mbkauthe 5.1.0 → 5.2.1

package/lib/db/sqlSqliteTranslate.js

@@ -0,0 +1,62 @@
+/**
+ * Best-effort translator for the small, consistent subset of Postgres SQL
+ * used throughout mbkauthe's raw queries (see AuthRepository.js). This is
+ * NOT a general-purpose SQL translator — it only handles the specific
+ * constructs this codebase actually emits:
+ *
+ *   - `$1`, `$2`, ... positional params            -> `?`
+ *   - `col = ANY($1)` array matching                -> `col IN (?, ?, ...)`
+ *   - `NOW()`                                       -> `CURRENT_TIMESTAMP`
+ *   - bare `TRUE` / `FALSE` literals                -> `1` / `0`
+ *   - `::type` casts                                -> stripped
+ *
+ * Queries with more exotic Postgres-only syntax (INTERVAL arithmetic,
+ * pg_advisory_xact_lock, LOCK TABLE, etc.) are handled by dialect-specific
+ * branches in the repositories/pool instead of trying to regex them here.
+ */
+export function translatePgToSqlite(text, values = []) {
+  let sql = String(text ?? "")
+    .replace(/::\w+(\[\])?/g, "")
+    .replace(/\bNOW\(\)/gi, "CURRENT_TIMESTAMP")
+    .replace(/\bTRUE\b/g, "1")
+    .replace(/\bFALSE\b/g, "0");
+
+  // Queries already written in native SQLite style with `?` placeholders
+  // (e.g. SqliteSessionStore) have no $N tokens to rewrite — pass their
+  // values through untouched instead of rebuilding an empty array.
+  if (!/\$\d/.test(sql)) {
+    return { text: sql, values };
+  }
+
+  const tokenRegex = /(=\s*ANY\(\$(\d+)\))|(\$(\d+))/g;
+  let out = "";
+  let lastIndex = 0;
+  let match;
+  const newValues = [];
+
+  while ((match = tokenRegex.exec(sql)) !== null) {
+    out += sql.slice(lastIndex, match.index);
+
+    if (match[1]) {
+      // `col = ANY($N)` -> `col IN (?, ?, ...)`
+      const paramIndex = Number(match[2]) - 1;
+      const rawValue = values[paramIndex];
+      const arr = Array.isArray(rawValue) ? rawValue : [rawValue];
+      if (arr.length === 0) {
+        out += "IN (NULL)"; // never matches, mirrors ANY('{}') semantics
+      } else {
+        out += `IN (${arr.map(() => "?").join(", ")})`;
+        newValues.push(...arr);
+      }
+    } else if (match[3]) {
+      const paramIndex = Number(match[4]) - 1;
+      out += "?";
+      newValues.push(values[paramIndex]);
+    }
+
+    lastIndex = tokenRegex.lastIndex;
+  }
+
+  out += sql.slice(lastIndex);
+  return { text: out, values: newValues };
+}

package/lib/db/sqlitePool.js

@@ -0,0 +1,210 @@
+import Database from "better-sqlite3";
+import { translatePgToSqlite } from "./sqlSqliteTranslate.js";
+
+/**
+ * FIFO promise mutex. All statements run on ONE shared better-sqlite3
+ * handle, and BEGIN/COMMIT are connection state — so a transaction must
+ * hold exclusive access for its whole (async) lifetime, or queries from
+ * other requests interleave between its awaits and silently join it
+ * (or a second BEGIN throws "cannot start a transaction within a
+ * transaction"). Individual statements are synchronous, so waiters queue
+ * for microseconds, not I/O time.
+ */
+class Mutex {
+  constructor() {
+    this._tail = Promise.resolve();
+  }
+
+  /** Resolves to a release function once the lock is held. */
+  acquire() {
+    const prev = this._tail;
+    let release;
+    this._tail = new Promise((resolve) => {
+      let released = false;
+      release = () => {
+        if (released) return;
+        released = true;
+        resolve();
+      };
+    });
+    return prev.then(() => release);
+  }
+}
+
+/**
+ * Exclusive handle returned by SqlitePool.connect(). Holds the pool mutex
+ * from connect() until release(), so a BEGIN..COMMIT sequence issued on it
+ * cannot interleave with queries from other requests. release() is
+ * idempotent. Queries on the client itself do NOT re-acquire the mutex —
+ * the client is the holder. Do not call pool.query() from code running
+ * inside a transaction (use the client / txRepo): it would wait for the
+ * lock the transaction is holding and deadlock.
+ */
+class SqliteClient {
+  constructor(db, releaseLock) {
+    this.db = db;
+    this._releaseLock = releaseLock;
+  }
+
+  async query(queryOrText, maybeValues) {
+    const { text, values, name } = normalizeQueryArgs(queryOrText, maybeValues);
+    return runQuery(this.db, text, values, name);
+  }
+
+  release() {
+    this._releaseLock();
+  }
+}
+
+function normalizeQueryArgs(queryOrText, maybeValues) {
+  if (typeof queryOrText === "string") {
+    return { text: queryOrText, values: maybeValues || [], name: undefined };
+  }
+  return {
+    text: queryOrText?.text ?? "",
+    values: queryOrText?.values ?? [],
+    name: queryOrText?.name
+  };
+}
+
+/**
+ * better-sqlite3 only binds numbers, strings, bigints, buffers, and null.
+ * Coerce the extra types the pg driver would serialize for us: Date ->
+ * SQLite's CURRENT_TIMESTAMP text format ('YYYY-MM-DD HH:MM:SS', UTC) so
+ * comparisons against CURRENT_TIMESTAMP stay correct, boolean -> 1/0,
+ * undefined -> null.
+ */
+function coerceBindValue(value) {
+  if (value === undefined) return null;
+  if (typeof value === "boolean") return value ? 1 : 0;
+  if (value instanceof Date) {
+    return value.toISOString().slice(0, 19).replace("T", " ");
+  }
+  // pg serializes objects/arrays bound to json/jsonb params; mirror that.
+  if (typeof value === "object" && value !== null && !Buffer.isBuffer(value)) {
+    return JSON.stringify(value);
+  }
+  return value;
+}
+
+/**
+ * Read-side row normalization so results match what the pg driver returns.
+ *
+ * Postgres jsonb columns arrive as parsed objects/arrays and timestamp
+ * columns as Date objects; better-sqlite3 returns raw TEXT for both. All
+ * consumers (login app-authorization checks, API-token permissions, expiry
+ * comparisons) are written against the pg shapes, so convert by column name
+ * — the schema is fixed and known. Timestamp text is UTC (it comes from
+ * CURRENT_TIMESTAMP or coerceBindValue), but `new Date('YYYY-MM-DD
+ * HH:MM:SS')` would parse it as LOCAL time, skewing every expiry check by
+ * the machine's UTC offset — hence the explicit 'Z'.
+ *
+ * "sess" and "expire" (express-session store) are deliberately NOT listed:
+ * SqliteSessionStore owns those columns and does its own JSON/UTC handling.
+ */
+const JSON_COLUMNS = new Set([
+  "AllowedApps",
+  "user_allowed_apps", // alias of Users.AllowedApps in getApiTokenByHash
+  "Permissions",
+  "Positions",
+  "SocialAccounts",
+  "meta"
+]);
+
+const TIMESTAMP_COLUMNS = new Set([
+  "expires_at",
+  "created_at",
+  "updated_at",
+  "last_login",
+  "last_activity",
+  "connect_expire", // alias of session.expire in getSessionValidity
+  "CreatedAt",
+  "ExpiresAt",
+  "LastUsed"
+]);
+
+const SQLITE_TIMESTAMP_RE = /^(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2}(?:\.\d+)?)(Z)?$/;
+
+function normalizeRow(row) {
+  for (const key of Object.keys(row)) {
+    const value = row[key];
+    if (typeof value !== "string") continue;
+
+    if (JSON_COLUMNS.has(key)) {
+      try {
+        row[key] = JSON.parse(value);
+      } catch {
+        // Not valid JSON — leave the raw string rather than lose data.
+      }
+    } else if (TIMESTAMP_COLUMNS.has(key)) {
+      const m = SQLITE_TIMESTAMP_RE.exec(value);
+      if (m) {
+        row[key] = new Date(`${m[1]}T${m[2]}Z`);
+      }
+    }
+  }
+  return row;
+}
+
+function runQuery(db, rawText, rawValues) {
+  const trimmed = rawText.trim();
+  const upper = trimmed.toUpperCase();
+
+  // Transaction control statements pass straight through.
+  if (upper === "BEGIN" || upper === "COMMIT" || upper === "ROLLBACK") {
+    db.exec(upper);
+    return { rows: [], rowCount: 0, command: upper };
+  }
+
+  const { text, values } = translatePgToSqlite(trimmed, rawValues);
+  const stmt = db.prepare(text);
+  const bindValues = values.map(coerceBindValue);
+
+  if (stmt.reader) {
+    const rows = stmt.all(...bindValues).map(normalizeRow);
+    return { rows, rowCount: rows.length, command: "SELECT" };
+  }
+
+  const info = stmt.run(...bindValues);
+  return {
+    rows: [],
+    rowCount: info.changes,
+    command: "EXECUTE",
+    lastInsertRowid: info.lastInsertRowid
+  };
+}
+
+export class SqlitePool {
+  constructor(filePath) {
+    this.db = new Database(filePath);
+    this.db.pragma("journal_mode = WAL");
+    this.db.pragma("foreign_keys = ON");
+    this.mutex = new Mutex();
+  }
+
+  async query(queryOrText, maybeValues) {
+    const { text, values } = normalizeQueryArgs(queryOrText, maybeValues);
+    // Take the mutex per statement so a plain query can never land inside
+    // another request's open transaction.
+    const release = await this.mutex.acquire();
+    try {
+      return runQuery(this.db, text, values);
+    } finally {
+      release();
+    }
+  }
+
+  async connect() {
+    const release = await this.mutex.acquire();
+    return new SqliteClient(this.db, release);
+  }
+
+  /** Run a raw multi-statement SQL script (schema files, migrations). */
+  execScript(sql) {
+    this.db.exec(sql);
+  }
+
+  async end() {
+    this.db.close();
+  }
+}

package/lib/middleware/auth.js

@@ -1,4 +1,4 @@
-import { dblogin } from "#pool.js";
+import { dblogin, dialect } from "#pool.js";
 import { mbkautheVar } from "#config.js";
 import { renderError } from "#response.js";
 import { clearSessionCookies, cachedCookieOptions, encryptSessionId } from "#cookies.js";
@@ -16,7 +16,7 @@ const MAX_API_TOKEN_LENGTH = 4096;
 const API_TOKEN_LAST_USED_INTERVAL_MS = 15 * 60 * 1000;
 const API_TOKEN_SESSION_RESTORE = Symbol('mbkauthe.apiTokenSessionRestore');
 const apiTokenLastUsedCache = new Map();
-const authRepo = new AuthRepository({ db: dblogin });
+const authRepo = new AuthRepository({ db: dblogin, dialect });
 const logAuth = createLogger("auth");
 
 function pruneApiTokenLastUsedCache(now) {
@@ -482,7 +482,7 @@ const checkRolePermission = (requiredRoles, notAllowed) => {
     try {
       const authUser = req.auth?.user || req.session?.user;
 
-      if (!authUser || !authUser.id) {
+      if (!authUser || !authUser.username) {
         logAuth(`User not authenticated`);
         if (isJsonRequest(req)) {
           return res.status(401).json(createErrorResponse(401, ErrorCodes.SESSION_NOT_FOUND));

package/lib/middleware/index.js

@@ -1,15 +1,21 @@
 import session from "express-session";
 import pgSession from "connect-pg-simple";
 const PgSession = pgSession(session);
-import { dblogin, runWithRequestContext } from "#pool.js";
+import { dblogin, dialect, dbType, runWithRequestContext } from "#pool.js";
 import { mbkautheVar } from "#config.js";
 import { cachedCookieOptions, decryptSessionId, encryptSessionId, cachedClearCookieOptions, getCookieDomain, getCookieSecure, isAllowedOriginHostname } from "#cookies.js";
 import { AuthRepository } from "../db/AuthRepository.js";
 import { isUserAuthorizedForApp } from "../utils/appAccess.js";
+import { SqliteSessionStore } from "../session/SqliteSessionStore.js";
 
-// Session configuration
-export const sessionConfig = {
-  store: new PgSession({
+const sessionStore = dbType === "sqlite"
+  ? new SqliteSessionStore({
+    db: dblogin,
+    tableName: "session",
+    createTableIfMissing: true,
+    disableTouch: true
+  })
+  : new PgSession({
     pool: dblogin,
     tableName: "session",
     createTableIfMissing: true,
@@ -17,7 +23,11 @@ export const sessionConfig = {
     // This avoids an UPDATE per request, which can significantly reduce DB load under burst traffic.
     // The session will still expire based on the cookie maxAge and the TTL stored when the session is saved.
     disableTouch: true
-  }),
+  });
+
+// Session configuration
+export const sessionConfig = {
+  store: sessionStore,
   secret: mbkautheVar.SESSION_SECRET_KEY,
   resave: false,
   saveUninitialized: false,
@@ -35,7 +45,7 @@ export const sessionConfig = {
   name: 'mbkauthe.sid'
 };
 
-const authRepo = new AuthRepository({ db: dblogin });
+const authRepo = new AuthRepository({ db: dblogin, dialect });
 const hasAuthorizationHeader = (req) => typeof req.headers?.authorization === 'string' && req.headers.authorization.trim().length > 0;
 
 export function securityHeadersMiddleware(req, res, next) {

package/lib/pool.js

@@ -2,24 +2,39 @@ import pkg from "pg";
 const { Pool } = pkg;
 import { mbkautheVar } from "#config.js";
 import { attachDevQueryLogger, runWithRequestContext, getRequestContext } from "./utils/dbQueryLogger.js";
+import { postgresDialect } from "./db/dialects/postgres.js";
+import { sqliteDialect } from "./db/dialects/sqlite.js";
+import { SqlitePool } from "./db/sqlitePool.js";
 import dotenv from "dotenv";
 dotenv.config();
 
 export { runWithRequestContext, getRequestContext };
 
-const poolConfig = {
-  connectionString: mbkautheVar.LOGIN_DB,
-  ssl: { rejectUnauthorized: true },
-  max: 10,
-  idleTimeoutMillis: 30000,
-  connectionTimeoutMillis: 5000,
-  application_name: `${mbkautheVar.APP_NAME}-mbkauthe-app`,
-};
+export const dbType = (mbkautheVar.DB_TYPE || "postgres").toLowerCase();
+export const dialect = dbType === "sqlite" ? sqliteDialect : postgresDialect;
 
-export const dblogin = new Pool(poolConfig);
+let dblogin;
 
-// Keep pool.js focused on pool setup; attach dev-only query logger from dedicated module.
-attachDevQueryLogger(dblogin);
+if (dbType === "sqlite") {
+  dblogin = new SqlitePool(mbkautheVar.SQLITE_PATH);
+} else {
+  const poolConfig = {
+    connectionString: mbkautheVar.LOGIN_DB,
+    ssl: { rejectUnauthorized: true },
+    max: 10,
+    idleTimeoutMillis: 30000,
+    connectionTimeoutMillis: 5000,
+    application_name: `${mbkautheVar.APP_NAME}-mbkauthe-app`,
+  };
+
+  dblogin = new Pool(poolConfig);
+
+  // Keep pool.js focused on pool setup; attach dev-only query logger from dedicated module.
+  // Only meaningful for the pg driver's event-emitter based pool.
+  attachDevQueryLogger(dblogin);
+}
+
+export { dblogin };
 
 /*
  attachDevQueryLogger([
@@ -38,4 +53,4 @@ attachDevQueryLogger(dblogin);
     console.error(`[mbkauthe] Database connection error (pool):`, err);
   }
 })();
-*/
+*/

package/lib/routes/auth.js

@@ -2,7 +2,7 @@ import express from "express";
 import csurf from "csurf";
 import speakeasy from "speakeasy";
 import rateLimit from 'express-rate-limit';
-import { dblogin } from "#pool.js";
+import { dblogin, dialect } from "#pool.js";
 import { mbkautheVar } from "#config.js";
 import {
   cachedCookieOptions, cachedClearCookieOptions, clearSessionCookies,
@@ -17,7 +17,7 @@ import { AuthRepository } from "../db/AuthRepository.js";
 import { createLogger } from "../utils/logger.js";
 
 const router = express.Router();
-const authRepo = new AuthRepository({ db: dblogin });
+const authRepo = new AuthRepository({ db: dblogin, dialect });
 const logAuth = createLogger("auth");
 
 // Helper function to clear profile picture cache
@@ -376,6 +376,7 @@ router.post("/api/login", LoginLimit, async (req, res) => {
       passwordMatches = await verifyPassword(password, user.UserName, user.PasswordEnc);
     }
 
+    // To Bypass Password check for testing, comment out this condition
     if (!passwordMatches) {
       logError('Login attempt', ErrorCodes.INCORRECT_PASSWORD, { username: trimmedUsername });
       return res.status(401).json(

package/lib/routes/misc.js

@@ -5,7 +5,7 @@ import { mbkautheVar, packageJson, appVersion } from "#config.js";
 import { renderError, renderPage } from "#response.js";
 import { authenticate, sessVal, sessRole } from "../middleware/auth.js";
 import { ErrorCodes, ErrorMessages, createErrorResponse } from "../utils/errors.js";
-import { dblogin } from "#pool.js";
+import { dblogin, dialect } from "#pool.js";
 import { clearSessionCookies, decryptSessionId, cachedCookieOptions, getCookieDomain } from "#cookies.js";
 import { AuthRepository } from "../db/AuthRepository.js";
 import { isSafeFetchUrl } from "../utils/urlSafety.js";
@@ -21,7 +21,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 
 const router = express.Router();
-const authRepo = new AuthRepository({ db: dblogin });
+const authRepo = new AuthRepository({ db: dblogin, dialect });
 const logMisc = createLogger("misc");
 const PROFILE_IMAGE_CACHE_SECONDS = 300;
 const PROFILE_IMAGE_CACHE_CONTROL = `private, max-age=${PROFILE_IMAGE_CACHE_SECONDS}, stale-while-revalidate=${PROFILE_IMAGE_CACHE_SECONDS}`;

package/lib/routes/oauth.js

@@ -4,7 +4,7 @@ import GitHubStrategy from 'passport-github2';
 import GoogleStrategy from 'passport-google-oauth20';
 import csurf from 'csurf';
 import rateLimit from 'express-rate-limit';
-import { dblogin } from "#pool.js";
+import { dblogin, dialect } from "#pool.js";
 import { mbkautheVar } from "#config.js";
 import { renderError } from "../utils/response.js";
 import { checkTrustedDevice, completeLoginProcess } from "./auth.js";
@@ -12,7 +12,7 @@ import { AuthRepository } from "../db/AuthRepository.js";
 import { createLogger } from "../utils/logger.js";
 
 const router = express.Router();
-const authRepo = new AuthRepository({ db: dblogin });
+const authRepo = new AuthRepository({ db: dblogin, dialect });
 const logOAuth = createLogger("oauth");
 
 // CSRF protection middleware

package/lib/session/SqliteSessionStore.js

@@ -0,0 +1,127 @@
+import session from "express-session";
+
+const Store = session.Store;
+
+// SQLite's CURRENT_TIMESTAMP format ('YYYY-MM-DD HH:MM:SS', UTC) — used so
+// this store's `expire` column sorts/compares correctly against any other
+// CURRENT_TIMESTAMP-derived timestamp text elsewhere in the SQLite schema.
+function toSqliteTimestamp(date) {
+  return date.toISOString().slice(0, 19).replace("T", " ");
+}
+
+/**
+ * express-session store for the SQLite backend. Mirrors the table shape and
+ * public behavior of connect-pg-simple (same "session" table: sid, sess,
+ * expire, username, last_activity) so admin/cleanup queries elsewhere in
+ * mbkauthe that read the "session" table work unchanged across both
+ * database backends.
+ */
+export class SqliteSessionStore extends Store {
+  constructor({ db, tableName = "session", createTableIfMissing = false, disableTouch = false } = {}) {
+    super();
+    if (!db) throw new Error("[mbkauthe] SqliteSessionStore requires a `db` (SqlitePool) instance");
+    this.db = db;
+    this.tableName = tableName;
+    this.disableTouch = disableTouch;
+
+    if (createTableIfMissing) {
+      this.db.execScript(`
+        CREATE TABLE IF NOT EXISTS "${this.tableName}" (
+          sid TEXT PRIMARY KEY,
+          sess TEXT NOT NULL,
+          expire TEXT NOT NULL,
+          username TEXT,
+          last_activity TEXT DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE INDEX IF NOT EXISTS idx_${this.tableName}_expire ON "${this.tableName}" (expire);
+      `);
+    }
+  }
+
+  get(sid, callback) {
+    this.db.query(`SELECT sess, expire FROM "${this.tableName}" WHERE sid = ?`, [sid])
+      .then((result) => {
+        const row = result.rows?.[0];
+        if (!row) return callback(null, undefined);
+
+        if (row.expire && new Date(row.expire.replace(" ", "T") + "Z").getTime() <= Date.now()) {
+          return this.destroy(sid, (err) => callback(err, undefined));
+        }
+
+        try {
+          callback(null, JSON.parse(row.sess));
+        } catch (err) {
+          callback(err);
+        }
+      })
+      .catch(callback);
+  }
+
+  set(sid, sessionData, callback) {
+    const maxAge = sessionData.cookie?.maxAge;
+    const expireDate = typeof maxAge === "number"
+      ? new Date(Date.now() + maxAge)
+      : new Date(Date.now() + 24 * 60 * 60 * 1000);
+
+    const sess = JSON.stringify(sessionData);
+    const expire = toSqliteTimestamp(expireDate);
+    const username = sessionData.user?.UserName ?? sessionData.UserName ?? null;
+
+    this.db.query(
+      `INSERT INTO "${this.tableName}" (sid, sess, expire, username, last_activity)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(sid) DO UPDATE SET sess = excluded.sess, expire = excluded.expire,
+         username = excluded.username, last_activity = excluded.last_activity`,
+      [sid, sess, expire, username, toSqliteTimestamp(new Date())]
+    )
+      .then(() => callback?.(null))
+      .catch((err) => callback?.(err));
+  }
+
+  destroy(sid, callback) {
+    this.db.query(`DELETE FROM "${this.tableName}" WHERE sid = ?`, [sid])
+      .then(() => callback?.(null))
+      .catch((err) => callback?.(err));
+  }
+
+  touch(sid, sessionData, callback) {
+    if (this.disableTouch) return callback?.(null);
+
+    const maxAge = sessionData.cookie?.maxAge;
+    const expireDate = typeof maxAge === "number"
+      ? new Date(Date.now() + maxAge)
+      : new Date(Date.now() + 24 * 60 * 60 * 1000);
+
+    this.db.query(
+      `UPDATE "${this.tableName}" SET expire = ?, last_activity = ? WHERE sid = ?`,
+      [toSqliteTimestamp(expireDate), toSqliteTimestamp(new Date()), sid]
+    )
+      .then(() => callback?.(null))
+      .catch((err) => callback?.(err));
+  }
+
+  all(callback) {
+    this.db.query(`SELECT sid, sess FROM "${this.tableName}"`, [])
+      .then((result) => {
+        try {
+          const sessions = (result.rows || []).map((row) => ({ sid: row.sid, ...JSON.parse(row.sess) }));
+          callback(null, sessions);
+        } catch (err) {
+          callback(err);
+        }
+      })
+      .catch(callback);
+  }
+
+  length(callback) {
+    this.db.query(`SELECT COUNT(*) AS count FROM "${this.tableName}"`, [])
+      .then((result) => callback(null, Number(result.rows?.[0]?.count ?? 0)))
+      .catch(callback);
+  }
+
+  clear(callback) {
+    this.db.query(`DELETE FROM "${this.tableName}"`, [])
+      .then(() => callback?.(null))
+      .catch((err) => callback?.(err));
+  }
+}