domma-cms 0.82.0 → 0.84.0

package/plugins/security/server/facts.js

@@ -0,0 +1,135 @@
+/**
+ * Security - the facts the health check judges (admin/lib/health.js does the
+ * judging). Everything here is read-only and time-boxed: a check that cannot
+ * be answered in a few seconds is reported as unknown, never as a pass.
+ *
+ * Slow answers (the latest engine version, the certificate) are cached.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import tls from 'node:tls';
+import {getConfig} from '../../../server/config.js';
+import {listUsers} from '../../../server/services/users.js';
+import {getEffectiveLevel} from '../../../server/services/userRoles.js';
+import {getEntitlementStates} from '../../../server/services/plugins.js';
+
+const CMS_ROOT = process.cwd();
+const TIMEOUT = 5000;
+const cache = new Map();
+
+async function cached(key, ms, fn) {
+    const hit = cache.get(key);
+    if (hit && hit.until > Date.now()) return hit.value;
+    const value = await fn();
+    cache.set(key, {value, until: Date.now() + ms});
+    return value;
+}
+
+const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+
+/** The engine's own version, and npm's latest (cached 12 h; null when unreachable). */
+async function engine() {
+    // The engine's version: .domma's cmsVersion (the updater stamps it). A site's own package.json
+    // carries the SITE's version; only the engine's repo has no .domma.
+    const installed = readJson(path.join(CMS_ROOT, '.domma'))?.cmsVersion || readJson(path.join(CMS_ROOT, 'package.json'))?.version || null;
+    const latest = await cached('latest', 12 * 3_600_000, async () => {
+        try {
+            const res = await fetch('https://registry.npmjs.org/domma-cms/latest', {signal: AbortSignal.timeout(TIMEOUT)});
+            return res.ok ? (await res.json()).version || null : null;
+        } catch { return null; }
+    });
+    return {installed, latest};
+}
+
+/** Days left on the certificate the site serves (cached 6 h). */
+function certificate(host) {
+    return cached(`cert:${host}`, 6 * 3_600_000, () => new Promise((resolve) => {
+        const done = (v) => { try { socket.destroy(); } catch { /* gone */ } resolve(v); };
+        const socket = tls.connect({host, port: 443, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
+            const c = socket.getPeerCertificate();
+            if (!c?.valid_to) return done({daysLeft: null, error: 'no certificate'});
+            done({daysLeft: Math.floor((Date.parse(c.valid_to) - Date.now()) / 86_400_000), issuer: c.issuer?.O || c.issuer?.CN || ''});
+        });
+        socket.on('timeout', () => done({daysLeft: null, error: 'timed out'}));
+        socket.on('error', (e) => done({daysLeft: null, error: e.code || e.message}));
+    }));
+}
+
+/** The security headers the public home page is served with. */
+async function headers(origin) {
+    try {
+        const res = await fetch(`${origin}/`, {redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT), headers: {'user-agent': 'Domma Security health check'}});
+        const h = (n) => res.headers.get(n) || '';
+        const csp = h('content-security-policy');
+        return {
+            https: origin.startsWith('https:'),
+            csp: Boolean(csp),
+            nosniff: /nosniff/i.test(h('x-content-type-options')),
+            frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
+            referrer: Boolean(h('referrer-policy')),
+            hsts: Boolean(h('strict-transport-security'))
+        };
+    } catch (e) {
+        return {error: e.name === 'TimeoutError' ? 'timed out' : (e.cause?.code || e.message)};
+    }
+}
+
+/** Private paths asked of the CMS itself (locally, so Security's own probe filter does not hide them). */
+const PRIVATE = ['/.env', '/.git/config', '/config/server.json', '/content/users/', '/config/auth.json', '/.env.example'];
+async function probeFiles(port) {
+    const out = [];
+    for (const p of PRIVATE) {
+        try {
+            const res = await fetch(`http://127.0.0.1:${port}${p}`, {redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT)});
+            out.push({path: p, status: res.status});
+        } catch {
+            out.push({path: p, status: 0});
+        }
+    }
+    return out;
+}
+
+const isLocalHost = (h) => !h || h === 'localhost' || /^[\d.]+$/.test(h) || h.includes(':') || h.endsWith('.local') || h.endsWith('.test');
+
+/**
+ * Everything the health check needs.
+ *
+ * @param {import('fastify').FastifyRequest} request - the admin asking (its host is the site's)
+ * @param {{settings: object, checks: boolean, twoFactor?: boolean}} ctx
+ */
+export async function gatherFacts(request, {settings, checks, twoFactor = false}) {
+    const server = readJson(path.join(CMS_ROOT, 'config', 'server.json')) || {};
+    const port = Number(process.env.PORT) || server.port || 4096;
+    const host = String(request.hostname || '').split(':')[0];
+    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+    const origin = isLocalHost(host) ? `http://127.0.0.1:${port}` : `${proto}://${host}`;
+
+    const users = (await listUsers()).map(u => ({name: u.name, email: u.email, role: u.role, lastLogin: u.lastLogin || null,
+        createdAt: u.createdAt || null, isActive: u.isActive !== false, level: getEffectiveLevel(u)}));
+    const trustRaw = String(process.env.TRUST_PROXY ?? '').trim();
+    const trust = !trustRaw || /^(0|false|no|off)$/i.test(trustRaw) ? false : /^(1|true|yes|on)$/i.test(trustRaw) ? true : trustRaw;
+
+    const [eng, cert, head, probes] = await Promise.all([
+        engine(),
+        isLocalHost(host) ? Promise.resolve(null) : certificate(host),
+        headers(origin),
+        probeFiles(port)
+    ]);
+    const smtp = getConfig('site')?.smtp || {};
+    return {
+        admins: users.filter(u => u.isActive && u.level <= 1),
+        users: users.filter(u => u.isActive),
+        engine: eng,
+        cert,
+        headers: head,
+        probeFiles: probes,
+        nodeEnv: process.env.NODE_ENV || '',
+        proxy: {via: Boolean(request.headers['x-forwarded-for']), trust},
+        bind: server.host || '',
+        smtp: Boolean(smtp.host),
+        licences: Object.entries(getEntitlementStates()).map(([name, state]) => ({name, state})),
+        protections: {checks, lockout: checks && settings.lockout.enabled, policy: checks && settings.policy.enabled},
+        policyMin: settings.policy.minLength,
+        twoFactor
+    };
+}

package/plugins/security/server/state.js

@@ -0,0 +1,106 @@
+/**
+ * Security - what it remembers, in the plugin's data/ (kept by every update and
+ * copy; never in a catalogue bundle):
+ *
+ *   state.json   - lockouts (lockout.js), blocks: manual rules and temporary
+ *                  blocks, addresses recently signed in from, today's counters
+ *   signins.jsonl - one line per sign-in attempt, for the Sign-ins screen
+ *
+ * state.json is held in memory and written (debounced) on change. The file is
+ * re-read when it changes underneath - bin/unlock.js edits it while the site
+ * runs, and that must win.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+const EMPTY = () => ({lockouts: {}, rules: [], temp: {}, trusted: {}, counters: {day: '', probes: 0, blocks: 0, failed: 0}});
+
+export function createState(dataDir) {
+    fs.mkdirSync(dataDir, {recursive: true});
+    const file = path.join(dataDir, 'state.json');
+    const logFile = path.join(dataDir, 'signins.jsonl');
+    let state = EMPTY();
+    let ownMtime = 0;
+    let timer = null;
+
+    function read() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+            state = {...EMPTY(), ...raw, counters: {...EMPTY().counters, ...(raw.counters || {})}};
+            ownMtime = fs.statSync(file).mtimeMs;
+        } catch { /* first run */ }
+    }
+    function write() {
+        clearTimeout(timer);
+        timer = null;
+        try {
+            const tmp = `${file}.${process.pid}.tmp`;
+            fs.writeFileSync(tmp, JSON.stringify(state));
+            fs.renameSync(tmp, file);
+            ownMtime = fs.statSync(file).mtimeMs;
+        } catch (e) {
+            console.error('[security] could not save state:', e.message);
+        }
+    }
+    read();
+
+    // Someone else (the unlock CLI) wrote it: theirs wins.
+    const watch = setInterval(() => {
+        try {
+            const m = fs.statSync(file).mtimeMs;
+            if (m !== ownMtime && !timer) read();
+        } catch { /* not written yet */ }
+    }, 3000);
+    watch.unref?.();
+
+    const today = () => new Date().toISOString().slice(0, 10);
+    return {
+        get: () => state,
+        /** Change it; saved within a second. */
+        change(fn) {
+            const out = fn(state);
+            if (!timer) {
+                timer = setTimeout(write, 800);
+                timer.unref?.();
+            }
+            return out;
+        },
+        flush: write,
+        count(name) {
+            this.change((s) => {
+                if (s.counters.day !== today()) s.counters = {day: today(), probes: 0, blocks: 0, failed: 0};
+                s.counters[name] = (s.counters[name] || 0) + 1;
+            });
+        },
+        /** One sign-in attempt, appended. */
+        logSignin(entry) {
+            fs.appendFile(logFile, `${JSON.stringify(entry)}\n`, () => {});
+        },
+        /** Sign-in attempts newer than `sinceMs`, newest first. */
+        readSignins(sinceMs) {
+            let raw = '';
+            try { raw = fs.readFileSync(logFile, 'utf8'); } catch { return []; }
+            const out = [];
+            for (const line of raw.split('\n')) {
+                if (!line) continue;
+                try {
+                    const e = JSON.parse(line);
+                    if (Date.parse(e.at) >= sinceMs) out.push(e);
+                } catch { /* a torn line */ }
+            }
+            return out.reverse();
+        },
+        /** Keep `days` of sign-ins. */
+        pruneSignins(days) {
+            const keep = this.readSignins(Date.now() - days * 86_400_000).reverse();
+            try {
+                fs.writeFileSync(`${logFile}.tmp`, keep.map(e => JSON.stringify(e)).join('\n') + (keep.length ? '\n' : ''));
+                fs.renameSync(`${logFile}.tmp`, logFile);
+            } catch { /* next time */ }
+        },
+        close() {
+            clearInterval(watch);
+            if (timer) write();
+        }
+    };
+}

package/plugins/security/tests/security.test.js

@@ -0,0 +1,134 @@
+/** Security - the pure parts: probes, lockout, blocks, password rules, settings, health. */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {isProbe} from '../admin/lib/probes.js';
+import {accountKey, activeLocks, addressKey, lockedUntil, pruneLockouts, recordFailure, recordSuccess, retryText} from '../admin/lib/lockout.js';
+import {blockedBy, isTrusted, pruneBlocks, recordProbe} from '../admin/lib/blocks.js';
+import {ipMatches, ipRuleValid, isLoopbackIp} from '../admin/lib/ip.js';
+import {passwordProblems} from '../admin/lib/policy.js';
+import {checkSettings, DEFAULT_SETTINGS, mergeDefaults} from '../admin/lib/settings.js';
+import {evaluate} from '../admin/lib/health.js';
+
+const MIN = 60_000;
+
+test('probes: what scanners ask for, not what a site serves', () => {
+    for (const p of ['/wp-login.php', '/wp-admin/install.php', '/.env', '/.git/config', '/xmlrpc.php', '/shop/index.php', '/a/../../etc/passwd', '/%2e%65nv'.replace('%2e%65', '.e'), '/phpmyadmin/', '/backup.sql']) {
+        assert.equal(isProbe(p), true, p);
+    }
+    for (const p of ['/', '/about', '/blog/my-post', '/media/photo.jpg', '/wordpress-tips', '/environment', '/admin']) {
+        assert.equal(isProbe(p), false, p);
+    }
+    assert.equal(isProbe('/secret-thing', {extra: ['/secret-thing']}), true);
+    assert.equal(isProbe('/legacy/index.php', {allow: ['/legacy/']}), false, 'a site that does serve it says so');
+    assert.equal(isProbe('/.ENV'), true, 'case does not matter');
+});
+
+test('lockout: 5 wrong on an account locks it, each lock twice as long, a success clears it', () => {
+    const s = {};
+    const k = accountKey('Sam@X.com');
+    let now = 1_000_000;
+    for (let i = 0; i < 4; i++) assert.equal(recordFailure(s, k, {now: now + i}), 0);
+    const first = recordFailure(s, k, {now: now + 5});
+    assert.equal(first, now + 5 + MIN);
+    assert.equal(lockedUntil(s, k, now + 10), first);
+    now += 2 * MIN;
+    assert.equal(lockedUntil(s, k, now), 0, 'the lock ended');
+    for (let i = 0; i < 5; i++) recordFailure(s, k, {now: now + i});
+    assert.equal(lockedUntil(s, k, now + 5), now + 4 + 2 * MIN, 'the second lock is twice as long');
+    recordSuccess(s, k);
+    assert.equal(lockedUntil(s, k, now + 5), 0);
+    // An address takes 20 (offices share one), and failures outside the window do not add up.
+    const a = addressKey('81.2.69.142');
+    for (let i = 0; i < 19; i++) recordFailure(s, a, {now: now + i});
+    assert.equal(lockedUntil(s, a, now + 20), 0);
+    assert.ok(recordFailure(s, a, {now: now + 20}) > 0);
+    const w = accountKey('w@x');
+    for (let i = 0; i < 4; i++) recordFailure(s, w, {now: now + i});
+    assert.equal(recordFailure(s, w, {now: now + 16 * MIN}), 0, 'the old four were outside the window');
+    assert.equal(activeLocks(s, now + 30).length, 1);
+    assert.equal(retryText(now + 90 * MIN, now), 'in 2 hours');
+    assert.equal(retryText(now + 30_000, now), 'in 1 minute');
+    pruneLockouts(s, {now: now + 3 * 86_400_000});
+    assert.deepEqual(Object.keys(s), []);
+});
+
+test('blocks: rules and temporary blocks; loopback never; recently signed-in addresses are trusted', () => {
+    const now = Date.parse('2026-09-26T12:00:00Z');
+    const state = {rules: [{rule: '10.0.0.0/8', note: 'office VPN'}], temp: {'81.2.69.142': {until: now + MIN, reason: 'Probing'}}, trusted: {'2.2.2.2': now - 86_400_000}};
+    assert.equal(blockedBy(state, '10.1.2.3', now).kind, 'rule');
+    assert.equal(blockedBy(state, '::ffff:81.2.69.142', now).kind, 'temp');
+    assert.equal(blockedBy(state, '81.2.69.142', now + 2 * MIN), null, 'ended');
+    assert.equal(blockedBy({rules: [{rule: '127.0.0.1'}]}, '127.0.0.1', now), null, 'loopback is never blocked');
+    assert.equal(isTrusted(state, '2.2.2.2', now), true);
+    assert.equal(isTrusted(state, '3.3.3.3', now), false);
+    const recent = new Map();
+    for (let i = 0; i < 4; i++) assert.equal(recordProbe(recent, '9.9.9.9', {now: now + i}), false);
+    assert.equal(recordProbe(recent, '9.9.9.9', {now: now + 5}), true);
+    pruneBlocks(state, now + 2 * MIN);
+    assert.deepEqual(state.temp, {});
+    assert.ok(ipRuleValid('192.168.1.*') && ipRuleValid('2a00:23c7:*') && !ipRuleValid('nope'));
+    assert.ok(ipMatches('192.168.1.7', ['192.168.1.*']));
+    assert.ok(isLoopbackIp('::1') && isLoopbackIp('::ffff:127.0.0.1') && !isLoopbackIp('10.0.0.1'));
+});
+
+test('password rules: length, common, personal, repetitive', () => {
+    const common = new Set(['password', 'qwerty123', 'letmein']);
+    const p = (pw, who = {}) => passwordProblems(pw, who, {minLength: 10, common});
+    assert.deepEqual(p('correct horse battery'), []);
+    assert.equal(p('short').length >= 1, true);
+    assert.match(p('Password').join(' '), /most common/);
+    assert.match(p('letmein2024!!').join(' '), /most common/, 'a common word with digits on the end');
+    assert.match(p('samsmith-rules-ok', {email: 'samsmith@x.com'}).join(' '), /name and email/);
+    assert.match(p('Joanna-Bloggs-99', {name: 'Joanna Bloggs'}).join(' '), /name and email/);
+    assert.match(p('aaaaaaaaaaaa').join(' '), /more than one or two/);
+});
+
+test('settings: checked, merged, bad values named', () => {
+    const {errors, settings} = checkSettings({lockout: {accountThreshold: '7', enabled: 'false'}, probes: {extra: '/old-app/\n/x.cgi'}, signinDays: 60});
+    assert.deepEqual(errors, {});
+    assert.equal(settings.lockout.accountThreshold, 7);
+    assert.equal(settings.lockout.enabled, false);
+    assert.deepEqual(settings.probes.extra, ['/old-app/', '/x.cgi']);
+    assert.equal(settings.policy.minLength, DEFAULT_SETTINGS.policy.minLength, 'untouched values keep what was stored');
+    const bad = checkSettings({lockout: {accountThreshold: 1, baseMin: 30, maxMin: 5}, probes: {allow: 'no-slash'}, signinDays: 2});
+    assert.deepEqual(Object.keys(bad.errors).sort(), ['lockout.accountThreshold', 'lockout.maxMin', 'probes.allow', 'signinDays']);
+    assert.equal(mergeDefaults({lockout: {enabled: false}}).lockout.accountThreshold, 5, 'an old, partial setting gets the new defaults');
+});
+
+test('health: facts become checks; unknown is info, never a pass; the score counts only what was answered', () => {
+    const now = Date.parse('2026-09-26T12:00:00Z');
+    const good = evaluate({
+        admins: [{name: 'Sam', lastLogin: '2026-09-25T10:00:00Z'}],
+        users: [{name: 'Sam', lastLogin: '2026-09-25T10:00:00Z', createdAt: '2026-01-01'}],
+        engine: {installed: '0.83.0', latest: '0.83.0'}, nodeEnv: 'production', proxy: {via: true, trust: 'loopback'},
+        bind: '127.0.0.1', smtp: true, cert: {daysLeft: 60}, headers: {https: true, csp: true, nosniff: true, frame: true, referrer: true, hsts: true},
+        probeFiles: [{path: '/.env', status: 404}], licences: [{name: 'x', state: 'valid'}],
+        protections: {checks: true, lockout: true, policy: true}, policyMin: 10, twoFactor: false
+    }, {now});
+    assert.equal(good.score, 100);
+    assert.equal(good.failing, 0);
+    assert.equal(good.checks.find(c => c.id === 'two-factor').status, 'info');
+
+    const bad = evaluate({
+        admins: [{name: 'Old', lastLogin: '2025-01-01T00:00:00Z'}, {name: 'Never', lastLogin: null}],
+        users: [{name: 'Never', lastLogin: null, createdAt: '2026-01-01'}],
+        engine: {installed: '0.80.2', latest: '0.83.0'}, nodeEnv: 'development', proxy: {via: true, trust: false}, bind: '0.0.0.0',
+        smtp: false, cert: {daysLeft: 3}, headers: {https: false, csp: false, nosniff: true, frame: true, referrer: false},
+        probeFiles: [{path: '/.env', status: 200}], licences: [{name: 'invoice', state: 'expired'}],
+        protections: {checks: false, lockout: false, policy: false}, policyMin: 10
+    }, {now});
+    const st = Object.fromEntries(bad.checks.map(c => [c.id, c.status]));
+    assert.equal(st['admins-stale'], 'warn');
+    assert.equal(st.exposed, 'fail');
+    assert.equal(st.certificate, 'fail');
+    assert.equal(st.proxy, 'fail');
+    assert.equal(st.lockout, 'fail');
+    assert.equal(st.engine, 'warn');
+    assert.equal(st.headers, 'warn');
+    assert.ok(bad.critical >= 3);
+    assert.ok(bad.score <= 40);
+    const unknown = evaluate({engine: {installed: '0.83.0', latest: null}, headers: {error: 'timed out'}, cert: {daysLeft: null, error: 'timed out'}}, {now});
+    assert.equal(unknown.checks.find(c => c.id === 'engine').status, 'info');
+    assert.equal(unknown.checks.find(c => c.id === 'certificate').status, 'info');
+    assert.equal(unknown.checks.find(c => c.id === 'headers').status, 'info');
+});