@vitnode/core 1.2.0-canary.23 → 1.2.0-canary.24

package/dist/src/api/lib/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/lib/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,8BAA8B,CAAC;AAEtC,KAAK,WAAW,CAAC,CAAC,SAAS,MAAM,IAC/B,CAAC,SAAS,GAAG,MAAM,IAAI,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,GACnD,GAAG,IAAI,KAAK,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,GACvC,CAAC,CAAC;AAER,KAAK,YAAY,CAAC,CAAC,SAAS,WAAW,IAAI,CACzC,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAC1C,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjC,eAAO,MAAM,UAAU,GACrB,MAAM,SAAS,MAAM,EACrB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC;CACT,EACD,CAAC,SAAS,YAAY,CAAC,CAAC,GAAG;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,EACvC,+BAIC;IACD,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,CAAC;CACV,KAAG;IACF,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,GAAG;QACT,cAAc,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KAC9C,CAAC;CA2BH,CAAC;AAEF,MAAM,WAAW,KAAK,CACpB,MAAM,SAAS,MAAM,GAAG,MAAM,EAC9B,CAAC,SAAS,WAAW,GAAG,WAAW,EACnC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;IAE3C,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,CAAC;CACV"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../src/api/lib/route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAInE,OAAO,EACL,KAAK,UAAU,EAEhB,MAAM,kCAAkC,CAAC;AAE1C,KAAK,WAAW,CAAC,CAAC,SAAS,MAAM,IAC/B,CAAC,SAAS,GAAG,MAAM,IAAI,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,GACnD,GAAG,IAAI,KAAK,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,GACvC,CAAC,CAAC;AAER,KAAK,YAAY,CAAC,CAAC,SAAS,WAAW,IAAI,CACzC,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAC1C,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjC,eAAO,MAAM,UAAU,GACrB,MAAM,SAAS,MAAM,EACrB,CAAC,SAAS,MAAM,EAChB,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG;IACpC,IAAI,EAAE,CAAC,CAAC;CACT,EACD,CAAC,SAAS,YAAY,CAAC,CAAC,GAAG;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,EACvC,+BAIC;IACD,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,CAAC;CACV,KAAG;IACF,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,GAAG;QACT,cAAc,EAAE,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KAC9C,CAAC;CA2BH,CAAC;AAEF,MAAM,WAAW,KAAK,CACpB,MAAM,SAAS,MAAM,GAAG,MAAM,EAC9B,CAAC,SAAS,WAAW,GAAG,WAAW,EACnC,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;IAE3C,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,CAAC;CACV"}

package/dist/src/api/lib/route.js

@@ -1,5 +1,5 @@
 import { createRoute as createRouteHono } from "@hono/zod-openapi";
-import { pluginMiddleware } from "../middlewares/global/global.js";
+import { pluginMiddleware } from "../middlewares/global.middleware.js";
 export const buildRoute = ({ route, handler, pluginId })=>{
     const pluginTag = pluginId.split(/[-_]/).map((word)=>word.charAt(0).toUpperCase() + word.slice(1)).join(' ');
     const tags = [

package/dist/src/api/middlewares/{global/global.d.ts → global.middleware.d.ts}

@@ -1,7 +1,8 @@
 import type { Context, Env, Next } from 'hono';
-import type { EmailApiPlugin } from '../../../api/models/email';
-import type { VitNodeApiConfig, VitNodeConfig } from '../../../vitnode.config';
-import type { SSOApiPlugin } from '../../models/sso';
+import type { EmailApiPlugin } from '../../api/models/email';
+import type { VitNodeApiConfig, VitNodeConfig } from '../../vitnode.config';
+import type { SSOApiPlugin } from '../models/sso';
+import { type LoggerMiddlewareType } from '../lib/logger-middleware';
 export interface EnvVitNode extends Env {
     Variables: EnvVariablesVitNode;
 }
@@ -29,16 +30,17 @@ interface EnvVariablesVitNode {
             cookieSecure: boolean;
             deviceCookieExpires: number;
             deviceCookieName: string;
-            ssoPlugins: SSOApiPlugin[];
+            ssoProviders: SSOApiPlugin[];
         };
-        emailProvider?: EmailApiPlugin;
+        emailAdapter?: EmailApiPlugin;
         metadata: {
             shortTitle?: string;
             title: string;
         };
     };
     db: Pick<VitNodeApiConfig, 'dbProvider'>['dbProvider'];
-    deviceId: number;
+    ipAddress: string;
+    log: LoggerMiddlewareType;
     plugin: {
         id: string;
     };
@@ -59,8 +61,8 @@ declare module 'hono' {
     interface ContextVariableMap extends EnvVariablesVitNode {
     }
 }
-export declare const globalMiddleware: ({ authorization, metadata, emailProvider, dbProvider, }: Pick<VitNodeApiConfig, "authorization" | "dbProvider" | "emailProvider"> & Pick<VitNodeConfig, "metadata">) => (c: Context, next: Next) => Promise<void>;
+export declare const globalMiddleware: ({ authorization, metadata, emailAdapter, dbProvider, }: Pick<VitNodeApiConfig, "authorization" | "dbProvider" | "emailAdapter"> & Pick<VitNodeConfig, "metadata">) => (c: Context, next: Next) => Promise<void>;
 export declare const pluginMiddleware: (pluginId: string) => (c: Context, next: Next) => Promise<void>;
 export declare const globalAdminMiddleware: () => (c: Context, next: Next) => Promise<void>;
 export {};
-//# sourceMappingURL=global.d.ts.map
+//# sourceMappingURL=global.middleware.d.ts.map

package/dist/src/api/middlewares/global.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global.middleware.d.ts","sourceRoot":"","sources":["../../../../src/api/middlewares/global.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,SAAS,EAAE,mBAAmB,CAAC;CAChC;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,IAAI,GAAG;QACZ,IAAI,EAAE;YACJ,WAAW,EAAE,MAAM,CAAC;YACpB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC;YAChB,KAAK,EAAE,MAAM,CAAC;YACd,aAAa,EAAE,OAAO,CAAC;YACvB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC;YACjB,UAAU,EAAE,OAAO,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;SAChB,CAAC;KACH,CAAC;IACF,IAAI,EAAE;QACJ,aAAa,EAAE;YACb,kBAAkB,EAAE,MAAM,CAAC;YAC3B,eAAe,EAAE,MAAM,CAAC;YACxB,cAAc,EAAE,MAAM,CAAC;YACvB,UAAU,EAAE,MAAM,CAAC;YACnB,YAAY,EAAE,OAAO,CAAC;YACtB,mBAAmB,EAAE,MAAM,CAAC;YAC5B,gBAAgB,EAAE,MAAM,CAAC;YACzB,YAAY,EAAE,YAAY,EAAE,CAAC;SAC9B,CAAC;QACF,YAAY,CAAC,EAAE,cAAc,CAAC;QAC9B,QAAQ,EAAE;YACR,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;IACF,EAAE,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,oBAAoB,CAAC;IAC1B,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,IAAI,EAAE,IAAI,GAAG;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;QACtB,SAAS,EAAE,IAAI,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,OAAO,QAAQ,MAAM,CAAC;IAEpB,UAAU,kBAAmB,SAAQ,mBAAmB;KAAG;CAC5D;AAED,eAAO,MAAM,gBAAgB,GAAI,wDAK9B,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,YAAY,GAAG,cAAc,CAAC,GACxE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,MACjB,GAAG,OAAO,EAAE,MAAM,IAAI,kBAwErC,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,UAAU,MAAM,MACjC,GAAG,OAAO,EAAE,MAAM,IAAI,kBAMrC,CAAC;AAEF,eAAO,MAAM,qBAAqB,SAClB,GAAG,OAAO,EAAE,MAAM,IAAI,kBASrC,CAAC"}

package/dist/src/api/middlewares/global.middleware.js

@@ -0,0 +1,86 @@
+import { HTTPException } from "hono/http-exception";
+import { SessionModel } from "../models/session.js";
+import { SessionAdminModel } from "../models/session-admin.js";
+import { loggerMiddleware } from "../lib/logger-middleware.js";
+export const globalMiddleware = ({ authorization, metadata, emailAdapter, dbProvider })=>{
+    return async (c, next)=>{
+        // Collect possible IP header keys in order of trust/preference
+        const ipHeaderKeys = [
+            'x-forwarded-for',
+            'x-real-ip',
+            'cf-connecting-ip',
+            'x-client-ip',
+            'x-forwarded',
+            'x-cluster-client-ip',
+            'forwarded-for',
+            'forwarded',
+            'via',
+            'remote-addr',
+            'client-ip',
+            'ip',
+            'x-ip',
+            'true-client-ip',
+            'fastly-client-ip',
+            'x-fastly-client-ip'
+        ];
+        let ipAddress;
+        // Try to get IP from Hono's request header method first
+        for (const key of ipHeaderKeys){
+            const value = c.req.header(key);
+            if (value) {
+                ipAddress = value;
+                break;
+            }
+        }
+        // If not found, try raw headers (for edge runtimes, etc.)
+        if (!ipAddress) {
+            for (const key of ipHeaderKeys){
+                const value = c.req.raw.headers.get(key);
+                if (value) {
+                    ipAddress = value;
+                    break;
+                }
+            }
+        }
+        // Fallback to localhost if nothing found
+        c.set('ipAddress', ipAddress ?? '127.0.0.1');
+        c.set('db', dbProvider);
+        c.set('core', {
+            metadata,
+            emailAdapter,
+            authorization: {
+                cookieName: authorization?.cookieName ?? 'vitnode_auth',
+                cookie_expires: authorization?.cookieExpires ?? 1000 * 60 * 60 * 24 * 90,
+                ssoProviders: authorization?.ssoProviders ?? [],
+                deviceCookieName: authorization?.deviceCookieName ?? 'vitnode_device',
+                deviceCookieExpires: authorization?.deviceCookieExpires ?? 1000 * 60 * 60 * 24 * 365,
+                adminCookieName: authorization?.adminCookieName ?? 'vitnode_auth_admin',
+                adminCookieExpires: authorization?.adminCookieExpires ?? 1000 * 60 * 60 * 24 * 1,
+                cookieSecure: authorization?.cookieSecure ?? true
+            }
+        });
+        const user = await new SessionModel(c).getUser();
+        c.set('user', user);
+        c.set('admin', null);
+        c.set('log', loggerMiddleware(c));
+        await next();
+    };
+};
+export const pluginMiddleware = (pluginId)=>{
+    return async (c, next)=>{
+        c.set('plugin', {
+            id: pluginId
+        });
+        await next();
+    };
+};
+export const globalAdminMiddleware = ()=>{
+    return async (c, next)=>{
+        const user = await new SessionAdminModel(c).getUser();
+        if (!user) throw new HTTPException(403);
+        c.set('admin', {
+            user
+        });
+        await next();
+    };
+};

package/dist/src/api/middlewares/rate-limiter.middleware.d.ts

@@ -0,0 +1,4 @@
+import type { Context, Next } from 'hono';
+import { type IRateLimiterOptions } from 'rate-limiter-flexible';
+export declare const rateLimiterMiddleware: (options?: Omit<IRateLimiterOptions, "keyPrefix">) => (c: Context, next: Next) => Promise<(Response & import("hono").TypedResponse<"Too Many Requests", 429, "text">) | undefined>;
+//# sourceMappingURL=rate-limiter.middleware.d.ts.map

package/dist/src/api/middlewares/rate-limiter.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.middleware.d.ts","sourceRoot":"","sources":["../../../../src/api/middlewares/rate-limiter.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EACL,KAAK,mBAAmB,EAGzB,MAAM,uBAAuB,CAAC;AAoB/B,eAAO,MAAM,qBAAqB,GAChC,UAAU,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAOlC,GAAG,OAAO,EAAE,MAAM,IAAI,qGAWrC,CAAC"}

package/dist/src/api/middlewares/rate-limiter.middleware.js

@@ -0,0 +1,26 @@
+import { RateLimiterMemory } from "rate-limiter-flexible";
+import { CONFIG } from "../../lib/config.js";
+const createRateLimiter = ({ keyPrefix, ...options })=>{
+    // TODO: Add support for Redis or other storage options
+    return new RateLimiterMemory({
+        keyPrefix,
+        points: CONFIG.node_development ? 120 : options?.points ?? 80,
+        duration: options?.duration ?? 60,
+        ...options
+    });
+};
+export const rateLimiterMiddleware = (options)=>{
+    const rateLimiter = createRateLimiter({
+        ...options,
+        keyPrefix: 'vitnode-api-rate-limiter'
+    });
+    return async (c, next)=>{
+        const key = c.get('ipAddress');
+        try {
+            await rateLimiter.consume(key);
+            await next();
+        } catch  {
+            return c.text('Too Many Requests', 429);
+        }
+    };
+};

package/dist/src/api/models/device.d.ts

@@ -5,6 +5,9 @@ export declare class DeviceModel {
     private createDevice;
     private getUserAgent;
     private setCookieDevice;
-    getDeviceId(): Promise<number>;
+    getDeviceId(): Promise<{
+        id: number;
+        publicId: string;
+    }>;
 }
 //# sourceMappingURL=device.d.ts.map

package/dist/src/api/models/device.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../../src/api/models/device.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAUpC,qBAAa,WAAW;gBACV,CAAC,EAAE,OAAO;IAGtB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;YAEhB,YAAY;IAe1B,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,eAAe;IAiBjB,WAAW;CAoClB"}
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../../src/api/models/device.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AASpC,qBAAa,WAAW;gBACV,CAAC,EAAE,OAAO;IAGtB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;YAEhB,YAAY;IAkB1B,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,eAAe;IAiBjB,WAAW;;;;CAwClB"}

package/dist/src/api/models/device.js

@@ -1,28 +1,33 @@
+import { randomBytes } from "crypto";
 import { eq } from "drizzle-orm";
 import { getCookie, setCookie } from "hono/cookie";
 import { core_sessions_known_devices } from "../../database/sessions.js";
 import { CONFIG } from "../../lib/config.js";
-import { getUserIp } from "../lib/get-user-ip.js";
 export class DeviceModel {
     constructor(c){
         this.c = c;
     }
     c;
     async createDevice() {
+        const publicId = randomBytes(16).toString('hex');
         const [device] = await this.c.get('db').insert(core_sessions_known_devices).values({
-            ipAddress: getUserIp(this.c),
+            publicId,
+            ipAddress: this.c.get('ipAddress'),
             userAgent: this.getUserAgent()
         }).returning({
             id: core_sessions_known_devices.id
         });
-        this.setCookieDevice(device.id);
-        return device.id;
+        this.setCookieDevice(publicId);
+        return {
+            id: device.id,
+            publicId
+        };
     }
     getUserAgent() {
         return this.c.req.header('User-Agent') ?? 'node';
     }
-    setCookieDevice(deviceId) {
-        setCookie(this.c, this.c.get('core').authorization.deviceCookieName, deviceId.toString(), {
+    setCookieDevice(publicDeviceId) {
+        setCookie(this.c, this.c.get('core').authorization.deviceCookieName, publicDeviceId, {
             httpOnly: true,
             secure: this.c.get('core').authorization.cookieSecure,
             path: '/',
@@ -31,24 +36,26 @@ export class DeviceModel {
         });
     }
     async getDeviceId() {
-        const deviceIdFromCookie = Number(getCookie(this.c, this.c.get('core').authorization.deviceCookieName));
+        const deviceIdFromCookie = getCookie(this.c, this.c.get('core').authorization.deviceCookieName);
         try {
             if (deviceIdFromCookie) {
                 const [device] = await this.c.get('db').select({
                     id: core_sessions_known_devices.id
-                }).from(core_sessions_known_devices).where(eq(core_sessions_known_devices.id, deviceIdFromCookie));
+                }).from(core_sessions_known_devices).where(eq(core_sessions_known_devices.publicId, deviceIdFromCookie));
                 if (!device) {
                     return await this.createDevice();
                 }
                 await this.c.get('db').update(core_sessions_known_devices).set({
-                    ipAddress: getUserIp(this.c),
+                    ipAddress: this.c.get('ipAddress'),
                     userAgent: this.getUserAgent()
-                }).where(eq(core_sessions_known_devices.id, deviceIdFromCookie));
-                return device.id;
+                }).where(eq(core_sessions_known_devices.publicId, deviceIdFromCookie));
+                return {
+                    id: device.id,
+                    publicId: deviceIdFromCookie
+                };
             }
-        } catch (_) {
-            return await this.createDevice();
-        }
+        } catch  {
+        /* empty */ }
         return await this.createDevice();
     }
 }

package/dist/src/api/models/email.d.ts

@@ -11,12 +11,11 @@ export interface EmailApiPlugin {
 export declare class EmailModel {
     constructor(c: Context);
     protected readonly c: Context;
-    isAvailable(): boolean;
     send(args: {
         html: string;
         replyTo?: string;
         subject: string;
         to: string;
-    }): Promise<void>;
+    }): void;
 }
 //# sourceMappingURL=email.d.ts.map

package/dist/src/api/models/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../../src/api/models/email.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAIxD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,CAAC,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,qBAAa,UAAU;gBACT,CAAC,EAAE,OAAO;IAItB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IAE9B,WAAW;IAIL,IAAI,CAAC,IAAI,EAAE;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ;CAqBF"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../../src/api/models/email.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAIxD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,CAAC,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED,qBAAa,UAAU;gBACT,CAAC,EAAE,OAAO;IAItB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IAE9B,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE;CAuB3E"}

package/dist/src/api/models/email.js

@@ -4,27 +4,20 @@ export class EmailModel {
         this.c = c;
     }
     c;
-    isAvailable() {
-        return !!this.c.get('core').emailProvider;
-    }
-    async send(args) {
+    send(args) {
         const core = this.c.get('core');
-        const provider = core.emailProvider;
+        const provider = core.emailAdapter;
         if (!provider) {
             throw new HTTPException(500, {
                 message: 'Email provider not found'
             });
         }
-        try {
-            await provider.sendEmail({
-                ...args,
-                metadata: core.metadata
-            });
-        } catch (e) {
-            const error = e;
-            throw new HTTPException(500, {
-                message: error.message
-            });
-        }
+        void provider.sendEmail({
+            ...args,
+            metadata: core.metadata
+        }).catch((err)=>{
+            const error = err instanceof Error ? err : new Error('Unknown error from email provider');
+            this.c.get('log').error(`Failed to send email: ${error.message}`);
+        });
     }
 }

package/dist/src/api/models/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/api/models/password.ts"],"names":[],"mappings":"AAEA,qBAAa,aAAa;IAClB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYlD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASvE"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../src/api/models/password.ts"],"names":[],"mappings":"AAEA,qBAAa,aAAa;IAClB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYlD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAkBvE"}

package/dist/src/api/models/password.js

@@ -12,9 +12,16 @@ export class PasswordModel {
     async verifyPassword(password, hash) {
         return new Promise((resolve, reject)=>{
             const [salt, key] = hash.split(':');
+            const keyBuffer = Buffer.from(key, 'hex');
             crypto.scrypt(password, salt, 64, (err, derivedKey)=>{
                 if (err) reject(err);
-                resolve(key == derivedKey.toString('hex'));
+                if (keyBuffer.length !== derivedKey.length) {
+                    crypto.timingSafeEqual(derivedKey, derivedKey);
+                    resolve(false);
+                } else {
+                    const areEqual = crypto.timingSafeEqual(keyBuffer, derivedKey);
+                    resolve(areEqual);
+                }
             });
         });
     }

package/dist/src/api/models/session-admin.d.ts

@@ -2,10 +2,10 @@ import type { Context } from 'hono';
 export declare class SessionAdminModel {
     constructor(c: Context);
     protected readonly c: Context;
+    private hashToken;
     checkIfUserIsAdmin(userId: number): Promise<boolean>;
     createSessionByUserId(userId: number): Promise<{
         token: string;
-        deviceId: number;
     }>;
     deleteSession(): Promise<void>;
     getUser(): Promise<{

package/dist/src/api/models/session-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-admin.d.ts","sourceRoot":"","sources":["../../../../src/api/models/session-admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAWpC,qBAAa,iBAAiB;gBAChB,CAAC,EAAE,OAAO;IAGtB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IAExB,kBAAkB,CAAC,MAAM,EAAE,MAAM;IAmBjC,qBAAqB,CAAC,MAAM,EAAE,MAAM;;;;IAsCpC,aAAa;IAgBb,OAAO;;;;;;;;;;;;CAgCd"}
+{"version":3,"file":"session-admin.d.ts","sourceRoot":"","sources":["../../../../src/api/models/session-admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAYpC,qBAAa,iBAAiB;gBAChB,CAAC,EAAE,OAAO;IAGtB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;YAEhB,SAAS;IASjB,kBAAkB,CAAC,MAAM,EAAE,MAAM;IAmBjC,qBAAqB,CAAC,MAAM,EAAE,MAAM;;;IAwCpC,aAAa;IAoBb,OAAO;;;;;;;;;;;;CAiDd"}

package/dist/src/api/models/session-admin.js

@@ -1,14 +1,22 @@
-import { and, eq, gt, or } from "drizzle-orm";
+import { and, eq, gt, or } from "drizzle-orm"; // Removed 'or' as it's safer not to use it here
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { core_admin_permissions, core_admin_sessions } from "../../database/admins.js";
 import { CONFIG } from "../../lib/config.js";
+import { DeviceModel } from "./device.js";
 import { UserModel } from "./user.js";
 export class SessionAdminModel {
     constructor(c){
         this.c = c;
     }
     c;
+    async hashToken(token) {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(token);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        return hashArray.map((b)=>b.toString(16).padStart(2, '0')).join('');
+    }
     async checkIfUserIsAdmin(userId) {
         const user = await new UserModel().getUserById({
             id: userId,
@@ -20,54 +28,70 @@ export class SessionAdminModel {
     }
     async createSessionByUserId(userId) {
         const isAdmin = await this.checkIfUserIsAdmin(userId);
-        if (!isAdmin) throw new HTTPException(403);
-        // Generate secure random bytes using Web Crypto API
+        if (!isAdmin) {
+            throw new HTTPException(403, {
+                message: 'Forbidden'
+            });
+        }
         const randomBytes = new Uint8Array(64);
         crypto.getRandomValues(randomBytes);
         const token = Array.from(randomBytes).map((b)=>b.toString(16).padStart(2, '0')).join('');
-        const deviceId = this.c.get('deviceId');
+        const hashedToken = await this.hashToken(token);
+        const device = await new DeviceModel(this.c).getDeviceId();
         await this.c.get('db').insert(core_admin_sessions).values({
-            token,
+            token: hashedToken,
             userId,
             expiresAt: new Date(Date.now() + this.c.get('core').authorization.adminCookieExpires),
-            deviceId
+            deviceId: device.id
         });
         setCookie(this.c, this.c.get('core').authorization.adminCookieName, token, {
             httpOnly: true,
             secure: this.c.get('core').authorization.cookieSecure,
-            path: '/admin',
+            path: '/',
             expires: new Date(Date.now() + this.c.get('core').authorization.adminCookieExpires),
             domain: CONFIG.frontend.hostname
         });
         return {
-            token,
-            deviceId
+            token
         };
     }
     async deleteSession() {
         const token = getCookie(this.c, this.c.get('core').authorization.adminCookieName);
         if (!token) return;
-        await this.c.get('db').delete(core_admin_sessions).where(eq(core_admin_sessions.token, token));
+        const hashedToken = await this.hashToken(token);
+        await this.c.get('db').delete(core_admin_sessions).where(eq(core_admin_sessions.token, hashedToken));
         deleteCookie(this.c, this.c.get('core').authorization.adminCookieName, {
-            path: '/admin'
+            path: '/',
+            domain: CONFIG.frontend.hostname
         });
     }
     async getUser() {
         const { authorization } = this.c.get('core');
         const token = getCookie(this.c, authorization.adminCookieName);
         if (!token) return null;
-        const deviceId = this.c.get('deviceId');
-        if (!deviceId) return null;
+        const device = await new DeviceModel(this.c).getDeviceId();
+        if (!device) return null;
+        const hashedToken = await this.hashToken(token);
         const [session] = await this.c.get('db').select({
-            token: core_admin_sessions.token,
             userId: core_admin_sessions.userId
-        }).from(core_admin_sessions).where(and(eq(core_admin_sessions.token, token), eq(core_admin_sessions.deviceId, deviceId), gt(core_admin_sessions.expiresAt, new Date()))).limit(1);
-        if (!session) return null;
+        }).from(core_admin_sessions).where(and(eq(core_admin_sessions.token, hashedToken), eq(core_admin_sessions.deviceId, device.id), gt(core_admin_sessions.expiresAt, new Date()))).limit(1);
+        if (!session) {
+            deleteCookie(this.c, this.c.get('core').authorization.adminCookieName, {
+                path: '/',
+                domain: CONFIG.frontend.hostname
+            });
+            return null;
+        }
         const user = await new UserModel().getUserById({
             id: session.userId,
             c: this.c
         });
         if (!user) return null;
+        const isStillAdmin = await this.checkIfUserIsAdmin(user.id);
+        if (!isStillAdmin) {
+            await this.deleteSession();
+            return null;
+        }
         return user;
     }
 }

package/dist/src/api/models/session.d.ts

@@ -2,9 +2,9 @@ import type { Context } from 'hono';
 export declare class SessionModel {
     constructor(c: Context);
     protected readonly c: Context;
+    private hashToken;
     createSessionByUserId(userId: number): Promise<{
         token: string;
-        deviceId: number;
     }>;
     deleteSession(): Promise<void>;
     getUser(): Promise<{

package/dist/src/api/models/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/api/models/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAUpC,qBAAa,YAAY;gBACX,CAAC,EAAE,OAAO;IAGtB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IAExB,qBAAqB,CAAC,MAAM,EAAE,MAAM;;;;IAqCpC,aAAa;IAcb,OAAO;;;;;;;;;;;;CAoCd"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/api/models/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAWpC,qBAAa,YAAY;gBACX,CAAC,EAAE,OAAO;IAGtB,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;YAEhB,SAAS;IASjB,qBAAqB,CAAC,MAAM,EAAE,MAAM;;;IAsCpC,aAAa;IA8Bb,OAAO;;;;;;;;;;;;CA0Cd"}

package/dist/src/api/models/session.js

@@ -2,23 +2,32 @@ import { and, eq, gt } from "drizzle-orm";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { core_sessions } from "../../database/sessions.js";
 import { CONFIG } from "../../lib/config.js";
+import { DeviceModel } from "./device.js";
 import { UserModel } from "./user.js";
 export class SessionModel {
     constructor(c){
         this.c = c;
     }
     c;
+    async hashToken(token) {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(token);
+        const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        return hashArray.map((b)=>b.toString(16).padStart(2, '0')).join('');
+    }
     async createSessionByUserId(userId) {
         // Generate secure random bytes using Web Crypto API
         const randomBytes = new Uint8Array(64);
         crypto.getRandomValues(randomBytes);
         const token = Array.from(randomBytes).map((b)=>b.toString(16).padStart(2, '0')).join('');
-        const deviceId = this.c.get('deviceId');
+        const device = await new DeviceModel(this.c).getDeviceId();
+        const hashedToken = await this.hashToken(token);
         await this.c.get('db').insert(core_sessions).values({
-            token,
+            token: hashedToken,
             userId,
             expiresAt: new Date(Date.now() + this.c.get('core').authorization.cookie_expires),
-            deviceId
+            deviceId: device.id
         });
         setCookie(this.c, this.c.get('core').authorization.cookieName, token, {
             httpOnly: true,
@@ -28,26 +37,33 @@ export class SessionModel {
             domain: CONFIG.frontend.hostname
         });
         return {
-            token,
-            deviceId
+            token
         };
     }
     async deleteSession() {
         const token = getCookie(this.c, this.c.get('core').authorization.cookieName);
-        if (!token) return;
-        await this.c.get('db').delete(core_sessions).where(eq(core_sessions.token, token));
+        const device = await new DeviceModel(this.c).getDeviceId();
+        // Ensure both token and deviceId exist before proceeding
+        if (!token || !device.id) {
+            deleteCookie(this.c, this.c.get('core').authorization.cookieName);
+            return;
+        }
+        const hashedToken = await this.hashToken(token);
+        await this.c.get('db').delete(core_sessions)// Harden the query to ensure a user can only delete their own device's session
+        .where(and(eq(core_sessions.token, hashedToken), eq(core_sessions.deviceId, device.id)));
         deleteCookie(this.c, this.c.get('core').authorization.cookieName);
     }
     async getUser() {
         const token = getCookie(this.c, this.c.get('core').authorization.cookieName);
         if (!token) return null;
-        const deviceId = this.c.get('deviceId');
-        if (!deviceId) return null;
+        const device = await new DeviceModel(this.c).getDeviceId();
+        if (!device) return null;
+        const hashedToken = await this.hashToken(token);
         const [session] = await this.c.get('db').select({
-            token: core_sessions.token,
             userId: core_sessions.userId
-        }).from(core_sessions).where(and(eq(core_sessions.token, token), eq(core_sessions.deviceId, deviceId), gt(core_sessions.expiresAt, new Date()))).limit(1);
-        if (!session || session.token !== token) {
+        }).from(core_sessions).where(and(eq(core_sessions.token, hashedToken), eq(core_sessions.deviceId, device.id), gt(core_sessions.expiresAt, new Date()))).limit(1);
+        if (!session) {
+            deleteCookie(this.c, this.c.get('core').authorization.cookieName);
             return null;
         }
         const user = await new UserModel().getUserById({

package/dist/src/api/models/sso.js

@@ -10,7 +10,7 @@ export const getRedirectUri = (code)=>new URL(`${CONFIG.frontend.href}login/sso/
 export class SSOModel {
     constructor(c){
         this.c = c;
-        this.plugins = c.get('core').authorization.ssoPlugins;
+        this.plugins = c.get('core').authorization.ssoProviders;
     }
     c;
     plugins;

package/dist/src/api/models/user/sign-up.d.ts

@@ -5,6 +5,7 @@ export declare const signUp: ({ email, name, newsletter, hashedPassword, }: {
     name: string;
     newsletter?: boolean;
 }, c: Context) => Promise<{
+    ipAddress: string;
     id: number;
     name: string;
     createdAt: Date;
@@ -16,6 +17,5 @@ export declare const signUp: ({ email, name, newsletter, hashedPassword, }: {
     emailVerified: boolean;
     roleId: number;
     birthday: Date | null;
-    ipAddress: string;
 }>;
 //# sourceMappingURL=sign-up.d.ts.map

package/dist/src/api/models/user/sign-up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign-up.d.ts","sourceRoot":"","sources":["../../../../../src/api/models/user/sign-up.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAkEpC,eAAO,MAAM,MAAM,GACjB,8CAKG;IACD,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,EACD,GAAG,OAAO;;;;;;;;;;;;;EAwDX,CAAC"}
+{"version":3,"file":"sign-up.d.ts","sourceRoot":"","sources":["../../../../../src/api/models/user/sign-up.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAiEpC,eAAO,MAAM,MAAM,GACjB,8CAKG;IACD,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,EACD,GAAG,OAAO;;;;;;;;;;;;;EAwDX,CAAC"}