@meith/accounts 0.35.0 → 0.36.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/accounts",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "hash-wasm": "^4.12.0",
-    "@meith/i18n": "0.35.0",
-    "@meith/subscriptions": "0.35.0"
+    "@meith/i18n": "0.36.0",
+    "@meith/subscriptions": "0.36.0"
   }
 }

package/src/federation/catalog.ts

@@ -25,6 +25,7 @@ const GOOGLE_ISSUER = 'https://accounts.google.com'
 
 export interface ProviderBuildDeps {
   readonly fetcher?: Fetcher
+  readonly allowPrivateHosts?: boolean
   readonly clock?: () => Date
 }
 
@@ -65,6 +66,9 @@ export function providerFor(
       clientSecret: options.google.clientSecret,
       scopes: DEFAULT_OIDC_SCOPES,
       ...(deps.fetcher === undefined ? {} : { fetcher: deps.fetcher }),
+      ...(deps.allowPrivateHosts === undefined
+        ? {}
+        : { allowPrivateHosts: deps.allowPrivateHosts }),
       ...(deps.clock === undefined ? {} : { clock: deps.clock }),
     })
   }
@@ -79,6 +83,7 @@ export function providerFor(
     clientSecret: options.oidc.clientSecret,
     scopes: parseScopes(options.oidc.scopes),
     ...(deps.fetcher === undefined ? {} : { fetcher: deps.fetcher }),
+    ...(deps.allowPrivateHosts === undefined ? {} : { allowPrivateHosts: deps.allowPrivateHosts }),
     ...(deps.clock === undefined ? {} : { clock: deps.clock }),
   })
 }

package/src/federation/oidc.ts

@@ -1,4 +1,5 @@
 import { ConfigurationError, ValidationError } from '@meith/core'
+import { assertAllowedUrl } from '@meith/core/outbound'
 import { msg } from '@meith/i18n'
 
 import { fetchJson, readBoolean, readString } from './http'
@@ -21,9 +22,18 @@ export interface OidcProviderConfig {
   readonly clientSecret: string
   readonly scopes: readonly string[]
   readonly fetcher?: Fetcher
+  readonly allowPrivateHosts?: boolean
   readonly clock?: () => Date
 }
 
+function guardedFetcher(allowPrivateHosts: boolean): Fetcher {
+  return async (input, init) => {
+    const target = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url
+    assertAllowedUrl(target, { allowPrivateHosts })
+    return fetch(input, { ...init, redirect: 'error' })
+  }
+}
+
 interface Discovery {
   readonly issuer: string
   readonly authorizationEndpoint: string
@@ -35,7 +45,7 @@ interface Discovery {
 export const DEFAULT_OIDC_SCOPES = ['openid', 'email', 'profile'] as const
 
 export function oidcProvider(config: OidcProviderConfig): IdentityProvider {
-  const fetcher = config.fetcher ?? fetch
+  const fetcher = config.fetcher ?? guardedFetcher(config.allowPrivateHosts ?? false)
   const clock = config.clock ?? (() => new Date())
   const issuer = config.issuer.replace(/\/$/, '')
 

package/src/memory-repos.ts

@@ -414,19 +414,44 @@ class MemoryCredentialTokens implements CredentialTokenRepository {
 }
 
 interface Attempt {
+  id: number
   succeeded: boolean
   at: Date
 }
 
 class MemoryLoginAttempts implements LoginAttemptRepository {
   private readonly buckets = new Map<string, Attempt[]>()
+  private nextId = 1
 
   async record(bucket: string, succeeded: boolean, at: Date): Promise<void> {
     const list = this.buckets.get(bucket) ?? []
-    list.push({ succeeded, at })
+    list.push({ id: this.nextId++, succeeded, at })
     this.buckets.set(bucket, list)
   }
 
+  async recordFailureAndCount(
+    bucket: string,
+    since: Date,
+    at: Date,
+  ): Promise<{ readonly id: number; readonly count: number }> {
+    const list = this.buckets.get(bucket) ?? []
+    const id = this.nextId++
+    list.push({ id, succeeded: false, at })
+    this.buckets.set(bucket, list)
+    const count = list.filter((a) => !a.succeeded && a.at.getTime() > since.getTime()).length
+    return { id, count }
+  }
+
+  async removeAttempt(id: number): Promise<void> {
+    for (const list of this.buckets.values()) {
+      const index = list.findIndex((a) => a.id === id)
+      if (index !== -1) {
+        list.splice(index, 1)
+        return
+      }
+    }
+  }
+
   async countFailuresSince(bucket: string, since: Date): Promise<number> {
     const list = this.buckets.get(bucket) ?? []
     return list.filter((a) => !a.succeeded && a.at.getTime() >= since.getTime()).length

package/src/ports.ts

@@ -316,6 +316,12 @@ export interface AuthEventRepository {
 
 export interface LoginAttemptRepository {
   record(bucket: string, succeeded: boolean, at: Date): Promise<void>
+  recordFailureAndCount(
+    bucket: string,
+    since: Date,
+    at: Date,
+  ): Promise<{ readonly id: number; readonly count: number }>
+  removeAttempt(id: number): Promise<void>
   countFailuresSince(bucket: string, since: Date): Promise<number>
   clear(bucket: string): Promise<void>
 }

package/src/service.ts

@@ -338,11 +338,18 @@ export class IdentityService {
     await this.assertNotFiltered({ ip: context.ip })
 
     const since = new Date(at.getTime() - this.config.lockoutMinutes * 60_000)
+    const spent: { readonly key: string; readonly id: number; readonly clearOnSuccess: boolean }[] =
+      []
     for (const counter of counters) {
       const max = counter.max ?? this.config.maxLoginAttempts
       if (max <= 0) continue
-      const failures = await this.store.loginAttempts.countFailuresSince(counter.key, since)
-      if (failures >= max) {
+      const { id, count } = await this.store.loginAttempts.recordFailureAndCount(
+        counter.key,
+        since,
+        at,
+      )
+      spent.push({ key: counter.key, id, clearOnSuccess: counter.clearOnSuccess !== false })
+      if (count > max) {
         throw new ForbiddenError(msg('error.accounts.too-many-failed-attempts-please'))
       }
     }
@@ -355,29 +362,20 @@ export class IdentityService {
     const encoded = account?.passwordHash ?? (await dummyHash())
     const ok = await verifyPassword(password, encoded)
 
-    const recordFailure = async (): Promise<void> => {
-      for (const counter of counters) {
-        await this.store.loginAttempts.record(counter.key, false, at)
-      }
-    }
-
     if (!account || !ok || account.passwordHash === null) {
-      await recordFailure()
       throw new ValidationError(msg('error.accounts.incorrect-username-password'))
     }
 
     const refusal = await this.signInRefusal(account)
     if (refusal !== null) {
-      await recordFailure()
       throw new ForbiddenError(refusal)
     }
 
     await this.assertNotFiltered({ username: account.username, email: account.email })
 
-    for (const counter of counters) {
-      if (counter.clearOnSuccess === false) continue
-      await this.store.loginAttempts.record(counter.key, true, at)
-      await this.store.loginAttempts.clear(counter.key)
+    for (const entry of spent) {
+      if (entry.clearOnSuccess) await this.store.loginAttempts.clear(entry.key)
+      else await this.store.loginAttempts.removeAttempt(entry.id)
     }
 
     if (needsRehash(encoded)) {
@@ -448,25 +446,22 @@ export class IdentityService {
     await this.store.tokens.revokeAllForUser(userId, 'second_factor')
   }
 
-  async assertSecondFactorAttemptsLeft(userId: number): Promise<void> {
+  async spendSecondFactorAttempt(userId: number): Promise<void> {
     const max = this.config.maxLoginAttempts
     if (max <= 0) return
 
     const since = new Date(this.now().getTime() - this.config.lockoutMinutes * 60_000)
-    const failures = await this.store.loginAttempts.countFailuresSince(
+    const { count } = await this.store.loginAttempts.recordFailureAndCount(
       secondFactorBucket(userId),
       since,
+      this.now(),
     )
 
-    if (failures >= max) {
+    if (count > max) {
       throw new ForbiddenError(msg('error.accounts.too-many-wrong-codes-please'))
     }
   }
 
-  async recordSecondFactorFailure(userId: number): Promise<void> {
-    await this.store.loginAttempts.record(secondFactorBucket(userId), false, this.now())
-  }
-
   async clearSecondFactorFailures(userId: number): Promise<void> {
     await this.store.loginAttempts.clear(secondFactorBucket(userId))
   }