clay-server 5.1.0 → 5.2.0-beta.1

package/lib/server-account-passkeys.js

@@ -0,0 +1,186 @@
+var crypto = require('crypto');
+var webauthn = require('@simplewebauthn/server');
+var passwords = require('./account-passwords');
+var policyStore = require('./account-passkey-policy');
+
+function attachAccountPasskeys(ctx) {
+  var users = ctx.users;
+  var http = ctx.http;
+  var challenges = require('./account-passkey-challenges').attachChallenges(ctx);
+  function policy() { return policyStore.configured(users.loadUsers()); }
+  function eligible(user) { return user && user.passwordHash && !user.mustChangePin; }
+  function current(req, original) {
+    var user = ctx.getUser(req);
+    if (!eligible(user) || original && (user.id !== original.id || user.passwordHash !== original.passwordHash)) {
+      throw new Error('Your account credentials changed. Sign in again.');
+    }
+    return user;
+  }
+  async function reauthenticate(req, data, admin) {
+    var user = current(req);
+    if (admin && user.role !== 'admin') throw new Error('Administrator access required.');
+    http.throttle(req, user.username);
+    if (!await passwords.verify(data.currentPassword, user.passwordHash)) throw new Error('Current password is incorrect.');
+    user = current(req, user);
+    if (admin && user.role !== 'admin') throw new Error('Administrator access required.');
+    http.clearAttempts(req, user.username);
+    return user;
+  }
+  function samePolicy(expected) {
+    var now = policy();
+    if (!now || now.origin !== expected.origin || now.rpID !== expected.rpID) throw new Error('Passkey settings changed. Please retry.');
+  }
+  function label(value) {
+    if (typeof value !== 'string' || !value.trim() || Array.from(value.trim()).length > 80) throw new Error('Give this passkey a name of 1–80 characters.');
+    return value.trim();
+  }
+  function responseData(data) {
+    var response = data.response;
+    if (!response || typeof response.id !== 'string' || !response.response || typeof response.response.clientDataJSON !== 'string') throw new Error('Invalid passkey response.');
+    var client = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString('utf8'));
+    if (client.crossOrigin || client.topOrigin) throw new Error('Open Clay directly to use a passkey.');
+    return response;
+  }
+  function list(user) {
+    return (user.passkeys || []).map(function (key) { return { id: key.id, name: key.name, createdAt: key.createdAt, lastUsedAt: key.lastUsedAt || null }; });
+  }
+  async function registerOptions(req, res, data, config) {
+    var user = await reauthenticate(req, data);
+    var name = label(data.name);
+    if ((user.passkeys || []).length >= 10) throw new Error('You can register up to 10 passkeys.');
+    var handle = user.passkeyUserHandle || crypto.randomBytes(32).toString('base64url');
+    var options = await webauthn.generateRegistrationOptions({
+      rpName: 'Clay', rpID: config.rpID, userID: Buffer.from(handle, 'base64url'), userName: user.username,
+      attestationType: 'none', timeout: 60000, supportedAlgorithmIDs: [-7, -257],
+      authenticatorSelection: { residentKey: 'required', userVerification: 'required' },
+      excludeCredentials: (user.passkeys || []).map(function (key) { return { id: key.id, transports: key.transports }; }),
+    });
+    current(req, user); samePolicy(config);
+    var cookie = challenges.issue(req, config, { purpose: 'register', challenge: options.challenge, userId: user.id,
+      passwordHash: user.passwordHash, session: ctx.sessionToken(req), handle: handle, name: name });
+    http.reply(res, 200, { options: options }, cookie);
+  }
+  async function registerVerify(req, res, data, config) {
+    var proof = challenges.take(req, config, 'register');
+    var user = current(req, { id: proof.userId, passwordHash: proof.passwordHash });
+    if (ctx.sessionToken(req) !== proof.session) throw new Error('Use the same signed-in session to register this passkey.');
+    var response = responseData(data);
+    var result;
+    try {
+      result = await webauthn.verifyRegistrationResponse({ response: response, expectedChallenge: proof.challenge,
+        expectedOrigin: config.origin, expectedRPID: config.rpID, requireUserVerification: true, supportedAlgorithmIDs: [-7, -257] });
+    } catch (error) { throw new Error('Could not verify this passkey. Please try registering again.'); }
+    if (!result.verified) throw new Error('Could not verify this passkey.');
+    current(req, user); samePolicy(config);
+    if (proof.until <= Date.now()) throw new Error('Registration expired. Please try again.');
+    var state = users.loadUsers();
+    user = state.users.find(function (entry) { return entry.id === user.id; });
+    var info = result.registrationInfo; var key = info.credential;
+    if (key.id !== response.id || state.users.some(function (entry) { return (entry.passkeys || []).some(function (saved) { return saved.id === key.id; }); })) {
+      throw new Error('This passkey is already registered or has an invalid identifier.');
+    }
+    if ((user.passkeys || []).length >= 10 || user.passkeyUserHandle && user.passkeyUserHandle !== proof.handle) throw new Error('Passkeys changed. Please register again.');
+    user.passkeyUserHandle = proof.handle;
+    user.passkeys = (user.passkeys || []).concat([{ id: key.id, publicKey: Buffer.from(key.publicKey).toString('base64url'),
+      counter: key.counter, transports: key.transports, name: proof.name, createdAt: new Date().toISOString(),
+      deviceType: info.credentialDeviceType, backedUp: info.credentialBackedUp }]);
+    users.saveUsers(state);
+    http.reply(res, 200, { ok: true, passkeys: list(user) }, challenges.cookie('', config.origin));
+  }
+  async function loginOptions(req, res, config) {
+    http.throttle(req, 'passkey:' + ctx.clientAddress(req));
+    var options = await webauthn.generateAuthenticationOptions({ rpID: config.rpID, userVerification: 'required', timeout: 60000 });
+    samePolicy(config);
+    http.reply(res, 200, { options: options }, challenges.issue(req, config, { purpose: 'login', challenge: options.challenge }));
+  }
+  async function loginVerify(req, res, data, config) {
+    var proof = challenges.take(req, config, 'login');
+    var response = responseData(data);
+    var state = users.loadUsers();
+    var user = state.users.find(function (entry) { return (entry.passkeys || []).some(function (key) { return key.id === response.id; }); });
+    if (!eligible(user) || response.response.userHandle !== user.passkeyUserHandle) throw new Error('Could not sign in with this passkey.');
+    var key = user.passkeys.find(function (entry) { return entry.id === response.id; });
+    var result;
+    try {
+      result = await webauthn.verifyAuthenticationResponse({ response: response, expectedChallenge: proof.challenge,
+        expectedOrigin: config.origin, expectedRPID: config.rpID, requireUserVerification: true,
+        credential: { id: key.id, publicKey: new Uint8Array(Buffer.from(key.publicKey, 'base64url')), counter: key.counter, transports: key.transports } });
+    } catch (error) { throw new Error('Could not sign in with this passkey. Try again or use your password.'); }
+    if (!result.verified || result.authenticationInfo.credentialDeviceType !== key.deviceType) throw new Error('Could not sign in with this passkey.');
+    samePolicy(config);
+    state = users.loadUsers();
+    var latest = state.users.find(function (entry) { return entry.id === user.id; });
+    var latestKey = latest && (latest.passkeys || []).find(function (entry) { return entry.id === key.id; });
+    if (!eligible(latest) || latest.passwordHash !== user.passwordHash || !latestKey || latestKey.publicKey !== key.publicKey ||
+      latestKey.counter !== key.counter || proof.until <= Date.now()) throw new Error('Account credentials changed. Please try again.');
+    latestKey.counter = result.authenticationInfo.newCounter;
+    latestKey.backedUp = result.authenticationInfo.credentialBackedUp;
+    latestKey.lastUsedAt = new Date().toISOString();
+    users.saveUsers(state);
+    var session = ctx.createSession(latest.id, latest.passwordHash, key.id, config.origin.indexOf('https:') === 0, req);
+    http.clearAttempts(req, 'passkey:' + ctx.clientAddress(req));
+    http.reply(res, 200, { ok: true }, session.cookies.concat([challenges.cookie('', config.origin)]));
+  }
+  async function manage(req, res, data, config, remove) {
+    var user = await reauthenticate(req, data);
+    samePolicy(config);
+    var state = users.loadUsers();
+    user = state.users.find(function (entry) { return entry.id === user.id; });
+    var key = (user.passkeys || []).find(function (entry) { return entry.id === data.id; });
+    if (!key) throw new Error('Passkey not found.');
+    if (remove) user.passkeys = user.passkeys.filter(function (entry) { return entry.id !== key.id; });
+    else key.name = label(data.name);
+    users.saveUsers(state);
+    // Removing a passkey also invalidates its sessions through the live session gate.
+    var cookie = remove ? ctx.createSession(user.id, user.passwordHash, null, config.origin.indexOf('https:') === 0, req).cookies : undefined;
+    http.reply(res, 200, { ok: true, passkeys: list(user) }, cookie);
+  }
+  function handleRequest(req, res, url) {
+    if (url === '/auth/passkey-browser.js' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/javascript; charset=utf-8', 'Cache-Control': 'no-cache' });
+      res.end(require('fs').readFileSync(require('path').join(__dirname, 'public/modules/passkey-browser.js'), 'utf8')); return true;
+    }
+    if (url === '/auth/logout' && req.method === 'POST') challenges.clear(req);
+    if (url === '/account/passkeys' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'" });
+      res.end(eligible(ctx.getUser(req)) ? require('./account-passkey-page').render() : require('./account-password-page').render());
+      return true;
+    }
+    if (url === '/auth/passkeys/status' && req.method === 'GET') { http.reply(res, 200, { origin: policy() && policy().origin }); return true; }
+    if (url === '/api/passkey-policy') {
+      var admin = ctx.getUser(req);
+      if (!admin || admin.role !== 'admin') { http.reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') {
+        var state = users.loadUsers();
+        http.reply(res, 200, { available: state.accountAuthMethod === 'password', origin: policy() && policy().origin, locked: policyStore.count(state) > 0 }); return true;
+      }
+      if (req.method !== 'PUT') { http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      http.read(req, res, async function (data) {
+        if (req.headers['sec-fetch-site'] === 'cross-site') throw new Error('Open Clay directly to change passkey settings.');
+        await reauthenticate(req, data, true);
+        var saved = policyStore.save(users, data.origin);
+        http.reply(res, 200, { ok: true, available: true, origin: saved.origin, locked: policyStore.count(users.loadUsers()) > 0 });
+      }); return true;
+    }
+    if (url.indexOf('/api/passkeys') !== 0 && url.indexOf('/auth/passkeys/') !== 0) return false;
+    var config = policy();
+    if (!config) { http.reply(res, 409, { error: 'Your administrator needs to configure passkeys first.' }); return true; }
+    if (url === '/api/passkeys' && req.method === 'GET') {
+      var user = ctx.getUser(req);
+      http.reply(res, eligible(user) ? 200 : 401, eligible(user) ? { origin: config.origin, passkeys: list(user) } : { error: 'Sign in to manage passkeys.' }); return true;
+    }
+    if (req.method !== 'POST') { http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    if (req.headers.origin !== config.origin || req.headers['sec-fetch-site'] === 'cross-site') { http.reply(res, 403, { error: 'Use the configured Clay address to use passkeys.' }); return true; }
+    http.read(req, res, async function (data) {
+      if (url === '/api/passkeys/register/options') return registerOptions(req, res, data, config);
+      if (url === '/api/passkeys/register/verify') return registerVerify(req, res, data, config);
+      if (url === '/auth/passkeys/login/options') return loginOptions(req, res, config);
+      if (url === '/auth/passkeys/login/verify') return loginVerify(req, res, data, config);
+      if (url === '/api/passkeys/remove' || url === '/api/passkeys/rename') return manage(req, res, data, config, url.endsWith('/remove'));
+      http.reply(res, 404, { error: 'Passkey endpoint not found.' });
+    }, 32768);
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachAccountPasskeys: attachAccountPasskeys };

package/lib/server-account-passwords.js

@@ -0,0 +1,127 @@
+var crypto = require('crypto');
+var passwords = require('./account-passwords');
+var attachPolicy = require('./account-auth-policy').attachPolicy;
+
+function attachAccountPasswords(ctx) {
+  var users = ctx.users;
+  var policy = attachPolicy(users);
+  var pending = new Map();
+
+  var cookieName = ctx.devMode ? 'clay_password_transition_dev' : 'clay_password_transition';
+  function reply(res, code, data, cookies) {
+    var headers = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' };
+    if (cookies) headers['Set-Cookie'] = cookies;
+    res.writeHead(code, headers); res.end(JSON.stringify(data));
+  }
+  function transitionCookie(token, req) {
+    return cookieName + '=' + token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + (token ? '600' : '0') + (ctx.tlsOptions || req && ctx.transport.info(req).secure ? '; Secure' : '');
+  }
+  function read(req, res, action, maxBytes) {
+    if ((req.headers['content-type'] || '').split(';')[0] !== 'application/json') { reply(res, 415, { error: 'JSON required.' }); return; }
+    var body = ''; var oversized = false;
+    req.on('data', function (chunk) { if (oversized) return; body += chunk; if (Buffer.byteLength(body) > (maxBytes || 4096)) { oversized = true; reply(res, 413, { error: 'Request too large.' }); } });
+    req.on('end', function () {
+      if (oversized) return;
+      var data; try { data = JSON.parse(body); } catch (error) { reply(res, 400, { error: 'Invalid request.' }); return; }
+      if (!data || typeof data !== 'object' || Array.isArray(data)) { reply(res, 400, { error: 'Invalid request.' }); return; }
+      Promise.resolve().then(function () { return action(data); }).catch(function (error) { reply(res, error.status || 400, { error: error.message || 'Could not complete sign-in.' }); });
+    });
+  }
+  function throttle(req, username) { ctx.throttle.consume(req, username); }
+  function clearAttempts(req, username) { ctx.throttle.success(req, username); }
+  function grant(user, res, req) {
+    var session = ctx.createSession(user.id, user.passwordHash, null, ctx.transport.info(req).secure, req);
+    reply(res, 200, { ok: true }, session.cookies.concat([transitionCookie('', req)]));
+  }
+  function startTransition(user, res, req) {
+    var now = Date.now();
+    pending.forEach(function (entry, key) { if (entry.until <= now) pending.delete(key); });
+    if (pending.size >= 1000) throw new Error('Sign-in is busy. Please retry shortly.');
+    var token = crypto.randomBytes(32).toString('hex');
+    pending.set(token, { userId: user.id, pinHash: user.pinHash, until: now + 600000, busy: false });
+    reply(res, 200, { ok: true, passwordRequired: true }, transitionCookie(token, req));
+  }
+  function handleRequest(req, res, url) {
+    if (req.method === 'POST' && url === '/auth/logout') pending.delete(ctx.parseCookies(req)[cookieName]);
+    if (url === '/api/account-auth-policy') {
+      var admin = ctx.getUser(req);
+      if (!admin || admin.role !== 'admin') { reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') { reply(res, 200, { method: policy.enabled() ? 'password' : 'pin', available: policy.available() }); return true; }
+      if (req.method !== 'PUT') { reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      read(req, res, function (data) {
+        if (data.method !== 'password') throw new Error('Only the password transition is supported.');
+        policy.activate();
+        reply(res, 200, { ok: true, method: 'password' });
+        if (ctx.onPolicyChanged) ctx.onPolicyChanged();
+      });
+      return true;
+    }
+    if (!policy.enabled()) return false;
+    if (req.method === 'GET' && url === '/account/password') {
+      var signedIn = ctx.getUser(req);
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+      res.end(signedIn ? require('./account-password-page').render(true) : require('./account-login-page').render({ password: true }));
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/password-change') {
+      read(req, res, async function (data) {
+        var user = ctx.getUser(req);
+        if (!user) throw new Error('Sign in again to change your password.');
+        throttle(req, user.username);
+        if (!await passwords.verify(data.currentPassword, user.passwordHash)) throw new Error('Current password is incorrect.');
+        if (data.password !== data.confirmPassword) throw new Error('Passwords do not match.');
+        var hash = await passwords.hash(data.password);
+        var state = users.loadUsers();
+        var current = state.users.find(function (entry) { return entry.id === user.id; });
+        if (!current || current.passwordHash !== user.passwordHash || current.mustChangePin) throw new Error('Credentials changed. Sign in again.');
+        current.passwordHash = hash; users.saveUsers(state);
+        ctx.revokeSessions(user.id); clearAttempts(req, user.username); grant(current, res, req);
+      });
+      return true;
+    }
+    if (url === '/api/user/pin') {
+      reply(res, 409, { error: 'This server uses account passwords. Contact an administrator for credential recovery.' });
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/login') {
+      read(req, res, async function (data) {
+        throttle(req, data.username);
+        var user = typeof data.username === 'string' ? users.findUserByUsername(data.username) : null;
+        if (data.pin !== undefined) {
+          if (!user || user.passwordHash && !user.mustChangePin || typeof data.pin !== 'string' || !/^\d{6}$/.test(data.pin) || !users.verifyPin(data.pin, user.pinHash, user)) throw new Error('Invalid username or account PIN.');
+          clearAttempts(req, user.username); startTransition(user, res, req); return;
+        }
+        var originalHash = user && user.passwordHash;
+        if (!await passwords.verify(data.password, originalHash)) throw new Error('Invalid username or password.');
+        user = users.findUserById(user.id);
+        if (!user || user.passwordHash !== originalHash || user.mustChangePin) throw new Error('Account credentials changed. Please sign in again.');
+        clearAttempts(req, user.username); grant(user, res, req);
+      });
+      return true;
+    }
+    if (req.method === 'POST' && url === '/auth/password-transition') {
+      read(req, res, async function (data) {
+        var token = ctx.parseCookies(req)[cookieName];
+        var proof = pending.get(token);
+        if (!proof || proof.until <= Date.now() || proof.busy) throw new Error('Verify your account PIN again.');
+        proof.busy = true;
+        try {
+          if (data.password !== data.confirmPassword) throw new Error('Passwords do not match.');
+          var hash = await passwords.hash(data.password);
+          var state = users.loadUsers();
+          var user = state.users.find(function (entry) { return entry.id === proof.userId; });
+          if (!user || user.pinHash !== proof.pinHash || user.passwordHash && !user.mustChangePin || proof.until <= Date.now()) throw new Error('Account credentials changed. Verify your PIN again.');
+          user.passwordHash = hash; user.pinHash = null; user.mustChangePin = false;
+          users.saveUsers(state);
+          pending.delete(token);
+          ctx.revokeSessions(user.id);
+          grant(user, res, req);
+        } finally { proof.busy = false; }
+      });
+      return true;
+    }
+    return false;
+  }
+  return { handleRequest: handleRequest, policy: policy, http: { read: read, reply: reply, throttle: throttle, clearAttempts: clearAttempts } };
+}
+module.exports = { attachAccountPasswords: attachAccountPasswords };

package/lib/server-account-security.js

@@ -0,0 +1,53 @@
+var passwords = require('./account-passwords');
+function attachAccountSecurity(ctx) {
+  function sessionList(req, user) {
+    var current = ctx.sessions.get(ctx.sessionToken(req), false);
+    return ctx.sessions.list(user.id).filter(function (entry) { return !!ctx.validSessionUser(entry); }).map(function (entry) {
+      return { id: entry.id, current: !!current && entry.id === current.id, userAgent: entry.userAgent || '',
+        address: entry.address, createdAt: entry.migrated ? null : entry.createdAt,
+        lastSeenAt: entry.migrated ? entry.observedAt || null : entry.lastSeenAt,
+        unknownDevice: !!entry.migrated && !entry.observedAt,
+        expiresAt: entry.expiresAt, method: entry.passkeyId ? 'Passkey' : entry.credentialVersion ? 'Password' : 'Account sign-in', migrated: !!entry.migrated };
+    }).sort(function (a, b) { return Number(b.current) - Number(a.current) || (b.lastSeenAt || 0) - (a.lastSeenAt || 0); });
+  }
+  async function verify(req, data, original) {
+    ctx.http.throttle(req, original.username);
+    if (!original.passwordHash || !await passwords.verify(data.currentPassword, original.passwordHash)) throw new Error('Current password is incorrect.');
+    var current = ctx.getUser(req);
+    if (!current || current.id !== original.id || current.passwordHash !== original.passwordHash) throw new Error('Sign in again to continue.');
+    ctx.http.clearAttempts(req, current.username); return current;
+  }
+  function handleRequest(req, res, url) {
+    if (url !== '/api/account-sessions' && url !== '/api/account-transport' && url !== '/account/sessions') return false;
+    var user = ctx.getUser(req);
+    if (!user) { ctx.http.reply(res, 401, { error: 'Sign in again to manage your account.' }); return true; }
+    if (url === '/account/sessions' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'" });
+      res.end(require('./account-session-page').render()); return true;
+    }
+    if (url === '/api/account-transport') {
+      if (user.role !== 'admin') { ctx.http.reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') { ctx.http.reply(res, 200, ctx.transport.settings()); return true; }
+      if (req.method !== 'PUT') { ctx.http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      ctx.http.read(req, res, async function (data) {
+        var admin = await verify(req, data, user);
+        if (admin.role !== 'admin') throw new Error('Administrator access required.');
+        var saved = ctx.transport.save(data); ctx.http.reply(res, 200, Object.assign({ ok: true }, saved));
+      }); return true;
+    }
+    if (req.method === 'GET') { ctx.http.reply(res, 200, { sessions: sessionList(req, user), maximumDays: 30, idleDays: 7 }); return true; }
+    if (req.method !== 'POST') { ctx.http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    ctx.http.read(req, res, function (data) {
+      var active = ctx.getUser(req);
+      if (!active || active.id !== user.id) throw new Error('Sign in again to manage sessions.');
+      var current = ctx.sessions.get(ctx.sessionToken(req), false);
+      if (!current || typeof data.id !== 'string') throw new Error('Invalid session.');
+      if (data.id !== 'others' && !ctx.sessions.list(user.id).some(function (entry) { return entry.id === data.id; })) throw new Error('Session not found.');
+      ctx.sessions.revoke(user.id, data.id, current.id);
+      ctx.http.reply(res, 200, { ok: true, signedOut: data.id === current.id, sessions: sessionList(req, user) });
+    });
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachAccountSecurity: attachAccountSecurity };