME, ROOT_KEY_FILENAME } from './constants.js';
+
+import type { ConfigService } from '../../services/config/index.js';
+
+export interface Certificate {
+  cert: string;
+  key: string;
+  certPath: string;
+  keyPath: string;
+}
+
+export interface Certificates extends Certificate {
+  ca: string;
+  caPath: string;
+}
+
+const makeNumberPositive = (hexString: string): string => {
+  let mostSignificativeHexDigitAsInt = Number.parseInt(hexString[0], 16);
+  if (mostSignificativeHexDigitAsInt < 8) return hexString;
+  mostSignificativeHexDigitAsInt -= 8;
+  return mostSignificativeHexDigitAsInt.toString() + hexString.slice(1);
+};
+
+const randomSerialNumber = (): string => {
+  return makeNumberPositive(forge.util.bytesToHex(forge.random.getBytesSync(20)));
+};
+
+const getCertNotBefore = (): Date => {
+  const twoDaysAgo = new Date(Date.now() - 2 * 24 * 60 * 60 * 1000);
+  return new Date(twoDaysAgo.toISOString().split('T')[0] + 'T00:00:00Z');
+};
+
+const getCertNotAfter = (notBefore: Date): Date => {
+  const ninetyDaysLater = new Date(notBefore.getTime() + 390 * 24 * 60 * 60 * 1000);
+  return new Date(ninetyDaysLater.toISOString().split('T')[0] + 'T23:59:59Z');
+};
+
+const getCANotAfter = (notBefore: Date): Date => {
+  const hundredYearsLater = new Date(notBefore);
+  hundredYearsLater.setFullYear(hundredYearsLater.getFullYear() + 100);
+  return new Date(hundredYearsLater.toISOString().split('T')[0] + 'T23:59:59Z');
+};
+
+const isCertificateValid = (certPath: string): boolean => {
+  const cert = forge.pki.certificateFromPem(readFileSync(certPath, 'utf8'));
+  const now = new Date();
+  return now >= cert.validity.notBefore && now <= cert.validity.notAfter;
+};
+
+const isLegacyCertificate = (certPath: string): boolean => {
+  try {
+    const certPem = readFileSync(certPath, 'utf8');
+    const cert = forge.pki.certificateFromPem(certPem);
+
+    const subject = cert.subject.getField('O');
+    const ou = cert.subject.getField('OU');
+    const cn = cert.subject.getField('CN');
+
+    return subject && subject.value === 'camera.ui' && ou && ou.value === 'cui' && cn && (cn.value === 'camera.ui root certificate' || cn.value.startsWith('camera.ui'));
+  } catch (error) {
+    console.error('Error checking legacy certificate:', error);
+    return false;
+  }
+};
+
+export class CertificateGeneration {
+  static createRootCA(customAddresses: string[]): Certificate {
+    const configService = container.resolve<ConfigService>('configService');
+    const serialNumber = randomSerialNumber();
+
+    const addresses: any[] = customAddresses.map((address) => ({
+      type: isIPv4(address) || isIPv6(address) ? 7 : 2,
+      ip: isIPv4(address) || isIPv6(address) ? address : undefined,
+      value: !(isIPv4(address) || isIPv6(address)) ? address : undefined,
+    }));
+
+    if (!addresses.some((addr) => addr.ip === '127.0.0.1')) {
+      addresses.push({ type: 7, ip: '127.0.0.1' });
+    }
+
+    const attributes = [
+      { shortName: 'C', value: DEFAULTS.C },
+      { shortName: 'ST', value: DEFAULTS.ST },
+      { shortName: 'L', value: DEFAULTS.L },
+      { shortName: 'CN', value: DEFAULTS.ROOT_CN },
+      { shortName: 'O', value: DEFAULTS.O },
+      { shortName: 'OU', value: DEFAULTS.OU },
+    ];
+
+    const extensions = [
+      { name: 'basicConstraints', cA: true, critical: true },
+      {
+        name: 'keyUsage',
+        critical: true,
+        keyCertSign: true,
+        cRLSign: true,
+        digitalSignature: true,
+        nonRepudiation: true,
+        keyEncipherment: true,
+        dataEncipherment: true,
+      },
+      {
+        name: 'nsCertType',
+        client: true,
+        server: true,
+        email: true,
+        objsign: true,
+        sslCA: true,
+        emailCA: true,
+        objCA: true,
+      },
+      { name: 'subjectKeyIdentifier' },
+      { name: 'authorityKeyIdentifier', keyIdentifier: true },
+      { name: 'subjectAltName', altNames: addresses },
+    ];
+
+    const { privateKey, publicKey } = forge.pki.rsa.generateKeyPair(2048);
+    const cert = forge.pki.createCertificate();
+
+    cert.publicKey = publicKey;
+    cert.serialNumber = serialNumber;
+    cert.validity.notBefore = getCertNotBefore();
+    cert.validity.notAfter = getCANotAfter(cert.validity.notBefore);
+
+    cert.setSubject(attributes);
+    cert.setIssuer(attributes);
+    cert.setExtensions(extensions);
+
+    cert.sign(privateKey, forge.md.sha256.create());
+
+    const pemCert = forge.pki.certificateToPem(cert);
+    const pemPrivateKey = forge.pki.privateKeyToPem(privateKey);
+
+    const rootCertFilePath = join(configService.STORAGE_PATH, ROOT_CERT_FILENAME);
+    const rootPrivateKeyFilePath = join(configService.STORAGE_PATH, ROOT_KEY_FILENAME);
+
+    writeFileSync(rootCertFilePath, pemCert);
+    writeFileSync(rootPrivateKeyFilePath, pemPrivateKey);
+
+    return { cert: pemCert, certPath: rootCertFilePath, key: pemPrivateKey, keyPath: rootPrivateKeyFilePath };
+  }
+
+  static createHostCert(customAddresses: string[], rootCAObject: Certificate): Certificate {
+    const configService = container.resolve<ConfigService>('configService');
+    const addresses: any[] = customAddresses.map((address) => ({
+      type: isIPv4(address) || isIPv6(address) ? 7 : 2,
+      ip: isIPv4(address) || isIPv6(address) ? address : undefined,
+      value: !(isIPv4(address) || isIPv6(address)) ? address : undefined,
+    }));
+
+    if (!addresses.some((addr) => addr.ip === '127.0.0.1')) {
+      addresses.push({ type: 7, ip: '127.0.0.1' });
+    }
+
+    const keyPairs = forge.pki.rsa.generateKeyPair(2048);
+
+    const caCert = forge.pki.certificateFromPem(rootCAObject.cert);
+    const caKey = forge.pki.privateKeyFromPem(rootCAObject.key);
+
+    const attributes = [
+      { shortName: 'C', value: DEFAULTS.C },
+      { shortName: 'ST', value: DEFAULTS.ST },
+      { shortName: 'L', value: DEFAULTS.L },
+      { shortName: 'CN', value: DEFAULTS.CN },
+      { shortName: 'O', value: DEFAULTS.O },
+    ];
+
+    const extensions = [
+      { name: 'basicConstraints', cA: false },
+      { name: 'nsCertType', server: true },
+      { name: 'subjectKeyIdentifier' },
+      {
+        name: 'authorityKeyIdentifier',
+        authorityCertIssuer: true,
+        serialNumber: caCert.serialNumber,
+      },
+      {
+        name: 'keyUsage',
+        critical: true,
+        digitalSignature: true,
+        keyEncipherment: true,
+      },
+      {
+        name: 'extKeyUsage',
+        critical: true,
+        serverAuth: true,
+        clientAuth: true,
+      },
+      { name: 'subjectAltName', altNames: addresses },
+    ];
+
+    const cert = forge.pki.createCertificate();
+
+    cert.publicKey = keyPairs.publicKey;
+    cert.serialNumber = randomSerialNumber();
+    cert.validity.notBefore = getCertNotBefore();
+    cert.validity.notAfter = getCertNotAfter(cert.validity.notBefore);
+
+    cert.setSubject(attributes);
+    cert.setIssuer(caCert.subject.attributes);
+    cert.setExtensions(extensions);
+
+    cert.sign(caKey, forge.md.sha256.create());
+
+    const pemCert = forge.pki.certificateToPem(cert);
+    const pemPrivateKey = forge.pki.privateKeyToPem(keyPairs.privateKey);
+
+    const certFilePath = join(configService.STORAGE_PATH, HOST_CERT_FILENAME);
+    const privateKeyFilePath = join(configService.STORAGE_PATH, HOST_KEY_FILENAME);
+
+    writeFileSync(certFilePath, pemCert);
+    writeFileSync(privateKeyFilePath, pemPrivateKey);
+
+    return { cert: pemCert, certPath: certFilePath, key: pemPrivateKey, keyPath: privateKeyFilePath };
+  }
+
+  static generateCert(forceNew?: boolean): Certificates {
+    const configService = container.resolve<ConfigService>('configService');
+    const sslConfig = configService.config.ssl;
+
+    const certExists = existsSync(sslConfig.certFile) && existsSync(sslConfig.keyFile) && existsSync(sslConfig.caFile);
+    const certIsValid = certExists && isCertificateValid(sslConfig.certFile) && isCertificateValid(sslConfig.caFile);
+    const isLegacy =
+      (certExists && isLegacyCertificate(sslConfig.certFile)) ||
+      sslConfig.certFile.endsWith(OLD_ROOT_CERT_FILENAME) ||
+      sslConfig.certFile.endsWith(OLD_ROOT_KEY_FILENAME);
+
+    if (!certExists || !certIsValid || isLegacy || forceNew) {
+      const CA = CertificateGeneration.createRootCA(sslConfig.addresses ?? []);
+      const hostCert = CertificateGeneration.createHostCert(sslConfig.addresses ?? [], CA);
+
+      return {
+        ...hostCert,
+        ca: CA.cert,
+        caPath: CA.certPath,
+      };
+    } else {
+      return {
+        cert: readFileSync(sslConfig.certFile, 'utf8'),
+        certPath: sslConfig.certFile,
+        key: readFileSync(sslConfig.keyFile, 'utf8'),
+        keyPath: sslConfig.keyFile,
+        ca: readFileSync(sslConfig.caFile, 'utf8'),
+        caPath: sslConfig.caFile,
+      };
+    }
+  }
+}

package/src/api/utils/constants.ts

@@ -0,0 +1,17 @@
+export const HOST_CERT_FILENAME = 'camera.ui.cert.pem';
+export const HOST_KEY_FILENAME = 'camera.ui.key.pem';
+export const ROOT_CERT_FILENAME = 'camera.ui.ca.cert.pem';
+export const ROOT_KEY_FILENAME = 'camera.ui.ca.key.pem';
+
+export const OLD_ROOT_CERT_FILENAME = 'camera.ui.root.cert.pem';
+export const OLD_ROOT_KEY_FILENAME = 'camera.ui.root.key.pem';
+
+export const DEFAULTS = {
+  C: 'DE',
+  ST: 'Berlin',
+  L: 'Berlin',
+  O: 'Camera UI',
+  OU: 'Camera UI Dev',
+  CN: 'localhost',
+  ROOT_CN: 'Camera UI Root CA',
+};

package/src/api/utils/fetch.ts

@@ -0,0 +1,21 @@
+export async function fetchWithTimeout(url: string, options?: RequestInit, timeout = 5000): Promise<Response> {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => {
+    controller.abort();
+  }, timeout);
+
+  try {
+    const response = await fetch(url, {
+      ...options,
+      signal: controller.signal,
+    });
+    return response;
+  } catch (error) {
+    if (error instanceof Error && error.name === 'AbortError') {
+      throw new Error('Timeout: request took more than 15 seconds');
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}

package/src/api/utils/moveFiles.ts

@@ -0,0 +1,45 @@
+import { move } from 'fs-extra/esm';
+import { lstat, mkdir, readdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+
+export interface MoveOptions {
+  overwrite?: boolean;
+}
+
+export async function moveFiles(source: string, destination: string, options: MoveOptions = { overwrite: true }): Promise<void> {
+  try {
+    const sourceStat = await lstat(source);
+
+    await mkdir(dirname(destination), { recursive: true });
+
+    if (sourceStat.isFile()) {
+      await move(source, destination, {
+        overwrite: options.overwrite,
+      });
+    } else if (sourceStat.isDirectory()) {
+      const files = await readdir(source);
+
+      await Promise.all(
+        files.map(async (file) => {
+          const sourcePath = join(source, file);
+          const targetPath = join(destination, file);
+
+          try {
+            const stat = await lstat(sourcePath);
+
+            if (stat.isDirectory() || stat.isFile()) {
+              await mkdir(dirname(targetPath), { recursive: true });
+              await move(sourcePath, targetPath, {
+                overwrite: options.overwrite,
+              });
+            }
+          } catch (error) {
+            throw new Error(`Failed to move ${file}: ${error.message}`);
+          }
+        }),
+      );
+    }
+  } catch (error) {
+    throw new Error(`File operation failed: ${error.message}`);
+  }
+}

package/src/api/utils/parse.ts

@@ -0,0 +1,17 @@
+import type { JwtTokenDecoded } from '../types/index.js';
+
+export function parseJwt(access_token: string): JwtTokenDecoded {
+  const base64Url = access_token.split('.')[1];
+  const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
+
+  const jsonPayload: string = decodeURIComponent(
+    atob(base64)
+      .split('')
+      .map((c) => {
+        return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
+      })
+      .join(''),
+  );
+
+  return JSON.parse(jsonPayload);
+}

package/src/api/websocket/index.ts

@@ -0,0 +1,110 @@
+import { Server } from 'socket.io';
+import { container } from 'tsyringe';
+
+import { authorize } from '../middlewares/socketAuth.middleware.js';
+import { AuthService } from '../services/auth.service.js';
+
+import { API_EVENT } from '../../api.js';
+import { UsersService } from '../services/users.service.js';
+import { LogsNamespace } from './nsp/logs.js';
+import { MainNamespace } from './nsp/main.js';
+import { MetricsNamespace } from './nsp/metrics.js';
+import { NotificationsNamespace } from './nsp/notifications.js';
+import { PluginsNamespace } from './nsp/plugins.js';
+import { ServerNamespace } from './nsp/server.js';
+import { StatusNamespace } from './nsp/status.js';
+
+import type { FastifyInstance } from 'fastify';
+import type { DisconnectReason, ServerOptions, Socket } from 'socket.io';
+import type { CameraUiAPI } from '../../api.js';
+import type { ConfigService } from '../../services/config/index.js';
+import type { LoggerService } from '../../services/logger/index.js';
+import type { JwtTokenDecoded } from '../types/index.js';
+import type { SocketNsp, SocketNspMap } from './types.js';
+
+export class SocketService {
+  public io: Server;
+
+  public namespaces = new Map<SocketNsp, SocketNspMap>();
+  public adminNsp: SocketNsp[] = ['/logs', '/notifications', '/status', '/metrics', '/plugins', '/server'];
+
+  private logger: LoggerService;
+  private authService!: AuthService;
+  private usersService!: UsersService;
+  private configService: ConfigService;
+  private api: CameraUiAPI;
+
+  constructor(app: FastifyInstance, opts: Partial<ServerOptions>) {
+    container.registerInstance('socketService', this);
+
+    this.logger = container.resolve<LoggerService>('logger');
+    this.configService = container.resolve<ConfigService>('configService');
+    this.api = container.resolve<CameraUiAPI>('api');
+
+    this.io = new Server(app.server, opts);
+
+    this.registerNamespaces();
+
+    this.api.setMaxListeners(this.api.getMaxListeners() + 1);
+    this.api.once(API_EVENT.SHUTDOWN, () => {
+      this.io.close();
+    });
+  }
+
+  private async registerNamespaces(): Promise<void> {
+    this.authService = new AuthService();
+    this.usersService = new UsersService();
+
+    this.namespaces.set('/camera.ui', new MainNamespace(this.io));
+    this.namespaces.set('/server', new ServerNamespace(this.io));
+    this.namespaces.set('/notifications', new NotificationsNamespace(this.io));
+    this.namespaces.set('/metrics', new MetricsNamespace(this.io));
+    this.namespaces.set('/logs', new LogsNamespace(this.io));
+    this.namespaces.set('/status', new StatusNamespace(this.io));
+    this.namespaces.set('/plugins', new PluginsNamespace(this.io));
+
+    for (const [nsp, contructor] of this.namespaces) {
+      contructor.nsp.use(authorize({ secret: this.configService.SECRETS.jwtAccessKey })).on('connection', (socket: Socket) => this.setupConnection(socket, nsp));
+    }
+  }
+
+  private setupConnection(socket: Socket, nsp: SocketNsp): void {
+    const decodedToken = socket.decodedToken as JwtTokenDecoded | undefined;
+    const user = this.usersService.findByName(decodedToken?.username ?? '');
+    const address = socket.conn.remoteAddress;
+
+    try {
+      if (!user) {
+        throw new Error('User not found');
+      }
+
+      if (this.adminNsp.includes(nsp) && user.role !== 'admin' && user.role !== 'master') {
+        throw new Error(`Not authorized to connect to ${nsp}`);
+      }
+
+      const valid = this.authService.checkToken(socket.encodedToken!);
+      if (!valid) {
+        throw new Error('Unauthenticated');
+      }
+
+      const device = this.authService.clientDataByToken(socket.encodedToken!)?.device ?? 'unknown';
+
+      this.logger.trace(`${user.username} | ${address} | ${device} | authenticated and connected to ${nsp}`);
+
+      const onEnd = (reason: DisconnectReason = 'transport close') => {
+        this.logger.trace(`${user.username} | ${address} | ${device} | disconnected from ${nsp} (${reason})`);
+
+        socket.removeAllListeners('end');
+        socket.removeAllListeners('disconnect');
+
+        socket.disconnect();
+      };
+
+      // socket.on('end', onEnd.bind(this));
+      socket.on('disconnect', onEnd.bind(this));
+    } catch {
+      socket.emit('unauthenticated');
+      socket.disconnect(true);
+    }
+  }
+}