maxibase 1.0.1 → 1.1.0

package/README.md

@@ -10,6 +10,21 @@ Setup your env file by editing the `.env.example` file and rename it to `.env`.
 
 Use the route `http://localhost:3000/dev/email/[templateId]` to see the email while you edit. You can put the locale or any parameter in the query.
 
+### Microsoft sign-in
+
+In your Azure app registration, go to Token configuration → Add optional claim → ID and add
+`email` and `xms_edov`. Without them every Microsoft sign-in is refused.
+
+A Microsoft account signs in to the user with the same email, so the email is only trusted
+when `xms_edov` says its domain is verified in the account's tenant. Any tenant can write any
+address in a user's `mail`, so trusting it unverified lets them sign in as anyone.
+
+The tenant defaults to `organizations`: any work or school account, no personal ones. Set
+`NUXT_OAUTH_MICROSOFT_TENANT=common` to also accept personal accounts.
+
+`/auth/microsoft` signs in with the Microsoft account already signed in, link to
+`/auth/microsoft?prompt=select_account` to let the user pick another one.
+
 ## Deployment
 
 ### On your server
@@ -39,6 +54,9 @@ location /files/ {
     # Optional: Hide S3 headers for security
     proxy_hide_header x-amz-request-id;
     proxy_hide_header x-amz-id-2;
+
+    add_header X-Content-Type-Options nosniff always;
+    add_header Content-Security-Policy sandbox always;
 }
 ```
 
@@ -47,6 +65,8 @@ location /files/ {
 ```
 location /files/ {
     alias /home/debian/project/volumes/files/public/;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Content-Security-Policy sandbox always;
 }
 ```
 

package/docker/Dockerfile

@@ -1,6 +1,6 @@
-FROM node:24-alpine AS build
+FROM node:26-alpine AS build
 
-RUN corepack enable && corepack prepare pnpm@latest --activate
+RUN npm install -g corepack && corepack enable
 
 WORKDIR /app
 
@@ -12,7 +12,7 @@ COPY . ./
 
 RUN pnpm build
 
-FROM node:24-alpine
+FROM node:26-alpine
 WORKDIR /app
 
 RUN apk add --no-cache postgresql-client age

package/layers/base/app/components/AuthCheck.vue

@@ -112,15 +112,25 @@ function handleError(error: any) {
   appStore.notify(error.data?.message || 'Bad credentials', 'error')
 }
 
+const signInForm = useTemplateRef<HTMLFormElement>('signInForm')
+let signInTimer: ReturnType<typeof setTimeout> | undefined
+
+watch(totp, (value) => {
+  const digits = value.replace(/\s/g, '')
+  if (digits !== value) totp.value = digits
+})
+
+// Paste, change and submit can fire together: wait for the pasted value, then sign in once
 function signIn() {
-  if (!email.value) return
-  if (options.value.hasTOTP && !totp.value) return
-  setTimeout(() => {
+  clearTimeout(signInTimer)
+  signInTimer = setTimeout(() => {
+    if (!email.value || isLoading.value) return
+    // paste and change bypass the browser's check, which only guards the submit
+    if (!signInForm.value?.reportValidity()) return
     if (totp.value) signInWithTOTP()
-    else if (!password.value) requestOtp()
     else if (password.value.length === 6) signInWithOtp()
     else signInWithPassword()
-  }, 100) // wait for paste event to complete
+  }, 100)
 }
 
 const { authenticate } = useWebAuthn({
@@ -162,9 +172,11 @@ async function getSignInOptions(email: string) {
   }
 }
 
-async function pastePassword() {
+const pasteFields = { password, totp }
+
+async function pasteTo(field: keyof typeof pasteFields) {
   try {
-    password.value = (await navigator.clipboard.readText()).trim()
+    pasteFields[field].value = (await navigator.clipboard.readText()).trim()
     signIn()
   } catch (e) {
     appStore.notify($t('authCheck.clipboardPermission') as string, 'error')
@@ -188,6 +200,7 @@ onMounted(async () => {
       <slot name="header"></slot>
       <form
         v-if="optionsFetched"
+        ref="signInForm"
         class="flex-column g2"
         @submit.prevent="signIn"
       >
@@ -197,52 +210,69 @@ onMounted(async () => {
           :value="email"
           autocomplete="username email"
         />
-        <label for="password">
-          {{
-            options.hasPassword && !otpRequested ? $t('authCheck.password') : $t('authCheck.code')
-          }}
-        </label>
-        <div class="group flex-row">
-          <input
-            id="password"
-            v-model.trim="password"
-            :type="showPassword ? 'text' : 'password'"
-            :disabled="isLoading"
-            autocomplete="current-password"
-            :pattern="
-              otpRequested
-                ? '[0-9]{6}'
-                : `.{${config.public.password.min},${config.public.password.max}}`
-            "
-            @paste="signIn"
-          />
-          <button
-            type="button"
-            class="flex-center fg"
-            @click="showPassword = !showPassword"
-          >
-            <Icon :name="showPassword ? 'lucide:eye-off' : 'lucide:eye'" />
-          </button>
-          <button
-            type="button"
-            class="flex-center fg"
-            :title="$t('paste') as string"
-            @click="pastePassword"
-          >
-            <Icon name="lucide:clipboard-paste" />
-          </button>
+        <div>
+          <label for="password">
+            {{
+              options.hasPassword && !otpRequested ? $t('authCheck.password') : $t('authCheck.code')
+            }}
+          </label>
+          <div class="group flex-row">
+            <input
+              id="password"
+              v-model.trim="password"
+              :type="showPassword ? 'text' : 'password'"
+              :disabled="isLoading"
+              autocomplete="current-password"
+              :pattern="
+                otpRequested
+                  ? '[0-9]{6}'
+                  : `[0-9]{6}|.{${config.public.password.min},${config.public.password.max}}`
+              "
+              required
+              @paste="signIn"
+            />
+            <button
+              type="button"
+              class="flex-center fg"
+              @click="showPassword = !showPassword"
+            >
+              <Icon :name="showPassword ? 'lucide:eye-off' : 'lucide:eye'" />
+            </button>
+            <button
+              type="button"
+              class="flex-center fg"
+              :title="$t('paste') as string"
+              @click="pasteTo('password')"
+            >
+              <Icon name="lucide:clipboard-paste" />
+            </button>
+          </div>
         </div>
         <div v-if="options.hasTOTP">
           <label for="totp">{{ $t('authCheck.authenticatorCode') }}</label>
-          <input
-            id="totp"
-            v-model.trim="totp"
-            type="text"
-            :disabled="isLoading || !password"
-            autocomplete="one-time-code"
-            @paste="signInWithTOTP"
-            @change="signInWithTOTP"
-          />
+          <div class="group flex-row">
+            <input
+              id="totp"
+              v-model.trim="totp"
+              type="text"
+              :disabled="isLoading || !password"
+              autocomplete="one-time-code"
+              inputmode="numeric"
+              pattern="[0-9]{6}"
+              required
+              @paste="signIn"
+              @change="signIn"
+            />
+            <button
+              type="button"
+              class="flex-center fg"
+              :title="$t('paste') as string"
+              :disabled="isLoading || !password"
+              @click="pasteTo('totp')"
+            >
+              <Icon name="lucide:clipboard-paste" />
+            </button>
+          </div>
         </div>
         <button
           type="submit"
@@ -251,6 +281,15 @@ onMounted(async () => {
         >
           {{ $t('authCheck.signin') }}
         </button>
+        <button
+          v-if="options.hasPasskey"
+          type="button"
+          :disabled="isLoading"
+          class="flex-center g1 w mt1 bg bg-border"
+          @click="signInWithPasskey"
+        >
+          {{ $t('authCheck.passkey') }}
+        </button>
         <button
           v-if="!otpRequested"
           type="button"

package/layers/base/app/components/files/FilesUpload.vue

@@ -47,6 +47,15 @@ async function uploadFile(event: Event) {
         appStore.notify('formatFailed', 'error', false, { files: failed.join(', ') })
       }
     }
+    const maxSize = Number(useRuntimeConfig().public.files.maxSize)
+    const tooLarge = files.filter((file) => file.size > maxSize * 1024 * 1024)
+    if (tooLarge.length) {
+      appStore.notify('fileTooLarge', 'error', false, {
+        files: tooLarge.map((file) => file.name).join(', '),
+        max: maxSize,
+      })
+      files = files.filter((file) => !tooLarge.includes(file))
+    }
     if (files.length) {
       let response = await uploadFiles(files, props.path, props.isPrivate, (p) => {
         progress.value = p

package/layers/base/app/pages/user/auth.vue

@@ -38,7 +38,7 @@ const { $getLocale, $t } = useI18n()
 const isMfaSetup = computed(() => user.value?.requiresMfaSetup === true)
 
 async function checkAuth() {
-  return isMfaSetup.value || (await appStore.checkAuth())
+  return appStore.checkAuth()
 }
 
 const isCurrentEmail = computed(() => {
@@ -424,14 +424,14 @@ onMounted(getAuth)
             />
             <button
               type="button"
-              class="bg danger-text flex"
+              class="bg danger-text flex-center"
               :disabled="!canRemovePasskey"
               :title="canRemovePasskey ? '' : $t('lastFactor')"
               @click="deletePasskey(credential.id)"
             >
               <Icon name="lucide:trash" />
             </button>
-            <button class="flex fg"><Icon name="lucide:save" /></button>
+            <button class="flex-center fg"><Icon name="lucide:save" /></button>
           </div>
         </form>
         <button

package/layers/base/app/stores/app.ts

@@ -15,7 +15,7 @@ export const useAppStore = defineStore('app', () => {
     reject: (value?: any) => any
   } | null>(null)
 
-  const authVerifiedAt = ref(0)
+  const { session } = useUserSession()
   const authPromise = ref()
 
   function confirm(message?: string) {
@@ -32,19 +32,14 @@ export const useAppStore = defineStore('app', () => {
 
   async function checkAuth(): Promise<boolean> {
     const reverifyAfter = useRuntimeConfig().public.recentAuth.maxAge * 1000
-    if (Date.now() - authVerifiedAt.value < reverifyAfter) {
+    if (Date.now() - (session.value?.authenticatedAt ?? 0) < reverifyAfter) {
       return true
     }
     return new Promise<boolean>((resolve) => {
       authPromise.value = { resolve }
+    }).finally(() => {
+      authPromise.value = null
     })
-      .then((verified) => {
-        if (verified) authVerifiedAt.value = Date.now()
-        return verified
-      })
-      .finally(() => {
-        authPromise.value = null
-      })
   }
 
   function setLoading(state: boolean) {

package/layers/base/nuxt.config.ts

@@ -27,6 +27,7 @@ export default defineNuxtConfig({
       files: {
         url: '/files',
         chunkSize: 5, // in MB
+        maxSize: 100, // in MB
       },
     },
     session: {
@@ -38,7 +39,7 @@ export default defineNuxtConfig({
       microsoft: {
         clientId: '',
         clientSecret: '',
-        tenant: 'common',
+        tenant: 'organizations',
       },
     },
     refreshToken: {
@@ -66,7 +67,7 @@ export default defineNuxtConfig({
       secretAccessKey: '',
     },
     backup: {
-      dumpArgs: '-F c',
+      dumpArgs: '-F c --exclude-table-data=auth.refresh_tokens',
       retentionDays: 30,
       agePublicKey: '', // age public key to encrypt backups
     },
@@ -88,7 +89,7 @@ export default defineNuxtConfig({
     },
     scheduledTasks: {
       '0 3 * * *': 'backup',
-      '0 2 1 * *': 'clean',
+      '0 2 * * *': 'clean',
     },
     storage: {
       auth: {

package/layers/base/server/api/admin/logs.get.ts

@@ -9,8 +9,7 @@ const querySchema = z.object({
 })
 
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event)
-  const { from, to, search, type, limit } = querySchema.parse(query)
+  const { from, to, search, type, limit } = await getValidatedQuery(event, querySchema.parse)
   const text = prepareStringForSearch(search)
 
   const rows = await db.query.logs.findMany({

package/layers/base/server/api/auth/otp/get.post.ts

@@ -22,12 +22,6 @@ export default defineEventHandler(async (event) => {
     goto,
     path = 'signin',
   } = await readValidatedBody(event, bodySchema.parse)
-  if (!email || typeof email !== 'string') {
-    throw createError({
-      status: 400,
-      message: 'Email is required',
-    })
-  }
 
   const storage = useStorage('auth')
   const record = await storage.getItem<OTP>(email)

package/layers/base/server/api/auth/otp/verify.post.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import type { H3Event } from 'h3'
 import type { OTP } from './get.post'
 
 const bodySchema = z.object({
@@ -8,47 +9,44 @@ const bodySchema = z.object({
 
 export default defineEventHandler(async (event) => {
   const { email, otp } = await readValidatedBody(event, bodySchema.parse)
-  if (!email || !otp) {
-    throw createError({
-      status: 400,
-      message: 'Email and OTP are required',
-    })
-  }
-  await verifyOTP(email, otp)
 
-  const session = await getUserSession(event)
-  if (session?.user?.isAnonymous) {
-    let user: any = await getAuth(event, email).catch(() => null)
-    if (!user) {
-      user = {
-        id: session.user.id,
-        email,
-      }
-      await setAuth(user)
-    }
-    return await setSession(event, user)
-  }
+  const existing = await getAuth(event, email, true).catch((error) => {
+    if (error.statusCode !== 404) throw error
+    return null
+  })
+  if (existing) requireSecondFactor(existing)
 
-  const user = await getAuth(event, email).catch((error) => {
-    const config = useRuntimeConfig()
+  await verifyOTP(email, otp)
 
-    if (error.statusCode === 404 && config.autoSignup) {
-      return createAuth({ email })
-    }
-    throw error
-  })
-  if (user.totp) {
-    throw createError({
-      status: 401,
-      message: 'TOTP required',
-    })
-  }
-  await setSession(event, user)
+  const user = existing ?? (await signUp(event, email))
+  requireSecondFactor(user) // an anonymous account can already have a TOTP
+  return setSession(event, user)
 })
 
+async function signUp(event: H3Event, email: string) {
+  const session = await getUserSession(event)
+  if (session?.user?.isAnonymous) return setAuth({ id: session.user.id, email })
+  if (useRuntimeConfig().autoSignup) return createAuth({ email })
+  throw createError({ status: 404, message: 'User not found' })
+}
+
 const MAX_OTP_ATTEMPTS = 3
 
-export async function verifyOTP(email: string, otp: string): Promise<void> {
+const verifying = new Set<string>()
+
+export async function verifyOTP(email: string, otp: string, consume = true): Promise<void> {
+  if (verifying.has(email)) {
+    throw createError({ status: 429, message: 'Verification already in progress.' })
+  }
+  verifying.add(email)
+  try {
+    await checkOTP(email, otp, consume)
+  } finally {
+    verifying.delete(email)
+  }
+}
+
+async function checkOTP(email: string, otp: string, consume: boolean) {
   const storage = useStorage('auth')
   const record = await storage.getItem<OTP>(email)
   if (!record) {
@@ -59,12 +57,12 @@ export async function verifyOTP(email: string, otp: string): Promise<void> {
     throw createError({ status: 400, message: 'Request a new OTP.' })
   }
 
+  record.attempts++
+  await storage.setItem(email, record)
+
   const hash = otp.length > 6 ? record.token : record.otp
-  if (hash && (await verifyPassword(hash, otp))) {
-    await storage.removeItem(email)
-  } else {
-    record.attempts++
-    await storage.setItem(email, record)
+  if (!hash || !(await verifyPassword(hash, otp))) {
     throw createError({ status: 400, message: 'Invalid OTP.' })
   }
+  if (consume) await storage.removeItem(email)
 }

package/layers/base/server/api/auth/password.post.ts

@@ -16,7 +16,7 @@ export default defineEventHandler(async (event) => {
     }).parse,
   )
 
-  const user = await getAuth(event, email).catch((error: any) => {
+  const user = await getAuth(event, email, true).catch((error: any) => {
     if (error?.statusCode === 404) return null
     throw error
   })
@@ -31,12 +31,7 @@ export default defineEventHandler(async (event) => {
     throw badCredentials()
   }
 
-  if (user.totp) {
-    throw createError({
-      status: 401,
-      message: 'TOTP required',
-    })
-  }
+  requireSecondFactor(user)
 
   return setSession(event, user)
 })

package/layers/base/server/api/auth/refresh.post.ts

@@ -1,5 +1,5 @@
 export default defineEventHandler(async (event) => {
-  const { user, refreshToken } = await verifyRefreshToken(event)
-  await revokeRefreshToken(refreshToken.token)
+  const { user } = await verifyRefreshToken(event)
+  await revokeRefreshToken(getCookie(event, 'refresh_token')!) // verified above, so it is set
   await createRefreshToken(user.id, event)
 })

package/layers/base/server/api/auth/totp/confirm.post.ts

@@ -10,16 +10,10 @@ const bodySchema = z.object({
 
 export default defineEventHandler(async (event) => {
   const { secret, token } = await readValidatedBody(event, bodySchema.parse)
-  if (!secret || !token) {
-    throw createError({
-      status: 400,
-      message: 'Missing required fields',
-    })
-  }
 
   const { user } = await requireRecentAuth(event)
 
-  if (await verify({ secret, token })) {
+  if ((await verify({ secret, token })).valid) {
     await db.update(auth).set({ totp: secret }).where(eq(auth.id, user.id))
     await setSession(event, user, false) // refresh requiresMfaSetup
   } else throw createError({ status: 400, message: 'Invalid code.' })

package/layers/base/server/api/auth/totp/verify.post.ts

@@ -12,25 +12,34 @@ export default defineEventHandler(async (event) => {
       token: z.string().length(6),
     }).parse,
   )
-  if (!email || !(otp || password) || !token) {
+  if (!otp && !password) {
     throw createError({
       status: 400,
       message: 'Missing required fields',
     })
   }
 
-  const user = await getAuth(event, email)
+  const user = await getAuth(event, email).catch((error: any) => {
+    if (error?.statusCode === 404) return null
+    throw error
+  })
 
-  if (otp) await verifyOTP(email, otp)
-  else if (!user.password || !(await verifyPassword(user.password, password!))) {
+  if (otp) await verifyOTP(email, otp, false)
+  else if (!user?.password) {
+    await hashPassword(password!)
+    throw createError({ status: 400, message: 'Invalid password.' })
+  } else if (!(await verifyPassword(user.password, password!))) {
     throw createError({ status: 400, message: 'Invalid password.' })
   }
 
-  if (!user.totp) {
+  if (!user?.totp) {
     throw createError({ status: 400, message: 'TOTP is not enabled.' })
   }
 
-  if (await verify({ secret: user.totp, token })) {
+  await enforceRateLimit(event, 'totp', { limit: 5, window: 900 }, user.id)
+
+  if ((await verify({ secret: user.totp, token })).valid) {
+    if (otp) await useStorage('auth').removeItem(email)
     await setSession(event, user)
   } else throw createError({ status: 400, message: 'Invalid TOTP.' })
 })

package/layers/base/server/api/auth/webauthn/authenticate.post.ts

@@ -1,5 +1,5 @@
 import { eq } from 'drizzle-orm'
-import { auth } from '#server/database/schema'
+import { auth, credentials } from '#server/database/schema'
 
 export default defineWebAuthnAuthenticateEventHandler({
   async storeChallenge(event, challenge, attemptId) {
@@ -28,7 +28,13 @@ export default defineWebAuthnAuthenticateEventHandler({
     if (!credential) throw createError({ status: 400, message: 'Credential not found' })
     return credential as any
   },
-  async onSuccess(event, { credential }) {
+  async onSuccess(event, { credential, authenticationInfo }) {
+    // the next assertion must report a higher counter, which exposes a cloned authenticator
+    await db
+      .update(credentials)
+      .set({ counter: authenticationInfo.newCounter })
+      .where(eq(credentials.id, credential.id))
+
     const user = await db
       .select()
       .from(auth)

package/layers/base/server/api/files/[...path].get.ts

@@ -5,19 +5,26 @@ const querySchema = z.object({
     .enum(['true', 'false'])
     .transform((v) => v === 'true')
     .optional(),
-  maxAge: z.coerce.number().optional(),
-  serverCache: z.string().optional(),
-  expireIn: z.coerce.number().optional(),
+  maxAge: z.coerce.number().int().min(0).optional(),
+  // only-if-cached is left out, fetch throws on it outside same-origin mode
+  serverCache: z.enum(['default', 'no-store', 'reload', 'no-cache', 'force-cache']).optional(),
+  // S3 refuses to presign a URL for longer than 7 days
+  expireIn: z.coerce.number().int().positive().max(604800).optional(),
   redirect: z
     .enum(['true', 'false'])
     .transform((v) => v === 'true')
     .optional(),
 })
 
-export default defineEventHandler((event) => {
+export default defineEventHandler(async (event) => {
   const path = event.context.params?.path || ''
-  const query = getQuery(event)
-  const { isPrivate = false, maxAge, serverCache, expireIn, redirect } = querySchema.parse(query)
+  const {
+    isPrivate = false,
+    maxAge,
+    serverCache,
+    expireIn,
+    redirect,
+  } = await getValidatedQuery(event, querySchema.parse)
 
   let cache = `public, max-age=${maxAge || 31536000}`
   if (maxAge === 0) {
@@ -26,12 +33,14 @@ export default defineEventHandler((event) => {
     cache = `private, max-age=${maxAge || 3600}`
   }
   setHeader(event, 'Cache-Control', cache)
-  return getFile(
-    event,
-    decodeURIComponent(path),
-    isPrivate,
-    serverCache as RequestCache,
-    expireIn,
-    redirect,
-  )
+  return getFile(event, decodePath(path), isPrivate, serverCache, expireIn, redirect)
 })
+
+// h3 decodes the path but keeps %25 encoded, so a % in a name needs this second pass
+function decodePath(path: string) {
+  try {
+    return decodeURIComponent(path)
+  } catch {
+    throw createError({ status: 400, message: 'Invalid path' }) // a % not followed by hex
+  }
+}

package/layers/base/server/api/files/chunk.post.ts

@@ -1,5 +1,26 @@
+import { z } from 'zod'
+
+const partsSchema = z.array(
+  z.object({
+    ETag: z.string().optional(), // absent on local uploads
+    PartNumber: z.number().int().positive(),
+  }),
+)
+
+function invalidChunkUpload() {
+  return createError({ status: 400, message: 'Invalid chunk upload' })
+}
+
+export function parseParts(value?: string) {
+  try {
+    return partsSchema.parse(JSON.parse(value || '[]'))
+  } catch {
+    throw invalidChunkUpload()
+  }
+}
+
 export default defineEventHandler(async (event) => {
-  const body = await readMultipartFormData(event)
+  const body = await readUploadBody(event, Number(useRuntimeConfig().public.files.chunkSize) || 1)
   if (!body) throw createError({ status: 400, message: 'No data' })
 
   const get = (name: string) =>
@@ -15,11 +36,11 @@ export default defineEventHandler(async (event) => {
   const type = get('type') || 'application/octet-stream'
   const path = get('path') || 'files'
   const isPrivate = get('isPrivate') !== 'false'
-  const parts = get('parts') ? JSON.parse(get('parts') || '[]') : []
+  const parts = parseParts(get('parts'))
   const chunkPart = body.find((p) => p.name === 'chunk')
 
-  if (isNaN(chunkIndex) || isNaN(totalChunks) || !filename || !chunkPart) {
-    throw createError({ status: 400, message: 'Invalid chunk upload' })
+  if (!Number.isInteger(chunkIndex) || !Number.isInteger(totalChunks) || !filename || !chunkPart) {
+    throw invalidChunkUpload()
   }
 
   return uploadChunk(event, {

package/layers/base/server/api/files/index.get.ts

@@ -12,8 +12,6 @@ const querySchema = z.object({
 })
 
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event)
-
-  const { path, isPrivate = false } = querySchema.parse(query)
+  const { path, isPrivate = false } = await getValidatedQuery(event, querySchema.parse)
   return listFolder(event, path, isPrivate)
 })

package/layers/base/server/api/files/index.post.ts

@@ -1,5 +1,5 @@
 export default defineEventHandler(async (event) => {
-  const body = await readMultipartFormData(event)
+  const body = await readUploadBody(event, Number(useRuntimeConfig().public.files.maxSize))
   if (!body) {
     throw createError({ status: 400, message: 'No file uploaded' })
   }

package/layers/base/server/middleware/0.rateLimit.ts

@@ -4,7 +4,7 @@ export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
   if (!config.rateLimit.enabled) return
 
-  const path = getRequestURL(event).pathname
+  const path = event.path.split('?')[0]!
   const routes = config.rateLimit.routes as Record<string, RateLimitRule>
 
   let matchedRoute = ''

package/layers/base/server/routes/auth/microsoft.get.ts

@@ -1,21 +1,34 @@
-export default defineOAuthMicrosoftEventHandler({
-  async onSuccess(event, { user }) {
-    if (!user.mail) {
-      throw createError({
-        status: 401,
-        message: 'This Microsoft account has no email address',
-      })
-    }
+import type { H3Event } from 'h3'
 
-    const auth = await getAuth(event, user.mail).catch((error) => {
-      const config = useRuntimeConfig()
+const scope = ['openid', 'email', 'User.Read']
 
-      if (error.statusCode === 404 && config.autoSignup) {
-        return createAuth({ email: user.mail })
-      }
-      throw error
+async function onSuccess(event: H3Event, { tokens }: { tokens: any }) {
+  const claims = JSON.parse(Buffer.from(tokens.id_token.split('.')[1], 'base64url').toString())
+  if (!claims.email || ![true, '1'].includes(claims.xms_edov)) {
+    throw createError({
+      status: 401,
+      message: 'This Microsoft account has no verified email address',
     })
-    await setSession(event, auth)
-    return sendRedirect(event, '/')
-  },
+  }
+
+  const auth = await getAuth(event, claims.email).catch((error) => {
+    const config = useRuntimeConfig()
+
+    if (error.statusCode === 404 && config.autoSignup) {
+      return createAuth({ email: claims.email })
+    }
+    throw error
+  })
+  await setSession(event, auth)
+  return sendRedirect(event, '/')
+}
+
+const signIn = defineOAuthMicrosoftEventHandler({ config: { scope }, onSuccess })
+const selectAccount = defineOAuthMicrosoftEventHandler({
+  config: { scope, authorizationParams: { prompt: 'select_account' } },
+  onSuccess,
 })
+
+export default defineEventHandler((event) =>
+  getQuery(event).prompt === 'select_account' ? selectAccount(event) : signIn(event),
+)

package/layers/base/server/tasks/clean.ts

@@ -1,7 +1,7 @@
 export default defineTask({
   meta: {
     name: 'clean',
-    description: 'Clean old backups and logs',
+    description: 'Clean old backups, logs and unfinished uploads',
   },
   async run() {
     const config = useRuntimeConfig()
@@ -21,6 +21,7 @@ export default defineTask({
         )
       }
       await cleanLogs()
+      await cleanTempUploads()
 
       return {
         result: {

package/layers/base/server/utils/auth.ts

@@ -1,6 +1,6 @@
 import { auth, refreshTokens } from '#server/database/schema'
 import { eq, lte } from 'drizzle-orm'
-import { randomBytes } from 'crypto'
+import { createHash, randomBytes } from 'crypto'
 import type { H3Event } from 'h3'
 
 type AuthUser = typeof auth.$inferSelect
@@ -17,6 +17,21 @@ export async function mfaSetupFlag(user: SessionUser) {
   return { requiresMfaSetup: !row?.totp && !row?.credentials.length }
 }
 
+export function requireSecondFactor(user: Pick<AuthUser, 'totp'> & { credentials?: unknown[] }) {
+  if (user.totp) {
+    throw createError({
+      status: 401,
+      message: 'TOTP required',
+    })
+  }
+  if (useRuntimeConfig().forceMfa && user.credentials?.length) {
+    throw createError({
+      status: 401,
+      message: 'Passkey required',
+    })
+  }
+}
+
 export async function createAuth(user: Pick<AuthUser, 'email'>) {
   const insertedUsers = await db
     .insert(auth)
@@ -112,7 +127,7 @@ export async function setSession(event: H3Event, user: SessionUser, refresh = tr
 export async function requireRecentAuth(event: H3Event) {
   const session = await requireUserSession(event)
 
-  if (session.user.isAnonymous || session.user.requiresMfaSetup) return session
+  if (session.user.isAnonymous) return session
 
   const maxAge = useRuntimeConfig().public.recentAuth.maxAge * 1000
   if (!session.authenticatedAt || Date.now() - session.authenticatedAt > maxAge) {
@@ -130,12 +145,16 @@ export function generateRefreshToken(): string {
   return randomBytes(32).toString('base64url')
 }
 
+export function hashRefreshToken(token: string) {
+  return createHash('sha256').update(token).digest('base64url')
+}
+
 export async function createRefreshToken(userId: string, event: H3Event) {
   const token = generateRefreshToken()
 
   await db.insert(refreshTokens).values({
     userId,
-    token,
+    token: hashRefreshToken(token),
   })
 
   const config = useRuntimeConfig()
@@ -158,7 +177,9 @@ export async function verifyRefreshToken(event: H3Event) {
     })
   }
 
-  const refreshToken = await db.query.refreshTokens.findFirst({ where: { token: existingToken } })
+  const refreshToken = await db.query.refreshTokens.findFirst({
+    where: { token: hashRefreshToken(existingToken) },
+  })
   if (!refreshToken) {
     deleteCookie(event, 'refresh_token')
     throw createError({
@@ -194,8 +215,9 @@ export async function verifyRefreshToken(event: H3Event) {
   return { refreshToken, user }
 }
 
+// Takes the token from the cookie, never the stored value
 export async function revokeRefreshToken(token: string) {
-  await db.delete(refreshTokens).where(eq(refreshTokens.token, token))
+  await db.delete(refreshTokens).where(eq(refreshTokens.token, hashRefreshToken(token)))
 }
 
 export async function revokeExpiredRefreshToken(creationExpiredAt: Date) {

package/layers/base/server/utils/backup.ts

@@ -37,7 +37,7 @@ function waitForExit(child: ChildProcess, name: string) {
 export async function createDatabaseBackup(
   backupName: string,
   dbUrl: string,
-  dumpArgs: string = '-F c',
+  dumpArgs: string,
   agePublicKey?: string,
 ) {
   const { conn, env } = splitCredentials(dbUrl)

package/layers/base/server/utils/files.ts

@@ -8,6 +8,7 @@ import {
   appendFile,
   rename,
   readFile as fsReadFile,
+  copyFile as fsCopyFile,
 } from 'fs/promises'
 import {
   S3Client,
@@ -21,6 +22,7 @@ import {
   UploadPartCommand,
   CompleteMultipartUploadCommand,
   AbortMultipartUploadCommand,
+  ListMultipartUploadsCommand,
 } from '@aws-sdk/client-s3'
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
 import type { CompletedPart } from '@aws-sdk/client-s3'
@@ -31,6 +33,21 @@ import type { Readable } from 'stream'
 import type { H3Event, MultiPartData } from 'h3'
 import { createHash } from 'crypto'
 
+const MB = 1024 * 1024
+
+function fileTooLarge() {
+  const { maxSize } = useRuntimeConfig().public.files
+  return createError({ statusCode: 413, message: `File too large, max ${maxSize} MB` })
+}
+
+export async function readUploadBody(event: H3Event, maxMB: number) {
+  await requireUserSession(event)
+  const length = getRequestHeader(event, 'content-length')
+  if (!length) throw createError({ statusCode: 411, message: 'Content-Length required' })
+  if (Number(length) > (maxMB + 1) * MB) throw fileTooLarge()
+  return readMultipartFormData(event)
+}
+
 export async function uploadFile(
   event: H3Event,
   file: MultiPartData,
@@ -39,9 +56,7 @@ export async function uploadFile(
 ) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
-  if (file.filename && !/[^/]\.[^.]+$/.test(path) && basename(path) !== basename(file.filename)) {
-    path = join(path, basename(file.filename))
-  }
+  path = appendFilename(path, file.filename)
 
   let url
   if (useS3()) {
@@ -73,9 +88,7 @@ export async function uploadStream(
 ) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
-  if (file.filename && !/[^/]\.[^.]+$/.test(path) && basename(path) !== basename(file.filename)) {
-    path = join(path, basename(file.filename))
-  }
+  path = appendFilename(path, file.filename)
 
   if (useS3()) {
     return uploadStreamToS3(
@@ -135,12 +148,15 @@ export async function uploadChunk(
   if (chunkIndex < 0 || chunkIndex >= totalChunks || totalChunks < 1) {
     throw createError({ statusCode: 400, message: 'Invalid chunk index' })
   }
+  const { chunkSize, maxSize } = useRuntimeConfig().public.files
+  const chunkBytes = (Number(chunkSize) || 1) * MB
+  if (totalChunks > Math.ceil((Number(maxSize) * MB) / chunkBytes)) {
+    throw fileTooLarge()
+  }
 
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
-  if (filename && !/[^/]\.[^.]+$/.test(path) && basename(path) !== basename(filename)) {
-    path = join(path, basename(filename))
-  }
+  path = appendFilename(path, filename)
 
   if (useS3()) {
     if (!uploadId) {
@@ -190,9 +206,69 @@ export async function uploadChunk(
   return getFileURL(path, isPrivate)
 }
 
+const TEMP_UPLOAD_MAX_AGE_MS = 24 * 60 * 60 * 1000
+
+// Removes chunked uploads that were started but never finished
+export async function cleanTempUploads(maxAgeMs = TEMP_UPLOAD_MAX_AGE_MS) {
+  const cutoff = Date.now() - maxAgeMs
+
+  const tempDir = join(process.cwd(), 'files', 'temp')
+  const uploadIds = await readdir(tempDir).catch(() => [])
+  await Promise.all(
+    uploadIds.map(async (uploadId) => {
+      const uploadDir = join(tempDir, uploadId)
+      const stats = await stat(uploadDir)
+      if (!stats.isDirectory()) return
+      // A retried chunk overwrites its file without touching the folder's mtime
+      const chunks = await readdir(uploadDir)
+      const chunkTimes = await Promise.all(
+        chunks.map(async (chunk) => (await stat(join(uploadDir, chunk))).mtimeMs),
+      )
+      if (Math.max(stats.mtimeMs, ...chunkTimes) < cutoff) {
+        await rm(uploadDir, { recursive: true, force: true })
+      }
+    }),
+  )
+
+  const client = useS3()
+  if (!client) return
+
+  const config = useRuntimeConfig()
+  const buckets = [...new Set([config.s3.privateBucket, config.s3.publicBucket])].filter(Boolean)
+  for (const Bucket of buckets) {
+    let KeyMarker: string | undefined
+    let UploadIdMarker: string | undefined
+    do {
+      const response = await client.send(
+        new ListMultipartUploadsCommand({ Bucket, KeyMarker, UploadIdMarker }),
+      )
+      await Promise.all(
+        (response.Uploads || [])
+          .filter((upload) => upload.Initiated && upload.Initiated.getTime() < cutoff)
+          .map((upload) =>
+            client.send(
+              new AbortMultipartUploadCommand({
+                Bucket,
+                Key: upload.Key,
+                UploadId: upload.UploadId,
+              }),
+            ),
+          ),
+      )
+      KeyMarker = response.IsTruncated ? response.NextKeyMarker : undefined
+      UploadIdMarker = response.IsTruncated ? response.NextUploadIdMarker : undefined
+    } while (KeyMarker)
+  }
+}
+
+// A name can hold %, # or ?, which would end or break the URL unencoded
+function encodePath(path: string) {
+  return path.split('/').map(encodeURIComponent).join('/')
+}
+
 export function getFileURL(path: string, isPrivate = true) {
   const config = useRuntimeConfig()
-  const url = removeRoot(path, isPrivate)
+  const url = encodePath(removeRoot(path, isPrivate))
 
   if (isPrivate) {
     return config.public.url + join('/', 'api/files', url) + '?isPrivate=true'
@@ -235,6 +311,8 @@ export async function getFile(
 ) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
+  setHeader(event, 'X-Content-Type-Options', 'nosniff')
+  setHeader(event, 'Content-Security-Policy', 'sandbox')
 
   const range = getRequestHeader(event, 'range')
 
@@ -299,6 +377,8 @@ export async function getFile(
 export async function deletePath(event: H3Event, path: string, isPrivate = true) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
+  // An empty path resolves to the root folder, deleting it would wipe every file
+  if (path === getSecurePath('', isPrivate)) throw invalidPath()
   if (useS3()) await deleteFromS3(path, isPrivate)
   else {
     const localPath = join(process.cwd(), path)
@@ -371,13 +451,19 @@ export async function copyFile(
   await checkFileAccess(event, dest)
   src = getSecurePath(src, isPrivate)
   dest = getSecurePath(dest, isPrivate)
+  // A copy onto itself would truncate the file, and a move would then delete it
+  if (src === dest) return
 
   if (useS3()) return copyFromS3(src, dest, isPrivate, deleteSrc)
 
   const srcPath = join(process.cwd(), src)
   const destPath = join(process.cwd(), dest)
+  const stats = await stat(srcPath).catch(() => null)
+  if (!stats?.isFile()) {
+    throw createError({ statusCode: 404, message: 'File not found' })
+  }
   await mkdir(dirname(destPath), { recursive: true })
-  await writeFile(destPath, createReadStream(srcPath))
+  await fsCopyFile(srcPath, destPath)
 
   if (deleteSrc) {
     await deletePath(event, removeRoot(src, isPrivate), isPrivate)
@@ -412,8 +498,11 @@ export function getSecurePath(path: string, isPrivate = true) {
   const root = isPrivate ? config.filesPrivateFolder : config.filesPublicFolder
   let normalizedPath = path.replace(/^\/+/, '')
 
-  if (normalizedPath.split('/').some((segment) => segment === '..' || segment === '.')) {
-    throw createError({ statusCode: 400, message: 'Invalid path' })
+  if (
+    normalizedPath.includes('..') ||
+    normalizedPath.split('/').some((segment) => segment === '.')
+  ) {
+    throw invalidPath()
   }
 
   normalizedPath = join('/', root, removeRoot(normalizedPath, isPrivate))
@@ -421,6 +510,32 @@ export function getSecurePath(path: string, isPrivate = true) {
   return normalizedPath.replace(/^\//, '').replace(/\/$/, '')
 }
 
+function invalidPath() {
+  return createError({ statusCode: 400, message: 'Invalid path' })
+}
+
+function appendFilename(path: string, filename?: string) {
+  if (!filename) return path
+  if (filename.includes('..')) throw invalidPath()
+  filename = cleanFilename(filename)
+  if (/[^/]\.[^.]+$/.test(path) || basename(path) === filename) return path
+  return join(path, filename)
+}
+
+// Keeps letters (accents too), digits, . - and _, anything else becomes a single -.
+// NFC, because macOS sends é as e + accent and the same name would not match.
+export function cleanFilename(filename: string) {
+  const name = basename(filename)
+    .normalize('NFC')
+    .replace(/[^\p{L}\p{M}\p{N}._-]+/gu, '-')
+    .replace(/-*\.-*/g, '.')
+    .replace(/\.{2,}/g, '.')
+    .replace(/-{2,}/g, '-')
+    .replace(/^-+|[-.]+$/g, '')
+  // Nothing left of the name, or a hidden file: keep the extension behind a visible name
+  return !name || name.startsWith('.') ? `file${name}` : name
+}
+
 export function removeRoot(path: string, isPrivate = true) {
   const config = useRuntimeConfig()
   const root = isPrivate ? config.filesPrivateFolder : config.filesPublicFolder
@@ -733,7 +848,7 @@ export function getS3Key(path: string) {
 
 function getS3URL(path: string) {
   const config = useRuntimeConfig()
-  return `${config.public.files.url}/${getS3Key(path)}`
+  return `${config.public.files.url}/${encodePath(getS3Key(path))}`
 }
 
 async function getS3SignedUrl(key: string, expiresIn = 3600, isPrivate = true): Promise<string> {

package/layers/base/server/utils/rateLimit.ts

@@ -27,9 +27,14 @@ async function getId(event: H3Event): Promise<string> {
   return getClientIP(event)
 }
 
-export async function enforceRateLimit(event: H3Event, route: string, rule: RateLimitRule) {
+export async function enforceRateLimit(
+  event: H3Event,
+  route: string,
+  rule: RateLimitRule,
+  id?: string,
+) {
   const config = useRuntimeConfig()
-  const id = await getId(event)
+  id ??= await getId(event)
   const key = `${route}:${id}`
   const now = Date.now()
 

package/locales/en.json

@@ -1,6 +1,7 @@
 {
   "add": "Add",
   "areYouSure": "Are you sure?",
+  "authentication": "Authentication",
   "cancel": "Cancel",
   "confirm": "Confirm",
   "continue": "Continue",
@@ -11,6 +12,7 @@
   "disable": "Disable",
   "email": "Email",
   "enable": "Enable",
+  "fileTooLarge": "Too large, max {max} MB: {files}",
   "formatFailed": "Could not format or upload {files}",
   "language": "Language | Languages",
   "paste": "Paste",
@@ -27,6 +29,7 @@
     "code": "Code",
     "getCode": "Get code",
     "otpSent": "Code sent to {email}",
+    "passkey": "Use a passkey",
     "password": "Password",
     "signin": "Sign In"
   }

package/locales/fr.json

@@ -1,6 +1,7 @@
 {
   "add": "Ajouter",
   "areYouSure": "Êtes-vous sûr ?",
+  "authentication": "Authentification",
   "cancel": "Annuler",
   "confirm": "Confirmer",
   "continue": "Continuer",
@@ -11,6 +12,7 @@
   "disable": "Désactiver",
   "email": "Email",
   "enable": "Activer",
+  "fileTooLarge": "Trop volumineux, max {max} Mo : {files}",
   "formatFailed": "Impossible de formater ou téléverser {files}",
   "language": "Langue | Langues",
   "paste": "Coller",
@@ -27,6 +29,7 @@
     "code": "Code",
     "getCode": "Demander le code",
     "otpSent": "Code envoyé à {email}",
+    "passkey": "Utiliser une passkey",
     "password": "Mot de passe",
     "signin": "Se connecter"
   }

package/locales/pages/user-auth/en.json

@@ -1,6 +1,5 @@
 {
   "2fa": "Two-Factor Authentication",
-  "authentication": "Authentication",
   "authenticatorApp": "Authenticator app",
   "changeEmail": "Change email address",
   "changePassword": "Change password",

package/locales/pages/user-auth/fr.json

@@ -1,6 +1,5 @@
 {
   "2fa": "Authentification à deux facteurs",
-  "authentication": "Authentification",
   "authenticatorApp": "Application d'authentification",
   "changeEmail": "Modifier l'adresse email",
   "changePassword": "Modifier le mot de passe",

package/nuxt.config.ts

@@ -27,6 +27,7 @@ export default defineNuxtConfig({
       routes: {
         // limit: max requests per IP, window: in seconds
         '/api/log': { limit: 30, window: 60 },
+        '/api/auth/options': { limit: 10, window: 60 },
         '/api/auth/password': { limit: 5, window: 60 },
         '/api/auth/otp/get': { limit: 5, window: 900 },
         '/api/auth/email/get': { limit: 5, window: 900 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",
@@ -31,7 +31,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=22"
+    "node": "^24.15.0 || >=26"
   },
   "packageManager": "pnpm@12.4.2+sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9",
   "scripts": {