backend-plus 2.5.2-betha.23 → 2.5.2-betha.25

package/lib/backend-plus.d.ts

@@ -56,6 +56,7 @@ export interface ProcedureDef<T = any> {
     forExport?:{
         fileName?:string
         csvFileName?:string
+        generarInmediato?:boolean
     }
 }
 
@@ -247,7 +248,9 @@ export interface ForeignKey {
     onUpdate?: FkActions, 
     onDelete?: FkActions, 
     displayAllFields?: boolean, 
-    alias?:string, 
+    alias?:string,
+    abr?:string,
+    label?:string,
     displayFields?:string[], 
     consName?:string, 
     initiallyDeferred?:boolean

package/lib/backend-plus.js

@@ -83,7 +83,104 @@ function md5(text){
     return crypto.createHash('md5').update(text).digest('hex');
 }
 
-//
+const DEFAULT_ITERATIONS = 4096; 
+const HASH_ALGORITHM = 'sha256';
+const KEY_LENGTH = 64; // Longitud de la clave (64 bytes)
+const bufferToBase64 = (buffer) => buffer.toString('base64');
+
+/**
+ * Función central para PBKDF2.
+ * Devuelve la clave derivada.
+ */
+function deriveKey(password, salt, iterations) {
+    return new Promise((resolve, reject) => {
+        crypto.pbkdf2(
+            password, 
+            salt, 
+            iterations, 
+            KEY_LENGTH, 
+            HASH_ALGORITHM, 
+            (err, derivedKey) => {
+                if (err) return reject(err);
+                resolve(derivedKey);
+            }
+        );
+    });
+}
+
+/**
+ * Genera la cadena de verificación SCRAM-SHA-256 en formato PostgreSQL.
+ * Formato: SCRAM-SHA-256$iterations:salt$verifier
+ * @param {string} password - Contraseña en texto plano.
+ * @returns {Promise<string>} La cadena SCRAM completa.
+ */
+async function generateScramVerifier(password) {
+    // Genera Salt aleatoria
+    const saltBuffer = crypto.randomBytes(32);
+    const saltBase64 = bufferToBase64(saltBuffer);
+
+    // Deriva la clave (Verifier)
+    const verifierBuffer = await deriveKey(
+        password, 
+        saltBase64, 
+        DEFAULT_ITERATIONS
+    );
+    const verifierBase64 = bufferToBase64(verifierBuffer);
+
+    // Ensambla la cadena final (PostgreSQL style)
+    // Usa $ como delimitador principal (aunque PostgreSQL lo pone dentro de la tabla).
+    // El formato canónico es 'SCRAM-SHA-256$i:salt, verifier$encoded_verifier'
+    return `SCRAM-SHA-256$${DEFAULT_ITERATIONS}:${saltBase64}$${verifierBase64}`;
+}
+
+/**
+ * Verifica una contraseña en texto plano contra la cadena SCRAM almacenada.
+ * @param {string} password - Contraseña en texto plano ingresada por el usuario.
+ * @param {string} storedScramString - Cadena SCRAM completa (ej: SCRAM-SHA-256$4096:SALT_BASE64$VERIFIER_BASE64).
+ * @returns {Promise<boolean>} True si la contraseña es válida.
+ */
+async function verifyScram(password, storedScramString) {
+    if (!storedScramString.startsWith('SCRAM-SHA-256$')) {
+        // No es formato SCRAM. Debe ser MD5 u otro algoritmo.
+        return false;
+    }
+
+    // Parsea la cadena SCRAM
+    // Ejemplo: SCRAM-SHA-256$4096:SALT_BASE64$VERIFIER_BASE64
+    const parts = storedScramString.split('$');
+    if (parts.length !== 3) {
+        throw new Error('Formato SCRAM almacenado inválido.');
+    }
+        
+    // Obtiene iteraciones y salt de la segunda parte (ej: '4096:SALT_BASE64')
+    const [storedIterations, storedSalt] = parts[1].split(':');
+    const storedVerifier = parts[2];
+    
+    if (!storedSalt || !storedVerifier || isNaN(parseInt(storedIterations))) {
+        throw new Error('Datos de SCRAM incompletos o malformados.');
+    }
+    
+    const iterations = parseInt(storedIterations);
+
+    // Deriva la clave de la contraseña ingresada
+    const generatedVerifierBuffer = await deriveKey(
+        password, 
+        storedSalt, 
+        iterations
+    );
+    const generatedVerifier = bufferToBase64(generatedVerifierBuffer);
+
+    // Compara de manera segura contra el Verificador Almacenado
+    const storedVerifierBuffer = Buffer.from(storedVerifier, 'base64');
+    const generatedVerifierBufferFromBase64 = Buffer.from(generatedVerifier, 'base64');
+
+    // Usa crypto.timingSafeEqual para evitar ataques de temporización
+    if (generatedVerifierBufferFromBase64.length !== storedVerifierBuffer.length) {
+        return false;
+    }
+
+    return crypto.timingSafeEqual(generatedVerifierBufferFromBase64, storedVerifierBuffer);
+}
 
 var dist=regexpDistCheck.test(packagejson.main)?'dist/':'';
 
@@ -1023,34 +1120,77 @@ AppBackend.prototype.start = function start(opts){
                 }
             });
             mainApp.loginPlusManager.setValidatorStrategy(
-                function(req, username, password, done) {
-                    var client;
-                    if(!be.config.login["preserve-case"]){
-                        username = username.toLowerCase().trim();
-                    }
-                    be.getDbClient(req).then(function(cli){
-                        client = cli;
-                        return client.query("CALL set_app_user('!login')").execute();
-                    }).then(function(){
-                        var infoFieldList=be.config.login.infoFieldList||(be.config.login.rolFieldName?[be.config.login.userFieldName,be.config.login.rolFieldName]:[be.config.login.userFieldName]);
-                        return client.query(
-                            "SELECT  "+infoFieldList.map(function(fieldOrPair){ return fieldOrPair.split(' as ').map(function(ident){ return be.db.quoteIdent(ident)}).join(' as '); })+
+                async function(req, username, password, done) {
+                    try{
+                        var client;
+                        if(!be.config.login["preserve-case"]){
+                            username = username.toLowerCase().trim();
+                        }
+                        client = await be.getDbClient(req);
+                        client.query("CALL set_app_user('!login')").execute();
+                        const {passFieldName, rolFieldName, userFieldName} = be.config.login;
+                        var infoFieldList=(
+                            be.config.login.infoFieldList||(
+                                rolFieldName?
+                                    [userFieldName, rolFieldName]
+                                :
+                                    [userFieldName]
+                                )
+                            ).concat(passFieldName);
+                        
+                        const sql = "SELECT  "+infoFieldList.map(function(fieldOrPair){ return fieldOrPair.split(' as ').map(function(ident){ return be.db.quoteIdent(ident)}).join(' as '); })+
                                 ", "+be.config.login.activeClausule+" as active "+
                                 ", "+be.config.login.lockedClausule+" as locked "+
                             "  FROM  "+(be.config.login.from ?? (
                                 (be.config.login.schema?be.db.quoteIdent(be.config.login.schema)+'.':'')+
                                 be.db.quoteIdent(be.config.login.table)
                             ))+
-                            "  WHERE "+be.db.quoteIdent(be.config.login.userFieldName)+" = $1 "+
-                            "    AND "+be.db.quoteIdent(be.config.login.passFieldName)+" = $2 ",
-                            [username, md5(password+username)]
-                        ).fetchOneRowIfExists();
-                    }).then(function(data){
+                            "  WHERE "+be.db.quoteIdent(be.config.login.userFieldName)+" = $1 ";
+                        const data = await client.query(sql,[username]).fetchOneRowIfExists();
+
+                        if(data.rowCount != 1){
+                            done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                            return
+                        }else{
+                            const user  = data.row;
+                            const usaScramSha256 = user[passFieldName].startsWith('SCRAM-SHA-256$')
+                            if (usaScramSha256){
+                                const isScramValid = await verifyScram(
+                                    password, 
+                                    user[passFieldName],
+                                )
+                                if(!isScramValid){
+                                    done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                                    return
+                                }
+                            }else{                         
+                                if (md5(password+username.toLowerCase()) === user[passFieldName]) {
+                                    console.log('Autenticación MD5 OK. Ejecutando migración a SCRAM...');
+                                    // Generar nuevos valores SCRAM
+                                    const hashPass = await generateScramVerifier(password);
+                                    //sobrescribo el hash MD5 antiguo
+                                    await client.query(`
+                                        UPDATE usuarios 
+                                            SET ${be.db.quoteIdent(passFieldName)} = $1
+                                            WHERE usuario = $2
+                                            returning *`, 
+                                        [hashPass, username]
+                                    ).fetchUniqueRow();
+                                    console.log('Migración completada.');
+                                }else{
+                                    done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                                    return
+                                }
+                            }
+                        }
+                        //continua validando                    
                         if(data.rowCount==1){
                             if(!data.row.active){
                                 done(null,false,{message:be.messages.unlogged.login.inactiveFail});
+                                return
                             }else if(data.row.locked){
                                 done(null,false,{message:be.messages.unlogged.login.lockedFail});
+                                return
                             }else{
                                 if(req.query["return-to"]){
                                     req.session.loginReturnTo = req.query["return-to"];
@@ -1058,12 +1198,13 @@ AppBackend.prototype.start = function start(opts){
                                 if(be.config.login["double-dragon"]){
                                     be.DoubleDragon.dbParams[username] = changing(be.config.db, {user:username, password});
                                 }
-                                return data.row;
                             }
                         }else{
                             done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
+                            return
                         }
-                    }).then(async function(userInfo){
+
+                        const userInfo = data.row;
                         if (!userInfo) return;
                         if (!be.config.login.skipBitacora) {
                             var context = be.getContext(req);
@@ -1078,42 +1219,72 @@ AppBackend.prototype.start = function start(opts){
                             userInfo.bitacoraId = sessionInfo.value;
                         }
                         done(null, userInfo);
-                    }).then(function(){
                         client.done();
-                    }).catch(function(err){
+                    }catch(err){
                         if(be.config.login["double-dragon"]){
                             done(null,false,{message:be.messages.unlogged.login.userOrPassFail});
                         }
                         if(client && typeof client.done === "function"){
                             client.done();
                         }
-                        throw err;
-                    }).catch(function(err){
                         console.log('login error',err);
                         console.log(err.stack);
                         done(new Error('internal login error'));
-                    });
+                    };
                 }
             );
             be.changePassword=async function(client,username,oldPassword,newPassword){
-                var sql = "UPDATE "+(be.config.login.schema?be.db.quoteIdent(be.config.login.schema)+'.':'')+
-                    be.db.quoteIdent(be.config.login.table)+
-                    "\n  SET "+be.db.quoteIdent(be.config.login.passFieldName)+" = $2 "+
-                    "\n  WHERE "+be.db.quoteIdent(be.config.login.userFieldName)+" = $1 "+
-                    (oldPassword!==false?"\n    AND "+be.db.quoteIdent(be.config.login.passFieldName)+" = $3 ":"")+
-                    "\n  RETURNING 1 as ok";
-                var params = [username, md5(newPassword+username.toLowerCase())]
-                if(oldPassword!==false){
-                    params.push(md5(oldPassword+username.toLowerCase()))
+                const { table, passFieldName, userFieldName } = be.config.login;
+                const { schema } = be.config.db;
+                let ok = false;
+                const data = await client.query(
+                    `SELECT *
+                        FROM ${(schema ? be.db.quoteIdent(schema) + '.' : '')}${be.db.quoteIdent(table)}
+                        WHERE ${be.db.quoteIdent(userFieldName)} = $1`, 
+                    [username]
+                ).fetchOneRowIfExists();
+                if (data.rowCount !== 1) {
+                    // Usuario no encontrado
+                    return false;
+                }
+                const user = data.row
+                const storedHash = user[passFieldName];
+                if (oldPassword !== false) {
+                    if (storedHash.startsWith('SCRAM-SHA-256$')) {//Intento SCRAM-SHA-256
+                        ok = await verifyScram(oldPassword, storedHash);
+                    } else { //Intento MD5
+                        const md5Hash = md5(oldPassword + username.toLowerCase()); 
+                        ok = (md5Hash === storedHash);
+                    }
+                    if (!ok) {
+                        // La contraseña antigua es incorrecta
+                        return false;
+                    }
+                } else {
+                    // Si no se requiere la contraseña antigua continua
+                    ok = true;
                 }
-                var result = await client.query(sql, params).fetchOneRowIfExists();
-                var ok = result.rowCount == 1;
-                if(ok && be.config.login['double-dragon']){
-                    sql = "ALTER USER " +be.db.quoteIdent(username) + " WITH PASSWORD " + be.db.quoteLiteral(newPassword);
-                    await client.query(sql,[]).execute();
+                // Si la verificación fue exitosa o se omitió (ok == true), generamos el nuevo hash SCRAM
+                if (ok) {
+                    // hash en ormato completo de PostgreSQL: SCRAM-SHA-256$i:salt$verifier
+                    const newScramVerifier = await generateScramVerifier(newPassword);
+                    const updateSql = 
+                        "UPDATE " + (schema ? be.db.quoteIdent(schema) + '.' : '') +
+                        be.db.quoteIdent(table) +
+                        "\n  SET " + be.db.quoteIdent(passFieldName) + " = $2 " +
+                        "\n  WHERE " + be.db.quoteIdent(userFieldName) + " = $1 " +
+                        "\n  RETURNING 1 as ok";
+
+                    const updateParams = [username, newScramVerifier];
+                    const updateResult = await client.query(updateSql, updateParams).fetchOneRowIfExists();
+                    ok = updateResult.rowCount === 1;
+                    if (ok && be.config.login['double-dragon']) {
+                        const doubleDragonSql = "ALTER USER " + be.db.quoteIdent(username) + " WITH PASSWORD " + be.db.quoteLiteral(newPassword);
+                        await client.query(doubleDragonSql, []).execute();
+                    }
                 }
                 return ok;
-            }
+            };
             be.passwordChanger=function(req, username, oldPassword, newPassword, done) {
                 if(be.config.login.disableChangePassword){
                     done(null,false,'el cambio de contraseña está deshabilitado');
@@ -3384,8 +3555,10 @@ AppBackend.prototype.exportacionesGenerico = async function exportacionesGeneric
             }
         }
     }
-    await buscarGenerados(csvFileName);
-    await buscarGenerados(fileName);
+    if (!procedureDef.forExport.generarInmediato) {
+        await buscarGenerados(csvFileName);
+        await buscarGenerados(fileName);
+    }
     if(hayGenerados.length>0){
         return hayGenerados;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "backend-plus",
   "description": "Backend for the anti Pareto rule",
-  "version": "2.5.2-betha.23",
+  "version": "2.5.2-betha.25",
   "author": "Codenautas <codenautas@googlegroups.com>",
   "license": "MIT",
   "repository": "codenautas/backend-plus",