@seele00/seele 0.1.63 → 0.1.65

package/server/dist/auth/session.js

@@ -1,71 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-const COOKIE_NAME = "seele_session";
-export function readSessionPayload(request, secret) {
-    const token = parseCookies(request.headers.cookie)[COOKIE_NAME];
-    if (!token) {
-        return null;
-    }
-    const [encodedPayload, signature] = token.split(".");
-    if (!encodedPayload || !signature) {
-        return null;
-    }
-    if (!safeEqual(signature, sign(encodedPayload, secret))) {
-        return null;
-    }
-    try {
-        const payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
-        if (typeof payload.userId !== "string" ||
-            !Number.isInteger(payload.sessionVersion) ||
-            !Number.isFinite(payload.expiresAt) ||
-            payload.expiresAt <= Date.now()) {
-            return null;
-        }
-        return payload;
-    }
-    catch {
-        return null;
-    }
-}
-export function setSessionCookie(response, request, input) {
-    const payload = Buffer.from(JSON.stringify({
-        userId: input.userId,
-        sessionVersion: input.sessionVersion,
-        expiresAt: Date.now() + input.ttlSeconds * 1000,
-    })).toString("base64url");
-    const token = `${payload}.${sign(payload, input.secret)}`;
-    const secure = isSecureRequest(request) ? "; Secure" : "";
-    response.setHeader("Set-Cookie", `${COOKIE_NAME}=${token}; Path=${input.path}; HttpOnly; SameSite=Strict; Max-Age=${input.ttlSeconds}${secure}`);
-}
-export function clearSessionCookie(response, request, path) {
-    const secure = isSecureRequest(request) ? "; Secure" : "";
-    response.setHeader("Set-Cookie", `${COOKIE_NAME}=; Path=${path}; HttpOnly; SameSite=Strict; Max-Age=0${secure}`);
-}
-function sign(value, secret) {
-    return createHmac("sha256", secret).update(value).digest("base64url");
-}
-function safeEqual(left, right) {
-    const leftBuffer = Buffer.from(left);
-    const rightBuffer = Buffer.from(right);
-    return (leftBuffer.length === rightBuffer.length &&
-        timingSafeEqual(leftBuffer, rightBuffer));
-}
-function parseCookies(header) {
-    if (!header) {
-        return {};
-    }
-    return Object.fromEntries(header.split(";").flatMap((part) => {
-        const separator = part.indexOf("=");
-        if (separator < 0) {
-            return [];
-        }
-        const key = part.slice(0, separator).trim();
-        const value = part.slice(separator + 1).trim();
-        return key ? [[key, value]] : [];
-    }));
-}
-function isSecureRequest(request) {
-    const forwardedProto = request.headers["x-forwarded-proto"];
-    const protocol = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
-    return (protocol?.split(",")[0]?.trim() === "https" ||
-        Boolean(request.socket.encrypted));
-}

package/server/dist/auth/users.js

@@ -1,276 +0,0 @@
-import { randomBytes, randomUUID, scrypt, scryptSync, timingSafeEqual, } from "node:crypto";
-import path from "node:path";
-import { mkdirSync } from "node:fs";
-import { openSqliteDatabase, runInTransaction, } from "../storage/sqlite.js";
-export class UserStore {
-    sessionSecret;
-    db;
-    dummyPasswordHash;
-    constructor(databasePath, bootstrap) {
-        mkdirSync(path.dirname(databasePath), { recursive: true });
-        this.db = openSqliteDatabase(databasePath);
-        this.db.exec("pragma journal_mode = WAL");
-        this.initializeSchema();
-        this.sessionSecret = this.ensureSessionSecret();
-        this.dummyPasswordHash = this.ensureDummyPasswordHash();
-        if (this.countUsers() === 0 && bootstrap?.password) {
-            this.createUser({
-                username: bootstrap.username,
-                password: bootstrap.password,
-                role: "admin",
-            });
-        }
-    }
-    get enabled() {
-        return this.countUsers() > 0;
-    }
-    listUsers() {
-        const rows = this.db
-            .prepare("select * from auth_users order by created_at asc")
-            .all();
-        return rows.map(userFromRow);
-    }
-    getUser(id) {
-        const row = this.db
-            .prepare("select * from auth_users where id = ?")
-            .get(id);
-        return row ? userFromRow(row) : null;
-    }
-    getUserByUsername(username) {
-        const row = this.db
-            .prepare("select * from auth_users where username = ? collate nocase")
-            .get(username.trim());
-        return row ? userFromRow(row) : null;
-    }
-    async authenticate(username, password) {
-        const row = this.db
-            .prepare("select * from auth_users where username = ? collate nocase")
-            .get(username.trim());
-        const passwordMatches = await verifyPassword(password, row?.password_hash ?? this.dummyPasswordHash);
-        if (!row || !row.active || !passwordMatches) {
-            return null;
-        }
-        return userFromRow(row);
-    }
-    loginBlockedUntil(keys, now = Date.now()) {
-        let blockedUntil = 0;
-        const statement = this.db.prepare("select locked_until from auth_login_attempts where key = ?");
-        for (const key of keys) {
-            const row = statement.get(key);
-            blockedUntil = Math.max(blockedUntil, row?.locked_until ?? 0);
-        }
-        return blockedUntil > now ? blockedUntil : 0;
-    }
-    recordLoginFailure(buckets, windowMs, lockoutMs, now = Date.now()) {
-        runInTransaction(this.db, () => {
-            const read = this.db.prepare(`
-        select failure_count, window_started_at, locked_until
-        from auth_login_attempts where key = ?
-      `);
-            const write = this.db.prepare(`
-        insert into auth_login_attempts (
-          key, failure_count, window_started_at, locked_until, updated_at
-        ) values (?, ?, ?, ?, ?)
-        on conflict(key) do update set
-          failure_count = excluded.failure_count,
-          window_started_at = excluded.window_started_at,
-          locked_until = excluded.locked_until,
-          updated_at = excluded.updated_at
-      `);
-            for (const bucket of buckets) {
-                const current = read.get(bucket.key);
-                const expired = !current ||
-                    (current.locked_until <= now &&
-                        now - current.window_started_at >= windowMs);
-                const failureCount = expired ? 1 : current.failure_count + 1;
-                const windowStartedAt = expired ? now : current.window_started_at;
-                const lockedUntil = failureCount >= bucket.maxFailures ? now + lockoutMs : 0;
-                write.run(bucket.key, failureCount, windowStartedAt, lockedUntil, now);
-            }
-            this.db
-                .prepare("delete from auth_login_attempts where updated_at < ?")
-                .run(now - Math.max(windowMs, lockoutMs) * 4);
-        });
-    }
-    clearLoginFailures(keys) {
-        const statement = this.db.prepare("delete from auth_login_attempts where key = ?");
-        runInTransaction(this.db, () => {
-            for (const key of keys) {
-                statement.run(key);
-            }
-        });
-    }
-    createUser(input) {
-        const username = normalizeUsername(input.username);
-        validatePassword(input.password);
-        const now = new Date().toISOString();
-        const row = {
-            id: randomUUID(),
-            username,
-            password_hash: hashPassword(input.password),
-            role: input.role,
-            active: 1,
-            session_version: 1,
-            created_at: now,
-            updated_at: now,
-        };
-        this.db.prepare(`
-      insert into auth_users (
-        id, username, password_hash, role, active, session_version, created_at, updated_at
-      ) values (
-        @id, @username, @password_hash, @role, @active, @session_version, @created_at, @updated_at
-      )
-    `).run(row);
-        return userFromRow(row);
-    }
-    updateUser(id, input) {
-        const current = this.db
-            .prepare("select * from auth_users where id = ?")
-            .get(id);
-        if (!current) {
-            return null;
-        }
-        const username = input.username === undefined
-            ? current.username
-            : normalizeUsername(input.username);
-        const passwordChanged = input.password !== undefined && input.password.length > 0;
-        if (passwordChanged) {
-            validatePassword(input.password);
-        }
-        const next = {
-            ...current,
-            username,
-            password_hash: passwordChanged ? hashPassword(input.password) : current.password_hash,
-            role: input.role ?? current.role,
-            active: input.active === undefined ? current.active : input.active ? 1 : 0,
-            session_version: passwordChanged || input.active === false
-                ? current.session_version + 1
-                : current.session_version,
-            updated_at: new Date().toISOString(),
-        };
-        this.db.prepare(`
-      update auth_users set
-        username = @username,
-        password_hash = @password_hash,
-        role = @role,
-        active = @active,
-        session_version = @session_version,
-        updated_at = @updated_at
-      where id = @id
-    `).run(next);
-        return userFromRow(next);
-    }
-    deleteUser(id) {
-        return this.db.prepare("delete from auth_users where id = ?").run(id).changes > 0;
-    }
-    countUsers() {
-        const row = this.db.prepare("select count(*) as count from auth_users").get();
-        return row.count;
-    }
-    initializeSchema() {
-        this.db.exec(`
-      create table if not exists auth_users (
-        id text primary key,
-        username text not null unique collate nocase,
-        password_hash text not null,
-        role text not null check (role in ('admin', 'user')),
-        active integer not null default 1,
-        session_version integer not null default 1,
-        created_at text not null,
-        updated_at text not null
-      );
-      create table if not exists auth_metadata (
-        key text primary key,
-        value text not null
-      );
-      create table if not exists auth_login_attempts (
-        key text primary key,
-        failure_count integer not null,
-        window_started_at integer not null,
-        locked_until integer not null,
-        updated_at integer not null
-      );
-      create index if not exists auth_login_attempts_updated_at
-        on auth_login_attempts(updated_at);
-    `);
-    }
-    ensureSessionSecret() {
-        const existing = this.db
-            .prepare("select value from auth_metadata where key = 'session_secret'")
-            .get();
-        if (existing) {
-            return existing.value;
-        }
-        const value = randomBytes(32).toString("base64url");
-        this.db
-            .prepare("insert into auth_metadata (key, value) values ('session_secret', ?)")
-            .run(value);
-        return value;
-    }
-    ensureDummyPasswordHash() {
-        const existing = this.db
-            .prepare("select value from auth_metadata where key = 'dummy_password_hash'")
-            .get();
-        if (existing) {
-            return existing.value;
-        }
-        const value = hashPassword(randomBytes(32).toString("base64url"));
-        this.db
-            .prepare("insert into auth_metadata (key, value) values ('dummy_password_hash', ?)")
-            .run(value);
-        return value;
-    }
-}
-function userFromRow(row) {
-    return {
-        id: row.id,
-        username: row.username,
-        role: row.role,
-        active: row.active === 1,
-        sessionVersion: row.session_version,
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-    };
-}
-function normalizeUsername(value) {
-    const username = value.trim();
-    if (!/^[A-Za-z0-9_.-]{2,64}$/.test(username)) {
-        throw new Error("invalid_username");
-    }
-    return username;
-}
-function validatePassword(value) {
-    if (value.length < 8 || value.length > 512) {
-        throw new Error("invalid_password");
-    }
-}
-function hashPassword(password) {
-    const salt = randomBytes(16);
-    const digest = scryptSync(password, salt, 64);
-    return `scrypt:${salt.toString("base64url")}:${digest.toString("base64url")}`;
-}
-async function verifyPassword(password, stored) {
-    const [algorithm, encodedSalt, encodedDigest] = stored.split(":");
-    if (algorithm !== "scrypt" || !encodedSalt || !encodedDigest) {
-        return false;
-    }
-    try {
-        const expected = Buffer.from(encodedDigest, "base64url");
-        const actual = await derivePassword(password, Buffer.from(encodedSalt, "base64url"), expected.length);
-        return expected.length === actual.length && timingSafeEqual(expected, actual);
-    }
-    catch {
-        return false;
-    }
-}
-function derivePassword(password, salt, length) {
-    return new Promise((resolve, reject) => {
-        scrypt(password, salt, length, (error, derivedKey) => {
-            if (error) {
-                reject(error);
-                return;
-            }
-            resolve(derivedKey);
-        });
-    });
-}