kempo 4.6.2 → 4.7.0

package/server/utils/scheduler/scheduler.js

@@ -0,0 +1,37 @@
+import { runDueJobs } from './runJobs.js';
+
+/*
+  One ticker per process, held on a Symbol.for global so that the middleware and an extension reach the
+  same one even if kempo was resolved twice. Each tick only asks the database what is due; the lease on
+  each job row is what stops several processes running the same job. Set KEMPO_SCHEDULER=off to keep a
+  process from running jobs.
+*/
+const SCHEDULER = Symbol.for('kempo.scheduler');
+
+export const TICK_MS = 15000;
+
+export const startScheduler = ({ tickMs = TICK_MS } = {}) => {
+  if(globalThis[SCHEDULER] || process.env.KEMPO_SCHEDULER === 'off') return false;
+
+  let running = false;
+  const timer = setInterval(async () => {
+    if(running) return;
+    running = true;
+    try {
+      const [error] = await runDueJobs();
+      if(error) console.error(`[kempo] Scheduler: ${error.msg}`);
+    } finally {
+      running = false;
+    }
+  }, tickMs);
+  timer.unref?.();
+  globalThis[SCHEDULER] = timer;
+  return true;
+};
+
+export const stopScheduler = () => {
+  if(!globalThis[SCHEDULER]) return false;
+  clearInterval(globalThis[SCHEDULER]);
+  globalThis[SCHEDULER] = null;
+  return true;
+};

package/server/utils/scheduler/unregisterJobs.js

@@ -0,0 +1,16 @@
+import db from '../../db/index.js';
+import { scheduledJob } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async ({ owner }) => {
+  if(!owner){
+    return [{ code: 400, msg: 'Owner is required' }, null];
+  }
+
+  try {
+    await db.delete(scheduledJob).where(eq(scheduledJob.owner, owner));
+    return [null, { success: true }];
+  } catch(error) {
+    return [{ code: 500, msg: 'Failed to remove jobs' }, null];
+  }
+};

package/server/utils/settings/ensureEncryptionKey.js

@@ -0,0 +1,132 @@
+import { readFile, writeFile, chmod } from 'fs/promises';
+import { join } from 'path';
+import crypto from 'crypto';
+import { and, eq, isNotNull, ne, sql } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { setting } from '../../db/schema.js';
+
+/*
+  Makes sure SETTINGS_ENCRYPTION_KEY exists before anything needs it, so a site never has to set one up by
+  hand. In order:
+
+    1. the environment, when it has one (a secret manager, docker compose, the host). It always wins
+    2. the site's `.env` file, for a key written after the process started
+    3. a new random key, but only when nothing is encrypted yet. Written to `.env` (owner-only, and a
+       .gitignore that names it is kept honest), then set for this process, so there is no restart
+
+  A key is never generated while the database already holds encrypted settings: a new one would make every
+  one of them unreadable. That case is an error that says so. A key is also never kept only in memory:
+  when `.env` cannot be written the answer is an error, because a key that vanishes on the next restart
+  is worse than none.
+
+  Anyone with shell access to the server can read the key in `.env`. Back it up with the database: losing
+  it makes the stored credentials unrecoverable (they can be typed in again, nothing else is lost).
+*/
+
+const NAME = 'SETTINGS_ENCRYPTION_KEY';
+const VALID = /^[0-9a-fA-F]{64}$/;
+const LINE = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${NAME}[ \\t]*=[ \\t]*(.*?)[ \\t]*$`, 'm');
+const COMMENT = '# Encrypts the API credentials saved in the admin. Back this up with your database: if it is lost they cannot be recovered.';
+
+const unquote = value => value.replace(/^(['"])(.*)\1$/, '$2');
+
+const readText = async path => {
+  try {
+    return await readFile(path, 'utf8');
+  } catch(error) {
+    if(error.code === 'ENOENT') return null;
+    throw error;
+  }
+};
+
+/* How many settings are stored encrypted. A site that has not created its tables yet has none. */
+const storedSecrets = async () => {
+  try {
+    const [{ total }] = await db.select({ total: sql`count(*)::int` }).from(setting)
+      .where(and(eq(setting.type, 'secret'), isNotNull(setting.value), ne(setting.value, '')));
+    return [null, total];
+  } catch(error) {
+    if((error?.code || error?.cause?.code) === '42P01') return [null, 0];
+    return [{ code: 500, msg: 'Could not check whether this site already has encrypted settings, so no encryption key was created' }, null];
+  }
+};
+
+/* Puts the key in `.env`: replaces an empty `SETTINGS_ENCRYPTION_KEY=` line, or adds one. */
+const saveKey = async (path, key, text) => {
+  const line = `${NAME}=${key}`;
+  let next;
+  if(text === null) next = `${COMMENT}\n${line}\n`;
+  else if(LINE.test(text)) next = text.replace(LINE, line);
+  else next = `${text}${text === '' || text.endsWith('\n') ? '' : '\n'}\n${COMMENT}\n${line}\n`;
+  await writeFile(path, next, { mode: 0o600 });
+  await chmod(path, 0o600).catch(() => {});
+};
+
+/* A .gitignore that exists but does not name `.env` would let the key be committed. */
+const keepOutOfGit = async dir => {
+  const path = join(dir, '.gitignore');
+  try {
+    const text = await readText(path);
+    if(text === null || /^\/?\.env\s*$/m.test(text)) return;
+    await writeFile(path, `${text}${text.endsWith('\n') ? '' : '\n'}.env\n`);
+  } catch {
+    /* Not being able to tidy .gitignore is not worth refusing a key over. */
+  }
+};
+
+const resolve = async ({ cwd }) => {
+  const fromEnvironment = process.env[NAME];
+  if(fromEnvironment){
+    return VALID.test(fromEnvironment)
+      ? [null, { source: 'environment' }]
+      : [{ code: 500, msg: `${NAME} must be a 64-character hex string (32 bytes). Remove it to have one generated, or replace it with the key this site was created with` }, null];
+  }
+
+  const path = join(cwd, '.env');
+  let text;
+  try {
+    text = await readText(path);
+  } catch(error) {
+    return [{ code: 500, msg: `Could not read ${path} (${error.code ?? error.message}), so no encryption key was created` }, null];
+  }
+
+  const inFile = text === null ? '' : unquote(LINE.exec(text)?.[1] ?? '');
+  if(inFile){
+    if(!VALID.test(inFile)) return [{ code: 500, msg: `${NAME} in ${path} must be a 64-character hex string (32 bytes)` }, null];
+    process.env[NAME] = inFile;
+    return [null, { source: 'file', path }];
+  }
+
+  const [countError, count] = await storedSecrets();
+  if(countError) return [countError, null];
+  if(count > 0){
+    return [{ code: 500, msg: `This site has ${count} encrypted setting${count === 1 ? '' : 's'} but ${NAME} is not set. Restore the key it was created with (your .env backup, or the host's environment). A new key would make them unreadable` }, null];
+  }
+
+  const key = crypto.randomBytes(32).toString('hex');
+  try {
+    await saveKey(path, key, text);
+  } catch(error) {
+    return [{ code: 500, msg: `Could not save a new ${NAME} to ${path} (${error.code ?? error.message}). Set ${NAME} in the server's environment instead` }, null];
+  }
+  await keepOutOfGit(cwd);
+  process.env[NAME] = key;
+  console.warn(`[kempo] ${NAME} was not set, so one was generated and saved to ${path}. Back it up with your database: if it is lost, stored credentials (Stripe keys and the like) cannot be recovered and must be entered again.`);
+  return [null, { source: 'generated', path }];
+};
+
+/* One answer per process: concurrent callers share the work, and a failure can be tried again. */
+let pending = null;
+
+export const ensureEncryptionKey = ({ cwd = process.cwd() } = {}) => {
+  pending ??= resolve({ cwd }).then(result => {
+    if(result[0]) pending = null;
+    return result;
+  });
+  return pending;
+};
+
+/* For tests: forget the answer so the next call decides again. */
+export const resetEncryptionKey = () => {
+  pending = null;
+};

package/server/utils/settings/secretCrypto.js

@@ -37,5 +37,9 @@ export const decryptSecret = encoded => {
   const ciphertext = data.subarray(28);
   const decipher = crypto.createDecipheriv('aes-256-gcm', getKey(), iv);
   decipher.setAuthTag(authTag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  try {
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  } catch {
+    throw new Error('A stored secret could not be decrypted: SETTINGS_ENCRYPTION_KEY is not the key it was saved with. Restore the original key, or enter the credential again');
+  }
 };

package/dist/kempo/icons/create_new_folder.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M560-320h80v-80h80v-80h-80v-80h-80v80h-80v80h80v80ZM160-160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h240l80 80h320q33 0 56.5 23.5T880-640v400q0 33-23.5 56.5T800-160H160Zm0-80h640v-400H447l-80-80H160v480Zm0 0v-480 480Z"/></svg>

package/dist/kempo/icons/credit_card.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M880-720v480q0 33-23.5 56.5T800-160H160q-33 0-56.5-23.5T80-240v-480q0-33 23.5-56.5T160-800h640q33 0 56.5 23.5T880-720ZM160-640h640v-80H160v80Zm0 160v240h640v-240H160Zm0 240v-480 480Z"/></svg>

package/dist/kempo/icons/login.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M480-120v-80h280v-560H480v-80h280q33 0 56.5 23.5T840-760v560q0 33-23.5 56.5T760-120H480Zm-80-160-55-58 102-102H120v-80h327L345-622l55-58 200 200-200 200Z"/></svg>

package/dist/kempo/icons/payments.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M560-440q-50 0-85-35t-35-85q0-50 35-85t85-35q50 0 85 35t35 85q0 50-35 85t-85 35ZM280-320q-33 0-56.5-23.5T200-400v-320q0-33 23.5-56.5T280-800h560q33 0 56.5 23.5T920-720v320q0 33-23.5 56.5T840-320H280Zm80-80h400q0-33 23.5-56.5T840-480v-160q-33 0-56.5-23.5T760-720H360q0 33-23.5 56.5T280-640v160q33 0 56.5 23.5T360-400Zm440 240H120q-33 0-56.5-23.5T40-240v-440h80v440h680v80ZM280-400v-320 320Z"/></svg>

package/dist/kempo/icons/toll.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M373-253q-93-93-93-227t93-227q93-93 227-93t227 93q93 93 93 227t-93 227q-93 93-227 93t-227-93Zm-93 83q-106-28-173-114T40-480q0-110 67-196t173-114v84q-72 25-116 87t-44 139q0 77 44 139t116 87v84Zm320-310Zm170 170q70-70 70-170t-70-170q-70-70-170-70t-170 70q-70 70-70 170t70 170q70 70 170 70t170-70Z"/></svg>

package/dist/kempo/icons/wallet.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 -960 960 960"><path fill="currentColor" d="M200-120q-33 0-56.5-23.5T120-200v-560q0-33 23.5-56.5T200-840h560q33 0 56.5 23.5T840-760v80h-80v-80H200v560h560v-80h80v80q0 33-23.5 56.5T760-120H200Zm320-160q-33 0-56.5-23.5T440-360v-240q0-33 23.5-56.5T520-680h280q33 0 56.5 23.5T880-600v240q0 33-23.5 56.5T800-280H520Zm280-80v-240H520v240h280Zm-160-60q25 0 42.5-17.5T700-480q0-25-17.5-42.5T640-540q-25 0-42.5 17.5T580-480q0 25 17.5 42.5T640-420Z"/></svg>