jishushell 0.0.1 → 0.4.2-beta2

package/dist/routes/auth.js

@@ -0,0 +1,151 @@
+import * as auth from "../auth.js";
+import { JWT_EXPIRE_HOURS } from "../config.js";
+import * as setupManager from "../services/setup-manager.js";
+// Brute-force protection: per-IP progressive lockout
+const loginAttempts = new Map();
+const MAX_ATTEMPTS = 5;
+const MAX_TRACKED_IPS = 10_000;
+// Progressive lockout: 1min → 5min → 15min → 1h (based on cumulative failures)
+const BLOCK_DURATIONS = [60_000, 300_000, 900_000, 3_600_000];
+function checkLoginRate(ip) {
+    const now = Date.now();
+    const record = loginAttempts.get(ip);
+    if (record && now < record.blockedUntil) {
+        return { allowed: false, retryAfter: Math.ceil((record.blockedUntil - now) / 1000) };
+    }
+    return { allowed: true };
+}
+function recordLoginFailure(ip) {
+    const record = loginAttempts.get(ip) || { count: 0, blockedUntil: 0, lastAttempt: 0 };
+    record.count++;
+    record.lastAttempt = Date.now();
+    if (record.count >= MAX_ATTEMPTS) {
+        // Progressive: longer blocks for repeat offenders
+        const tier = Math.min(Math.floor(record.count / MAX_ATTEMPTS) - 1, BLOCK_DURATIONS.length - 1);
+        record.blockedUntil = Date.now() + BLOCK_DURATIONS[tier];
+    }
+    // Evict a non-blocked entry first to avoid kicking active locks off the map;
+    // only fall back to FIFO if every tracked IP is still within its block window.
+    if (!loginAttempts.has(ip) && loginAttempts.size >= MAX_TRACKED_IPS) {
+        const now = Date.now();
+        let evictKey;
+        for (const [k, v] of loginAttempts) {
+            if (now >= v.blockedUntil) {
+                evictKey = k;
+                break;
+            }
+        }
+        if (evictKey === undefined)
+            evictKey = loginAttempts.keys().next().value;
+        if (evictKey !== undefined)
+            loginAttempts.delete(evictKey);
+    }
+    loginAttempts.set(ip, record);
+}
+function clearLoginFailures(ip) {
+    loginAttempts.delete(ip);
+}
+// Clean up expired entries every minute to limit memory under brute-force attacks
+setInterval(() => {
+    const now = Date.now();
+    for (const [ip, record] of loginAttempts) {
+        // Remove entries whose block has expired for over 10 minutes (no longer useful)
+        if (record.blockedUntil > 0 && now >= record.blockedUntil + 600_000)
+            loginAttempts.delete(ip);
+        // Remove entries that never reached the block threshold and have been idle for over 10 minutes
+        else if (record.blockedUntil === 0 && record.count < MAX_ATTEMPTS && now - record.lastAttempt >= 600_000)
+            loginAttempts.delete(ip);
+    }
+}, 60_000).unref();
+const AUTH_COOKIE_NAME = "jishushell_session";
+function setAuthCookie(req, reply, token) {
+    const maxAge = JWT_EXPIRE_HOURS * 3600;
+    const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
+    reply.header("Set-Cookie", `${AUTH_COOKIE_NAME}=${token}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=${maxAge}${secure}`);
+}
+function clearAuthCookie(reply) {
+    reply.header("Set-Cookie", `${AUTH_COOKIE_NAME}=; HttpOnly; SameSite=Strict; Path=/api; Max-Age=0`);
+}
+export async function authRoutes(app, opts = {}) {
+    app.get("/api/auth/status", async () => {
+        return { initialized: auth.isInitialized() };
+    });
+    app.post("/api/auth/init", async (req, reply) => {
+        if (auth.isInitialized()) {
+            return reply.status(400).send({ detail: "Password already initialized" });
+        }
+        if (typeof req.body?.password !== "string" || req.body.password.length < 8) {
+            return reply.status(400).send({ detail: "Password must be at least 8 characters" });
+        }
+        const ok = await auth.initPassword(req.body.password);
+        if (!ok) {
+            // Could lose race with another concurrent init call — treat same as already-initialized.
+            return reply.status(409).send({ detail: "Password already initialized" });
+        }
+        const token = auth.createToken();
+        setAuthCookie(req, reply, token);
+        // Rebind from 127.0.0.1 → 0.0.0.0 after password is set, so the response can be sent first.
+        setTimeout(() => {
+            const rebind = opts.getRebind?.();
+            if (rebind) {
+                console.log("[auth] Password initialized — rebinding to 0.0.0.0 for remote access...");
+                rebind("0.0.0.0")
+                    .then(() => setupManager.startNomad())
+                    .then((r) => console.log("[auth] Post-rebind Nomad:", r.message))
+                    .catch((e) => console.error("[auth] Post-rebind error:", e));
+            }
+            else {
+                console.log("[auth] Password initialized — restart to enable remote access.");
+            }
+        }, 500);
+        return { token };
+    });
+    app.post("/api/auth/login", async (req, reply) => {
+        if (!auth.isInitialized()) {
+            return reply.status(400).send({ detail: "Password not initialized" });
+        }
+        const ip = req.ip || "unknown";
+        const rateCheck = checkLoginRate(ip);
+        if (!rateCheck.allowed) {
+            reply.header("Retry-After", String(rateCheck.retryAfter));
+            return reply.status(429).send({ detail: `Too many login attempts, retry after ${rateCheck.retryAfter}s` });
+        }
+        if (typeof req.body?.password !== "string") {
+            return reply.status(400).send({ detail: "Password is required" });
+        }
+        if (!await auth.verifyPassword(req.body.password)) {
+            recordLoginFailure(ip);
+            return reply.status(401).send({ detail: "Wrong password" });
+        }
+        clearLoginFailures(ip);
+        const token = auth.createToken();
+        setAuthCookie(req, reply, token);
+        return { token };
+    });
+    app.post("/api/auth/change-password", async (req, reply) => {
+        // Rate-limit change-password same as login to prevent brute-force on old password
+        const ip = req.ip || "unknown";
+        const rateCheck = checkLoginRate(ip);
+        if (!rateCheck.allowed) {
+            reply.header("Retry-After", String(rateCheck.retryAfter));
+            return reply.status(429).send({ detail: `Too many attempts, retry after ${rateCheck.retryAfter}s` });
+        }
+        if (typeof req.body?.new_password !== "string" || req.body.new_password.length < 8) {
+            return reply.status(400).send({ detail: "Password must be at least 8 characters" });
+        }
+        if (!await auth.changePassword(req.body.old_password, req.body.new_password)) {
+            recordLoginFailure(ip);
+            return reply.status(401).send({ detail: "Wrong old password" });
+        }
+        clearLoginFailures(ip);
+        const token = auth.createToken();
+        setAuthCookie(req, reply, token);
+        return { token };
+    });
+    // Logout — clear the httpOnly cookie
+    app.post("/api/auth/logout", async (_req, reply) => {
+        clearAuthCookie(reply);
+        return { ok: true };
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAE7D,qDAAqD;AACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwE,CAAC;AACtG,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,+EAA+E;AAC/E,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAE9D,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU;IACpC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACtF,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,QAA4B,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBAAC,QAAQ,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACrD,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACzE,IAAI,QAAQ,KAAK,SAAS;YAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU;IACpC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,kFAAkF;AAClF,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QACzC,gFAAgF;QAChF,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,YAAY,GAAG,OAAO;YAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9F,+FAA+F;aAC1F,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,YAAY,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO;YAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;AACH,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;AAEnB,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,aAAa,CAAC,GAAmB,EAAE,KAAmB,EAAE,KAAa;IAC5E,MAAM,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,KAAK,CAAC,MAAM,CAAC,YAAY,EACvB,GAAG,gBAAgB,IAAI,KAAK,mDAAmD,MAAM,GAAG,MAAM,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAmB;IAC1C,KAAK,CAAC,MAAM,CAAC,YAAY,EACvB,GAAG,gBAAgB,oDAAoD,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAoB,EACpB,OAA0E,EAAE;IAE5E,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QACrC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAiC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9E,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,yFAAyF;YACzF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,4FAA4F;QAC5F,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAClC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;gBACvF,MAAM,CAAC,SAAS,CAAC;qBACd,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;qBACrC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;qBAChE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAiC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/E,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wCAAwC,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,kFAAkF;QAClF,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC/B,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kCAAkC,SAAS,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7E,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC,CACF,CAAC;IAEF,qCAAqC;IACrC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACjD,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/instances.d.ts

@@ -0,0 +1,2 @@
+import { FastifyInstance } from "fastify";
+export declare function instanceRoutes(app: FastifyInstance): Promise<void>;