@nymphjs/tilmeld 1.0.0-beta.138 → 1.0.0-beta.139

package/src/User.ts

@@ -518,7 +518,7 @@ export class User extends AbleObject<UserData> {
       `User account recovery for "${user.username}".`,
     );
 
-    user.$password(data.password);
+    await user.$password(data.password);
     delete user.recoverSecret;
     delete user.recoverSecretDate;
     try {
@@ -637,6 +637,10 @@ export class User extends AbleObject<UserData> {
   async $getUniques(): Promise<string[]> {
     const tilmeld = enforceTilmeld(this);
     const uniques = [`u:${this.username}`];
+    if (this.abilities?.includes('system/autogranted')) {
+      // Prevent multiple users from ever being granted admin automatically.
+      uniques.push('a:autogranted');
+    }
     if (
       !tilmeld.config.emailUsernames &&
       tilmeld.config.userFields.includes('email')
@@ -661,7 +665,7 @@ export class User extends AbleObject<UserData> {
       await tilmeld.config.failedLoginAttempt(null, data);
       return { result: false, message: 'Incorrect login/password.' };
     }
-    if (!this.$checkPassword(data.password)) {
+    if (!(await this.$checkPassword(data.password))) {
       await tilmeld.config.failedLoginAttempt(this, data);
       return { result: false, message: 'Incorrect login/password.' };
     }
@@ -719,6 +723,17 @@ export class User extends AbleObject<UserData> {
       }
     }
 
+    // Check if the password uses the old hash method.
+    if (
+      tilmeld.config.pwMethod === 'salt' &&
+      !this.password?.startsWith('scrypt$')
+    ) {
+      // Update the password hash with one using the new method.
+      await this.$refresh();
+      await this.$password(data.password);
+      await this.$save();
+    }
+
     // Login was successful.
     return { result: true, message: 'You are logged in.' };
   }
@@ -784,7 +799,7 @@ export class User extends AbleObject<UserData> {
     );
 
     // Authentication was successful, attempt to login.
-    if (!(await tilmeld.loginSwitch(this, true))) {
+    if (!(await tilmeld.loginSwitch(user, this, true))) {
       return { result: false, message: 'Incorrect login/password.' };
     }
 
@@ -894,6 +909,12 @@ export class User extends AbleObject<UserData> {
 
     if ('abilities' in input.data) {
       this.$checkIncomingAbilities(input.data.abilities);
+    } else if (
+      (this.$allowlistData == null ||
+        this.$allowlistData.includes('abilities')) &&
+      (this.$privateData == null || !this.$privateData.includes('abilities'))
+    ) {
+      this.$checkIncomingAbilities(undefined);
     }
 
     // If the user is a new domain user, the data protection needs to be updated
@@ -939,6 +960,10 @@ export class User extends AbleObject<UserData> {
       this.$checkIncomingAbilities(patch.set.abilities);
     }
 
+    if (patch.unset.includes('abilities')) {
+      this.$checkIncomingAbilities(undefined);
+    }
+
     super.$jsonAcceptPatch(patch, allowConflict);
   }
 
@@ -963,6 +988,20 @@ export class User extends AbleObject<UserData> {
       );
     }
 
+    if (
+      xor(
+        incoming.filter((ability) => ability.startsWith('system/')),
+        this.abilities?.filter((ability) => ability.startsWith('system/')) ??
+          [],
+      ).length &&
+      (!tilmeld.currentUser ||
+        !tilmeld.currentUser.abilities?.includes('system/admin'))
+    ) {
+      throw new BadDataError(
+        "You don't have the authority to grant or revoke system abilities.",
+      );
+    }
+
     if (
       incoming.includes('tilmeld/admin') !==
         this.abilities?.includes('tilmeld/admin') &&
@@ -987,10 +1026,9 @@ export class User extends AbleObject<UserData> {
 
     if (
       xor(
-        incoming.filter((ability: string) => ability.startsWith('tilmeld/')),
-        this.abilities?.filter((ability: string) =>
-          ability.startsWith('tilmeld/'),
-        ) ?? [],
+        incoming.filter((ability) => ability.startsWith('tilmeld/')),
+        this.abilities?.filter((ability) => ability.startsWith('tilmeld/')) ??
+          [],
       ).length &&
       (!tilmeld.currentUser ||
         (!tilmeld.currentUser.abilities?.includes('system/admin') &&
@@ -1392,25 +1430,55 @@ export class User extends AbleObject<UserData> {
    * @param password The password in question.
    * @returns True if the passwords match, otherwise false.
    */
-  public $checkPassword(password: string) {
+  public async $checkPassword(password: string) {
     const tilmeld = enforceTilmeld(this);
     switch (tilmeld.config.pwMethod) {
       case 'plain':
-        return this.password === password;
+        return crypto.timingSafeEqual(
+          Buffer.from(this.password ?? ''),
+          Buffer.from(password),
+        );
       case 'digest':
-        return (
-          this.password ===
-          crypto.createHash('sha256').update(password).digest('base64')
+        return crypto.timingSafeEqual(
+          Buffer.from(this.password ?? '', 'base64'),
+          crypto.createHash('sha256').update(password).digest(),
         );
       case 'salt':
       default:
-        return (
-          this.password ===
-          crypto
-            .createHash('sha256')
-            .update(password + this.salt)
-            .digest('base64')
-        );
+        if (!this.password?.startsWith('scrypt$')) {
+          // Check using the old hash method.
+          return crypto.timingSafeEqual(
+            Buffer.from(this.password ?? '', 'base64'),
+            crypto
+              .createHash('sha256')
+              .update(password + this.salt)
+              .digest(),
+          );
+        }
+        // Check using the new hash method.
+        const [alg, n, rr, pp, salt, keyB64] = (this.password ?? '').split('$');
+        if (alg !== 'scrypt') {
+          return false;
+        }
+        const expected = Buffer.from(keyB64, 'base64');
+        const N = Number(n),
+          r = Number(rr),
+          p = Number(pp);
+        const key = await new Promise<Buffer>((resolve, reject) => {
+          crypto.scrypt(
+            password,
+            salt,
+            expected.length,
+            { N, r, p, maxmem: 256 * N * r },
+            (err, key) => {
+              if (err) {
+                return reject(err);
+              }
+              resolve(key);
+            },
+          );
+        });
+        return crypto.timingSafeEqual(key, expected);
     }
   }
 
@@ -1493,6 +1561,10 @@ export class User extends AbleObject<UserData> {
     currentPassword: string;
     revokeCurrentTokens?: boolean;
   }): Promise<{ result: boolean; message: string }> {
+    const tilmeld = enforceTilmeld(this);
+    if (!tilmeld.gatekeeper()) {
+      return { result: false, message: 'You must be logged in.' };
+    }
     this.$nymph.config.debugLog(
       'tilmeld',
       `Password change request for "${this.username}".`,
@@ -1500,7 +1572,7 @@ export class User extends AbleObject<UserData> {
     if (!('newPassword' in data) || !data.newPassword.length) {
       return { result: false, message: 'Please specify a password.' };
     }
-    if (!this.$checkPassword(data.currentPassword ?? '')) {
+    if (!(await this.$checkPassword(data.currentPassword ?? ''))) {
       this.$nymph.config.debugLog(
         'tilmeld',
         `Incorrect password for change request for "${this.username}".`,
@@ -1513,11 +1585,15 @@ export class User extends AbleObject<UserData> {
     }
     try {
       await this.$save();
-      if (data.revokeCurrentTokens) {
-        const tilmeld = enforceTilmeld(this);
+      if (data.revokeCurrentTokens && this.$is(tilmeld.currentUser)) {
         await tilmeld.login(this, true);
       }
-      return { result: true, message: 'Your password has been changed.' };
+      return {
+        result: true,
+        message: this.$is(tilmeld.currentUser)
+          ? 'Your password has been changed.'
+          : "User's password has been changed.",
+      };
     } catch (e: any) {
       return { result: false, message: "Couldn't save new password." };
     }
@@ -1529,7 +1605,7 @@ export class User extends AbleObject<UserData> {
    * @param password The new password.
    * @returns The resulting password or hash which is stored in the entity.
    */
-  public $password(password: string) {
+  public async $password(password: string) {
     const tilmeld = enforceTilmeld(this);
     switch (tilmeld.config.pwMethod) {
       case 'plain':
@@ -1546,10 +1622,20 @@ export class User extends AbleObject<UserData> {
       case 'salt':
       default:
         this.salt = nanoid();
-        this.password = crypto
-          .createHash('sha256')
-          .update(password + this.salt)
-          .digest('base64');
+        const N = 131072;
+        const r = 8;
+        const p = 1;
+        const KEYLEN = 64;
+        const opts = { N, r, p, maxmem: 256 * N * r };
+        const key = await new Promise<Buffer>((resolve, reject) => {
+          crypto.scrypt(password, this.salt ?? '', KEYLEN, opts, (err, key) => {
+            if (err) {
+              return reject(err);
+            }
+            resolve(key);
+          });
+        });
+        this.password = `scrypt$${N}$${r}$${p}$${this.salt}$${key.toString('base64')}`;
         break;
     }
     return this.password;
@@ -1564,7 +1650,11 @@ export class User extends AbleObject<UserData> {
   public async $revokeCurrentTokens(data: {
     password: string;
   }): Promise<{ result: boolean; message: string }> {
-    if (!this.$checkPassword(data.password ?? '')) {
+    const tilmeld = enforceTilmeld(this);
+    if (!tilmeld.gatekeeper()) {
+      return { result: false, message: 'You must be logged in.' };
+    }
+    if (!(await this.$checkPassword(data.password ?? ''))) {
       return { result: false, message: 'Incorrect password.' };
     }
 
@@ -1572,12 +1662,18 @@ export class User extends AbleObject<UserData> {
 
     try {
       await this.$save();
-      const tilmeld = enforceTilmeld(this);
-      await tilmeld.login(this, true);
-      return {
-        result: true,
-        message: 'You have logged out of all other sessions.',
-      };
+      if (this.$is(tilmeld.currentUser)) {
+        await tilmeld.login(this, true);
+        return {
+          result: true,
+          message: 'You have logged out of all other sessions.',
+        };
+      } else {
+        return {
+          result: true,
+          message: 'The user has been logged out of all sessions.',
+        };
+      }
     } catch (e: any) {
       return { result: false, message: "Couldn't save revocation date." };
     }
@@ -1657,7 +1753,7 @@ export class User extends AbleObject<UserData> {
     secret: string;
     code: string;
   }): Promise<{ result: boolean; message: string }> {
-    if (!this.$checkPassword(data.password ?? '')) {
+    if (!(await this.$checkPassword(data.password ?? ''))) {
       return { result: false, message: 'Incorrect password.' };
     }
 
@@ -1720,7 +1816,7 @@ export class User extends AbleObject<UserData> {
     const tilmeld = enforceTilmeld(this);
 
     if (data) {
-      if (!this.$checkPassword(data.password ?? '')) {
+      if (!(await this.$checkPassword(data.password ?? ''))) {
         return { result: false, message: 'Incorrect password.' };
       }
 
@@ -2029,7 +2125,7 @@ export class User extends AbleObject<UserData> {
       return { ...unCheck, loggedin: false };
     }
 
-    this.$password(data.password);
+    await this.$password(data.password);
     if (tilmeld.config.regFields.includes('name')) {
       this.name =
         this.nameFirst +
@@ -2089,6 +2185,7 @@ export class User extends AbleObject<UserData> {
             }
             if (!otherUsers.length) {
               this.$grant('system/admin');
+              this.$grant('system/autogranted');
               this.enabled = true;
               madeAdmin = true;
             }
@@ -2452,12 +2549,13 @@ export class User extends AbleObject<UserData> {
         // be able to cancel the email change from their old address.
         this.cancelEmailAddress = this.$originalEmail;
         this.cancelEmailSecret = nanoid();
+        this.emailChangeDate = Date.now();
         sendVerification = true;
       }
     }
 
     if (this.passwordTemp != null) {
-      this.$password(this.passwordTemp);
+      await this.$password(this.passwordTemp);
     }
     delete this.passwordTemp;
 

package/src/conf/defaults.ts

@@ -61,21 +61,32 @@ export default {
   jwtExpire: 60 * 60 * 24 * 7 * 24, // 24 weeks(ish) (6 months)
   jwtSwitchExpire: 60 * 60 * 6, // 6 hours
   jwtRenew: 60 * 60 * 24 * 7 * 12, // 12 weeks(ish) (3 months)
-  jwtBuilder: (config, user, switchToken) => {
+  jwtBuilder: (config, user, switchToken, switchForUser) => {
     const secret = config.jwtSecret;
     if (secret === '') {
       throw new Error('JWT secret is not configured.');
     }
 
+    if (switchToken && (!switchForUser || switchForUser.guid == null)) {
+      throw new Error(
+        "Issuing a switch token requires providing the user it's for.",
+      );
+    }
+
     return jwt.sign(
       {
         iss: config.appUrl,
+        sub: switchForUser ? switchForUser.guid : user.guid,
         nbf: Math.floor(Date.now() / 1000),
         exp:
           Math.floor(Date.now() / 1000) +
           (switchToken ? config.jwtSwitchExpire : config.jwtExpire),
+        // TODO: remove this guid claim in favor of sub claim
+        // this needs to be done long enough after Nov 1 2026, when sub added
+        // also don't forget to change how switchForUser guid is stored.
         guid: user.guid,
         xsrfToken: 'TILMELDXSRF-' + nanoid(),
+        ...(switchToken ? { switch: true } : {}),
       },
       secret,
     );
@@ -96,7 +107,14 @@ export default {
         return null;
       }
 
-      const { guid, xsrfToken: jwtXsrfToken, exp, nbf } = payload;
+      const {
+        sub,
+        guid,
+        xsrfToken: jwtXsrfToken,
+        switch: switchBool,
+        exp,
+        nbf,
+      } = payload;
 
       if (xsrfToken != null && xsrfToken !== jwtXsrfToken) {
         return null;
@@ -118,7 +136,7 @@ export default {
 
       const expire = new Date(exp * 1000);
 
-      return { guid, issued, expire };
+      return { sub, guid, issued, expire, switch: switchBool };
     } catch (e: any) {
       return null;
     }

package/src/conf/index.ts

@@ -164,12 +164,18 @@ export interface Config {
    */
   pwRecoveryTimeLimit: string;
   /**
-   * Method used to store passwords. Salt is more secure if the database is
-   * compromised. Plain: store the password in plaintext. Digest: store the
-   * password's digest (hash). Salt: store the password's digest using a
-   * complex, unique salt.
+   * Method used to store passwords. Salt is the most secure if the database is
+   * compromised.
    *
-   * Digests are SHA-256, so a salt probably isn't necessary, but who knows.
+   * - Plain: Store the password in plain text. A very bad idea.
+   * - Digest: Store the password's digest (hash) using SHA-256. The minimum
+   *   level of security, but not enough for modern apps.
+   * - Salt: Store the password's digest with a complex, unique salt using
+   *   the scrypt algorithm. Modern, secure password storage.
+   *
+   * Really the only reason to use anything other than "salt" is if you need
+   * logins to be so incredibly fast you can't even perceive a delay. So, not in
+   * a web app.
    *
    * Options are: "plain", "digest", "salt"
    */
@@ -265,7 +271,12 @@ export interface Config {
   /**
    * Function to build the JWT for user sessions.
    */
-  jwtBuilder: (config: Config, user: User, switchToken?: boolean) => string;
+  jwtBuilder: (
+    config: Config,
+    user: User,
+    switchToken?: boolean,
+    switchForUser?: User,
+  ) => string;
   /**
    * Function to verify that a JWT was signed with the secret key, validate its
    * data, validate the XSRF token, and extract the GUID and dates.
@@ -279,7 +290,13 @@ export interface Config {
     config: Config,
     token: string,
     xsrfToken?: string,
-  ) => { guid: string; issued: Date; expire: Date } | null;
+  ) => {
+    sub: string;
+    guid: string;
+    issued: Date;
+    expire: Date;
+    switch?: true;
+  } | null;
   /**
    * The absolute path to the email template directory. Used by the default
    * email sender.

package/src/testArtifacts.ts

@@ -17,6 +17,7 @@ import { GroupTest } from './Group.testArtifacts.js';
 
 export interface TestModelData extends AccessControlData {
   name?: string;
+  another?: TestModel;
 }
 
 export interface TestModel extends TestModelData {}
@@ -147,7 +148,7 @@ export function TilmeldTest(
         admin.nameFirst = 'Admin';
         admin.nameLast = 'User';
         admin.name = 'Admin User';
-        admin.$password('password');
+        await admin.$password('password');
         admin.$grant('system/admin');
         await admin.$saveSkipAC();
       }
@@ -165,7 +166,7 @@ export function TilmeldTest(
         bob.nameFirst = 'Bob';
         bob.nameLast = 'User';
         bob.name = 'Bob User';
-        bob.$password('password');
+        await bob.$password('password');
         bob.$addGroup(abgroup);
         await bob.$saveSkipAC();
       }
@@ -176,7 +177,7 @@ export function TilmeldTest(
         alice.nameFirst = 'Alice';
         alice.nameLast = 'User';
         alice.name = 'Alice User';
-        alice.$password('password');
+        await alice.$password('password');
         alice.$addGroup(abgroup);
         await alice.$saveSkipAC();
       }
@@ -1223,6 +1224,53 @@ export function TilmeldTest(
       expect(verifyEntityAlice).toBeNull();
     });
 
+    it("alice can't find an entity by qref using an entity she doesn't have permission for", async () => {
+      const { bob, alice } = await makeUsers();
+
+      await tilmeld.fillSession(bob);
+
+      const bobsEntity = await TestModel.factory();
+      bobsEntity.name = "Bob's Entity";
+      await bobsEntity.$save();
+
+      expect(bobsEntity.guid).not.toBeNull();
+      expect(bob.$is(bobsEntity.user)).toEqual(true);
+
+      const testEntityBob = await nymph.getEntity(
+        { class: TestModel },
+        { type: '&', guid: bobsEntity.guid || '' },
+      );
+
+      expect(testEntityBob).not.toBeNull();
+      expect(testEntityBob?.guid).toEqual(bobsEntity.guid);
+
+      tilmeld.clearSession();
+      await tilmeld.fillSession(alice);
+
+      const alicesEntity = await TestModel.factory();
+      alicesEntity.name = "Alice's Entity";
+      await alicesEntity.$save();
+
+      expect(alicesEntity.guid).not.toBeNull();
+      expect(alice.$is(alicesEntity.user)).toEqual(true);
+
+      alicesEntity.another = bobsEntity;
+      await alicesEntity.$save();
+
+      const testEntityAlice = await nymph.getEntity(
+        { class: TestModel },
+        {
+          type: '&',
+          qref: [
+            'another',
+            [{ class: TestModel }, { type: '&', guid: bobsEntity.guid || '' }],
+          ],
+        },
+      );
+
+      expect(testEntityAlice).toBeNull();
+    });
+
     it('a clear session can delete an entity everyone has full permission for', async () => {
       const { bob } = await makeUsers();