@timqi/pier 0.0.15 → 0.0.17

package/dist/web/auth.js

@@ -10,19 +10,29 @@
 // password exists before the listener does — and no env var for an operator to
 // get wrong. Forgot it? Delete the row and restart; a new one is printed.
 //
-// The cookie is a signed expiry, not a stored session id: an HMAC keyed by the
-// stored hash. No session table, no pruning — and changing the password
-// changes the key, so every cookie already out there dies with it. That is the
-// whole revocation story a single-user system needs. A cookie (not a bearer
-// header) because the workbench lives on SSE, and EventSource sends no headers.
-import { createHash, createHmac, randomBytes, randomInt, scryptSync, timingSafeEqual, } from "node:crypto";
+// The cookie is "<id>.<token>", and the database keeps the token's SHA-256 —
+// one row per signed-in browser. Two things follow, and both are why this is
+// not the signed expiry it used to be: a copy of pier.db cannot be turned into
+// a session (there is no signing key in it to forge with), and a single
+// browser can be signed out without changing the password everyone shares. A
+// cookie (not a bearer header) because the workbench lives on SSE, and
+// EventSource sends no headers.
+import { createHash, randomBytes, randomInt, scryptSync, timingSafeEqual } from "node:crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { pierDb } from "../db.js";
+import { pierDb, transact } from "../db.js";
 import { logger } from "../log.js";
 const log = logger("auth");
 const COOKIE = "pier_session";
-const TTL_MS = 90 * 24 * 60 * 60_000;
+/** How long an idle browser stays signed in. Sliding: a session in daily use
+ *  never expires, and a stolen cookie is dead a week after its last use. */
+const TTL_MS = 7 * 24 * 60 * 60_000;
+/** How stale `seen_at` may get before a request writes. Renewal rides on it,
+ *  so this is also how coarse "last seen" is — one write per browser per five
+ *  minutes instead of one per request. */
+const TOUCH_MS = 5 * 60_000;
+/** `revoke(ALL)` — not an id any row can have, so it cannot collide with one. */
+export const ALL = "*";
 /** Failed attempts one client may make before it has to wait out the window. */
 const MAX_FAILURES = 10;
 const WINDOW_MS = 15 * 60_000;
@@ -57,9 +67,7 @@ function generatePassword() {
  */
 export class AuthStore {
     #db;
-    /** HMAC key for cookies: the hash, so rotating the password expires them. */
-    #key;
-    #rotationListeners = new Set();
+    #revokeListeners = new Set();
     constructor(db = pierDb(), print = (m) => log.info(m)) {
         this.#db = db;
         let row = this.#row();
@@ -67,53 +75,157 @@ export class AuthStore {
             const password = generatePassword();
             const salt = randomBytes(16).toString("hex");
             row = { salt, hash: hash(password, salt), createdAt: Date.now() };
-            this.#db
-                .prepare("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
-                .run(row.salt, row.hash, row.createdAt);
+            // Recovery is "DELETE FROM auth and restart", so this branch is also how
+            // a forgotten password is replaced — and the browsers signed in under the
+            // old one must not walk through it. Their rows go with the credential,
+            // in one transaction: half of this leaves a new password and live old
+            // cookies, which is the state recovery exists to end.
+            transact(this.#db, () => {
+                this.#db
+                    .prepare("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
+                    .run(salt, hash(password, salt), Date.now());
+                this.#dropSessions();
+            });
             print(`\nthis instance had no password, so one was generated:\n\n    ${password}\n\n` +
                 `only its hash is stored — it is not printed again. ` +
                 `Lost it? "DELETE FROM auth" in the database, then restart.\n`);
         }
-        this.#key = row.hash;
+        // Boot is the one moment that comes around on its own. Without it, a
+        // session that expired while Pier was down would sit there notifying a
+        // phone until somebody happened to sign in.
+        this.sweep();
     }
     #row() {
         return this.#db
             .prepare("SELECT salt, hash, created_at AS createdAt FROM auth WHERE id = 1")
             .get();
     }
+    /** Every signed-in browser at once. Private: the callers that mean it also
+     *  have to tell the listeners, and `revoke(ALL)` is that pair in public. */
+    #dropSessions() {
+        this.#db.prepare("DELETE FROM web_sessions").run();
+    }
+    /** Sessions nobody may use any more, deleted rather than merely refused: a
+     *  row is what a push subscription hangs off, so "expired" has to become
+     *  "gone" without waiting for the browser to come back and be told. Run at
+     *  boot and whenever somebody signs in — the two moments the process has a
+     *  reason to look at this table at all. */
+    sweep() {
+        const swept = this.#db
+            .prepare("DELETE FROM web_sessions WHERE seen_at <= ? RETURNING id")
+            .all(Date.now() - TTL_MS);
+        for (const row of swept)
+            this.#revoked(row.id);
+        if (swept.length)
+            log.info(`swept ${String(swept.length)} expired session(s)`);
+    }
     /** Whether this is the password, compared in constant time. */
     verify(password) {
         const row = this.#row();
         return row ? sameSecret(hash(password, row.salt), row.hash) : false;
     }
     /**
-     * Replace the password, salt and all.
-     *
-     * The new hash becomes the cookie key, so every cookie signed with the old
-     * one — every other browser, and the caller's own — stops verifying. That is
-     * the point: a password is changed because the old one may be known.
+     * Replace the password, salt and all — and with it every session, the
+     * caller's own included. That is the point: a password is changed because the
+     * old one may be known, so nothing that was signed in under it stays signed
+     * in. Listeners hear it after the commit, never before.
      */
     setPassword(password) {
         const salt = randomBytes(16).toString("hex");
-        const next = hash(password, salt);
+        // Credential and sessions change together or not at all — a crash between
+        // the two writes is exactly the state "everyone signs in again" denies.
+        transact(this.#db, () => {
+            this.#db
+                .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
+                .run(salt, hash(password, salt), Date.now());
+            this.#dropSessions();
+        });
+        this.#revoked(ALL);
+    }
+    /** Sign a browser in: one row, and the cookie value that opens it. */
+    open(ip, agent) {
+        const now = Date.now();
+        this.sweep();
+        // The id names the row and the token proves it: 72 bits is plenty for a
+        // name, and the 256-bit token is the only part that has to resist guessing.
+        const id = randomBytes(9).toString("base64url");
+        const token = randomBytes(32).toString("base64url");
         this.#db
-            .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
-            .run(salt, next, Date.now());
-        this.#key = next;
-        for (const listener of this.#rotationListeners)
-            listener();
+            .prepare("INSERT INTO web_sessions(id, token_hash, created_at, seen_at, ip, agent)" +
+            " VALUES (?, ?, ?, ?, ?, ?)")
+            .run(id, digest(token), now, now, ip, agent.slice(0, 200));
+        return `${id}.${token}`;
     }
-    /** A long-lived authenticated surface closes itself when every cookie is
+    /**
+     * The row this cookie names, if the token matches and the row is live.
+     * `renewed` says the deadline just moved, which is the caller's cue to send
+     * the browser a cookie with the new Max-Age — the sliding window has to slide
+     * on both sides or the browser drops a cookie the database still honours.
+     */
+    check(cookie) {
+        const [id, token] = (cookie ?? "").split(".");
+        if (!id || !token)
+            return undefined;
+        const row = this.#db
+            .prepare("SELECT token_hash AS tokenHash, seen_at AS seenAt FROM web_sessions WHERE id = ?")
+            .get(id);
+        const now = Date.now();
+        // One clock: last use is the deadline, so there is no second column that
+        // can disagree with it about when this session ends. An expired row is
+        // deleted here rather than left for the next login to sweep — a session
+        // nobody may use must stop being a device Pier notifies at the same moment.
+        if (!row)
+            return undefined;
+        if (now - row.seenAt >= TTL_MS) {
+            this.revoke(id);
+            return undefined;
+        }
+        if (!sameSecret(digest(token), row.tokenHash))
+            return undefined;
+        if (now - row.seenAt < TOUCH_MS)
+            return { id, renewed: false };
+        this.#db.prepare("UPDATE web_sessions SET seen_at = ? WHERE id = ?").run(now, id);
+        return { id, renewed: true };
+    }
+    /** Sign out one browser, or every one of them (`ALL`). Listeners hear the
+     *  same id: a revoked cookie must also close what it opened. */
+    revoke(id) {
+        if (id === ALL)
+            this.#dropSessions();
+        else
+            this.#db.prepare("DELETE FROM web_sessions WHERE id = ?").run(id);
+        this.#revoked(id);
+    }
+    /** Signed-in browsers, most recently seen first. Never the token — the list
+     *  is shown to whoever is signed in, and it is not a set of credentials. */
+    list() {
+        return this.#db
+            .prepare("SELECT id, created_at AS createdAt, seen_at AS seenAt, ip, agent" +
+            " FROM web_sessions WHERE seen_at > ? ORDER BY seen_at DESC")
+            .all(Date.now() - TTL_MS);
+    }
+    /** A long-lived authenticated surface closes itself when a cookie is
      *  revoked. The store and listeners share the process lifetime. */
-    onRotation(listener) {
-        this.#rotationListeners.add(listener);
+    onRevoke(listener) {
+        this.#revokeListeners.add(listener);
     }
-    /** Cookie signing key. Never the password: that is not stored anywhere. */
-    get cookieKey() {
-        return this.#key;
+    /** One listener throwing must not cost the next one its notification: the
+     *  row is already gone, so a surface that never hears about it stays open on
+     *  a session that no longer exists. */
+    #revoked(id) {
+        for (const listener of this.#revokeListeners) {
+            try {
+                listener(id);
+            }
+            catch (err) {
+                log.error(`a revocation listener failed for session ${id}`, err);
+            }
+        }
     }
 }
 const hash = (password, salt) => scryptSync(password, salt, KEY_BYTES).toString("hex");
+/** What the database keeps instead of the cookie's token. */
+const digest = (token) => createHash("sha256").update(token).digest("hex");
 /**
  * What a logged-out visitor must still reach: the login form, published
  * boards, and the stylesheet those boards link — a published board rendering
@@ -130,18 +242,10 @@ function isPublic(method, path) {
         return false;
     return path.startsWith("/p/");
 }
-const sign = (secret, expiresAt) => createHmac("sha256", secret).update(String(expiresAt)).digest("base64url");
 /** Constant-time equality that also hides length: both sides are digested. */
 function sameSecret(a, b) {
-    const digest = (s) => createHash("sha256").update(s).digest();
-    return timingSafeEqual(digest(a), digest(b));
-}
-function valid(secret, cookie) {
-    const [exp, sig] = (cookie ?? "").split(".");
-    const expiresAt = Number(exp);
-    if (!sig || !Number.isSafeInteger(expiresAt) || expiresAt <= Date.now())
-        return false;
-    return sameSecret(sig, sign(secret, expiresAt));
+    const bytes = (s) => createHash("sha256").update(s).digest();
+    return timingSafeEqual(bytes(a), bytes(b));
 }
 /**
  * Only a same-origin path may be returned to after login. `//evil.example` is a
@@ -213,22 +317,30 @@ function sameOrigin(c) {
         : undefined;
     return originMatches(c.req.header("origin"), forwarded || c.req.header("host") || new URL(c.req.url).host);
 }
+/** Which row this request's cookie names. The boundary already verified the
+ *  token; this reads the id back off the value it accepted. Exported so a
+ *  surface that belongs to one browser (its push subscription) names it the
+ *  same way, rather than parsing the cookie a second way. */
+export const sessionIdOf = (c) => (getCookie(c, COOKIE) ?? "").split(".")[0] ?? "";
 /** The same cookie + Origin boundary for a WebSocket upgrade, where no Hono
- *  context exists before the handshake completes. */
+ *  context exists before the handshake completes. The session id comes back
+ *  with the verdict: a socket outlives the request that opened it, so it has
+ *  to know which row signing out would close it. */
 export function upgradeAuthorized(store, req) {
     const raw = req.headers.cookie
         ?.split(";")
         .map((part) => part.trim())
         .find((part) => part.startsWith(`${COOKIE}=`))
         ?.slice(COOKIE.length + 1);
-    if (!valid(store.cookieKey, raw))
-        return false;
+    const session = store.check(raw);
+    if (!session)
+        return undefined;
     const remote = req.socket.remoteAddress ?? "";
     const forwardedHeader = req.headers["x-forwarded-host"];
     const forwarded = loopback(remote) && typeof forwardedHeader === "string"
         ? forwardedHeader.split(",").at(-1)?.trim()
         : undefined;
-    return originMatches(req.headers.origin, forwarded || req.headers.host);
+    return originMatches(req.headers.origin, forwarded || req.headers.host) ? session.id : undefined;
 }
 /** Every route, in one place — no per-route opt-in to forget on the next one. */
 export function requireAuth(store) {
@@ -238,13 +350,18 @@ export function requireAuth(store) {
         c.header("x-frame-options", "DENY");
         if (isPublic(c.req.method, c.req.path))
             return next();
-        const authenticated = valid(store.cookieKey, getCookie(c, COOKIE));
+        const cookie = getCookie(c, COOKIE);
+        const session = store.check(cookie);
         const unsafe = c.req.method !== "GET" && c.req.method !== "HEAD";
-        if (authenticated && unsafe && !sameOrigin(c)) {
+        if (session && unsafe && !sameOrigin(c)) {
             log.warn(`blocked ${c.req.method} ${c.req.path} from origin ${c.req.header("origin")}`);
             return c.json({ error: "forbidden origin" }, 403);
         }
-        if (authenticated) {
+        if (session) {
+            // The database just moved the deadline; the browser is told the same, or
+            // it would drop a cookie that is still good.
+            if (session.renewed && cookie)
+                setSessionCookie(c, cookie);
             await next();
             // Cookie-authenticated content must not become public in a shared proxy.
             if (!c.res.headers.has("cache-control")) {
@@ -279,7 +396,15 @@ export function registerAuthRoutes(app, store) {
         }
         failures.delete(client);
         log.info(`login from ${client}`);
-        issueCookie(c, store);
+        // Signing in again replaces this browser's session rather than adding one:
+        // the cookie it is about to drop would otherwise stay valid for a week, as
+        // a row nobody can recognize in the device list. Verified first — the id in
+        // an unverified cookie is a string the caller chose, and `ALL` is one of
+        // the strings they could choose.
+        const previous = store.check(getCookie(c, COOKIE));
+        if (previous)
+            store.revoke(previous.id);
+        setSessionCookie(c, store.open(client, c.req.header("user-agent") ?? ""));
         return c.redirect(next);
     });
     // Re-authenticate before rotating the credential. The global boundary also
@@ -300,33 +425,58 @@ export function registerAuthRoutes(app, store) {
         }
         failures.delete(client);
         store.setPassword(next);
-        // The rotation just killed every cookie out there, this caller's included —
-        // a password is changed because the old one may be known, and "everyone
-        // signs in again" is the whole point. Clear the dead cookie; the client
-        // sends the person to the login form with the password they just chose.
+        // The rotation drops every session row, this caller's included — a password
+        // is changed because the old one may be known, and "everyone signs in
+        // again" is the whole point. Clear the dead cookie; the client sends the
+        // person to the login form with the password they just chose.
         deleteCookie(c, COOKIE, { path: "/" });
         return c.json({ ok: true });
     });
-    // Signs out this browser by clearing its cookie. The value itself stays
-    // verifiable until it expires — it is a signature, not a stored id — so the
-    // full revocation story remains the password change above. Behind the
-    // boundary like every write: only a signed-in browser has anything to end.
+    // Signed-in browsers, so "sign out that one" is something an operator can
+    // see before doing. Not /api/sessions: that is the agent's sessions, and one
+    // vocabulary for two unrelated things is how the wrong one gets ended.
+    app.get("/api/devices", (c) => {
+        const current = sessionIdOf(c);
+        return c.json(store.list().map((d) => ({ ...d, current: d.id === current })));
+    });
+    // Real revocation: the row goes, and the cookie holding its token opens
+    // nothing on the next request. Ending this browser's own session is the same
+    // call, so the client clears the cookie it is about to stop being able to use.
+    app.post("/api/devices/:id/signout", (c) => {
+        const id = c.req.param("id");
+        // One row per call. Signing everyone out is the password change above,
+        // which is the only thing that also invalidates the password they know.
+        if (id === ALL)
+            return c.json({ error: "not a session id" }, 400);
+        store.revoke(id);
+        log.info(`signed out session ${id}`);
+        if (id === sessionIdOf(c))
+            deleteCookie(c, COOKIE, { path: "/" });
+        return c.json({ ok: true });
+    });
+    // Signs out this browser: the row is deleted, not just the cookie cleared,
+    // so a copy of that cookie taken beforehand is dead too. Behind the boundary
+    // like every write — only a signed-in browser has anything to end.
     app.post("/logout", (c) => {
+        store.revoke(sessionIdOf(c));
         deleteCookie(c, COOKIE, { path: "/" });
         return c.json({ ok: true });
     });
 }
-/** The signed-in cookie, set the same way by login and by a password change. */
-function issueCookie(c, store) {
-    const expiresAt = Date.now() + TTL_MS;
-    setCookie(c, COOKIE, `${expiresAt}.${sign(store.cookieKey, expiresAt)}`, {
+/** The signed-in cookie — set at login, and again whenever the sliding window
+ *  moved, which is why it takes the value rather than making one. */
+function setSessionCookie(c, value) {
+    setCookie(c, COOKIE, value, {
         path: "/",
         httpOnly: true,
         sameSite: "Lax",
         // Set only over TLS: a Secure cookie on plain http is dropped, which
-        // would lock out the loopback and SSH-tunnel setups.
-        secure: c.req.header("x-forwarded-proto") === "https" ||
-            new URL(c.req.url).protocol === "https:",
+        // would lock out the loopback and SSH-tunnel setups. The forwarded scheme
+        // counts only from a local proxy — anywhere else it is a header the client
+        // wrote, and a stranger must not get to decide this flag.
+        secure: new URL(c.req.url).protocol === "https:" ||
+            (c.req.header("x-forwarded-proto")?.split(",").at(-1)?.trim() === "https" &&
+                loopback(remoteOf(c) ?? "")),
         maxAge: TTL_MS / 1000,
     });
 }