@seriousme/opifex 1.11.3 → 2.1.0

package/server/handlers/handleConnect.ts

@@ -1,119 +1,234 @@
-import type { Context } from "../context.ts";
-import { AuthenticationResult, logger, PacketType, Timer } from "../deps.ts";
+import type {
+  AuthenticatedResult,
+  ConnectOptions,
+  Context,
+} from "../context.ts";
+import {
+  invalidmaxTopicLevels,
+  invalidTopic,
+  logger,
+  PacketType,
+  ReasonCode,
+} from "../deps.ts";
+import type { ConnectPacket, ExtPublishPacket } from "../deps.ts";
+import { completeConnect } from "./completeConnect.ts";
 
-import type { ConnectPacket, TAuthenticationResult } from "../deps.ts";
+/**
+ * Extracts options from MQTT v5 packet properties.
+ */
+function extractConnectOptions(packet: ConnectPacket): ConnectOptions {
+  if (packet.protocolLevel !== 5) {
+    return {};
+  }
+
+  return {
+    sessionExpiryInterval: packet.properties?.sessionExpiryInterval,
+    willDelayInterval: packet.will?.properties?.willDelayInterval,
+    topicAliasMaximum: packet.properties?.topicAliasMaximum,
+    maximumOutgoingPacketSize: packet.properties?.maximumPacketSize,
+    receiveMaximum: packet.properties?.receiveMaximum,
+  };
+}
 
 /**
- * Checks if the client is authenticated based on the provided credentials
- * @param ctx - The connection context
- * @param packet - The MQTT CONNECT packet
- * @returns Authentication result indicating if the client is authenticated
+ * Checks if client credentials are valid.
  */
-function isAuthenticated(
+async function authenticateClient(
   ctx: Context,
+  clientId: string,
   packet: ConnectPacket,
-): TAuthenticationResult {
+): Promise<AuthenticatedResult> {
+  const isProtocolV5 = packet.protocolLevel === 5;
+  const authMethod = isProtocolV5
+    ? packet.properties?.authenticationMethod
+    : undefined;
+
   if (ctx.handlers.isAuthenticated) {
-    return ctx.handlers.isAuthenticated(
-      ctx,
-      packet.clientId || "",
-      packet.username || "",
-      packet.password || new Uint8Array(0),
-    );
+    try {
+      const result = await ctx.handlers.isAuthenticated(
+        ctx,
+        clientId,
+        packet.username || "",
+        packet.password || new Uint8Array(0),
+        packet,
+      );
+      if (
+        isProtocolV5 && result.reasonCode === ReasonCode.success &&
+        authMethod !== undefined && ctx.handlers.processAuth
+      ) {
+        const authData = packet.properties?.authenticationData;
+        return await ctx.handlers.processAuth(
+          ctx,
+          clientId,
+          authMethod,
+          authData!,
+        );
+      }
+      return result;
+    } catch (err) {
+      let message = "unknown error";
+      if (err instanceof Error) {
+        message = err.message;
+      }
+      logger.error("Authentication failed with error", message);
+      return {
+        reasonCode: ReasonCode.unspecifiedError,
+        reasonString: "Authentication failed",
+      };
+    }
   }
-  return AuthenticationResult.ok;
+  return { reasonCode: ReasonCode.success };
 }
 
 /**
- * Validates the CONNECT packet
- * @param ctx - The connection context
- * @param packet - The MQTT CONNECT packet to validate
- * @returns Authentication result indicating if the CONNECT packet is valid
+ * Validates the CONNECT packet structure and Will configuration.
  */
-function validateConnect(
+async function validateConnectPacket(
   ctx: Context,
   packet: ConnectPacket,
-): TAuthenticationResult {
-  if (packet.protocolLevel !== 4) {
-    return AuthenticationResult.unacceptableProtocol;
+  sessionExpiryInterval: number,
+): Promise<AuthenticatedResult | null> {
+  const cfg = ctx.config.context;
+
+  // Protocol version check
+  if (!cfg.protocols.includes(packet.protocolLevel)) {
+    return {
+      reasonCode: ReasonCode.unsupportedProtocolVersion,
+      reasonString: `Protocol version ${packet.protocolLevel} is not supported`,
+    };
   }
 
-  return isAuthenticated(ctx, packet);
-}
+  // Will message validation
+  if (packet.will) {
+    const isProtocolV5 = packet.protocolLevel === 5;
+    const will = packet.will as ExtPublishPacket;
 
-/**
- * Processes the validated CONNECT packet
- * @param packet - The MQTT CONNECT packet
- * @param ctx - The connection context
- * @param clientId - The client ID
- */
-function processValidatedConnect(
-  returnCode: TAuthenticationResult,
-  packet: ConnectPacket,
-  ctx: Context,
-  clientId: string,
-): boolean {
-  if (returnCode === AuthenticationResult.ok) {
-    if (packet.will) {
-      ctx.will = {
-        type: PacketType.publish,
-        protocolLevel: ctx.protocolLevel,
-        qos: packet.will.qos,
-        retain: packet.will.retain,
-        topic: packet.will.topic,
-        payload: packet.will.payload,
+    if (
+      will.topic === "" || invalidTopic(will.topic) ||
+      invalidmaxTopicLevels(will.topic, cfg.maxTopicLevels)
+    ) {
+      return {
+        reasonCode: ReasonCode.topicNameInvalid,
+        reasonString: "Invalid will topic",
+      };
+    }
+
+    if (!cfg.retainAvailable && will.retain) {
+      return {
+        reasonCode: ReasonCode.retainNotSupported,
+        reasonString: "Publish will with retain=true is not supported",
       };
     }
 
-    ctx.connect(clientId, packet.clean || false);
-    ctx.protocolLevel = packet.protocolLevel;
-    if (ctx.mqttConn) {
-      logger.debug(`Setting protocolLevel to ${ctx.protocolLevel}`);
-      ctx.mqttConn.codecOpts.protocolLevel = ctx.protocolLevel;
+    const checkAuthz = ctx.handlers.isAuthorizedToPublish;
+    if (checkAuthz && !await checkAuthz(ctx, will.topic)) {
+      return {
+        reasonCode: ReasonCode.notAuthorized,
+        reasonString: `Client not authorized to publish will to ${will.topic}`,
+      };
     }
 
-    const keepAlive = packet.keepAlive || 0;
-    if (keepAlive > 0) {
-      logger.debug(`Setting keepalive to ${keepAlive * 1500} ms`);
-      ctx.timer = new Timer(() => {
-        ctx.close();
-      }, Math.floor(keepAlive * 1500));
+    const qos = will.qos || 0;
+    if (qos > cfg.maximumQos) {
+      return {
+        reasonCode: ReasonCode.qosNotSupported,
+        reasonString: `Server does not support publish will with QoS ${qos}`,
+      };
     }
-    // is this a new session?
-    // either because its the first time for the client
-    // or it specifically asked for a clean one
-    const previousSession = ctx.store?.existingSession;
-    // client now has a history
-    if (!previousSession && ctx.store) {
-      ctx.store.existingSession = true;
+
+    if (isProtocolV5) {
+      const requestedInterval = packet.will.properties?.willDelayInterval || 0;
+      if (requestedInterval > sessionExpiryInterval) {
+        return {
+          reasonCode: ReasonCode.payloadFormatInvalid,
+          reasonString:
+            "Will delay interval larger than allowed session expiry interval",
+        };
+      }
+      const expiryInterval = packet.will.properties?.messageExpiryInterval;
+      if (expiryInterval) {
+        will.expiresAtMs = Date.now() + expiryInterval * 1000;
+      }
+
+      const authMethod = packet.properties?.authenticationMethod;
+      const authData = packet.properties?.authenticationData;
+
+      if (
+        // both need to be either present or absent, one is not enough
+        (authMethod !== undefined) !== (authData !== undefined) ||
+        // authMethod without a handler won't work
+        (authMethod !== undefined || !ctx.handlers.processAuth)
+      ) {
+        return {
+          reasonCode: ReasonCode.badAuthenticationMethod,
+          reasonString:
+            "Bad authentication method or missing authentication data",
+        };
+      }
     }
-    return previousSession || false;
   }
-  return false;
+
+  return null;
 }
 
 /**
- * Handles the MQTT CONNECT packet
- * @param ctx - The connection context
- * @param packet - The MQTT CONNECT packet to handle
+ * Handles the MQTT CONNECT packet.
  */
-export function handleConnect(ctx: Context, packet: ConnectPacket): void {
-  const clientId = packet.clientId || `Opifex-${crypto.randomUUID()}`;
-  const returnCode = validateConnect(ctx, packet);
-  const sessionPresent = processValidatedConnect(
-    returnCode,
-    packet,
+export async function handleConnect(
+  ctx: Context,
+  packet: ConnectPacket,
+): Promise<void> {
+  const isProtocolV5 = packet.protocolLevel === 5;
+  const cfg = ctx.config.context;
+
+  // Assign Client ID if missing
+  let clientId = packet.clientId;
+  let assignedClientIdentifier = undefined;
+  if (!clientId) {
+    clientId = `Opifex-${crypto.randomUUID()}`;
+    assignedClientIdentifier = clientId;
+  }
+
+  // Extract connect options for v5
+  const connectOpts = extractConnectOptions(packet);
+  // Limit session Expiry Interval to server maximum
+  connectOpts.sessionExpiryInterval = Math.min(
+    connectOpts.sessionExpiryInterval || 0,
+    cfg.maxSessionExpiryInterval,
+  );
+  connectOpts.keepAlive = packet.keepAlive;
+  connectOpts.assignedClientIdentifier = assignedClientIdentifier;
+
+  // Validate Packet & Authenticate Client
+  const validationError = await validateConnectPacket(
     ctx,
-    clientId,
+    packet,
+    connectOpts.sessionExpiryInterval,
   );
-  ctx.send({
-    type: PacketType.connack,
-    protocolLevel: ctx.protocolLevel,
-    sessionPresent,
-    returnCode,
-  });
-  logger.debug("connect returnCode", returnCode);
-  if (returnCode !== AuthenticationResult.ok) {
-    ctx.close();
+  const authResult = validationError ??
+    await authenticateClient(ctx, clientId, packet);
+  const { reasonCode, reasonString, authData } = authResult;
+  const requireAuth = reasonCode === ReasonCode.continueAuthentication;
+
+  ctx.prepareConnect(packet, clientId, connectOpts);
+  if (isProtocolV5 && requireAuth) {
+    const authMethod = packet.properties?.authenticationMethod;
+    await ctx.send({
+      type: PacketType.auth,
+      protocolLevel: 5,
+      reasonCode,
+      properties: {
+        authenticationMethod: authMethod,
+        authenticationData: authData,
+      },
+    });
+    return;
   }
+
+  await completeConnect(
+    ctx,
+    packet.protocolLevel || 4,
+    reasonCode,
+    reasonString,
+  );
 }

package/server/handlers/handleConnect.version.test.ts

@@ -0,0 +1,108 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { AnyPacket, ProtocolLevel } from "../deps.ts";
+import { AuthenticationResult, MQTTLevel, PacketType } from "../deps.ts";
+import { startMockServer } from "../../dev_utils/mod.ts";
+
+const txtEncoder = new TextEncoder();
+
+const baseConnectPacket: AnyPacket = {
+  type: PacketType.connect,
+  protocolName: "MQTT",
+  protocolLevel: MQTTLevel.v4 as ProtocolLevel,
+  clientId: "testClient",
+  clean: true,
+  keepAlive: 0,
+  username: "IoTester_1",
+  password: txtEncoder.encode("strong_password"),
+  will: undefined,
+};
+
+const disconnectPacket: AnyPacket = {
+  type: PacketType.disconnect,
+  protocolLevel: MQTTLevel.v4,
+};
+
+test("rejects MQTT 3.1 (protocolLevel 3) with unacceptableProtocol", async () => {
+  const { mqttConn } = startMockServer();
+  const packet = structuredClone(baseConnectPacket);
+  packet.protocolLevel = MQTTLevel.v3;
+  mqttConn.send(packet);
+  const { value: connack } = await mqttConn.next();
+  assert.deepStrictEqual(
+    connack.type,
+    PacketType.connack,
+    "Expect Connack packet",
+  );
+  if (connack.type === PacketType.connack) {
+    assert.deepStrictEqual(
+      connack.returnCode,
+      AuthenticationResult.unacceptableProtocol,
+      "Expected unacceptableProtocol for MQTT 3.1",
+    );
+  }
+  await mqttConn.next();
+  assert.deepStrictEqual(
+    mqttConn.isClosed,
+    true,
+    "Expected connection to be closed after protocol rejection",
+  );
+});
+
+test("accepts MQTT 3.1.1 (protocolLevel 4) connection", async () => {
+  const { mqttConn } = startMockServer();
+  const packet = structuredClone(baseConnectPacket);
+  packet.protocolLevel = MQTTLevel.v4;
+  mqttConn.send(packet);
+  const { value: connack } = await mqttConn.next();
+  assert.deepStrictEqual(
+    connack.type,
+    PacketType.connack,
+    "Expect Connack packet",
+  );
+  if (connack.type === PacketType.connack) {
+    assert.deepStrictEqual(
+      connack.returnCode,
+      AuthenticationResult.ok,
+      "Expected OK for MQTT 3.1.1",
+    );
+  }
+  mqttConn.send(disconnectPacket);
+  await mqttConn.next();
+  assert.deepStrictEqual(
+    mqttConn.isClosed,
+    true,
+    "Expected connection to be closed cleanly",
+  );
+});
+
+test("accepts MQTT 5.0 (protocolLevel 5) connection", async () => {
+  const { mqttConn } = startMockServer();
+  const packet = structuredClone(baseConnectPacket);
+  packet.protocolLevel = MQTTLevel.v5;
+  mqttConn.codecOpts.protocolLevel = MQTTLevel.v5;
+  mqttConn.send(packet);
+  const { value: connack } = await mqttConn.next();
+  assert.deepStrictEqual(
+    connack.type,
+    PacketType.connack,
+    "Expect Connack packet",
+  );
+  if (connack.type === PacketType.connack) {
+    assert.deepStrictEqual(
+      connack.reasonCode,
+      AuthenticationResult.ok,
+      "Expected Ok for MQTT 5.0",
+    );
+  }
+
+  const disconnectV5 = structuredClone(disconnectPacket);
+  disconnectV5.protocolLevel = 5;
+  mqttConn.send(disconnectV5);
+  await mqttConn.next();
+  assert.deepStrictEqual(
+    mqttConn.isClosed,
+    true,
+    "Expected connection to be closed cleanly",
+  );
+});

package/server/handlers/handleDisconnect.test.ts

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { AnyPacket } from "../deps.ts";
+import { PacketType } from "../deps.ts";
+import {
+  addMockClient,
+  checkNoPacket,
+  connect,
+  disconnect,
+  startMockServer,
+  subscribe,
+} from "../../dev_utils/mod.ts";
+
+const txtEncoder = new TextEncoder();
+
+test("DISCONNECT closes connection cleanly", async () => {
+  const { mqttConn } = startMockServer();
+
+  // Connect first
+  await connect(mqttConn);
+  // Send DISCONNECT
+  await disconnect(mqttConn);
+});
+
+test("DISCONNECT clears will message", async () => {
+  const connectWithWill: AnyPacket = {
+    type: PacketType.connect,
+    protocolName: "MQTT",
+    protocolLevel: 4,
+    clientId: "testClientWithWill",
+    clean: true,
+    keepAlive: 0,
+    username: "IoTester_1",
+    password: txtEncoder.encode("strong_password"),
+    will: {
+      topic: "will/topic",
+      payload: txtEncoder.encode("goodbye"),
+      qos: 0,
+      retain: false,
+    },
+  };
+
+  const { mqttConn: mqttConn1, mqttServer } = startMockServer();
+  // Connect subscriber to catch any will message
+  await connect(mqttConn1);
+  await subscribe(mqttConn1, [{ topicFilter: "will/topic", qos: 0 }]);
+
+  // Connect with will message
+  const mqttConn2 = addMockClient(mqttServer);
+  mqttConn2.send(connectWithWill);
+  const { value: connack2 } = await mqttConn2.next();
+  assert.deepStrictEqual(connack2.type, PacketType.connack, "Expected CONNACK");
+  await disconnect(mqttConn2);
+  // Clean disconnect should clear will (will should not be published)
+  await checkNoPacket(mqttConn1);
+});

package/server/handlers/handleDisconnect.ts

@@ -5,7 +5,7 @@ import type { Context } from "../context.ts";
  * @param {Context} ctx - The connection context object
  * @returns {void}
  */
-export function handleDisconnect(ctx: Context): void {
-  ctx.will = undefined;
-  ctx.close();
+export async function handleDisconnect(ctx: Context): Promise<void> {
+  // close the context without sending the will
+  await ctx.close(false);
 }

package/server/handlers/handlePacket.test.ts

@@ -0,0 +1,24 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { AnyPacket } from "../deps.ts";
+import { MQTTLevel, PacketType } from "../deps.ts";
+import { startMockServer } from "../../dev_utils/mod.ts";
+
+test("rejects packets before CONNECT", async () => {
+  const { mqttConn } = startMockServer();
+
+  // Try to send PINGREQ before CONNECT
+  const pingreqPacket: AnyPacket = {
+    type: PacketType.pingreq,
+    protocolLevel: MQTTLevel.v4,
+  };
+  mqttConn.send(pingreqPacket);
+  await mqttConn.next();
+
+  // Connection should be closed due to protocol violation
+  assert.deepStrictEqual(
+    mqttConn.isClosed,
+    true,
+    "Connection should be closed for packets before CONNECT",
+  );
+});

package/server/handlers/handlePacket.ts

@@ -1,7 +1,9 @@
+import { SessionState } from "../context.ts";
 import type { Context } from "../context.ts";
 import { PacketNameByType, PacketType } from "../deps.ts";
 import type {
   AnyPacket,
+  AuthPacket,
   PubackPacket,
   PubcompPacket,
   PublishPacket,
@@ -20,6 +22,7 @@ import { handlePubcomp } from "./handlePubcomp.ts";
 import { handleSubscribe } from "./handleSubscribe.ts";
 import { handleUnsubscribe } from "./handleUnsubscribe.ts";
 import { handleDisconnect } from "./handleDisconnect.ts";
+import { handleAuth } from "./handleAuth.ts";
 import { logger } from "../deps.ts";
 
 /**
@@ -33,16 +36,32 @@ export async function handlePacket(
   ctx: Context,
   packet: AnyPacket,
 ): Promise<void> {
-  logger.debug("handling", PacketNameByType[packet.type]);
-  logger.debug(JSON.stringify(packet, null, 2));
-  if (!ctx.connected) {
+  logger.debug("server/handlePacket", PacketNameByType[packet.type]);
+  logger.debug(
+    "server/handlePacket",
+    () => JSON.stringify(packet, null, 2),
+  );
+  if (ctx.state === SessionState.disconnected) {
     if (packet.type === PacketType.connect) {
-      handleConnect(ctx, packet);
-    } else {
-      throw new Error(
-        `Received ${PacketNameByType[packet.type]} packet before connect`,
-      );
+      await handleConnect(ctx, packet);
+      ctx.timer?.reset();
+      return;
     }
+    throw new Error(
+      `Received ${PacketNameByType[packet.type]} packet before connect`,
+    );
+  }
+  if (ctx.state === SessionState.connecting) {
+    if (packet.type === PacketType.auth) {
+      await handleAuth(ctx, packet as AuthPacket);
+      ctx.timer?.reset();
+      return;
+    }
+    throw new Error(
+      `Received unexpected ${
+        PacketNameByType[packet.type]
+      } packet before connect completed`,
+    );
   } else {
     switch (packet.type) {
       case PacketType.pingreq:
@@ -72,6 +91,9 @@ export async function handlePacket(
       case PacketType.disconnect:
         handleDisconnect(ctx);
         break;
+      case PacketType.auth:
+        handleAuth(ctx, packet as AuthPacket);
+        break;
       default:
         throw new Error(
           `Received unexpected ${

package/server/handlers/handlePingreq.test.ts

@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import type { AnyPacket } from "../deps.ts";
+import { MQTTLevel, PacketType } from "../deps.ts";
+import { connect, disconnect, startMockServer } from "../../dev_utils/mod.ts";
+
+const pingreqPacket: AnyPacket = {
+  type: PacketType.pingreq,
+  protocolLevel: MQTTLevel.v4,
+};
+
+test("PINGREQ returns PINGRES", async () => {
+  const { mqttConn } = startMockServer();
+
+  // Connect first
+  await connect(mqttConn);
+
+  // Send PINGREQ
+  mqttConn.send(pingreqPacket);
+  const { value: pingres } = await mqttConn.next();
+  assert.deepStrictEqual(
+    pingres.type,
+    PacketType.pingres,
+    "Expected PINGRES response to PINGREQ",
+  );
+
+  // Disconnect
+  await disconnect(mqttConn);
+});

package/server/handlers/handlePuback.test.ts

@@ -0,0 +1,28 @@
+import { test } from "node:test";
+import type { AnyPacket } from "../deps.ts";
+import { MQTTLevel, PacketType } from "../deps.ts";
+import {
+  connect,
+  disconnect,
+  ping,
+  startMockServer,
+} from "../../dev_utils/mod.ts";
+
+test("PUBACK is handled without error", async () => {
+  const { mqttConn } = startMockServer();
+
+  await connect(mqttConn);
+
+  // Send PUBACK (simulating acknowledgment for outgoing QoS 1 message)
+  const pubackPacket: AnyPacket = {
+    type: PacketType.puback,
+    protocolLevel: MQTTLevel.v4,
+    id: 9999,
+  };
+  mqttConn.send(pubackPacket);
+
+  // Verify server is still responsive
+  await ping(mqttConn);
+
+  await disconnect(mqttConn);
+});

package/server/handlers/handlePuback.ts

@@ -7,13 +7,10 @@ import type { PubackPacket } from "../deps.ts";
  * @param packet - The PUBACK packet received from the client
  * @description
  * PUBACK packets are sent in response to PUBLISH packets with QoS level 1.
- * This function removes the original PUBLISH packet from the pending outgoing messages store
- * once acknowledgment is received.
  */
-export function handlePuback(ctx: Context, packet: PubackPacket) {
-  // qos 1 only
-  const id = packet.id;
-  if (ctx.store?.pendingOutgoing.has(id)) {
-    ctx.store.pendingOutgoing.delete(id);
-  }
+export async function handlePuback(
+  ctx: Context,
+  packet: PubackPacket,
+): Promise<void> {
+  await ctx.processAck(packet.id);
 }