@opengis/fastify-table 2.0.57 → 2.0.59

package/dist/server/migrations/0.sql

@@ -59,8 +59,8 @@ if (_returnType != 'text') then
 	end loop;
 
 	raise notice 'reassign default finish: %', _tables;
-	
-else 
+
+else
 	raise notice 'skip default reassign';
 
 		/* CREATE EXTENSION if not exists "uuid-ossp";
@@ -81,7 +81,7 @@ else
 	  COST 100;
 end if;
 
-end $$
+end $$;
 
 CREATE OR REPLACE FUNCTION array_intersect(
 	anyarray,

package/dist/server/plugins/auth/funcs/authorizeUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizeUser.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/authorizeUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AA2BtD,wBAA8B,aAAa,CACzC,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,SAAe,EACvB,MAAM,CAAC,EAAE,MAAM,gBAkFhB"}
+{"version":3,"file":"authorizeUser.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/authorizeUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AA4BtD,wBAA8B,aAAa,CACzC,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,SAAe,EACvB,MAAM,CAAC,EAAE,MAAM,gBA+HhB"}

package/dist/server/plugins/auth/funcs/authorizeUser.js

@@ -1,5 +1,6 @@
 import config from "../../../../config.js";
 import logger from "../../logger/getLogger.js";
+import pgClients from "../../pg/pgClients.js";
 import applyHook from "../../hook/applyHook.js";
 import logAuth from "./logAuth.js";
 /*
@@ -18,6 +19,7 @@ const getIp = (req) => (req.headers?.["x-real-ip"] ||
 export default async function authorizeUser(user, req, authType = "creds-user", expire) {
     if (!user?.uid)
         return "/logout";
+    const { pg = pgClients.client } = req;
     Object.assign(user, { auth_type: authType });
     // fastify/passport
     await req.login(user);
@@ -54,10 +56,39 @@ export default async function authorizeUser(user, req, authType = "creds-user",
     })) ||
         {};
     await req.session?.save?.();
-    if (req.method === "POST") {
-        return { message: "ok", status: "200" };
-    }
     const redirectUrl = req.headers?.referer?.match?.(/[?&]redirect=([^&]+)/)?.[1] || "/";
+    const twofaEnabled = config.auth?.["2factor"] && user?.twofa && user.uid && pg;
+    const registered = false; // ? check by created/updated date?
+    if (req.method === "POST" &&
+        (!twofaEnabled || req.session?.secondFactorPassed)) {
+        return {
+            redirectUrl: href ||
+                config.auth?.redirectAfter ||
+                (redirectUrl.startsWith("/") ? redirectUrl : "/"),
+            authType,
+            registered,
+            user: { ...user, password: undefined, salt: undefined },
+        };
+    }
+    if (req.method === "POST" &&
+        twofaEnabled &&
+        !req.session?.secondFactorPassed) {
+        const verified = await pg
+            .query(`select
+          enabled and social_auth_url is not null as verified
+        from admin.users_social_auth
+        where uid = $1
+        and social_auth_type = $2`, [user.uid, "TOTP"])
+            .then((el) => el.rows?.[0]?.verified || false);
+        const redirect2fa = `${config.auth?.link?.["2fa"]?.login || "/2factor"}?redirect=${redirectUrl.startsWith("/") ? redirectUrl : "/"}`;
+        return {
+            redirectUrl: redirect2fa,
+            authType,
+            registered,
+            "2factor": { verified, enabled: !!user?.twofa },
+            user: { ...user, password: undefined, salt: undefined },
+        };
+    }
     // by default, disable 2factor for id.gov.ua auth
     const check = authType === "govid" ? config.auth?.["2factor"]?.govid : true;
     if (config.auth?.["2factor"] && user?.twofa && check) {

package/dist/server/plugins/auth/funcs/loginUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginUser.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/loginUser.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AAEvD,wBAA8B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBA+CpE"}
+{"version":3,"file":"loginUser.d.ts","sourceRoot":"","sources":["../../../../../server/plugins/auth/funcs/loginUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAUvC,wBAA8B,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,kBA+CpE"}

package/dist/server/plugins/auth/funcs/loginUser.js

@@ -9,14 +9,14 @@ export default async function loginUser(req, reply) {
     if (!config.pg) {
         return req.method === "GET"
             ? reply.status(302).redirect("/login?confirm=wrong_pass&message=empty pg")
-            : reply.status(400).send({ message: "empty pg" });
+            : reply.status(400).send({ error: "empty pg", code: 400 });
     }
     if (!config.redis) {
         return req.method === "GET"
             ? reply
                 .status(302)
                 .redirect("/login?confirm=wrong_pass&message=empty redis")
-            : reply.status(400).send({ message: "empty redis" });
+            : reply.status(400).send({ error: "empty redis", code: 400 });
     }
     const { user, message = "invalid user" } = (await verifyPassword({
         pg,
@@ -28,19 +28,19 @@ export default async function loginUser(req, reply) {
             ? reply
                 .status(302)
                 .redirect(`/login?confirm=wrong_pass&message=${message}`)
-            : reply.status(400).send({ message });
+            : reply.status(400).send({ error: message, code: 400 });
     }
     if (!user && (req.query?.username || req.body?.username)) {
         return req.method === "GET"
             ? reply
                 .status(302)
                 .redirect(`/login?confirm=wrong_pass&message=${message}`)
-            : reply.status(400).send({ message });
+            : reply.status(400).send({ error: message, code: 400 });
     }
     logger.metrics("user.login");
     const authType = "creds-" + (user.user_type === "admin" ? "admin" : "user");
-    const href = await authorizeUser(user, req, authType); // creds-admin / creds-admin
+    const result = await authorizeUser(user, req, authType); // creds-admin / creds-admin
     return req.method === "GET"
-        ? reply.status(302).redirect(href)
-        : reply.status(200).send(href);
+        ? reply.status(302).redirect(result)
+        : reply.status(200).send(result);
 }

package/dist/server/plugins/crud/funcs/dataUpdate.js

@@ -60,7 +60,7 @@ export default async function dataUpdate({ table, tokenData, referer, id, data,
             ["string", "number"].includes(typeof data[el])) {
             Object.assign(data, { [el]: data[el].split(",") });
         }
-        return [el, data[el]];
+        return [el, data[el] === "" ? null : data[el]]; // ensure '' on number does not throw
     })
         .map((el) => typeof el[1] === "object" && types[el[0]]?.includes?.("json") && el[1]
         ? JSON.stringify(el[1])

package/dist/server/routes/auth/controllers/2factor/qrcode.d.ts

@@ -0,0 +1,4 @@
+import { FastifyReply } from "fastify";
+import { ExtendedRequest } from "../../../../types/core.js";
+export default function qrCode(req: ExtendedRequest, reply: FastifyReply): Promise<never>;
+//# sourceMappingURL=qrcode.d.ts.map

package/dist/server/routes/auth/controllers/2factor/qrcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qrcode.d.ts","sourceRoot":"","sources":["../../../../../../server/routes/auth/controllers/2factor/qrcode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAa5D,wBAA8B,MAAM,CAClC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,YAAY,kBAsDpB"}

package/dist/server/routes/auth/controllers/2factor/qrcode.js

@@ -0,0 +1,48 @@
+import qr from "qrcode";
+import config from "../../../../../config.js";
+import pgClients from "../../../../plugins/pg/pgClients.js";
+import { getSecret, generate } from "./providers/totp.js";
+const headers = {
+    "Content-Type": "image/png",
+};
+export default async function qrCode(req, reply) {
+    const { pg = pgClients.client } = req;
+    const { uid } = req.session?.passport?.user || {};
+    if (!uid) {
+        return reply.status(401).send({ error: "unauthorized", code: 401 });
+    }
+    if (!pg || !pg?.pk?.["admin.users"] || !pg?.pk?.["admin.users_social_auth"]) {
+        return reply.status(400).send({
+            error: "db connection / users/users_social_auth tables are required",
+            code: 400,
+        });
+    }
+    const userExists = await pg
+        .query(`select uid from admin.users where uid=$1`, [uid])
+        .then((el) => el.rows?.[0]?.uid);
+    if (!userExists && config.pg) {
+        return reply.status(404).send({ error: "invalid user", code: 404 });
+    }
+    const { enabled, secret } = pg
+        ? await getSecret({ pg, TYPE: "TOTP", uid })
+        : {};
+    const otp = secret
+        ? await pg
+            .query(`select social_auth_url
+  from admin.users_social_auth where uid=$1 and social_auth_type=$2`, [uid, "TOTP"])
+            ?.then((el) => el.rows?.[0]?.social_auth_url)
+        : await generate({ uid, pg });
+    const base64 = otp ? await qr.toDataURL(otp) : undefined;
+    if (enabled && !config.local && !config.debug) {
+        return reply
+            .status(400)
+            .send({ error: "2factor already enabled", code: 400 });
+    }
+    if (!otp || !base64) {
+        return reply.status(500).send({ error: "generation error", code: 500 });
+    }
+    // substring to exclude data:image/png;base64,
+    return reply
+        .headers(headers)
+        .send(Buffer.from(base64.substring(22), "base64"));
+}

package/dist/server/routes/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAiC1C,iBAAe,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,GAAE,GAAQ,iBA4ExD;AAED,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../server/routes/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAkC1C,iBAAe,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,GAAE,GAAQ,iBA8ExD;AAED,eAAe,MAAM,CAAC"}

package/dist/server/routes/auth/index.js

@@ -18,6 +18,7 @@ import login2faTemplate from "./controllers/page/login2faTemplate.js";
 // jwt
 import oauthAuthorize from "./controllers/jwt/authorize.js";
 import oauthToken from "./controllers/jwt/token.js";
+import qrCode from "./controllers/2factor/qrcode.js";
 const params = { config: { policy: "L0" } };
 async function plugin(app, opt = {}) {
     if (opt.routes === false || config.auth?.customRoutes) {
@@ -70,6 +71,9 @@ async function plugin(app, opt = {}) {
         !config.auth?.customGovId) {
         app.get("/auth/by_data", params, authByData);
     }
+    if (!app.hasRoute({ method: "GET", url: "/2factor/qr" })) {
+        app.get("/2factor/qr", params, qrCode);
+    }
     // pages
     if (!app.hasRoute({ method: "GET", url: "/2factor" }) &&
         !config.auth?.disable &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "2.0.57",
+  "version": "2.0.59",
   "type": "module",
   "description": "core-plugins",
   "keywords": [