maxibase 0.0.0-stage → 1.0.0

package/layers/base/server/api/auth/password.post.ts

@@ -0,0 +1,42 @@
+import { z } from 'zod'
+
+function badCredentials() {
+  return createError({
+    status: 401,
+    message: 'Bad credentials',
+  })
+}
+
+export default defineEventHandler(async (event) => {
+  const { email, password } = await readValidatedBody(
+    event,
+    z.object({
+      email: emailSchema,
+      password: passwordSchema(),
+    }).parse,
+  )
+
+  const user = await getAuth(event, email).catch((error: any) => {
+    if (error?.statusCode === 404) return null
+    throw error
+  })
+
+  if (!user?.password) {
+    // Burn comparable time so the timing does not leak what the status hides.
+    await hashPassword(password)
+    throw badCredentials()
+  }
+
+  if (!(await verifyPassword(user.password, password))) {
+    throw badCredentials()
+  }
+
+  if (user.totp) {
+    throw createError({
+      status: 401,
+      message: 'TOTP required',
+    })
+  }
+
+  return setSession(event, user)
+})

package/layers/base/server/api/auth/refresh.delete.ts

@@ -0,0 +1,4 @@
+export default defineEventHandler(async (event) => {
+  const session = await requireRecentAuth(event)
+  await revokeAllUserTokens(session.user.id)
+})

package/layers/base/server/api/auth/refresh.post.ts

@@ -0,0 +1,5 @@
+export default defineEventHandler(async (event) => {
+  const { user, refreshToken } = await verifyRefreshToken(event)
+  await revokeRefreshToken(refreshToken.token)
+  await createRefreshToken(user.id, event)
+})

package/layers/base/server/api/auth/totp/confirm.post.ts

@@ -0,0 +1,26 @@
+import { eq } from 'drizzle-orm'
+import { auth } from '#server/database/schema'
+import { z } from 'zod'
+import { verify } from 'otplib'
+
+const bodySchema = z.object({
+  secret: z.string().min(32),
+  token: z.string().length(6),
+})
+
+export default defineEventHandler(async (event) => {
+  const { secret, token } = await readValidatedBody(event, bodySchema.parse)
+  if (!secret || !token) {
+    throw createError({
+      status: 400,
+      message: 'Missing required fields',
+    })
+  }
+
+  const { user } = await requireRecentAuth(event)
+
+  if (await verify({ secret, token })) {
+    await db.update(auth).set({ totp: secret }).where(eq(auth.id, user.id))
+    await setSession(event, user, false) // refresh requiresMfaSetup
+  } else throw createError({ status: 400, message: 'Invalid code.' })
+})

package/layers/base/server/api/auth/totp/disable.post.ts

@@ -0,0 +1,33 @@
+import { eq } from 'drizzle-orm/sql/expressions/conditions'
+import { auth, credentials } from '#server/database/schema'
+
+export default defineEventHandler(async (event) => {
+  const session = await requireRecentAuth(event)
+  const userId = session.user.id
+
+  await db.transaction(async (tx) => {
+    const [locked] = await tx
+      .select({ totp: auth.totp })
+      .from(auth)
+      .where(eq(auth.id, userId))
+      .for('update')
+    if (!locked) {
+      throw createError({ status: 404, message: 'User not found' })
+    }
+    if (!locked.totp) {
+      throw createError({ status: 400, message: 'TOTP is not enabled.' })
+    }
+
+    if (useRuntimeConfig().forceMfa) {
+      const remaining = await tx
+        .select({ id: credentials.id })
+        .from(credentials)
+        .where(eq(credentials.userId, userId))
+      if (!remaining.length) {
+        throw createError({ status: 400, message: 'Keep at least one second factor.' })
+      }
+    }
+
+    await tx.update(auth).set({ totp: null }).where(eq(auth.id, userId))
+  })
+})

package/layers/base/server/api/auth/totp/generate.get.ts

@@ -0,0 +1,6 @@
+import { generateSecret } from 'otplib'
+
+export default defineEventHandler(async (event) => {
+  await requireRecentAuth(event)
+  return { secret: generateSecret() }
+})

package/layers/base/server/api/auth/totp/verify.post.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod'
+import { verify } from 'otplib'
+import { verifyOTP } from '../otp/verify.post'
+
+export default defineEventHandler(async (event) => {
+  const { email, password, otp, token } = await readValidatedBody(
+    event,
+    z.object({
+      email: emailSchema,
+      password: passwordSchema().optional(),
+      otp: z.string().length(6).or(z.string().min(32)).optional(),
+      token: z.string().length(6),
+    }).parse,
+  )
+  if (!email || !(otp || password) || !token) {
+    throw createError({
+      status: 400,
+      message: 'Missing required fields',
+    })
+  }
+
+  const user = await getAuth(event, email)
+
+  if (otp) await verifyOTP(email, otp)
+  else if (!user.password || !(await verifyPassword(user.password, password!))) {
+    throw createError({ status: 400, message: 'Invalid password.' })
+  }
+
+  if (!user.totp) {
+    throw createError({ status: 400, message: 'TOTP is not enabled.' })
+  }
+
+  if (await verify({ secret: user.totp, token })) {
+    await setSession(event, user)
+  } else throw createError({ status: 400, message: 'Invalid TOTP.' })
+})

package/layers/base/server/api/auth/webauthn/authenticate.post.ts

@@ -0,0 +1,39 @@
+import { eq } from 'drizzle-orm'
+import { auth } from '#server/database/schema'
+
+export default defineWebAuthnAuthenticateEventHandler({
+  async storeChallenge(event, challenge, attemptId) {
+    await useStorage('auth').setItem(`attempt:${attemptId}`, challenge)
+  },
+  async getChallenge(event, attemptId) {
+    const challenge = await useStorage('auth').getItem(`attempt:${attemptId}`)
+
+    await useStorage('auth').removeItem(`attempt:${attemptId}`)
+
+    if (!challenge) throw createError({ status: 400, message: 'Challenge expired' })
+
+    return challenge as string
+  },
+  async allowCredentials(event, userName) {
+    const user = await getAuth(event, userName, true)
+    return (user as any).credentials || []
+  },
+  async getCredential(event, credentialId) {
+    const credential = await db.query.credentials.findFirst({
+      where: {
+        id: credentialId,
+      },
+    })
+
+    if (!credential) throw createError({ status: 400, message: 'Credential not found' })
+    return credential as any
+  },
+  async onSuccess(event, { credential }) {
+    const user = await db
+      .select()
+      .from(auth)
+      .where(eq(auth.id, credential.userId as string))
+      .then((result) => result[0])
+    await setSession(event, user!)
+  },
+})

package/layers/base/server/api/auth/webauthn/index.delete.ts

@@ -0,0 +1,43 @@
+import { and, eq } from 'drizzle-orm'
+import { z } from 'zod'
+import { auth, credentials } from '#server/database/schema'
+
+const bodySchema = z.object({
+  credentialId: z.string().min(1),
+})
+
+export default defineEventHandler(async (event) => {
+  const { credentialId } = await readValidatedBody(event, bodySchema.parse)
+  const session = await requireRecentAuth(event)
+  const userId = session.user.id
+
+  if (!useRuntimeConfig().forceMfa) {
+    await db
+      .delete(credentials)
+      .where(and(eq(credentials.id, credentialId), eq(credentials.userId, userId)))
+    return
+  }
+
+  await db.transaction(async (tx) => {
+    const [locked] = await tx
+      .select({ totp: auth.totp })
+      .from(auth)
+      .where(eq(auth.id, userId))
+      .for('update')
+    if (!locked) {
+      throw createError({ status: 404, message: 'User not found' })
+    }
+
+    const remaining = await tx
+      .select({ id: credentials.id })
+      .from(credentials)
+      .where(eq(credentials.userId, userId))
+    if (!locked.totp && remaining.length <= 1) {
+      throw createError({ status: 400, message: 'Keep at least one second factor.' })
+    }
+
+    await tx
+      .delete(credentials)
+      .where(and(eq(credentials.id, credentialId), eq(credentials.userId, userId)))
+  })
+})

package/layers/base/server/api/auth/webauthn/index.post.ts

@@ -0,0 +1,17 @@
+import { and, eq } from 'drizzle-orm'
+import { z } from 'zod'
+import { credentials } from '#server/database/schema'
+
+const bodySchema = z.object({
+  name: z.string().min(1).max(32),
+  credentialId: z.string().min(1),
+})
+
+export default defineEventHandler(async (event) => {
+  const { name, credentialId } = await readValidatedBody(event, bodySchema.parse)
+  const session = await requireRecentAuth(event)
+  await db
+    .update(credentials)
+    .set({ name })
+    .where(and(eq(credentials.id, credentialId), eq(credentials.userId, session.user.id)))
+})

package/layers/base/server/api/auth/webauthn/register.post.ts

@@ -0,0 +1,49 @@
+import { z } from 'zod'
+import { credentials } from '#server/database/schema'
+
+const registerHandler = defineWebAuthnRegisterEventHandler({
+  async storeChallenge(event, challenge, attemptId) {
+    await useStorage('auth').setItem(`attempt:${attemptId}`, challenge)
+  },
+  async getChallenge(event, attemptId) {
+    const challenge = await useStorage('auth').getItem(`attempt:${attemptId}`)
+
+    await useStorage('auth').removeItem(`attempt:${attemptId}`)
+
+    if (!challenge) throw createError({ status: 400, message: 'Challenge expired' })
+
+    return challenge as string
+  },
+  async validateUser(userBody, event) {
+    const session = await requireUserSession(event)
+    const parsed = z
+      .object({
+        userName: emailSchema,
+      })
+      .safeParse(userBody)
+
+    if (!parsed.success || !session.user?.email || session.user.email !== parsed.data.userName) {
+      throw createError({ status: 400, message: 'Email incorrect' })
+    }
+
+    return parsed.data
+  },
+  async onSuccess(event, { credential }) {
+    const session = await requireUserSession(event)
+    await db.insert(credentials).values({
+      name: new Date().toISOString().substring(0, 10),
+      userId: session.user.id,
+      id: credential.id,
+      publicKey: credential.publicKey,
+      counter: credential.counter,
+      backedUp: credential.backedUp,
+      transports: credential.transports as any[],
+    })
+    await setSession(event, session.user, false) // refresh requiresMfaSetup
+  },
+})
+
+export default defineEventHandler(async (event) => {
+  await requireRecentAuth(event)
+  return registerHandler(event)
+})

package/layers/base/server/api/files/[...path].get.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod'
+
+const querySchema = z.object({
+  isPrivate: z
+    .enum(['true', 'false'])
+    .transform((v) => v === 'true')
+    .optional(),
+  maxAge: z.coerce.number().optional(),
+  serverCache: z.string().optional(),
+  expireIn: z.coerce.number().optional(),
+  redirect: z
+    .enum(['true', 'false'])
+    .transform((v) => v === 'true')
+    .optional(),
+})
+
+export default defineEventHandler((event) => {
+  const path = event.context.params?.path || ''
+  const query = getQuery(event)
+  const { isPrivate = false, maxAge, serverCache, expireIn, redirect } = querySchema.parse(query)
+
+  let cache = `public, max-age=${maxAge || 31536000}`
+  if (maxAge === 0) {
+    cache = 'no-store, no-cache'
+  } else if (isPrivate) {
+    cache = `private, max-age=${maxAge || 3600}`
+  }
+  setHeader(event, 'Cache-Control', cache)
+  return getFile(
+    event,
+    decodeURIComponent(path),
+    isPrivate,
+    serverCache as RequestCache,
+    expireIn,
+    redirect,
+  )
+})

package/layers/base/server/api/files/chunk.post.ts

@@ -0,0 +1,36 @@
+export default defineEventHandler(async (event) => {
+  const body = await readMultipartFormData(event)
+  if (!body) throw createError({ status: 400, message: 'No data' })
+
+  const get = (name: string) =>
+    body
+      .find((p) => p.name === name)
+      ?.data.toString()
+      .trim()
+
+  const uploadId = get('uploadId')
+  const chunkIndex = Number(get('chunkIndex'))
+  const totalChunks = Number(get('totalChunks'))
+  const filename = get('filename')
+  const type = get('type') || 'application/octet-stream'
+  const path = get('path') || 'files'
+  const isPrivate = get('isPrivate') !== 'false'
+  const parts = get('parts') ? JSON.parse(get('parts') || '[]') : []
+  const chunkPart = body.find((p) => p.name === 'chunk')
+
+  if (isNaN(chunkIndex) || isNaN(totalChunks) || !filename || !chunkPart) {
+    throw createError({ status: 400, message: 'Invalid chunk upload' })
+  }
+
+  return uploadChunk(event, {
+    uploadId,
+    chunkIndex,
+    totalChunks,
+    filename,
+    type,
+    chunk: chunkPart.data,
+    path,
+    isPrivate,
+    parts,
+  })
+})

package/layers/base/server/api/files/copy.post.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod'
+
+const bodySchema = z.object({
+  src: z.string().min(1),
+  dest: z.string().min(1),
+  isPrivate: z.boolean().optional(),
+  deleteSrc: z.boolean().optional(),
+  isFolder: z.boolean().optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const {
+    src,
+    dest,
+    isPrivate,
+    deleteSrc,
+    isFolder = !src.includes('.'),
+  } = await readValidatedBody(event, bodySchema.parse)
+  if (isFolder) await copyFiles(event, src, dest, isPrivate, deleteSrc)
+  else await copyFile(event, src, dest, isPrivate, deleteSrc)
+  return { success: true }
+})

package/layers/base/server/api/files/index.delete.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod'
+
+const bodySchema = z.object({
+  path: z.string().min(1),
+  isPrivate: z.boolean().optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const { path, isPrivate } = await readValidatedBody(event, bodySchema.parse)
+  await deletePath(event, path, isPrivate)
+  return { success: true }
+})

package/layers/base/server/api/files/index.get.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod'
+
+const querySchema = z.object({
+  path: z
+    .string()
+    .min(1)
+    .refine((p) => !p.includes('.')),
+  isPrivate: z
+    .enum(['true', 'false'])
+    .transform((v) => v === 'true')
+    .optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event)
+
+  const { path, isPrivate = false } = querySchema.parse(query)
+  return listFolder(event, path, isPrivate)
+})

package/layers/base/server/api/files/index.post.ts

@@ -0,0 +1,15 @@
+export default defineEventHandler(async (event) => {
+  const body = await readMultipartFormData(event)
+  if (!body) {
+    throw createError({ status: 400, message: 'No file uploaded' })
+  }
+
+  const pathPart = body.find((p) => p.name === 'path')
+  const isPrivatePart = body.find((p) => p.name === 'isPrivate')
+  const isPrivate = isPrivatePart ? isPrivatePart.data.toString() === 'true' : true
+  const path = pathPart?.data.toString().trim()
+
+  return await Promise.all(
+    body.filter((p) => p.name === 'file').map((file) => uploadFile(event, file, path, isPrivate)),
+  )
+})

package/layers/base/server/api/log.post.ts

@@ -0,0 +1,20 @@
+import z from 'zod'
+
+const MAX_DATA_LENGTH = 10000
+
+const bodySchema = z.object({
+  summary: z.string().max(1000),
+  data: z
+    .unknown()
+    .optional()
+    .refine((v) => v === undefined || (JSON.stringify(v)?.length ?? 0) <= MAX_DATA_LENGTH, {
+      message: 'data too large',
+    }),
+  origin: z.string().max(500).optional(),
+  type: z.enum(['info', 'warn', 'error', 'debug']).catch('info').optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const { summary, data, origin, type } = await readValidatedBody(event, bodySchema.parse)
+  await log(summary, data, origin, type, event)
+})

package/layers/base/server/database/defaults/access.ts

@@ -0,0 +1,14 @@
+import type { H3Event } from 'h3'
+
+// Users reach their own folder u/{id}, admins every folder
+export async function checkFileAccess(event: H3Event, path: string) {
+  const { user } = await requireUserSession(event)
+  if (!user) throw createError({ statusCode: 401, message: 'Unauthorized' })
+  const root = `u/${user.id}`
+  if (path.startsWith(root) && (path[root.length] === '/' || path.length === root.length)) {
+    return true
+  }
+  if (user.role === 'admin') return true
+
+  throw createError({ statusCode: 403, message: 'Insufficient permissions' })
+}

package/layers/base/server/database/defaults/db.ts

@@ -0,0 +1,5 @@
+import { drizzle } from 'drizzle-orm/node-postgres'
+import { relations } from '#database/relations'
+import { authRelations } from '../relations'
+
+export const db = drizzle(useRuntimeConfig().db, { relations: { ...relations, ...authRelations } })

package/layers/base/server/database/defaults/relations.ts

@@ -0,0 +1,5 @@
+import * as schema from '#server/database/schema'
+import { defineRelationsPart } from 'drizzle-orm'
+
+// No relations of the project's own, every table is still queryable with db.query
+export const relations = defineRelationsPart(schema)

package/layers/base/server/database/relations.ts

@@ -0,0 +1,35 @@
+import * as schema from '#server/database/schema'
+import { defineRelationsPart } from 'drizzle-orm'
+
+// Built from the project schema, so they also apply to a table the project overrides.
+// Spread after the project's relations, so they replace any the project defines on these tables.
+export const authRelations = defineRelationsPart(schema, (r) => ({
+  auth: {
+    refreshTokens: r.many.refreshTokens({
+      from: r.auth.id,
+      to: r.refreshTokens.userId,
+    }),
+    credentials: r.many.credentials({
+      from: r.auth.id,
+      to: r.credentials.userId,
+    }),
+  },
+  refreshTokens: {
+    auth: r.one.auth({
+      from: r.refreshTokens.userId,
+      to: r.auth.id,
+    }),
+  },
+  credentials: {
+    auth: r.one.auth({
+      from: r.credentials.userId,
+      to: r.auth.id,
+    }),
+  },
+  logs: {
+    auth: r.one.auth({
+      from: r.logs.userId,
+      to: r.auth.id,
+    }),
+  },
+}))

package/layers/base/server/database/schema.ts

@@ -0,0 +1,66 @@
+import type { WebAuthnCredential } from '#auth-utils'
+import {
+  snakeCase,
+  text,
+  integer,
+  timestamp,
+  uuid,
+  boolean,
+  primaryKey,
+  pgEnum,
+  jsonb,
+  bigint,
+  index,
+} from 'drizzle-orm/pg-core'
+
+export const authSchema = snakeCase.schema('auth')
+
+export const appRoleEnum = pgEnum('app_role', ['admin', 'user'])
+export const auth = authSchema.table('users', {
+  id: uuid().primaryKey().defaultRandom(),
+  email: text().unique(),
+  password: text(),
+  createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+  totp: text(),
+  role: appRoleEnum().notNull().default('user'),
+})
+
+export const refreshTokens = authSchema.table('refresh_tokens', {
+  token: text().primaryKey(),
+  userId: uuid()
+    .notNull()
+    .references(() => auth.id, { onDelete: 'cascade' }),
+  createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+})
+
+export const credentials = authSchema.table(
+  'credentials',
+  {
+    userId: uuid()
+      .notNull()
+      .references(() => auth.id, { onDelete: 'cascade' }),
+    id: text().unique().notNull(),
+    name: text().notNull(),
+    publicKey: text().notNull(),
+    counter: integer().notNull(),
+    backedUp: boolean().notNull(),
+    transports: text().array().notNull().$type<WebAuthnCredential['transports']>(),
+  },
+  (table) => [primaryKey({ columns: [table.userId, table.id] })],
+)
+
+export const logs = authSchema.table(
+  'logs',
+  {
+    id: bigint({ mode: 'number' }).generatedByDefaultAsIdentity().primaryKey(),
+    userId: uuid().references(() => auth.id, { onDelete: 'cascade' }),
+    type: text().notNull().default('info'),
+    origin: text(),
+    summary: text(),
+    data: jsonb(),
+    time: timestamp({ withTimezone: true }).notNull().defaultNow(),
+    ipAddress: text(),
+    userAgent: text(),
+  },
+  (table) => [index('logs_time_idx').on(table.time)],
+)

package/layers/base/server/middleware/0.rateLimit.ts

@@ -0,0 +1,21 @@
+import type { RateLimitRule } from '../utils/rateLimit'
+
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  if (!config.rateLimit.enabled) return
+
+  const path = getRequestURL(event).pathname
+  const routes = config.rateLimit.routes as Record<string, RateLimitRule>
+
+  let matchedRoute = ''
+  let matchedRule: RateLimitRule | undefined
+  for (const [route, rule] of Object.entries(routes)) {
+    if ((path === route || path.startsWith(route + '/')) && route.length > matchedRoute.length) {
+      matchedRoute = route
+      matchedRule = rule
+    }
+  }
+  if (!matchedRule) return
+
+  await enforceRateLimit(event, matchedRoute, matchedRule)
+})

package/layers/base/server/middleware/1.session.ts

@@ -0,0 +1,14 @@
+export default defineEventHandler(async (event) => {
+  const existingToken = getCookie(event, 'refresh_token')
+  if (!existingToken) return
+
+  const session = await getUserSession(event)
+  if (session.user) return
+
+  try {
+    const { user } = await verifyRefreshToken(event)
+
+    const sessionData = await setSession(event, user, false)
+    session.user = sessionData?.user // to update the session on SSR
+  } catch {}
+})