@cuongtran001/kanna 1.71.2 → 1.72.0

package/src/server/auth.ts

@@ -1,9 +1,11 @@
-import { randomBytes, timingSafeEqual } from "node:crypto"
-import type { AuthSessionStore } from "./auth-session-store.adapter"
 import { isJsonObject, type JsonValue } from "../shared/json"
-
-const SESSION_COOKIE_NAME = "kanna_session"
-const TOUCH_THROTTLE_MS = 60 * 1000
+import {
+  CLIENT_IP_HEADER,
+  OWNER_EMAIL,
+  SESSION_COOKIE_NAME,
+  SIGN_IN_PATH,
+  type AuthBackend,
+} from "./auth-backend"
 
 export interface AuthStatusPayload {
   enabled: boolean
@@ -11,12 +13,12 @@ export interface AuthStatusPayload {
 }
 
 export interface AuthManager {
-  isAuthenticated(req: Request): boolean
+  isAuthenticated(req: Request): Promise<boolean>
   validateOrigin(req: Request): boolean
   redirectToApp(req: Request): Response
-  handleLogin(req: Request, nextPath: string): Promise<Response>
-  handleLogout(req: Request): Response
-  handleStatus(req: Request): Response
+  handleLogin(req: Request, nextPath: string, clientIp: string | null): Promise<Response>
+  handleLogout(req: Request): Promise<Response>
+  handleStatus(req: Request): Promise<Response>
   dispose(): Promise<void>
 }
 
@@ -68,26 +70,19 @@ function shouldUseSecureCookie(req: Request, trustProxy: boolean) {
   return new URL(req.url).protocol === "https:"
 }
 
-function buildCookie(
-  name: string,
-  value: string,
-  req: Request,
-  trustProxy: boolean,
-  maxAgeSeconds: number,
-) {
-  const parts = [
+function isLoopbackAddress(ip: string | null) {
+  if (!ip) return false
+  return ip === "::1" || ip.startsWith("127.") || ip.startsWith("::ffff:127.")
+}
+
+function buildCookie(name: string, value: string, maxAgeSeconds: number) {
+  return [
     `${name}=${encodeURIComponent(value)}`,
     "Path=/",
     "HttpOnly",
     "SameSite=Strict",
     `Max-Age=${maxAgeSeconds}`,
-  ]
-
-  if (shouldUseSecureCookie(req, trustProxy)) {
-    parts.push("Secure")
-  }
-
-  return parts.join("; ")
+  ].join("; ")
 }
 
 async function readLoginForm(req: Request) {
@@ -112,8 +107,6 @@ async function readLoginForm(req: Request) {
 
 export interface AuthManagerOptions {
   trustProxy?: boolean
-  sessionStore: AuthSessionStore
-  getMaxAgeMs: () => number
 }
 
 export function isPublicSharePath(url: string): boolean {
@@ -129,35 +122,38 @@ export function isPublicSharePath(url: string): boolean {
     || pathname.startsWith("/assets/share-view/")
 }
 
-export function createAuthManager(password: string, options: AuthManagerOptions): AuthManager {
-  const expectedPassword = Buffer.from(password)
+export function createAuthManager(backend: AuthBackend, options: AuthManagerOptions = {}): AuthManager {
   const trustProxy = options.trustProxy ?? false
-  const sessionStore = options.sessionStore
-  const getMaxAgeMs = options.getMaxAgeMs
-  const lastTouchedAt = new Map<string, number>()
 
-  function getSessionToken(req: Request) {
-    return parseCookies(req.headers.get("cookie")).get(SESSION_COOKIE_NAME) ?? null
+  function sessionHeaders(req: Request) {
+    const headers = new Headers()
+    const cookie = req.headers.get("cookie")
+    if (cookie) headers.set("cookie", cookie)
+    return headers
   }
 
-  function maybeTouchSession(token: string) {
-    const now = Date.now()
-    const last = lastTouchedAt.get(token)
-    if (last !== undefined && now - last < TOUCH_THROTTLE_MS) return
-    lastTouchedAt.set(token, now)
-    sessionStore.touch(token, getMaxAgeMs())
+  function hasSessionCookie(req: Request) {
+    return parseCookies(req.headers.get("cookie")).has(SESSION_COOKIE_NAME)
   }
 
-  function isAuthenticated(req: Request) {
-    const sessionToken = getSessionToken(req)
-    if (!sessionToken) return false
-    const session = sessionStore.validate(sessionToken)
-    if (!session) {
-      lastTouchedAt.delete(sessionToken)
-      return false
+  function withSecureAttribute(req: Request, setCookie: string) {
+    return shouldUseSecureCookie(req, trustProxy) ? `${setCookie}; Secure` : setCookie
+  }
+
+  function appendCookies(response: Response, req: Request, setCookies: string[]) {
+    for (const setCookie of setCookies) {
+      response.headers.append("Set-Cookie", withSecureAttribute(req, setCookie))
     }
-    maybeTouchSession(sessionToken)
-    return true
+    return response
+  }
+
+  async function readSession(req: Request) {
+    if (!hasSessionCookie(req)) return { authenticated: false, setCookies: [] }
+    return backend.getSession(sessionHeaders(req))
+  }
+
+  async function isAuthenticated(req: Request) {
+    return (await readSession(req)).authenticated
   }
 
   function validateOrigin(req: Request) {
@@ -168,35 +164,37 @@ export function createAuthManager(password: string, options: AuthManagerOptions)
     return origin === effectiveOrigin(req, trustProxy)
   }
 
-  function createSessionCookie(req: Request) {
-    const sessionToken = randomBytes(32).toString("base64url")
-    const maxAgeMs = getMaxAgeMs()
-    sessionStore.create(sessionToken, maxAgeMs)
-    return buildCookie(SESSION_COOKIE_NAME, sessionToken, req, trustProxy, Math.floor(maxAgeMs / 1000))
-  }
-
-  function clearSessionCookie(req: Request) {
-    const sessionToken = getSessionToken(req)
-    if (sessionToken) {
-      sessionStore.revoke(sessionToken)
-      lastTouchedAt.delete(sessionToken)
-    }
-    return buildCookie(SESSION_COOKIE_NAME, "", req, trustProxy, 0)
-  }
-
-  function verifyPassword(candidate: string) {
-    const actual = Buffer.from(candidate)
-    if (actual.length !== expectedPassword.length) {
-      return false
-    }
-    return timingSafeEqual(actual, expectedPassword)
-  }
-
-  function handleStatus(req: Request) {
-    return Response.json({
+  function resolveClientIp(req: Request, socketIp: string | null) {
+    if (!trustProxy || !isLoopbackAddress(socketIp)) return socketIp
+    const cloudflare = req.headers.get("cf-connecting-ip")?.trim()
+    if (cloudflare) return cloudflare
+    const forwarded = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim()
+    return forwarded || socketIp
+  }
+
+  function buildSignInRequest(req: Request, password: string, clientIp: string | null) {
+    const origin = effectiveOrigin(req, trustProxy)
+    const headers = new Headers({
+      "content-type": "application/json",
+      origin,
+    })
+    const userAgent = req.headers.get("user-agent")
+    if (userAgent) headers.set("user-agent", userAgent)
+    if (clientIp) headers.set(CLIENT_IP_HEADER, clientIp)
+    return new Request(`${origin}${SIGN_IN_PATH}`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ email: OWNER_EMAIL, password, rememberMe: true }),
+    })
+  }
+
+  async function handleStatus(req: Request) {
+    const session = await readSession(req)
+    const response = Response.json({
       enabled: true,
-      authenticated: isAuthenticated(req),
+      authenticated: session.authenticated,
     } satisfies AuthStatusPayload)
+    return appendCookies(response, req, session.setCookies)
   }
 
   function redirectToApp(req: Request) {
@@ -204,35 +202,40 @@ export function createAuthManager(password: string, options: AuthManagerOptions)
     return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), effectiveOrigin(req, trustProxy)), 302)
   }
 
-  async function handleLogin(req: Request, fallbackNextPath: string) {
+  async function handleLogin(req: Request, fallbackNextPath: string, socketIp: string | null) {
     if (!validateOrigin(req)) {
       return Response.json({ error: "Forbidden" }, { status: 403 })
     }
 
-    const { password: candidate, nextPath } = await readLoginForm(req)
-    if (!verifyPassword(candidate)) {
+    const { password, nextPath } = await readLoginForm(req)
+    const upstream = await backend.signIn(buildSignInRequest(req, password, resolveClientIp(req, socketIp)))
+
+    if (upstream.status === 429) {
+      const limited = Response.json({ error: "Too many attempts" }, { status: 429 })
+      const retryAfter = upstream.headers.get("retry-after")
+      if (retryAfter) limited.headers.set("Retry-After", retryAfter)
+      return limited
+    }
+    if (!upstream.ok) {
       return Response.json({ error: "Invalid password" }, { status: 401 })
     }
 
     const response = Response.json({ ok: true, nextPath: sanitizeNextPath(nextPath || fallbackNextPath) })
-
-    response.headers.set("Set-Cookie", createSessionCookie(req))
-    return response
+    return appendCookies(response, req, upstream.headers.getSetCookie())
   }
 
-  function handleLogout(req: Request) {
+  async function handleLogout(req: Request) {
     if (!validateOrigin(req)) {
       return Response.json({ error: "Forbidden" }, { status: 403 })
     }
 
-    const response = Response.json({ ok: true })
-    response.headers.set("Set-Cookie", clearSessionCookie(req))
-    return response
+    const issued = hasSessionCookie(req) ? await backend.signOut(sessionHeaders(req)) : []
+    const clearing = issued.length > 0 ? issued : [buildCookie(SESSION_COOKIE_NAME, "", 0)]
+    return appendCookies(Response.json({ ok: true }), req, clearing)
   }
 
   async function dispose() {
-    lastTouchedAt.clear()
-    await sessionStore.dispose()
+    await backend.dispose()
   }
 
   return {

package/src/server/better-auth.adapter.ts

@@ -0,0 +1,197 @@
+import { Database } from "bun:sqlite"
+import { randomBytes } from "node:crypto"
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises"
+import path from "node:path"
+import { betterAuth, type BetterAuthOptions } from "better-auth"
+import { getMigrations } from "better-auth/db/migration"
+import { isErrnoException, toError } from "../shared/errors"
+import { log } from "../shared/log"
+import type { AppSettingsManager } from "./app-settings"
+import { createAuthManager, type AuthManager } from "./auth"
+import { CLIENT_IP_HEADER, OWNER_EMAIL, SESSION_COOKIE_NAME, type AuthBackend } from "./auth-backend"
+
+const SECRET_FILE = "auth-secret"
+const DATABASE_FILE = "auth.db"
+const LEGACY_SESSIONS_FILE = "sessions.json"
+const SECONDS_PER_DAY = 86_400
+const SESSION_UPDATE_AGE_SECONDS = SECONDS_PER_DAY
+const AUTH_BASE_PATH = "/api/auth"
+const INTERNAL_BASE_URL = "http://localhost"
+const MAX_PASSWORD_LENGTH = 4096
+const SECRET_BYTES = 32
+
+async function loadOrCreateSecret(filePath: string): Promise<string> {
+  try {
+    const existing = (await readFile(filePath, "utf8")).trim()
+    if (existing) return existing
+  } catch (error) {
+    if (!isErrnoException(error) || error.code !== "ENOENT") throw error
+  }
+  const secret = randomBytes(SECRET_BYTES).toString("base64url")
+  await writeFile(filePath, secret, { mode: 0o600 })
+  return secret
+}
+
+async function removeLegacySessions(dataDir: string) {
+  await rm(path.join(dataDir, LEGACY_SESSIONS_FILE), { force: true })
+}
+
+function authOptions(database: Database, secret: string, sessionMaxAgeDays: number) {
+  return {
+    secret,
+    database,
+    baseURL: INTERNAL_BASE_URL,
+    basePath: AUTH_BASE_PATH,
+    emailAndPassword: {
+      enabled: true,
+      disableSignUp: true,
+      minPasswordLength: 1,
+      maxPasswordLength: MAX_PASSWORD_LENGTH,
+    },
+    session: {
+      expiresIn: Math.round(sessionMaxAgeDays * SECONDS_PER_DAY),
+      updateAge: SESSION_UPDATE_AGE_SECONDS,
+    },
+    advanced: {
+      cookies: { session_token: { name: SESSION_COOKIE_NAME } },
+      defaultCookieAttributes: { sameSite: "strict" },
+      useSecureCookies: false,
+      ipAddress: { ipAddressHeaders: [CLIENT_IP_HEADER] },
+    },
+    rateLimit: { enabled: true, storage: "database" },
+    trustedOrigins: (request) => (request ? [new URL(request.url).origin] : []),
+    logger: {
+      level: "warn",
+      log: (level, message, ...args) => log[level](`[auth] ${message}`, ...args),
+    },
+  } satisfies BetterAuthOptions
+}
+
+function buildAuth(database: Database, secret: string, sessionMaxAgeDays: number) {
+  return betterAuth(authOptions(database, secret, sessionMaxAgeDays))
+}
+
+type KannaAuthInstance = ReturnType<typeof buildAuth>
+
+async function ensureOwner(instance: KannaAuthInstance, password: string) {
+  const context = await instance.$context
+  const found = await context.internalAdapter.findUserByEmail(OWNER_EMAIL, { includeAccounts: true })
+  if (!found) {
+    const hash = await context.password.hash(password)
+    const user = await context.internalAdapter.createUser(
+      { email: OWNER_EMAIL, name: "Owner", emailVerified: true },
+      { method: "email-password" },
+    )
+    await context.internalAdapter.linkAccount({
+      userId: user.id,
+      providerId: "credential",
+      accountId: user.id,
+      password: hash,
+    })
+    return
+  }
+  const credential = found.accounts.find((account) => account.providerId === "credential")
+  const unchanged = credential?.password
+    ? await context.password.verify({ hash: credential.password, password })
+    : false
+  if (unchanged) return
+  const hash = await context.password.hash(password)
+  if (credential) {
+    await context.internalAdapter.updatePassword(found.user.id, hash)
+  } else {
+    await context.internalAdapter.linkAccount({
+      userId: found.user.id,
+      providerId: "credential",
+      accountId: found.user.id,
+      password: hash,
+    })
+  }
+  await context.internalAdapter.deleteUserSessions(found.user.id)
+}
+
+export interface BetterAuthBackendOptions {
+  dataDir: string
+  password: string
+  getSessionMaxAgeDays: () => number
+}
+
+export interface BetterAuthBackend extends AuthBackend {
+  refreshSessionLifetime(): void
+}
+
+export async function createBetterAuthBackend(options: BetterAuthBackendOptions): Promise<BetterAuthBackend> {
+  await mkdir(options.dataDir, { recursive: true })
+  const secret = await loadOrCreateSecret(path.join(options.dataDir, SECRET_FILE))
+  const databasePath = path.join(options.dataDir, DATABASE_FILE)
+  const database = new Database(databasePath, { create: true })
+  await chmod(databasePath, 0o600)
+  let configuredDays = options.getSessionMaxAgeDays()
+  let current: KannaAuthInstance
+
+  try {
+    const { runMigrations } = await getMigrations(authOptions(database, secret, configuredDays))
+    await runMigrations()
+    current = buildAuth(database, secret, configuredDays)
+    await ensureOwner(current, options.password)
+    await removeLegacySessions(options.dataDir)
+  } catch (error) {
+    database.close()
+    throw toError(error)
+  }
+
+  return {
+    refreshSessionLifetime() {
+      const days = options.getSessionMaxAgeDays()
+      if (days === configuredDays) return
+      configuredDays = days
+      current = buildAuth(database, secret, days)
+    },
+    async signIn(request) {
+      return current.handler(request)
+    },
+    async getSession(headers) {
+      const result = await current.api.getSession({ headers, returnHeaders: true })
+      return {
+        authenticated: result.response !== null,
+        setCookies: result.headers.getSetCookie(),
+      }
+    },
+    async signOut(headers) {
+      try {
+        const result = await current.api.signOut({ headers, returnHeaders: true })
+        return result.headers.getSetCookie()
+      } catch (error) {
+        log.warn("[auth] sign-out failed", toError(error).message)
+        return []
+      }
+    },
+    async dispose() {
+      database.close()
+    },
+  }
+}
+
+export interface PasswordAuthOptions {
+  dataDir: string
+  password: string
+  trustProxy: boolean
+  appSettings: AppSettingsManager
+}
+
+export async function createPasswordAuth(options: PasswordAuthOptions): Promise<AuthManager> {
+  const { appSettings } = options
+  const backend = await createBetterAuthBackend({
+    dataDir: options.dataDir,
+    password: options.password,
+    getSessionMaxAgeDays: () => appSettings.getSnapshot().auth.sessionMaxAgeDays,
+  })
+  const unsubscribe = appSettings.onChange(() => backend.refreshSessionLifetime())
+  const manager = createAuthManager(backend, { trustProxy: options.trustProxy })
+  return {
+    ...manager,
+    async dispose() {
+      unsubscribe()
+      await manager.dispose()
+    },
+  }
+}

package/src/server/http-dispatcher.ts

@@ -111,7 +111,7 @@ export function createHttpDispatcher(
 
     if (url.pathname === "/auth/status") {
       return auth
-        ? auth.handleStatus(req)
+        ? await auth.handleStatus(req)
         : Response.json({ enabled: false, authenticated: true })
     }
 
@@ -119,7 +119,7 @@ export function createHttpDispatcher(
       if (req.method !== "POST") {
         return new Response(null, { status: 405, headers: { Allow: "POST" } })
       }
-      return auth ? auth.handleLogout(req) : Response.json({ ok: true })
+      return auth ? await auth.handleLogout(req) : Response.json({ ok: true })
     }
 
     if (url.pathname.startsWith("/api/share/")) {
@@ -129,14 +129,14 @@ export function createHttpDispatcher(
     if (auth) {
       if (url.pathname === "/auth/login") {
         if (req.method === "GET") return auth.redirectToApp(req)
-        if (req.method === "POST") return auth.handleLogin(req, "/")
+        if (req.method === "POST") return auth.handleLogin(req, "/", server.requestIP(req)?.address ?? null)
         return new Response(null, { status: 405, headers: { Allow: "GET, POST" } })
       }
 
       if (url.pathname === "/ws") {
         if (!auth.validateOrigin(req)) return new Response("Forbidden", { status: 403 })
-        if (!auth.isAuthenticated(req)) return new Response("Unauthorized", { status: 401 })
-      } else if (url.pathname.startsWith("/api/") && !auth.isAuthenticated(req)) {
+        if (!(await auth.isAuthenticated(req))) return new Response("Unauthorized", { status: 401 })
+      } else if (url.pathname.startsWith("/api/") && !(await auth.isAuthenticated(req))) {
         return Response.json({ error: "Unauthorized" }, { status: 401 })
       }
     }

package/src/server/server.ts

@@ -9,8 +9,8 @@ import {
   type AppSettingsSnapshot,
 } from "../shared/types"
 import type { ShareMode } from "../shared/share"
-import { createAuthManager } from "./auth"
-import { createAuthSessionStore } from "./auth-session-store.adapter"
+import type { AuthManager } from "./auth"
+import { createPasswordAuth } from "./better-auth.adapter"
 import { EventStore } from "./event-store"
 import { PushManager, realWebPushSender } from "./push/push-manager"
 import { loadOrGenerateVapidKeys } from "./push/vapid.adapter"
@@ -159,7 +159,7 @@ export interface StartKannaServerOptions {
 interface ApplicationServices {
   store: EventStore
   diffStore: DiffStore
-  auth: ReturnType<typeof createAuthManager> | null
+  auth: AuthManager | null
   analytics: KannaAnalyticsReporter
   terminals: TerminalManager
   updateManager: UpdateManager | null
@@ -274,12 +274,11 @@ async function createApplicationServices(options: StartKannaServerOptions): Prom
   const snapshotSweepHandle = startSnapshotSweep(sessionShareService, 24 * 60 * 60 * 1000)
   await keybindings.initialize()
   const auth = options.password
-    ? createAuthManager(options.password, {
+    ? await createPasswordAuth({
+        dataDir: store.dataDir,
+        password: options.password,
         trustProxy: options.trustProxy ?? false,
-        sessionStore: await createAuthSessionStore({
-          filePath: path.join(store.dataDir, "sessions.json"),
-        }),
-        getMaxAgeMs: () => appSettings.getSnapshot().auth.sessionMaxAgeDays * 86_400_000,
+        appSettings,
       })
     : null
   const analytics = new KannaAnalyticsReporter({

package/dist/client/assets/chevron-left-FnMbL2tA.js

@@ -1 +0,0 @@
-import{f as e}from"./pendingActionsStore-CWNaCyjS.js";var t={name:`chevron-left`,size:24,node:[[`path`,{d:`m15 18-6-6 6-6`,key:`1wnfg3`}]]};t.node;var n=e(t);export{n as t};

package/dist/client/assets/runDetached-CQOu05LK.js

@@ -1 +0,0 @@
-import{i as e,m as t,t as n}from"./log-Ch_SNBXH.js";function r(r,i){i.then(void 0,t(t=>n.error(e,`${r} failed`,t)))}export{r as t};