@pixelbyte-software/pixcode 1.54.10 → 1.55.0

package/server/middleware/auth.js

@@ -1,277 +1,277 @@
-import jwt from 'jsonwebtoken';
-
-import { userDb, appConfigDb, apiKeysDb } from '../database/db.js';
-import { IS_PLATFORM } from '../constants/config.js';
-import { securityLog, getClientIp } from '../utils/security-log.js';
-
-// Use env var if set, otherwise auto-generate a unique secret per installation
-const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
-const JWT_ALGORITHM = 'HS256';
-const JWT_EXPIRY = process.env.JWT_EXPIRY || '24h';
-const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
-const ADMIN_ROLES = new Set(['owner', 'admin']);
-const PLATFORM_AUTH_BYPASS_ENABLED = IS_PLATFORM && process.env.PIXCODE_ALLOW_PLATFORM_AUTH_BYPASS === '1';
-
-// Optional API key middleware
-const validateApiKey = (req, res, next) => {
-  // Skip API key validation if not configured
-  if (!process.env.API_KEY) {
-    return next();
-  }
-  
-  const apiKey = req.headers['x-api-key'];
-  if (apiKey !== process.env.API_KEY) {
-    securityLog('api_key_validation_failed', {
-      ip: getClientIp(req),
-      endpoint: req.path,
-      method: req.method,
-    });
-    return res.status(401).json({ error: 'Invalid API key' });
-  }
-  next();
-};
-
-// JWT authentication middleware
-const authenticateToken = async (req, res, next) => {
-  // Platform mode:  use single database user
-  if (PLATFORM_AUTH_BYPASS_ENABLED) {
-    try {
-      const user = userDb.getFirstUser();
-      if (!user) {
-        return res.status(500).json({ error: 'Platform mode: No user found in database' });
-      }
-      req.user = user;
-      return next();
-    } catch (error) {
-      console.error('Platform mode error:', error);
-      return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
-    }
-  }
-
-  // Pull credentials from any of the supported transports.
-  //  - Authorization: Bearer <jwt-or-apikey>
-  //  - X-API-Key: <apikey>            (legacy, kept for /api/agent compatibility)
-  //  - ?token=<jwt>                    (EventSource workaround — can't set headers)
-  //  - ?apiKey=<apikey>                (EventSource workaround)
-  // Auth-token mode is decided by the prefix: new keys generated by Pixcode
-  // start with `px_`; older `ck_` keys remain valid for existing installs.
-  // SECURITY NOTE: Query-param credentials may appear in server logs, proxy
-  // logs, and browser history. Prefer Authorization headers for new clients.
-  const authHeader = req.headers['authorization'];
-  const bearerToken = authHeader && authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : null;
-  const apiKeyHeader = req.headers['x-api-key'];
-  const queryToken = typeof req.query.token === 'string' ? req.query.token : null;
-  const queryApiKey = typeof req.query.apiKey === 'string' ? req.query.apiKey : null;
-
-  if (queryToken || queryApiKey) {
-    securityLog('query_param_credential_used', {
-      ip: getClientIp(req),
-      endpoint: req.path,
-      method: req.method,
-      userAgent: req.headers['user-agent'],
-    });
-  }
-
-  // Try API-key paths first when the credential is unambiguously an API key.
-  const explicitApiKey = apiKeyHeader || queryApiKey
-    || (isPixcodeApiKey(bearerToken) ? bearerToken : null)
-    || (isPixcodeApiKey(queryToken) ? queryToken : null);
-
-  if (explicitApiKey) {
-    try {
-      const user = apiKeysDb.validateApiKey(explicitApiKey);
-      if (!user) {
-        securityLog('api_key_auth_failed', {
-          ip: getClientIp(req),
-          endpoint: req.path,
-          method: req.method,
-          userId: user?.id,
-        });
-        return res.status(401).json({ error: 'Invalid or inactive API key' });
-      }
-      securityLog('api_key_auth_success', {
-        ip: getClientIp(req),
-        endpoint: req.path,
-        method: req.method,
-        userId: user.id,
-        username: user.username,
-      });
-      req.user = user;
-      return next();
-    } catch (error) {
-      console.error('API key validation error:', error);
-      return res.status(500).json({ error: 'Authentication backend error' });
-    }
-  }
-
-  // Otherwise fall back to JWT.
-  const jwtToken = bearerToken || queryToken;
-  if (!jwtToken) {
-    securityLog('auth_no_token', {
-      ip: getClientIp(req),
-      endpoint: req.path,
-      method: req.method,
-    });
-    return res.status(401).json({ error: 'Access denied. No token provided.' });
-  }
-
-  try {
-    const decoded = jwt.verify(jwtToken, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
-
-    // Verify user still exists and is active
-    const user = userDb.getUserById(decoded.userId);
-    if (!user) {
-      securityLog('jwt_user_not_found', {
-        ip: getClientIp(req),
-        endpoint: req.path,
-        method: req.method,
-        userId: decoded.userId,
-      });
-      return res.status(401).json({ error: 'Invalid token. User not found.' });
-    }
-
-    // Auto-refresh: if token is past halfway through its lifetime, issue a new one
-    if (decoded.exp && decoded.iat) {
-      const now = Math.floor(Date.now() / 1000);
-      const halfLife = (decoded.exp - decoded.iat) / 2;
-      if (now > decoded.iat + halfLife) {
-        const newToken = generateToken(user);
-        res.setHeader('X-Refreshed-Token', newToken);
-      }
-    }
-
-    req.user = user;
-    next();
-  } catch (error) {
-    securityLog('jwt_verification_failed', {
-      ip: getClientIp(req),
-      endpoint: req.path,
-      method: req.method,
-      reason: error.name || 'unknown',
-    });
-    return res.status(403).json({ error: 'Invalid token' });
-  }
-};
-
-const requireAdmin = (req, res, next) => {
-  if (!req.user) {
-    return res.status(401).json({ error: 'Access denied. No authenticated user.' });
-  }
-
-  if (!ADMIN_ROLES.has(req.user.role)) {
-    securityLog('admin_access_denied', {
-      ip: getClientIp(req),
-      endpoint: req.path,
-      method: req.method,
-      userId: req.user.id,
-      username: req.user.username,
-    });
-    return res.status(403).json({ error: 'Admin access required.' });
-  }
-
-  if (
-    req.user.api_key_id &&
-    !req.user.api_key_scopes?.includes('admin') &&
-    !req.user.api_key_scopes?.includes('system') &&
-    !req.user.api_key_scopes?.includes('*')
-  ) {
-    securityLog('admin_scope_denied', {
-      ip: getClientIp(req),
-      endpoint: req.path,
-      method: req.method,
-      userId: req.user.id,
-    });
-    return res.status(403).json({ error: 'API key lacks admin scope.' });
-  }
-
-  next();
-};
-
-const requireApiScope = (scope) => (req, res, next) => {
-  if (!req.user?.api_key_id) {
-    return next();
-  }
-
-  const scopes = Array.isArray(req.user.api_key_scopes) ? req.user.api_key_scopes : [];
-  if (scopes.includes('*') || scopes.includes(scope)) {
-    return next();
-  }
-
-  securityLog('api_scope_denied', {
-    ip: getClientIp(req),
-    endpoint: req.path,
-    method: req.method,
-    userId: req.user.id,
-    reason: `Missing scope: ${scope}`,
-  });
-  return res.status(403).json({ error: `API key lacks required scope: ${scope}` });
-};
-
-// Generate JWT token
-const generateToken = (user) => {
-  return jwt.sign(
-    {
-      userId: user.id,
-      username: user.username,
-      role: user.role || null,
-    },
-    JWT_SECRET,
-    { expiresIn: JWT_EXPIRY, algorithm: JWT_ALGORITHM }
-  );
-};
-
-// WebSocket authentication function
-const authenticateWebSocket = (token) => {
-  // Platform mode: bypass token validation, return first user
-  if (PLATFORM_AUTH_BYPASS_ENABLED) {
-    try {
-      const user = userDb.getFirstUser();
-      if (user) {
-        return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
-      }
-      return null;
-    } catch (error) {
-      console.error('Platform mode WebSocket error:', error);
-      return null;
-    }
-  }
-
-  // Normal OSS validation — accept either an API key (`px_…` or legacy
-  // `ck_…`) or a JWT.
-  if (!token) {
-    return null;
-  }
-
-  if (isPixcodeApiKey(token)) {
-    try {
-      const user = apiKeysDb.validateApiKey(token);
-      if (!user) return null;
-      return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
-    } catch (error) {
-      console.error('WebSocket API key validation error:', error);
-      return null;
-    }
-  }
-
-  try {
-    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
-    const user = userDb.getUserById(decoded.userId);
-    if (!user) {
-      return null;
-    }
-    return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
-  } catch (error) {
-    console.error('WebSocket token verification error:', error);
-    return null;
-  }
-};
-
-export {
-  validateApiKey,
-  authenticateToken,
-  requireAdmin,
-  requireApiScope,
-  generateToken,
-  authenticateWebSocket,
-  JWT_SECRET
-};
+import jwt from 'jsonwebtoken';
+
+import { userDb, appConfigDb, apiKeysDb } from '../database/db.js';
+import { IS_PLATFORM } from '../constants/config.js';
+import { securityLog, getClientIp } from '../utils/security-log.js';
+
+// Use env var if set, otherwise auto-generate a unique secret per installation
+const JWT_SECRET = process.env.JWT_SECRET || appConfigDb.getOrCreateJwtSecret();
+const JWT_ALGORITHM = 'HS256';
+const JWT_EXPIRY = process.env.JWT_EXPIRY || '24h';
+const isPixcodeApiKey = (token) => typeof token === 'string' && (token.startsWith('px_') || token.startsWith('ck_'));
+const ADMIN_ROLES = new Set(['owner', 'admin']);
+const PLATFORM_AUTH_BYPASS_ENABLED = IS_PLATFORM && process.env.PIXCODE_ALLOW_PLATFORM_AUTH_BYPASS === '1';
+
+// Optional API key middleware
+const validateApiKey = (req, res, next) => {
+  // Skip API key validation if not configured
+  if (!process.env.API_KEY) {
+    return next();
+  }
+  
+  const apiKey = req.headers['x-api-key'];
+  if (apiKey !== process.env.API_KEY) {
+    securityLog('api_key_validation_failed', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+    });
+    return res.status(401).json({ error: 'Invalid API key' });
+  }
+  next();
+};
+
+// JWT authentication middleware
+const authenticateToken = async (req, res, next) => {
+  // Platform mode:  use single database user
+  if (PLATFORM_AUTH_BYPASS_ENABLED) {
+    try {
+      const user = userDb.getFirstUser();
+      if (!user) {
+        return res.status(500).json({ error: 'Platform mode: No user found in database' });
+      }
+      req.user = user;
+      return next();
+    } catch (error) {
+      console.error('Platform mode error:', error);
+      return res.status(500).json({ error: 'Platform mode: Failed to fetch user' });
+    }
+  }
+
+  // Pull credentials from any of the supported transports.
+  //  - Authorization: Bearer <jwt-or-apikey>
+  //  - X-API-Key: <apikey>            (legacy, kept for /api/agent compatibility)
+  //  - ?token=<jwt>                    (EventSource workaround — can't set headers)
+  //  - ?apiKey=<apikey>                (EventSource workaround)
+  // Auth-token mode is decided by the prefix: new keys generated by Pixcode
+  // start with `px_`; older `ck_` keys remain valid for existing installs.
+  // SECURITY NOTE: Query-param credentials may appear in server logs, proxy
+  // logs, and browser history. Prefer Authorization headers for new clients.
+  const authHeader = req.headers['authorization'];
+  const bearerToken = authHeader && authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : null;
+  const apiKeyHeader = req.headers['x-api-key'];
+  const queryToken = typeof req.query.token === 'string' ? req.query.token : null;
+  const queryApiKey = typeof req.query.apiKey === 'string' ? req.query.apiKey : null;
+
+  if (queryToken || queryApiKey) {
+    securityLog('query_param_credential_used', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userAgent: req.headers['user-agent'],
+    });
+  }
+
+  // Try API-key paths first when the credential is unambiguously an API key.
+  const explicitApiKey = apiKeyHeader || queryApiKey
+    || (isPixcodeApiKey(bearerToken) ? bearerToken : null)
+    || (isPixcodeApiKey(queryToken) ? queryToken : null);
+
+  if (explicitApiKey) {
+    try {
+      const user = apiKeysDb.validateApiKey(explicitApiKey);
+      if (!user) {
+        securityLog('api_key_auth_failed', {
+          ip: getClientIp(req),
+          endpoint: req.path,
+          method: req.method,
+          userId: user?.id,
+        });
+        return res.status(401).json({ error: 'Invalid or inactive API key' });
+      }
+      securityLog('api_key_auth_success', {
+        ip: getClientIp(req),
+        endpoint: req.path,
+        method: req.method,
+        userId: user.id,
+        username: user.username,
+      });
+      req.user = user;
+      return next();
+    } catch (error) {
+      console.error('API key validation error:', error);
+      return res.status(500).json({ error: 'Authentication backend error' });
+    }
+  }
+
+  // Otherwise fall back to JWT.
+  const jwtToken = bearerToken || queryToken;
+  if (!jwtToken) {
+    securityLog('auth_no_token', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+    });
+    return res.status(401).json({ error: 'Access denied. No token provided.' });
+  }
+
+  try {
+    const decoded = jwt.verify(jwtToken, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
+
+    // Verify user still exists and is active
+    const user = userDb.getUserById(decoded.userId);
+    if (!user) {
+      securityLog('jwt_user_not_found', {
+        ip: getClientIp(req),
+        endpoint: req.path,
+        method: req.method,
+        userId: decoded.userId,
+      });
+      return res.status(401).json({ error: 'Invalid token. User not found.' });
+    }
+
+    // Auto-refresh: if token is past halfway through its lifetime, issue a new one
+    if (decoded.exp && decoded.iat) {
+      const now = Math.floor(Date.now() / 1000);
+      const halfLife = (decoded.exp - decoded.iat) / 2;
+      if (now > decoded.iat + halfLife) {
+        const newToken = generateToken(user);
+        res.setHeader('X-Refreshed-Token', newToken);
+      }
+    }
+
+    req.user = user;
+    next();
+  } catch (error) {
+    securityLog('jwt_verification_failed', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      reason: error.name || 'unknown',
+    });
+    return res.status(403).json({ error: 'Invalid token' });
+  }
+};
+
+const requireAdmin = (req, res, next) => {
+  if (!req.user) {
+    return res.status(401).json({ error: 'Access denied. No authenticated user.' });
+  }
+
+  if (!ADMIN_ROLES.has(req.user.role)) {
+    securityLog('admin_access_denied', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userId: req.user.id,
+      username: req.user.username,
+    });
+    return res.status(403).json({ error: 'Admin access required.' });
+  }
+
+  if (
+    req.user.api_key_id &&
+    !req.user.api_key_scopes?.includes('admin') &&
+    !req.user.api_key_scopes?.includes('system') &&
+    !req.user.api_key_scopes?.includes('*')
+  ) {
+    securityLog('admin_scope_denied', {
+      ip: getClientIp(req),
+      endpoint: req.path,
+      method: req.method,
+      userId: req.user.id,
+    });
+    return res.status(403).json({ error: 'API key lacks admin scope.' });
+  }
+
+  next();
+};
+
+const requireApiScope = (scope) => (req, res, next) => {
+  if (!req.user?.api_key_id) {
+    return next();
+  }
+
+  const scopes = Array.isArray(req.user.api_key_scopes) ? req.user.api_key_scopes : [];
+  if (scopes.includes('*') || scopes.includes(scope)) {
+    return next();
+  }
+
+  securityLog('api_scope_denied', {
+    ip: getClientIp(req),
+    endpoint: req.path,
+    method: req.method,
+    userId: req.user.id,
+    reason: `Missing scope: ${scope}`,
+  });
+  return res.status(403).json({ error: `API key lacks required scope: ${scope}` });
+};
+
+// Generate JWT token
+const generateToken = (user) => {
+  return jwt.sign(
+    {
+      userId: user.id,
+      username: user.username,
+      role: user.role || null,
+    },
+    JWT_SECRET,
+    { expiresIn: JWT_EXPIRY, algorithm: JWT_ALGORITHM }
+  );
+};
+
+// WebSocket authentication function
+const authenticateWebSocket = (token) => {
+  // Platform mode: bypass token validation, return first user
+  if (PLATFORM_AUTH_BYPASS_ENABLED) {
+    try {
+      const user = userDb.getFirstUser();
+      if (user) {
+        return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
+      }
+      return null;
+    } catch (error) {
+      console.error('Platform mode WebSocket error:', error);
+      return null;
+    }
+  }
+
+  // Normal OSS validation — accept either an API key (`px_…` or legacy
+  // `ck_…`) or a JWT.
+  if (!token) {
+    return null;
+  }
+
+  if (isPixcodeApiKey(token)) {
+    try {
+      const user = apiKeysDb.validateApiKey(token);
+      if (!user) return null;
+      return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
+    } catch (error) {
+      console.error('WebSocket API key validation error:', error);
+      return null;
+    }
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: [JWT_ALGORITHM] });
+    const user = userDb.getUserById(decoded.userId);
+    if (!user) {
+      return null;
+    }
+    return { id: user.id, userId: user.id, username: user.username, role: user.role || null };
+  } catch (error) {
+    console.error('WebSocket token verification error:', error);
+    return null;
+  }
+};
+
+export {
+  validateApiKey,
+  authenticateToken,
+  requireAdmin,
+  requireApiScope,
+  generateToken,
+  authenticateWebSocket,
+  JWT_SECRET
+};