domma-cms 0.81.1 → 0.83.0

package/server/services/authChecks.js

@@ -0,0 +1,128 @@
+/**
+ * Sign-in and password checks that plugins add (Security, Security Pro).
+ *
+ * Login checks run in two phases:
+ *   - `before`: before the password is looked at, with the email and request
+ *     (the user if one exists). A lockout lives here, so a locked-out attacker
+ *     learns nothing - not even whether the password was right.
+ *   - `after`: once the password is right, with the user. Two-factor lives here.
+ * A check answers:
+ *   {allow: true}                              - carry on
+ *   {deny: true, message, status?}              - refuse, with this message (429/403/401)
+ *   {challenge: {kind, label, help, ...}}        - ask for something more ('after' only)
+ * A challenge makes the login answer `{challenge, ticket}`; the admin posts
+ * `{ticket, response}` to /api/auth/login/verify, the check's `verify()` decides,
+ * and the remaining checks run from the next one.
+ *
+ * Password checks run wherever a password is set (setup, create user, update
+ * user, My Profile, reset). Each returns '' or a message; every message is shown.
+ *
+ * A check that THROWS is logged and skipped (sign-in must not break because a
+ * plugin did) - except in `verify()`, where a throw is a refusal.
+ */
+
+const loginChecks = [];
+const passwordChecks = [];
+
+const errOf = (err) => (err && err.message) || String(err);
+
+/**
+ * @param {string} owner - the plugin's name
+ * @param {{id: string, phase?: 'before'|'after', check: Function, verify?: Function}} def
+ */
+export function registerLoginCheck(owner, def) {
+    if (!def || typeof def.check !== 'function' || !def.id) throw new Error('registerLoginCheck needs {id, check}');
+    const id = `${owner}:${def.id}`;
+    const at = loginChecks.findIndex(c => c.id === id);
+    const entry = {...def, id, owner, phase: def.phase === 'before' ? 'before' : 'after'};
+    if (at >= 0) loginChecks[at] = entry;
+    else loginChecks.push(entry);
+}
+
+/**
+ * @param {string} owner
+ * @param {{id: string, check: (password: string, ctx: object) => Promise<string>|string}} def
+ */
+export function registerPasswordCheck(owner, def) {
+    if (!def || typeof def.check !== 'function' || !def.id) throw new Error('registerPasswordCheck needs {id, check}');
+    const id = `${owner}:${def.id}`;
+    const at = passwordChecks.findIndex(c => c.id === id);
+    if (at >= 0) passwordChecks[at] = {...def, id, owner};
+    else passwordChecks.push({...def, id, owner});
+}
+
+/** Plugins unloading (tests, a disabled plugin on restart): forget their checks. */
+export function clearChecks(owner = null) {
+    for (const list of [loginChecks, passwordChecks]) {
+        for (let i = list.length - 1; i >= 0; i--) if (!owner || list[i].owner === owner) list.splice(i, 1);
+    }
+}
+
+export const loginCheckIds = () => loginChecks.map(c => c.id);
+
+/**
+ * Run the login checks of a phase, from `start` (an index into that phase's list).
+ *
+ * @param {'before'|'after'} phase
+ * @param {object} ctx - {email, user, request, ip, ua}
+ * @param {{start?: number, log?: {warn: Function}}} [opts]
+ * @returns {Promise<{allow: true} | {deny: true, message: string, status: number, by: string}
+ *                   | {challenge: object, by: string, index: number}>}
+ */
+export async function runLoginChecks(phase, ctx, {start = 0, log = console} = {}) {
+    const list = loginChecks.filter(c => c.phase === phase);
+    for (let i = start; i < list.length; i++) {
+        const c = list[i];
+        let out;
+        try {
+            out = await c.check(ctx);
+        } catch (err) {
+            log.warn?.(`[auth] login check ${c.id} failed, skipped: ${errOf(err)}`);
+            continue;
+        }
+        if (!out || out.allow) continue;
+        if (out.deny) return {deny: true, message: String(out.message || 'Sign-in refused.'), status: Number(out.status) || 403, by: c.id};
+        if (out.challenge && phase === 'after' && typeof c.verify === 'function') {
+            return {challenge: {...out.challenge}, by: c.id, index: i};
+        }
+    }
+    return {allow: true};
+}
+
+/**
+ * A challenge answered: the check that asked verifies it.
+ *
+ * @returns {Promise<{ok: boolean, message?: string, trust?: object}>}
+ */
+export async function verifyChallenge(by, ctx) {
+    const c = loginChecks.find(x => x.id === by && x.phase === 'after');
+    if (!c || typeof c.verify !== 'function') return {ok: false, message: 'This sign-in step is no longer available. Sign in again.'};
+    try {
+        const out = await c.verify(ctx);
+        return out && out.ok ? {ok: true, ...(out.trust && {trust: out.trust})} : {ok: false, message: String(out?.message || 'That did not match.')};
+    } catch (err) {
+        return {ok: false, message: 'That could not be checked. Try again.'};
+    }
+}
+
+/** The index, among the 'after' checks, of a check by id (-1 when gone). */
+export const afterIndexOf = (by) => loginChecks.filter(c => c.phase === 'after').findIndex(c => c.id === by);
+
+/**
+ * Every password check's objection, in order ([] = fine).
+ *
+ * @param {string} password
+ * @param {{email?: string, name?: string, userId?: string, request?: object}} ctx
+ */
+export async function checkPassword(password, ctx = {}, {log = console} = {}) {
+    const problems = [];
+    for (const c of passwordChecks) {
+        try {
+            const msg = await c.check(password, ctx);
+            if (msg) problems.push(String(msg));
+        } catch (err) {
+            log.warn?.(`[auth] password check ${c.id} failed, skipped: ${errOf(err)}`);
+        }
+    }
+    return problems;
+}

package/server/services/avatars.js

@@ -0,0 +1,77 @@
+/**
+ * Avatars - a user's picture, uploaded from My Profile.
+ *
+ * Any image the browser sends is re-encoded here (sharp): turned upright from
+ * its EXIF orientation, cropped square on its centre, 256 px, WebP - so what is
+ * stored and served is always a small, plain image, never the uploaded bytes
+ * (no scripts in an SVG, no metadata, no 20 MB phone photo).
+ *
+ * Files live in content/avatars/, beside content/users/ - not in the Media
+ * library, which is for the site's own images. The name carries a random part,
+ * so a new picture is a new address (no stale cache) and one cannot be guessed
+ * from a user id. The user record holds `avatar`: the address to show.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import sharp from 'sharp';
+import {config} from '../config.js';
+
+export const AVATAR_DIR = path.resolve(path.dirname(config.content.usersDir), 'avatars');
+export const AVATAR_PREFIX = '/api/auth/avatar/';
+export const AVATAR_MAX_BYTES = 8 * 1024 * 1024;
+export const AVATAR_SIZE = 256;
+/** A stored avatar's file name: `<user id>-<random>.webp`. */
+export const AVATAR_FILE = /^[A-Za-z0-9_-]{1,80}-[a-f0-9]{16}\.webp$/;
+
+const ACCEPTED = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif', 'image/heic', 'image/heif']);
+
+/** Is this upload type one we take? (sharp decides for certain.) */
+export const acceptedType = (mime) => ACCEPTED.has(String(mime || '').toLowerCase());
+
+/**
+ * Re-encode an uploaded image as the avatar.
+ *
+ * @param   {Buffer} input
+ * @returns {Promise<Buffer>} a 256x256 WebP
+ * @throws  {Error} code 'BAD_IMAGE' when it is not an image sharp can read
+ */
+export async function toAvatar(input) {
+    try {
+        return await sharp(input, {limitInputPixels: 50_000_000, animated: false})
+            .rotate()
+            .resize(AVATAR_SIZE, AVATAR_SIZE, {fit: 'cover', position: 'attention'})
+            .webp({quality: 84})
+            .toBuffer();
+    } catch {
+        const err = new Error('That file is not an image we can read. Try a JPEG, PNG or WebP.');
+        err.code = 'BAD_IMAGE';
+        throw err;
+    }
+}
+
+/** The file an avatar address points at, or null for anything that is not one of ours. */
+export function avatarFile(address) {
+    const name = String(address || '').startsWith(AVATAR_PREFIX) ? String(address).slice(AVATAR_PREFIX.length).split('?')[0] : '';
+    return AVATAR_FILE.test(name) ? path.join(AVATAR_DIR, name) : null;
+}
+
+/**
+ * Store a user's new avatar; returns its address.
+ *
+ * @param {string} userId
+ * @param {Buffer} webp - from toAvatar()
+ */
+export async function saveAvatar(userId, webp) {
+    await fs.mkdir(AVATAR_DIR, {recursive: true});
+    const safeId = String(userId).replace(/[^A-Za-z0-9_-]/g, '').slice(0, 80) || 'user';
+    const name = `${safeId}-${crypto.randomBytes(8).toString('hex')}.webp`;
+    await fs.writeFile(path.join(AVATAR_DIR, name), webp);
+    return `${AVATAR_PREFIX}${name}`;
+}
+
+/** Delete the file behind an avatar address (quietly: it may be gone already). */
+export async function removeAvatar(address) {
+    const file = avatarFile(address);
+    if (file) await fs.rm(file, {force: true}).catch(() => {});
+}

package/server/services/network.js

@@ -0,0 +1,49 @@
+/**
+ * Network trust - who a request is really from.
+ *
+ * A Domma CMS sits behind proxies: Apache in front of the manager, and the
+ * manager in front of each site. Two things follow, and both went wrong:
+ *
+ * 1. TRUST_PROXY used to be a yes/no. "Yes" trusts EVERY hop, and Fastify then
+ *    takes the LEFT-most X-Forwarded-For entry - whatever the visitor chose to
+ *    send. `loopback` trusts only local proxies and takes the right-most entry
+ *    they did not add, which is the address Apache saw. So TRUST_PROXY now also
+ *    takes Fastify's own values: `loopback`, a list of addresses/CIDRs, or a hop
+ *    count. `1` / `true` keep their old meaning.
+ *
+ * 2. Loopback was exempt from rate limiting ("local admin use"). Behind a proxy
+ *    that trusts nothing - dcm, until 2026-09 - EVERY visitor is loopback, so
+ *    nothing was ever limited, the login included. Only a GENUINELY local call
+ *    (loopback socket, no forwarding header) is exempt now.
+ */
+
+const LOOPBACK = /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/;
+
+/**
+ * Fastify's `trustProxy` from the TRUST_PROXY environment value.
+ *
+ * @param {string|undefined} value
+ * @returns {boolean|string|number}
+ */
+export function parseTrustProxy(value) {
+    const v = String(value ?? '').trim();
+    if (!v || /^(0|false|no|off)$/i.test(v)) return false;
+    if (/^(1|true|yes|on)$/i.test(v)) return true;
+    if (/^\d+$/.test(v)) return Number(v);    // a hop count
+    return v;                                  // 'loopback', 'uniquelocal', or addresses/CIDRs, comma-separated
+}
+
+/** Is this address a loopback one? */
+export const isLoopback = (ip) => LOOPBACK.test(String(ip ?? ''));
+
+/**
+ * A call from this machine itself - a health check, a cron job, the manager
+ * asking one of its sites - and NOT a visitor relayed by a local proxy.
+ *
+ * @param {{socket?: {remoteAddress?: string}, raw?: {socket?: {remoteAddress?: string}}, headers?: object}} request
+ */
+export function isGenuinelyLocal(request) {
+    const peer = request?.raw?.socket?.remoteAddress ?? request?.socket?.remoteAddress ?? '';
+    const forwarded = request?.headers?.['x-forwarded-for'];
+    return isLoopback(peer) && !forwarded;
+}

package/server/services/plugins.js

@@ -35,6 +35,7 @@ import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
 import {normaliseAdminScope} from './roles.js';
 import * as defaultUsersService from './users.js';
+import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 
@@ -486,7 +487,10 @@ export async function registerPlugins(fastify) {
                   on: hooks.on.bind(hooks), ...pluginRoleHooks(manifest.name),
                   // Notifications (0.80) - notify, resolveNotification, registerNotificationSource,
                   // stamped with the plugin's name (its source ids are `<plugin>:<id>`).
-                  ...notifierFor(manifest.name, manifest.displayName || manifest.name)},
+                  ...notifierFor(manifest.name, manifest.displayName || manifest.name),
+                  // Sign-in and password checks (0.83) - Security / Security Pro. services/authChecks.js.
+                  registerLoginCheck: (def) => registerLoginCheck(manifest.name, def),
+                  registerPasswordCheck: (def) => registerPasswordCheck(manifest.name, def)},
               settings,
               config: {}
           });

package/server/services/sessions.js

@@ -0,0 +1,171 @@
+/**
+ * Sessions - one per sign-in, behind each refresh token.
+ *
+ * A refresh token carries `sid`, the id of its session here. Signing out,
+ * "sign out everywhere", a password change or reset revoke sessions in this
+ * store, which is a file - so a signed-out session STAYS signed out across a
+ * restart. (Until 0.83 revoked refresh tokens were an in-memory Set: a restart
+ * brought every one of them back for the rest of their 7 days.)
+ *
+ * Each session records who, when it began and was last used, and from where
+ * (address, browser) - Security Pro's Sessions screen shows them. Only ids are
+ * stored, never a token.
+ *
+ * Refresh tokens issued before 0.83 have no `sid`. They stay valid until they
+ * expire, unless signed out: then their hash is kept here until their expiry.
+ *
+ * content/sessions/ is runtime state - never committed (siteGitignore.js).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {config} from '../config.js';
+
+export const SESSIONS_FILE = path.resolve(path.dirname(config.content.usersDir), 'sessions', 'sessions.json');
+const MAX_PER_USER = 50;
+
+let cache = null;
+let queue = Promise.resolve();
+
+async function load() {
+    if (cache) return cache;
+    try {
+        const raw = JSON.parse(await fs.readFile(SESSIONS_FILE, 'utf8'));
+        cache = {sessions: raw.sessions && typeof raw.sessions === 'object' ? raw.sessions : {}, legacy: raw.legacy && typeof raw.legacy === 'object' ? raw.legacy : {}};
+    } catch {
+        cache = {sessions: {}, legacy: {}};
+    }
+    return cache;
+}
+
+/** Expired sessions and legacy revocations go; the oldest go past MAX_PER_USER. */
+function prune(store, now = Date.now()) {
+    for (const [sid, s] of Object.entries(store.sessions)) {
+        if (Date.parse(s.expiresAt) < now || (s.revokedAt && Date.parse(s.revokedAt) < now - 7 * 86400000)) delete store.sessions[sid];
+    }
+    for (const [h, exp] of Object.entries(store.legacy)) if (exp < now) delete store.legacy[h];
+    const byUser = {};
+    for (const [sid, s] of Object.entries(store.sessions)) (byUser[s.userId] ??= []).push([sid, s]);
+    for (const list of Object.values(byUser)) {
+        if (list.length <= MAX_PER_USER) continue;
+        list.sort((a, b) => Date.parse(a[1].lastUsedAt) - Date.parse(b[1].lastUsedAt));
+        for (const [sid] of list.slice(0, list.length - MAX_PER_USER)) delete store.sessions[sid];
+    }
+}
+
+/** Serialise writes: two sign-ins at once must not lose one. */
+function change(fn) {
+    const run = queue.then(async () => {
+        const store = await load();
+        const out = await fn(store);
+        prune(store);
+        await fs.mkdir(path.dirname(SESSIONS_FILE), {recursive: true});
+        const tmp = `${SESSIONS_FILE}.${process.pid}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify(store), {mode: 0o600});
+        await fs.rename(tmp, SESSIONS_FILE);
+        return out;
+    });
+    queue = run.catch(() => {});
+    return run;
+}
+
+const clip = (s, n) => String(s ?? '').slice(0, n);
+
+/**
+ * Begin a session.
+ *
+ * @param {{userId: string, ip?: string, ua?: string, ttlMs: number}} opts
+ * @returns {Promise<string>} the session id, for the refresh token's `sid`
+ */
+export function createSession({userId, ip = '', ua = '', ttlMs}) {
+    const sid = crypto.randomBytes(16).toString('hex');
+    const now = new Date();
+    return change((store) => {
+        store.sessions[sid] = {
+            userId: String(userId),
+            createdAt: now.toISOString(),
+            lastUsedAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+            ip: clip(ip, 64), ua: clip(ua, 300)
+        };
+        return sid;
+    });
+}
+
+/**
+ * A refresh: is the session live? Records the use. Null when it is unknown,
+ * revoked, expired or someone else's.
+ *
+ * @param {string} sid
+ * @param {{userId: string, ip?: string, ua?: string}} who
+ */
+export async function useSession(sid, {userId, ip = '', ua = ''}) {
+    const store = await load();
+    const s = store.sessions[sid];
+    if (!s || s.revokedAt || s.userId !== String(userId) || Date.parse(s.expiresAt) < Date.now()) return null;
+    // Written at most once a minute per session: a refresh every 15 minutes is the normal rate.
+    if (Date.now() - Date.parse(s.lastUsedAt) > 60_000 || s.ip !== clip(ip, 64)) {
+        await change((st) => {
+            const live = st.sessions[sid];
+            if (live) Object.assign(live, {lastUsedAt: new Date().toISOString(), ip: clip(ip, 64), ua: clip(ua, 300) || live.ua});
+        });
+    }
+    return {...s, sid};
+}
+
+/** Revoke one session. True when there was a live one. */
+export function revokeSession(sid, {userId = null} = {}) {
+    return change((store) => {
+        const s = store.sessions[sid];
+        if (!s || s.revokedAt || (userId && s.userId !== String(userId))) return false;
+        s.revokedAt = new Date().toISOString();
+        return true;
+    });
+}
+
+/** Revoke every live session of a user (but `except`). Returns how many. */
+export function revokeUserSessions(userId, {except = null} = {}) {
+    return change((store) => {
+        let n = 0;
+        for (const [sid, s] of Object.entries(store.sessions)) {
+            if (s.userId === String(userId) && !s.revokedAt && sid !== except) {
+                s.revokedAt = new Date().toISOString();
+                n++;
+            }
+        }
+        return n;
+    });
+}
+
+/**
+ * Live sessions, newest use first - one user's, or everyone's.
+ *
+ * @param {{userId?: string}} [opts]
+ * @returns {Promise<{sid: string, userId: string, createdAt: string, lastUsedAt: string, expiresAt: string, ip: string, ua: string}[]>}
+ */
+export async function listSessions({userId = null} = {}) {
+    const store = await load();
+    const now = Date.now();
+    return Object.entries(store.sessions)
+        .filter(([, s]) => !s.revokedAt && Date.parse(s.expiresAt) >= now && (!userId || s.userId === String(userId)))
+        .map(([sid, s]) => ({sid, ...s}))
+        .sort((a, b) => Date.parse(b.lastUsedAt) - Date.parse(a.lastUsedAt));
+}
+
+const tokenHash = (token) => crypto.createHash('sha256').update(String(token)).digest('hex');
+
+/** A pre-0.83 refresh token (no sid) signed out: remembered until it would have expired. */
+export function revokeLegacyToken(token, expSeconds) {
+    const exp = Number(expSeconds) * 1000 || Date.now() + 7 * 86400000;
+    return change((store) => { store.legacy[tokenHash(token)] = exp; });
+}
+
+export async function isLegacyTokenRevoked(token) {
+    const store = await load();
+    return Boolean(store.legacy[tokenHash(token)]);
+}
+
+/** Tests: forget the cached store (the file stays). */
+export function _resetCache() {
+    cache = null;
+}

package/server/services/siteGitignore.js

@@ -195,6 +195,7 @@ export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic
     for (const c of PRIVATE_DATA) L.push(`/content/collections/${c}/data.json`);
     L.push(
         '/content/users/',
+        '/content/sessions/',
         '/content/versions/',
         '/content/analytics/',
         '/content/instances_log.json',

package/server/services/users.js

@@ -219,7 +219,12 @@ export async function deleteUser(id) {
         throw new Error('Invalid user ID');
     }
     const filePath = path.join(USERS_DIR, `${id}.json`);
+    const avatar = (await readUserFile(id).catch(() => null))?.avatar;
     await fs.unlink(filePath);
+    if (avatar) {
+        const {removeAvatar} = await import('./avatars.js');
+        await removeAvatar(avatar);
+    }
     try {
         await deleteProfile(id);
     } catch {