maxibase 0.0.0-stage → 1.0.1

package/layers/base/server/middleware/2.mfa.ts

@@ -0,0 +1,34 @@
+// a session flagged requiresMfaSetup is only allowed to enroll a second factor
+const ENROLLMENT_ROUTES = [
+  '/api/_auth/session', // read and clear the session
+  '/api/auth', // GET only, lists the credentials shown on /user/auth
+  '/api/auth/webauthn/register',
+  '/api/auth/totp/generate',
+  '/api/auth/totp/confirm',
+  '/api/auth/refresh', // DELETE, sign out from all devices
+  '/api/log', // client error reporting, rate limited
+]
+
+export default defineEventHandler(async (event) => {
+  if (!useRuntimeConfig().forceMfa) return
+  if (!event.path.startsWith('/api/')) return
+
+  const session = await getUserSession(event)
+  if (!session.user?.email) return
+
+  let { requiresMfaSetup } = session.user
+  if (requiresMfaSetup === undefined) {
+    requiresMfaSetup = (await mfaSetupFlag(session.user))?.requiresMfaSetup ?? false
+    await replaceUserSession(event, {
+      ...session,
+      user: { ...session.user, requiresMfaSetup },
+    })
+  }
+  if (!requiresMfaSetup) return
+
+  const path = event.path.split('?')[0]!
+  if (path.startsWith('/api/auth/otp/') || path === '/api/auth/password') return // re-authentication
+  if (ENROLLMENT_ROUTES.includes(path) && !(path === '/api/auth' && event.method !== 'GET')) return
+
+  throw createError({ status: 403, message: 'MFA setup required' })
+})

package/layers/base/server/middleware/3.admin.ts

@@ -0,0 +1,4 @@
+export default defineEventHandler(async (event) => {
+  if (!event.path.startsWith('/api/admin/')) return
+  await isAdmin(event)
+})

package/layers/base/server/plugins/session.ts

@@ -0,0 +1,9 @@
+export default defineNitroPlugin(() => {
+  sessionHooks.hook('clear', async (session, event) => {
+    const refreshToken = getCookie(event, 'refresh_token')
+    if (refreshToken) {
+      deleteCookie(event, 'refresh_token')
+      await revokeRefreshToken(refreshToken)
+    }
+  })
+})

package/layers/base/server/routes/auth/microsoft.get.ts

@@ -0,0 +1,21 @@
+export default defineOAuthMicrosoftEventHandler({
+  async onSuccess(event, { user }) {
+    if (!user.mail) {
+      throw createError({
+        status: 401,
+        message: 'This Microsoft account has no email address',
+      })
+    }
+
+    const auth = await getAuth(event, user.mail).catch((error) => {
+      const config = useRuntimeConfig()
+
+      if (error.statusCode === 404 && config.autoSignup) {
+        return createAuth({ email: user.mail })
+      }
+      throw error
+    })
+    await setSession(event, auth)
+    return sendRedirect(event, '/')
+  },
+})

package/layers/base/server/routes/dev/email/[template].ts

@@ -0,0 +1,15 @@
+export default defineEventHandler(async (event) => {
+  if (process.env.NODE_ENV === 'production') {
+    throw createError({
+      statusCode: 404,
+      message: 'Not found',
+    })
+  }
+
+  const templateId = event.context.params?.template || ''
+  const query = getQuery(event)
+  const locale = (query.locale as string) || 'en'
+
+  const template = (await buildEmailTemplate(templateId, locale)).html
+  return buildEmail(template, locale, query)
+})

package/layers/base/server/tasks/backup.ts

@@ -0,0 +1,42 @@
+import { createReadStream } from 'fs'
+
+export default defineTask({
+  meta: {
+    name: 'backup',
+    description: 'Backup DB',
+  },
+  async run() {
+    const timestamp = new Date().toISOString()
+    try {
+      const config = useRuntimeConfig()
+      const agePublicKey = config.backup.agePublicKey
+      const backupName = `backups/backup-${timestamp}.dump${agePublicKey ? '.age' : ''}`
+
+      await createDatabaseBackup(backupName, config.db, config.backup.dumpArgs, agePublicKey)
+      if (config.s3.privateBucket) {
+        await uploadStreamToS3(
+          backupName,
+          createReadStream(backupName),
+          'application/octet-stream',
+          'private',
+          true,
+        )
+      }
+      await log('Backup created', { backupName }, 'backup task', 'info')
+
+      return {
+        result: {
+          success: true,
+        },
+      }
+    } catch (error: any) {
+      await log(error.message, { stack: error.stack, cause: error.cause }, 'backup task', 'error')
+
+      return {
+        result: {
+          success: false,
+        },
+      }
+    }
+  },
+})

package/layers/base/server/tasks/clean.ts

@@ -0,0 +1,39 @@
+export default defineTask({
+  meta: {
+    name: 'clean',
+    description: 'Clean old backups and logs',
+  },
+  async run() {
+    const config = useRuntimeConfig()
+
+    try {
+      await cleanOldBackups()
+      if (config.s3.privateBucket) {
+        const backups = await listFromS3('backups', true)
+        const retentionMs = daysToMilliseconds(config.backup.retentionDays)
+        const cutoffDate = new Date(Date.now() - retentionMs)
+        await Promise.all(
+          backups.map((b) => {
+            if (b.updatedAt && b.updatedAt < cutoffDate) {
+              return deleteFromS3(`backups/${b.name}`, true)
+            }
+          }),
+        )
+      }
+      await cleanLogs()
+
+      return {
+        result: {
+          success: true,
+        },
+      }
+    } catch (error: any) {
+      await log(error.message, { stack: error.stack, cause: error.cause }, 'clean task', 'error')
+      return {
+        result: {
+          success: false,
+        },
+      }
+    }
+  },
+})

package/layers/base/server/utils/access.ts

@@ -0,0 +1,8 @@
+import type { H3Event } from 'h3'
+
+export async function isAdmin(event: H3Event) {
+  const { user } = await requireUserSession(event)
+  if (user.role === 'admin') return true
+
+  throw createError({ statusCode: 403, message: 'Insufficient permissions' })
+}

package/layers/base/server/utils/auth.ts

@@ -0,0 +1,207 @@
+import { auth, refreshTokens } from '#server/database/schema'
+import { eq, lte } from 'drizzle-orm'
+import { randomBytes } from 'crypto'
+import type { H3Event } from 'h3'
+
+type AuthUser = typeof auth.$inferSelect
+type SessionUser = Pick<AuthUser, 'id'> & Partial<Pick<AuthUser, 'email' | 'role'>>
+
+export async function mfaSetupFlag(user: SessionUser) {
+  const config = useRuntimeConfig()
+  if (!config.forceMfa || !user.email) return
+
+  const row = await db.query.auth.findFirst({
+    where: { id: user.id },
+    with: { credentials: true },
+  })
+  return { requiresMfaSetup: !row?.totp && !row?.credentials.length }
+}
+
+export async function createAuth(user: Pick<AuthUser, 'email'>) {
+  const insertedUsers = await db
+    .insert(auth)
+    .values({
+      email: user.email?.trim().toLowerCase(),
+    })
+    .returning()
+  if (!insertedUsers[0]) {
+    throw createError({
+      status: 500,
+      message: 'User creation failed',
+    })
+  }
+  return insertedUsers[0]
+}
+
+export async function setAuth(user: Pick<AuthUser, 'id' | 'email'>) {
+  const insertedUsers = await db
+    .update(auth)
+    .set({
+      email: user.email?.trim().toLowerCase(),
+    })
+    .where(eq(auth.id, user.id))
+    .returning()
+  if (!insertedUsers[0]) {
+    throw createError({
+      status: 500,
+      message: 'User update failed',
+    })
+  }
+  return insertedUsers[0]
+}
+
+export async function getAuth(event: H3Event, email?: string, credentials = false) {
+  const id = email ? undefined : (await getUserSession(event)).user?.id
+  // an undefined filter is dropped by drizzle, which would match an arbitrary user
+  if (!email && !id) {
+    throw createError({
+      status: 401,
+      message: 'Not authenticated',
+    })
+  }
+
+  const where = email ? { email: email.trim().toLowerCase() } : { id }
+  const user = await db.query.auth.findFirst({
+    where,
+    with: {
+      credentials,
+    },
+  })
+  if (!user) {
+    throw createError({
+      status: 404,
+      message: 'User not found',
+    })
+  }
+  return user
+}
+
+export async function setSession(event: H3Event, user: SessionUser, refresh = true) {
+  if (refresh) {
+    if (useRuntimeConfig().session.unique) {
+      await revokeAllUserTokens(user.id)
+    } else {
+      const existingToken = getCookie(event, 'refresh_token')
+      if (existingToken) {
+        await revokeRefreshToken(existingToken)
+      }
+    }
+    await createRefreshToken(user.id, event)
+  }
+
+  const sessionMaxAge = useRuntimeConfig().session.maxAge
+  const authenticatedAt = refresh
+    ? Date.now()
+    : ((await getUserSession(event)).authenticatedAt ?? 0)
+
+  // replace, not set: setUserSession merges with defu, so an absent
+  // requiresMfaSetup would never clear a previously flagged session
+  return replaceUserSession(event, {
+    user: {
+      id: user.id,
+      email: user.email?.trim().toLowerCase() ?? undefined,
+      role: user.role || 'user',
+      isAnonymous: !user.email,
+      ...(await mfaSetupFlag(user)),
+    },
+    authenticatedAt,
+    expiresAt: sessionMaxAge ? Date.now() + sessionMaxAge * 1000 : undefined,
+  })
+}
+
+export async function requireRecentAuth(event: H3Event) {
+  const session = await requireUserSession(event)
+
+  if (session.user.isAnonymous || session.user.requiresMfaSetup) return session
+
+  const maxAge = useRuntimeConfig().public.recentAuth.maxAge * 1000
+  if (!session.authenticatedAt || Date.now() - session.authenticatedAt > maxAge) {
+    throw createError({
+      status: 403,
+      statusMessage: 'reauth_required',
+      message: 'Please verify your identity again to continue.',
+    })
+  }
+
+  return session
+}
+
+export function generateRefreshToken(): string {
+  return randomBytes(32).toString('base64url')
+}
+
+export async function createRefreshToken(userId: string, event: H3Event) {
+  const token = generateRefreshToken()
+
+  await db.insert(refreshTokens).values({
+    userId,
+    token,
+  })
+
+  const config = useRuntimeConfig()
+  setCookie(event, 'refresh_token', token, {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict',
+    maxAge: config.refreshToken.maxAge,
+    path: '/',
+  })
+  return token
+}
+
+export async function verifyRefreshToken(event: H3Event) {
+  const existingToken = getCookie(event, 'refresh_token')
+  if (!existingToken) {
+    throw createError({
+      status: 401,
+      message: 'No token provided',
+    })
+  }
+
+  const refreshToken = await db.query.refreshTokens.findFirst({ where: { token: existingToken } })
+  if (!refreshToken) {
+    deleteCookie(event, 'refresh_token')
+    throw createError({
+      status: 401,
+      message: 'No token found',
+    })
+  }
+
+  const user = await db.query.auth.findFirst({
+    where: { id: refreshToken.userId },
+  })
+  if (!user) {
+    deleteCookie(event, 'refresh_token')
+    throw createError({
+      status: 401,
+      message: 'No user found',
+    })
+  }
+
+  const config = useRuntimeConfig()
+  const createdAt = refreshToken.createdAt.getTime()
+  const creationExpiredAt = Date.now() - config.refreshToken.maxAge * 1000
+
+  if (createdAt < creationExpiredAt) {
+    await revokeExpiredRefreshToken(new Date(creationExpiredAt))
+    deleteCookie(event, 'refresh_token')
+    throw createError({
+      status: 401,
+      message: 'Token expired',
+    })
+  }
+
+  return { refreshToken, user }
+}
+
+export async function revokeRefreshToken(token: string) {
+  await db.delete(refreshTokens).where(eq(refreshTokens.token, token))
+}
+
+export async function revokeExpiredRefreshToken(creationExpiredAt: Date) {
+  await db.delete(refreshTokens).where(lte(refreshTokens.createdAt, creationExpiredAt))
+}
+
+export async function revokeAllUserTokens(userId: string) {
+  await db.delete(refreshTokens).where(eq(refreshTokens.userId, userId))
+}

package/layers/base/server/utils/backup.ts

@@ -0,0 +1,98 @@
+import { spawn, type ChildProcess } from 'child_process'
+import fs from 'fs/promises'
+import path from 'path'
+
+// pg_dump takes the connection string in argv, where `ps` shows it to every process on
+// the host, so move the password into the child's environment instead.
+function splitCredentials(dbUrl: string) {
+  try {
+    const url = new URL(dbUrl)
+    if (!url.password) return { conn: dbUrl, env: {} }
+    const password = decodeURIComponent(url.password)
+    url.password = ''
+    return { conn: url.toString(), env: { PGPASSWORD: password } }
+  } catch {
+    return { conn: dbUrl, env: {} } // a libpq keyword/value string, leave it alone
+  }
+}
+
+function waitForExit(child: ChildProcess, name: string) {
+  let stderr = ''
+  child.stderr?.on('data', (chunk) => {
+    stderr = (stderr + chunk).slice(-2000)
+  })
+
+  return new Promise<void>((resolve, reject) => {
+    child.on('error', (e: NodeJS.ErrnoException) =>
+      reject(e.code === 'ENOENT' ? new Error(`${name} is not installed`) : e),
+    )
+    child.on('close', (code, signal) => {
+      if (code === 0) return resolve()
+      const how = signal ? `signal ${signal}` : `exit code ${code}`
+      reject(new Error(`${name} failed (${how})${stderr ? `: ${stderr.trim()}` : ''}`))
+    })
+  })
+}
+
+export async function createDatabaseBackup(
+  backupName: string,
+  dbUrl: string,
+  dumpArgs: string = '-F c',
+  agePublicKey?: string,
+) {
+  const { conn, env } = splitCredentials(dbUrl)
+  const args = [...dumpArgs.split(' ').filter(Boolean), conn]
+  const options = { env: { ...process.env, ...env } }
+
+  if (!agePublicKey) {
+    const dump = spawn('pg_dump', [...args, '-f', backupName], {
+      ...options,
+      stdio: ['ignore', 'ignore', 'pipe'],
+    })
+    return waitForExit(dump, 'pg_dump')
+  }
+
+  // age needs only the public key, so the server can write backups it cannot read back.
+  // Piping keeps the plaintext dump off the disk entirely.
+  const dump = spawn('pg_dump', args, { ...options, stdio: ['ignore', 'pipe', 'pipe'] })
+  const encrypt = spawn('age', ['-r', agePublicKey, '-o', backupName], {
+    stdio: ['pipe', 'ignore', 'pipe'],
+  })
+  dump.stdout!.on('error', () => {}) // the EPIPE that follows the kills below
+  encrypt.stdin!.on('error', () => {})
+  dump.stdout!.pipe(encrypt.stdin!)
+
+  // Either one dying leaves the other blocked on a pipe nobody touches again.
+  dump.on('close', (code) => code !== 0 && encrypt.kill())
+  encrypt.on('close', (code) => code !== 0 && dump.kill())
+
+  // Kept in the order they happened: the first is the cause, any second is just the
+  // peer reporting the pipe we broke.
+  const errors: Error[] = []
+  const collect = (child: ChildProcess, name: string) =>
+    waitForExit(child, name).catch((e) => void errors.push(e))
+  await Promise.all([collect(dump, 'pg_dump'), collect(encrypt, 'age')])
+
+  if (errors.length) {
+    await fs.rm(backupName, { force: true }) // a truncated .age is not a backup
+    throw errors[0]
+  }
+}
+
+export async function cleanOldBackups() {
+  const backupDir = path.resolve(process.cwd(), 'backups')
+  const files = await fs.readdir(backupDir)
+  const now = Date.now()
+  const config = useRuntimeConfig()
+  const retentionMs = daysToMilliseconds(config.backup.retentionDays)
+
+  await Promise.all(
+    files.map(async (file) => {
+      const filePath = path.join(backupDir, file)
+      const stats = await fs.stat(filePath)
+      if (now - stats.mtimeMs > retentionMs) {
+        await fs.unlink(filePath) // Delete old backup
+      }
+    }),
+  )
+}

package/layers/base/server/utils/db.ts

@@ -0,0 +1,3 @@
+import { db } from '#database/db'
+
+export { db }

package/layers/base/server/utils/email.ts

@@ -0,0 +1,138 @@
+import nodemailer from 'nodemailer'
+import type { Transporter } from 'nodemailer'
+
+let transporter: Transporter | null = null
+
+function useTransporter() {
+  const config = useRuntimeConfig()
+  if (!transporter) {
+    const port = Number(config.smtp.port)
+    transporter = nodemailer.createTransport({
+      host: config.smtp.host,
+      port,
+      secure: port === 465,
+      requireTLS: port !== 465,
+      pool: true,
+      auth: {
+        user: config.smtp.user,
+        pass: config.smtp.pass,
+      },
+    })
+  }
+  return transporter
+}
+
+export function escapeHtml(value: unknown) {
+  return String(value)
+    .replaceAll('&', '&')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;')
+}
+
+export async function sendEmail(
+  to: string,
+  subject: string,
+  html: string,
+  locale: string = 'en',
+  attachments?: any[],
+  bcc?: string,
+  params = {},
+) {
+  const config = useRuntimeConfig()
+  const mail = await useTransporter().sendMail({
+    from: config.smtp.from,
+    to,
+    bcc,
+    subject: fillTemplate(subject, params, false),
+    html: await buildEmail(html, locale, params),
+    attachments,
+  })
+  return mail
+}
+
+async function getEmailAsset(key: string) {
+  return ((await useStorage('assets:server').getItem(`emails/${key}`)) ??
+    (await useStorage('assets:base').getItem(`emails/${key}`))) as string | null
+}
+
+export async function buildEmail(html: string, locale: string = 'en', params = {}) {
+  const base = (await getEmailAsset('base.html')) as string
+  const localeBase = await getEmailAsset(`${locale}/base.html`)
+  return fillTemplate(
+    inlineStyles(base.replace('{{content}}', localeBase?.replace('{{content}}', html) || html)),
+    params,
+  )
+}
+
+export async function sendEmailTemplate(
+  templateId: string,
+  locale: string = 'en',
+  params: Record<string, any> = {},
+  to: string,
+  attachments?: any[],
+  bcc?: string,
+) {
+  const { subject, html } = await buildEmailTemplate(templateId, locale)
+  return sendEmail(to, subject, html, locale, attachments, bcc, params)
+}
+
+export async function buildEmailTemplate(templateId: string, locale: string = 'en') {
+  const template =
+    (await getEmailAsset(`${locale}/${templateId}.html`)) ??
+    (await getEmailAsset(`en/${templateId}.html`))
+  if (!template) {
+    throw new Error(`Email template not found: ${locale}/${templateId}`)
+  }
+  const match = template.match(/<title>(.*?)<\/title>/i)
+  const subject = match ? (match[1] as string) : '{{appName}}'
+  return {
+    subject,
+    html: template,
+  }
+}
+
+function getClasses(html: string) {
+  const classes: Record<string, string> = {}
+  const style = html
+    .replaceAll(/\n/g, '')
+    .replaceAll(/\s{2,}/g, ' ')
+    .replace(/.*<style>/, '')
+    .replace(/<\/style>.*/, '')
+  style.split('}').forEach((rule) => {
+    const [selectors, declarations] = rule.split('{')
+    if (!selectors || !declarations) return
+    classes[selectors.trim().replace(/^\./, '')] = declarations.trim()
+  })
+  return classes
+}
+
+function inlineStyles(html: string): string {
+  const classes = getClasses(html)
+  return html.replace(/class="(.*?)"/g, (_, className) => {
+    const styles = className
+      .split(' ')
+      .map((name: string) => classes[name] || '')
+      .join('; ')
+    return `style="${styles}"`
+  })
+}
+
+function appPlaceholders() {
+  const config = useRuntimeConfig()
+  return { appName: config.public.name, url: config.public.url, logo: config.public.logo }
+}
+
+// {{value}} is escaped, {{{value}}} is inserted as raw html. Reach for the raw
+// form only for markup we build ourselves, never for a user-controlled value.
+export function fillTemplate(html: string, params = {}, escape = true) {
+  const context: Record<string, any> = { ...appPlaceholders(), ...params }
+  return html.replace(/{{{(\w+)}}}|{{(\w+)}}/g, (match, rawKey?: string, key?: string) => {
+    const name = rawKey ?? key
+    if (!name) return match
+    const value = context[name]
+    if (value === undefined || value === null) return ''
+    return escape && !rawKey ? escapeHtml(value) : String(value)
+  })
+}