parse-dashboard-analytics 7.4.2 → 7.4.5

package/Parse-Dashboard/Authentication.js

@@ -1,10 +1,14 @@
 'use strict';
 const bcrypt = require('bcryptjs');
-const csrf = require('csurf');
+const { csrfSync } = require('csrf-sync');
 const passport = require('passport');
 const LocalStrategy = require('passport-local').Strategy;
 const OTPAuth = require('otpauth')
 
+const { csrfSynchronisedProtection } = csrfSync({
+  getTokenFromRequest: (req) => req.body._csrf || req.headers['x-csrf-token'],
+});
+
 /**
  * Constructor for Authentication class
  *
@@ -27,7 +31,7 @@ function initialize(app, options) {
       const match = self.authenticate({
         name: username,
         pass: password,
-        otpCode: req.body.otpCode
+        otpCode: req.body?.otpCode
       });
       if (!match.matchingUsername) {
         return cb(null, false, { message: JSON.stringify({ text: 'Invalid username or password' }) });
@@ -81,11 +85,11 @@ function initialize(app, options) {
   app.use(passport.session());
 
   app.post('/login',
-    csrf(),
+    csrfSynchronisedProtection,
     (req,res,next) => {
       let redirect = 'apps';
       let originalRedirect = null;
-      if (req.body.redirect) {
+      if (req.body?.redirect) {
         originalRedirect = req.body.redirect;
         // Validate redirect to prevent open redirect vulnerability
         if (originalRedirect.includes('://') || originalRedirect.startsWith('//')) {
@@ -176,5 +180,6 @@ function authenticate(userToTest, usernameOnly) {
 
 Authentication.prototype.initialize = initialize;
 Authentication.prototype.authenticate = authenticate;
+Authentication.csrfProtection = csrfSynchronisedProtection;
 
 module.exports = Authentication;

package/Parse-Dashboard/CLI/mfa.js

@@ -1,8 +1,11 @@
 const crypto = require('crypto');
-let inquirer = require('inquirer');
-if (inquirer.default) {
-  inquirer = inquirer.default;
-}
+let inquirer;
+const loadInquirer = async () => {
+  if (!inquirer) {
+    const mod = await import('inquirer');
+    inquirer = mod.default || mod;
+  }
+};
 const OTPAuth = require('otpauth');
 const { copy } = require('./utils.js');
 const phrases = {
@@ -11,9 +14,10 @@ const phrases = {
   enterAppName: 'Enter the app name:',
 }
 const getAlgorithm = async () => {
+  await loadInquirer();
   let { algorithm } = await inquirer.prompt([
     {
-      type: 'list',
+      type: 'select',
       name: 'algorithm',
       message: 'Which hashing algorithm do you want to use?',
       default: 'SHA1',
@@ -141,6 +145,7 @@ const showInstructions = ({ app, username, passwordCopied, encrypt, config }) =>
 
 module.exports = {
   async createUser() {
+    await loadInquirer();
     const data = {};
 
     console.log('');
@@ -210,6 +215,7 @@ module.exports = {
     showInstructions({ app: data.app, username, passwordCopied: true, encrypt, config });
   },
   async createMFA() {
+    await loadInquirer();
     console.log('');
     const { username, app } = await inquirer.prompt([
       {

package/Parse-Dashboard/app.js

@@ -2,7 +2,6 @@
 
 const express = require('express');
 const path = require('path');
-const csrf = require('csurf');
 const Authentication = require('./Authentication.js');
 const fs = require('fs');
 const ConfigKeyCache = require('./configKeyCache.js');
@@ -88,6 +87,32 @@ module.exports = function(config, options) {
       cookieSessionStore: options.cookieSessionStore
     });
 
+    /**
+     * Checks whether a request is from localhost.
+     */
+    function isLocalRequest(req) {
+      return req.connection.remoteAddress === '127.0.0.1' ||
+        req.connection.remoteAddress === '::ffff:127.0.0.1' ||
+        req.connection.remoteAddress === '::1';
+    }
+
+    /**
+     * Middleware that enforces remote access restrictions:
+     * - Requires HTTPS for remote requests (unless allowInsecureHTTP is set)
+     * - Requires users to be configured for remote access (unless dev mode is enabled)
+     */
+    function enforceRemoteAccessRestrictions(req, res, next) {
+      if (!options.dev && !isLocalRequest(req)) {
+        if (!req.secure && !options.allowInsecureHTTP) {
+          return res.status(403).json({ error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
+        }
+        if (!users) {
+          return res.status(401).json({ error: 'Configure a user to access Parse Dashboard remotely' });
+        }
+      }
+      next();
+    }
+
     // CSRF error handler
     app.use(function (err, req, res, next) {
       if (err.code !== 'EBADCSRFTOKEN') {return next(err)}
@@ -110,13 +135,7 @@ module.exports = function(config, options) {
         agent: config.agent,
       };
 
-      //Based on advice from Doug Wilson here:
-      //https://github.com/expressjs/express/issues/2518
-      const requestIsLocal =
-        req.connection.remoteAddress === '127.0.0.1' ||
-        req.connection.remoteAddress === '::ffff:127.0.0.1' ||
-        req.connection.remoteAddress === '::1';
-      if (!options.dev && !requestIsLocal) {
+      if (!options.dev && !isLocalRequest(req)) {
         if (!req.secure && !options.allowInsecureHTTP) {
           //Disallow HTTP requests except on localhost, to prevent the master key from being transmitted in cleartext
           return res.send({ success: false, error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
@@ -159,7 +178,8 @@ module.exports = function(config, options) {
               }
 
               if (typeof app.masterKey === 'function') {
-                app.masterKey = await ConfigKeyCache.get(app.appId, 'masterKey', app.masterKeyTtl, app.masterKey);
+                const cacheKey = matchingAccess.readOnly ? 'readOnlyMasterKey' : 'masterKey';
+                app.masterKey = await ConfigKeyCache.get(app.appId, cacheKey, app.masterKeyTtl, app.masterKey);
               }
 
               return app;
@@ -179,7 +199,7 @@ module.exports = function(config, options) {
 
       //They didn't provide auth, and have configured the dashboard to not need auth
       //(ie. didn't supply usernames and passwords)
-      if (requestIsLocal || options.dev) {
+      if (isLocalRequest(req) || options.dev) {
         //Allow no-auth access on localhost only, if they have configured the dashboard to not need auth
         await Promise.all(
           response.apps.map(async (app) => {
@@ -198,10 +218,12 @@ module.exports = function(config, options) {
     // In-memory conversation storage (consider using Redis in future)
     const conversations = new Map();
 
-    // Agent API endpoint for handling AI requests - scoped to specific app
-    app.post('/apps/:appId/agent', async (req, res) => {
+    // Agent API endpoint handler
+    async function agentHandler(req, res) {
       try {
-        const { message, modelName, conversationId, permissions } = req.body;
+        const authentication = req.user;
+
+        const { message, modelName, conversationId, permissions } = req.body || {};
         const { appId } = req.params;
 
         if (!message || typeof message !== 'string' || message.trim() === '') {
@@ -222,11 +244,40 @@ module.exports = function(config, options) {
         }
 
         // Find the app in the configuration
-        const app = config.apps.find(app => (app.appNameForURL || app.appName) === appId);
-        if (!app) {
+        const appConfig = config.apps.find(a => (a.appNameForURL || a.appName) === appId);
+        if (!appConfig) {
           return res.status(404).json({ error: `App "${appId}" not found` });
         }
 
+        // Cross-app access control — restrict to apps the authenticated user has access to
+        const appsUserHasAccess = authentication && authentication.appsUserHasAccessTo;
+        let isPerAppReadOnly = false;
+        if (appsUserHasAccess) {
+          const matchingAccess = appsUserHasAccess.find(access => access.appId === appConfig.appId);
+          if (!matchingAccess) {
+            return res.status(403).json({ error: 'Forbidden: you do not have access to this app' });
+          }
+          isPerAppReadOnly = !!matchingAccess.readOnly;
+        }
+
+        // Determine if the user is read-only (globally or per-app)
+        const isReadOnly = (authentication && authentication.isReadOnly) || isPerAppReadOnly;
+
+        // Build the app context — always shallow copy to avoid mutating the shared config
+        const appContext = { ...appConfig };
+        if (isReadOnly) {
+          if (!appConfig.readOnlyMasterKey) {
+            return res.status(400).json({ error: 'You need to provide a readOnlyMasterKey to use read-only features.' });
+          }
+          appContext.masterKey = appConfig.readOnlyMasterKey;
+        }
+
+        // Resolve function-typed masterKey (supports dynamic key rotation via ConfigKeyCache)
+        if (typeof appContext.masterKey === 'function') {
+          const cacheKey = isReadOnly ? 'readOnlyMasterKey' : 'masterKey';
+          appContext.masterKey = await ConfigKeyCache.get(appContext.appId, cacheKey, appContext.masterKeyTtl, appContext.masterKey);
+        }
+
         // Find the requested model
         const modelConfig = config.agent.models.find(model => model.name === modelName);
         if (!modelConfig) {
@@ -259,8 +310,12 @@ module.exports = function(config, options) {
         // Array to track database operations for this request
         const operationLog = [];
 
+        // Read-only users: override client permissions to deny all write operations,
+        // preventing privilege escalation via self-authorized permissions in the request body
+        const effectivePermissions = isReadOnly ? {} : (permissions || {});
+
         // Make request to OpenAI API with app context and conversation history
-        const response = await makeOpenAIRequest(message, model, apiKey, app, conversationHistory, operationLog, permissions);
+        const response = await makeOpenAIRequest(message, model, apiKey, appContext, conversationHistory, operationLog, effectivePermissions);
 
         // Update conversation history with user message and AI response
         conversationHistory.push(
@@ -281,7 +336,7 @@ module.exports = function(config, options) {
           conversationId: finalConversationId,
           debug: {
             timestamp: new Date().toISOString(),
-            appId: app.appId,
+            appId: appContext.appId,
             modelUsed: model,
             operations: operationLog
           }
@@ -292,7 +347,20 @@ module.exports = function(config, options) {
         const errorMessage = error.message || 'Provider error';
         res.status(500).json({ error: `Error: ${errorMessage}` });
       }
-    });
+    }
+
+    // Agent API endpoint — middleware chain: remote access guard → auth check (401) → CSRF validation (403) → handler
+    app.post('/apps/:appId/agent',
+      enforceRemoteAccessRestrictions,
+      (req, res, next) => {
+        if (users && (!req.user || !req.user.isAuthenticated)) {
+          return res.status(401).json({ error: 'Unauthorized' });
+        }
+        next();
+      },
+      Authentication.csrfProtection,
+      agentHandler
+    );
 
     /**
      * Database function tools for the AI agent
@@ -1065,7 +1133,7 @@ You have direct access to the Parse database through function calls, so you can
       }
     }
 
-    app.get('/login', csrf(), function(req, res) {
+    app.get('/login', Authentication.csrfProtection, function(req, res) {
       let redirectURL = null;
       try {
         const url = new URL(req.url, 'http://localhost');
@@ -1116,7 +1184,7 @@ You have direct access to the Parse database through function calls, so you can
     });
 
     // Analytics dashboard routes - Only serve custom analytics if analyticsPage is configured
-    app.get('/apps/*/analytics_dashboard', function(req, res) {
+    app.get('/apps/:appId/analytics_dashboard', function(req, res) {
       console.log('🎯 Analytics dashboard route hit:', req.path, req.url);
       
       if (users && (!req.user || !req.user.isAuthenticated)) {
@@ -1129,8 +1197,7 @@ You have direct access to the Parse database through function calls, so you can
       }
       
       // Extract app ID from URL
-      const appIdMatch = req.path.match(/\/apps\/([^\/]+)\/analytics_dashboard/);
-      const appId = appIdMatch ? appIdMatch[1] : null;
+      const appId = req.params.appId;
       console.log('📱 Extracted app ID:', appId);
       
       // Find the app configuration
@@ -1172,7 +1239,7 @@ You have direct access to the Parse database through function calls, so you can
     });
 
     // Alternative analytics dashboard route (with slash instead of underscore)
-    app.get('/apps/*/analytics/dashboard', function(req, res) {
+    app.get('/apps/:appId/analytics/dashboard', function(req, res) {
       console.log('🎯 Alternative analytics route hit:', req.path, req.url);
       
       if (users && (!req.user || !req.user.isAuthenticated)) {
@@ -1185,8 +1252,7 @@ You have direct access to the Parse database through function calls, so you can
       }
       
       // Extract app ID from URL
-      const appIdMatch = req.path.match(/\/apps\/([^\/]+)\/analytics\/dashboard/);
-      const appId = appIdMatch ? appIdMatch[1] : null;
+      const appId = req.params.appId;
       console.log('📱 Extracted app ID:', appId);
       
       // Find the app configuration
@@ -1228,7 +1294,7 @@ You have direct access to the Parse database through function calls, so you can
     });
 
     // For every other request, go to index.html. Let client-side handle the rest.
-    app.get('/*', function(req, res) {
+    app.get('{*splat}', Authentication.csrfProtection, function(req, res) {
       if (users && (!req.user || !req.user.isAuthenticated)) {
         const redirect = req.url.replace('/login', '');
         if (redirect.length > 1) {
@@ -1252,6 +1318,7 @@ You have direct access to the Parse database through function calls, so you can
         </head>
         <body>
           <div id="browser_mount"></div>
+          <script id="csrf" type="application/json">"${req.csrfToken()}"</script>
           <script src="${mountPath}bundles/dashboard.bundle.js"></script>
         </body>
       </html>