domma-cms 0.82.0 → 0.83.0

package/server/services/network.js

@@ -0,0 +1,49 @@
+/**
+ * Network trust - who a request is really from.
+ *
+ * A Domma CMS sits behind proxies: Apache in front of the manager, and the
+ * manager in front of each site. Two things follow, and both went wrong:
+ *
+ * 1. TRUST_PROXY used to be a yes/no. "Yes" trusts EVERY hop, and Fastify then
+ *    takes the LEFT-most X-Forwarded-For entry - whatever the visitor chose to
+ *    send. `loopback` trusts only local proxies and takes the right-most entry
+ *    they did not add, which is the address Apache saw. So TRUST_PROXY now also
+ *    takes Fastify's own values: `loopback`, a list of addresses/CIDRs, or a hop
+ *    count. `1` / `true` keep their old meaning.
+ *
+ * 2. Loopback was exempt from rate limiting ("local admin use"). Behind a proxy
+ *    that trusts nothing - dcm, until 2026-09 - EVERY visitor is loopback, so
+ *    nothing was ever limited, the login included. Only a GENUINELY local call
+ *    (loopback socket, no forwarding header) is exempt now.
+ */
+
+const LOOPBACK = /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/;
+
+/**
+ * Fastify's `trustProxy` from the TRUST_PROXY environment value.
+ *
+ * @param {string|undefined} value
+ * @returns {boolean|string|number}
+ */
+export function parseTrustProxy(value) {
+    const v = String(value ?? '').trim();
+    if (!v || /^(0|false|no|off)$/i.test(v)) return false;
+    if (/^(1|true|yes|on)$/i.test(v)) return true;
+    if (/^\d+$/.test(v)) return Number(v);    // a hop count
+    return v;                                  // 'loopback', 'uniquelocal', or addresses/CIDRs, comma-separated
+}
+
+/** Is this address a loopback one? */
+export const isLoopback = (ip) => LOOPBACK.test(String(ip ?? ''));
+
+/**
+ * A call from this machine itself - a health check, a cron job, the manager
+ * asking one of its sites - and NOT a visitor relayed by a local proxy.
+ *
+ * @param {{socket?: {remoteAddress?: string}, raw?: {socket?: {remoteAddress?: string}}, headers?: object}} request
+ */
+export function isGenuinelyLocal(request) {
+    const peer = request?.raw?.socket?.remoteAddress ?? request?.socket?.remoteAddress ?? '';
+    const forwarded = request?.headers?.['x-forwarded-for'];
+    return isLoopback(peer) && !forwarded;
+}

package/server/services/plugins.js

@@ -35,6 +35,7 @@ import {createCollection, getCollection} from './collections.js';
 import * as defaultRolesService from './roles.js';
 import {normaliseAdminScope} from './roles.js';
 import * as defaultUsersService from './users.js';
+import {registerLoginCheck, registerPasswordCheck} from './authChecks.js';
 
 const PLUGINS_DIR = path.resolve('plugins');
 
@@ -486,7 +487,10 @@ export async function registerPlugins(fastify) {
                   on: hooks.on.bind(hooks), ...pluginRoleHooks(manifest.name),
                   // Notifications (0.80) - notify, resolveNotification, registerNotificationSource,
                   // stamped with the plugin's name (its source ids are `<plugin>:<id>`).
-                  ...notifierFor(manifest.name, manifest.displayName || manifest.name)},
+                  ...notifierFor(manifest.name, manifest.displayName || manifest.name),
+                  // Sign-in and password checks (0.83) - Security / Security Pro. services/authChecks.js.
+                  registerLoginCheck: (def) => registerLoginCheck(manifest.name, def),
+                  registerPasswordCheck: (def) => registerPasswordCheck(manifest.name, def)},
               settings,
               config: {}
           });

package/server/services/sessions.js

@@ -0,0 +1,171 @@
+/**
+ * Sessions - one per sign-in, behind each refresh token.
+ *
+ * A refresh token carries `sid`, the id of its session here. Signing out,
+ * "sign out everywhere", a password change or reset revoke sessions in this
+ * store, which is a file - so a signed-out session STAYS signed out across a
+ * restart. (Until 0.83 revoked refresh tokens were an in-memory Set: a restart
+ * brought every one of them back for the rest of their 7 days.)
+ *
+ * Each session records who, when it began and was last used, and from where
+ * (address, browser) - Security Pro's Sessions screen shows them. Only ids are
+ * stored, never a token.
+ *
+ * Refresh tokens issued before 0.83 have no `sid`. They stay valid until they
+ * expire, unless signed out: then their hash is kept here until their expiry.
+ *
+ * content/sessions/ is runtime state - never committed (siteGitignore.js).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {config} from '../config.js';
+
+export const SESSIONS_FILE = path.resolve(path.dirname(config.content.usersDir), 'sessions', 'sessions.json');
+const MAX_PER_USER = 50;
+
+let cache = null;
+let queue = Promise.resolve();
+
+async function load() {
+    if (cache) return cache;
+    try {
+        const raw = JSON.parse(await fs.readFile(SESSIONS_FILE, 'utf8'));
+        cache = {sessions: raw.sessions && typeof raw.sessions === 'object' ? raw.sessions : {}, legacy: raw.legacy && typeof raw.legacy === 'object' ? raw.legacy : {}};
+    } catch {
+        cache = {sessions: {}, legacy: {}};
+    }
+    return cache;
+}
+
+/** Expired sessions and legacy revocations go; the oldest go past MAX_PER_USER. */
+function prune(store, now = Date.now()) {
+    for (const [sid, s] of Object.entries(store.sessions)) {
+        if (Date.parse(s.expiresAt) < now || (s.revokedAt && Date.parse(s.revokedAt) < now - 7 * 86400000)) delete store.sessions[sid];
+    }
+    for (const [h, exp] of Object.entries(store.legacy)) if (exp < now) delete store.legacy[h];
+    const byUser = {};
+    for (const [sid, s] of Object.entries(store.sessions)) (byUser[s.userId] ??= []).push([sid, s]);
+    for (const list of Object.values(byUser)) {
+        if (list.length <= MAX_PER_USER) continue;
+        list.sort((a, b) => Date.parse(a[1].lastUsedAt) - Date.parse(b[1].lastUsedAt));
+        for (const [sid] of list.slice(0, list.length - MAX_PER_USER)) delete store.sessions[sid];
+    }
+}
+
+/** Serialise writes: two sign-ins at once must not lose one. */
+function change(fn) {
+    const run = queue.then(async () => {
+        const store = await load();
+        const out = await fn(store);
+        prune(store);
+        await fs.mkdir(path.dirname(SESSIONS_FILE), {recursive: true});
+        const tmp = `${SESSIONS_FILE}.${process.pid}.tmp`;
+        await fs.writeFile(tmp, JSON.stringify(store), {mode: 0o600});
+        await fs.rename(tmp, SESSIONS_FILE);
+        return out;
+    });
+    queue = run.catch(() => {});
+    return run;
+}
+
+const clip = (s, n) => String(s ?? '').slice(0, n);
+
+/**
+ * Begin a session.
+ *
+ * @param {{userId: string, ip?: string, ua?: string, ttlMs: number}} opts
+ * @returns {Promise<string>} the session id, for the refresh token's `sid`
+ */
+export function createSession({userId, ip = '', ua = '', ttlMs}) {
+    const sid = crypto.randomBytes(16).toString('hex');
+    const now = new Date();
+    return change((store) => {
+        store.sessions[sid] = {
+            userId: String(userId),
+            createdAt: now.toISOString(),
+            lastUsedAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+            ip: clip(ip, 64), ua: clip(ua, 300)
+        };
+        return sid;
+    });
+}
+
+/**
+ * A refresh: is the session live? Records the use. Null when it is unknown,
+ * revoked, expired or someone else's.
+ *
+ * @param {string} sid
+ * @param {{userId: string, ip?: string, ua?: string}} who
+ */
+export async function useSession(sid, {userId, ip = '', ua = ''}) {
+    const store = await load();
+    const s = store.sessions[sid];
+    if (!s || s.revokedAt || s.userId !== String(userId) || Date.parse(s.expiresAt) < Date.now()) return null;
+    // Written at most once a minute per session: a refresh every 15 minutes is the normal rate.
+    if (Date.now() - Date.parse(s.lastUsedAt) > 60_000 || s.ip !== clip(ip, 64)) {
+        await change((st) => {
+            const live = st.sessions[sid];
+            if (live) Object.assign(live, {lastUsedAt: new Date().toISOString(), ip: clip(ip, 64), ua: clip(ua, 300) || live.ua});
+        });
+    }
+    return {...s, sid};
+}
+
+/** Revoke one session. True when there was a live one. */
+export function revokeSession(sid, {userId = null} = {}) {
+    return change((store) => {
+        const s = store.sessions[sid];
+        if (!s || s.revokedAt || (userId && s.userId !== String(userId))) return false;
+        s.revokedAt = new Date().toISOString();
+        return true;
+    });
+}
+
+/** Revoke every live session of a user (but `except`). Returns how many. */
+export function revokeUserSessions(userId, {except = null} = {}) {
+    return change((store) => {
+        let n = 0;
+        for (const [sid, s] of Object.entries(store.sessions)) {
+            if (s.userId === String(userId) && !s.revokedAt && sid !== except) {
+                s.revokedAt = new Date().toISOString();
+                n++;
+            }
+        }
+        return n;
+    });
+}
+
+/**
+ * Live sessions, newest use first - one user's, or everyone's.
+ *
+ * @param {{userId?: string}} [opts]
+ * @returns {Promise<{sid: string, userId: string, createdAt: string, lastUsedAt: string, expiresAt: string, ip: string, ua: string}[]>}
+ */
+export async function listSessions({userId = null} = {}) {
+    const store = await load();
+    const now = Date.now();
+    return Object.entries(store.sessions)
+        .filter(([, s]) => !s.revokedAt && Date.parse(s.expiresAt) >= now && (!userId || s.userId === String(userId)))
+        .map(([sid, s]) => ({sid, ...s}))
+        .sort((a, b) => Date.parse(b.lastUsedAt) - Date.parse(a.lastUsedAt));
+}
+
+const tokenHash = (token) => crypto.createHash('sha256').update(String(token)).digest('hex');
+
+/** A pre-0.83 refresh token (no sid) signed out: remembered until it would have expired. */
+export function revokeLegacyToken(token, expSeconds) {
+    const exp = Number(expSeconds) * 1000 || Date.now() + 7 * 86400000;
+    return change((store) => { store.legacy[tokenHash(token)] = exp; });
+}
+
+export async function isLegacyTokenRevoked(token) {
+    const store = await load();
+    return Boolean(store.legacy[tokenHash(token)]);
+}
+
+/** Tests: forget the cached store (the file stays). */
+export function _resetCache() {
+    cache = null;
+}

package/server/services/siteGitignore.js

@@ -195,6 +195,7 @@ export function buildGitignore({sitePlugins = [], pluginContent = {}, sitePublic
     for (const c of PRIVATE_DATA) L.push(`/content/collections/${c}/data.json`);
     L.push(
         '/content/users/',
+        '/content/sessions/',
         '/content/versions/',
         '/content/analytics/',
         '/content/instances_log.json',