@meith/accounts 0.16.0

package/LICENSE.md

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@meith/accounts",
+  "version": "0.16.0",
+  "license": "LGPL-3.0-or-later",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/meith-dev/meith.git",
+    "directory": "packages/accounts"
+  },
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "files": [
+    "src",
+    "!src/**/*.test.*",
+    "!src/**/*.type-test.*"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "hash-wasm": "^4.12.0",
+    "@meith/i18n": "0.16.0"
+  }
+}

package/src/ban-filter.ts

@@ -0,0 +1,127 @@
+import { ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import { foldIdentifier } from './case-fold'
+
+export const BAN_FILTER_TYPES = ['username', 'email', 'ip'] as const
+export type BanFilterType = (typeof BAN_FILTER_TYPES)[number]
+
+export interface BanFilter {
+  readonly id: number
+  readonly type: BanFilterType
+  readonly pattern: string
+}
+
+export interface BanFilterSubject {
+  readonly username?: string | undefined
+  readonly email?: string | undefined
+  readonly ip?: string | undefined
+}
+
+export const BAN_FILTER_PATTERN_MAX = 200
+export const BAN_FILTER_WILDCARD_MAX = 20
+
+function preparedPattern(type: BanFilterType, pattern: string): string {
+  return type === 'ip' ? pattern.trim() : foldIdentifier(pattern)
+}
+
+function wildcards(pattern: string): number {
+  let count = 0
+  for (const char of pattern) {
+    if (char === '*' || char === '?') count += 1
+  }
+  return count
+}
+
+function tooLong(pattern: string): boolean {
+  return [...pattern].length > BAN_FILTER_PATTERN_MAX
+}
+
+function tooWild(pattern: string): boolean {
+  return wildcards(pattern) > BAN_FILTER_WILDCARD_MAX
+}
+
+function globMatches(pattern: string, value: string): boolean {
+  const p = [...pattern]
+  const v = [...value]
+
+  let pi = 0
+  let vi = 0
+  let star = -1
+  let resume = 0
+
+  while (vi < v.length) {
+    if (pi < p.length && (p[pi] === '?' || p[pi] === v[vi])) {
+      pi += 1
+      vi += 1
+    } else if (pi < p.length && p[pi] === '*') {
+      star = pi
+      resume = vi
+      pi += 1
+    } else if (star !== -1) {
+      resume += 1
+      pi = star + 1
+      vi = resume
+    } else {
+      return false
+    }
+  }
+
+  while (pi < p.length && p[pi] === '*') pi += 1
+
+  return pi === p.length
+}
+
+export function assertUsableFilter(type: BanFilterType, pattern: string): void {
+  const trimmed = pattern.trim()
+
+  if (trimmed === '') {
+    throw new ValidationError(msg('error.accounts.ban-filter-needs-pattern'))
+  }
+
+  if (/^\*+$/.test(trimmed)) {
+    throw new ValidationError(
+      `"${trimmed}" would match every ${type} and lock everyone out. ` +
+        'Use the registration settings to close signups instead.',
+    )
+  }
+
+  if (!(BAN_FILTER_TYPES as readonly string[]).includes(type)) {
+    throw new ValidationError(`Unknown ban filter type: ${type}`)
+  }
+
+  const prepared = preparedPattern(type, pattern)
+
+  if (tooLong(prepared)) {
+    throw new ValidationError(
+      msg('error.accounts.ban-filter-pattern-long', { max: BAN_FILTER_PATTERN_MAX }),
+    )
+  }
+
+  if (tooWild(prepared)) {
+    throw new ValidationError(
+      msg('error.accounts.ban-filter-too-many-wildcards', { max: BAN_FILTER_WILDCARD_MAX }),
+    )
+  }
+}
+
+function subjectValue(type: BanFilterType, subject: BanFilterSubject): string | undefined {
+  if (type === 'username') return subject.username ? foldIdentifier(subject.username) : undefined
+  if (type === 'email') return subject.email ? foldIdentifier(subject.email) : undefined
+  return subject.ip?.trim()
+}
+
+export function matchBanFilter(
+  filters: readonly BanFilter[],
+  subject: BanFilterSubject,
+): BanFilter | null {
+  for (const filter of filters) {
+    const value = subjectValue(filter.type, subject)
+    if (value === undefined || value === '') continue
+
+    const pattern = preparedPattern(filter.type, filter.pattern)
+    if (tooLong(pattern) || tooWild(pattern)) continue
+    if (globMatches(pattern, value)) return filter
+  }
+  return null
+}

package/src/ban-service.ts

@@ -0,0 +1,71 @@
+import { ForbiddenError, ValidationError } from '@meith/core'
+import { msg } from '@meith/i18n'
+
+import type { BanRecord, BanRepository, Clock } from './ports'
+
+export interface BanServiceDeps {
+  readonly bans: BanRepository
+  readonly clock?: Clock
+  readonly bannedGroupId: number
+}
+
+export interface BanInput {
+  readonly userId: number
+  readonly bannedByUserId?: number | undefined
+  readonly reason?: string | undefined
+  readonly publicReason?: string | undefined
+  readonly expiresAt?: Date | undefined
+}
+
+export class BanService {
+  private readonly now: () => Date
+
+  constructor(private readonly deps: BanServiceDeps) {
+    this.now = deps.clock ?? (() => new Date())
+  }
+
+  async ban(input: BanInput): Promise<BanRecord> {
+    const now = this.now()
+
+    if (input.expiresAt !== undefined && input.expiresAt <= now) {
+      throw new ValidationError(msg('error.accounts.ban-expire-past'))
+    }
+
+    const existing = await this.deps.bans.findActive(input.userId)
+    if (existing) {
+      throw new ValidationError(msg('error.accounts.user-already-banned-lift-existing'))
+    }
+
+    return this.deps.bans.create({
+      userId: input.userId,
+      bannedByUserId: input.bannedByUserId ?? null,
+      reason: input.reason ?? null,
+      publicReason: input.publicReason ?? null,
+      expiresAt: input.expiresAt ?? null,
+      bannedGroupId: this.deps.bannedGroupId,
+      now,
+    })
+  }
+
+  async lift(userId: number): Promise<void> {
+    const active = await this.deps.bans.findActive(userId)
+    if (!active) throw new ValidationError(msg('error.accounts.user-banned'))
+
+    await this.deps.bans.lift(active.id, this.now())
+  }
+
+  async expireDue(limit = 200): Promise<number> {
+    return this.deps.bans.expireDue(this.now(), limit)
+  }
+
+  async assertNotBanned(userId: number): Promise<void> {
+    const active = await this.deps.bans.findActive(userId)
+    if (!active) return
+
+    throw new ForbiddenError(
+      active.publicReason
+        ? `This account is banned: ${active.publicReason}`
+        : 'This account is banned.',
+    )
+  }
+}

package/src/case-fold.ts

@@ -0,0 +1,3 @@
+export function foldIdentifier(value: string): string {
+  return value.trim().toLowerCase()
+}

package/src/credential-proof.ts

@@ -0,0 +1,17 @@
+import type { SessionRecord } from './ports'
+
+export const CREDENTIAL_PROOF_TTL_MS = 10 * 60 * 1_000
+
+export function hasFreshCredentialProof(
+  session: SessionRecord,
+  userId: number,
+  now: Date,
+): boolean {
+  if (session.userId !== userId) return false
+  if (session.revokedAt !== null || session.supersededBySessionId !== null) return false
+  if (session.expiresAt.getTime() <= now.getTime()) return false
+  if (session.credentialProvedAt === null) return false
+
+  const age = now.getTime() - session.credentialProvedAt.getTime()
+  return age >= 0 && age <= CREDENTIAL_PROOF_TTL_MS
+}

package/src/crypto/base64url.ts

@@ -0,0 +1,53 @@
+const ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_'
+
+export function encodeBase64Url(bytes: Uint8Array): string {
+  let out = ''
+
+  for (let index = 0; index < bytes.length; index += 3) {
+    const a = bytes[index]!
+    const b = bytes[index + 1]
+    const c = bytes[index + 2]
+
+    out += ALPHABET[a >> 2]
+    out += ALPHABET[((a & 0b11) << 4) | ((b ?? 0) >> 4)]
+    if (b === undefined) break
+    out += ALPHABET[((b & 0b1111) << 2) | ((c ?? 0) >> 6)]
+    if (c === undefined) break
+    out += ALPHABET[c & 0b111111]
+  }
+
+  return out
+}
+
+export function decodeBase64Url(value: string): Uint8Array<ArrayBuffer> {
+  const clean = value.replace(/[=\s]/g, '')
+  const bytes: number[] = []
+
+  let buffer = 0
+  let bits = 0
+
+  for (const character of clean) {
+    const digit = ALPHABET.indexOf(character === '+' ? '-' : character === '/' ? '_' : character)
+    if (digit < 0) throw new Error('not base64url')
+
+    buffer = (buffer << 6) | digit
+    bits += 6
+
+    if (bits >= 8) {
+      bits -= 8
+      bytes.push((buffer >> bits) & 0xff)
+    }
+  }
+
+  return Uint8Array.from(bytes)
+}
+
+export function decodeBase64UrlText(value: string): string {
+  return new TextDecoder().decode(decodeBase64Url(value))
+}
+
+export function randomBase64Url(byteLength: number): string {
+  const bytes = new Uint8Array(byteLength)
+  crypto.getRandomValues(bytes)
+  return encodeBase64Url(bytes)
+}

package/src/crypto/legacy.ts

@@ -0,0 +1,127 @@
+import { createHash, timingSafeEqual } from 'node:crypto'
+
+import { bcryptVerify } from 'hash-wasm'
+
+export const MYBB_PREFIX = 'mybb$'
+export const PHPBB_PREFIX = 'phpbb$'
+
+export interface LegacyMybbHash {
+  readonly salt: string
+  readonly hash: string
+}
+
+function md5(value: string | Buffer): Buffer {
+  return createHash('md5').update(value).digest()
+}
+
+function md5Hex(value: string): string {
+  return createHash('md5').update(value, 'utf8').digest('hex')
+}
+
+export function parseMybbHash(stored: string): LegacyMybbHash | null {
+  if (!stored.startsWith(MYBB_PREFIX)) return null
+
+  const rest = stored.slice(MYBB_PREFIX.length)
+  const separator = rest.indexOf('$')
+  if (separator === -1) return null
+
+  const salt = rest.slice(0, separator)
+  const hash = rest.slice(separator + 1)
+
+  if (salt.length === 0) return null
+  if (!/^[0-9a-f]{32}$/i.test(hash)) return null
+
+  return { salt, hash }
+}
+
+export function isLegacyHash(stored: string | null | undefined): boolean {
+  return (
+    typeof stored === 'string' &&
+    (stored.startsWith(MYBB_PREFIX) || stored.startsWith(PHPBB_PREFIX))
+  )
+}
+
+export function verifyMybbPassword(password: string, stored: string): boolean {
+  const parsed = parseMybbHash(stored)
+  if (parsed === null) return false
+
+  const computed = md5Hex(md5Hex(parsed.salt) + md5Hex(password))
+  return constantTimeEqual(computed, parsed.hash.toLowerCase())
+}
+
+const ITOA64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+
+function phpassEncode64(input: Buffer, count: number): string {
+  let output = ''
+  let i = 0
+  while (i < count) {
+    let value = input[i]!
+    i += 1
+    output += ITOA64[value & 0x3f]
+    if (i < count) value |= input[i]! << 8
+    output += ITOA64[(value >> 6) & 0x3f]
+    if (i >= count) break
+    i += 1
+    if (i < count) value |= input[i]! << 16
+    output += ITOA64[(value >> 12) & 0x3f]
+    if (i >= count) break
+    i += 1
+    output += ITOA64[(value >> 18) & 0x3f]
+  }
+  return output
+}
+
+function verifyPhpassHash(password: string, stored: string): boolean {
+  if (stored.length !== 34) return false
+
+  const countLog2 = ITOA64.indexOf(stored[3]!)
+  if (countLog2 < 7 || countLog2 > 30) return false
+
+  const salt = stored.slice(4, 12)
+  if (salt.length !== 8) return false
+
+  const rounds = 1 << countLog2
+  let hash = md5(salt + password)
+  for (let i = 0; i < rounds; i += 1) {
+    hash = md5(Buffer.concat([hash, Buffer.from(password, 'utf8')]))
+  }
+
+  return constantTimeEqual(stored.slice(0, 12) + phpassEncode64(hash, 16), stored)
+}
+
+export async function verifyPhpbbPassword(password: string, stored: string): Promise<boolean> {
+  if (!stored.startsWith(PHPBB_PREFIX)) return false
+  const hash = stored.slice(PHPBB_PREFIX.length)
+
+  if (/^\$2[abxy]\$/.test(hash)) {
+    try {
+      return await bcryptVerify({ password, hash: `$2a$${hash.slice(4)}` })
+    } catch {
+      return false
+    }
+  }
+
+  if (hash.startsWith('$H$') || hash.startsWith('$P$')) {
+    return verifyPhpassHash(password, hash)
+  }
+
+  if (/^[0-9a-f]{32}$/i.test(hash)) {
+    return constantTimeEqual(md5Hex(password), hash.toLowerCase())
+  }
+
+  return false
+}
+
+export function verifyLegacyPassword(password: string, stored: string): Promise<boolean> {
+  if (stored.startsWith(MYBB_PREFIX)) {
+    return Promise.resolve(verifyMybbPassword(password, stored))
+  }
+  return verifyPhpbbPassword(password, stored)
+}
+
+function constantTimeEqual(a: string, b: string): boolean {
+  const left = Buffer.from(a, 'utf8')
+  const right = Buffer.from(b, 'utf8')
+  if (left.length !== right.length) return false
+  return timingSafeEqual(left, right)
+}

package/src/crypto/password.ts

@@ -0,0 +1,92 @@
+import { argon2id, argon2Verify } from 'hash-wasm'
+
+import { isLegacyHash, verifyLegacyPassword } from './legacy'
+
+export interface PasswordPolicy {
+  readonly memorySize: number
+  readonly iterations: number
+  readonly parallelism: number
+}
+
+export const CURRENT_PASSWORD_POLICY: PasswordPolicy = {
+  memorySize: 19456,
+  iterations: 2,
+  parallelism: 1,
+}
+
+const SALT_BYTES = 16
+const HASH_BYTES = 32
+
+export async function hashPassword(
+  password: string,
+  policy: PasswordPolicy = CURRENT_PASSWORD_POLICY,
+): Promise<string> {
+  if (password.length === 0) {
+    throw new Error('Refusing to hash an empty password.')
+  }
+  const salt = randomBytes(SALT_BYTES)
+  return argon2id({
+    password,
+    salt,
+    memorySize: policy.memorySize,
+    iterations: policy.iterations,
+    parallelism: policy.parallelism,
+    hashLength: HASH_BYTES,
+    outputType: 'encoded',
+  })
+}
+
+export async function verifyPassword(
+  password: string,
+  encodedHash: string | null | undefined,
+): Promise<boolean> {
+  if (!encodedHash) return false
+
+  if (isLegacyHash(encodedHash)) return verifyLegacyPassword(password, encodedHash)
+
+  try {
+    return await argon2Verify({ password, hash: encodedHash })
+  } catch {
+    return false
+  }
+}
+
+export interface Argon2Params {
+  readonly algo: 'argon2id' | 'argon2i' | 'argon2d'
+  readonly memorySize: number
+  readonly iterations: number
+  readonly parallelism: number
+}
+
+const PHC = /^\$(argon2id|argon2i|argon2d)\$v=19\$m=(\d+),t=(\d+),p=(\d+)\$/
+
+export function parseArgon2Params(encodedHash: string): Argon2Params | null {
+  const m = PHC.exec(encodedHash)
+  if (!m) return null
+  return {
+    algo: m[1] as Argon2Params['algo'],
+    memorySize: Number(m[2]),
+    iterations: Number(m[3]),
+    parallelism: Number(m[4]),
+  }
+}
+
+export function needsRehash(
+  encodedHash: string,
+  policy: PasswordPolicy = CURRENT_PASSWORD_POLICY,
+): boolean {
+  const p = parseArgon2Params(encodedHash)
+  if (p === null) return true
+  if (p.algo !== 'argon2id') return true
+  return (
+    p.memorySize < policy.memorySize ||
+    p.iterations < policy.iterations ||
+    p.parallelism < policy.parallelism
+  )
+}
+
+function randomBytes(n: number): Uint8Array {
+  const bytes = new Uint8Array(n)
+  crypto.getRandomValues(bytes)
+  return bytes
+}