@meith/web 0.16.0

package/app/api/v1/[...path]/route.ts

@@ -0,0 +1,208 @@
+import type { NextRequest } from 'next/server'
+
+import {
+  bearerFrom,
+  consumeAnonymousRateLimit,
+  consumeRateLimit,
+  hasScope,
+  type Method,
+  matchRoute,
+  type RateLimitOutcome,
+  type RouteSpec,
+  rateLimitHeaders,
+  routeKey,
+} from '@meith/api'
+import type { Actor } from '@meith/authorization'
+import { isAppError, metrics, statusForError, toPublicError, withSpan } from '@meith/core'
+import { currentRequestId } from '@meith/core/logger'
+
+import { JSON_MEDIA_TYPE } from '@/server/api/http'
+import { handlerFor } from '@/server/api/registry'
+import {
+  type AuthenticatedToken,
+  anonymousLimits,
+  anonymousSubject,
+  apiActor,
+  apiGuest,
+  apiToken,
+} from '@/server/api-auth'
+import { boardOffline } from '@/server/board-offline'
+import { getMessageResolver } from '@/server/i18n'
+
+export const dynamic = 'force-dynamic'
+
+function json(body: unknown, status: number, headers: Record<string, string> = {}): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': JSON_MEDIA_TYPE, ...headers },
+  })
+}
+
+function fail(status: number, code: string, message: string, headers = {}): Response {
+  return json({ error: { code, message, requestId: currentRequestId() ?? null } }, status, headers)
+}
+
+interface Caller {
+  readonly actor: Actor
+  readonly authenticated: AuthenticatedToken | null
+  readonly limit: RateLimitOutcome | null
+}
+
+async function resolveCaller(
+  route: RouteSpec,
+  presented: string | null,
+): Promise<Caller | Response> {
+  if (presented !== null) {
+    const authenticated = await apiToken(presented)
+    if (authenticated === null) return fail(401, 'unauthenticated', 'That token is not valid.')
+
+    if (!hasScope(authenticated.token, route.scope)) {
+      return fail(403, 'missing_scope', `This token does not carry the "${route.scope}" scope.`)
+    }
+
+    const limit = await consumeRateLimit(
+      authenticated.limits,
+      authenticated.token.id,
+      route.cost,
+      new Date(),
+    )
+    if (!limit.allowed) return refused(limit)
+
+    const actor = await apiActor(authenticated.token.userId)
+    if (actor === null) {
+      return fail(403, 'owner_unavailable', 'The account this token belongs to cannot act.', {
+        ...rateLimitHeaders(limit),
+      })
+    }
+
+    return { actor, authenticated, limit }
+  }
+
+  if (route.authenticated) {
+    return fail(401, 'unauthenticated', 'Send a bearer token in the Authorization header.')
+  }
+
+  const store = anonymousLimits()
+  const limit =
+    store === null
+      ? null
+      : await consumeAnonymousRateLimit(store, await anonymousSubject(), route.cost, new Date())
+
+  if (limit !== null && !limit.allowed) return refused(limit)
+
+  return { actor: await apiGuest(), authenticated: null, limit }
+}
+
+function refused(limit: RateLimitOutcome): Response {
+  return fail(429, 'rate_limited', 'Too many requests. Slow down and try again.', {
+    ...rateLimitHeaders(limit),
+    'retry-after': String(limit.resetSeconds),
+  })
+}
+
+const httpRequestSeconds = metrics.histogram(
+  'meith_http_request_duration_seconds',
+  'REST API v1 request duration in seconds, labelled by method, route and status.',
+)
+
+async function handle(request: NextRequest, method: Method): Promise<Response> {
+  const startedAt = Date.now()
+  const url = new URL(request.url)
+  const path = url.pathname.replace(/^\/api\/v1/, '')
+  const matched = matchRoute(method, path)
+  const routeLabel = matched === null ? 'unmatched' : matched.route.path
+
+  const response = await withSpan(
+    'http.request',
+    { 'http.method': method, 'http.route': routeLabel },
+    async (span) => {
+      const result = await respondTo(request, url, matched)
+      span.setAttribute('http.status_code', result.status)
+      return result
+    },
+  )
+
+  httpRequestSeconds.observe((Date.now() - startedAt) / 1000, {
+    method,
+    route: routeLabel,
+    status: String(response.status),
+  })
+
+  return response
+}
+
+async function respondTo(
+  request: NextRequest,
+  url: URL,
+  matched: ReturnType<typeof matchRoute>,
+): Promise<Response> {
+  if (matched === null) {
+    return fail(404, 'no_such_route', 'No such endpoint. See /api/v1/openapi.json for the routes.')
+  }
+
+  const caller = await resolveCaller(
+    matched.route,
+    bearerFrom(request.headers.get('authorization')),
+  )
+  if (caller instanceof Response) return caller
+
+  const headers = caller.limit === null ? {} : rateLimitHeaders(caller.limit)
+
+  const offline = await boardOffline(caller.actor)
+  if (offline !== null) return fail(503, 'board_offline', offline.message, headers)
+
+  const handler = handlerFor(routeKey(matched.route))
+  if (handler === null) {
+    return fail(
+      501,
+      'not_implemented',
+      `${matched.route.method} ${matched.route.path} is declared but not yet implemented.`,
+      headers,
+    )
+  }
+
+  try {
+    const result = await handler({
+      actor: caller.actor,
+      token: caller.authenticated?.token ?? null,
+      params: matched.params,
+      url,
+      body: matched.route.request === undefined ? null : await readJsonBody(request),
+    })
+
+    return json(result.body, result.status, headers)
+  } catch (err) {
+    if (isAppError(err)) {
+      const { error } = toPublicError(err, await getMessageResolver())
+      return fail(statusForError(err), error.code, error.message, headers)
+    }
+    throw err
+  }
+}
+
+async function readJsonBody(request: NextRequest): Promise<Record<string, unknown> | null> {
+  try {
+    const parsed: unknown = await request.json()
+    return typeof parsed === 'object' && parsed !== null
+      ? (parsed as Record<string, unknown>)
+      : null
+  } catch {
+    return null
+  }
+}
+
+export async function GET(request: NextRequest): Promise<Response> {
+  return handle(request, 'GET')
+}
+
+export async function POST(request: NextRequest): Promise<Response> {
+  return handle(request, 'POST')
+}
+
+export async function PATCH(request: NextRequest): Promise<Response> {
+  return handle(request, 'PATCH')
+}
+
+export async function DELETE(request: NextRequest): Promise<Response> {
+  return handle(request, 'DELETE')
+}

package/app/api/v1/openapi.json/route.ts

@@ -0,0 +1,12 @@
+import { openApiDocument } from '@meith/api'
+
+import { JSON_MEDIA_TYPE, SPEC_CACHE } from '@/server/api/http'
+import { CODE_VERSION } from '@/server/upgrade-notice'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(): Promise<Response> {
+  return new Response(JSON.stringify(openApiDocument(CODE_VERSION)), {
+    headers: { 'content-type': JSON_MEDIA_TYPE, 'cache-control': SPEC_CACHE },
+  })
+}

package/app/apple-icon.ts

@@ -0,0 +1,11 @@
+import { renderBrandMark } from '@/server/brand-mark'
+
+export const dynamic = 'force-dynamic'
+
+export const size = { width: 180, height: 180 }
+
+export const contentType = 'image/png'
+
+export default function AppleIcon(): Promise<Response> {
+  return renderBrandMark(size.width)
+}

package/app/atom.xml/route.ts

@@ -0,0 +1,7 @@
+import { boardFeed } from '@/server/feed-routes'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(): Promise<Response> {
+  return boardFeed('atom', '/atom.xml')
+}

package/app/attachment/[id]/route.ts

@@ -0,0 +1,10 @@
+import { serveAttachment } from '@/server/attachment-download'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  return serveAttachment((await context.params).id, 'file')
+}

package/app/attachment/[id]/thumb/route.ts

@@ -0,0 +1,10 @@
+import { serveAttachment } from '@/server/attachment-download'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  return serveAttachment((await context.params).id, 'thumb')
+}

package/app/auth/passkey/options/route.ts

@@ -0,0 +1,145 @@
+import type { NextRequest } from 'next/server'
+
+import { newChallenge } from '@meith/accounts'
+import { logger, statusForError, toPublicError } from '@meith/core'
+
+import { configuredIdentity, getContainer } from '@/server/container'
+import { getActor } from '@/server/context'
+import { currentCredentialProof } from '@/server/credential-proof'
+import {
+  memberManagedSignIns,
+  passkeyRelyingPartyName,
+  passkeyService,
+  passkeysEnabled,
+  relyingParty,
+} from '@/server/federation'
+import { tr } from '@/server/i18n'
+import { type PasskeyPurpose, packChallenge } from '@/server/passkey-challenge'
+import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
+import { readSecondFactorToken, setPasskeyChallengeCookie } from '@/server/session-cookies'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+  })
+}
+
+function problem(message: string, status: number): Response {
+  return json({ error: { code: 'FORBIDDEN', message } }, status)
+}
+
+export async function POST(request: NextRequest): Promise<Response> {
+  if (!isSameOrigin(request)) return crossOriginRefusal()
+
+  if (!(await passkeysEnabled())) {
+    return problem(await tr('authRoute.passkey.disabled'), 404)
+  }
+
+  const asked = request.nextUrl.searchParams.get('for')
+  const purpose: PasskeyPurpose =
+    asked === 'register' || asked === 'second-factor' || asked === 'credential-proof'
+      ? asked
+      : 'authenticate'
+
+  const challenge = newChallenge()
+
+  try {
+    if (purpose === 'second-factor') {
+      const held = await readSecondFactorToken()
+      const pending =
+        held === undefined || held === ''
+          ? null
+          : await (await configuredIdentity()).pendingSecondFactor(held)
+
+      if (pending === null) {
+        return problem(await tr('authRoute.passkey.signInExpired'), 403)
+      }
+
+      const heldPasskeys = await getContainer().accountStore.passkeys.listForUser(pending.userId)
+      if (heldPasskeys.length === 0) {
+        return problem(await tr('authRoute.passkey.noneForAccount'), 403)
+      }
+
+      const options = (await passkeyService()).assertionOptions({
+        challenge,
+        relyingParty: await relyingParty(),
+        allowCredentials: heldPasskeys.map((passkey) => passkey.credentialId),
+      })
+
+      await setPasskeyChallengeCookie(packChallenge(purpose, challenge))
+      return json(options)
+    }
+
+    if (purpose === 'credential-proof') {
+      const actor = await getActor()
+      if (actor.userId === null) {
+        return problem(await tr('authRoute.passkey.signInBeforeAdding'), 403)
+      }
+      const token = await import('@/server/session-cookies').then((module) =>
+        module.readSessionToken(),
+      )
+      const located = token ? await (await configuredIdentity()).locateSession(token) : null
+      if (located === null || located.userId !== actor.userId) {
+        return problem(await tr('authRoute.passkey.signInExpired'), 403)
+      }
+      const heldPasskeys = await getContainer().accountStore.passkeys.listForUser(actor.userId)
+      if (heldPasskeys.length === 0) {
+        return problem(await tr('authRoute.passkey.noneForAccount'), 403)
+      }
+      const options = (await passkeyService()).assertionOptions({
+        challenge,
+        relyingParty: await relyingParty(),
+        allowCredentials: heldPasskeys.map((passkey) => passkey.credentialId),
+      })
+      await setPasskeyChallengeCookie(
+        packChallenge(purpose, challenge, { userId: actor.userId, sessionId: located.sessionId }),
+      )
+      return json(options)
+    }
+
+    if (purpose === 'authenticate') {
+      const options = (await passkeyService()).assertionOptions({
+        challenge,
+        relyingParty: await relyingParty(),
+      })
+      await setPasskeyChallengeCookie(packChallenge(purpose, challenge))
+      return json(options)
+    }
+
+    const actor = await getActor()
+    if (actor.userId === null) {
+      return problem(await tr('authRoute.passkey.signInBeforeAdding'), 403)
+    }
+    if (!(await memberManagedSignIns())) {
+      return problem(await tr('authRoute.passkey.managedSignIns'), 403)
+    }
+
+    const proof = await currentCredentialProof(actor.userId)
+    if (proof === null) {
+      return problem(await tr('authRoute.passkey.recentProofRequired'), 403)
+    }
+
+    const options = await (await passkeyService()).registrationOptions({
+      userId: actor.userId,
+      challenge,
+      relyingParty: await relyingParty(),
+      boardName: await passkeyRelyingPartyName(),
+    })
+
+    await setPasskeyChallengeCookie(
+      packChallenge(purpose, challenge, {
+        userId: actor.userId,
+        sessionId: proof.session.id,
+        provedAt: proof.provedAt.getTime(),
+      }),
+    )
+    return json(options)
+  } catch (err) {
+    logger({ module: 'passkeys' }).warn({ err, purpose }, 'could not issue passkey options')
+    return json(toPublicError(err), statusForError(err))
+  }
+}

package/app/auth/passkey/verify/route.ts

@@ -0,0 +1,241 @@
+import type { NextRequest } from 'next/server'
+
+import { logger, statusForError, toPublicError } from '@meith/core'
+
+import { recordAuthEvent } from '@/server/auth-events'
+import { configuredIdentity, configuredSessions } from '@/server/container'
+import { getActor } from '@/server/context'
+import {
+  currentCredentialProof,
+  markCurrentSessionCredentialProved,
+} from '@/server/credential-proof'
+import {
+  memberManagedSignIns,
+  passkeyService,
+  passkeysEnabled,
+  relyingParty,
+} from '@/server/federation'
+import { tr } from '@/server/i18n'
+import { type PasskeyPurpose, unpackChallenge } from '@/server/passkey-challenge'
+import { retainedIpPrefix } from '@/server/request-fingerprint'
+import { isSafeLocalPath } from '@/server/safe-path'
+import { crossOriginRefusal, isSameOrigin } from '@/server/same-origin'
+import {
+  clearPasskeyChallengeCookie,
+  clearSecondFactorCookie,
+  readPasskeyChallengeCookie,
+  readSecondFactorToken,
+  readSessionToken,
+  setRememberCookie,
+  setSessionCookie,
+} from '@/server/session-cookies'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+interface Submission {
+  readonly id?: unknown
+  readonly label?: unknown
+  readonly transports?: unknown
+  readonly clientDataJSON?: unknown
+  readonly attestationObject?: unknown
+  readonly authenticatorData?: unknown
+  readonly signature?: unknown
+  readonly next?: unknown
+}
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+  })
+}
+
+function problem(message: string, status: number): Response {
+  return json({ error: { code: 'FORBIDDEN', message } }, status)
+}
+
+function text(value: unknown): string | null {
+  return typeof value === 'string' && value !== '' ? value : null
+}
+
+export async function POST(request: NextRequest): Promise<Response> {
+  if (!isSameOrigin(request)) return crossOriginRefusal()
+
+  if (!(await passkeysEnabled())) {
+    return problem(await tr('authRoute.passkey.disabled'), 404)
+  }
+
+  const asked = request.nextUrl.searchParams.get('for')
+  const purpose: PasskeyPurpose =
+    asked === 'register' || asked === 'second-factor' || asked === 'credential-proof'
+      ? asked
+      : 'authenticate'
+
+  let body: Submission
+  try {
+    body = (await request.json()) as Submission
+  } catch {
+    return problem(await tr('authRoute.passkey.responseUnreadable'), 400)
+  }
+
+  const challengeState = unpackChallenge(await readPasskeyChallengeCookie(), purpose)
+  await clearPasskeyChallengeCookie()
+
+  if (challengeState === null) {
+    return problem(await tr('authRoute.passkey.attemptExpired'), 400)
+  }
+
+  const clientDataJSON = text(body.clientDataJSON)
+  if (clientDataJSON === null) {
+    return problem(await tr('authRoute.passkey.responseIncomplete'), 400)
+  }
+
+  const log = logger({ module: 'passkeys' })
+
+  try {
+    const service = await passkeyService()
+    const party = await relyingParty()
+
+    if (purpose === 'register') {
+      const actor = await getActor()
+      if (actor.userId === null)
+        return problem(await tr('authRoute.passkey.signInBeforeAdding'), 403)
+      if (!(await memberManagedSignIns())) {
+        return problem(await tr('authRoute.passkey.managedSignIns'), 403)
+      }
+
+      const proof = await currentCredentialProof(actor.userId)
+      if (
+        proof === null ||
+        challengeState.userId !== actor.userId ||
+        challengeState.sessionId !== proof.session.id ||
+        challengeState.provedAt !== proof.provedAt.getTime()
+      ) {
+        return problem(await tr('authRoute.passkey.recentProofRequired'), 403)
+      }
+
+      const attestationObject = text(body.attestationObject)
+      if (attestationObject === null) {
+        return problem(await tr('authRoute.passkey.responseIncomplete'), 400)
+      }
+
+      const passkey = await service.enrol({
+        userId: actor.userId,
+        label: text(body.label) ?? '',
+        expectedChallenge: challengeState.challenge,
+        relyingParty: party,
+        response: {
+          clientDataJSON,
+          attestationObject,
+          ...(Array.isArray(body.transports)
+            ? { transports: body.transports.filter((entry) => typeof entry === 'string') }
+            : {}),
+        },
+      })
+
+      await recordAuthEvent({ userId: actor.userId, kind: 'passkey_added' })
+      return json({ ok: true, label: passkey.label })
+    }
+
+    const credentialId = text(body.id)
+    const authenticatorData = text(body.authenticatorData)
+    const signature = text(body.signature)
+
+    if (credentialId === null || authenticatorData === null || signature === null) {
+      return problem(await tr('authRoute.passkey.responseIncomplete'), 400)
+    }
+
+    if (purpose === 'credential-proof') {
+      const actor = await getActor()
+      const token = await readSessionToken()
+      const located = token ? await (await configuredIdentity()).locateSession(token) : null
+      if (
+        actor.userId === null ||
+        located === null ||
+        located.userId !== actor.userId ||
+        challengeState.userId !== actor.userId ||
+        challengeState.sessionId !== located.sessionId
+      ) {
+        return problem(await tr('authRoute.passkey.signInExpired'), 403)
+      }
+
+      const proved = await service.proveOwnership({
+        userId: actor.userId,
+        credentialId,
+        expectedChallenge: challengeState.challenge,
+        relyingParty: party,
+        response: { clientDataJSON, authenticatorData, signature },
+      })
+      if (!proved || !(await markCurrentSessionCredentialProved(actor.userId))) {
+        return problem(await tr('authRoute.passkey.notForAccount'), 403)
+      }
+      return json({ ok: true, next: '/usercp/security?verified=1' })
+    }
+
+    if (purpose === 'second-factor') {
+      const held = await readSecondFactorToken()
+      const identity = await configuredIdentity()
+      const pending =
+        held === undefined || held === '' ? null : await identity.pendingSecondFactor(held)
+
+      if (pending === null || held === undefined) {
+        return problem(await tr('authRoute.passkey.signInExpired'), 403)
+      }
+
+      await identity.assertSecondFactorAttemptsLeft(pending.userId)
+
+      const proved = await service.proveOwnership({
+        userId: pending.userId,
+        credentialId,
+        expectedChallenge: challengeState.challenge,
+        relyingParty: party,
+        response: { clientDataJSON, authenticatorData, signature },
+      })
+
+      if (!proved) {
+        await identity.recordSecondFactorFailure(pending.userId)
+        await recordAuthEvent({ userId: pending.userId, kind: 'second_factor_failed' })
+        return problem(await tr('authRoute.passkey.notForAccount'), 403)
+      }
+
+      await identity.clearSecondFactorFailures(pending.userId)
+
+      const login = await identity.redeemSecondFactor(held, {
+        ipPrefix: await retainedIpPrefix(),
+      })
+
+      await clearSecondFactorCookie()
+      await setSessionCookie(login.sessionToken, login.expiresAt)
+
+      if (pending.remember) {
+        const remembered = await (await configuredSessions()).startRemembered(pending.userId)
+        await setRememberCookie(remembered.rememberToken, remembered.rememberExpiresAt)
+      }
+
+      await recordAuthEvent({ userId: pending.userId, kind: 'login' })
+
+      const target = text(body.next)
+      return json({
+        ok: true,
+        next: target !== null && isSafeLocalPath(target) ? target : '/',
+      })
+    }
+
+    const outcome = await service.authenticate({
+      credentialId,
+      expectedChallenge: challengeState.challenge,
+      relyingParty: party,
+      response: { clientDataJSON, authenticatorData, signature },
+      context: { ipPrefix: await retainedIpPrefix() },
+    })
+
+    await setSessionCookie(outcome.login.sessionToken, outcome.login.expiresAt)
+
+    const next = text(body.next)
+    return json({ ok: true, next: next !== null && isSafeLocalPath(next) ? next : '/' })
+  } catch (err) {
+    log.warn({ err, purpose }, 'a passkey exchange was refused')
+    return json(toPublicError(err), statusForError(err))
+  }
+}