@meith/web 0.33.4 → 0.35.0

package/src/server/passkey-challenge.ts

@@ -1,37 +1,70 @@
 import 'server-only'
 
+import { createHmac } from 'node:crypto'
+
+import { env, timingSafeEqualString } from '@meith/core'
+
 export type PasskeyPurpose = 'register' | 'authenticate' | 'second-factor' | 'credential-proof'
 
+export const PASSKEY_CHALLENGE_TTL_MS = 10 * 60 * 1000
+
+export const PASSKEY_CHALLENGE_TTL_SECONDS = PASSKEY_CHALLENGE_TTL_MS / 1000
+
+const CLOCK_SKEW_MS = 60_000
+
 export interface PasskeyChallenge {
   readonly challenge: string
+  readonly issuedAt: number
   readonly userId?: number
   readonly sessionId?: number
   readonly provedAt?: number
 }
 
+function signature(purpose: PasskeyPurpose, payload: string): string {
+  return createHmac('sha256', env.AUTH_SECRET ?? '')
+    .update(`${purpose}:${payload}`)
+    .digest('base64url')
+}
+
 export function packChallenge(
   purpose: PasskeyPurpose,
   challenge: string,
-  binding: Omit<PasskeyChallenge, 'challenge'> = {},
+  binding: Omit<PasskeyChallenge, 'challenge' | 'issuedAt'> = {},
+  now: number = Date.now(),
 ): string {
-  return `${purpose}:${encodeURIComponent(JSON.stringify({ challenge, ...binding }))}`
+  const payload = Buffer.from(JSON.stringify({ challenge, issuedAt: now, ...binding })).toString(
+    'base64url',
+  )
+  return `${purpose}:${payload}.${signature(purpose, payload)}`
 }
 
 export function unpackChallenge(
   raw: string | undefined,
   purpose: PasskeyPurpose,
+  now: number = Date.now(),
 ): PasskeyChallenge | null {
   if (raw === undefined) return null
 
   const separator = raw.indexOf(':')
   if (separator < 0 || raw.slice(0, separator) !== purpose) return null
 
+  const body = raw.slice(separator + 1)
+  const dot = body.indexOf('.')
+  if (dot < 0) return null
+
+  const payload = body.slice(0, dot)
+  const provided = body.slice(dot + 1)
+  if (!timingSafeEqualString(provided, signature(purpose, payload))) return null
+
   try {
-    const value = JSON.parse(decodeURIComponent(raw.slice(separator + 1))) as Record<
+    const value = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<
       string,
       unknown
     >
     if (typeof value.challenge !== 'string' || value.challenge === '') return null
+    if (typeof value.issuedAt !== 'number' || !Number.isInteger(value.issuedAt)) return null
+    if (now - value.issuedAt > PASSKEY_CHALLENGE_TTL_MS) return null
+    if (value.issuedAt - now > CLOCK_SKEW_MS) return null
     if (value.userId !== undefined && !Number.isInteger(value.userId)) return null
     if (value.sessionId !== undefined && !Number.isInteger(value.sessionId)) return null
     if (value.provedAt !== undefined && !Number.isInteger(value.provedAt)) return null

package/src/server/poll-scope.ts

@@ -32,6 +32,12 @@ export async function resolvePollScope(actor: Actor, threadId: number): Promise<
   }
   if (!authorizer.can(actor, 'thread.view', scope)) return null
 
+  if (
+    (located.visibility === 'deleted' && !authorizer.can(actor, 'content.viewDeleted', scope)) ||
+    (located.visibility === 'unapproved' && !authorizer.can(actor, 'content.viewUnapproved', scope))
+  )
+    return null
+
   const wroteIt = actor.userId !== null && located.authorUserId === actor.userId
   const editsOwn = wroteIt && authorizer.can(actor, 'post.editOwn', scope)
   const mayEditOthers = authorizer.can(actor, 'post.editOthers', scope)

package/src/server/post-notifications.ts

@@ -1,7 +1,7 @@
 import 'server-only'
 
 import { foldIdentifier } from '@meith/accounts'
-import { logger } from '@meith/core'
+import { audienceFilterIn, authorFilterAdmits, logger } from '@meith/core'
 import { extractMentions, extractQuotedAuthors, vocabularyOptions } from '@meith/markdown'
 
 import { postLink } from '@/view/post-link'
@@ -15,8 +15,10 @@ const MAX_RECIPIENTS_PER_KIND = 10
 export interface NewPostNotice {
   readonly postId: number
   readonly threadId: number
+  readonly forumId: number
   readonly threadSlug: string
   readonly threadTitle: string
+  readonly threadAuthorId: number | null
   readonly message: string
   readonly authorUsername: string
   readonly visibility: 'visible' | 'unapproved'
@@ -35,7 +37,7 @@ export async function notifyPostAudience(notice: NewPostNotice): Promise<void> {
     const href = postLink(`/thread/${notice.threadId}-${notice.threadSlug}`, notice.postId)
     const data = { byUsername: notice.authorUsername, threadTitle: notice.threadTitle }
 
-    const { accountStore } = getContainer()
+    const { accountStore, actorSource, authorizer } = getContainer()
     const told = new Set<string>([foldIdentifier(notice.authorUsername)])
 
     for (const [kind, names] of [
@@ -52,6 +54,12 @@ export async function notifyPostAudience(notice: NewPostNotice): Promise<void> {
         const account = await accountStore.accounts.findByUsernameLower(folded)
         if (account === null) continue
 
+        const recipient = await actorSource.buildForUser(account.id)
+        if (recipient === null) continue
+        const audience = await authorizer.threadAudience(recipient)
+        const filter = audienceFilterIn(audience, notice.forumId)
+        if (!authorFilterAdmits(filter, notice.threadAuthorId)) continue
+
         await service.raise({
           userId: account.id,
           kind,

package/src/server/post-scope.ts

@@ -36,9 +36,13 @@ export async function resolvePostScope(
   const scope = {
     ...(await moderatorTargetFor(actor, target.forum.id, matrix)),
     ownerId: target.post.authorUserId,
+    threadAuthorId: target.thread.authorUserId,
   }
   if (!authorizer.can(actor, 'thread.view', scope)) return null
 
+  const visibleStates = authorizer.contentScope(actor, scope)
+  if (!visibleStates.states.includes(target.thread.visibility)) return null
+
   const isOwn = actor.userId !== null && target.post.authorUserId === actor.userId
   const editsOthers = authorizer.can(actor, 'post.editOthers', scope)
   const moderates = authorizer.can(actor, 'content.viewUnapproved', scope)

package/src/server/reply-core.ts

@@ -162,8 +162,10 @@ export async function submitReply(
   await notifyPostAudience({
     postId: created.postId,
     threadId: created.threadId,
+    forumId,
     threadSlug: created.slug,
     threadTitle: target.title,
+    threadAuthorId: target.authorUserId,
     message: draft.body,
     authorUsername: profile.username,
     visibility: created.visibility,

package/src/server/thread-core.ts

@@ -201,8 +201,10 @@ export async function submitThread(
   await notifyPostAudience({
     postId: created.postId,
     threadId: created.threadId,
+    forumId: forum.id,
     threadSlug: created.slug,
     threadTitle: draft.subject ?? input.title,
+    threadAuthorId: userId,
     message: draft.body,
     authorUsername: profile.username,
     visibility: created.visibility,

package/src/server/thread-rating-actions.ts

@@ -38,6 +38,12 @@ export async function rateThreadAction(form: FormData): Promise<void> {
   }
   if (!authorizer.can(actor, 'thread.view', target))
     throw new ValidationError(msg('error.app.thread-exist'))
+  if (
+    (located?.visibility === 'deleted' && !authorizer.can(actor, 'content.viewDeleted', target)) ||
+    (located?.visibility === 'unapproved' &&
+      !authorizer.can(actor, 'content.viewUnapproved', target))
+  )
+    throw new ValidationError(msg('error.app.thread-exist'))
   const recorded = await new ThreadRatingService(polls).rate({
     threadId,
     userId: actor.userId,

package/src/server/two-factor-actions.ts

@@ -12,6 +12,7 @@ import { recordAuthEvent } from './auth-events'
 import type { FormState } from './auth-form-state'
 import { getContainer } from './container'
 import { getActor } from './context'
+import { requireFreshCredentialProof } from './credential-proof'
 import { assertDemoAccountChangeable } from './demo'
 import { formStateReporter } from './form-state-reporter'
 import { text } from './form-values'
@@ -59,6 +60,8 @@ async function requireOwnFactor(): Promise<Owner> {
 }
 
 export async function beginTwoFactorAction(_prev: FormState, _form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId } = await requireOwnAccount()
 
@@ -91,6 +94,8 @@ export async function abandonTwoFactorAction(
 }
 
 export async function confirmTwoFactorAction(_prev: FormState, form: FormData): Promise<FormState> {
+  const actor = await getActor()
+  if (actor.userId !== null) await requireFreshCredentialProof(actor.userId)
   try {
     const { userId } = await requireOwnAccount()
 

package/src/server/upgrade-notice.ts

@@ -17,7 +17,7 @@ import { planUpgrade, type UpgradeState, upgradeNotice } from '@meith/upgrade'
 
 import { activeDefinitions } from './plugin-host'
 
-export const CODE_VERSION = '0.33.4'
+export const CODE_VERSION = '0.35.0'
 
 export interface UpgradeApplied {
   readonly plugins: readonly string[]

package/src/server/user-admin-actions.ts

@@ -447,15 +447,15 @@ async function queueMassMailBatch(
   bulk: ReturnType<typeof requireUserBulk>,
   massMailId: number,
 ): Promise<{ state: FormState; sent: number; queued: number }> {
-  const chunk = await bulk.claimMassMailChunk(massMailId, MASS_MAIL_CHUNK)
-
-  for (const recipient of chunk.recipients) {
-    await drivers().queue.enqueue(
-      'admin.mass_mail',
-      { massMailId, userId: recipient.userId, email: recipient.email },
-      { dedupeKey: `mass-mail:${massMailId}:${recipient.userId}` },
-    )
-  }
+  const chunk = await bulk.claimMassMailChunk(massMailId, MASS_MAIL_CHUNK, async (recipients) => {
+    for (const recipient of recipients) {
+      await drivers().queue.enqueue(
+        'admin.mass_mail',
+        { massMailId, userId: recipient.userId, email: recipient.email },
+        { dedupeKey: `mass-mail:${massMailId}:${recipient.userId}` },
+      )
+    }
+  })
 
   const total = (await bulk.readMassMail(massMailId))?.queuedCount ?? 0
 

package/src/server/usercp-actions.ts

@@ -23,6 +23,7 @@ import { formStateReporter } from './form-state-reporter'
 import { text } from './form-values'
 import { getTranslator, tr } from './i18n'
 import { boardRendering } from './markdown-pipeline'
+import { notificationService } from './notifications'
 import { emitEvent } from './plugin-view'
 import { profileFieldService, submittedFields, viewerFieldContext } from './profile-fields'
 import { setSessionCookie } from './session-cookies'
@@ -170,6 +171,7 @@ export async function changePasswordAction(_prev: FormState, form: FormData): Pr
     if (admin !== null) await admin.endAllFor(userId)
 
     await revokeFeedToken(userId)
+    await notificationService()?.unsubscribeAllFromPush(userId)
 
     await recordAuthEvent({ userId, kind: 'password_changed' })
   } catch (err) {

package/src/view/admin-nav.ts

@@ -115,6 +115,7 @@ export const ADMIN_SECTIONS: PanelNav = [
     titleKey: 'adminNav.admin-system.title',
     icon: 'system',
     blurbKey: 'adminNav.admin-system.blurb',
+    children: [{ href: '/admin/system/backups', titleKey: 'adminNav.admin-system-backups.title' }],
   },
   {
     href: '/admin/log',

package/src/view/admin-panel-copy.ts

@@ -75,6 +75,22 @@ export function webhookFormsCopy(t: Translator = untranslated()): Readonly<Recor
   )
 }
 
+export function backupFormsCopy(t: Translator = untranslated()): Readonly<Record<string, string>> {
+  return {
+    ...copyFor(
+      [
+        'adminPanel.backup.now',
+        'adminPanel.backup.queued',
+        'adminPanel.backup.already',
+        'adminPanel.backup.delete',
+        'adminPanel.backup.test',
+      ],
+      t,
+    ),
+    ...patternCopy(['adminPanel.backup.deleted', 'adminPanel.backup.reachable'], t),
+  }
+}
+
 export function systemFormsCopy(t: Translator = untranslated()): Readonly<Record<string, string>> {
   return {
     ...copyFor(

package/src/view/install-copy.ts

@@ -96,3 +96,38 @@ export function installFormCopy(
     'install.mail.testNoteTail': testNoteTail,
   }
 }
+
+export function installRestoreCopy(
+  t: Translator = untranslated(),
+): Readonly<Record<string, string>> {
+  return {
+    ...copyFor(
+      [
+        'install.restore.title',
+        'install.restore.hint',
+        'install.restore.pick',
+        'install.restore.confirm',
+        'install.restore.submit',
+        'install.restore.restoring',
+        'install.restore.pendingNote',
+        'install.restore.idleNote',
+        'install.restore.notRestored',
+        'install.restore.noneLocal',
+        'install.restore.doneTitle',
+        'install.restore.noUploads',
+        'install.restore.next',
+        'install.restore.signIn',
+      ],
+      t,
+    ),
+    ...patternCopy(
+      [
+        'install.restore.noneAnywhere',
+        'install.restore.doneDetail',
+        'install.restore.migrated',
+        'install.restore.skipped',
+      ],
+      t,
+    ),
+  }
+}

package/src/view/setting-groups.ts

@@ -12,6 +12,7 @@ export const GROUP_LABELS: Record<SettingGroup, string> = {
   federation: 'Sign-in providers',
   antispam: 'Anti-spam',
   push: 'Push',
+  backup: 'Backups',
   legal: 'Legal',
 }
 
@@ -27,6 +28,7 @@ export const GROUP_ORDER: readonly SettingGroup[] = [
   'federation',
   'antispam',
   'push',
+  'backup',
   'legal',
 ]