dsh-multimodal-node 0.0.0-stage → 0.3.1

package/lib/auth.js

@@ -0,0 +1,315 @@
+/**
+ * Accounts, the rotating pairing code, and sessions for the remote port.
+ *
+ * Three separate things, deliberately:
+ *
+ *   password  — what a person knows. Stored as scrypt(password, salt); the
+ *               plaintext never exists outside the request that set it.
+ *   pairing   — what the machine proves. A 6-digit code derived from a per-install
+ *               secret and a 60-second time step, so it can be shown on the
+ *               desktop and read out loud without ever being stored, and an
+ *               attacker who only has the password still cannot log in.
+ *   session   — what the browser keeps. A random token in an HttpOnly cookie,
+ *               with idle + absolute expiry, revocable one by one.
+ *
+ * The code is derived per step and never persisted, so a leaked settings file
+ * does not hand out a second factor.
+ */
+import { createHmac, randomBytes, scrypt as scryptCallback, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+import { normalizeTier } from './tiers.js';
+
+const scrypt = promisify(scryptCallback);
+
+const STEP_MS = 60_000;
+const CODE_DIGITS = 6;
+const SESSION_IDLE_MS = 30 * 60_000;
+const SESSION_MAX_MS = 12 * 60 * 60_000;
+const MAX_FAILURES = 8;
+const FAILURE_WINDOW_MS = 10 * 60_000;
+
+export function hashPassword(password, salt = randomBytes(16).toString('hex')) {
+    return scrypt(password, salt, 64).then((derived) => ({
+        salt,
+        hash: Buffer.from(derived).toString('hex'),
+        algo: 'scrypt',
+    }));
+}
+
+export async function verifyPassword(password, record) {
+    if (record === undefined || record === null || typeof record.hash !== 'string') return false;
+    if (record.algo !== 'scrypt' || typeof record.salt !== 'string') return false;
+    const derived = Buffer.from(await scrypt(password, record.salt, 64));
+    const expected = Buffer.from(record.hash, 'hex');
+    if (expected.length !== derived.length) return false;
+    return timingSafeEqual(derived, expected);
+}
+
+/** One code per 60s step, plus the next step so a slow clock still works. */
+export function pairingCodes(secret, at = Date.now()) {
+    const step = Math.floor(at / STEP_MS);
+    return [step, step + 1].map((value) => ({
+        code: deriveCode(secret, value),
+        step: value,
+        expiresAt: (value + 1) * STEP_MS,
+    }));
+}
+
+function deriveCode(secret, step) {
+    const mac = createHmac('sha256', secret).update(`pair:${step}`).digest();
+    const offset = mac[mac.length - 1] & 0x0f;
+    const number = ((mac[offset] & 0x7f) << 24) | (mac[offset + 1] << 16) | (mac[offset + 2] << 8) | mac[offset + 3];
+    return String(number % 10 ** CODE_DIGITS).padStart(CODE_DIGITS, '0');
+}
+
+export function matchesPairingCode(secret, input, at = Date.now()) {
+    const text = String(input ?? '').replace(/\D/g, '');
+    if (text.length !== CODE_DIGITS) return false;
+    return pairingCodes(secret, at).some((entry) => entry.code === text);
+}
+
+export class AuthStore {
+    constructor(store) {
+        this.store = store;
+    }
+
+    get settings() {
+        return this.store.get().remote ?? {};
+    }
+
+    /** The per-install secret, created on first use and kept in settings. */
+    async ensureSecret() {
+        const remote = this.store.get().remote ?? {};
+        if (typeof remote.secret === 'string' && remote.secret.length >= 32) return remote.secret;
+        const secret = randomBytes(32).toString('hex');
+        await this.store.patch({ remote: { secret } });
+        return secret;
+    }
+
+    /** Face value for the desktop panel: "read this to the person joining". */
+    async currentCode() {
+        const required = this.settings.requireCode !== false;
+        if (!required) return { code: null, expiresAt: 0, secondsLeft: 0, next: null, required: false };
+        const secret = await this.ensureSecret();
+        const [now, next] = pairingCodes(secret);
+        return {
+            code: now.code,
+            expiresAt: now.expiresAt,
+            secondsLeft: Math.max(0, Math.round((now.expiresAt - Date.now()) / 1000)),
+            next: next.code,
+            required: true,
+        };
+    }
+
+    /**
+     * Fill in tiers for accounts created before tiers existed.
+     *
+     * An administrator is the person who runs the machine and already has adult
+     * workflows in their library, so defaulting them to SFW would hide their own
+     * work from them; a viewer stays SFW, which is the safe direction.
+     */
+    async migrateTiers() {
+        const records = this.accounts();
+        let changed = 0;
+        const accounts = records.map((entry) => {
+            if (entry.tier === 'sfw' || entry.tier === 'nsfw') return entry;
+            changed += 1;
+            return { ...entry, tier: entry.role === 'admin' ? 'nsfw' : 'sfw' };
+        });
+        if (changed > 0) await this.store.patch({ remote: { accounts } });
+        return changed;
+    }
+
+    /** Turn the second factor on or off. Off means password-only. */
+    async setRequireCode(required) {
+        await this.store.patch({ remote: { requireCode: required === true } });
+        return { ok: true, requireCode: this.settings.requireCode !== false };
+    }
+
+    accounts() {
+        return Array.isArray(this.settings.accounts) ? this.settings.accounts : [];
+    }
+
+    async addAccount(name, password, role = 'viewer', tier = 'sfw') {
+        const user = String(name ?? '').trim().toLowerCase();
+        if (!/^[a-z0-9_.-]{2,32}$/.test(user)) throw new Error('用户名需为 2–32 位字母、数字、下划线、点或减号');
+        if (String(password ?? '').length < 8) throw new Error('密码至少 8 位');
+        if (this.accounts().some((entry) => entry.name === user)) throw new Error(`账号 ${user} 已存在`);
+        const record = await hashPassword(String(password));
+        const accounts = [
+            ...this.accounts(),
+            { name: user, role, tier: normalizeTier(tier), ...record, createdAt: new Date().toISOString() },
+        ];
+        await this.store.patch({ remote: { accounts } });
+        return { ok: true, accounts: this.accounts().map(publicAccount) };
+    }
+
+    /** Change an account's content tier. Sessions keep working; the ceiling moves. */
+    async setTier(name, tier) {
+        const user = String(name ?? '').toLowerCase();
+        const records = this.accounts();
+        const index = records.findIndex((entry) => entry.name === user);
+        if (index < 0) throw new Error(`没有账号 ${user}`);
+        const accounts = records.slice();
+        accounts[index] = { ...records[index], tier: normalizeTier(tier) };
+        await this.store.patch({ remote: { accounts } });
+        return { ok: true, accounts: accounts.map(publicAccount) };
+    }
+
+    async removeAccount(name) {
+        const user = String(name ?? '').toLowerCase();
+        const accounts = this.accounts().filter((entry) => entry.name !== user);
+        if (accounts.length === this.accounts().length) throw new Error(`没有账号 ${user}`);
+        const sessions = (this.settings.sessions ?? []).filter((entry) => entry.user !== user);
+        await this.store.patch({ remote: { accounts, sessions } });
+        return { ok: true, accounts: accounts.map(publicAccount) };
+    }
+
+    async setPassword(name, password) {
+        const user = String(name ?? '').toLowerCase();
+        if (String(password ?? '').length < 8) throw new Error('密码至少 8 位');
+        const records = this.accounts();
+        const index = records.findIndex((entry) => entry.name === user);
+        if (index < 0) throw new Error(`没有账号 ${user}`);
+        const hashed = await hashPassword(String(password));
+        const accounts = records.slice();
+        accounts[index] = { ...records[index], ...hashed };
+        // A password change invalidates that user's sessions: the reason to change
+        // it is usually that somebody else has the old one.
+        const sessions = (this.settings.sessions ?? []).filter((entry) => entry.user !== user);
+        await this.store.patch({ remote: { accounts, sessions } });
+        return { ok: true };
+    }
+
+    /**
+     * Verify a login: password first, then the pairing code. Failures are
+     * throttled per user so the port cannot be used as a password oracle.
+     */
+    async login(name, password, code, meta = {}) {
+        const user = String(name ?? '').trim().toLowerCase();
+        const now = Date.now();
+        const failures = (this.settings.failures ?? []).filter((entry) => now - entry.at < FAILURE_WINDOW_MS);
+        const recent = failures.filter((entry) => entry.user === user);
+        if (recent.length >= MAX_FAILURES) {
+            return { ok: false, error: `失败次数过多，请 ${Math.ceil((FAILURE_WINDOW_MS - (now - recent[0].at)) / 60000)} 分钟后再试` };
+        }
+        const record = this.accounts().find((entry) => entry.name === user);
+        const passwordOk = record !== undefined && (await verifyPassword(String(password ?? ''), record));
+        // The second factor is a switch, not a fact of life: on a home LAN the
+        // owner may want password-only access, and then the code field is not
+        // merely optional, it is not checked at all.
+        const requireCode = this.settings.requireCode !== false;
+        let codeOk = true;
+        if (requireCode) {
+            const secret = await this.ensureSecret();
+            codeOk = matchesPairingCode(secret, code, now);
+        }
+        if (!passwordOk || !codeOk) {
+            failures.push({ user, at: now });
+            await this.store.patch({ remote: { failures } });
+            // One message for both halves: telling a caller which factor was wrong
+            // turns the pairing code into a search target.
+            if (!passwordOk) return { ok: false, error: '账号或密码不正确' };
+            return { ok: false, error: '配对码不正确或已过期' };
+        }
+        const token = randomBytes(32).toString('base64url');
+        const session = {
+            token,
+            user,
+            role: record.role ?? 'viewer',
+            // The tier is copied onto the session so a running browser keeps the
+            // ceiling it logged in with even if an admin edits the account; the
+            // next login picks up the new one.
+            tier: normalizeTier(record.tier),
+            createdAt: now,
+            seenAt: now,
+            ip: meta.ip ?? '',
+            agent: String(meta.agent ?? '').slice(0, 120),
+        };
+        const sessions = [...(this.settings.sessions ?? []), session].filter(
+            (entry) => now - entry.createdAt < SESSION_MAX_MS,
+        );
+        await this.store.patch({ remote: { sessions, failures: failures.filter((entry) => entry.user !== user) } });
+        return { ok: true, token, session: publicSession(session) };
+    }
+
+    sessions() {
+        const now = Date.now();
+        return (this.settings.sessions ?? []).filter(
+            (entry) => now - entry.seenAt < SESSION_IDLE_MS && now - entry.createdAt < SESSION_MAX_MS,
+        );
+    }
+
+    /**
+     * Persist one flag on a session record.
+     *
+     * The admin eye used to live in an in-process Map keyed by token, which meant "刷新了就
+     * 没了" whenever the page's read-back raced the write, and it vanished entirely on a host
+     * restart. The session record is already written to settings.json for the sliding
+     * `seenAt`, so storing the flag there costs one small object and survives everything a
+     * session survives — which is exactly the lifetime an elevated view should have.
+     *
+     * A logout still drops it, because logout deletes the session row.
+     */
+    async patchSession(token, patch) {
+        if (typeof token !== 'string' || token === '') return undefined;
+        const sessions = (this.settings.sessions ?? []).map((entry) =>
+            entry.token === token ? { ...entry, ...patch } : entry,
+        );
+        await this.store.patch({ remote: { sessions } });
+        return sessions.find((entry) => entry.token === token);
+    }
+
+    /** Resolve a cookie token; refreshes the idle timer at most once a minute. */
+    async touch(token) {
+        if (typeof token !== 'string' || token === '') return undefined;
+        const now = Date.now();
+        const session = this.sessions().find((entry) => entry.token === token);
+        if (session === undefined) return undefined;
+        if (now - session.seenAt > 60_000) {
+            const sessions = (this.settings.sessions ?? []).map((entry) =>
+                entry.token === token ? { ...entry, seenAt: now } : entry,
+            );
+            await this.store.patch({ remote: { sessions } });
+        }
+        return session;
+    }
+
+    async logout(token) {
+        const sessions = (this.settings.sessions ?? []).filter((entry) => entry.token !== token);
+        await this.store.patch({ remote: { sessions } });
+        return { ok: true };
+    }
+
+    async revokeAll() {
+        await this.store.patch({ remote: { sessions: [] } });
+        return { ok: true };
+    }
+}
+
+function publicAccount(record) {
+    return { name: record.name, role: record.role ?? 'viewer', tier: normalizeTier(record.tier), createdAt: record.createdAt ?? null };
+}
+
+function publicSession(record) {
+    return { user: record.user, role: record.role, tier: normalizeTier(record.tier), createdAt: record.createdAt, ip: record.ip };
+}
+
+export { SESSION_IDLE_MS, SESSION_MAX_MS, CODE_DIGITS };
+
+/** Parse a Cookie header without a dependency. */
+export function readCookie(header, name) {
+    if (typeof header !== 'string') return undefined;
+    for (const part of header.split(';')) {
+        const index = part.indexOf('=');
+        if (index < 0) continue;
+        if (part.slice(0, index).trim() === name) return decodeURIComponent(part.slice(index + 1).trim());
+    }
+    return undefined;
+}
+
+export function cookieHeader(name, value, maxAgeSec) {
+    const bits = [`${name}=${encodeURIComponent(value)}`, 'Path=/', 'HttpOnly', 'SameSite=Lax'];
+    if (maxAgeSec !== undefined) bits.push(`Max-Age=${maxAgeSec}`);
+    return bits.join('; ');
+}