maxibase 1.0.0 → 1.1.0

package/README.md

@@ -10,6 +10,21 @@ Setup your env file by editing the `.env.example` file and rename it to `.env`.
 
 Use the route `http://localhost:3000/dev/email/[templateId]` to see the email while you edit. You can put the locale or any parameter in the query.
 
+### Microsoft sign-in
+
+In your Azure app registration, go to Token configuration → Add optional claim → ID and add
+`email` and `xms_edov`. Without them every Microsoft sign-in is refused.
+
+A Microsoft account signs in to the user with the same email, so the email is only trusted
+when `xms_edov` says its domain is verified in the account's tenant. Any tenant can write any
+address in a user's `mail`, so trusting it unverified lets them sign in as anyone.
+
+The tenant defaults to `organizations`: any work or school account, no personal ones. Set
+`NUXT_OAUTH_MICROSOFT_TENANT=common` to also accept personal accounts.
+
+`/auth/microsoft` signs in with the Microsoft account already signed in, link to
+`/auth/microsoft?prompt=select_account` to let the user pick another one.
+
 ## Deployment
 
 ### On your server
@@ -39,6 +54,9 @@ location /files/ {
     # Optional: Hide S3 headers for security
     proxy_hide_header x-amz-request-id;
     proxy_hide_header x-amz-id-2;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header Content-Security-Policy sandbox always;
 }
 ```
 
@@ -47,6 +65,8 @@ location /files/ {
 ```
 location /files/ {
     alias /home/debian/project/volumes/files/public/;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Content-Security-Policy sandbox always;
 }
 ```
 
@@ -63,7 +83,7 @@ Each build is tagged `{utc-timestamp}-{commit}` and the last 5 stay on the serve
 Roll back with `pnpm rollback` (the version before the live one), `pnpm rollback {tag}`, or
 list what is available with `pnpm rollback --list`. Rolling back does not undo migrations.
 
-Push your migration through SSH with `pnpm db:push-server`.
+Push your migration through SSH with `pnpm db:push-prod`.
 
 In a project that uses the layer, these scripts run from the package, see [Scripts](#scripts).
 
@@ -204,8 +224,9 @@ The tables of the `auth` schema ship with the layer, in `layers/base/server/data
 Your `server/database/schema.ts` re-exports them and adds your own tables, so `pnpm update maxibase`
 brings their changes: run `pnpm db:generate` after an update. To customise one, copy it into your
 schema, a table declared in your file takes precedence over the package's one with the same name.
-Their relations come from `authRelations`, merged after yours in `db.ts`, so only define relations
-on your own tables.
+Their relations come from `authRelations` in `layers/base/server/database/relations.ts`. To add a
+relation to one of these tables, define the table in your `relations.ts`: your entry replaces the
+layer's for that table, so repeat the layer's relations you still need there.
 
 `db.ts`, `relations.ts` and `access.ts` in `server/database` are optional, the layer has a default
 for each in `layers/base/server/database/defaults`: no relations of your own, and file access to
@@ -229,7 +250,7 @@ A project's `package.json` looks like this. Add any package your own files impor
     "db:seed": "npx jiti ./server/database/seed.ts",
     "db:generate": "drizzle-kit generate",
     "db:push": "drizzle-kit push",
-    "db:push-server": "bash node_modules/maxibase/scripts/db/push-server.sh",
+    "db:push-prod": "bash node_modules/maxibase/scripts/db/push-server.sh",
     "db:restore": "bash node_modules/maxibase/scripts/db/restore.sh",
     "db:migrate": "npx jiti node_modules/maxibase/scripts/db/migrate.ts",
     "db:studio": "drizzle-kit studio",

package/docker/Dockerfile

@@ -1,6 +1,6 @@
-FROM node:24-alpine AS build
+FROM node:26-alpine AS build
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN npm install -g corepack && corepack enable
 
 WORKDIR /app
 
@@ -12,7 +12,7 @@ COPY . ./
 
 RUN pnpm build
 
-FROM node:24-alpine
+FROM node:26-alpine
 WORKDIR /app
 
 RUN apk add --no-cache postgresql-client age

package/docker/compose.yaml

@@ -5,8 +5,8 @@ services:
     env_file:
       - .env
     volumes:
-      - ./volumes/files/public:/app/${NUXT_FILES_PUBLIC_FOLDER:-files}
-      - ./volumes/files/private:/app/${NUXT_FILES_PRIVATE_FOLDER:-files}
+      - ./volumes/files/public:/app/${NUXT_FILES_PUBLIC_FOLDER:-files/public}
+      - ./volumes/files/private:/app/${NUXT_FILES_PRIVATE_FOLDER:-files/private}
       - ./volumes/backups:/app/backups
     ports:
       - ${SERVER_PORT:-3000}:3000

package/layers/base/app/components/AuthCheck.vue

@@ -112,15 +112,25 @@ function handleError(error: any) {
   appStore.notify(error.data?.message || 'Bad credentials', 'error')
 }
 
+const signInForm = useTemplateRef<HTMLFormElement>('signInForm')
+let signInTimer: ReturnType<typeof setTimeout> | undefined
+
+watch(totp, (value) => {
+  const digits = value.replace(/\s/g, '')
+  if (digits !== value) totp.value = digits
+})
+
+// Paste, change and submit can fire together: wait for the pasted value, then sign in once
 function signIn() {
-  if (!email.value) return
-  if (options.value.hasTOTP && !totp.value) return
-  setTimeout(() => {
+  clearTimeout(signInTimer)
+  signInTimer = setTimeout(() => {
+    if (!email.value || isLoading.value) return
+    // paste and change bypass the browser's check, which only guards the submit
+    if (!signInForm.value?.reportValidity()) return
     if (totp.value) signInWithTOTP()
-    else if (!password.value) requestOtp()
     else if (password.value.length === 6) signInWithOtp()
     else signInWithPassword()
-  }, 100) // wait for paste event to complete
+  }, 100)
 }
 
 const { authenticate } = useWebAuthn({
@@ -162,9 +172,11 @@ async function getSignInOptions(email: string) {
   }
 }
 
-async function pastePassword() {
+const pasteFields = { password, totp }
+
+async function pasteTo(field: keyof typeof pasteFields) {
   try {
-    password.value = (await navigator.clipboard.readText()).trim()
+    pasteFields[field].value = (await navigator.clipboard.readText()).trim()
     signIn()
   } catch (e) {
     appStore.notify($t('authCheck.clipboardPermission') as string, 'error')
@@ -188,6 +200,7 @@ onMounted(async () => {
       <slot name="header"></slot>
       <form
         v-if="optionsFetched"
+        ref="signInForm"
         class="flex-column g2"
         @submit.prevent="signIn"
       >
@@ -197,52 +210,69 @@ onMounted(async () => {
           :value="email"
           autocomplete="username email"
         />
-        <label for="password">
-          {{
-            options.hasPassword && !otpRequested ? $t('authCheck.password') : $t('authCheck.code')
-          }}
-        </label>
-        <div class="group flex-row">
-          <input
-            id="password"
-            v-model.trim="password"
-            :type="showPassword ? 'text' : 'password'"
-            :disabled="isLoading"
-            autocomplete="current-password"
-            :pattern="
-              otpRequested
-                ? '[0-9]{6}'
-                : `.{${config.public.password.min},${config.public.password.max}}`
-            "
-            @paste="signIn"
-          />
-          <button
-            type="button"
-            class="flex-center fg"
-            @click="showPassword = !showPassword"
-          >
-            <Icon :name="showPassword ? 'lucide:eye-off' : 'lucide:eye'" />
-          </button>
-          <button
-            type="button"
-            class="flex-center fg"
-            :title="$t('paste') as string"
-            @click="pastePassword"
-          >
-            <Icon name="lucide:clipboard-paste" />
-          </button>
+        <div>
+          <label for="password">
+            {{
+              options.hasPassword && !otpRequested ? $t('authCheck.password') : $t('authCheck.code')
+            }}
+          </label>
+          <div class="group flex-row">
+            <input
+              id="password"
+              v-model.trim="password"
+              :type="showPassword ? 'text' : 'password'"
+              :disabled="isLoading"
+              autocomplete="current-password"
+              :pattern="
+                otpRequested
+                  ? '[0-9]{6}'
+                  : `[0-9]{6}|.{${config.public.password.min},${config.public.password.max}}`
+              "
+              required
+              @paste="signIn"
+            />
+            <button
+              type="button"
+              class="flex-center fg"
+              @click="showPassword = !showPassword"
+            >
+              <Icon :name="showPassword ? 'lucide:eye-off' : 'lucide:eye'" />
+            </button>
+            <button
+              type="button"
+              class="flex-center fg"
+              :title="$t('paste') as string"
+              @click="pasteTo('password')"
+            >
+              <Icon name="lucide:clipboard-paste" />
+            </button>
+          </div>
         </div>
         <div v-if="options.hasTOTP">
           <label for="totp">{{ $t('authCheck.authenticatorCode') }}</label>
-          <input
-            id="totp"
-            v-model.trim="totp"
-            type="text"
-            :disabled="isLoading || !password"
-            autocomplete="one-time-code"
-            @paste="signInWithTOTP"
-            @change="signInWithTOTP"
-          />
+          <div class="group flex-row">
+            <input
+              id="totp"
+              v-model.trim="totp"
+              type="text"
+              :disabled="isLoading || !password"
+              autocomplete="one-time-code"
+              inputmode="numeric"
+              pattern="[0-9]{6}"
+              required
+              @paste="signIn"
+              @change="signIn"
+            />
+            <button
+              type="button"
+              class="flex-center fg"
+              :title="$t('paste') as string"
+              :disabled="isLoading || !password"
+              @click="pasteTo('totp')"
+            >
+              <Icon name="lucide:clipboard-paste" />
+            </button>
+          </div>
         </div>
         <button
           type="submit"
@@ -251,6 +281,15 @@ onMounted(async () => {
         >
           {{ $t('authCheck.signin') }}
         </button>
+        <button
+          v-if="options.hasPasskey"
+          type="button"
+          :disabled="isLoading"
+          class="flex-center g1 w mt1 bg bg-border"
+          @click="signInWithPasskey"
+        >
+          {{ $t('authCheck.passkey') }}
+        </button>
         <button
           v-if="!otpRequested"
           type="button"

package/layers/base/app/components/files/FilesUpload.vue

@@ -47,6 +47,15 @@ async function uploadFile(event: Event) {
         appStore.notify('formatFailed', 'error', false, { files: failed.join(', ') })
       }
     }
+    const maxSize = Number(useRuntimeConfig().public.files.maxSize)
+    const tooLarge = files.filter((file) => file.size > maxSize * 1024 * 1024)
+    if (tooLarge.length) {
+      appStore.notify('fileTooLarge', 'error', false, {
+        files: tooLarge.map((file) => file.name).join(', '),
+        max: maxSize,
+      })
+      files = files.filter((file) => !tooLarge.includes(file))
+    }
     if (files.length) {
       let response = await uploadFiles(files, props.path, props.isPrivate, (p) => {
         progress.value = p

package/layers/base/app/pages/user/auth.vue

@@ -38,7 +38,7 @@ const { $getLocale, $t } = useI18n()
 const isMfaSetup = computed(() => user.value?.requiresMfaSetup === true)
 
 async function checkAuth() {
-  return isMfaSetup.value || (await appStore.checkAuth())
+  return appStore.checkAuth()
 }
 
 const isCurrentEmail = computed(() => {
@@ -424,14 +424,14 @@ onMounted(getAuth)
             />
             <button
               type="button"
-              class="bg danger-text flex"
+              class="bg danger-text flex-center"
               :disabled="!canRemovePasskey"
               :title="canRemovePasskey ? '' : $t('lastFactor')"
               @click="deletePasskey(credential.id)"
             >
               <Icon name="lucide:trash" />
             </button>
-            <button class="flex fg"><Icon name="lucide:save" /></button>
+            <button class="flex-center fg"><Icon name="lucide:save" /></button>
           </div>
         </form>
         <button

package/layers/base/app/stores/app.ts

@@ -15,7 +15,7 @@ export const useAppStore = defineStore('app', () => {
     reject: (value?: any) => any
   } | null>(null)
 
-  const authVerifiedAt = ref(0)
+  const { session } = useUserSession()
   const authPromise = ref()
 
   function confirm(message?: string) {
@@ -32,19 +32,14 @@ export const useAppStore = defineStore('app', () => {
 
   async function checkAuth(): Promise<boolean> {
     const reverifyAfter = useRuntimeConfig().public.recentAuth.maxAge * 1000
-    if (Date.now() - authVerifiedAt.value < reverifyAfter) {
+    if (Date.now() - (session.value?.authenticatedAt ?? 0) < reverifyAfter) {
       return true
     }
     return new Promise<boolean>((resolve) => {
       authPromise.value = { resolve }
+    }).finally(() => {
+      authPromise.value = null
     })
-      .then((verified) => {
-        if (verified) authVerifiedAt.value = Date.now()
-        return verified
-      })
-      .finally(() => {
-        authPromise.value = null
-      })
   }
 
   function setLoading(state: boolean) {

package/layers/base/nuxt.config.ts

@@ -27,6 +27,7 @@ export default defineNuxtConfig({
       files: {
         url: '/files',
         chunkSize: 5, // in MB
+        maxSize: 100, // in MB
       },
     },
     session: {
@@ -38,7 +39,7 @@ export default defineNuxtConfig({
       microsoft: {
         clientId: '',
         clientSecret: '',
-        tenant: 'common',
+        tenant: 'organizations',
       },
     },
     refreshToken: {
@@ -66,7 +67,7 @@ export default defineNuxtConfig({
       secretAccessKey: '',
     },
     backup: {
-      dumpArgs: '-F c',
+      dumpArgs: '-F c --exclude-table-data=auth.refresh_tokens',
       retentionDays: 30,
       agePublicKey: '', // age public key to encrypt backups
     },
@@ -88,7 +89,7 @@ export default defineNuxtConfig({
     },
     scheduledTasks: {
       '0 3 * * *': 'backup',
-      '0 2 1 * *': 'clean',
+      '0 2 * * *': 'clean',
     },
     storage: {
       auth: {

package/layers/base/server/api/admin/logs.get.ts

@@ -9,8 +9,7 @@ const querySchema = z.object({
 })
 
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event)
-  const { from, to, search, type, limit } = querySchema.parse(query)
+  const { from, to, search, type, limit } = await getValidatedQuery(event, querySchema.parse)
   const text = prepareStringForSearch(search)
 
   const rows = await db.query.logs.findMany({

package/layers/base/server/api/auth/otp/get.post.ts

@@ -22,12 +22,6 @@ export default defineEventHandler(async (event) => {
     goto,
     path = 'signin',
   } = await readValidatedBody(event, bodySchema.parse)
-  if (!email || typeof email !== 'string') {
-    throw createError({
-      status: 400,
-      message: 'Email is required',
-    })
-  }
 
   const storage = useStorage('auth')
   const record = await storage.getItem<OTP>(email)

package/layers/base/server/api/auth/otp/verify.post.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import type { H3Event } from 'h3'
 import type { OTP } from './get.post'
 
 const bodySchema = z.object({
@@ -8,47 +9,44 @@ const bodySchema = z.object({
 
 export default defineEventHandler(async (event) => {
   const { email, otp } = await readValidatedBody(event, bodySchema.parse)
-  if (!email || !otp) {
-    throw createError({
-      status: 400,
-      message: 'Email and OTP are required',
-    })
-  }
-  await verifyOTP(email, otp)
 
-  const session = await getUserSession(event)
-  if (session?.user?.isAnonymous) {
-    let user: any = await getAuth(event, email).catch(() => null)
-    if (!user) {
-      user = {
-        id: session.user.id,
-        email,
-      }
-      await setAuth(user)
-    }
-    return await setSession(event, user)
-  }
+  const existing = await getAuth(event, email, true).catch((error) => {
+    if (error.statusCode !== 404) throw error
+    return null
+  })
+  if (existing) requireSecondFactor(existing)
 
-  const user = await getAuth(event, email).catch((error) => {
-    const config = useRuntimeConfig()
+  await verifyOTP(email, otp)
 
-    if (error.statusCode === 404 && config.autoSignup) {
-      return createAuth({ email })
-    }
-    throw error
-  })
-  if (user.totp) {
-    throw createError({
-      status: 401,
-      message: 'TOTP required',
-    })
-  }
-  await setSession(event, user)
+  const user = existing ?? (await signUp(event, email))
+  requireSecondFactor(user) // an anonymous account can already have a TOTP
+  return setSession(event, user)
 })
 
+async function signUp(event: H3Event, email: string) {
+  const session = await getUserSession(event)
+  if (session?.user?.isAnonymous) return setAuth({ id: session.user.id, email })
+  if (useRuntimeConfig().autoSignup) return createAuth({ email })
+  throw createError({ status: 404, message: 'User not found' })
+}
+
 const MAX_OTP_ATTEMPTS = 3
 
-export async function verifyOTP(email: string, otp: string): Promise<void> {
+const verifying = new Set<string>()
+
+export async function verifyOTP(email: string, otp: string, consume = true): Promise<void> {
+  if (verifying.has(email)) {
+    throw createError({ status: 429, message: 'Verification already in progress.' })
+  }
+  verifying.add(email)
+  try {
+    await checkOTP(email, otp, consume)
+  } finally {
+    verifying.delete(email)
+  }
+}
+
+async function checkOTP(email: string, otp: string, consume: boolean) {
   const storage = useStorage('auth')
   const record = await storage.getItem<OTP>(email)
   if (!record) {
@@ -59,12 +57,12 @@ export async function verifyOTP(email: string, otp: string): Promise<void> {
     throw createError({ status: 400, message: 'Request a new OTP.' })
   }
 
+  record.attempts++
+  await storage.setItem(email, record)
+
   const hash = otp.length > 6 ? record.token : record.otp
-  if (hash && (await verifyPassword(hash, otp))) {
-    await storage.removeItem(email)
-  } else {
-    record.attempts++
-    await storage.setItem(email, record)
+  if (!hash || !(await verifyPassword(hash, otp))) {
     throw createError({ status: 400, message: 'Invalid OTP.' })
   }
+  if (consume) await storage.removeItem(email)
 }

package/layers/base/server/api/auth/password.post.ts

@@ -16,7 +16,7 @@ export default defineEventHandler(async (event) => {
     }).parse,
   )
 
-  const user = await getAuth(event, email).catch((error: any) => {
+  const user = await getAuth(event, email, true).catch((error: any) => {
     if (error?.statusCode === 404) return null
     throw error
   })
@@ -31,12 +31,7 @@ export default defineEventHandler(async (event) => {
     throw badCredentials()
   }
 
-  if (user.totp) {
-    throw createError({
-      status: 401,
-      message: 'TOTP required',
-    })
-  }
+  requireSecondFactor(user)
 
   return setSession(event, user)
 })

package/layers/base/server/api/auth/refresh.post.ts

@@ -1,5 +1,5 @@
 export default defineEventHandler(async (event) => {
-  const { user, refreshToken } = await verifyRefreshToken(event)
-  await revokeRefreshToken(refreshToken.token)
+  const { user } = await verifyRefreshToken(event)
+  await revokeRefreshToken(getCookie(event, 'refresh_token')!) // verified above, so it is set
   await createRefreshToken(user.id, event)
 })

package/layers/base/server/api/auth/totp/confirm.post.ts

@@ -10,16 +10,10 @@ const bodySchema = z.object({
 
 export default defineEventHandler(async (event) => {
   const { secret, token } = await readValidatedBody(event, bodySchema.parse)
-  if (!secret || !token) {
-    throw createError({
-      status: 400,
-      message: 'Missing required fields',
-    })
-  }
 
   const { user } = await requireRecentAuth(event)
 
-  if (await verify({ secret, token })) {
+  if ((await verify({ secret, token })).valid) {
     await db.update(auth).set({ totp: secret }).where(eq(auth.id, user.id))
     await setSession(event, user, false) // refresh requiresMfaSetup
   } else throw createError({ status: 400, message: 'Invalid code.' })

package/layers/base/server/api/auth/totp/verify.post.ts

@@ -12,25 +12,34 @@ export default defineEventHandler(async (event) => {
       token: z.string().length(6),
     }).parse,
   )
-  if (!email || !(otp || password) || !token) {
+  if (!otp && !password) {
     throw createError({
       status: 400,
       message: 'Missing required fields',
     })
   }
 
-  const user = await getAuth(event, email)
+  const user = await getAuth(event, email).catch((error: any) => {
+    if (error?.statusCode === 404) return null
+    throw error
+  })
 
-  if (otp) await verifyOTP(email, otp)
-  else if (!user.password || !(await verifyPassword(user.password, password!))) {
+  if (otp) await verifyOTP(email, otp, false)
+  else if (!user?.password) {
+    await hashPassword(password!)
+    throw createError({ status: 400, message: 'Invalid password.' })
+  } else if (!(await verifyPassword(user.password, password!))) {
     throw createError({ status: 400, message: 'Invalid password.' })
   }
 
-  if (!user.totp) {
+  if (!user?.totp) {
     throw createError({ status: 400, message: 'TOTP is not enabled.' })
   }
 
-  if (await verify({ secret: user.totp, token })) {
+  await enforceRateLimit(event, 'totp', { limit: 5, window: 900 }, user.id)
+
+  if ((await verify({ secret: user.totp, token })).valid) {
+    if (otp) await useStorage('auth').removeItem(email)
     await setSession(event, user)
   } else throw createError({ status: 400, message: 'Invalid TOTP.' })
 })

package/layers/base/server/api/auth/webauthn/authenticate.post.ts

@@ -1,5 +1,5 @@
 import { eq } from 'drizzle-orm'
-import { auth } from '#server/database/schema'
+import { auth, credentials } from '#server/database/schema'
 
 export default defineWebAuthnAuthenticateEventHandler({
   async storeChallenge(event, challenge, attemptId) {
@@ -28,7 +28,13 @@ export default defineWebAuthnAuthenticateEventHandler({
     if (!credential) throw createError({ status: 400, message: 'Credential not found' })
     return credential as any
   },
-  async onSuccess(event, { credential }) {
+  async onSuccess(event, { credential, authenticationInfo }) {
+    // the next assertion must report a higher counter, which exposes a cloned authenticator
+    await db
+      .update(credentials)
+      .set({ counter: authenticationInfo.newCounter })
+      .where(eq(credentials.id, credential.id))
+
     const user = await db
       .select()
       .from(auth)