@joystick.js/db-canary 0.0.0-canary.2209

package/src/server/lib/auth_manager.js

@@ -0,0 +1,375 @@
+/**
+ * @fileoverview Authentication manager with rate limiting, IP whitelisting, and secure password handling.
+ * 
+ * Provides comprehensive authentication services including password generation, verification,
+ * rate limiting with exponential backoff, failed attempt tracking, and secure settings management.
+ * Handles authentication setup, IP-based security controls, and persistent state management.
+ */
+
+import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
+import bcrypt from 'bcrypt';
+import crypto from 'crypto';
+import create_logger from './logger.js';
+
+const { create_context_logger } = create_logger('auth_manager');
+const log = create_context_logger();
+
+import { load_settings as load_joystick_settings, get_settings as get_joystick_settings, has_settings } from './load_settings.js';
+
+/** @type {number} BCrypt salt rounds for password hashing */
+const SALT_ROUNDS = 12;
+
+/** @type {number} Rate limiting window in milliseconds (1 minute) */
+const RATE_LIMIT_WINDOW = 60 * 1000;
+
+/** @type {number} Maximum failed attempts before rate limiting */
+const MAX_FAILED_ATTEMPTS = 5;
+
+/** @type {number} Base backoff duration in milliseconds */
+const BACKOFF_BASE = 1000;
+
+/** @type {number} Backoff multiplier for exponential backoff */
+const BACKOFF_MULTIPLIER = 2;
+
+/** @type {Object|null} Cached settings data */
+let settings_data = null;
+
+/** @type {Map<string, Array<number>>} Map of IP addresses to failed attempt timestamps */
+let failed_attempts = new Map();
+
+/** @type {Map<string, Object>} Map of IP addresses to rate limit information */
+let rate_limits = new Map();
+
+/**
+ * Generates a cryptographically secure random password.
+ * @returns {string} 32-character hexadecimal password
+ */
+const generate_secure_password = () => {
+  return crypto.randomBytes(16).toString('hex');
+};
+
+/**
+ * Loads settings data from environment variable and initializes authentication state.
+ * @returns {Object|null} Loaded settings data or null if not available
+ * @throws {Error} When environment variable contains invalid JSON
+ */
+const load_settings_data = () => {
+  try {
+    if (!has_settings()) {
+      return null;
+    }
+    
+    const parsed_data = load_joystick_settings();
+    settings_data = parsed_data;
+    
+    if (parsed_data.authentication && parsed_data.authentication.failed_attempts) {
+      failed_attempts = new Map(Object.entries(parsed_data.authentication.failed_attempts));
+    }
+    
+    if (parsed_data.authentication && parsed_data.authentication.rate_limits) {
+      rate_limits = new Map(Object.entries(parsed_data.authentication.rate_limits));
+    }
+    
+    log.info('Settings data loaded successfully from environment variable');
+    return settings_data;
+  } catch (error) {
+    log.error('Failed to load settings data', { error: error.message });
+    throw new Error(`Failed to load settings data: ${error.message}`);
+  }
+};
+
+/**
+ * Updates the JOYSTICK_DB_SETTINGS environment variable with current authentication state.
+ * NOTE: This updates the environment variable for the current process only.
+ * @throws {Error} When settings data is null or JSON serialization fails
+ */
+const save_settings_data = () => {
+  try {
+    if (!settings_data) {
+      throw new Error('No settings data to save');
+    }
+    
+    // NOTE: Update authentication section with current failed attempts and rate limits.
+    if (!settings_data.authentication) {
+      settings_data.authentication = {};
+    }
+    
+    settings_data.authentication.failed_attempts = Object.fromEntries(failed_attempts);
+    settings_data.authentication.rate_limits = Object.fromEntries(rate_limits);
+    
+    // NOTE: Update the environment variable with the new settings.
+    process.env.JOYSTICK_DB_SETTINGS = JSON.stringify(settings_data);
+    
+    log.info('Settings data saved successfully to environment variable');
+  } catch (error) {
+    log.error('Failed to save settings data', { error: error.message });
+    throw new Error(`Failed to save settings data: ${error.message}`);
+  }
+};
+
+/**
+ * Checks if an IP address is whitelisted (localhost addresses).
+ * Whitelisting is disabled during tests to allow rate limiting testing.
+ * @param {string} ip - IP address to check
+ * @returns {boolean} True if IP is whitelisted
+ */
+const is_ip_whitelisted = (ip) => {
+  // NOTE: Disable IP whitelisting during tests to allow rate limiting testing.
+  if (process.env.NODE_ENV === 'test') {
+    return false;
+  }
+  
+  const whitelisted_ips = ['127.0.0.1', '::1', 'localhost'];
+  return whitelisted_ips.includes(ip);
+};
+
+/**
+ * Extracts client IP address from socket connection.
+ * @param {net.Socket} socket - Socket connection
+ * @returns {string} Client IP address or localhost fallback
+ */
+const get_client_ip = (socket) => {
+  return socket.remoteAddress || '127.0.0.1';
+};
+
+/**
+ * Checks if an IP address is currently rate limited.
+ * Implements exponential backoff based on failed attempt count.
+ * @param {string} ip - IP address to check
+ * @returns {boolean} True if IP is rate limited
+ */
+const is_rate_limited = (ip) => {
+  if (is_ip_whitelisted(ip)) {
+    return false;
+  }
+  
+  const now = Date.now();
+  const attempts = failed_attempts.get(ip) || [];
+  
+  const recent_attempts = attempts.filter(timestamp => now - timestamp < RATE_LIMIT_WINDOW);
+  
+  if (recent_attempts.length >= MAX_FAILED_ATTEMPTS) {
+    const rate_limit_info = rate_limits.get(ip);
+    if (rate_limit_info && now < rate_limit_info.expires_at) {
+      return true;
+    }
+    
+    const backoff_duration = Math.min(
+      BACKOFF_BASE * Math.pow(BACKOFF_MULTIPLIER, Math.floor(recent_attempts.length / MAX_FAILED_ATTEMPTS)),
+      30 * 60 * 1000
+    );
+    
+    rate_limits.set(ip, {
+      expires_at: now + backoff_duration,
+      attempts: recent_attempts.length
+    });
+    
+    save_settings_data();
+    
+    log.warn('IP rate limited', {
+      ip,
+      attempts: recent_attempts.length,
+      backoff_duration_ms: backoff_duration
+    });
+    
+    return true;
+  }
+  
+  return false;
+};
+
+/**
+ * Records a failed authentication attempt for an IP address.
+ * @param {string} ip - IP address that failed authentication
+ */
+const record_failed_attempt = (ip) => {
+  if (is_ip_whitelisted(ip)) {
+    return;
+  }
+  
+  const now = Date.now();
+  const attempts = failed_attempts.get(ip) || [];
+  attempts.push(now);
+  
+  const recent_attempts = attempts.filter(timestamp => now - timestamp < RATE_LIMIT_WINDOW);
+  failed_attempts.set(ip, recent_attempts);
+  
+  log.warn('Failed authentication attempt recorded', {
+    ip,
+    total_recent_attempts: recent_attempts.length
+  });
+  
+  save_settings_data();
+};
+
+/**
+ * Clears failed attempts and rate limits for an IP address after successful authentication.
+ * @param {string} ip - IP address to clear
+ */
+const clear_failed_attempts = (ip) => {
+  failed_attempts.delete(ip);
+  rate_limits.delete(ip);
+  save_settings_data();
+};
+
+/**
+ * Sets up authentication by generating a secure password and saving configuration.
+ * @returns {string} Generated password (only shown once)
+ * @throws {Error} When authentication is already configured
+ */
+const setup_authentication = () => {
+  // NOTE: Load existing settings or create new ones.
+  if (!settings_data) {
+    load_settings_data();
+  }
+  
+  if (!settings_data) {
+    // NOTE: Create default settings structure.
+    settings_data = {
+      port: 1983,
+      cluster: true,
+      worker_count: 2,
+      authentication: {},
+      backup: { enabled: false },
+      replication: { enabled: false, role: "primary" },
+      auto_indexing: { enabled: true, threshold: 100 },
+      performance: {
+        monitoring_enabled: true,
+        log_slow_queries: true,
+        slow_query_threshold_ms: 1000
+      },
+      logging: { level: "info", structured: true }
+    };
+  }
+  
+  if (settings_data.authentication && settings_data.authentication.password_hash) {
+    throw new Error('Authentication already configured. Update JOYSTICK_DB_SETTINGS environment variable to reconfigure.');
+  }
+  
+  const password = generate_secure_password();
+  const password_hash = bcrypt.hashSync(password, SALT_ROUNDS);
+  const now = new Date().toISOString();
+  
+  settings_data.authentication = {
+    password_hash,
+    created_at: now,
+    last_updated: now,
+    failed_attempts: {},
+    rate_limits: {}
+  };
+  
+  save_settings_data();
+  
+  log.info('Authentication setup completed', {
+    created_at: now
+  });
+  
+  return password;
+};
+
+/**
+ * Verifies a password against the stored hash with rate limiting and timing attack protection.
+ * @param {string} password - Password to verify
+ * @param {string} ip - Client IP address for rate limiting
+ * @returns {Promise<boolean>} True if password is valid
+ * @throws {Error} When authentication not configured or rate limited
+ */
+const verify_password = async (password, ip) => {
+  if (!settings_data) {
+    try {
+      load_settings_data();
+    } catch (error) {
+      // NOTE: If loading fails, settings_data remains null.
+    }
+  }
+  
+  if (!settings_data || !settings_data.authentication || !settings_data.authentication.password_hash) {
+    throw new Error('Authentication not configured. Run setup first.');
+  }
+  
+  if (is_rate_limited(ip)) {
+    throw new Error('Too many failed attempts. Please try again later.');
+  }
+  
+  const start_time = Date.now();
+  
+  try {
+    const is_valid = await bcrypt.compare(password, settings_data.authentication.password_hash);
+    
+    const verification_time = Date.now() - start_time;
+    const min_time = 100;
+    if (verification_time < min_time) {
+      await new Promise(resolve => setTimeout(resolve, min_time - verification_time));
+    }
+    
+    if (is_valid) {
+      clear_failed_attempts(ip);
+      log.info('Password verification successful', { ip });
+      return true;
+    } else {
+      record_failed_attempt(ip);
+      log.warn('Password verification failed', { ip });
+      return false;
+    }
+  } catch (error) {
+    record_failed_attempt(ip);
+    log.error('Password verification error', { ip, error: error.message });
+    throw error;
+  }
+};
+
+/**
+ * Gets authentication statistics and status information.
+ * @returns {Object} Authentication statistics
+ * @returns {boolean} returns.configured - Whether authentication is configured
+ * @returns {number} returns.failed_attempts_count - Number of IPs with failed attempts
+ * @returns {number} returns.rate_limited_ips - Number of rate limited IPs
+ * @returns {string|null} returns.created_at - Authentication creation timestamp
+ * @returns {string|null} returns.last_updated - Last update timestamp
+ */
+const get_auth_stats = () => {
+  const auth_configured = !!(settings_data && settings_data.authentication && settings_data.authentication.password_hash);
+  return {
+    configured: auth_configured,
+    failed_attempts_count: failed_attempts.size,
+    rate_limited_ips: rate_limits.size,
+    created_at: settings_data?.authentication?.created_at || null,
+    last_updated: settings_data?.authentication?.last_updated || null
+  };
+};
+
+/**
+ * Initializes the authentication manager by loading existing settings.
+ */
+const initialize_auth_manager = () => {
+  try {
+    load_settings_data();
+  } catch (error) {
+    log.warn('Could not load settings data on startup', { error: error.message });
+  }
+};
+
+/**
+ * Resets authentication state (used for testing).
+ * Clears both in-memory state and environment variable.
+ */
+const reset_auth_state = () => {
+  settings_data = null;
+  failed_attempts = new Map();
+  rate_limits = new Map();
+  
+  // NOTE: Clear the environment variable to ensure clean test state.
+  if (process.env.JOYSTICK_DB_SETTINGS) {
+    delete process.env.JOYSTICK_DB_SETTINGS;
+  }
+};
+
+export {
+  setup_authentication,
+  verify_password,
+  get_client_ip,
+  is_rate_limited,
+  get_auth_stats,
+  initialize_auth_manager,
+  reset_auth_state
+};