@joystick.js/db-canary 0.0.0-canary.2209

package/src/server/lib/api_key_manager.js

@@ -0,0 +1,473 @@
+/**
+ * @fileoverview API key management for JoystickDB authentication system.
+ * 
+ * Handles API key file generation, validation, and user management operations.
+ * Provides secure API key-based authentication for database setup and user management.
+ */
+
+import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
+import create_logger from './logger.js';
+import { get_database, build_collection_key, generate_document_id } from './query_engine.js';
+
+const { create_context_logger } = create_logger('api_key_manager');
+const log = create_context_logger();
+
+/** @type {string} Path to API key file */
+const API_KEY_FILE_PATH = './API_KEY';
+
+/** @type {string} Collection name for storing users */
+const USERS_COLLECTION = '_users';
+
+/** @type {number} BCrypt salt rounds for password hashing */
+const SALT_ROUNDS = 12;
+
+/** @type {string|null} Cached API key */
+let cached_api_key = null;
+
+/** @type {boolean} Flag to track if admin user exists */
+let admin_user_exists = false;
+
+/**
+ * Generates a cryptographically secure 32-character alphanumeric API key.
+ * @returns {string} 32-character alphanumeric API key
+ */
+const generate_api_key = () => {
+  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+  let result = '';
+  const bytes = crypto.randomBytes(32);
+  
+  for (let i = 0; i < 32; i++) {
+    result += chars[bytes[i] % chars.length];
+  }
+  
+  return result;
+};
+
+/**
+ * Loads API key from file or generates new one if it doesn't exist.
+ * @returns {string} API key from file or newly generated key
+ */
+const load_or_generate_api_key = () => {
+  if (cached_api_key) {
+    return cached_api_key;
+  }
+  
+  if (existsSync(API_KEY_FILE_PATH)) {
+    try {
+      cached_api_key = readFileSync(API_KEY_FILE_PATH, 'utf8').trim();
+      log.info('API key loaded from file');
+      return cached_api_key;
+    } catch (error) {
+      log.error('Failed to read API key file', { error: error.message });
+      throw new Error(`Failed to read API key file: ${error.message}`);
+    }
+  }
+  
+  // Generate new API key
+  const api_key = generate_api_key();
+  
+  try {
+    writeFileSync(API_KEY_FILE_PATH, api_key, { mode: 0o600 });
+    cached_api_key = api_key;
+    
+    log.info('New API key generated and saved', { file_path: API_KEY_FILE_PATH });
+    
+    // Display startup message
+    display_startup_message(api_key);
+    
+    return api_key;
+  } catch (error) {
+    log.error('Failed to save API key file', { error: error.message });
+    throw new Error(`Failed to save API key file: ${error.message}`);
+  }
+};
+
+/**
+ * Displays the startup message with API key and setup instructions.
+ * @param {string} api_key - Generated API key to display
+ */
+const display_startup_message = (api_key) => {
+  const port = process.env.JOYSTICK_DB_PORT || '1983';
+  const http_port = process.env.JOYSTICK_DB_HTTP_PORT || '1984';
+  
+  console.log('\nJoystickDB Setup\n');
+  console.log('To finish setting up your database and enable operations for authenticated users, you will need to create an admin user via the database\'s admin API using the API key displayed below.\n');
+  console.log('=== STORE THIS KEY SECURELY -- IT WILL NOT BE DISPLAYED AGAIN ===');
+  console.log(api_key);
+  console.log('===\n');
+  console.log('To create a user, send a POST request to the server:\n');
+  console.log(`fetch('http://localhost:${http_port}/api/users', {`);
+  console.log('  method: \'POST\',');
+  console.log('  headers: {');
+  console.log('    \'Content-Type\': \'application/json\',');
+  console.log(`    'x-joystick-db-api-key': '${api_key}'`);
+  console.log('  },');
+  console.log('  body: JSON.stringify({');
+  console.log('    username: \'admin\',');
+  console.log('    password: \'your_secure_password\',');
+  console.log('    role: \'read_write\'');
+  console.log('  })');
+  console.log('});\n');
+  console.log('==!==');
+  console.log('Store this key securely. It will not be displayed again.');
+  console.log('==!==\n');
+  console.log(`API key saved to: ${API_KEY_FILE_PATH}\n`);
+};
+
+/**
+ * Validates an API key against the stored key.
+ * @param {string} provided_key - API key to validate
+ * @returns {boolean} True if API key is valid
+ */
+const validate_api_key = (provided_key) => {
+  if (!provided_key) {
+    return false;
+  }
+  
+  const stored_key = load_or_generate_api_key();
+  return provided_key === stored_key;
+};
+
+/**
+ * Validates username format (alphanumeric, 3-50 characters).
+ * @param {string} username - Username to validate
+ * @returns {boolean} True if username is valid
+ */
+const validate_username = (username) => {
+  if (!username || typeof username !== 'string') {
+    return false;
+  }
+  
+  return /^[a-zA-Z0-9]{3,50}$/.test(username);
+};
+
+/**
+ * Validates password complexity requirements.
+ * @param {string} password - Password to validate
+ * @returns {Object} Validation result
+ * @returns {boolean} returns.valid - Whether password is valid
+ * @returns {string} returns.error - Error message if invalid
+ */
+const validate_password = (password) => {
+  if (!password || typeof password !== 'string') {
+    return { valid: false, error: 'Password is required' };
+  }
+  
+  if (password.length < 8) {
+    return { valid: false, error: 'Password must be at least 8 characters long' };
+  }
+  
+  if (password.length > 128) {
+    return { valid: false, error: 'Password must be no more than 128 characters long' };
+  }
+  
+  return { valid: true };
+};
+
+/**
+ * Validates role value against allowed options.
+ * @param {string} role - Role to validate
+ * @returns {boolean} True if role is valid
+ */
+const validate_role = (role) => {
+  const allowed_roles = ['read', 'write', 'read_write'];
+  return allowed_roles.includes(role);
+};
+
+/**
+ * Creates a new user in the database.
+ * @param {Object} user_data - User data
+ * @param {string} user_data.username - Username
+ * @param {string} user_data.password - Plain text password
+ * @param {string} user_data.role - User role
+ * @returns {Promise<Object>} Created user data
+ * @throws {Error} When validation fails or user already exists
+ */
+const create_user = async (user_data) => {
+  const { username, password, role } = user_data;
+  
+  // Validate input
+  if (!validate_username(username)) {
+    throw new Error('Username must be alphanumeric and 3-50 characters long');
+  }
+  
+  const password_validation = validate_password(password);
+  if (!password_validation.valid) {
+    throw new Error(password_validation.error);
+  }
+  
+  if (!validate_role(role)) {
+    throw new Error('Role must be one of: read, write, read_write');
+  }
+  
+  const db = get_database();
+  
+  // Hash password
+  const password_hash = await bcrypt.hash(password, SALT_ROUNDS);
+  
+  // Create user document
+  const user_document = {
+    username,
+    password_hash,
+    role,
+    created_at: new Date().toISOString(),
+    updated_at: new Date().toISOString()
+  };
+  
+  // Store user in database using transaction
+  const user_key = build_collection_key(USERS_COLLECTION, username);
+  let stored_user = null;
+  
+  await db.transaction(() => {
+    const existing_user = db.get(user_key);
+    
+    if (existing_user) {
+      throw new Error('Username already exists');
+    }
+    
+    db.put(user_key, JSON.stringify(user_document));
+    stored_user = user_document;
+  });
+  
+  // Check if this is the first admin user
+  if (role === 'read_write') {
+    admin_user_exists = true;
+    log.info('Admin user created, API key requirement relaxed for authenticated operations');
+  }
+  
+  log.info('User created successfully', { username, role });
+  
+  // Return user data without password hash
+  return {
+    username: user_document.username,
+    role: user_document.role,
+    created_at: user_document.created_at
+  };
+};
+
+/**
+ * Gets all users from the database.
+ * @returns {Array<Object>} Array of user objects without password hashes
+ */
+const get_all_users = () => {
+  const db = get_database();
+  const users = [];
+  
+  for (const { key, value } of db.getRange({ start: `${USERS_COLLECTION}:`, end: `${USERS_COLLECTION}:\xFF` })) {
+    const parsed_user = JSON.parse(value);
+    const user_data = {
+      username: parsed_user.username,
+      role: parsed_user.role,
+      created_at: parsed_user.created_at,
+      updated_at: parsed_user.updated_at
+    };
+    users.push(user_data);
+  }
+  
+  return users;
+};
+
+/**
+ * Gets a user by username.
+ * @param {string} username - Username to find
+ * @returns {Object|null} User object without password hash, or null if not found
+ */
+const get_user = (username) => {
+  const db = get_database();
+  const user_key = build_collection_key(USERS_COLLECTION, username);
+  const user_data = db.get(user_key);
+  
+  if (!user_data) {
+    return null;
+  }
+  
+  const user = JSON.parse(user_data);
+  
+  return {
+    username: user.username,
+    role: user.role,
+    created_at: user.created_at,
+    updated_at: user.updated_at
+  };
+};
+
+/**
+ * Updates a user's role or password.
+ * @param {string} username - Username to update
+ * @param {Object} updates - Updates to apply
+ * @param {string} [updates.password] - New password
+ * @param {string} [updates.role] - New role
+ * @returns {Promise<Object>} Updated user data
+ * @throws {Error} When user not found or validation fails
+ */
+const update_user = async (username, updates) => {
+  const db = get_database();
+  const user_key = build_collection_key(USERS_COLLECTION, username);
+  
+  // Validate password first if provided (before transaction)
+  let password_hash = null;
+  if (updates.password) {
+    const password_validation = validate_password(updates.password);
+    if (!password_validation.valid) {
+      throw new Error(password_validation.error);
+    }
+    
+    password_hash = await bcrypt.hash(updates.password, SALT_ROUNDS);
+  }
+  
+  // Validate role if provided (before transaction)
+  if (updates.role && !validate_role(updates.role)) {
+    throw new Error('Role must be one of: read, write, read_write');
+  }
+  
+  // Check if user exists first
+  const existing_user_data = db.get(user_key);
+  if (!existing_user_data) {
+    throw new Error('User not found');
+  }
+  
+  const existing_user = JSON.parse(existing_user_data);
+  const user_to_update = { ...existing_user };
+  
+  if (updates.role) {
+    user_to_update.role = updates.role;
+  }
+  
+  if (password_hash) {
+    user_to_update.password_hash = password_hash;
+  }
+  
+  user_to_update.updated_at = new Date().toISOString();
+  
+  // Update using putSync for immediate persistence
+  db.putSync(user_key, JSON.stringify(user_to_update));
+  
+  log.info('User updated successfully', { username, updates: Object.keys(updates) });
+  
+  return {
+    username: user_to_update.username,
+    role: user_to_update.role,
+    created_at: user_to_update.created_at,
+    updated_at: user_to_update.updated_at
+  };
+};
+
+/**
+ * Deletes a user from the database.
+ * @param {string} username - Username to delete
+ * @returns {boolean} True if user was deleted
+ * @throws {Error} When user not found
+ */
+const delete_user = (username) => {
+  const db = get_database();
+  const user_key = build_collection_key(USERS_COLLECTION, username);
+  
+  // Check if user exists first
+  const existing_user = db.get(user_key);
+  if (!existing_user) {
+    throw new Error('User not found');
+  }
+  
+  // Delete using removeSync (synchronous remove)
+  const result = db.removeSync(user_key);
+  
+  log.info('User deleted successfully', { username });
+  return true;
+};
+
+/**
+ * Verifies a user's password.
+ * @param {string} username - Username
+ * @param {string} password - Plain text password
+ * @returns {Promise<Object|null>} User object if password is correct, null otherwise
+ */
+const verify_user_password = async (username, password) => {
+  const db = get_database();
+  const user_key = build_collection_key(USERS_COLLECTION, username);
+  const user_data = db.get(user_key);
+  
+  if (!user_data) {
+    return null;
+  }
+  
+  const user = JSON.parse(user_data);
+  const is_valid = await bcrypt.compare(password, user.password_hash);
+  
+  if (is_valid) {
+    return {
+      username: user.username,
+      role: user.role,
+      created_at: user.created_at,
+      updated_at: user.updated_at
+    };
+  }
+  
+  return null;
+};
+
+/**
+ * Checks if an admin user exists in the database.
+ * @returns {boolean} True if admin user exists
+ */
+const check_admin_user_exists = () => {
+  if (admin_user_exists) {
+    return true;
+  }
+  
+  const db = get_database();
+  
+  for (const { value } of db.getRange({ start: `${USERS_COLLECTION}:`, end: `${USERS_COLLECTION}:\xFF` })) {
+    const parsed_user = JSON.parse(value);
+    if (parsed_user.role === 'read_write') {
+      admin_user_exists = true;
+      return true;
+    }
+  }
+  
+  return false;
+};
+
+/**
+ * Initializes the API key manager.
+ */
+const initialize_api_key_manager = () => {
+  load_or_generate_api_key();
+  admin_user_exists = check_admin_user_exists();
+  
+  if (admin_user_exists) {
+    log.info('Admin user detected, API key requirement relaxed for authenticated operations');
+  }
+};
+
+/**
+ * Resets API key manager state (for testing).
+ */
+const reset_api_key_state = () => {
+  cached_api_key = null;
+  admin_user_exists = false;
+  
+  // Remove API key file if it exists
+  if (existsSync(API_KEY_FILE_PATH)) {
+    try {
+      unlinkSync(API_KEY_FILE_PATH);
+    } catch (error) {
+      // Ignore errors when removing file
+    }
+  }
+};
+
+export {
+  load_or_generate_api_key,
+  validate_api_key,
+  create_user,
+  get_all_users,
+  get_user,
+  update_user,
+  delete_user,
+  verify_user_password,
+  check_admin_user_exists,
+  initialize_api_key_manager,
+  reset_api_key_state
+};