rlz-engine 1.0.53 → 1.0.55

package/dist/back/auth/rate-limit.js

@@ -0,0 +1,59 @@
+import { httpErrors } from '@fastify/sensible';
+const SIGNIN_WINDOW_MS = 15 * 60 * 1000;
+const SIGNIN_ATTEMPTS_PER_WINDOW = 10;
+const SIGNUP_WINDOW_MS = 60 * 60 * 1000;
+const SIGNUP_ATTEMPTS_PER_WINDOW = 5;
+const MAX_CONCURRENT_OPERATIONS = 4;
+const MAX_TRACKED_BUCKETS = 10_000;
+/** Bounds anonymous password-hash work per peer and across this server process. */
+export class AuthRateLimiter {
+    buckets = new Map();
+    activeOperations = 0;
+    bucketInsertionsSinceCleanup = 0;
+    async run(operation, ip, action) {
+        if (this.activeOperations >= MAX_CONCURRENT_OPERATIONS)
+            throw httpErrors.tooManyRequests();
+        this.checkRate(operation, ip);
+        this.activeOperations += 1;
+        try {
+            return await action();
+        }
+        finally {
+            this.activeOperations -= 1;
+        }
+    }
+    checkRate(operation, ip) {
+        const now = Date.now();
+        const windowMs = operation === 'signin' ? SIGNIN_WINDOW_MS : SIGNUP_WINDOW_MS;
+        const limit = operation === 'signin' ? SIGNIN_ATTEMPTS_PER_WINDOW : SIGNUP_ATTEMPTS_PER_WINDOW;
+        const key = `${operation}:${ip}`;
+        const bucket = this.buckets.get(key);
+        if (bucket === undefined || now - bucket.startedAt >= windowMs) {
+            if (bucket === undefined && this.buckets.size >= MAX_TRACKED_BUCKETS) {
+                this.bucketInsertionsSinceCleanup += 1;
+                if (this.bucketInsertionsSinceCleanup >= 256) {
+                    this.removeExpiredBuckets(now);
+                    this.bucketInsertionsSinceCleanup = 0;
+                }
+                if (this.buckets.size >= MAX_TRACKED_BUCKETS) {
+                    // Keep attacker-controlled peer diversity from growing this map without bound.
+                    const oldestKey = this.buckets.keys().next().value;
+                    if (oldestKey !== undefined)
+                        this.buckets.delete(oldestKey);
+                }
+            }
+            this.buckets.set(key, { startedAt: now, attempts: 1, expiresAt: now + windowMs });
+            return;
+        }
+        if (bucket.attempts >= limit)
+            throw httpErrors.tooManyRequests();
+        bucket.attempts += 1;
+    }
+    removeExpiredBuckets(now) {
+        for (const [key, bucket] of this.buckets) {
+            if (bucket.expiresAt <= now)
+                this.buckets.delete(key);
+        }
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/back/auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/back/auth/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACvC,MAAM,0BAA0B,GAAG,EAAE,CAAA;AACrC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACvC,MAAM,0BAA0B,GAAG,CAAC,CAAA;AACpC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AACnC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAUlC,mFAAmF;AACnF,MAAM,OAAO,eAAe;IACP,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IAChD,gBAAgB,GAAG,CAAC,CAAA;IACpB,4BAA4B,GAAG,CAAC,CAAA;IAExC,KAAK,CAAC,GAAG,CAAI,SAAwB,EAAE,EAAU,EAAE,MAAwB;QACvE,IAAI,IAAI,CAAC,gBAAgB,IAAI,yBAAyB;YAAE,MAAM,UAAU,CAAC,eAAe,EAAE,CAAA;QAC1F,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QAE7B,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC;YACD,OAAO,MAAM,MAAM,EAAE,CAAA;QACzB,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAA;QAC9B,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,SAAwB,EAAE,EAAU;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,QAAQ,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAA;QAC7E,MAAM,KAAK,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAA;QAC9F,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,EAAE,EAAE,CAAA;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEpC,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YAC7D,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;gBACnE,IAAI,CAAC,4BAA4B,IAAI,CAAC,CAAA;gBACtC,IAAI,IAAI,CAAC,4BAA4B,IAAI,GAAG,EAAE,CAAC;oBAC3C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;oBAC9B,IAAI,CAAC,4BAA4B,GAAG,CAAC,CAAA;gBACzC,CAAC;gBACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;oBAC3C,+EAA+E;oBAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;oBAClD,IAAI,SAAS,KAAK,SAAS;wBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBAC/D,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAA;YACjF,OAAM;QACV,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,IAAI,KAAK;YAAE,MAAM,UAAU,CAAC,eAAe,EAAE,CAAA;QAChE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAA;IACxB,CAAC;IAEO,oBAAoB,CAAC,GAAW;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACzD,CAAC;IACL,CAAC;CACJ"}

package/dist/back/auth/session.d.ts

@@ -0,0 +1,22 @@
+import { Binary } from 'mongodb';
+import type { AuthStorage } from './storage.js';
+import { toAuthUser } from './utils.js';
+import type { RpcRequestContext } from '../rpc/rpc.js';
+export declare const SESSION_IDLE_TIMEOUT_MS: number;
+export declare const SESSION_ABSOLUTE_TIMEOUT_MS: number;
+export interface AuthenticatedSession {
+    user: ReturnType<typeof toAuthUser>;
+    sessionHash: Binary;
+    csrfToken: string;
+}
+/** Create a new opaque session; only its one-way hash is persisted. */
+export declare function createSession(storage: AuthStorage, userId: string): Promise<{
+    sessionId: string;
+    csrfToken: string;
+}>;
+/** Revoke the session currently held by this browser before issuing a replacement. */
+export declare function revokeCurrentSession(storage: AuthStorage, context: RpcRequestContext): Promise<void>;
+/** Authenticate only previously issued session IDs and reject expired or idle sessions. */
+export declare function authenticateSession(storage: AuthStorage, context: RpcRequestContext, idleTimeoutMs?: number): Promise<AuthenticatedSession>;
+/** Require both same-origin browser requests and a session-bound synchronizer token. */
+export declare function verifySessionCsrf(storage: AuthStorage, context: RpcRequestContext, session: AuthenticatedSession): Promise<void>;

package/dist/back/auth/session.js

@@ -0,0 +1,55 @@
+import { httpErrors } from '@fastify/sensible';
+import { createHash, randomBytes } from 'node:crypto';
+import { Binary } from 'mongodb';
+import { SESSION_COOKIE_NAME } from './cookies.js';
+import { assertSameOrigin, verifyCsrfToken } from './csrf.js';
+import { toAuthUser } from './utils.js';
+export const SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+export const SESSION_ABSOLUTE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1000;
+/** Create a new opaque session; only its one-way hash is persisted. */
+export async function createSession(storage, userId) {
+    const sessionId = randomBytes(32).toString('base64url');
+    const csrfToken = randomBytes(32).toString('base64url');
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + SESSION_ABSOLUTE_TIMEOUT_MS);
+    const sessionHash = hashSessionId(sessionId);
+    await storage.createSession(sessionHash, userId, csrfToken, now, expiresAt);
+    return { sessionId, csrfToken };
+}
+/** Revoke the session currently held by this browser before issuing a replacement. */
+export async function revokeCurrentSession(storage, context) {
+    const sessionId = context.request.cookies[SESSION_COOKIE_NAME];
+    if (typeof sessionId === 'string' && /^[A-Za-z0-9_-]{43}$/.test(sessionId)) {
+        await storage.deleteSession(hashSessionId(sessionId));
+    }
+}
+/** Authenticate only previously issued session IDs and reject expired or idle sessions. */
+export async function authenticateSession(storage, context, idleTimeoutMs = SESSION_IDLE_TIMEOUT_MS) {
+    const sessionId = context.request.cookies[SESSION_COOKIE_NAME];
+    if (typeof sessionId !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(sessionId)) {
+        throw httpErrors.forbidden();
+    }
+    const sessionHash = hashSessionId(sessionId);
+    const session = await storage.getSession(sessionHash, new Date(), idleTimeoutMs);
+    if (session === null)
+        throw httpErrors.forbidden();
+    const user = await storage.getUserById(session.userId);
+    if (user === null) {
+        await storage.deleteSession(sessionHash);
+        throw httpErrors.forbidden();
+    }
+    return { user: toAuthUser(user), sessionHash, csrfToken: session.csrfToken };
+}
+/** Require both same-origin browser requests and a session-bound synchronizer token. */
+export async function verifySessionCsrf(storage, context, session) {
+    assertSameOrigin(context.request);
+    const provided = context.request.headers['x-csrf-token'];
+    if (!verifyCsrfToken(session.csrfToken, provided))
+        throw httpErrors.forbidden();
+    await storage.touchSession(session.sessionHash, new Date());
+}
+/** Require same-origin requests for anonymous auth actions and session bootstrap. */
+function hashSessionId(sessionId) {
+    return new Binary(createHash('sha256').update(sessionId).digest());
+}
+//# sourceMappingURL=session.js.map

package/dist/back/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/back/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGvC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAQlE,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAoB,EAAE,MAAc;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,2BAA2B,CAAC,CAAA;IACvE,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IAE5C,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;IAC3E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACnC,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAoB,EAAE,OAA0B;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC9D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;IACzD,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAAoB,EACpB,OAA0B,EAC1B,aAAa,GAAG,uBAAuB;IAEvC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC9D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChC,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,aAAa,CAAC,CAAA;IAChF,IAAI,OAAO,KAAK,IAAI;QAAE,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAElD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;QACxC,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;AAChF,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAoB,EAAE,OAA0B,EAAE,OAA6B;IACnH,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACxD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAC/E,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,SAAiB;IACpC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AACtE,CAAC"}

package/dist/back/auth/storage.d.ts

@@ -1,22 +1,22 @@
-import { FastifyRequest } from 'fastify';
 import { Binary, Collection } from 'mongodb';
 import { MongoStorage } from '../storage/db.js';
-import { StorageTempPassword, StorageUser } from './model.js';
+import { StorageSession, StorageUser } from './model.js';
 export declare class AuthStorage {
     private readonly logger;
     private readonly mongo;
     private constructor();
     static create(mongo: MongoStorage): Promise<AuthStorage>;
     private init;
-    createUser(id: string, name: string, email: string, passwordSalt: Binary, passwordHash: Binary): Promise<void>;
+    createUser(id: string, name: string, email: string, passwordSalt: Binary, passwordHash: Binary, passwordHashVersion: number): Promise<void>;
     getUser(name: string): Promise<StorageUser | null>;
     markUserActive(userId: string): Promise<void>;
-    pushTempPassword(userId: string, passwordHash: Binary, validUntil: Date): Promise<void>;
-    deleteTempPassword(userId: string, passwordHash: Binary): Promise<void>;
-    getUserByTempPassword(userId: string, passwordHash: Binary): Promise<StorageUser | null>;
-    private createCollections;
+    getUserById(userId: string): Promise<StorageUser | null>;
+    updateLegacyPasswordHash(userId: string, oldSalt: Binary, oldHash: Binary, newSalt: Binary, newHash: Binary): Promise<boolean>;
+    createSession(sessionHash: Binary, userId: string, csrfToken: string, createdAt: Date, expiresAt: Date): Promise<void>;
+    getSession(sessionHash: Binary, now: Date, idleTimeoutMs: number): Promise<StorageSession | null>;
+    touchSession(sessionHash: Binary, lastActivityAt: Date): Promise<void>;
+    deleteSession(sessionHash: Binary): Promise<void>;
     private createIndexes;
     get users(): Collection<StorageUser>;
-    get tempPasswords(): Collection<StorageTempPassword>;
-    get auth(): (headers: FastifyRequest["headers"]) => Promise<string>;
+    get sessions(): Collection<StorageSession>;
 }

package/dist/back/auth/storage.js

@@ -1,8 +1,7 @@
 import { DateTime } from 'luxon';
-import { logger } from '../logger.js';
-import { auth } from './utils.js';
+import { getSystemLogger } from '../logger/system-logger.js';
 export class AuthStorage {
-    logger = logger('AuthStorage');
+    logger = getSystemLogger('AuthStorage');
     mongo;
     constructor(mongo) {
         this.mongo = mongo;
@@ -13,18 +12,17 @@ export class AuthStorage {
         return s;
     }
     async init() {
-        await Promise.all([
-            'users', 'temp-passwords'
-        ].map(i => this.mongo.createCollection(i)));
+        await Promise.all(['users', 'sessions'].map((i) => this.mongo.createCollection(i)));
         await this.createIndexes();
     }
-    async createUser(id, name, email, passwordSalt, passwordHash) {
+    async createUser(id, name, email, passwordSalt, passwordHash, passwordHashVersion) {
         await this.users.insertOne({
             _id: id,
             name,
             email,
             passwordSalt,
             passwordHash,
+            passwordHashVersion,
             lastActivityDate: DateTime.utc().toJSDate()
         });
     }
@@ -34,28 +32,38 @@ export class AuthStorage {
     async markUserActive(userId) {
         await this.users.updateOne({ _id: userId }, { $set: { lastActivityDate: DateTime.utc().toJSDate() } });
     }
-    async pushTempPassword(userId, passwordHash, validUntil) {
-        await this.tempPasswords.insertOne({
+    async getUserById(userId) {
+        return await this.users.findOne({ _id: userId });
+    }
+    async updateLegacyPasswordHash(userId, oldSalt, oldHash, newSalt, newHash) {
+        const result = await this.users.updateOne({ _id: userId, passwordSalt: oldSalt, passwordHash: oldHash, passwordHashVersion: { $exists: false } }, { $set: { passwordSalt: newSalt, passwordHash: newHash, passwordHashVersion: 1 } });
+        return result.modifiedCount === 1;
+    }
+    async createSession(sessionHash, userId, csrfToken, createdAt, expiresAt) {
+        await this.sessions.insertOne({
             userId,
-            passwordHash,
-            validUntil
+            sessionHash,
+            csrfToken,
+            createdAt,
+            lastActivityAt: createdAt,
+            expiresAt
         });
     }
-    async deleteTempPassword(userId, passwordHash) {
-        await this.tempPasswords.deleteOne({ userId, passwordHash });
-    }
-    async getUserByTempPassword(userId, passwordHash) {
-        const t = await this.tempPasswords.findOne({ userId, passwordHash });
-        if (t === null) {
+    async getSession(sessionHash, now, idleTimeoutMs) {
+        const session = await this.sessions.findOne({ sessionHash, expiresAt: { $gt: now } });
+        if (session === null)
             return null;
-        }
-        if (DateTime.utc() > DateTime.fromJSDate(t.validUntil)) {
-            await this.tempPasswords.deleteOne({ _id: t._id });
+        if (session.lastActivityAt.getTime() <= now.getTime() - idleTimeoutMs) {
+            await this.sessions.deleteOne({ sessionHash });
             return null;
         }
-        return await this.users.findOne({ _id: t.userId });
+        return session;
     }
-    async createCollections() {
+    async touchSession(sessionHash, lastActivityAt) {
+        await this.sessions.updateOne({ sessionHash }, { $set: { lastActivityAt } });
+    }
+    async deleteSession(sessionHash) {
+        await this.sessions.deleteOne({ sessionHash });
     }
     async createIndexes() {
         await this.mongo.createIndexes(this.users, [
@@ -67,31 +75,26 @@ export class AuthStorage {
                 unique: true
             }
         ]);
-        await this.mongo.createIndexes(this.tempPasswords, [
+        await this.mongo.createIndexes(this.sessions, [
             {
-                name: 'userId_v0',
-                key: {
-                    userId: 1
-                }
+                name: 'sessionHash_v1',
+                key: { sessionHash: 1 },
+                unique: true
             },
             {
-                name: 'ttl_v0',
+                name: 'expiresAt_v1',
                 key: {
-                    passwordHash: 1
+                    expiresAt: 1
                 },
-                // Temp passwords also have expirity dates, make sure they are syncronized with this expirity index
-                expireAfterSeconds: 60 * 60 * 24 * 7 // 7 days
+                expireAfterSeconds: 0
             }
         ]);
     }
     get users() {
         return this.mongo.db.collection('users');
     }
-    get tempPasswords() {
-        return this.mongo.db.collection('temp-passwords');
-    }
-    get auth() {
-        return (headers) => auth(headers, this);
+    get sessions() {
+        return this.mongo.db.collection('sessions');
     }
 }
 //# sourceMappingURL=storage.js.map

package/dist/back/auth/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../src/back/auth/storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAGrC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEjC,MAAM,OAAO,WAAW;IACH,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;IAC9B,KAAK,CAAc;IAEpC,YAAoB,KAAmB;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACd,OAAO,CAAC,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,IAAI;QACd,MAAM,OAAO,CAAC,GAAG,CAAC;YACd,OAAO,EAAE,gBAAgB;SAC5B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAE3C,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa,EAAE,YAAoB,EAAE,YAAoB;QAChG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACvB,GAAG,EAAE,EAAE;YACP,IAAI;YACJ,KAAK;YACL,YAAY;YACZ,YAAY;YACZ,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACtB,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;IAC1G,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,YAAoB,EAAE,UAAgB;QACzE,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YAC/B,MAAM;YACN,YAAY;YACZ,UAAU;SACb,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,YAAoB;QACzD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,YAAoB;QAC5D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAEpE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACb,OAAO,IAAI,CAAA;QACf,CAAC;QAED,IAAI,QAAQ,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;YAClD,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,iBAAiB;IAC/B,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EACrC;YACI;gBACI,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE;oBACD,IAAI,EAAE,CAAC;iBACV;gBACD,MAAM,EAAE,IAAI;aACf;SACJ,CACJ,CAAA;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAC7C;YACI;gBACI,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE;oBACD,MAAM,EAAE,CAAC;iBACZ;aACJ;YACD;gBACI,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE;oBACD,YAAY,EAAE,CAAC;iBAClB;gBACD,mGAAmG;gBACnG,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS;aACjD;SACJ,CACJ,CAAA;IACL,CAAC;IAED,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,IAAI,aAAa;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,IAAI;QACJ,OAAO,CAAC,OAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtE,CAAC;CACJ"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../src/back/auth/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAI5D,MAAM,OAAO,WAAW;IACH,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAA;IACvC,KAAK,CAAc;IAEpC,YAAoB,KAAmB;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACtB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAmB;QACnC,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACd,OAAO,CAAC,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,IAAI;QACd,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEnF,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa,EAAE,YAAoB,EAAE,YAAoB,EAAE,mBAA2B;QAC7H,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACvB,GAAG,EAAE,EAAE;YACP,IAAI;YACJ,KAAK;YACL,YAAY;YACZ,YAAY;YACZ,mBAAmB;YACnB,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;SAC9C,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACtB,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;IAC1G,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC5B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,OAAe,EAAE,OAAe,EAAE,OAAe,EAAE,OAAe;QAC7G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CACrC,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EACtG,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE,CACrF,CAAA;QACD,OAAO,MAAM,CAAC,aAAa,KAAK,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,MAAc,EAAE,SAAiB,EAAE,SAAe,EAAE,SAAe;QACxG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1B,MAAM;YACN,WAAW;YACX,SAAS;YACT,SAAS;YACT,cAAc,EAAE,SAAS;YACzB,SAAS;SACZ,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,GAAS,EAAE,aAAqB;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACrF,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAEjC,IAAI,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;YAC9C,OAAO,IAAI,CAAA;QACf,CAAC;QAED,OAAO,OAAO,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,cAAoB;QACxD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB;QACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE;YACvC;gBACI,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE;oBACD,IAAI,EAAE,CAAC;iBACV;gBACD,MAAM,EAAE,IAAI;aACf;SACJ,CAAC,CAAA;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C;gBACI,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE;gBACvB,MAAM,EAAE,IAAI;aACf;YACD;gBACI,IAAI,EAAE,cAAc;gBACpB,GAAG,EAAE;oBACD,SAAS,EAAE,CAAC;iBACf;gBACD,kBAAkB,EAAE,CAAC;aACxB;SACJ,CAAC,CAAA;IACN,CAAC;IAED,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,IAAI,QAAQ;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IAC/C,CAAC;CACJ"}

package/dist/back/auth/utils.d.ts

@@ -1,8 +1,10 @@
-import { FastifyRequest } from 'fastify';
-import { ApiAuthResponseV0 } from '../../shared/api/auth.js';
-import { AuthStorage } from './storage.js';
-export declare function signup(storage: AuthStorage, name: string, email: string, password: string): Promise<ApiAuthResponseV0>;
-export declare function signin(storage: AuthStorage, name: string, password: string): Promise<ApiAuthResponseV0 | null>;
-export declare function logout(storage: AuthStorage, userId: string, tempPassword: string): Promise<void>;
-export declare function verifyTempPassword(storage: AuthStorage, userId: string, tempPassword: string): Promise<string>;
-export declare function auth(headers: FastifyRequest['headers'], storage: AuthStorage): Promise<string>;
+import type { AuthStorage } from './storage.js';
+import type { StorageUser } from './model.js';
+export interface AuthUser {
+    id: string;
+    name: string;
+    email: string;
+}
+export declare function signup(storage: AuthStorage, name: string, email: string, password: string): Promise<AuthUser>;
+export declare function signin(storage: AuthStorage, name: string, password: string): Promise<AuthUser | null>;
+export declare function toAuthUser(user: Pick<StorageUser, '_id' | 'name' | 'email'>): AuthUser;

package/dist/back/auth/utils.js

@@ -1,81 +1,68 @@
 import { httpErrors } from '@fastify/sensible';
-import { randomBytes, scryptSync } from 'crypto';
-import { DateTime } from 'luxon';
+import { randomBytes, scrypt as scryptCallback, timingSafeEqual } from 'node:crypto';
 import { Binary, MongoServerError } from 'mongodb';
 import { uuidv7 } from 'uuidv7';
-const TEMP_PASSWORD_SALT = Buffer.from('cashmony-temp-password-salt', 'utf8');
+const PASSWORD_HASH_VERSION = 1;
+const PASSWORD_HASH_BYTES = 64;
+const LEGACY_SCRYPT_OPTIONS = { N: 1024, r: 8, p: 1, maxmem: 32 * 1024 * 1024 };
+const CURRENT_SCRYPT_OPTIONS = { N: 32_768, r: 8, p: 3, maxmem: 64 * 1024 * 1024 };
+const DUMMY_SALT = Buffer.alloc(64, 0x5a);
 export async function signup(storage, name, email, password) {
     const salt = randomBytes(64);
-    const hash = calcHash(password, salt);
+    const hash = await derivePasswordHash(password, salt, CURRENT_SCRYPT_OPTIONS);
     const id = uuidv7();
     try {
-        await storage.createUser(id, name, email, new Binary(salt), new Binary(hash));
+        await storage.createUser(id, name, email, new Binary(salt), new Binary(hash), PASSWORD_HASH_VERSION);
     }
     catch (e) {
         if (e instanceof MongoServerError && e.code === 11000) {
-            // duplicate key error
             throw httpErrors.conflict();
         }
         throw e;
     }
-    const tempPassword = await makeTempPassword(storage, id);
-    return {
-        id,
-        name,
-        email,
-        tempPassword
-    };
+    return { id, name, email };
 }
 export async function signin(storage, name, password) {
-    const u = await storage.getUser(name);
-    if (u === null) {
+    const user = await storage.getUser(name);
+    if (user === null) {
+        await derivePasswordHash(password, DUMMY_SALT, CURRENT_SCRYPT_OPTIONS);
         return null;
     }
-    const hash = calcHash(password, u.passwordSalt.value());
-    if (!hash.equals(u.passwordHash.value())) {
-        return null;
+    if (user.passwordHashVersion === undefined) {
+        const legacyHash = await derivePasswordHash(password, user.passwordSalt.value(), LEGACY_SCRYPT_OPTIONS, 512);
+        if (!hashMatches(legacyHash, user.passwordHash.value())) {
+            await derivePasswordHash(password, DUMMY_SALT, CURRENT_SCRYPT_OPTIONS);
+            return null;
+        }
+        const salt = randomBytes(64);
+        const upgradedHash = await derivePasswordHash(password, salt, CURRENT_SCRYPT_OPTIONS);
+        await storage.updateLegacyPasswordHash(user._id, user.passwordSalt, user.passwordHash, new Binary(salt), new Binary(upgradedHash));
     }
-    const tempPassword = await makeTempPassword(storage, u._id);
-    await storage.markUserActive(u._id);
-    return {
-        id: u._id,
-        name: u.name,
-        email: u.email,
-        tempPassword
-    };
-}
-export async function logout(storage, userId, tempPassword) {
-    const hash = calcHash(tempPassword, TEMP_PASSWORD_SALT);
-    await storage.deleteTempPassword(userId, new Binary(hash));
-}
-export async function verifyTempPassword(storage, userId, tempPassword) {
-    const hash = calcTempPasswordHash(Buffer.from(tempPassword, 'base64'));
-    const u = await storage.getUserByTempPassword(userId, new Binary(hash));
-    if (u === null) {
-        throw httpErrors.forbidden();
+    else if (user.passwordHashVersion === PASSWORD_HASH_VERSION) {
+        const hash = await derivePasswordHash(password, user.passwordSalt.value(), CURRENT_SCRYPT_OPTIONS);
+        if (!hashMatches(hash, user.passwordHash.value()))
+            return null;
     }
-    await storage.markUserActive(u._id);
-    return u._id;
-}
-async function makeTempPassword(storage, userId) {
-    const password = randomBytes(128);
-    const passwordHash = calcTempPasswordHash(password);
-    // Temp passwords also are removed from Mongo by TTL index, make sure expirity dates are syncronised
-    await storage.pushTempPassword(userId, new Binary(passwordHash), DateTime.utc().plus({ days: 7 }).toJSDate());
-    return password.toString('base64');
-}
-export async function auth(headers, storage) {
-    const authHeader = headers.authorization;
-    if (authHeader === undefined) {
-        throw httpErrors.forbidden();
+    else {
+        return null;
     }
-    const [userId, tempPassword] = authHeader.split(':');
-    return await verifyTempPassword(storage, userId, tempPassword);
+    await storage.markUserActive(user._id);
+    return toAuthUser(user);
+}
+export function toAuthUser(user) {
+    return { id: user._id, name: user.name, email: user.email };
 }
-function calcHash(password, salt) {
-    return scryptSync(password, salt, 512, { N: 1024 });
+async function derivePasswordHash(password, salt, options, keyLength = PASSWORD_HASH_BYTES) {
+    return await new Promise((resolve, reject) => {
+        scryptCallback(password, salt, keyLength, options, (error, derivedKey) => {
+            if (error !== null)
+                reject(error);
+            else
+                resolve(derivedKey);
+        });
+    });
 }
-function calcTempPasswordHash(tempPassword) {
-    return scryptSync(tempPassword, TEMP_PASSWORD_SALT, 512, { N: 1024 });
+function hashMatches(actual, expected) {
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
 }
 //# sourceMappingURL=utils.js.map

package/dist/back/auth/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/back/auth/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAK/B,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;AAE7E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAoB,EAAE,IAAY,EAAE,KAAa,EAAE,QAAgB;IAC5F,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACrC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;IACnB,IAAI,CAAC;QACD,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACjF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpD,sBAAsB;YACtB,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC,CAAA;IACX,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACxD,OAAO;QACH,EAAE;QACF,IAAI;QACJ,KAAK;QACL,YAAY;KACf,CAAA;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAoB,EAAE,IAAY,EAAE,QAAgB;IAC7E,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAA;IAEvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAA;IAE3D,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAEnC,OAAO;QACH,EAAE,EAAE,CAAC,CAAC,GAAG;QACT,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,YAAY;KACf,CAAA;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAoB,EAAE,MAAc,EAAE,YAAoB;IACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;IACvD,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB,EAAE,MAAc,EAAE,YAAoB;IAC/F,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACb,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChC,CAAC;IAED,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAEnC,OAAO,CAAC,CAAC,GAAG,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAoB,EAAE,MAAc;IAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACnD,oGAAoG;IACpG,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC7G,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAkC,EAAE,OAAoB;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAA;IACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;IAChC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEpD,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,IAAgB;IAChD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAwB;IAClD,OAAO,UAAU,CAAC,YAAY,EAAE,kBAAkB,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACzE,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/back/auth/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAK/B,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAC/B,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAC9B,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAA;AAC/E,MAAM,sBAAsB,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAA;AAClF,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;AAQzC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAoB,EAAE,IAAY,EAAE,KAAa,EAAE,QAAgB;IAC5F,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;IAC7E,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;IACnB,IAAI,CAAC;QACD,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAA;IACxG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpD,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC,CAAA;IACX,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAoB,EAAE,IAAY,EAAE,QAAgB;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChB,MAAM,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAA;QACtE,OAAO,IAAI,CAAA;IACf,CAAC;IAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAA;QAC5G,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAA;YACtE,OAAO,IAAI,CAAA;QACf,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAA;QACrF,MAAM,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IACtI,CAAC;SAAM,IAAI,IAAI,CAAC,mBAAmB,KAAK,qBAAqB,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAA;QAClG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;IAClE,CAAC;SAAM,CAAC;QACJ,OAAO,IAAI,CAAA;IACf,CAAC;IAED,MAAM,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiD;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC7B,QAAgB,EAChB,IAAgB,EAChB,OAAqE,EACrE,SAAS,GAAG,mBAAmB;IAE/B,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACrE,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBAC5B,OAAO,CAAC,UAAU,CAAC,CAAA;QAC5B,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;AACN,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB,EAAE,QAAoB;IACzD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AACjF,CAAC"}

package/dist/back/certificate/adm-rpc.d.ts

@@ -0,0 +1,5 @@
+/** Creates a protected endpoint that reports dates from the certificate on disk. */
+export declare function makeCertificateAdmRpc({ certDir, domain }: {
+    certDir: string;
+    domain: string;
+}): import("../rpc/rpc.js").AdmRpcPluginBuilder<import("../rpc/rpc.js").AdmRpcPluginOptions>;

package/dist/back/certificate/adm-rpc.js

@@ -0,0 +1,52 @@
+import { X509Certificate } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import z from 'zod';
+import { certFilename } from 'fastify-acme';
+import { admRpc } from '../rpc/rpc.js';
+const CERTIFICATE_RENEWAL_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+const certificateStatusSchema = z.object({
+    domain: z.string(),
+    certificateFound: z.boolean(),
+    issuedAt: z.string().optional(),
+    expiresAt: z.string().optional(),
+    renewalAt: z.string().optional(),
+    renewalOverdue: z.boolean(),
+    expired: z.boolean()
+});
+/** Creates a protected endpoint that reports dates from the certificate on disk. */
+export function makeCertificateAdmRpc({ certDir, domain }) {
+    const certificatePath = certFilename(path.resolve(certDir));
+    return admRpc('certificate').add({
+        name: 'status',
+        v: 1,
+        bodySchema: z.object({}),
+        respSchema: certificateStatusSchema,
+        action: async () => {
+            let pem;
+            try {
+                pem = await readFile(certificatePath);
+            }
+            catch (error) {
+                if (error instanceof Error && 'code' in error && error.code === 'ENOENT') {
+                    return { domain, certificateFound: false, renewalOverdue: true, expired: false };
+                }
+                throw error;
+            }
+            const certificate = new X509Certificate(pem);
+            const issuedAt = new Date(certificate.validFrom);
+            const expiresAt = new Date(certificate.validTo);
+            const renewalAt = new Date(expiresAt.getTime() - CERTIFICATE_RENEWAL_WINDOW_MS);
+            return {
+                domain,
+                certificateFound: true,
+                issuedAt: issuedAt.toISOString(),
+                expiresAt: expiresAt.toISOString(),
+                renewalAt: renewalAt.toISOString(),
+                renewalOverdue: Date.now() >= renewalAt.getTime(),
+                expired: Date.now() >= expiresAt.getTime()
+            };
+        }
+    });
+}
+//# sourceMappingURL=adm-rpc.js.map

package/dist/back/certificate/adm-rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adm-rpc.js","sourceRoot":"","sources":["../../../src/back/certificate/adm-rpc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE9D,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAA;AAEF,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAuC;IAC1F,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAE3D,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;QAC7B,IAAI,EAAE,QAAQ;QACd,CAAC,EAAE,CAAC;QACJ,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,UAAU,EAAE,uBAAuB;QACnC,MAAM,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,GAAW,CAAA;YACf,IAAI,CAAC;gBACD,GAAG,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;gBACpF,CAAC;gBACD,MAAM,KAAK,CAAA;YACf,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAA;YAC5C,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;YAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,6BAA6B,CAAC,CAAA;YAE/E,OAAO;gBACH,MAAM;gBACN,gBAAgB,EAAE,IAAI;gBACtB,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;gBAChC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE;gBACjD,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,OAAO,EAAE;aAC7C,CAAA;QACL,CAAC;KACJ,CAAC,CAAA;AACN,CAAC"}

package/dist/back/certificate/module.d.ts

@@ -0,0 +1,13 @@
+import type { AdmModule } from '../../client/adm/admin.js';
+import { makeCertificateAdmRpc } from './adm-rpc.js';
+export interface CertificateModuleOptions {
+    certDir: string;
+    domain: string;
+}
+declare function makeAdm(): AdmModule;
+/** TLS certificate status integrations. */
+export declare const CERTIFICATE_MODULE: {
+    makeAdmRpc: typeof makeCertificateAdmRpc;
+    makeAdm: typeof makeAdm;
+};
+export {};

package/dist/back/certificate/module.js

@@ -0,0 +1,19 @@
+import { admRpcCall } from '../../client/rpc.js';
+import { CertificateStatus } from '../../client/adm/certificate.js';
+import { makeCertificateAdmRpc } from './adm-rpc.js';
+function makeAdm() {
+    return {
+        name: 'certificate',
+        title: 'Certificate',
+        component: CertificateStatus,
+        verify: async (auth) => {
+            await admRpcCall(auth, 'certificate', 'status', 1, {});
+        }
+    };
+}
+/** TLS certificate status integrations. */
+export const CERTIFICATE_MODULE = {
+    makeAdmRpc: makeCertificateAdmRpc,
+    makeAdm
+};
+//# sourceMappingURL=module.js.map

package/dist/back/certificate/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/back/certificate/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAOpD,SAAS,OAAO;IACZ,OAAO;QACH,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,iBAAiB;QAC5B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnB,MAAM,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,CAAC;KACJ,CAAA;AACL,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAC9B,UAAU,EAAE,qBAAqB;IACjC,OAAO;CACV,CAAA"}