@oneuptime/common 12.0.29 → 12.0.31

package/build/dist/Server/Utils/OnCall/CalendarFeedToken.js

@@ -0,0 +1,161 @@
+import crypto from "crypto";
+import OneUptimeDate from "../../../Types/Date";
+import { PREVIOUS_TOKEN_GRACE_DAYS } from "../../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+/*
+ * The capability token that addresses an on-call calendar feed.
+ *
+ * A calendar client keeps the feed URL forever and re-fetches it unattended,
+ * so the token has to be both unguessable and cheap to look up: 256 bits from
+ * the CSPRNG, carried in the URL as base64url (43 characters, no padding), and
+ * stored ONLY as its unkeyed SHA-256 hex digest. The digest is what the public
+ * route queries by, which keeps the plaintext out of the indexed column; a
+ * database dump therefore yields hashes, not working feed URLs.
+ *
+ * Unkeyed on purpose: a keyed hash (HMAC over EncryptionSecret, the backup-code
+ * recipe) would tie every feed to the instance secret, and rotating that secret
+ * would silently break every subscribed calendar in the world with no way to
+ * tell the user. The token already carries 256 bits of entropy, so a rainbow
+ * table buys nothing and the key adds no strength worth that failure mode.
+ *
+ * The hint is the last four characters - enough for the settings page to say
+ * "link ending in …k3Qx" so a user can tell two links apart, far too little to
+ * recover anything.
+ */
+// crypto.randomBytes(32) -> 32 bytes -> ceil(32 * 8 / 6) = 43 base64url chars.
+const TOKEN_BYTE_LENGTH = 32;
+export const CALENDAR_FEED_TOKEN_LENGTH = 43;
+export const CALENDAR_FEED_TOKEN_HINT_LENGTH = 4;
+/*
+ * Shape guard for the public route. Anything that does not match is answered
+ * 404 before any database work, so a scanner probing the path costs one regex.
+ */
+export const CALENDAR_FEED_TOKEN_REGEX = /^[A-Za-z0-9_-]{43}$/;
+export default class CalendarFeedToken {
+    /**
+     * A fresh 43-character base64url token from 32 CSPRNG bytes.
+     */
+    static mint() {
+        return crypto.randomBytes(TOKEN_BYTE_LENGTH).toString("base64url");
+    }
+    /**
+     * Unkeyed SHA-256 of the token, lowercase hex (64 characters). This is the
+     * value stored in `tokenHash` / `previousTokenHash` and the value the public
+     * route looks up by. Deterministic: the same token always hashes the same.
+     */
+    static hash(token) {
+        return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+    }
+    /**
+     * The display hint - the last four characters of the token. Never enough to
+     * reconstruct the token; enough to tell "…k3Qx" from "…Q9zA" in the UI.
+     */
+    static hint(token) {
+        return token.slice(-CALENDAR_FEED_TOKEN_HINT_LENGTH);
+    }
+    /**
+     * True when the string has exactly the shape a minted token has. Used as
+     * the shape guard on the public route so a malformed path never reaches the
+     * database.
+     */
+    static isValidShape(token) {
+        return typeof token === "string" && CALENDAR_FEED_TOKEN_REGEX.test(token);
+    }
+    /**
+     * Everything a feed row needs when a token is minted or rotated.
+     */
+    static mintSet() {
+        const token = CalendarFeedToken.mint();
+        return {
+            token: token,
+            tokenHash: CalendarFeedToken.hash(token),
+            tokenHint: CalendarFeedToken.hint(token),
+        };
+    }
+    /**
+     * The token columns a feed row should hold after minting or rotating.
+     *
+     * The hash the row held before (if any) moves to `previousTokenHash` and
+     * keeps serving an EMPTY calendar until `previousTokenExpiresAt`
+     * (PREVIOUS_TOKEN_GRACE_DAYS from now), so a still-subscribed client clears
+     * its copy instead of showing "could not fetch" until the user notices.
+     */
+    static buildRotation(data) {
+        const now = data.now || OneUptimeDate.getCurrentDate();
+        const minted = CalendarFeedToken.mintSet();
+        const previousTokenHash = data.currentTokenHash || null;
+        return Object.assign(Object.assign({}, minted), { rotatedAt: now, previousTokenHash: previousTokenHash, previousTokenExpiresAt: previousTokenHash
+                ? OneUptimeDate.addRemoveDays(now, PREVIOUS_TOKEN_GRACE_DAYS)
+                : null });
+    }
+    /**
+     * Populate the token columns of a row about to be INSERTED.
+     *
+     * With `trustSuppliedToken`, a well-formed plaintext token already on the
+     * row (the calendar API mints one up front so it can build the URL in the
+     * same response) is kept and the hash and hint are DERIVED from it. Without
+     * it - every non-root create - whatever the request carried is discarded
+     * and a fresh token is minted. Either way a malformed token or a
+     * caller-chosen hash is replaced: there is no path to a row whose hash
+     * disagrees with its token, and no path for a request body to choose the
+     * secret. A brand-new row never carries a grace-period hash.
+     */
+    static applyTokenColumnsOnCreate(data, options) {
+        let minted;
+        if (options.trustSuppliedToken &&
+            CalendarFeedToken.isValidShape(data.token)) {
+            minted = {
+                token: data.token,
+                tokenHash: CalendarFeedToken.hash(data.token),
+                tokenHint: CalendarFeedToken.hint(data.token),
+            };
+        }
+        else {
+            minted = CalendarFeedToken.mintSet();
+        }
+        data.token = minted.token;
+        data.tokenHash = minted.tokenHash;
+        data.tokenHint = minted.tokenHint;
+        data.rotatedAt = OneUptimeDate.getCurrentDate();
+        data.previousTokenHash = undefined;
+        data.previousTokenExpiresAt = undefined;
+        return minted;
+    }
+    /**
+     * The partial row a rotation writes. `previousTokenHash` /
+     * `previousTokenExpiresAt` are null on a first mint, which the update path
+     * has to be able to write; the model types them as optional strings/dates,
+     * hence the cast at this one boundary.
+     */
+    static toRotationUpdateData(rotation) {
+        return {
+            token: rotation.token,
+            tokenHash: rotation.tokenHash,
+            tokenHint: rotation.tokenHint,
+            rotatedAt: rotation.rotatedAt,
+            previousTokenHash: rotation.previousTokenHash,
+            previousTokenExpiresAt: rotation.previousTokenExpiresAt,
+        };
+    }
+    /**
+     * Constant-time comparison of two hashes, for callers that compare a
+     * freshly computed digest against a stored one in memory rather than in a
+     * WHERE clause. Length mismatch is answered false without leaking timing on
+     * the content.
+     */
+    static isHashEqual(a, b) {
+        /*
+         * Plain Uint8Arrays rather than Buffers: the two are interchangeable at
+         * runtime, but the App build's @types/node rejects Buffer where an
+         * ArrayBufferView is expected (the same mismatch PasswordHash and
+         * TwoFactorBackupCode trip over), and TextEncoder is global on every
+         * supported Node.
+         */
+        const bytesA = new TextEncoder().encode(a);
+        const bytesB = new TextEncoder().encode(b);
+        if (bytesA.length !== bytesB.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(bytesA, bytesB);
+    }
+}
+//# sourceMappingURL=CalendarFeedToken.js.map

package/build/dist/Server/Utils/OnCall/CalendarFeedToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CalendarFeedToken.js","sourceRoot":"","sources":["../../../../../Server/Utils/OnCall/CalendarFeedToken.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+EAA+E;AAC/E,MAAM,iBAAiB,GAAW,EAAE,CAAC;AAErC,MAAM,CAAC,MAAM,0BAA0B,GAAW,EAAE,CAAC;AAErD,MAAM,CAAC,MAAM,+BAA+B,GAAW,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,qBAAqB,CAAC;AA8CvE,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC;;OAEG;IACI,MAAM,CAAC,IAAI;QAChB,OAAO,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,IAAI,CAAC,KAAa;QAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,IAAI,CAAC,KAAa;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,YAAY,CAAC,KAAc;QACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO;QACnB,MAAM,KAAK,GAAW,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAE/C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YACxC,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,aAAa,CAAC,IAG3B;QACC,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;QAC7D,MAAM,MAAM,GAA4B,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAEpE,MAAM,iBAAiB,GAAkB,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;QAEvE,uCACK,MAAM,KACT,SAAS,EAAE,GAAG,EACd,iBAAiB,EAAE,iBAAiB,EACpC,sBAAsB,EAAE,iBAAiB;gBACvC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;gBAC7D,CAAC,CAAC,IAAI,IACR;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACI,MAAM,CAAC,yBAAyB,CACrC,IAA8B,EAC9B,OAAwC;QAExC,IAAI,MAA+B,CAAC;QAEpC,IACE,OAAO,CAAC,kBAAkB;YAC1B,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1C,CAAC;YACD,MAAM,GAAG;gBACP,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAC9C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC;QAChD,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QAExC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,oBAAoB,CAChC,QAA8B;QAE9B,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,iBAAiB,EAAE,QAAQ,CAAC,iBAAsC;YAClE,sBAAsB,EACpB,QAAQ,CAAC,sBAAyC;SACrD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,WAAW,CAAC,CAAS,EAAE,CAAS;QAC5C;;;;;;WAMG;QACH,MAAM,MAAM,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;CACF"}