spec-3nweb-server 1.8.5 → 1.8.7

package/ts-code/lib-server/resources/mem-backed-sessions-factory.ts

@@ -0,0 +1,132 @@
+/*
+ Copyright (C) 2015 - 2017, 2021 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * This module constructs memory-backed sessions factories.
+ */
+
+import { Factory, Session, BaseSessionFactory, wrapFactory } from './sessions';
+import { bytes as randomBytes } from '../../lib-common/random-node';
+import { base64urlSafe } from '../../lib-common/buffer-utils';
+import { compareVectors } from 'ecma-nacl';
+
+const ID_BYTES_LEN = 30;
+const ID_STR_CHUNK_LEN = 15;
+
+
+export class InMemorySessions<T> extends BaseSessionFactory<T> {
+
+	private sessions = new Map<string, [Uint8Array, Session<T>]>();
+	private timeoutCodeIntervalId: NodeJS.Timer|undefined = undefined;
+	private timeoutMillis: number;
+
+	private checkSessionsForTimeout = () => {
+		const now = Date.now();
+		for (const [, s] of this.sessions.values()) {
+			if ((now - s.lastAccessedAt) >= this.timeoutMillis) { s.close(); }
+		}
+	};
+
+	private makeDefaultSessionParams: (sessionId: string) => T;
+
+	protected constructor(
+		timeoutSecs: number, makeSessionParams: (sessionId: string) => T
+	) {
+		super();
+		if ((typeof timeoutSecs !== 'number') || (timeoutSecs <= 0)) {
+			throw new Error("Given timeout must be a number greater than zero."); }
+		this.timeoutMillis = timeoutSecs*1000;
+		if (typeof makeSessionParams !== 'function') { throw new TypeError(
+			`Given argument 'makeSessionParams' is not a function.`) }
+		this.makeDefaultSessionParams = makeSessionParams;
+	}
+
+	async generate(): Promise<Session<T>> {
+		let newSessionId: string;
+		do {
+			newSessionId = base64urlSafe.pack(await randomBytes(ID_BYTES_LEN));
+		} while (this.sessions.has(strChunk(newSessionId)));
+		const params = this.makeDefaultSessionParams(newSessionId);
+		const session = this.makeSession(newSessionId, params);
+		return session;
+	}
+
+	protected async add(s: Session<T>): Promise<void> {
+		const { key, idBytes } = idToChunks(s.id);
+		this.sessions.set(key, [idBytes, s]);
+		if (this.sessions.size === 1) {
+			this.timeoutCodeIntervalId = setInterval(
+				this.checkSessionsForTimeout, this.timeoutMillis/2);
+		}
+	}
+
+	protected async remove(s: Session<T>): Promise<void> {
+		if (this.sessions.delete(strChunk(s.id))) {
+			if (this.sessions.size === 0) {
+				clearInterval(this.timeoutCodeIntervalId!);
+				this.timeoutCodeIntervalId = undefined;
+			}
+		}
+	}
+
+	protected async get(sId: string): Promise<Session<T>|undefined> {
+		const idAndSession = this.sessions.get(strChunk(sId));
+		return ((idAndSession && sameIdBytes(sId, idAndSession[0])) ?
+			idAndSession[1] : undefined);
+	}
+
+	/**
+	 * This returns factory, that works properly in a single process application,
+	 * clearing up sessions that past given timeout.
+	 * @param timeout is a session timeout in seconds
+	 * @param makeDefaultSessionParams is a function that creates session
+	 * parameters object in some initial/default state
+	 */
+	static factory<T>(
+		timeout: number, makeDefaultSessionParams: () => T
+	): Factory<T> {
+		const factory = new InMemorySessions(timeout, makeDefaultSessionParams);
+		Object.seal(factory);
+		return Object.freeze(wrapFactory(factory));
+	}
+
+}
+Object.freeze(InMemorySessions.prototype);
+Object.freeze(InMemorySessions);
+
+
+function sameIdBytes(idStr: string, idBytes: Uint8Array): boolean {
+	try {
+		const bytes = base64urlSafe.open(idStr);
+		return compareVectors(bytes, idBytes);
+	} catch (err) {
+		return false;
+	}
+}
+
+function idToChunks(sessionId: string): { key: string; idBytes: Uint8Array; } {
+	const idBytes = base64urlSafe.open(sessionId);
+	const key = sessionId.substring(0, ID_STR_CHUNK_LEN);
+	return { key, idBytes };
+}
+
+function strChunk(sessionId: string): string {
+	return sessionId.substring(0, ID_STR_CHUNK_LEN);
+}
+
+
+Object.freeze(exports);

package/ts-code/lib-server/resources/server-data-folders.ts

@@ -0,0 +1,160 @@
+/*
+ Copyright (C) 2020 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { base64urlSafe, utf8 } from '../../lib-common/buffer-utils';
+import { toCanonicalAddress } from '../../lib-common/canonical-address';
+import { join } from 'path';
+import { promises as fsPromises, mkdirSync } from 'fs';
+
+export function addressToFName(address: string): string {
+	return idStringToFName(toCanonicalAddress(address));
+}
+
+function idStringToFName(id: string): string {
+	return base64urlSafe.pack(utf8.pack(id));
+}
+
+export interface FolderDef {
+	path: string;
+}
+
+export interface RootDataTree {
+	tokens: FolderDef;
+	users: FolderDef;
+	defaults: FolderDef;
+}
+
+export interface DefaultsDataTree {
+	info: FolderDef;
+	store: FolderDef & {
+		params: FolderDef;
+	};
+	mail: FolderDef & {
+		params: FolderDef & {
+			anonymous: FolderDef;
+			authenticated: FolderDef;
+		};
+	};
+}
+
+export interface UserDataTree {
+	mail: FolderDef & {
+		messages: FolderDef;
+		delivery: FolderDef;
+		params: FolderDef;
+	};
+	store: FolderDef & {
+		objects: FolderDef;
+		transactions: FolderDef;
+		root: FolderDef;
+		params: FolderDef;
+	};
+	info: FolderDef;
+}
+
+export function treeInRootFolder(rootFolder: string): RootDataTree {
+	const defaults = join(rootFolder, 'defaults');
+	return {
+		users: { path: join(rootFolder, 'users') },
+		defaults: {
+			path: defaults,
+		},
+		tokens: { path: tokensInRootFolder(rootFolder) }
+	};
+}
+
+export function tokensInRootFolder(rootFolder: string): string {
+	return join(rootFolder, 'tokens');
+}
+
+export function userDataInRootFolder(root: string, userId: string): string {
+	return join(root, 'users', addressToFName(userId));
+}
+
+// XXX use this instead of userDataInRootFolder for locker storage
+export function lockerDataInRootFolder(root: string, lockerId: string): string {
+	return join(root, 'lockers', idStringToFName(lockerId));
+}
+
+export function treeInDefaultsFolder(defaults: string): DefaultsDataTree {
+	const mail = join(defaults, 'mail');
+	const mailParams = join(mail, 'params');
+	const store = join(defaults, 'store');
+	return {
+		info: { path: join(defaults, 'info') },
+		mail: {
+			path: mail,
+			params: {
+				path: mailParams,
+				anonymous: { path: join(mailParams, 'anonymous') },
+				authenticated: { path: join(mailParams, 'authenticated') }
+			}
+		},
+		store: {
+			path: store,
+			params: { path: join(store, 'params') }
+		}
+	};
+}
+
+export function treeInUserFolder(userFoder: string): UserDataTree {
+	const mail = join(userFoder, 'mail');
+	const store = join(userFoder, 'store');
+	return {
+		info: { path: join(userFoder, 'info') },
+		mail: {
+			path: mail,
+			delivery: { path: join(mail, 'delivery') },
+			messages: { path: join(mail, 'messages') },
+			params: { path: join(mail, 'params') }
+		},
+		store: {
+			path: store,
+			params: { path: join(store, 'params') },
+			root: { path: join(store, 'root') },
+			objects: { path: join(store, 'objects') },
+			transactions: { path: join(store, 'transactions') }
+		}
+	};
+}
+
+export async function createFolderTree(
+	structure: RootDataTree|UserDataTree|DefaultsDataTree|FolderDef
+): Promise<void> {
+	for (const [ key, def ] of Object.entries(structure)) {
+		if (key === 'path') {
+			await fsPromises.mkdir(def, { recursive: true });
+		} else {
+			await createFolderTree(def);
+		}
+	}
+}
+
+export function createFolderTreeSync(
+	structure: RootDataTree|UserDataTree|DefaultsDataTree|string
+): void {
+	for (const [ key, def ] of Object.entries(structure)) {
+		if (key === 'path') {
+			mkdirSync(def, { recursive: true });
+		} else {
+			createFolderTreeSync(def);
+		}
+	}
+}
+
+
+Object.freeze(exports);

package/ts-code/lib-server/resources/server-key-for-pkl-challenge.ts

@@ -0,0 +1,41 @@
+/*
+ Copyright (C) 2015 - 2016 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * This module is a test-grade function to calculate DH-shared keys for login.
+ */
+
+import { box } from 'ecma-nacl';
+import * as random from '../../lib-common/random-node';
+
+// XXX update the key from time-to-time, and this must be single instance
+
+const skeyForPKLChallenge = random.bytesSync(32);
+
+const pkeyForPKLChallenge = box.generate_pubkey(skeyForPKLChallenge);
+
+export function calcNaClBoxSharedKey(userPubKey: Uint8Array): {
+	dhsharedKey: Uint8Array; serverPubKey: Uint8Array;
+} {
+	const dhsharedKey = box.calc_dhshared_key(userPubKey, skeyForPKLChallenge);
+	return {
+		dhsharedKey: dhsharedKey,
+		serverPubKey: pkeyForPKLChallenge
+	};
+}
+
+Object.freeze(exports);

package/ts-code/lib-server/resources/sessions.ts

@@ -0,0 +1,232 @@
+/*
+ Copyright (C) 2015 - 2017 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import * as express from 'express';
+import * as http from 'http';
+
+// Constant custom header
+export const SESSION_ID_HEADER = "X-Session-Id";
+const LOW_CASED_SESSION_ID_HEADER = SESSION_ID_HEADER.toLowerCase();
+
+export interface SessionParams {
+	userId: string;
+}
+
+export interface Session<T> {
+	params: T;
+	isAuthorized: boolean;
+	id: string;
+	lastAccessedAt: number;
+	addCleanUp(func: { (): void; }): void;
+	putIdIntoResponse(res: express.Response): void;
+	close(): void;
+}
+
+export interface Request<T> extends express.Request {
+	session: Session<T>;
+}
+
+export interface BaseRequest<T> extends http.IncomingMessage {
+	session: Session<T>;
+}
+
+export type CheckSession<T> = (req: BaseRequest<T>) => Promise<boolean>;
+
+export type GenerateSession<T> = () => Promise<Session<T>>;
+
+export interface Factory<T> {
+	generate: GenerateSession<T>;
+	ensureAuthorizedSession(): express.RequestHandler;
+	ensureOpenedSession(): express.RequestHandler;
+	checkSession(): express.RequestHandler;
+	ensureAuthorizedSessionForSocketStart(): CheckSession<T>;
+}
+
+export abstract class BaseSessionFactory<T> implements Factory<T> {
+	
+	abstract generate(): Promise<Session<T>>;
+
+	protected abstract get(sId: string): Promise<Session<T>|undefined>;
+
+	protected abstract add(s: Session<any>): Promise<void>;
+
+	protected abstract remove(s: Session<T>): Promise<void>;
+
+	protected async makeSession(id: string, params: T): Promise<Session<T>> {
+		const cleanUpFuncs: ({ (): void; }|undefined)[] = [];
+		const session: Session<T> = {
+			params,
+			isAuthorized: false,
+			id: id,
+			lastAccessedAt: Date.now(),
+			addCleanUp: (func: { (): void; }): void => {
+				if ('function' !== typeof func) { throw new Error(
+						"Given argument func must be function."); } 
+				cleanUpFuncs.push(func);
+			},
+			close: (): void => {
+				this.remove(session);
+				for (let i=0; i<cleanUpFuncs.length; i+=1) {
+					const func = cleanUpFuncs[i];
+					cleanUpFuncs[i] = undefined;
+					try {
+						if (typeof func === 'function') { func(); }
+					} catch (err) {
+						// where to log error(s)?
+					}
+				}
+			},
+			putIdIntoResponse: (res: express.Response): void => {
+				const header = {};
+				header[SESSION_ID_HEADER] = session.id;
+				res.set(header);
+			}
+		};
+		Object.seal(session);
+		await this.add(session);
+		return session;
+	}
+
+	/**
+	 * This returns middleware function, that adds to request object a 'session'
+	 * field with existing valid session object, or, if no session found, and
+	 * it is configured so, responds with 401.
+	 * @param factory to which resulting middleware is bound.
+	 * @param send401WhenMissingSession is a flag, which, when true, makes
+	 * middleware function to send 401 reply, when valid session object cannot
+	 * be found.
+	 * @param sessionMustBeAuthorized is a flag, which, when true,, makes
+	 * middleware function to send 401 reply, when session needs to go through
+	 * sender authorization step.
+	 */
+	private makeSessionMiddleware(
+		send401WhenMissingSession: boolean,
+		sessionMustBeAuthorized: boolean
+	): express.RequestHandler {
+		return async (
+			req: Request<T>, res: express.Response, next: express.NextFunction
+		) => {
+			if ('OPTIONS' == req.method) {
+				next();
+				return;
+			}
+			
+			// get session id header
+			const sessionId = req.get(SESSION_ID_HEADER);
+			if (typeof sessionId !== 'string') {
+				if (send401WhenMissingSession) {
+					res.status(401).send("Required to start new session.");
+				} else {
+					next();
+				}
+				return;
+			}
+			
+			// get session, and attach it to request
+			const session = await this.get(sessionId);
+			if (session) {
+				req.session = session;
+				session.lastAccessedAt = Date.now();
+			}
+
+			// send error status or continue, depending on session and flags
+			if (send401WhenMissingSession) {
+				if (!req.session) {
+					res.status(401).send("Required to start new session.");
+				} else if (sessionMustBeAuthorized &&
+						!req.session.isAuthorized) {
+					res.status(401).send(
+							"Required to complete authorization step.");
+				} else {
+					next();
+				}
+			} else {
+				next();
+			}
+		};
+	}
+	
+	/**
+	 * This returns middleware function, that adds to request object a 'session'
+	 * field with existing valid session object, or, if no session found, or if
+	 * it is not yet set as authorized, responds with 401.
+	 */
+	ensureAuthorizedSession(): express.RequestHandler {
+		return this.makeSessionMiddleware(true, true);
+	}
+	
+	/**
+	 * This returns middleware function, that adds to request object a 'session'
+	 * field with existing valid session object, even if session is not yet
+	 * authorized. If there is no session found, middleware responds with 401.
+	 */
+	ensureOpenedSession(): express.RequestHandler {
+		return this.makeSessionMiddleware(true, false);
+	}
+	
+	/**
+	 * This returns middleware function, that adds to request object a 'session'
+	 * field with existing valid session object, or creates a new not authorized,
+	 * yet, session.
+	 */
+	checkSession(): express.RequestHandler {
+		return this.makeSessionMiddleware(false, false);
+	}
+
+	/**
+	 * This returns a function that checks for an authorized session, attaching
+	 * it to request object, and resolving returned promise to true. Else, if
+	 * there is no session found, or if a session is not yet set as authorized,
+	 * returned promise resolves to false.
+	 * This function should be used for verification of incoming web-socket
+	 * connection requests.
+	 */
+	ensureAuthorizedSessionForSocketStart(): CheckSession<T> {
+		return async (req: BaseRequest<T>): Promise<boolean> => {
+			// get session id header
+			const sessionId = req.headers[LOW_CASED_SESSION_ID_HEADER];
+			if (typeof sessionId !== 'string') { return false; }
+			
+			// get session, and check it
+			const session = await this.get(sessionId);
+			if (!session) { return false; }
+			if (!session.isAuthorized) { return false; }
+			
+			// attach session to request
+			req.session = session;
+			session.lastAccessedAt = Date.now();
+			return true;
+		};
+	}
+	
+}
+Object.freeze(BaseSessionFactory.prototype);
+Object.freeze(BaseSessionFactory);
+
+export function wrapFactory<T>(impl: Factory<T>): Factory<T> {
+	const wrap: Factory<T> = {
+		checkSession: impl.checkSession.bind(impl),
+		ensureAuthorizedSession: impl.ensureAuthorizedSession.bind(impl),
+		ensureOpenedSession: impl.ensureOpenedSession.bind(impl),
+		ensureAuthorizedSessionForSocketStart:
+			impl.ensureAuthorizedSessionForSocketStart.bind(impl),
+		generate: impl.generate.bind(impl)
+	};
+	return wrap;
+}
+
+Object.freeze(exports);

package/ts-code/lib-server/resources/user-files.ts

@@ -0,0 +1,147 @@
+/*
+ Copyright (C) 2015 - 2017, 2020 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import * as fs from '../../lib-common/async-fs-node';
+import { FileException, Code as excCode } from '../../lib-common/exceptions/file';
+import { stringToNumOfBytes } from '../conf-util';
+import { toCanonicalAddress } from '../../lib-common/canonical-address';
+import { base64urlSafe, utf8 } from '../../lib-common/buffer-utils';
+import { defer } from '../../lib-common/processes';
+import { join } from 'path';
+
+const DEFAULT_FILE_WRITE_BUFFER_SIZE = 4*1024;
+const DEFAULT_FILE_READ_BUFFER_SIZE = 64*1024;
+
+export const SC = {
+	USER_UNKNOWN: 'user-unknown',
+};
+Object.freeze(SC);
+
+async function readJsonFile<T>(path): Promise<T> {
+	const buf = await fs.readFile(path);
+	return <T> JSON.parse(buf.toString('utf8'));
+}
+
+export function addressToFName(address: string): string {
+	return base64urlSafe.pack(utf8.pack(toCanonicalAddress(address)));
+}
+
+
+export abstract class UserFiles<ParamTypes extends object> {
+	
+	protected readonly fileWritingBufferSize: number;
+	protected readonly fileReadingBufferSize: number;
+
+	constructor(
+		public readonly userId: string,
+		public readonly path: string,
+		writeBufferSize?: string|number, readBufferSize?: string|number
+	) {
+		this.fileWritingBufferSize = (writeBufferSize ?
+			stringToNumOfBytes(writeBufferSize) :
+			DEFAULT_FILE_WRITE_BUFFER_SIZE
+		);
+		this.fileReadingBufferSize = (readBufferSize ?
+			stringToNumOfBytes(readBufferSize) :
+			DEFAULT_FILE_READ_BUFFER_SIZE
+		);
+	}
+
+	async ensureUserExistsOnDisk(): Promise<void> {
+		try {
+			const stats = await fs.stat(this.path);
+			if (!stats.isDirectory()) {
+				throw new Error(
+					`Path for users' folder is not a folder: ${this.path}`
+				);
+			}
+		} catch (err) {
+			if ((err as FileException).code === excCode.notFound) {
+				throw SC.USER_UNKNOWN;
+			}
+			throw err;
+		}
+	}
+
+	private commonInfoFolder(): string {
+		return join(this.path, '..', 'info');
+	}
+
+	getSpaceQuota(): Promise<number> {
+		return readJsonFile<number>(join(this.commonInfoFolder(), 'quota'));
+	}
+
+	getParam<P extends keyof ParamTypes>(
+		paramFileName: P
+	): Promise<ParamTypes[P]> {
+		const filePath = join(this.path, 'params', paramFileName as string);
+		return readJsonFile<ParamTypes[P]>(filePath);
+	}
+
+	protected setParam<P extends keyof ParamTypes>(
+		paramFileName: P, param: ParamTypes[P]
+	): Promise<void> {
+		const filePath = join(this.path, 'params', paramFileName as string);
+		return fs.writeFile(
+			filePath, JSON.stringify(param), { encoding: 'utf8', flag: 'w' }
+		);
+	}
+
+}
+Object.freeze(UserFiles.prototype);
+Object.freeze(UserFiles);
+
+
+export type ObjPipe = (outStream: NodeJS.WritableStream) => Promise<void>;
+
+export interface ObjReader {
+	len: number;
+	
+	/**
+	 * This is a pipe function that reads bytes directly from file.
+	 */
+	pipe?: ObjPipe;
+
+	/**
+	 * This is header length. It is present only if header is included in piped
+	 * bytes.
+	 */
+	headerLen?: number;
+	
+	/**
+	 * This is a total segments' length of this object version.
+	 */
+	segsLen: number;
+
+}
+
+export async function pipeBytes(src: NodeJS.ReadableStream,
+		sink: NodeJS.WritableStream): Promise<void> {
+	const deferred = defer<void>();
+	src.pipe(sink, { end: false });
+	src.on('error', (err) => {
+		deferred.reject(err);
+		src.unpipe(sink);
+	});
+	src.on('end', () => {
+		src.unpipe(sink);
+		deferred.resolve();
+	});
+	return deferred.promise;
+}
+
+Object.freeze(exports);