notifkit 0.1.7 → 0.1.9

package/src/services/api/main.ts

@@ -11,11 +11,14 @@ import {
   ProjectRepository,
   WorkflowRepository,
   SegmentRepository,
+  AdminUserRepository,
 } from "@/repositories/index.js";
 import { STREAMS } from "@/contracts/index.js";
 import { readJsonBody, readRawBody, sendJson, HttpError } from "./http.js";
 import { Router } from "./router.js";
 import { createHandlers } from "./handlers.js";
+import { handleAdminRequest } from "./admin-static.js";
+import { getAdminSession, hashPassword } from "@/services/auth/index.js";
 import { projects, messageLogs, projectApiKeys, suppressions } from "@/db/schema.js";
 import { eq, inArray } from "drizzle-orm";
 import { randomBytes, timingSafeEqual, createHash } from "node:crypto";
@@ -58,6 +61,20 @@ export function extractAuthToken(req: Pick<IncomingMessage, "headers">): string
   return undefined;
 }
 
+/**
+ * Resolves client IP address, respecting reverse proxy headers only when TRUST_PROXY is enabled.
+ */
+export function getClientIp(req: IncomingMessage, trustProxy: boolean): string {
+  if (trustProxy) {
+    const forwarded = req.headers["x-forwarded-for"];
+    if (typeof forwarded === "string") {
+      const first = forwarded.split(",")[0]?.trim();
+      if (first) return first;
+    }
+  }
+  return req.socket.remoteAddress || "unknown";
+}
+
 async function handleCreateProject(req: IncomingMessage, res: ServerResponse): Promise<void> {
   const parsed = z.object({ name: z.string().min(1) }).safeParse(await readJsonBody(req));
   if (!parsed.success) {
@@ -127,7 +144,42 @@ async function handleHealth(_req: IncomingMessage, res: ServerResponse): Promise
   sendJson(res, statusCode, response);
 }
 
-async function handleMetrics(_req: IncomingMessage, res: ServerResponse): Promise<void> {
+async function handleMetrics(req: IncomingMessage, res: ServerResponse): Promise<void> {
+  const remoteIp = req.socket.remoteAddress ?? "";
+  const isLoopback =
+    remoteIp === "127.0.0.1" ||
+    remoteIp === "::1" ||
+    remoteIp === "::ffff:127.0.0.1" ||
+    remoteIp === "localhost";
+
+  let authorized = isLoopback;
+  if (!authorized) {
+    const token = extractAuthToken(req);
+    if (token) {
+      if (token.startsWith("nk_sess_") && redis?.native) {
+        const session = await getAdminSession(redis.native, token);
+        if (session) authorized = true;
+      } else if (config.ADMIN_API_KEY) {
+        const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
+        const providedBuffer = Buffer.from(token);
+        if (
+          expectedBuffer.length === providedBuffer.length &&
+          timingSafeEqual(expectedBuffer, providedBuffer)
+        ) {
+          authorized = true;
+        }
+      }
+    }
+  }
+
+  if (!authorized) {
+    sendJson(res, 401, {
+      error: "unauthorized",
+      message: "Metrics endpoint requires admin credentials",
+    });
+    return;
+  }
+
   const registry = getMetricsRegistry();
   res.writeHead(200, { "Content-Type": registry.contentType });
   res.end(await registry.metrics());
@@ -164,6 +216,15 @@ let server: ReturnType<typeof createServer>;
 
 export async function startApiServer() {
   logger = createLogger({ name: "api", level: config.LOG_LEVEL });
+
+  if (config.NODE_ENV === "production" && !config.UNSUBSCRIBE_SECRET) {
+    logger.fatal(
+      "UNSUBSCRIBE_SECRET is required in production. Without it, all unsubscribe links " +
+        "return 400 and opt-outs are silently dropped. Set a random string of 32+ characters and restart.",
+    );
+    process.exit(1);
+  }
+
   redis = new RedisClient({ url: config.REDIS_URL, name: "api", logger });
   const dbData = createDatabase({ url: config.DATABASE_URL, applicationName: "api", logger });
   sql = dbData.sql;
@@ -177,6 +238,26 @@ export async function startApiServer() {
     events: new StreamProducer({ redis: redis.native, stream: STREAMS.EVENTS_INBOUND, logger }),
   };
 
+  const adminUserRepo = new AdminUserRepository(db);
+
+  if (config.ADMIN_EMAIL && config.ADMIN_PASSWORD) {
+    try {
+      const existing = await adminUserRepo.findByEmailOrUsername(config.ADMIN_EMAIL);
+      if (!existing) {
+        const passwordHash = await hashPassword(config.ADMIN_PASSWORD);
+        await adminUserRepo.create({
+          email: config.ADMIN_EMAIL,
+          username: config.ADMIN_USERNAME,
+          passwordHash,
+          role: "superadmin",
+        });
+        logger.info({ email: config.ADMIN_EMAIL }, "Bootstrapped initial admin user");
+      }
+    } catch (err) {
+      logger.error({ err }, "Failed to bootstrap default admin user");
+    }
+  }
+
   deps = {
     logger,
     redis,
@@ -187,12 +268,16 @@ export async function startApiServer() {
     projectRepo: new ProjectRepository(db),
     workflowRepo: new WorkflowRepository(db),
     segmentRepo: new SegmentRepository(db),
+    adminUserRepo,
     db,
   };
   h = createHandlers(deps);
 
   router = new Router();
   router
+    .post("/v1/auth/login", h.login)
+    .post("/v1/auth/logout", h.logout)
+    .get("/v1/auth/me", h.getMe)
     .put("/v1/templates", h.syncTemplates)
     .get("/v1/templates", h.listTemplates)
     .get("/v1/templates/:id", h.getTemplate)
@@ -253,8 +338,28 @@ export async function startApiServer() {
   server.keepAliveTimeout = 5_000;
 
   async function handleRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
-    // Add CORS headers for browser clients (like the Next.js dashboard)
-    res.setHeader("Access-Control-Allow-Origin", "*");
+    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    const origin = req.headers["origin"] as string | undefined;
+    const allowedOrigins = (config.CORS_ORIGIN ?? "")
+      .split(",")
+      .map((s) => s.trim())
+      .filter(Boolean);
+    const isSessionRoute =
+      url.pathname.startsWith("/v1/auth/") ||
+      url.pathname === "/v1/projects" ||
+      url.pathname.startsWith("/v1/projects/") ||
+      url.pathname.startsWith("/v1/system/") ||
+      url.pathname.startsWith("/v1/dlq");
+
+    if (isSessionRoute) {
+      if (origin && allowedOrigins.includes(origin)) {
+        res.setHeader("Access-Control-Allow-Origin", origin);
+        res.setHeader("Vary", "Origin");
+      }
+    } else {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    }
+
     res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
     res.setHeader(
       "Access-Control-Allow-Headers",
@@ -267,11 +372,15 @@ export async function startApiServer() {
       return;
     }
 
-    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+    if (url.pathname === "/admin" || url.pathname.startsWith("/admin/")) {
+      const handled = await handleAdminRequest(req, res, url);
+      if (handled) return;
+    }
 
     let projectId: string | undefined = undefined;
     let projectRateLimitRpm = 600;
     let keyRole: "admin" | "read_only" = "admin";
+    let isAdminToken = false;
 
     const isProjectManagement =
       url.pathname === "/v1/projects" || url.pathname.startsWith("/v1/projects/");
@@ -280,8 +389,14 @@ export async function startApiServer() {
     // will. The signed token in the URL is the credential, and it authorises
     // exactly one action for one address.
     const isPublicUnsubscribe = url.pathname === "/v1/unsubscribe";
-
-    if (url.pathname.startsWith("/v1/") && !isProjectManagement && !isPublicUnsubscribe) {
+    const isPublicAuth = url.pathname === "/v1/auth/login";
+
+    if (
+      url.pathname.startsWith("/v1/") &&
+      !isProjectManagement &&
+      !isPublicUnsubscribe &&
+      !isPublicAuth
+    ) {
       let token = extractAuthToken(req);
       if (!token && url.searchParams.has("token")) {
         token = url.searchParams.get("token") || undefined;
@@ -292,8 +407,13 @@ export async function startApiServer() {
         return;
       }
 
-      let isAdminToken = false;
-      if (config.ADMIN_API_KEY) {
+      if (token.startsWith("nk_sess_")) {
+        const session = await getAdminSession(redis.native, token);
+        if (session) {
+          isAdminToken = true;
+          keyRole = session.role === "superadmin" ? "admin" : (session.role as any);
+        }
+      } else if (config.ADMIN_API_KEY) {
         const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
         const providedBuffer = Buffer.from(token);
         if (
@@ -309,7 +429,11 @@ export async function startApiServer() {
           (req.headers["x-project-id"] as string | undefined) ||
           url.searchParams.get("projectId") ||
           undefined;
-        if (!headerProjectId) {
+        const isProjectAgnostic =
+          url.pathname.startsWith("/v1/auth/") ||
+          url.pathname.startsWith("/v1/system/") ||
+          url.pathname.startsWith("/v1/dlq");
+        if (!headerProjectId && !isProjectAgnostic) {
           sendJson(res, 400, {
             error: "bad_request",
             message: "x-project-id header or projectId query param required when using admin token",
@@ -318,7 +442,9 @@ export async function startApiServer() {
         }
         projectId = headerProjectId;
         projectRateLimitRpm = 6000;
-        keyRole = "admin";
+        if (!token.startsWith("nk_sess_")) {
+          keyRole = "admin";
+        }
       } else {
         const tokenHash = createHash("sha256").update(token).digest("hex");
         const cached = authCache.get(tokenHash);
@@ -374,7 +500,7 @@ export async function startApiServer() {
         end
         return -1
       `;
-      const rlKey = `rate-limit:api:req:${projectId}`;
+      const rlKey = `rate-limit:api:req:${projectId || "global"}`;
       const nowMs = Date.now();
       const count = (await redis.native.eval(
         LUA_LIMIT,
@@ -398,27 +524,31 @@ export async function startApiServer() {
     } else if (isProjectManagement) {
       const token = extractAuthToken(req);
 
-      if (!config.ADMIN_API_KEY) {
-        sendJson(res, 403, {
-          error: "forbidden",
-          message: "Project management disabled (no ADMIN_API_KEY set)",
-        });
-        return;
-      }
       if (!token) {
         sendJson(res, 401, { error: "unauthorized", message: "Missing admin token" });
         return;
       }
 
-      const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
-      const providedBuffer = Buffer.from(token);
-      if (
-        expectedBuffer.length !== providedBuffer.length ||
-        !timingSafeEqual(expectedBuffer, providedBuffer)
-      ) {
+      let authorized = false;
+      if (token.startsWith("nk_sess_")) {
+        const session = await getAdminSession(redis.native, token);
+        if (session) authorized = true;
+      } else if (config.ADMIN_API_KEY) {
+        const expectedBuffer = Buffer.from(config.ADMIN_API_KEY);
+        const providedBuffer = Buffer.from(token);
+        if (
+          expectedBuffer.length === providedBuffer.length &&
+          timingSafeEqual(expectedBuffer, providedBuffer)
+        ) {
+          authorized = true;
+        }
+      }
+
+      if (!authorized) {
         sendJson(res, 401, { error: "unauthorized", message: "Invalid admin token" });
         return;
       }
+      isAdminToken = true;
     }
 
     // The unsubscribe routes skip the block above, and with it the per-project
@@ -426,10 +556,7 @@ export async function startApiServer() {
     // an open endpoint cannot be used to hammer the process. Generous, because
     // a shared corporate egress IP can legitimately produce a burst.
     if (isPublicUnsubscribe) {
-      const clientIp =
-        (req.headers["x-forwarded-for"] as string | undefined)?.split(",")[0]?.trim() ||
-        req.socket.remoteAddress ||
-        "unknown";
+      const clientIp = getClientIp(req, Boolean(config.TRUST_PROXY));
       try {
         const key = `rate-limit:api:unsub:${clientIp}`;
         const count = await redis.native.incr(key);
@@ -446,6 +573,27 @@ export async function startApiServer() {
       }
     }
 
+    // The login route is unauthenticated and CPU-intensive due to password hashing (scrypt).
+    // Throttle login attempts per IP to prevent credential brute-forcing and CPU exhaustion.
+    if (isPublicAuth) {
+      const clientIp = getClientIp(req, Boolean(config.TRUST_PROXY));
+      try {
+        const key = `rate-limit:api:auth:${clientIp}`;
+        const count = await redis.native.incr(key);
+        if (count === 1) await redis.native.expire(key, 60);
+        if (count > 10) {
+          res.setHeader("Retry-After", "60");
+          sendJson(res, 429, {
+            error: "too_many_requests",
+            message: "Too many login attempts. Please try again later.",
+          });
+          return;
+        }
+      } catch (err) {
+        logger.warn({ err }, "auth rate limit unavailable — allowing request");
+      }
+    }
+
     const route = router.match(req.method ?? "GET", url.pathname);
 
     if (!route) {
@@ -453,7 +601,13 @@ export async function startApiServer() {
       return;
     }
 
-    const ctx = { params: route.params, query: url.searchParams, projectId, role: keyRole };
+    const ctx = {
+      params: route.params,
+      query: url.searchParams,
+      projectId,
+      role: keyRole,
+      isAdmin: isAdminToken,
+    };
 
     void Promise.resolve(route.handler(req, res, ctx)).catch((err: unknown) => {
       if (err instanceof HttpError) {

package/src/services/api/router.ts

@@ -5,6 +5,7 @@ export interface RouteContext {
   query: URLSearchParams;
   projectId?: string;
   role?: "admin" | "read_only";
+  isAdmin?: boolean;
 }
 
 export type RouteHandler = (
@@ -65,7 +66,12 @@ export class Router {
         const seg = route.segments[i]!;
         const part = parts[i]!;
         if (seg.startsWith(":")) {
-          params[seg.slice(1)] = decodeURIComponent(part);
+          try {
+            params[seg.slice(1)] = decodeURIComponent(part);
+          } catch {
+            ok = false;
+            break;
+          }
         } else if (seg !== part) {
           ok = false;
           break;

package/src/services/auth/index.ts

@@ -0,0 +1,111 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+import type { RedisClient } from "@/redis/index.js";
+import type { AdminUserRecord } from "@/repositories/index.js";
+
+const scryptAsync = promisify(scrypt);
+
+const DEFAULT_SESSION_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
+const SESSION_PREFIX = "notif:session:";
+
+/**
+ * Pre-computed dummy hash conforming to salt(16 bytes hex):hash(64 bytes hex).
+ * Used during authentication failure to equalize execution time and prevent
+ * user enumeration via scrypt timing side-channels.
+ */
+export const DUMMY_PASSWORD_HASH =
+  "00000000000000000000000000000000:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+
+export interface AdminSession {
+  token: string;
+  adminId: string;
+  email: string;
+  username: string | null;
+  role: string;
+  createdAt: number;
+  expiresAt: number;
+}
+
+/**
+ * Hashes a plaintext password using crypto.scrypt with a random 16-byte salt.
+ * Returns salt and hash separated by a colon.
+ */
+export async function hashPassword(password: string): Promise<string> {
+  const salt = randomBytes(16).toString("hex");
+  const derivedKey = (await scryptAsync(password, salt, 64)) as Buffer;
+  return `${salt}:${derivedKey.toString("hex")}`;
+}
+
+/**
+ * Verifies a plaintext password against a stored salt:hash string using constant-time comparison.
+ */
+export async function verifyPassword(password: string, storedHash: string): Promise<boolean> {
+  const [salt, key] = storedHash.split(":");
+  if (!salt || !key) return false;
+
+  const keyBuffer = Buffer.from(key, "hex");
+  const derivedKey = (await scryptAsync(password, salt, keyBuffer.length)) as Buffer;
+
+  if (derivedKey.length !== keyBuffer.length) {
+    return false;
+  }
+  return timingSafeEqual(derivedKey, keyBuffer);
+}
+
+/**
+ * Creates a secure session in Redis for an authenticated admin user.
+ */
+export async function createAdminSession(
+  redis: RedisClient["native"],
+  user: AdminUserRecord,
+  ttlSeconds: number = DEFAULT_SESSION_TTL_SECONDS,
+): Promise<AdminSession> {
+  const token = `nk_sess_${randomBytes(32).toString("hex")}`;
+  const now = Date.now();
+  const session: AdminSession = {
+    token,
+    adminId: user.id,
+    email: user.email,
+    username: user.username,
+    role: user.role,
+    createdAt: now,
+    expiresAt: now + ttlSeconds * 1000,
+  };
+
+  await redis.set(`${SESSION_PREFIX}${token}`, JSON.stringify(session), "EX", ttlSeconds);
+  return session;
+}
+
+/**
+ * Retrieves an admin session from Redis if valid and unexpired.
+ */
+export async function getAdminSession(
+  redis: RedisClient["native"],
+  token: string,
+): Promise<AdminSession | null> {
+  if (!token || !token.startsWith("nk_sess_")) return null;
+  const raw = await redis.get(`${SESSION_PREFIX}${token}`);
+  if (!raw) return null;
+
+  try {
+    const session = JSON.parse(raw) as AdminSession;
+    if (session.expiresAt <= Date.now()) {
+      await redis.del(`${SESSION_PREFIX}${token}`);
+      return null;
+    }
+    return session;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Revokes an active admin session.
+ */
+export async function revokeAdminSession(
+  redis: RedisClient["native"],
+  token: string,
+): Promise<void> {
+  if (!token) return;
+  await redis.del(`${SESSION_PREFIX}${token}`);
+}