@camera.ui/server 0.0.50-internal.0 → 0.0.50-internal.2

package/src/api/utils/cert.ts

@@ -1,254 +0,0 @@
-import forge from 'node-forge';
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { isIPv4, isIPv6 } from 'node:net';
-import { join } from 'node:path';
-import { container } from 'tsyringe';
-
-import { DEFAULTS, HOST_CERT_FILENAME, HOST_KEY_FILENAME, OLD_ROOT_CERT_FILENAME, OLD_ROOT_KEY_FILENAME, ROOT_CERT_FILENAME, ROOT_KEY_FILENAME } from './constants.js';
-
-import type { ConfigService } from '../../services/config/index.js';
-
-export interface Certificate {
-  cert: string;
-  key: string;
-  certPath: string;
-  keyPath: string;
-}
-
-export interface Certificates extends Certificate {
-  ca: string;
-  caPath: string;
-}
-
-const makeNumberPositive = (hexString: string): string => {
-  let mostSignificativeHexDigitAsInt = Number.parseInt(hexString[0], 16);
-  if (mostSignificativeHexDigitAsInt < 8) return hexString;
-  mostSignificativeHexDigitAsInt -= 8;
-  return mostSignificativeHexDigitAsInt.toString() + hexString.slice(1);
-};
-
-const randomSerialNumber = (): string => {
-  return makeNumberPositive(forge.util.bytesToHex(forge.random.getBytesSync(20)));
-};
-
-const getCertNotBefore = (): Date => {
-  const twoDaysAgo = new Date(Date.now() - 2 * 24 * 60 * 60 * 1000);
-  return new Date(twoDaysAgo.toISOString().split('T')[0] + 'T00:00:00Z');
-};
-
-const getCertNotAfter = (notBefore: Date): Date => {
-  const ninetyDaysLater = new Date(notBefore.getTime() + 390 * 24 * 60 * 60 * 1000);
-  return new Date(ninetyDaysLater.toISOString().split('T')[0] + 'T23:59:59Z');
-};
-
-const getCANotAfter = (notBefore: Date): Date => {
-  const hundredYearsLater = new Date(notBefore);
-  hundredYearsLater.setFullYear(hundredYearsLater.getFullYear() + 100);
-  return new Date(hundredYearsLater.toISOString().split('T')[0] + 'T23:59:59Z');
-};
-
-const isCertificateValid = (certPath: string): boolean => {
-  const cert = forge.pki.certificateFromPem(readFileSync(certPath, 'utf8'));
-  const now = new Date();
-  return now >= cert.validity.notBefore && now <= cert.validity.notAfter;
-};
-
-const isLegacyCertificate = (certPath: string): boolean => {
-  try {
-    const certPem = readFileSync(certPath, 'utf8');
-    const cert = forge.pki.certificateFromPem(certPem);
-
-    const subject = cert.subject.getField('O');
-    const ou = cert.subject.getField('OU');
-    const cn = cert.subject.getField('CN');
-
-    return subject && subject.value === 'camera.ui' && ou && ou.value === 'cui' && cn && (cn.value === 'camera.ui root certificate' || cn.value.startsWith('camera.ui'));
-  } catch (error) {
-    console.error('Error checking legacy certificate:', error);
-    return false;
-  }
-};
-
-export class CertificateGeneration {
-  static createRootCA(customAddresses: string[]): Certificate {
-    const configService = container.resolve<ConfigService>('configService');
-    const serialNumber = randomSerialNumber();
-
-    const addresses: any[] = customAddresses.map((address) => ({
-      type: isIPv4(address) || isIPv6(address) ? 7 : 2,
-      ip: isIPv4(address) || isIPv6(address) ? address : undefined,
-      value: !(isIPv4(address) || isIPv6(address)) ? address : undefined,
-    }));
-
-    if (!addresses.some((addr) => addr.ip === '127.0.0.1')) {
-      addresses.push({ type: 7, ip: '127.0.0.1' });
-    }
-
-    const attributes = [
-      { shortName: 'C', value: DEFAULTS.C },
-      { shortName: 'ST', value: DEFAULTS.ST },
-      { shortName: 'L', value: DEFAULTS.L },
-      { shortName: 'CN', value: DEFAULTS.ROOT_CN },
-      { shortName: 'O', value: DEFAULTS.O },
-      { shortName: 'OU', value: DEFAULTS.OU },
-    ];
-
-    const extensions = [
-      { name: 'basicConstraints', cA: true, critical: true },
-      {
-        name: 'keyUsage',
-        critical: true,
-        keyCertSign: true,
-        cRLSign: true,
-        digitalSignature: true,
-        nonRepudiation: true,
-        keyEncipherment: true,
-        dataEncipherment: true,
-      },
-      {
-        name: 'nsCertType',
-        client: true,
-        server: true,
-        email: true,
-        objsign: true,
-        sslCA: true,
-        emailCA: true,
-        objCA: true,
-      },
-      { name: 'subjectKeyIdentifier' },
-      { name: 'authorityKeyIdentifier', keyIdentifier: true },
-      { name: 'subjectAltName', altNames: addresses },
-    ];
-
-    const { privateKey, publicKey } = forge.pki.rsa.generateKeyPair(2048);
-    const cert = forge.pki.createCertificate();
-
-    cert.publicKey = publicKey;
-    cert.serialNumber = serialNumber;
-    cert.validity.notBefore = getCertNotBefore();
-    cert.validity.notAfter = getCANotAfter(cert.validity.notBefore);
-
-    cert.setSubject(attributes);
-    cert.setIssuer(attributes);
-    cert.setExtensions(extensions);
-
-    cert.sign(privateKey, forge.md.sha256.create());
-
-    const pemCert = forge.pki.certificateToPem(cert);
-    const pemPrivateKey = forge.pki.privateKeyToPem(privateKey);
-
-    const rootCertFilePath = join(configService.STORAGE_PATH, ROOT_CERT_FILENAME);
-    const rootPrivateKeyFilePath = join(configService.STORAGE_PATH, ROOT_KEY_FILENAME);
-
-    writeFileSync(rootCertFilePath, pemCert);
-    writeFileSync(rootPrivateKeyFilePath, pemPrivateKey);
-
-    return { cert: pemCert, certPath: rootCertFilePath, key: pemPrivateKey, keyPath: rootPrivateKeyFilePath };
-  }
-
-  static createHostCert(customAddresses: string[], rootCAObject: Certificate): Certificate {
-    const configService = container.resolve<ConfigService>('configService');
-    const addresses: any[] = customAddresses.map((address) => ({
-      type: isIPv4(address) || isIPv6(address) ? 7 : 2,
-      ip: isIPv4(address) || isIPv6(address) ? address : undefined,
-      value: !(isIPv4(address) || isIPv6(address)) ? address : undefined,
-    }));
-
-    if (!addresses.some((addr) => addr.ip === '127.0.0.1')) {
-      addresses.push({ type: 7, ip: '127.0.0.1' });
-    }
-
-    const keyPairs = forge.pki.rsa.generateKeyPair(2048);
-
-    const caCert = forge.pki.certificateFromPem(rootCAObject.cert);
-    const caKey = forge.pki.privateKeyFromPem(rootCAObject.key);
-
-    const attributes = [
-      { shortName: 'C', value: DEFAULTS.C },
-      { shortName: 'ST', value: DEFAULTS.ST },
-      { shortName: 'L', value: DEFAULTS.L },
-      { shortName: 'CN', value: DEFAULTS.CN },
-      { shortName: 'O', value: DEFAULTS.O },
-    ];
-
-    const extensions = [
-      { name: 'basicConstraints', cA: false },
-      { name: 'nsCertType', server: true },
-      { name: 'subjectKeyIdentifier' },
-      {
-        name: 'authorityKeyIdentifier',
-        authorityCertIssuer: true,
-        serialNumber: caCert.serialNumber,
-      },
-      {
-        name: 'keyUsage',
-        critical: true,
-        digitalSignature: true,
-        keyEncipherment: true,
-      },
-      {
-        name: 'extKeyUsage',
-        critical: true,
-        serverAuth: true,
-        clientAuth: true,
-      },
-      { name: 'subjectAltName', altNames: addresses },
-    ];
-
-    const cert = forge.pki.createCertificate();
-
-    cert.publicKey = keyPairs.publicKey;
-    cert.serialNumber = randomSerialNumber();
-    cert.validity.notBefore = getCertNotBefore();
-    cert.validity.notAfter = getCertNotAfter(cert.validity.notBefore);
-
-    cert.setSubject(attributes);
-    cert.setIssuer(caCert.subject.attributes);
-    cert.setExtensions(extensions);
-
-    cert.sign(caKey, forge.md.sha256.create());
-
-    const pemCert = forge.pki.certificateToPem(cert);
-    const pemPrivateKey = forge.pki.privateKeyToPem(keyPairs.privateKey);
-
-    const certFilePath = join(configService.STORAGE_PATH, HOST_CERT_FILENAME);
-    const privateKeyFilePath = join(configService.STORAGE_PATH, HOST_KEY_FILENAME);
-
-    writeFileSync(certFilePath, pemCert);
-    writeFileSync(privateKeyFilePath, pemPrivateKey);
-
-    return { cert: pemCert, certPath: certFilePath, key: pemPrivateKey, keyPath: privateKeyFilePath };
-  }
-
-  static generateCert(forceNew?: boolean): Certificates {
-    const configService = container.resolve<ConfigService>('configService');
-    const sslConfig = configService.config.ssl;
-
-    const certExists = existsSync(sslConfig.certFile) && existsSync(sslConfig.keyFile) && existsSync(sslConfig.caFile);
-    const certIsValid = certExists && isCertificateValid(sslConfig.certFile) && isCertificateValid(sslConfig.caFile);
-    const isLegacy =
-      (certExists && isLegacyCertificate(sslConfig.certFile)) ||
-      sslConfig.certFile.endsWith(OLD_ROOT_CERT_FILENAME) ||
-      sslConfig.certFile.endsWith(OLD_ROOT_KEY_FILENAME);
-
-    if (!certExists || !certIsValid || isLegacy || forceNew) {
-      const CA = CertificateGeneration.createRootCA(sslConfig.addresses ?? []);
-      const hostCert = CertificateGeneration.createHostCert(sslConfig.addresses ?? [], CA);
-
-      return {
-        ...hostCert,
-        ca: CA.cert,
-        caPath: CA.certPath,
-      };
-    } else {
-      return {
-        cert: readFileSync(sslConfig.certFile, 'utf8'),
-        certPath: sslConfig.certFile,
-        key: readFileSync(sslConfig.keyFile, 'utf8'),
-        keyPath: sslConfig.keyFile,
-        ca: readFileSync(sslConfig.caFile, 'utf8'),
-        caPath: sslConfig.caFile,
-      };
-    }
-  }
-}

package/src/api/utils/constants.ts

@@ -1,17 +0,0 @@
-export const HOST_CERT_FILENAME = 'camera.ui.cert.pem';
-export const HOST_KEY_FILENAME = 'camera.ui.key.pem';
-export const ROOT_CERT_FILENAME = 'camera.ui.ca.cert.pem';
-export const ROOT_KEY_FILENAME = 'camera.ui.ca.key.pem';
-
-export const OLD_ROOT_CERT_FILENAME = 'camera.ui.root.cert.pem';
-export const OLD_ROOT_KEY_FILENAME = 'camera.ui.root.key.pem';
-
-export const DEFAULTS = {
-  C: 'DE',
-  ST: 'Berlin',
-  L: 'Berlin',
-  O: 'Camera UI',
-  OU: 'Camera UI Dev',
-  CN: 'localhost',
-  ROOT_CN: 'Camera UI Root CA',
-};

package/src/api/utils/fetch.ts

@@ -1,21 +0,0 @@
-export async function fetchWithTimeout(url: string, options?: RequestInit, timeout = 5000): Promise<Response> {
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => {
-    controller.abort();
-  }, timeout);
-
-  try {
-    const response = await fetch(url, {
-      ...options,
-      signal: controller.signal,
-    });
-    return response;
-  } catch (error) {
-    if (error instanceof Error && error.name === 'AbortError') {
-      throw new Error('Timeout: request took more than 15 seconds');
-    }
-    throw error;
-  } finally {
-    clearTimeout(timeoutId);
-  }
-}

package/src/api/utils/moveFiles.ts

@@ -1,45 +0,0 @@
-import { move } from 'fs-extra/esm';
-import { lstat, mkdir, readdir } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-
-export interface MoveOptions {
-  overwrite?: boolean;
-}
-
-export async function moveFiles(source: string, destination: string, options: MoveOptions = { overwrite: true }): Promise<void> {
-  try {
-    const sourceStat = await lstat(source);
-
-    await mkdir(dirname(destination), { recursive: true });
-
-    if (sourceStat.isFile()) {
-      await move(source, destination, {
-        overwrite: options.overwrite,
-      });
-    } else if (sourceStat.isDirectory()) {
-      const files = await readdir(source);
-
-      await Promise.all(
-        files.map(async (file) => {
-          const sourcePath = join(source, file);
-          const targetPath = join(destination, file);
-
-          try {
-            const stat = await lstat(sourcePath);
-
-            if (stat.isDirectory() || stat.isFile()) {
-              await mkdir(dirname(targetPath), { recursive: true });
-              await move(sourcePath, targetPath, {
-                overwrite: options.overwrite,
-              });
-            }
-          } catch (error) {
-            throw new Error(`Failed to move ${file}: ${error.message}`);
-          }
-        }),
-      );
-    }
-  } catch (error) {
-    throw new Error(`File operation failed: ${error.message}`);
-  }
-}

package/src/api/utils/parse.ts

@@ -1,17 +0,0 @@
-import type { JwtTokenDecoded } from '../types/index.js';
-
-export function parseJwt(access_token: string): JwtTokenDecoded {
-  const base64Url = access_token.split('.')[1];
-  const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
-
-  const jsonPayload: string = decodeURIComponent(
-    atob(base64)
-      .split('')
-      .map((c) => {
-        return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
-      })
-      .join(''),
-  );
-
-  return JSON.parse(jsonPayload);
-}

package/src/api/websocket/index.ts

@@ -1,110 +0,0 @@
-import { Server } from 'socket.io';
-import { container } from 'tsyringe';
-
-import { authorize } from '../middlewares/socketAuth.middleware.js';
-import { AuthService } from '../services/auth.service.js';
-
-import { API_EVENT } from '../../api.js';
-import { UsersService } from '../services/users.service.js';
-import { LogsNamespace } from './nsp/logs.js';
-import { MainNamespace } from './nsp/main.js';
-import { MetricsNamespace } from './nsp/metrics.js';
-import { NotificationsNamespace } from './nsp/notifications.js';
-import { PluginsNamespace } from './nsp/plugins.js';
-import { ServerNamespace } from './nsp/server.js';
-import { StatusNamespace } from './nsp/status.js';
-
-import type { FastifyInstance } from 'fastify';
-import type { DisconnectReason, ServerOptions, Socket } from 'socket.io';
-import type { CameraUiAPI } from '../../api.js';
-import type { ConfigService } from '../../services/config/index.js';
-import type { LoggerService } from '../../services/logger/index.js';
-import type { JwtTokenDecoded } from '../types/index.js';
-import type { SocketNsp, SocketNspMap } from './types.js';
-
-export class SocketService {
-  public io: Server;
-
-  public namespaces = new Map<SocketNsp, SocketNspMap>();
-  public adminNsp: SocketNsp[] = ['/logs', '/notifications', '/status', '/metrics', '/plugins', '/server'];
-
-  private logger: LoggerService;
-  private authService!: AuthService;
-  private usersService!: UsersService;
-  private configService: ConfigService;
-  private api: CameraUiAPI;
-
-  constructor(app: FastifyInstance, opts: Partial<ServerOptions>) {
-    container.registerInstance('socketService', this);
-
-    this.logger = container.resolve<LoggerService>('logger');
-    this.configService = container.resolve<ConfigService>('configService');
-    this.api = container.resolve<CameraUiAPI>('api');
-
-    this.io = new Server(app.server, opts);
-
-    this.registerNamespaces();
-
-    this.api.setMaxListeners(this.api.getMaxListeners() + 1);
-    this.api.once(API_EVENT.SHUTDOWN, () => {
-      this.io.close();
-    });
-  }
-
-  private async registerNamespaces(): Promise<void> {
-    this.authService = new AuthService();
-    this.usersService = new UsersService();
-
-    this.namespaces.set('/camera.ui', new MainNamespace(this.io));
-    this.namespaces.set('/server', new ServerNamespace(this.io));
-    this.namespaces.set('/notifications', new NotificationsNamespace(this.io));
-    this.namespaces.set('/metrics', new MetricsNamespace(this.io));
-    this.namespaces.set('/logs', new LogsNamespace(this.io));
-    this.namespaces.set('/status', new StatusNamespace(this.io));
-    this.namespaces.set('/plugins', new PluginsNamespace(this.io));
-
-    for (const [nsp, contructor] of this.namespaces) {
-      contructor.nsp.use(authorize({ secret: this.configService.SECRETS.jwtAccessKey })).on('connection', (socket: Socket) => this.setupConnection(socket, nsp));
-    }
-  }
-
-  private setupConnection(socket: Socket, nsp: SocketNsp): void {
-    const decodedToken = socket.decodedToken as JwtTokenDecoded | undefined;
-    const user = this.usersService.findByName(decodedToken?.username ?? '');
-    const address = socket.conn.remoteAddress;
-
-    try {
-      if (!user) {
-        throw new Error('User not found');
-      }
-
-      if (this.adminNsp.includes(nsp) && user.role !== 'admin' && user.role !== 'master') {
-        throw new Error(`Not authorized to connect to ${nsp}`);
-      }
-
-      const valid = this.authService.checkToken(socket.encodedToken!);
-      if (!valid) {
-        throw new Error('Unauthenticated');
-      }
-
-      const device = this.authService.clientDataByToken(socket.encodedToken!)?.device ?? 'unknown';
-
-      this.logger.trace(`${user.username} | ${address} | ${device} | authenticated and connected to ${nsp}`);
-
-      const onEnd = (reason: DisconnectReason = 'transport close') => {
-        this.logger.trace(`${user.username} | ${address} | ${device} | disconnected from ${nsp} (${reason})`);
-
-        socket.removeAllListeners('end');
-        socket.removeAllListeners('disconnect');
-
-        socket.disconnect();
-      };
-
-      // socket.on('end', onEnd.bind(this));
-      socket.on('disconnect', onEnd.bind(this));
-    } catch {
-      socket.emit('unauthenticated');
-      socket.disconnect(true);
-    }
-  }
-}