spec-3nweb-server 1.7.12 → 1.7.14

package/build/{config/cli → cli}/index.d.ts

@@ -6,4 +6,5 @@ export declare function parseProcessArgv(): {
     runCmd?: ParsedRunArgs;
     signupCmd?: ParsedSignupArgs;
     showUsage?: CliUsageDisplay;
+    showSampleConfig?: CliUsageDisplay;
 };

package/build/{config/cli → cli}/index.js

@@ -17,8 +17,9 @@
 */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseProcessArgv = void 0;
-const default_confs_1 = require("../default-confs");
+const default_confs_1 = require("../config/default-confs");
 const run_cmd_1 = require("./run-cmd");
+const show_sample_config_1 = require("./show-sample-config");
 const signup_cmd_1 = require("./signup-cmd");
 const utils_1 = require("./utils");
 function mainUsage(execName) {
@@ -35,7 +36,8 @@ function mainUsage(execName) {
             header: 'Available commands:',
             content: [
                 run_cmd_1.runCmd,
-                signup_cmd_1.signupCmd
+                signup_cmd_1.signupCmd,
+                show_sample_config_1.showSampleConfigCmd
             ]
         },
         {
@@ -55,6 +57,11 @@ function parseProcessArgv() {
     else if (args[0] === signup_cmd_1.signupCmd.name) {
         return (0, signup_cmd_1.parseSignupArgs)(args.slice(1), default_confs_1.EXECUTABLE_NAME);
     }
+    else if (args[0] === show_sample_config_1.showSampleConfigCmd.name) {
+        return { showSampleConfig: {
+                txtToDisplay: show_sample_config_1.sampleConfig, exitStatus: 0
+            } };
+    }
     else {
         const opts = (0, utils_1.parseArgv)(args, [utils_1.helpOpt], { partial: true });
         if (opts.help) {

package/build/cli/show-sample-config.d.ts

@@ -0,0 +1,3 @@
+import { CommandDef } from "./utils";
+export declare const showSampleConfigCmd: CommandDef<'show-sample-config'>;
+export declare const sampleConfig = "\n# This is a sample configuration yaml file.\n# Uncomment and set required values.\n# Default path of this file is /etc/3nweb/conf.yaml\n\n# Uncomment to enable service\nenabledServices:\n  # asmail: true\n  # storage: true\n  # mailerId: true\n\n# Data root folder. Set non-default value, if required.\n# rootFolder: /var/3nweb\n\n# Customize domain at which clients reach this server from an outside.\n# This value is used by users' MailerId-based login: assertion challenges\n# cryptographically imprint this domain to assure client that there is no\n# missuse.\ndomain: service-for.example.com\n\n# If MailerId provider service is enabled, this is its configuration\nmailerId:\n  certs: /etc/3nweb/mailerid/certs\n\n# Customize servicesConnect before starting this server.\nservicesConnect:\n\n  port: 7070\n  # Hostname allows to restrict on which address service is listening for incoming connections\n  # hostname: \"1.2.3.4\"\n\n  # Uncomment path to Let's Encrypt folder, if it is used. This implicitly tells\n  # server to HTTPS with given certificates.\n  # letsencrypt: /etc/letsencrypt/live/service-for.example.com\n\n  # By default HTTPS service reloads when certificates change. Skip, if required.\n  # skipReloadOnCertsChange: false\n\n  # Set TLS cert and key to do HTTPS. Use either this, or letsencrypt, but not both.\n  # sslOpts: {\n  #   It is Node's https.ServerOptions. Follow https://nodejs.org/docs/latest/api/https.html\n  # }\n\n# Configuration for signup service that creates new accounts on this server.\n# Comment out to disable signup service completely.\n# Note that signup cli commands should be used to create token, without which\n# signup doesn't happen, unless a no-token configuration file is provided.\nsignup: {\n  # noTokenFile: /some/path/to/json\n}\n";

package/build/cli/show-sample-config.js

@@ -0,0 +1,75 @@
+"use strict";
+/*
+ Copyright (C) 2025 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sampleConfig = exports.showSampleConfigCmd = void 0;
+exports.showSampleConfigCmd = {
+    name: 'show-sample-config',
+    summary: 'prints out a template configuration yaml file with comments'
+};
+exports.sampleConfig = `
+# This is a sample configuration yaml file.
+# Uncomment and set required values.
+# Default path of this file is /etc/3nweb/conf.yaml
+
+# Uncomment to enable service
+enabledServices:
+  # asmail: true
+  # storage: true
+  # mailerId: true
+
+# Data root folder. Set non-default value, if required.
+# rootFolder: /var/3nweb
+
+# Customize domain at which clients reach this server from an outside.
+# This value is used by users' MailerId-based login: assertion challenges
+# cryptographically imprint this domain to assure client that there is no
+# missuse.
+domain: service-for.example.com
+
+# If MailerId provider service is enabled, this is its configuration
+mailerId:
+  certs: /etc/3nweb/mailerid/certs
+
+# Customize servicesConnect before starting this server.
+servicesConnect:
+
+  port: 7070
+  # Hostname allows to restrict on which address service is listening for incoming connections
+  # hostname: "1.2.3.4"
+
+  # Uncomment path to Let's Encrypt folder, if it is used. This implicitly tells
+  # server to HTTPS with given certificates.
+  # letsencrypt: /etc/letsencrypt/live/service-for.example.com
+
+  # By default HTTPS service reloads when certificates change. Skip, if required.
+  # skipReloadOnCertsChange: false
+
+  # Set TLS cert and key to do HTTPS. Use either this, or letsencrypt, but not both.
+  # sslOpts: {
+  #   It is Node's https.ServerOptions. Follow https://nodejs.org/docs/latest/api/https.html
+  # }
+
+# Configuration for signup service that creates new accounts on this server.
+# Comment out to disable signup service completely.
+# Note that signup cli commands should be used to create token, without which
+# signup doesn't happen, unless a no-token configuration file is provided.
+signup: {
+  # noTokenFile: /some/path/to/json
+}
+`;
+Object.freeze(exports);

package/build/config/letsencrypt.js

@@ -1,6 +1,6 @@
 "use strict";
 /*
- Copyright (C) 2023 3NSoft Inc.
+ Copyright (C) 2023, 2025 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -19,13 +19,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sslOptsFromConfig = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
+const LETSENCRYPT_CERT_FILE = 'fullchain.pem';
+const LETSENCRYPT_KEY_FILE = 'privkey.pem';
 function sslOptsFromConfig(letsencrypt, sslOpts, skipReloadOnCertsChange) {
     if (!sslOpts) {
         sslOpts = {};
     }
     if (letsencrypt) {
-        sslOpts.cert = (0, fs_1.readFileSync)((0, path_1.join)(letsencrypt, 'fullchain.pem'));
-        sslOpts.key = (0, fs_1.readFileSync)((0, path_1.join)(letsencrypt, 'privkey.pem'));
+        sslOpts.cert = (0, fs_1.readFileSync)((0, path_1.join)(letsencrypt, LETSENCRYPT_CERT_FILE));
+        sslOpts.key = (0, fs_1.readFileSync)((0, path_1.join)(letsencrypt, LETSENCRYPT_KEY_FILE));
         if (skipReloadOnCertsChange) {
             return { sslOpts };
         }

package/build/lib-server/resources/mailerid-authorizer.d.ts

@@ -1,2 +1,7 @@
+import { SignedLoad } from '../../lib-common/jwkeys';
 import { MidAuthorizer } from '../routes/sessions/mid-auth';
-export declare function validator(): MidAuthorizer;
+export declare function validator(ownMidService: OwnMidService | undefined): MidAuthorizer;
+export interface OwnMidService {
+    domain: string;
+    getRoot: () => SignedLoad;
+}

package/build/lib-server/resources/mailerid-authorizer.js

@@ -1,6 +1,6 @@
 "use strict";
 /*
- Copyright (C) 2015 - 2016, 2019 3NSoft Inc.
+ Copyright (C) 2015 - 2016, 2019, 2025 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -62,11 +62,11 @@ function getRootCert(serviceURL) {
 }
 // TODO need to add caching of certs using domain->(kid->cert)
 //		(this will speed things up)
-function validator() {
-    return (rpDomain, sessionId, userId, assertion, userCert, provCert) => validate(rpDomain, sessionId, userId, assertion, userCert, provCert);
+function validator(ownMidService) {
+    return (rpDomain, sessionId, userId, assertion, userCert, provCert) => validate(rpDomain, sessionId, userId, assertion, userCert, provCert, ownMidService);
 }
 exports.validator = validator;
-async function validate(rpDomain, sessionId, userId, assertion, userCert, provCert) {
+async function validate(rpDomain, sessionId, userId, assertion, userCert, provCert, ownMidService) {
     const validAt = Date.now() / 1000;
     try {
         // check that certificate is for the user
@@ -83,7 +83,8 @@ async function validate(rpDomain, sessionId, userId, assertion, userCert, provCe
             return false;
         }
         // get root certificate and check the whole chain
-        const rootCert = await getRootCert(serviceURL);
+        const rootCert = ((ownMidService && (issuer === ownMidService.domain)) ?
+            ownMidService.getRoot() : await getRootCert(serviceURL));
         const assertInfo = mid.relyingParty.verifyAssertion(assertion, { user: userCert, prov: provCert, root: rootCert }, issuer, validAt);
         if ((assertInfo.relyingPartyDomain === rpDomain)
             && (assertInfo.sessionId === sessionId)) {

package/build/lib-server/routes/sessions/mid-auth.js

@@ -36,9 +36,9 @@ function midLogin(relyingPartyDomain, midAuthorizingFunc) {
         }
         const rb = req.body;
         const sessionId = req.session.id;
-        if (!(0, jwkeys_1.isLikeSignedMailerIdAssertion)(rb.assertion) ||
-            !(0, jwkeys_1.isLikeSignedKeyCert)(rb.userCert) ||
-            !(0, jwkeys_1.isLikeSignedKeyCert)(rb.provCert)) {
+        if (!(0, jwkeys_1.isLikeSignedMailerIdAssertion)(rb.assertion)
+            || !(0, jwkeys_1.isLikeSignedKeyCert)(rb.userCert)
+            || !(0, jwkeys_1.isLikeSignedKeyCert)(rb.provCert)) {
             res.sendStatus(login_1.ERR_SC.malformed);
             req.session.close();
             return;

package/build/mailerId/mailerId-app.d.ts

@@ -4,4 +4,8 @@
  */
 import * as express from 'express';
 import { ErrLogger } from '../lib-server/middleware/error-handler';
-export declare function makeMailerIdApp(rootFolder: string, domain: string, certFile: string, errLogger?: ErrLogger): express.Express;
+import { OwnMidService } from '../lib-server/resources/mailerid-authorizer';
+export declare function makeMailerIdApp(rootFolder: string, domain: string, certFile: string, errLogger?: ErrLogger): {
+    app: express.Express;
+    ownService: OwnMidService;
+};

package/build/mailerId/mailerId-app.js

@@ -1,6 +1,6 @@
 "use strict";
 /*
- Copyright (C) 2015 - 2016, 2020, 2024 3NSoft Inc.
+ Copyright (C) 2015 - 2016, 2020, 2024 - 2025 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -64,7 +64,13 @@ function makeMailerIdApp(rootFolder, domain, certFile, errLogger) {
         res.status(200).json(json); // content type application/json
     });
     app.use((0, error_handler_1.makeErrHandler)(errLogger));
-    return app;
+    return {
+        app,
+        ownService: {
+            domain,
+            getRoot: () => certifier.getRootCert()
+        }
+    };
 }
 exports.makeMailerIdApp = makeMailerIdApp;
 Object.freeze(exports);

package/build/main.js

@@ -17,15 +17,16 @@
  this program. If not, see <http://www.gnu.org/licenses/>.
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-const cli_1 = require("./config/cli");
+const cli_1 = require("./cli");
 const from_yaml_1 = require("./config/from-yaml");
 const letsencrypt_1 = require("./config/letsencrypt");
 const lib_1 = require("./lib");
 const signup_1 = require("./config/signup");
 const default_confs_1 = require("./config/default-confs");
+const file_1 = require("./lib-common/exceptions/file");
 async function run(conf) {
     if (!conf.servicesConnect) {
-        console.error(`No connection settings found in ??.`);
+        console.error(`❌ No connection settings found in configuration.`);
         process.exit(-1);
         return;
     }
@@ -41,7 +42,7 @@ async function run(conf) {
             return;
         }
         try {
-            console.log(`Stopping app ...`);
+            console.log(`🏁 Stopping app ...`);
             await app.stop();
             console.log(`app has stopped.`);
         }
@@ -55,11 +56,11 @@ async function run(conf) {
     }
     async function startAppWithTLS(sslOpts, port, hostname) {
         await app.start(sslOpts, port, hostname);
-        console.log(`Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} with TLS.`);
+        console.log(`🚀 Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} with TLS.`);
     }
     async function startAppWithoutTLS(port, hostname) {
         await app.start(undefined, port, hostname);
-        console.log(`Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} without TLS, and requiring TLS reverse proxy infront.`);
+        console.log(`🚀 Started 3NWeb server on port ${port},${hostname ? ` hostname ${hostname},` : ''} without TLS, and requiring TLS reverse proxy infront.`);
     }
     try {
         app = createApp(conf);
@@ -69,7 +70,7 @@ async function run(conf) {
             await startAppWithTLS(tls.sslOpts, port, hostname);
             if (!skipReloadOnCertsChange) {
                 tls.onCertsUpdate(async (newOpts, originalOpts) => {
-                    console.log(`Reloading server app server on TLS certificates change`);
+                    console.log(`🗘  Reloading server app server on TLS certificates change`);
                     try {
                         await stopProcess();
                         app = createApp(conf);
@@ -77,7 +78,7 @@ async function run(conf) {
                     }
                     catch (err) {
                         console.error(err);
-                        console.log(`Failed to reload with new TLS certs. Attempting to load with original ones.`);
+                        console.log(`⚠️  Failed to reload with new TLS certs. Attempting to load with original ones.`);
                         try {
                             await stopProcess();
                             app = createApp(conf);
@@ -118,7 +119,16 @@ function assembleConfig(configPath) {
         configPath = default_confs_1.DEFAULT_CONFIG_PATH;
         console.log(`Looking for configuration in default location: ${configPath}`);
     }
-    return (0, from_yaml_1.readYamlConfFile)(configPath);
+    try {
+        return (0, from_yaml_1.readYamlConfFile)(configPath);
+    }
+    catch (err) {
+        if (err.code === file_1.Code.notFound) {
+            console.error(`❌ Configuration file ${configPath} is not found.`);
+            process.exit(-2);
+        }
+        throw err;
+    }
 }
 async function displaySignupInfo(conf) {
     if (!conf.signup) {
@@ -223,12 +233,21 @@ else if (cmd.signupCmd) {
         }
     }
     else {
-        throw new Error(`CLI parser failed to capture invalid command`);
+        showUsage({
+            txtToDisplay: `❌ No recognized subcommand given to signup module`,
+            exitStatus: -1
+        });
     }
 }
+else if (cmd.showSampleConfig) {
+    showUsage(cmd.showSampleConfig);
+}
 else if (cmd.showUsage) {
     showUsage(cmd.showUsage);
 }
 else {
-    throw new Error(`CLI parser failed to trigger useful action`);
+    showUsage({
+        txtToDisplay: `❌ No recognized command given`,
+        exitStatus: -1
+    });
 }

package/build/services.js

@@ -1,6 +1,6 @@
 "use strict";
 /*
- Copyright (C) 2015 - 2017, 2020, 2024 3NSoft Inc.
+ Copyright (C) 2015 - 2017, 2020, 2024 - 2025 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -30,12 +30,17 @@ function servicesApp(conf, errLogger, logSetup) {
         throw new Error('Missing enabled-services sections in confs.');
     }
     const app = new app_1.AppWithWSs();
-    const midAuthorizer = (0, mailerid_authorizer_1.validator)(); // share, allowing for caching of certs
+    let midAuthorizer; // share, allowing for caching of certs
     if (conf.enabledServices.mailerId) {
-        app.http.use('/mailerid', (0, mailerId_app_1.makeMailerIdApp)(conf.rootFolder, conf.domain, conf.mailerId.certs, (errLogger === 'console') ? (0, error_handler_1.makeErrLoggerToConsole)('MailerId') : errLogger));
+        const { app: midApp, ownService } = (0, mailerId_app_1.makeMailerIdApp)(conf.rootFolder, conf.domain, conf.mailerId.certs, (errLogger === 'console') ? (0, error_handler_1.makeErrLoggerToConsole)('MailerId') : errLogger);
+        app.http.use('/mailerid', midApp);
         if (logSetup === 'console') {
             console.log(`Enabled MailerId service with provider domain ${conf.domain}`);
         }
+        midAuthorizer = (0, mailerid_authorizer_1.validator)(ownService);
+    }
+    else {
+        midAuthorizer = (0, mailerid_authorizer_1.validator)(undefined);
     }
     if (conf.enabledServices.asmail) {
         app.use('/asmail', (0, asmail_app_1.makeASMailApp)(conf.rootFolder, conf.domain, midAuthorizer, (errLogger === 'console') ? (0, error_handler_1.makeErrLoggerToConsole)('ASMail') : errLogger));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spec-3nweb-server",
-  "version": "1.7.12",
+  "version": "1.7.14",
   "description": "3NWeb spec server.",
   "main": "build/lib.js",
   "types": "build/lib.d.ts",