spec-3nweb-server 1.8.5 → 1.8.6

package/ts-code/signup/resources/users.ts

@@ -0,0 +1,429 @@
+/*
+ Copyright (C) 2015 - 2016, 2020 - 2021 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/*
+ * This module is provides administrative functionality, like adding new users,
+ * changing users quotas, etc.
+ */
+
+import * as fs from '../../lib-common/async-fs-node';
+import { writeFileSync, readdirSync } from 'fs';
+import * as jwk from '../../lib-common/jwkeys';
+import * as nacl from 'ecma-nacl';
+import { UserMidParams, UserStorageParams } from '../../lib-common/admin-api/signup';
+import * as asmailConf from '../../lib-common/service-api/asmail/config';
+import { join } from 'path';
+import { createFolderTreeSync, treeInRootFolder, treeInDefaultsFolder, DefaultsDataTree, addressToFName, treeInUserFolder, createFolderTree } from '../../lib-server/resources/server-data-folders';
+import { MultiDomainSignupCtx, SignupContext, addressesForName, canCreateUser, parseToken, areTokensSame } from '../signup-tokens';
+import { errWithCause } from '../../lib-common/exceptions/error';
+
+export const SC = {
+	USER_ALREADY_EXIST: 'user-already-exist',
+	CREATION_UNAUTHORIZED: 'creation-unauthorized'
+};
+Object.freeze(SC);
+
+const MID_KEY_USE = 'login-pub-key';
+
+function checkDefaultMidKeyParams(params: UserMidParams): boolean {
+	const ok = ('object' === typeof params.defaultPKey) &&
+		!!params.defaultPKey &&
+		jwk.isLikeJsonKey(params.defaultPKey.pkey) &&
+		(typeof params.defaultPKey.kdParams === 'object') &&
+		!!params.defaultPKey.kdParams;
+	if (!ok) { return false; }
+	try {
+		jwk.keyFromJson(params.defaultPKey.pkey, MID_KEY_USE,
+			nacl.box.JWK_ALG_NAME, nacl.box.KEY_LENGTH);
+		return true;
+	} catch (err) {
+		return false;
+	}
+}
+
+export function validateUserMidParams(params: UserMidParams): boolean {
+	const ok = ('object' === typeof params) && !!params &&
+		checkDefaultMidKeyParams(params) &&
+		Array.isArray(params.otherPKeys) &&
+		(params.otherPKeys.length > 0);
+	if (!ok) { return false; }
+	for (const pkey of params.otherPKeys) {
+		try {
+			jwk.keyFromJson(pkey, MID_KEY_USE,
+				nacl.box.JWK_ALG_NAME, nacl.box.KEY_LENGTH);
+		} catch (err) {
+			return false;
+		}
+		if (!pkey.kid) { return false; }
+	}
+	return true;
+}
+
+export function validateUserStorageParams(params: UserStorageParams): boolean {
+	return ((typeof params === 'object') && !!params &&
+			(typeof params.kdParams === 'object') && !!params.kdParams);
+}
+
+/**
+ * This returns a promise, resolvable to an array of domains, that are
+ * available for a given token. Array may be empty, when there are no
+ * such domains.
+ * @param signupToken
+ * @return a promise, resolvable to available addresses for a given name.
+ * If array is empty, there are no available addresses for a given name.
+ */
+export type IAvailableDomains = (
+	signupToken: string|undefined
+) => Promise<string[]>;
+
+/**
+ * This returns a promise, resolvable to an array of addresses, that are
+ * available for a given string. Array may be empty, when there are no
+ * such addresses.
+ * @param name is a name part of address, or not a domain part.
+ * @param signupToken
+ * @return a promise, resolvable to available addresses for a given name.
+ * If array is empty, there are no available addresses for a given name.
+ */
+export type IAvailableAddressesForName = (
+	name: string, signupToken: string|undefined
+) => Promise<string[]>;
+
+/**
+ * This creates a user, returning a promise, resolvable when a new account has
+ * been created for a given user id.
+ * @param userId is user's address. Notice that this is not a canonical form,
+ * but user-likable variant.
+ * @param midParams MailerId parameters to save
+ * @param storeParams storage parameters to save
+ * @param signupToken
+ * @return a promise, resolvable, when user is added, and all parameters are
+ * saved.
+ */
+export type IAdd = (
+	userId: string, midParams: UserMidParams, storeParams: any,
+	signupToken: string|undefined
+) => Promise<void>;
+
+export interface Factory {
+	getAvailableDomains: IAvailableDomains;
+	getAvailableAddresses: IAvailableAddressesForName;
+	add: IAdd;
+}
+
+async function writeJson(path: string, json: any): Promise<void> {
+	return fs.writeFile(path, JSON.stringify(json),
+		{ encoding: 'utf8', flag: 'w', mode: '660' });
+}
+
+function writeJsonSync(path: string, json: any): void {
+	writeFileSync(path, JSON.stringify(json),
+		{ encoding: 'utf8', flag: 'w', mode: '660' });
+}
+
+function setGeneralDefaults(defaults: DefaultsDataTree): void {
+	const infoFolder = defaults.info.path;
+	writeJsonSync(join(infoFolder, 'quota'), 100*1024*1024*1024);
+}
+
+function setStoreDefaults(store: DefaultsDataTree['store']): void {
+	const sp = store.params.path;
+	writeJsonSync(join(sp, 'key-deriv'), null);
+}
+
+function setMailDefaults(mail: DefaultsDataTree['mail']): void {
+	writeJsonSync(join(mail.params.path, 'pubkey'), null);
+	const anonFolder = mail.params.anonymous.path;
+	const anonPolicy: asmailConf.p.anonSenderPolicy.Policy = {
+		accept: true,
+		acceptWithInvitesOnly: false,
+		defaultMsgSize: 1024*1024
+	};
+	writeJsonSync(join(anonFolder, 'policy'), anonPolicy);
+	writeJsonSync(join(anonFolder, 'invites'), {});
+	const authFolder = mail.params.authenticated.path;
+	const authPolicy: asmailConf.p.authSenderPolicy.Policy = {
+		acceptWithInvitesOnly: false,
+		acceptFromWhiteListOnly: false,
+		applyBlackList: true,
+		defaultMsgSize: 1024*1024
+	}
+	writeJsonSync(join(authFolder, 'policy'), authPolicy);
+	writeJsonSync(join(authFolder, 'whitelist'), {});
+	writeJsonSync(join(authFolder, 'blacklist'), {});
+	writeJsonSync(join(authFolder, 'invites'), {});
+}
+
+
+class Users {
+
+	private readonly users: string;
+	private readonly defaults: string;
+	private readonly tokens: string;
+
+
+	constructor(
+		rootFolder: string,
+		private readonly noTokenFile?: string
+	) {
+		if (!fs.existsFolderSync(rootFolder)) { throw new Error(
+			`Given root folder does not exist: ${rootFolder}`); }
+		const folders = treeInRootFolder(rootFolder);
+		createFolderTreeSync(folders);
+		this.users = folders.users.path;
+		this.defaults = folders.defaults.path;
+		this.tokens = folders.tokens.path;
+		this.populateDefaultsIfEmpty();
+	}
+
+	private populateDefaultsIfEmpty(): void {
+		if (readdirSync(this.defaults).length > 0) { return; }
+		const defaults = treeInDefaultsFolder(this.defaults);
+		createFolderTreeSync(defaults);
+		setGeneralDefaults(defaults);
+		setMailDefaults(defaults.mail);
+		setStoreDefaults(defaults.store);
+	}
+
+	private userFolderPath(userId: string): string {
+		return join(this.users, addressToFName(userId));
+	}
+
+	async add(
+		userId: string, midParams: UserMidParams, storeKeyDerivParams: any,
+		signupToken: string|undefined
+	): Promise<void> {
+		if (!validateUserMidParams(midParams)) { throw new Error(
+			'Invalid MailerId parameters are given'); }
+		if (!storeKeyDerivParams) { throw new Error(
+			'Store key derivation parameters are not given'); }
+		const rmToken = await this.checkIfCreationAllowed(userId, signupToken);
+		const userFolder = this.userFolderPath(userId);
+		await fs.mkdir(userFolder).catch((err: fs.FileException) => {
+			if (err.alreadyExists) {
+				throw SC.USER_ALREADY_EXIST;
+			} else {
+				throw err;
+			}
+		});
+		try {
+			// make folder tree
+			const tree = treeInUserFolder(userFolder);
+			await createFolderTree(tree);
+			// record user id
+			await fs.writeFile(
+				join(tree.info.path, 'userid'),
+				userId, { encoding: 'utf8', flag: 'w', mode: '440' });
+			// copy defaults
+			await fs.copyTree(this.defaults, userFolder);
+			// record mid parameters
+			await writeJson(
+				join(tree.info.path, 'mid-params'),
+				midParams);
+			// record storage params
+			await writeJson(
+				join(tree.store.params.path, 'key-deriv'),
+				storeKeyDerivParams);
+			if (rmToken) {
+				await rmToken();
+			}
+		} catch (e) {
+			await fs.rmDirWithContent(userFolder).catch(err => {});
+			throw e;
+		}
+	}
+
+	private async checkIfCreationAllowed(
+		userId: string, signupToken: string|undefined
+	): Promise<(() => Promise<void>)|undefined> {
+		if (signupToken) {
+			const t = parseToken(signupToken);
+			if (!t) { throw SC.CREATION_UNAUTHORIZED; }
+			const ctxFilePath = join(this.tokens, t.tokenFile);
+			const str = await fs.readFile(ctxFilePath, { encoding: 'utf8' })
+			.catch((exc: fs.FileException) => {
+				throw (exc.notFound ? SC.CREATION_UNAUTHORIZED : exc);
+			});
+			try {
+				const ctx = JSON.parse(str) as SignupContext;
+				if (ctx.token && !areTokensSame(t.tokenBytes, ctx.token)) {
+					throw SC.CREATION_UNAUTHORIZED;
+				}
+				if (canCreateUser(userId, ctx)) {
+					if (ctx.type === 'single-user') {
+						return () => fs.unlink(ctxFilePath).catch(noop);
+					} else {
+						return;
+					}
+				}
+			} catch (err) {
+				throw errWithCause(err, `Error occured in using file ${
+					ctxFilePath} as a signup context.`);
+			}
+		} else if (this.noTokenFile) {
+			try {
+				const str = await fs.readFile(
+					this.noTokenFile, { encoding: 'utf8' });
+				const ctx = JSON.parse(str) as MultiDomainSignupCtx;
+				if (canCreateUser(userId, ctx)) { return; }
+			} catch (exc) {
+				if (!(exc as fs.FileException).notFound) {
+					throw errWithCause(exc, `Error occured in using file ${
+						this.noTokenFile} as a no-token signup context.`);
+				}
+			}
+		}
+		throw SC.CREATION_UNAUTHORIZED;
+	}
+
+	async getAvailableDomains(signupToken: string|undefined): Promise<string[]> {
+		if (signupToken) {
+			const t = parseToken(signupToken);
+			if (!t) { return []; }
+			const ctxFilePath = join(this.tokens, t.tokenFile);
+			const str = await fs.readFile(ctxFilePath, { encoding: 'utf8' })
+			.catch((exc: fs.FileException) => {
+				if (exc.notFound) { return; }
+				else { throw exc; }
+			});
+			if (!str) {
+				return [];
+			}
+			try {
+				const ctx = JSON.parse(str) as SignupContext;
+				if ((ctx.type === 'single-user')
+				|| (ctx.token && !areTokensSame(t.tokenBytes, ctx.token))) {
+					return [];
+				} else {
+					return ctx.domains;
+				}
+			} catch (err) {
+				throw errWithCause(err, `Error occured in using file ${
+					ctxFilePath} as a signup context.`);
+			}
+		} else if (this.noTokenFile) {
+			try {
+				const str = await fs.readFile(
+					this.noTokenFile, { encoding: 'utf8' });
+				const ctx = JSON.parse(str) as MultiDomainSignupCtx;
+				return ctx.domains;
+			} catch (exc) {
+				if ((exc as fs.FileException).notFound) {
+					return [];
+				} else {
+					throw errWithCause(exc, `Error occured in using file ${
+						this.noTokenFile} as a no-token signup context.`);
+				}
+			}
+		} else {
+			return [];
+		}
+	}
+
+	async getAvailableAddresses(
+		name: string, signupToken: string|undefined
+	): Promise<string[]> {
+		if (signupToken) {
+			const t = parseToken(signupToken);
+			if (!t) { return []; }
+			const ctxFilePath = join(this.tokens, t.tokenFile);
+			const str = await fs.readFile(ctxFilePath, { encoding: 'utf8' })
+			.catch((exc: fs.FileException) => {
+				if (exc.notFound) { return; }
+				else { throw exc; }
+			});
+			if (!str) {
+				return [];
+			}
+			try {
+				const ctx = JSON.parse(str) as SignupContext;
+				if (ctx.token && !areTokensSame(t.tokenBytes, ctx.token)) {
+					return [];
+				}
+				return this.availableAddressInCtx(name, ctx);
+			} catch (err) {
+				throw errWithCause(err, `Error occured in using file ${
+					ctxFilePath} as a signup context.`);
+			}
+		} else if (this.noTokenFile) {
+			try {
+				const str = await fs.readFile(
+					this.noTokenFile, { encoding: 'utf8' });
+				const ctx = JSON.parse(str) as MultiDomainSignupCtx;
+				return this.availableAddressInCtx(name, ctx);
+			} catch (exc) {
+				if ((exc as fs.FileException).notFound) {
+					return [];
+				} else {
+					throw errWithCause(exc, `Error occured in using file ${
+						this.noTokenFile} as a no-token signup context.`);
+				}
+			}
+		} else {
+			return [];
+		}
+	}
+
+	private async availableAddressInCtx(
+		name: string, ctx: SignupContext
+	): Promise<string[]> {
+		const allIds = addressesForName(name, ctx);
+		if (!allIds) {
+			return [];
+		}
+		const availableIds: string[] = [];
+		for (const userId of allIds) {
+			const userExist = await this.isUserPresent(userId);
+			if (!userExist) {
+				availableIds.push(userId);
+			}
+		}
+		return availableIds;
+	}
+
+	private async isUserPresent(id: string): Promise<boolean> {
+		const userFolder = this.userFolderPath(id);
+		try {
+			const stats = await fs.stat(userFolder);
+			return stats.isDirectory();
+		} catch (err) {
+			if ((err as fs.FileException).notFound) { return false; }
+			else { throw err; }
+		}
+	}
+
+	wrap(): Factory {
+		const wrap: Factory = {
+			getAvailableDomains: this.getAvailableDomains.bind(this),
+			getAvailableAddresses: this.getAvailableAddresses.bind(this),
+			add: this.add.bind(this),
+		};
+		Object.freeze(wrap);
+		return wrap;
+	}
+
+}
+
+function noop() {}
+
+export function makeFactory(
+	rootFolder: string, noTokenFile: string|undefined
+): Factory {
+	return (new Users(rootFolder, noTokenFile)).wrap();
+}
+
+Object.freeze(exports);

package/ts-code/signup/routes/add.ts

@@ -0,0 +1,65 @@
+/*
+ Copyright (C) 2015 - 2016, 2020, 2026 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { RequestHandler } from 'express';
+import { addUser as api, ERR_SC } from '../../lib-common/admin-api/signup';
+import { IAdd, SC as userSC, validateUserMidParams, validateUserStorageParams } from '../resources/users';
+import { checkAndTransformAddress } from '../../lib-common/canonical-address';
+
+export function addUser(addUserFunc: IAdd): RequestHandler {
+
+	return async function(req, res, next) {
+
+		const {
+			mailerId, storage, userId, signupToken
+		} = req.body as api.Request;
+
+		if (('string' !== typeof userId)
+		|| !checkAndTransformAddress(userId)) {
+			res.status(ERR_SC.malformed).send('Given user id is malformed.');
+			return;
+		}
+		if (!validateUserMidParams(mailerId)) {
+			res.status(ERR_SC.malformed).send('MailerId parameters are malformed.');
+			return;
+		}
+		if (!validateUserStorageParams(storage)) {
+			res.status(ERR_SC.malformed).send('Storage parameters are malformed.');
+			return;
+		}
+		if ((signupToken !== undefined) && (typeof signupToken !== 'string')) {
+			res.status(ERR_SC.malformed).send('signupToken is invalid.');
+			return;
+		}
+
+		try {
+			await addUserFunc(userId, mailerId, storage.kdParams, signupToken);
+			res.status(api.SC.ok).send();
+		} catch (err) {
+			if (err === userSC.USER_ALREADY_EXIST) {
+				res.status(api.SC.userAlreadyExists).send();
+			} else if (err === userSC.CREATION_UNAUTHORIZED) {
+				res.status(api.SC.unauthorized).send();
+			} else {
+				next(err);
+			}
+		}
+
+	};
+}
+
+Object.freeze(exports);

package/ts-code/signup/routes/get-available-addresses.ts

@@ -0,0 +1,49 @@
+/*
+ Copyright (C) 2015 - 2016, 2020 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { RequestHandler } from 'express';
+import { availableAddressesForName as api, ERR_SC } from '../../lib-common/admin-api/signup';
+import { IAvailableAddressesForName } from '../resources/users';
+
+export function availableAddresses(
+	availableAddressesFunc: IAvailableAddressesForName
+): RequestHandler {
+
+	return async function (req, res, next) {
+
+		const { name, signupToken } = req.body as api.Request;
+
+		if ((typeof name !== 'string') || (name.indexOf('@') >= 0)) {
+			res.status(ERR_SC.malformed).send('name is missing or invalid.');
+			return;
+		}
+		if ((signupToken !== undefined) && (typeof signupToken !== 'string')) {
+			res.status(ERR_SC.malformed).send('signupToken is invalid.');
+			return;
+		}
+
+		try {
+			const addresses = await availableAddressesFunc(name, signupToken);
+			res.status(api.SC.ok).json(addresses);
+		} catch (err) {
+			next(err);
+		}
+
+	};
+}
+
+Object.freeze(exports);

package/ts-code/signup/routes/get-available-domains.ts

@@ -0,0 +1,45 @@
+/*
+ Copyright (C) 2021 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { RequestHandler } from 'express';
+import { availableDomains as api, ERR_SC } from '../../lib-common/admin-api/signup';
+import { IAvailableDomains } from '../resources/users';
+
+export function availableDomains(
+	availableDomainsFunc: IAvailableDomains
+): RequestHandler {
+
+	return async function (req, res, next) {
+
+		const { signupToken } = req.body as api.Request;
+
+		if ((signupToken !== undefined) && (typeof signupToken !== 'string')) {
+			res.status(ERR_SC.malformed).send('signupToken is invalid.');
+			return;
+		}
+
+		try {
+			const addresses = await availableDomainsFunc(signupToken);
+			res.status(api.SC.ok).json(addresses);
+		} catch (err) {
+			next(err);
+		}
+
+	};
+}
+
+Object.freeze(exports);

package/ts-code/signup/signup-app.ts

@@ -0,0 +1,54 @@
+/*
+ Copyright (C) 2015 - 2016, 2020 - 2021, 2024 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import * as express from 'express';
+import { json as parseJSON } from '../lib-server/middleware/body-parsers';
+import { ErrLogger, makeErrHandler } from '../lib-server/middleware/error-handler';
+import { makeFactory as makeUserFactory } from './resources/users';
+import { addUser } from './routes/add';
+import { availableAddresses } from './routes/get-available-addresses';
+import { availableDomains } from './routes/get-available-domains';
+import * as signupApi from '../lib-common/admin-api/signup';
+import { Configurations } from '../services';
+
+
+export function makeSignupApp(
+	conf: Configurations, errLogger?: ErrLogger
+): express.Express {
+	const app = express();
+	app.disable('etag');
+
+	const noTokenFile = (conf.signup ? conf.signup.noTokenFile : undefined);
+	const users = makeUserFactory(conf.rootFolder, noTokenFile);
+
+	app.post('/'+signupApi.availableDomains.URL_END,
+		parseJSON('1kb'),
+		availableDomains(users.getAvailableDomains));
+	app.post('/'+signupApi.availableAddressesForName.URL_END,
+		parseJSON('1kb'),
+		availableAddresses(users.getAvailableAddresses));
+	app.post('/'+signupApi.addUser.URL_END,
+		parseJSON('4kb'),
+		addUser(users.add));
+
+	app.use(makeErrHandler(errLogger));
+	
+	return app;
+}
+
+
+Object.freeze(exports);