dbgate-api-premium 6.5.3 → 6.5.5

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dbgate-api-premium",
   "main": "src/index.js",
-  "version": "6.5.3",
+  "version": "6.5.5",
   "homepage": "https://dbgate.org/",
   "repository": {
     "type": "git",
@@ -30,10 +30,10 @@
     "compare-versions": "^3.6.0",
     "cors": "^2.8.5",
     "cross-env": "^6.0.3",
-    "dbgate-datalib": "^6.5.3",
+    "dbgate-datalib": "^6.5.5",
     "dbgate-query-splitter": "^4.11.5",
-    "dbgate-sqltree": "^6.5.3",
-    "dbgate-tools": "^6.5.3",
+    "dbgate-sqltree": "^6.5.5",
+    "dbgate-tools": "^6.5.5",
     "debug": "^4.3.4",
     "diff": "^5.0.0",
     "diff2html": "^3.4.13",
@@ -85,7 +85,7 @@
   "devDependencies": {
     "@types/fs-extra": "^9.0.11",
     "@types/lodash": "^4.14.149",
-    "dbgate-types": "^6.5.3",
+    "dbgate-types": "^6.5.5",
     "env-cmd": "^10.1.0",
     "jsdoc-to-markdown": "^9.0.5",
     "node-loader": "^1.0.2",

package/src/auth/authProvider.js

@@ -11,7 +11,7 @@ const logger = getLogger('authProvider');
 class AuthProviderBase {
   amoid = 'none';
 
-  async login(login, password, options = undefined) {
+  async login(login, password, options = undefined, req = undefined) {
     return {
       accessToken: jwt.sign(
         {
@@ -23,7 +23,7 @@ class AuthProviderBase {
     };
   }
 
-  oauthToken(params) {
+  oauthToken(params, req) {
     return {};
   }
 

package/src/auth/storageAuthProvider.js

@@ -21,6 +21,8 @@ const axios = require('axios');
 const _ = require('lodash');
 const { authProxyGetTokenFromCode, authProxyGetRedirectUrl } = require('../utility/authProxy');
 const { decryptUser } = require('../utility/crypting');
+const { sendToAuditLog } = require('../utility/auditlog');
+const { isLoginLicensed, LOGIN_LIMIT_ERROR } = require('../utility/loginchecker');
 
 async function loadPermissionsForUserId(userId) {
   const rolePermissions = sortPermissionsFromTheSameLevel(await storageReadUserRolePermissions(userId));
@@ -29,6 +31,7 @@ async function loadPermissionsForUserId(userId) {
   return [...getPredefinedPermissions('logged-user'), ...loggedUserPermissions, ...rolePermissions, ...userPermissions];
 }
 
+
 class StorageProviderBase extends AuthProviderBase {
   constructor(config) {
     super();
@@ -50,17 +53,31 @@ class StorageProviderBase extends AuthProviderBase {
 }
 
 class AnonymousProvider extends StorageProviderBase {
-  async login(login, password, options = undefined) {
+  async login(login, password, options = undefined, req = undefined) {
     const permissions = await [
       ...getPredefinedPermissions('anonymous-user'),
       ...(await storageReadRolePermissions(-1)),
     ];
 
+    if (!(await isLoginLicensed(req, `anonymous`))) {
+      return { error: LOGIN_LIMIT_ERROR };
+    }
+
+    sendToAuditLog(req, {
+      category: 'auth',
+      component: 'AnonymousProvider',
+      action: 'login',
+      event: 'login.anonymous',
+      severity: 'info',
+      message: 'Anonymous login',
+    });
+
     return {
       accessToken: jwt.sign(
         {
           amoid: this.amoid,
           permissions,
+          licenseUid: 'anonymous',
         },
         getTokenSecret(),
         { expiresIn: getTokenLifetime() }
@@ -73,7 +90,7 @@ class LocalAuthProvider extends StorageProviderBase {
   constructor(config) {
     super(config);
   }
-  async login(login, password) {
+  async login(login, password, _options, req) {
     const rows = await storageSelectFmt('select * from ~users where login = %v', login);
     if (rows.length == 0) {
       return { error: 'Login not allowed' };
@@ -83,6 +100,20 @@ class LocalAuthProvider extends StorageProviderBase {
       const userId = row.id;
       const permissions = await loadPermissionsForUserId(userId);
 
+      if (!(await isLoginLicensed(req, `local:${login}`))) {
+        return { error: LOGIN_LIMIT_ERROR };
+      }
+
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'LocalAuthProvider',
+        action: 'login',
+        event: 'login.local',
+        severity: 'info',
+        detail: { login },
+        message: 'Local login successful',
+      });
+
       return {
         accessToken: jwt.sign(
           {
@@ -90,12 +121,24 @@ class LocalAuthProvider extends StorageProviderBase {
             login,
             permissions,
             userId,
+            licenseUid: `local:${login}`,
           },
           getTokenSecret(),
           { expiresIn: getTokenLifetime() }
         ),
       };
     }
+
+    sendToAuditLog(req, {
+      category: 'auth',
+      component: 'LocalAuthProvider',
+      action: 'loginFail',
+      event: 'login.localFailed',
+      severity: 'warn',
+      detail: { login },
+      message: 'Local login failed',
+    });
+
     return { error: 'Invalid credentials' };
   }
 
@@ -121,7 +164,7 @@ class OauthProvider extends StorageProviderBase {
     return this.config.oauthLogout;
   }
 
-  async oauthToken(params) {
+  async oauthToken(params, req) {
     const { redirectUri, code } = params;
 
     const scopeParam = this.config.oauthScope ? `&scope=${this.config.oauthScope}` : '';
@@ -151,6 +194,16 @@ class OauthProvider extends StorageProviderBase {
     const permissions = await loadPermissionsForUserId(loginRows[0]?.id ?? -1);
 
     if (this.config.oauthOnlyDefinedLogins == 1 && loginRows.length == 0) {
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'OauthProvider',
+        action: 'loginFail',
+        event: 'login.oauthNotAllowed',
+        severity: 'warn',
+        detail: { login },
+        message: `Username ${login} not allowed to log in`,
+      });
+
       return { error: `Username ${login} not allowed to log in` };
     }
 
@@ -171,10 +224,34 @@ class OauthProvider extends StorageProviderBase {
     if (this.config.oauthOnlyDefinedGroups == 1) {
       const roleRows = await storageSelectFmt('select * from ~roles where ~name in (%,v)', groups);
       if (roleRows.length == 0) {
+        sendToAuditLog(req, {
+          category: 'auth',
+          component: 'OauthProvider',
+          action: 'loginFail',
+          event: 'login.groupNotAllowed',
+          severity: 'warn',
+          detail: { login },
+          message: `Groups ${groups.join(', ')} not allowed to log in`,
+        });
+
         return { error: `Groups ${groups.join(', ')} not allowed to log in` };
       }
     }
 
+    if (!(await isLoginLicensed(req, `oauth:${login}`))) {
+      return { error: LOGIN_LIMIT_ERROR };
+    }
+
+    sendToAuditLog(req, {
+      category: 'auth',
+      component: 'OauthProvider',
+      action: 'login',
+      event: 'login.oauth',
+      severity: 'info',
+      detail: { login, userId: loginRows[0]?.id },
+      message: `User ${login} logged in via OAUTH`,
+    });
+
     return {
       accessToken: jwt.sign(
         {
@@ -182,6 +259,7 @@ class OauthProvider extends StorageProviderBase {
           login,
           permissions,
           userId: loginRows[0]?.id,
+          licenseUid: `oauth:${login}`,
         },
         getTokenSecret(),
         { expiresIn: getTokenLifetime() }
@@ -214,7 +292,7 @@ class ADProvider extends StorageProviderBase {
     super(config);
   }
 
-  async login(login, password) {
+  async login(login, password, _options, req) {
     const adConfig = {
       url: this.config.adUrl,
       baseDN: this.config.adBaseDN,
@@ -225,6 +303,16 @@ class ADProvider extends StorageProviderBase {
     try {
       const res = await ad.authenticate(login, password);
       if (!res) {
+        sendToAuditLog(req, {
+          category: 'auth',
+          component: 'OauthProvider',
+          action: 'loginFail',
+          event: 'login.adRejected',
+          severity: 'warn',
+          detail: { login },
+          message: `AD rejected login for ${login}`,
+        });
+
         return { error: `Login failed, AD rejected login ${login}` };
       }
 
@@ -237,18 +325,43 @@ class ADProvider extends StorageProviderBase {
         }
       }
 
+      if (!(await isLoginLicensed(req, `ad:${login}`))) {
+        return { error: LOGIN_LIMIT_ERROR };
+      }
+
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'ADProvider',
+        action: 'login',
+        event: 'login.ad',
+        severity: 'info',
+        detail: { login },
+        message: `User ${login} logged in via AD`,
+      });
+
       return {
         accessToken: jwt.sign(
           {
             amoid: this.amoid,
             login,
             permissions,
+            licenseUid: `ad:${login}`,
           },
           getTokenSecret(),
           { expiresIn: getTokenLifetime() }
         ),
       };
     } catch (e) {
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'OauthProvider',
+        action: 'loginFail',
+        event: 'login.adError',
+        severity: 'warn',
+        detail: { login, error: e.message },
+        message: `AD login error for ${login}`,
+      });
+
       return { error: `Login failed: ${e.message}` };
     }
   }
@@ -276,14 +389,39 @@ class DatabaseProvider extends StorageProviderBase {
     }));
   }
 
-  async login(login, password, options) {
+  async login(login, password, options, req) {
     const { conid } = options;
     const rows = login ? await storageSelectFmt('select * from ~users where ~login = %v', login) : [];
     if (this.config.dbloginOnlyDefinedLogins == 1 && rows.length == 0) {
-      return { error: 'Login not allowed' };
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'DatabaseProvider',
+        action: 'loginFail',
+        event: 'login.dbLoginNotAllowed',
+        severity: 'warn',
+        detail: { login },
+        message: `Login ${login} not allowed to log in`,
+      });
+
+      return { error: 'Login not allowed', login };
     }
     const userId = rows[0]?.id;
     const permissions = await loadPermissionsForUserId(userId ?? -1);
+
+    if (!(await isLoginLicensed(req, `db:${login}`))) {
+      return { error: LOGIN_LIMIT_ERROR };
+    }
+
+    sendToAuditLog(req, {
+      category: 'auth',
+      component: 'DatabaseProvider',
+      action: 'login',
+      event: 'login.dbLogin',
+      severity: 'info',
+      detail: { login },
+      message: `User ${login} logged in via database`,
+    });
+
     return {
       accessToken: jwt.sign(
         {
@@ -292,6 +430,7 @@ class DatabaseProvider extends StorageProviderBase {
           permissions,
           userId,
           conid,
+          licenseUid: `db:${login}`,
         },
         getTokenSecret(),
         { expiresIn: getTokenLifetime() }
@@ -320,7 +459,7 @@ class MsEntraProvider extends StorageProviderBase {
     return null;
   }
 
-  async oauthToken(params) {
+  async oauthToken(params, req) {
     const { sid, code } = params;
 
     const token = await authProxyGetTokenFromCode({ sid, code });
@@ -336,11 +475,35 @@ class MsEntraProvider extends StorageProviderBase {
 
     if (this.config.msentraOnlyDefinedLogins == 1) {
       if (loginRows.length == 0) {
+        sendToAuditLog(req, {
+          category: 'auth',
+          component: 'MsEntraProvider',
+          action: 'loginFail',
+          event: 'login.msentraNotAllowed',
+          severity: 'warn',
+          detail: { email },
+          message: `Email ${email} not allowed to log in`,
+        });
+
         return { error: `Email ${email} not allowed to log in` };
       }
     }
 
     if (token) {
+      if (!(await isLoginLicensed(req, `msentra:${payload.unique_name}`))) {
+        return { error: LOGIN_LIMIT_ERROR };
+      }
+
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'MsEntraProvider',
+        action: 'login',
+        event: 'login.msentra',
+        severity: 'info',
+        detail: { login: payload.unique_name, userId: loginRows[0]?.id },
+        message: `User ${payload.unique_name} logged in via MS Entra`,
+      });
+
       return {
         accessToken: jwt.sign(
           {
@@ -349,6 +512,7 @@ class MsEntraProvider extends StorageProviderBase {
             msentraToken: token,
             userId: loginRows[0]?.id,
             login: payload.unique_name,
+            licenseUid: `msentra:${payload.unique_name}`,
           },
           getTokenSecret(),
           { expiresIn: getTokenLifetime() }
@@ -356,6 +520,16 @@ class MsEntraProvider extends StorageProviderBase {
       };
     }
 
+    sendToAuditLog(req, {
+      category: 'auth',
+      component: 'MsEntraProvider',
+      action: 'loginFail',
+      event: 'login.msentraNotFound',
+      severity: 'warn',
+      detail: { email },
+      message: `Token not found for email ${email}`,
+    });
+
     return { error: 'Token not found' };
   }
 

package/src/controllers/auth.js

@@ -13,8 +13,15 @@ const {
 } = require('../auth/authProvider');
 const storage = require('./storage');
 const { decryptPasswordString } = require('../utility/crypting');
-const { createDbGateIdentitySession, startCloudTokenChecking } = require('../utility/cloudIntf');
+const {
+  createDbGateIdentitySession,
+  startCloudTokenChecking,
+  readCloudTokenHolder,
+  readCloudTestTokenHolder,
+} = require('../utility/cloudIntf');
 const socket = require('../utility/socket');
+const { sendToAuditLog } = require('../utility/auditlog');
+const { isLoginLicensed, LOGIN_LIMIT_ERROR } = require('../utility/loginchecker');
 
 const logger = getLogger('auth');
 
@@ -72,6 +79,8 @@ function authMiddleware(req, res, next) {
   try {
     const decoded = jwt.verify(token, getTokenSecret());
     req.user = decoded;
+    storage.markUserAsActive(decoded.licenseUid);
+
     return next();
   } catch (err) {
     if (skipAuth) {
@@ -87,12 +96,12 @@ function authMiddleware(req, res, next) {
 
 module.exports = {
   oauthToken_meta: true,
-  async oauthToken(params) {
+  async oauthToken(params, req) {
     const { amoid } = params;
-    return getAuthProviderById(amoid).oauthToken(params);
+    return getAuthProviderById(amoid).oauthToken(params, req);
   },
   login_meta: true,
-  async login(params) {
+  async login(params, req) {
     const { amoid, login, password, isAdminPage } = params;
 
     if (isAdminPage) {
@@ -102,12 +111,26 @@ module.exports = {
         adminPassword = decryptPasswordString(adminConfig?.adminPassword);
       }
       if (adminPassword && adminPassword == password) {
+        if (!(await isLoginLicensed(req, `superadmin`))) {
+          return { error: LOGIN_LIMIT_ERROR };
+        }
+
+        sendToAuditLog(req, {
+          category: 'auth',
+          component: 'AuthController',
+          action: 'login',
+          event: 'login.admin',
+          severity: 'info',
+          message: 'Administration login successful',
+        });
+
         return {
           accessToken: jwt.sign(
             {
               login: 'superadmin',
               permissions: await storage.loadSuperadminPermissions(),
               roleId: -3,
+              licenseUid: `superadmin`,
             },
             getTokenSecret(),
             {
@@ -117,10 +140,19 @@ module.exports = {
         };
       }
 
+      sendToAuditLog(req, {
+        category: 'auth',
+        component: 'AuthController',
+        action: 'loginFail',
+        event: 'login.adminFailed',
+        severity: 'warn',
+        message: 'Administraton login failed',
+      });
+
       return { error: 'Login failed' };
     }
 
-    return getAuthProviderById(amoid).login(login, password);
+    return getAuthProviderById(amoid).login(login, password, undefined, req);
   },
 
   getProviders_meta: true,
@@ -138,8 +170,8 @@ module.exports = {
   },
 
   createCloudLoginSession_meta: true,
-  async createCloudLoginSession({ client }) {
-    const res = await createDbGateIdentitySession(client);
+  async createCloudLoginSession({ client, redirectUri }) {
+    const res = await createDbGateIdentitySession(client, redirectUri);
     startCloudTokenChecking(res.sid, tokenHolder => {
       socket.emit('got-cloud-token', tokenHolder);
       socket.emitChanged('cloud-content-changed');
@@ -148,5 +180,17 @@ module.exports = {
     return res;
   },
 
+  cloudLoginRedirected_meta: true,
+  async cloudLoginRedirected({ sid }) {
+    const tokenHolder = await readCloudTokenHolder(sid);
+    return tokenHolder;
+  },
+
+  cloudTestLogin_meta: true,
+  async cloudTestLogin({ email }) {
+    const tokenHolder = await readCloudTestTokenHolder(email);
+    return tokenHolder;
+  },
+
   authMiddleware,
 };

package/src/controllers/cloud.js

@@ -258,4 +258,22 @@ module.exports = {
     await fs.writeFile(filePath, content);
     return true;
   },
+
+  folderUsers_meta: true,
+  async folderUsers({ folid }) {
+    const resp = await callCloudApiGet(`content-folders/users/${folid}`);
+    return resp;
+  },
+
+  setFolderUserRole_meta: true,
+  async setFolderUserRole({ folid, email, role }) {
+    const resp = await callCloudApiPost(`content-folders/set-user-role/${folid}`, { email, role });
+    return resp;
+  },
+
+  removeFolderUser_meta: true,
+  async removeFolderUser({ folid, email }) {
+    const resp = await callCloudApiPost(`content-folders/remove-user/${folid}`, { email });
+    return resp;
+  },
 };

package/src/controllers/config.js

@@ -29,6 +29,7 @@ const {
 } = require('../utility/crypting');
 
 const lock = new AsyncLock();
+let cachedSettingsValue = null;
 
 module.exports = {
   // settingsValue: {},
@@ -118,6 +119,7 @@ module.exports = {
       supportCloudAutoUpgrade: !!process.env.CLOUD_UPGRADE_FILE,
       allowPrivateCloud: platformInfo.isElectron || !!process.env.ALLOW_DBGATE_PRIVATE_CLOUD,
       ...currentVersion,
+      redirectToDbGateCloudLogin: !!process.env.REDIRECT_TO_DBGATE_CLOUD_LOGIN,
     };
 
     return configResult;
@@ -144,6 +146,13 @@ module.exports = {
     return res;
   },
 
+  async getCachedSettings() {
+    if (!cachedSettingsValue) {
+      cachedSettingsValue = await this.loadSettings();
+    }
+    return cachedSettingsValue;
+  },
+
   deleteSettings_meta: true,
   async deleteSettings() {
     await fs.unlink(path.join(datadir(), processArgs.runE2eTests ? 'settings-e2etests.json' : 'settings.json'));
@@ -257,6 +266,7 @@ module.exports = {
   updateSettings_meta: true,
   async updateSettings(values, req) {
     if (!hasPermission(`settings/change`, req)) return false;
+    cachedSettingsValue = null;
 
     const res = await lock.acquire('settings', async () => {
       const currentValue = await this.loadSettings();
@@ -265,7 +275,11 @@ module.exports = {
         if (process.env.STORAGE_DATABASE) {
           updated = {
             ...currentValue,
-            ...values,
+            ..._.mapValues(values, v => {
+              if (v === true) return 'true';
+              if (v === false) return 'false';
+              return v;
+            }),
           };
           await storage.writeConfig({
             group: 'settings',
@@ -303,7 +317,7 @@ module.exports = {
       const resp = await axios.default.get('https://raw.githubusercontent.com/dbgate/dbgate/master/CHANGELOG.md');
       return resp.data;
     } catch (err) {
-      return ''
+      return '';
     }
   },
 

package/src/controllers/connections.js

@@ -536,14 +536,14 @@ module.exports = {
   },
 
   dbloginAuthToken_meta: true,
-  async dbloginAuthToken({ amoid, code, conid, redirectUri, sid }) {
+  async dbloginAuthToken({ amoid, code, conid, redirectUri, sid }, req) {
     try {
       const connection = await this.getCore({ conid });
       const driver = requireEngineDriver(connection);
       const accessToken = await driver.getAuthTokenFromCode(connection, { code, redirectUri, sid });
       const volatile = await this.saveVolatile({ conid, accessToken });
       const authProvider = getAuthProviderById(amoid);
-      const resp = await authProvider.login(null, null, { conid: volatile._id });
+      const resp = await authProvider.login(null, null, { conid: volatile._id }, req);
       return resp;
     } catch (err) {
       logger.error(extractErrorLogData(err), 'Error getting DB token');
@@ -552,18 +552,18 @@ module.exports = {
   },
 
   dbloginAuth_meta: true,
-  async dbloginAuth({ amoid, conid, user, password }) {
+  async dbloginAuth({ amoid, conid, user, password }, req) {
     if (user || password) {
       const saveResp = await this.saveVolatile({ conid, user, password, test: true });
       if (saveResp.msgtype == 'connected') {
-        const loginResp = await getAuthProviderById(amoid).login(user, password, { conid: saveResp._id });
+        const loginResp = await getAuthProviderById(amoid).login(user, password, { conid: saveResp._id }, req);
         return loginResp;
       }
       return saveResp;
     }
 
     // user and password is stored in connection, volatile connection is not needed
-    const loginResp = await getAuthProviderById(amoid).login(null, null, { conid });
+    const loginResp = await getAuthProviderById(amoid).login(null, null, { conid }, req);
     return loginResp;
   },