@crombolo/server 0.13.2 → 0.14.4

package/src/member-auth.ts

@@ -12,6 +12,9 @@
  *   POST /umbraco/members/logout
  *   POST /umbraco/members/register  name, email, username, password, returnUrl?
  *   GET  /umbraco/members/current
+ *   POST /umbraco/members/login/2fa  code, returnUrl?   the second step, when 2FA is on
+ *   GET  /umbraco/members/2fa                           the signed-in member's 2FA state
+ *   POST /umbraco/members/2fa/setup | enable | disable   turning it on and off (story 032)
  *
  * A form post is answered with a redirect, a JSON post with JSON, so the same
  * endpoint serves a plain `<form>` in a TSX template and a fetch from the page.
@@ -27,14 +30,17 @@ import {
   passwordConfigJson,
   readCookie,
   readMemberTicket,
+  readShortLived,
   serializeCookie,
   signMemberTicket,
+  signShortLived,
   verifyPassword,
 } from '@crombolo/auth'
 import {
   DEFAULT_PASSWORD_CONFIGURATION,
   isValidPassword,
   localReturnUrl,
+  memberMayOpen,
   ObjectTypes,
 } from '@crombolo/core'
 import {
@@ -45,14 +51,25 @@ import {
   type NodeSchemaState,
   PublicAccessRepository,
 } from '@crombolo/data'
-import type { AccessDecision, PublishedContent, RequestMember } from '@crombolo/render'
+import {
+  type AccessDecision,
+  MEMBER_EXTERNAL_SIGN_IN_PATH,
+  type PublishedContent,
+  type RequestMember,
+} from '@crombolo/render'
 import type { CromboloConfig } from './config.ts'
+import { createExternalSignIn, type ExternalAccount } from './external-sign-in.ts'
+import { IdentityProviderOverrides } from './identity-provider-overrides.ts'
+import { MEMBER_TWO_FACTOR_PROVIDER, TwoFactorService } from './two-factor.ts'
 
 /** The key member tickets are signed with, generated once and shared by every node. */
 const SIGNING_KEY = 'crombolo/memberCookieKey'
 
 export const MEMBER_ROUTE_PREFIX = '/umbraco/members'
 
+/** How long a member has to enter their code after their password. */
+const TWO_FACTOR_PENDING_SECONDS = 5 * 60
+
 export interface MemberAuthOptions {
   /** The schema state this node runs at; a registration is refused without it. */
   nodeState?: NodeSchemaState
@@ -72,6 +89,11 @@ export interface MemberAuth {
   handle(request: Request, pathname: string): Promise<Response | undefined>
   /** The `Set-Cookie` value that ends a member's site session. */
   signOutCookie(): string
+  /**
+   * Where a "Sign in with …" link for a member identity provider goes, by its
+   * id; undefined for a provider the site does not configure.
+   */
+  externalSignInUrl(providerId: string, returnUrl?: string): string | undefined
 }
 
 const isFormPost = (request: Request) =>
@@ -149,6 +171,13 @@ export function createMemberAuth(
     return signingKey
   }
 
+  const twoFactor = new TwoFactorService(db, {
+    secretKey: config.secretKey,
+    issuer: config.siteName,
+  })
+  const pendingCookie = `${cookie}TwoFactor`
+  const flagged = (url: string, flags: string) => `${url}${url.includes('?') ? '&' : '?'}${flags}`
+
   const asRequestMember = (member: {
     key: string
     name: string
@@ -176,6 +205,93 @@ export function createMemberAuth(
     })
   }
 
+  /** Member group keys by name, for the names a registration or a provider names. */
+  const groupKeysFor = async (names: readonly string[]): Promise<string[]> => {
+    const keys: string[] = []
+    for (const groupName of names) {
+      const rows = await db.query<{ unique_id: string }>(
+        'SELECT unique_id FROM node WHERE text = ? AND node_object_type = ?',
+        [groupName, ObjectTypes.MemberGroup],
+      )
+      if (rows[0]) keys.push(String(rows[0].unique_id))
+    }
+    return keys
+  }
+
+  const asAccount = (member: { key: string; email: string; roles: string[] }): ExternalAccount => ({
+    key: member.key,
+    email: member.email,
+    groups: member.roles,
+  })
+
+  const MEMBER_EXTERNAL_PATH = MEMBER_EXTERNAL_SIGN_IN_PATH
+  const external =
+    config.memberIdentityProviders.length === 0
+      ? undefined
+      : createExternalSignIn(
+          db,
+          {
+            audience: 'member',
+            providers: config.memberIdentityProviders,
+            basePath: MEMBER_EXTERNAL_PATH,
+            byKey: async (key) => {
+              const member = await members.byKey(key)
+              return member ? asAccount(member) : undefined
+            },
+            byEmail: async (email) => {
+              const member = await members.byEmail(email)
+              return member ? asAccount(member) : undefined
+            },
+            create: async (identity, provider, groups) => {
+              const alias = provider.memberType ?? config.memberRegistrationType
+              const type = await memberTypes.byAlias(alias)
+              if (!type) throw new Error(`The member type "${alias}" does not exist.`)
+              const email = identity.email as string
+              // The email is the username, as registration makes it, unless
+              // someone already signs in with that name.
+              const username = (await members.taken('username', email))
+                ? `${provider.oidc.id}-${identity.subject}`
+                : email
+              const created = await members.create(
+                {
+                  key: crypto.randomUUID(),
+                  contentTypeKey: type.key,
+                  componentKey: null,
+                  parentKey: null,
+                  values: [],
+                  variants: [{ culture: null, segment: null, name: identity.name || email }],
+                },
+                {
+                  email,
+                  username,
+                  isApproved: true,
+                  isLockedOut: false,
+                  groupKeys: await groupKeysFor(groups),
+                },
+              )
+              return asAccount(created)
+            },
+            setGroups: async (account, groups) => {
+              await members.setGroups(account.key, await groupKeysFor(groups))
+            },
+            signIn: async (account) => {
+              const member = await members.byKey(account.key)
+              if (!member?.isApproved || member.isLockedOut)
+                return { refused: 'This account cannot sign in at the moment.' }
+              await members.recordLogin(member.key)
+              return { cookies: [await issue(member.key, member.securityStamp, false)] }
+            },
+            failed: (returnUrl, reason) =>
+              `${returnUrl}${returnUrl.includes('?') ? '&' : '?'}memberLoginFailed=1&memberLoginError=${encodeURIComponent(reason)}`,
+          },
+          {
+            applicationUrl: config.applicationUrl,
+            secureCookies: config.secureCookies,
+            resolve: (provider) =>
+              new IdentityProviderOverrides(db, config.secretKey).apply('member', provider),
+          },
+        )
+
   const resolve: MemberAuth['resolve'] = async (request) => {
     const ticket = await readMemberTicket(await secret(), readCookie(request, cookie))
     if (!ticket) return undefined
@@ -196,12 +312,7 @@ export function createMemberAuth(
     // branch they serve, or the substitution would never terminate.
     if (here === entry.loginNodeKey || here === entry.errorNodeKey) return { status: 'allowed' }
     if (!member) return { status: 'substitute', contentKey: entry.loginNodeKey }
-    const allowed =
-      entry.memberUserNames.some((name) => name.toLowerCase() === member.username.toLowerCase()) ||
-      entry.memberGroupNames.some((name) =>
-        member.roles.some((role) => role.toLowerCase() === name.toLowerCase()),
-      )
-    return allowed
+    return memberMayOpen(entry, { username: member.username, groups: member.roles })
       ? { status: 'allowed' }
       : { status: 'substitute', contentKey: entry.errorNodeKey }
   }
@@ -268,6 +379,28 @@ export function createMemberAuth(
         await hashPassword(input.password ?? ''),
         passwordConfigJson(),
       )
+    if ((await twoFactor.providers(member.key)).includes(MEMBER_TWO_FACTOR_PROVIDER)) {
+      const pending = await signShortLived(
+        await secret(),
+        { sub: member.key, persist: input.rememberMe === 'true' ? 1 : 0 },
+        TWO_FACTOR_PENDING_SECONDS,
+      )
+      return answer(
+        request,
+        { ok: true, body: { twoFactorRequired: true } },
+        {
+          returnUrl: flagged(back, 'memberTwoFactorRequired=1'),
+          cookies: [
+            serializeCookie({
+              name: pendingCookie,
+              value: pending,
+              secure: config.secureCookies,
+              maxAgeSeconds: TWO_FACTOR_PENDING_SECONDS,
+            }),
+          ],
+        },
+      )
+    }
     await members.recordLogin(member.key)
     return answer(
       request,
@@ -279,6 +412,87 @@ export function createMemberAuth(
     )
   }
 
+  /** The second step: the code from the app, or a recovery code, after the password. */
+  const verifyTwoFactor = async (request: Request): Promise<Response> => {
+    const input = await readInput(request)
+    const back = safeReturnUrl(input.returnUrl) ?? '/'
+    const pending = await readShortLived(await secret(), readCookie(request, pendingCookie))
+    const key = typeof pending?.sub === 'string' ? pending.sub : undefined
+    const member = key ? await members.byKey(key) : undefined
+    if (!member || member.isLockedOut || !member.isApproved)
+      return answer(
+        request,
+        { ok: false, status: 401, error: 'Sign in again.' },
+        {
+          returnUrl: flagged(back, 'memberLoginFailed=1'),
+          cookies: [expireCookie(pendingCookie, config.secureCookies)],
+        },
+      )
+    if (!(await twoFactor.verify(member.key, MEMBER_TWO_FACTOR_PROVIDER, input.code ?? ''))) {
+      await members.recordFailedLogin(member.key, config.maxFailedPasswordAttempts)
+      return answer(
+        request,
+        { ok: false, status: 400, error: 'That code is not right.' },
+        { returnUrl: flagged(back, 'memberTwoFactorRequired=1&memberLoginFailed=1') },
+      )
+    }
+    await members.recordLogin(member.key)
+    return answer(
+      request,
+      { ok: true, body: { member: asRequestMember(member) } },
+      {
+        returnUrl: back,
+        cookies: [
+          await issue(member.key, member.securityStamp, pending?.persist === 1),
+          expireCookie(pendingCookie, config.secureCookies),
+        ],
+      },
+    )
+  }
+
+  /** The signed-in member's own two-factor settings; JSON, as the recovery codes must be shown. */
+  const manageTwoFactor = async (request: Request, step: string): Promise<Response> => {
+    const member = await resolve(request)
+    if (!member) return Response.json({ error: 'Sign in first.' }, { status: 401 })
+    const refused = (message: string, status = 400) => Response.json({ error: message }, { status })
+    if (step === '') {
+      if (request.method !== 'GET') return new Response(null, { status: 405 })
+      return Response.json({
+        available: twoFactor.available,
+        enabled: (await twoFactor.providers(member.key)).includes(MEMBER_TWO_FACTOR_PROVIDER),
+        recoveryCodesLeft: await twoFactor.recoveryCodesLeft(member.key),
+      })
+    }
+    if (request.method !== 'POST') return new Response(null, { status: 405 })
+    if (!fromThisSite(request)) return new Response('Forbidden', { status: 403 })
+    const input = await readInput(request)
+    switch (step) {
+      case 'setup': {
+        const setup = twoFactor.setup(member.email || member.username)
+        return setup.ok ? Response.json(setup.value) : refused(setup.message)
+      }
+      case 'enable': {
+        const enabled = await twoFactor.enable(
+          member.key,
+          MEMBER_TWO_FACTOR_PROVIDER,
+          input.secret ?? '',
+          input.code ?? '',
+        )
+        return enabled.ok ? Response.json(enabled.value) : refused(enabled.message)
+      }
+      case 'disable': {
+        const disabled = await twoFactor.disable(
+          member.key,
+          MEMBER_TWO_FACTOR_PROVIDER,
+          input.code ?? '',
+        )
+        return disabled.ok ? Response.json({ ok: true }) : refused(disabled.message)
+      }
+      default:
+        return new Response(null, { status: 404 })
+    }
+  }
+
   const logout = async (request: Request): Promise<Response> => {
     const input = await readInput(request)
     return answer(
@@ -334,14 +548,7 @@ export function createMemberAuth(
         status: 400,
         error: `A password must be at least ${DEFAULT_PASSWORD_CONFIGURATION.minimumPasswordLength} characters.`,
       })
-    const groupKeys: string[] = []
-    for (const groupName of config.memberRegistrationGroups) {
-      const rows = await db.query<{ unique_id: string }>(
-        'SELECT unique_id FROM node WHERE text = ? AND node_object_type = ?',
-        [groupName, ObjectTypes.MemberGroup],
-      )
-      if (rows[0]) groupKeys.push(String(rows[0].unique_id))
-    }
+    const groupKeys = await groupKeysFor(config.memberRegistrationGroups)
     const created = await members.create(
       {
         key: crypto.randomUUID(),
@@ -375,19 +582,29 @@ export function createMemberAuth(
     resolve,
     decide,
     signOutCookie: () => expireCookie(cookie, config.secureCookies),
+    externalSignInUrl: (providerId, returnUrl) =>
+      config.memberIdentityProviders.some((p) => p.oidc.id === providerId)
+        ? external?.startUrl(providerId, returnUrl)
+        : undefined,
     async handle(request, pathname) {
       if (!pathname.startsWith(`${MEMBER_ROUTE_PREFIX}/`)) return undefined
+      if (pathname.startsWith(`${MEMBER_EXTERNAL_PATH}/`))
+        return external?.handle(request, pathname) ?? undefined
       const action = pathname.slice(MEMBER_ROUTE_PREFIX.length + 1)
       if (action === 'current') {
         if (request.method !== 'GET') return new Response(null, { status: 405 })
         const member = await resolve(request)
         return member ? Response.json({ member }) : Response.json({ member: null }, { status: 401 })
       }
+      if (action === '2fa' || action.startsWith('2fa/'))
+        return manageTwoFactor(request, action.slice(4))
       if (request.method !== 'POST') return new Response(null, { status: 405 })
       if (!fromThisSite(request)) return new Response('Forbidden', { status: 403 })
       switch (action) {
         case 'login':
           return login(request)
+        case 'login/2fa':
+          return verifyTwoFactor(request)
         case 'logout':
           return logout(request)
         case 'register':

package/src/ports.ts

@@ -12,6 +12,7 @@ import type {
   ServerPort,
   TemporaryFilePort,
   UserItemPort,
+  UserTwoFactorPort,
 } from '@crombolo/api-management'
 import { AuthStore, expireCookie, serializeCookie } from '@crombolo/auth'
 import {
@@ -84,6 +85,7 @@ import { createOEmbedService } from './oembed.ts'
 import { createRedirectTracker } from './redirects.ts'
 import { componentAliasesIn, type SchemaBoot } from './schema.ts'
 import { publishSchema } from './schema-store.ts'
+import { TwoFactorService, USER_TWO_FACTOR_PROVIDER } from './two-factor.ts'
 import { createWebhookService, type WebhookService } from './webhooks.ts'
 
 /** Re-exported for tests; the canonical list lives in @crombolo/core. */
@@ -492,7 +494,22 @@ export function createDeps(options: DepsOptions): ManagementApiDeps {
         await store.endAllSessionsForUser(userId)
       },
     })
-    deps.userManagement = userPorts.users
+    // Story 032: the authenticator provider, offered only where secrets can be sealed.
+    const twoFactor = new TwoFactorService(options.db, {
+      secretKey: options.config.secretKey,
+      issuer: options.config.siteName,
+    })
+    const configuration = userPorts.users.configuration
+    const currentConfiguration = userPorts.users.currentConfiguration
+    deps.userManagement = {
+      ...userPorts.users,
+      configuration: () => ({ ...configuration(), allowTwoFactor: twoFactor.available }),
+      currentConfiguration: () => ({
+        ...currentConfiguration(),
+        allowTwoFactor: twoFactor.available,
+      }),
+      twoFactor: userTwoFactorPort(twoFactor),
+    }
     deps.userGroups = userPorts.groups
     deps.userData = userPorts.userData
     deps.media = createMediaPort(options.db, mediaFiles, {
@@ -621,3 +638,40 @@ export function createDeps(options: DepsOptions): ManagementApiDeps {
   }
   return deps
 }
+
+/** The user operations' view of two-factor sign-in: the one authenticator provider. */
+function userTwoFactorPort(service: TwoFactorService): UserTwoFactorPort {
+  const provider = USER_TWO_FACTOR_PROVIDER
+  return {
+    providerName: provider,
+    async list(userKey) {
+      return [
+        {
+          providerName: provider,
+          isEnabledOnUser: (await service.providers(userKey)).includes(provider),
+        },
+      ]
+    },
+    setup(account) {
+      const setup = service.setup(account)
+      return setup.ok
+        ? {
+            ok: true,
+            secret: setup.value.secret,
+            qrCodeSetupImageUrl: setup.value.qrCodeSetupImageUrl,
+          }
+        : { ok: false, message: setup.message }
+    },
+    async enable(userKey, code, secret) {
+      const enabled = await service.enable(userKey, provider, secret, code)
+      return enabled.ok
+        ? { ok: true, recoveryCodes: enabled.value.recoveryCodes }
+        : { ok: false, message: enabled.message }
+    },
+    async disable(userKey, code) {
+      const disabled = await service.disable(userKey, provider, code)
+      return disabled.ok ? { ok: true } : { ok: false, message: disabled.message }
+    },
+    reset: (userKey) => service.reset(userKey, provider),
+  }
+}

package/src/remote-credentials.ts

@@ -0,0 +1,108 @@
+/**
+ * A developer's sign-ins to remotes (story 108): kept in the operating system's
+ * keychain (macOS Keychain, Windows Credential Manager, libsecret) through
+ * `Bun.secrets`, keyed by the remote's origin, never in the site's folder.
+ * Shared by the CLI's commands and a lazily-fetching local media store.
+ */
+
+export const KEYCHAIN_SERVICE = 'crombolo-remote'
+
+export interface Keychain {
+  get(name: string): Promise<string | null>
+  set(name: string, value: string): Promise<void>
+  delete(name: string): Promise<void>
+}
+
+/** The operating system's keychain. */
+export function osKeychain(): Keychain {
+  return {
+    get: (name) => Bun.secrets.get({ service: KEYCHAIN_SERVICE, name }),
+    set: (name, value) => Bun.secrets.set({ service: KEYCHAIN_SERVICE, name, value }),
+    delete: async (name) => {
+      await Bun.secrets.delete({ service: KEYCHAIN_SERVICE, name })
+    },
+  }
+}
+
+/** A keychain in memory, for tests and machines without one. */
+export function memoryKeychain(): Keychain {
+  const values = new Map<string, string>()
+  return {
+    get: async (name) => values.get(name) ?? null,
+    set: async (name, value) => {
+      values.set(name, value)
+    },
+    delete: async (name) => {
+      values.delete(name)
+    },
+  }
+}
+
+export interface RemoteSignIn {
+  accessToken: string
+  refreshToken: string
+  /** Milliseconds since the epoch. */
+  expiresAt: number
+  tokenUrl: string
+  clientId: string
+  /** Who approved it, for `whoami`. */
+  user?: string
+}
+
+const keyOf = (origin: string) => new URL(origin).origin
+
+export async function readSignIn(
+  keychain: Keychain,
+  origin: string,
+): Promise<RemoteSignIn | undefined> {
+  const stored = await keychain.get(keyOf(origin))
+  if (!stored) return undefined
+  try {
+    return JSON.parse(stored) as RemoteSignIn
+  } catch {
+    return undefined
+  }
+}
+
+export const saveSignIn = (keychain: Keychain, origin: string, signIn: RemoteSignIn) =>
+  keychain.set(keyOf(origin), JSON.stringify(signIn))
+
+export const forgetSignIn = (keychain: Keychain, origin: string) => keychain.delete(keyOf(origin))
+
+/**
+ * A usable access token: the stored one, or a refreshed one when it is within a
+ * minute of expiring. Undefined when there is no sign-in, or the remote refused
+ * the refresh — the person signs in again.
+ */
+export async function freshAccessToken(
+  keychain: Keychain,
+  origin: string,
+  http: typeof fetch = fetch,
+  force = false,
+): Promise<string | undefined> {
+  const signIn = await readSignIn(keychain, origin)
+  if (!signIn) return undefined
+  if (!force && signIn.expiresAt - Date.now() > 60_000) return signIn.accessToken
+  const response = await http(signIn.tokenUrl, {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: signIn.refreshToken,
+      client_id: signIn.clientId,
+    }).toString(),
+  })
+  if (!response.ok) return undefined
+  const tokens = (await response.json()) as {
+    access_token: string
+    refresh_token: string
+    expires_in: number
+  }
+  await saveSignIn(keychain, origin, {
+    ...signIn,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    expiresAt: Date.now() + tokens.expires_in * 1000,
+  })
+  return tokens.access_token
+}

package/src/remote-media.ts

@@ -0,0 +1,91 @@
+/**
+ * Media fetched from a remote on first request (story 108, `pull
+ * --media-info-only --lazy-media`): a local site pulled without its media
+ * files reads each one through from the remote it came from the first time it
+ * is asked for, under the developer's own sign-in, and keeps it.
+ *
+ * Only the store the site serves from is wrapped. An export reads the plain
+ * store, so pushing a lazily-pulled site never downloads what it never used.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { logger } from './logging.ts'
+import type { MediaStore, StoredFile } from './media-store.ts'
+import { freshAccessToken, type Keychain, osKeychain } from './remote-credentials.ts'
+
+export const REMOTE_MEDIA_FILE = join('.crombolo', 'remote-media.json')
+
+export interface RemoteMediaSource {
+  /** The remote's API base, which is also what its sign-in is kept under. */
+  api: string
+  environment: string
+}
+
+export function readRemoteMedia(siteDir: string): RemoteMediaSource | undefined {
+  const file = join(siteDir, REMOTE_MEDIA_FILE)
+  if (!existsSync(file)) return undefined
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8')) as Partial<RemoteMediaSource>
+    return typeof parsed.api === 'string' && typeof parsed.environment === 'string'
+      ? { api: parsed.api, environment: parsed.environment }
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function writeRemoteMedia(siteDir: string, source: RemoteMediaSource): void {
+  const file = join(siteDir, REMOTE_MEDIA_FILE)
+  mkdirSync(dirname(file), { recursive: true })
+  writeFileSync(file, `${JSON.stringify(source, null, 2)}\n`)
+}
+
+/** The site's store, reading through to its remote when the site was pulled lazily. */
+export function withRemoteMedia(
+  store: MediaStore,
+  siteDir: string,
+  options: { keychain?: Keychain; http?: typeof fetch } = {},
+): MediaStore {
+  const source = readRemoteMedia(siteDir)
+  if (!source) return store
+  const keychain = options.keychain ?? osKeychain()
+  const http = options.http ?? fetch
+  const log = logger('media')
+  let warned = false
+
+  const fetchThrough = async (key: string): Promise<StoredFile | undefined> => {
+    const token = await freshAccessToken(keychain, source.api, http)
+    if (!token) {
+      if (!warned)
+        log.warning(
+          'A media file is not here yet, and fetching it needs `crombolo login` to {api}',
+          {
+            api: source.api,
+          },
+        )
+      warned = true
+      return undefined
+    }
+    const path = key.split('/').map(encodeURIComponent).join('/')
+    const response = await http(`${source.api}/environments/${source.environment}/media/${path}`, {
+      headers: { authorization: `Bearer ${token}` },
+    }).catch(() => undefined)
+    if (!response?.ok) return undefined
+    await store.put(key, await response.blob())
+    return store.get(key)
+  }
+
+  return {
+    ...store,
+    description: `${store.description} (fetching from ${new URL(source.api).origin})`,
+    async get(key) {
+      const local = await store.get(key)
+      if (local || key.startsWith('.')) return local
+      return fetchThrough(key)
+    },
+    put: (key, body, putOptions) => store.put(key, body, putOptions),
+    delete: (key) => store.delete(key),
+    list: (prefix) => store.list(prefix),
+    ...(store.publicUrl ? { publicUrl: (key: string) => store.publicUrl?.(key) } : {}),
+  }
+}