@takosjp/yurucommu-core 3.0.0

package/src/backend/routes/auth.ts

@@ -0,0 +1,615 @@
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import type { Env, Variables } from "../types.ts";
+import { actorApId, formatUsername } from "../federation-helpers.ts";
+import { verifyBootstrapOrPassword } from "../lib/crypto.ts";
+import {
+  fetchUserInfo,
+  getAuthConfig,
+  getClientCredentials,
+  getProvider,
+} from "../lib/oauth-providers.ts";
+import { verifyOidcIdToken } from "../lib/oidc-id-token.ts";
+import {
+  deleteOAuthState,
+  generateCodeChallenge,
+  generateCodeVerifier,
+  generateId as generateOAuthId,
+  generateNonce,
+  getOAuthState,
+  saveOAuthState,
+} from "../lib/oauth-utils.ts";
+import {
+  clearLoginLockout,
+  getLoginLockoutStatus,
+  recordFailedLoginAttempt,
+} from "../lib/auth-lockout.ts";
+import { getClientIP } from "../lib/client-ip.ts";
+import { and, asc, count, eq, or } from "drizzle-orm";
+import { actors, notDeleted, sessions } from "../../db/index.ts";
+import { hashSessionIdForEnv } from "../lib/crypto.ts";
+import {
+  createActor,
+  deleteSessionSafely,
+  exchangeOAuthToken,
+  findOrCreateOAuthActor,
+  formatAccountResponse,
+  lockoutErrorResponse,
+  parseJsonObject,
+  parseNonEmptyString,
+  rotateSession,
+} from "./auth-helpers.ts";
+import { logger } from "../lib/logger.ts";
+
+const log = logger.child({ component: "auth" });
+
+const KNOWN_OAUTH_ERRORS = new Set([
+  "access_denied",
+  "invalid_request",
+  "unauthorized_client",
+  "unsupported_response_type",
+  "invalid_scope",
+  "server_error",
+  "temporarily_unavailable",
+  "interaction_required",
+  "login_required",
+  "consent_required",
+]);
+
+const auth = new Hono<{ Bindings: Env; Variables: Variables }>();
+
+// Maximum number of sub-accounts a single instance owner may mint, capping
+// abuse even from the legitimate owner session (#23).
+const MAX_SUB_ACCOUNTS = 20;
+
+// 認証設定取得
+auth.get("/providers", async (c) => {
+  const config = getAuthConfig(c.env);
+  return c.json({
+    providers: config.providers.map((p) => ({
+      id: p.id,
+      name: p.name,
+      icon: p.icon,
+    })),
+    password_enabled: config.passwordEnabled,
+  });
+});
+
+// 現在のユーザー情報
+auth.get("/me", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "Not authenticated" }, 401);
+
+  const sessionId = getCookie(c, "session");
+  let provider: string | null = null;
+  let hasTakosAccess = false;
+
+  if (sessionId) {
+    const db = c.get("db");
+    const sessionKey = await hashSessionIdForEnv(c.env, sessionId);
+    const session = await db
+      .select({
+        provider: sessions.provider,
+        providerAccessToken: sessions.providerAccessToken,
+      })
+      .from(sessions)
+      .where(eq(sessions.id, sessionKey))
+      .get();
+    if (session) {
+      provider = session.provider;
+      hasTakosAccess =
+        session.provider === "takos" && !!session.providerAccessToken;
+    }
+  }
+
+  return c.json({
+    actor: {
+      ap_id: actor.ap_id,
+      username: formatUsername(actor.ap_id),
+      preferred_username: actor.preferred_username,
+      name: actor.name,
+      summary: actor.summary,
+      icon_url: actor.icon_url,
+      header_url: actor.header_url,
+      follower_count: actor.follower_count,
+      following_count: actor.following_count,
+      post_count: actor.post_count,
+      role: actor.role,
+    },
+    provider,
+    has_takos_access: hasTakosAccess,
+  });
+});
+
+// パスワード認証
+auth.post("/login", async (c) => {
+  const config = getAuthConfig(c.env);
+  if (!config.passwordEnabled) {
+    return c.json({ error: "Password auth not enabled" }, 400);
+  }
+
+  const clientIp = getClientIP(c);
+  const lockoutKey = `password:${clientIp}`;
+
+  const lockoutStatus = await getLoginLockoutStatus(c.env.KV, lockoutKey);
+  if (lockoutStatus.locked) {
+    c.header("Retry-After", String(lockoutStatus.retryAfterSeconds));
+    return c.json(lockoutErrorResponse(lockoutStatus.retryAfterSeconds), 429);
+  }
+
+  const body = await parseJsonObject(c);
+  if (!body) {
+    return c.json({ error: "Invalid request body", code: "BAD_REQUEST" }, 400);
+  }
+
+  const password = parseNonEmptyString(body.password);
+  if (!password) {
+    return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
+  }
+
+  // Verify password against AUTH_PASSWORD_HASH. Properly-hashed values use the
+  // PBKDF2 salt:hash path; a fresh Capsule install generates a colon-less
+  // bootstrap token that is matched verbatim in constant time so the install
+  // is actually loginnable out of the box (#11).
+  let isValid = false;
+
+  // Treat a blank / whitespace-only AUTH_PASSWORD_HASH as "password login
+  // disabled", not "the password is whitespace": otherwise a misconfigured
+  // `AUTH_PASSWORD_HASH=" "` would let an attacker log in by submitting " ".
+  if (c.env.AUTH_PASSWORD_HASH?.trim()) {
+    isValid = await verifyBootstrapOrPassword(
+      password,
+      c.env.AUTH_PASSWORD_HASH,
+    );
+  }
+
+  if (!isValid) {
+    const failedStatus = await recordFailedLoginAttempt(c.env.KV, lockoutKey);
+    if (failedStatus.locked) {
+      c.header("Retry-After", String(failedStatus.retryAfterSeconds));
+      return c.json(lockoutErrorResponse(failedStatus.retryAfterSeconds), 429);
+    }
+    return c.json({ error: "Invalid password" }, 401);
+  }
+
+  const db = c.get("db");
+
+  // Single-user instance: find existing owner or create default.
+  // Exclude tombstoned rows (`notDeleted`): a wave-8 account deletion keeps the
+  // owner row as a scrubbed tombstone (role still "owner") for the federation
+  // Delete signer. Without this guard the owner-resolution query would re-resolve
+  // that zombie and log a fresh login into a deleted account; with it, login
+  // falls through to createActor and provisions a clean owner.
+  const actorData =
+    (await db
+      .select()
+      .from(actors)
+      .where(and(eq(actors.role, "owner"), notDeleted(actors)))
+      .get()) ??
+    (await createActor(db, c.env, {
+      username: "tako",
+      name: "tako",
+      takosUserId: "password:owner",
+      role: "owner",
+    }));
+
+  await rotateSession(
+    c,
+    actorData.apId,
+    null,
+    null,
+    c.env.ENCRYPTION_KEY,
+    "password login rotation",
+  );
+  await clearLoginLockout(c.env.KV, lockoutKey);
+
+  return c.json({ success: true });
+});
+
+// OAuth: 認証開始
+auth.get("/login/:provider", async (c) => {
+  const providerId = c.req.param("provider");
+  const provider = getProvider(c.env, providerId);
+
+  if (!provider) {
+    return c.json({ error: "Unknown or unconfigured provider" }, 400);
+  }
+
+  const state = generateOAuthId();
+  const codeVerifier = generateCodeVerifier();
+  const codeChallenge = await generateCodeChallenge(codeVerifier);
+
+  const nonce = generateNonce();
+  await saveOAuthState(c.env.KV, state, {
+    provider: providerId,
+    codeVerifier,
+    createdAt: Date.now(),
+    nonce,
+  });
+  // Bind OAuth state to this browser session to prevent login CSRF (Issue 107).
+  // Secure unless served over explicit http:// (see the session cookie).
+  setCookie(c, "oauth_nonce", nonce, {
+    httpOnly: true,
+    secure: !(c.env.APP_URL ?? "").startsWith("http://"),
+    sameSite: "Lax",
+    path: "/",
+    maxAge: 600,
+  });
+
+  const { clientId } = getClientCredentials(c.env, providerId);
+  const redirectUri = `${c.env.APP_URL}/api/auth/callback/${providerId}`;
+
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    scope: provider.scopes.join(" "),
+    state,
+  });
+
+  if (provider.supportsPkce) {
+    params.set("code_challenge", codeChallenge);
+    params.set("code_challenge_method", "S256");
+  }
+  // For OIDC providers, send the `nonce` so the issuer echoes it in the ID Token
+  // and the callback can bind the token to this exact login (replay protection).
+  // We reuse the same random value that backs the state/CSRF binding.
+  if (provider.issuer) {
+    params.set("nonce", nonce);
+  }
+
+  return c.redirect(`${provider.authorizeUrl}?${params.toString()}`);
+});
+
+// OAuth: コールバック
+auth.get("/callback/:provider", async (c) => {
+  const providerId = c.req.param("provider");
+  const error = c.req.query("error");
+
+  if (error) {
+    log.error("OAuth provider returned error", {
+      event: "auth.oauth.callback_error",
+      provider: providerId,
+      oauthError: error,
+      errorDescription: c.req.query("error_description"),
+    });
+    const safeError = KNOWN_OAUTH_ERRORS.has(error) ? error : "oauth_error";
+    return c.redirect(`/?error=${safeError}`);
+  }
+
+  const code = c.req.query("code");
+  const state = c.req.query("state");
+  if (!code || !state) {
+    return c.redirect("/?error=missing_params");
+  }
+
+  const storedState = await getOAuthState(c.env.KV, state);
+  if (!storedState) return c.redirect("/?error=invalid_state");
+  if (storedState.provider !== providerId) {
+    return c.redirect("/?error=provider_mismatch");
+  }
+  // Verify browser-session binding nonce to prevent login CSRF (Issue 107).
+  if (storedState.nonce) {
+    const cookieNonce = getCookie(c, "oauth_nonce");
+    if (!cookieNonce || cookieNonce !== storedState.nonce) {
+      await deleteOAuthState(c.env.KV, state);
+      deleteCookie(c, "oauth_nonce");
+      return c.redirect("/?error=csrf_check_failed");
+    }
+  }
+  await deleteOAuthState(c.env.KV, state);
+  deleteCookie(c, "oauth_nonce");
+
+  const provider = getProvider(c.env, providerId);
+  if (!provider) return c.redirect("/?error=unknown_provider");
+
+  const tokens = await exchangeOAuthToken(
+    providerId,
+    code,
+    storedState.codeVerifier,
+    c.env,
+    provider,
+  );
+  if (!tokens) return c.redirect("/?error=token_exchange_failed");
+
+  let userInfo;
+  try {
+    userInfo = await fetchUserInfo(provider, tokens.access_token);
+  } catch (err) {
+    log.error("Failed to fetch user info", {
+      event: "auth.oauth.user_info_failed",
+      provider: providerId,
+      error: err,
+    });
+    return c.redirect("/?error=user_info_failed");
+  }
+
+  // For an OIDC provider (Takosumi Accounts) the ID Token is the authoritative
+  // identity assertion and carries name/email/sub that the minimal userinfo
+  // endpoint omits. Verify it (ES256 against the issuer JWKS + iss/aud/exp) and
+  // let its claims fill/override the userinfo; an ID Token that is present but
+  // invalid fails the login (fail closed — never trust an unverified subject).
+  // `issuer`+`jwksUrl` is the "this is an OIDC provider" discriminator. For such
+  // a provider the id_token MUST be present and valid — a token response that
+  // simply omits it must NOT fall through to unverified userinfo (that would skip
+  // the aud + nonce binding the rest of this flow enforces). Fail closed.
+  if (provider.issuer && provider.jwksUrl) {
+    if (!tokens.id_token) {
+      log.error("OIDC provider returned no id_token", {
+        event: "auth.oauth.id_token_missing",
+        provider: providerId,
+      });
+      return c.redirect("/?error=id_token_missing");
+    }
+    try {
+      const { clientId } = getClientCredentials(c.env, providerId);
+      const claims = await verifyOidcIdToken(tokens.id_token, {
+        issuer: provider.issuer,
+        clientId,
+        jwksUrl: provider.jwksUrl,
+        expectedNonce: storedState.nonce,
+      });
+      userInfo = {
+        ...userInfo,
+        id: claims.sub || userInfo.id,
+        name: claims.name ?? userInfo.name,
+        email: claims.email ?? userInfo.email,
+        username: claims.preferred_username ?? userInfo.username,
+      };
+    } catch (err) {
+      log.error("OIDC ID token verification failed", {
+        event: "auth.oauth.id_token_invalid",
+        provider: providerId,
+        error: err,
+      });
+      return c.redirect("/?error=id_token_invalid");
+    }
+  }
+
+  const actorData = await findOrCreateOAuthActor(
+    c.get("db"),
+    c.env,
+    providerId,
+    userInfo,
+  );
+  if (!actorData) return c.redirect("/?error=actor_creation_failed");
+
+  await rotateSession(
+    c,
+    actorData.apId,
+    providerId,
+    providerId === "takos" ? tokens : null,
+    c.env.ENCRYPTION_KEY,
+    "oauth login rotation",
+  );
+
+  return c.redirect("/");
+});
+
+// ログアウト
+auth.post("/logout", async (c) => {
+  const sessionId = getCookie(c, "session");
+  if (sessionId) {
+    await deleteSessionSafely(c.get("db"), c.env, sessionId, "logout");
+    deleteCookie(c, "session");
+  }
+  return c.json({ success: true });
+});
+
+auth.get("/accounts", async (c) => {
+  const actor = c.get("actor");
+  if (!actor) return c.json({ error: "Not authenticated" }, 401);
+
+  const db = c.get("db");
+
+  // Find the root owner ap_id: current actor may be a sub-account.
+  // ownerActorApId is set on actors created via POST /accounts; root actors have null.
+  const currentActorRecord = await db
+    .select({
+      ownerActorApId: actors.ownerActorApId,
+    })
+    .from(actors)
+    .where(eq(actors.apId, actor.ap_id))
+    .get();
+  const rootOwnerApId = currentActorRecord?.ownerActorApId ?? actor.ap_id;
+
+  // Return only the root actor and any sub-accounts they own (Issue 106).
+  const accounts = await db
+    .select({
+      apId: actors.apId,
+      preferredUsername: actors.preferredUsername,
+      name: actors.name,
+      iconUrl: actors.iconUrl,
+    })
+    .from(actors)
+    .where(
+      or(
+        eq(actors.apId, rootOwnerApId),
+        eq(actors.ownerActorApId, rootOwnerApId),
+      ),
+    )
+    .orderBy(asc(actors.createdAt))
+    .all();
+
+  return c.json({
+    accounts: accounts.map(formatAccountResponse),
+    current_ap_id: actor.ap_id,
+  });
+});
+
+auth.post("/switch", async (c) => {
+  const currentActor = c.get("actor");
+  if (!currentActor) return c.json({ error: "Not authenticated" }, 401);
+
+  const sessionId = getCookie(c, "session");
+  if (!sessionId) return c.json({ error: "No session" }, 401);
+
+  const body = await parseJsonObject(c);
+  if (!body) {
+    return c.json({ error: "Invalid request body", code: "BAD_REQUEST" }, 400);
+  }
+
+  const targetApId = parseNonEmptyString(body.ap_id);
+  if (!targetApId) {
+    return c.json({ error: "ap_id required", code: "BAD_REQUEST" }, 400);
+  }
+
+  const db = c.get("db");
+
+  // Resolve the root owner of the current session to enforce ownership (Issue 106).
+  const currentActorRecord = await db
+    .select({
+      ownerActorApId: actors.ownerActorApId,
+    })
+    .from(actors)
+    .where(eq(actors.apId, currentActor.ap_id))
+    .get();
+  const rootOwnerApId =
+    currentActorRecord?.ownerActorApId ?? currentActor.ap_id;
+
+  const targetActor = await db
+    .select({
+      apId: actors.apId,
+      ownerActorApId: actors.ownerActorApId,
+    })
+    .from(actors)
+    .where(eq(actors.apId, targetApId))
+    .get();
+
+  if (!targetActor) return c.json({ error: "Account not found" }, 404);
+
+  // Only allow switching to the root account or its own sub-accounts.
+  const isAllowed =
+    targetActor.apId === rootOwnerApId ||
+    targetActor.ownerActorApId === rootOwnerApId;
+  if (!isAllowed) return c.json({ error: "Forbidden" }, 403);
+
+  // Rotate the session instead of repointing `member_id` in place. Two reasons:
+  // (1) a fresh session id is minted and the old one invalidated (fixation
+  // hygiene), and (2) — critically — the owner's encrypted provider/OAuth tokens
+  // do NOT carry over to the sub-account (provider=null, tokens=null). A raw
+  // member_id rewrite would leave the owner's `provider_access_token` attached to
+  // a session now acting as a different actor.
+  await rotateSession(
+    c,
+    targetApId,
+    null,
+    null,
+    c.env.ENCRYPTION_KEY,
+    "account switch",
+  );
+
+  return c.json({ success: true });
+});
+
+auth.post("/accounts", async (c) => {
+  const currentActor = c.get("actor");
+  if (!currentActor) return c.json({ error: "Not authenticated" }, 401);
+
+  const body = await parseJsonObject(c);
+  if (!body) {
+    return c.json({ error: "Invalid request body", code: "BAD_REQUEST" }, 400);
+  }
+
+  const username = parseNonEmptyString(body.username);
+  if (!username) {
+    return c.json({ error: "username required", code: "BAD_REQUEST" }, 400);
+  }
+  if (!/^[a-zA-Z0-9_]{1,30}$/.test(username)) {
+    // Length-bound the identifier (1-30): it becomes the actor apId primary key
+    // and preferredUsername, so the unanchored character class let an
+    // arbitrarily long string into a PK column.
+    return c.json(
+      {
+        error: "Invalid username. Use 1-30 letters, numbers, and underscores.",
+      },
+      400,
+    );
+  }
+
+  if (body.name !== undefined && typeof body.name !== "string") {
+    return c.json({ error: "name must be a string", code: "BAD_REQUEST" }, 400);
+  }
+  if (typeof body.name === "string" && body.name.length > 50) {
+    // Mirror the profile-update cap (MAX_PROFILE_NAME_LENGTH) so the display name
+    // can't be an unbounded string.
+    return c.json(
+      { error: "name too long (max 50)", code: "BAD_REQUEST" },
+      400,
+    );
+  }
+  const name: string | undefined =
+    typeof body.name === "string" ? body.name : undefined;
+
+  const db = c.get("db");
+
+  // Resolve the root owner of the current session, then gate sub-account
+  // creation to the instance owner only (#23). Sub-accounts are minted with
+  // role "member", so an arbitrary logged-in member must never be able to
+  // create more accounts. We resolve the root actor (sub-accounts carry
+  // ownerActorApId pointing at their root) and require that root to be the
+  // instance owner. This still lets the owner manage accounts while switched
+  // into one of their own sub-accounts.
+  const creatorRecord = await db
+    .select({
+      ownerActorApId: actors.ownerActorApId,
+    })
+    .from(actors)
+    .where(eq(actors.apId, currentActor.ap_id))
+    .get();
+  const rootOwnerApId = creatorRecord?.ownerActorApId ?? currentActor.ap_id;
+
+  const rootOwnerRecord = await db
+    .select({ role: actors.role })
+    .from(actors)
+    .where(eq(actors.apId, rootOwnerApId))
+    .get();
+  if (!rootOwnerRecord || rootOwnerRecord.role !== "owner") {
+    return c.json({ error: "Forbidden" }, 403);
+  }
+
+  // Cap the number of sub-accounts owned by this root owner (#23).
+  const subAccountCount = await db
+    .select({ value: count() })
+    .from(actors)
+    .where(eq(actors.ownerActorApId, rootOwnerApId))
+    .get();
+  if ((subAccountCount?.value ?? 0) >= MAX_SUB_ACCOUNTS) {
+    return c.json(
+      {
+        error: "Sub-account limit reached",
+        code: "SUB_ACCOUNT_LIMIT_REACHED",
+      },
+      400,
+    );
+  }
+
+  const apId = actorApId(c.env.APP_URL, username);
+
+  // Exclude tombstoned rows: a deleted account keeps its row (with a renamed
+  // sentinel handle, but the original apId is unique-keyed) until the reaper
+  // drains it. A freed handle must be immediately re-registerable, so only a
+  // LIVE collision blocks creation (#9).
+  const existing = await db
+    .select({ apId: actors.apId })
+    .from(actors)
+    .where(and(eq(actors.apId, apId), notDeleted(actors)))
+    .get();
+
+  if (existing) return c.json({ error: "Username already taken" }, 400);
+
+  const newActor = await createActor(db, c.env, {
+    username,
+    name: name || username,
+    takosUserId: `local:${username}`,
+    role: "member",
+    ownerActorApId: rootOwnerApId,
+  });
+
+  return c.json({
+    success: true,
+    account: formatAccountResponse(newActor),
+  });
+});
+
+export default auth;