tabminal 3.0.27 → 3.0.28

package/src/auth.mjs

@@ -1,88 +1,522 @@
+import crypto from 'node:crypto';
+
 import { config } from './config.mjs';
+import {
+    loadAuthSessions,
+    saveAuthSessions
+} from './persistence.mjs';
+
+const MAX_ATTEMPTS = 30;
+const ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;
+const REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+const ACCESS_TOKEN_REPLAY_LEEWAY_MS = 30 * 1000;
 
 let failedAttempts = 0;
 let isLocked = false;
-const MAX_ATTEMPTS = 30;
+let authStoreInitialized = false;
+let authStoreInitPromise = null;
+const refreshSessions = new Map();
+const accessTokens = new Map();
+
+function nowTimestamp() {
+    return Date.now();
+}
+
+function nowIso() {
+    return new Date().toISOString();
+}
+
+function sha256(input) {
+    return crypto.createHash('sha256').update(input).digest('hex');
+}
+
+function safeEqualHex(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(
+        Buffer.from(left, 'hex'),
+        Buffer.from(right, 'hex')
+    );
+}
+
+function getPasswordFingerprint() {
+    return sha256(`tabminal-auth-password:${config.passwordHash}`);
+}
+
+function generateOpaqueToken(prefix) {
+    return `${prefix}_${crypto.randomBytes(32).toString('base64url')}`;
+}
+
+function normalizeAuthHeader(value) {
+    const raw = typeof value === 'string' ? value.trim() : '';
+    if (!raw) {
+        return '';
+    }
+    if (/^bearer\s+/i.test(raw)) {
+        return raw.replace(/^bearer\s+/i, '').trim();
+    }
+    return raw;
+}
+
+function normalizeUserAgent(value) {
+    const raw = typeof value === 'string' ? value.trim() : '';
+    return raw.length > 500 ? raw.slice(0, 500) : raw;
+}
+
+function isIsoExpired(value, now = nowTimestamp()) {
+    if (!value) {
+        return true;
+    }
+    const timestamp = Date.parse(value);
+    if (!Number.isFinite(timestamp)) {
+        return true;
+    }
+    return timestamp <= now;
+}
+
+function toIsoOffset(baseMs, deltaMs) {
+    return new Date(baseMs + deltaMs).toISOString();
+}
+
+function serializeRefreshSessions() {
+    return Array.from(refreshSessions.values())
+        .sort((left, right) => {
+            return String(left.createdAt || '').localeCompare(
+                String(right.createdAt || '')
+            );
+        });
+}
+
+async function persistRefreshSessions() {
+    await saveAuthSessions(serializeRefreshSessions());
+}
+
+function removeAccessTokensForSession(sessionId) {
+    for (const [tokenHash, entry] of accessTokens.entries()) {
+        if (entry?.sessionId === sessionId) {
+            accessTokens.delete(tokenHash);
+        }
+    }
+}
+
+function pruneExpiredAccessTokens(now = nowTimestamp()) {
+    for (const [tokenHash, entry] of accessTokens.entries()) {
+        if (!entry || isIsoExpired(entry.expiresAt, now)) {
+            accessTokens.delete(tokenHash);
+        }
+    }
+}
+
+function pruneExpiredRefreshSessions(now = nowTimestamp()) {
+    let changed = false;
+    for (const [sessionId, session] of refreshSessions.entries()) {
+        if (
+            !session
+            || session.passwordFingerprint !== getPasswordFingerprint()
+            || session.revokedAt
+            || isIsoExpired(session.refreshExpiresAt, now)
+        ) {
+            refreshSessions.delete(sessionId);
+            removeAccessTokensForSession(sessionId);
+            changed = true;
+        }
+    }
+    return changed;
+}
+
+async function ensureAuthStoreInitialized() {
+    if (authStoreInitialized) {
+        return;
+    }
+    if (!authStoreInitPromise) {
+        authStoreInitPromise = (async () => {
+            const sessions = await loadAuthSessions();
+            refreshSessions.clear();
+            for (const session of sessions) {
+                refreshSessions.set(session.id, session);
+            }
+            const changed = pruneExpiredRefreshSessions();
+            if (changed) {
+                await persistRefreshSessions();
+            }
+            authStoreInitialized = true;
+        })().finally(() => {
+            authStoreInitPromise = null;
+        });
+    }
+    await authStoreInitPromise;
+}
 
-export function checkAuth(providedHash) {
+function verifyPasswordHash(passwordHash) {
     if (isLocked) {
         return { success: false, locked: true };
     }
-
-    if (!providedHash || providedHash !== config.passwordHash) {
-        failedAttempts++;
+    const normalized = typeof passwordHash === 'string'
+        ? passwordHash.trim().toLowerCase()
+        : '';
+    if (
+        !/^[0-9a-f]{64}$/.test(normalized)
+        || !safeEqualHex(normalized, config.passwordHash)
+    ) {
+        failedAttempts += 1;
         if (failedAttempts >= MAX_ATTEMPTS) {
             isLocked = true;
-            console.error('[Auth] Maximum failed attempts reached. Service locked.');
+            console.error(
+                '[Auth] Maximum failed attempts reached. Service locked.'
+            );
         }
         return { success: false, locked: isLocked };
     }
-
-    // Reset attempts on success? 
-    // Requirement says "already wrong 30 times, service locked". 
-    // Usually success resets counter, but strict interpretation might mean cumulative.
-    // Assuming standard behavior: success resets counter to avoid accidental lockout over long periods.
     failedAttempts = 0;
     return { success: true, locked: false };
 }
 
+function buildAuthPayload(rawAccessToken, rawRefreshToken, now = nowTimestamp()) {
+    return {
+        accessToken: rawAccessToken,
+        accessTokenExpiresAt: toIsoOffset(now, ACCESS_TOKEN_TTL_MS),
+        refreshToken: rawRefreshToken,
+        refreshTokenExpiresAt: toIsoOffset(now, REFRESH_TOKEN_TTL_MS)
+    };
+}
+
+function issueAccessToken(sessionId, now = nowTimestamp()) {
+    removeAccessTokensForSession(sessionId);
+    const rawAccessToken = generateOpaqueToken('ta');
+    const accessTokenHash = sha256(rawAccessToken);
+    accessTokens.set(accessTokenHash, {
+        sessionId,
+        expiresAt: toIsoOffset(now, ACCESS_TOKEN_TTL_MS)
+    });
+    return rawAccessToken;
+}
+
+function findRefreshSessionByToken(refreshToken) {
+    const tokenHash = sha256(refreshToken);
+    for (const session of refreshSessions.values()) {
+        if (session.refreshTokenHash === tokenHash) {
+            return session;
+        }
+    }
+    return null;
+}
+
+function buildSessionSummary(session, currentSessionId = '') {
+    return {
+        id: session.id,
+        createdAt: session.createdAt || '',
+        lastSeenAt: session.lastSeenAt || '',
+        refreshExpiresAt: session.refreshExpiresAt || '',
+        userAgent: session.userAgent || '',
+        current: session.id === currentSessionId
+    };
+}
+
+export async function initAuthStore() {
+    await ensureAuthStoreInitialized();
+}
+
+export async function issueAuthTokensFromPasswordHash(
+    passwordHash,
+    { userAgent = '' } = {}
+) {
+    await ensureAuthStoreInitialized();
+    const { success, locked } = verifyPasswordHash(passwordHash);
+    if (locked) {
+        return {
+            ok: false,
+            status: 403,
+            error: 'Service locked due to too many failed attempts. Please restart the service.'
+        };
+    }
+    if (!success) {
+        return {
+            ok: false,
+            status: 401,
+            error: 'Unauthorized'
+        };
+    }
+
+    const now = nowTimestamp();
+    const sessionId = crypto.randomUUID();
+    const rawRefreshToken = generateOpaqueToken('tr');
+    const refreshTokenHash = sha256(rawRefreshToken);
+    const session = {
+        id: sessionId,
+        passwordFingerprint: getPasswordFingerprint(),
+        refreshTokenHash,
+        createdAt: nowIso(),
+        lastSeenAt: nowIso(),
+        refreshExpiresAt: toIsoOffset(now, REFRESH_TOKEN_TTL_MS),
+        rotatedAt: nowIso(),
+        revokedAt: '',
+        userAgent: normalizeUserAgent(userAgent)
+    };
+    refreshSessions.set(sessionId, session);
+    await persistRefreshSessions();
+
+    const rawAccessToken = issueAccessToken(sessionId, now);
+    return {
+        ok: true,
+        status: 200,
+        sessionId,
+        ...buildAuthPayload(rawAccessToken, rawRefreshToken, now)
+    };
+}
+
+export async function refreshAuthTokens(
+    refreshToken,
+    { userAgent = '' } = {}
+) {
+    await ensureAuthStoreInitialized();
+    const normalized = typeof refreshToken === 'string'
+        ? refreshToken.trim()
+        : '';
+    if (!normalized) {
+        return {
+            ok: false,
+            status: 401,
+            error: 'Unauthorized'
+        };
+    }
+
+    const session = findRefreshSessionByToken(normalized);
+    if (!session) {
+        return {
+            ok: false,
+            status: 401,
+            error: 'Unauthorized'
+        };
+    }
+
+    const now = nowTimestamp();
+    if (
+        session.passwordFingerprint !== getPasswordFingerprint()
+        || session.revokedAt
+        || isIsoExpired(session.refreshExpiresAt, now)
+    ) {
+        refreshSessions.delete(session.id);
+        removeAccessTokensForSession(session.id);
+        await persistRefreshSessions();
+        return {
+            ok: false,
+            status: 401,
+            error: 'Unauthorized'
+        };
+    }
+
+    const nextRefreshToken = generateOpaqueToken('tr');
+    session.refreshTokenHash = sha256(nextRefreshToken);
+    session.lastSeenAt = nowIso();
+    session.rotatedAt = session.lastSeenAt;
+    session.refreshExpiresAt = toIsoOffset(now, REFRESH_TOKEN_TTL_MS);
+    const normalizedUserAgent = normalizeUserAgent(userAgent);
+    if (normalizedUserAgent) {
+        session.userAgent = normalizedUserAgent;
+    }
+    refreshSessions.set(session.id, session);
+    await persistRefreshSessions();
+
+    const rawAccessToken = issueAccessToken(session.id, now);
+    return {
+        ok: true,
+        status: 200,
+        sessionId: session.id,
+        ...buildAuthPayload(rawAccessToken, nextRefreshToken, now)
+    };
+}
+
+export async function listAuthSessions(currentSessionId = '') {
+    await ensureAuthStoreInitialized();
+    const changed = pruneExpiredRefreshSessions();
+    if (changed) {
+        await persistRefreshSessions();
+    }
+    return serializeRefreshSessions()
+        .map((session) => buildSessionSummary(session, currentSessionId))
+        .sort((left, right) => {
+            if (left.current !== right.current) {
+                return left.current ? -1 : 1;
+            }
+            return String(right.lastSeenAt || right.createdAt || '')
+                .localeCompare(String(left.lastSeenAt || left.createdAt || ''));
+        });
+}
+
+export async function revokeAuthSessionById(sessionId) {
+    await ensureAuthStoreInitialized();
+    const normalizedSessionId = typeof sessionId === 'string'
+        ? sessionId.trim()
+        : '';
+    if (!normalizedSessionId || !refreshSessions.has(normalizedSessionId)) {
+        return { ok: false, status: 404, error: 'Not found' };
+    }
+    refreshSessions.delete(normalizedSessionId);
+    removeAccessTokensForSession(normalizedSessionId);
+    await persistRefreshSessions();
+    return { ok: true, status: 204 };
+}
+
+export async function revokeOtherAuthSessions(currentSessionId = '') {
+    await ensureAuthStoreInitialized();
+    const normalizedCurrentId = typeof currentSessionId === 'string'
+        ? currentSessionId.trim()
+        : '';
+    let changed = false;
+    for (const sessionId of refreshSessions.keys()) {
+        if (sessionId === normalizedCurrentId) {
+            continue;
+        }
+        refreshSessions.delete(sessionId);
+        removeAccessTokensForSession(sessionId);
+        changed = true;
+    }
+    if (changed) {
+        await persistRefreshSessions();
+    }
+    return { ok: true, status: 204 };
+}
+
+export async function revokeAuthTokens({
+    refreshToken = '',
+    accessToken = ''
+} = {}) {
+    await ensureAuthStoreInitialized();
+    const normalizedRefreshToken = typeof refreshToken === 'string'
+        ? refreshToken.trim()
+        : '';
+    const normalizedAccessToken = normalizeAuthHeader(accessToken);
+    let sessionId = '';
+
+    if (normalizedRefreshToken) {
+        const session = findRefreshSessionByToken(normalizedRefreshToken);
+        sessionId = session?.id || '';
+    }
+
+    if (!sessionId && normalizedAccessToken) {
+        pruneExpiredAccessTokens();
+        const accessEntry = accessTokens.get(sha256(normalizedAccessToken));
+        sessionId = accessEntry?.sessionId || '';
+    }
+
+    if (!sessionId) {
+        return { ok: true, status: 204 };
+    }
+
+    refreshSessions.delete(sessionId);
+    removeAccessTokensForSession(sessionId);
+    await persistRefreshSessions();
+    return { ok: true, status: 204 };
+}
+
+export async function authenticateAccessToken(rawToken) {
+    await ensureAuthStoreInitialized();
+    const normalizedToken = normalizeAuthHeader(rawToken);
+    if (!normalizedToken) {
+        return { ok: false, status: 401, error: 'Unauthorized' };
+    }
+
+    pruneExpiredAccessTokens();
+
+    const accessEntry = accessTokens.get(sha256(normalizedToken));
+    if (!accessEntry || isIsoExpired(accessEntry.expiresAt)) {
+        if (accessEntry) {
+            accessTokens.delete(sha256(normalizedToken));
+        }
+        return { ok: false, status: 401, error: 'Unauthorized' };
+    }
+
+    const session = refreshSessions.get(accessEntry.sessionId);
+    if (
+        !session
+        || session.passwordFingerprint !== getPasswordFingerprint()
+        || session.revokedAt
+        || isIsoExpired(session.refreshExpiresAt)
+    ) {
+        accessTokens.delete(sha256(normalizedToken));
+        if (session) {
+            refreshSessions.delete(session.id);
+            removeAccessTokensForSession(session.id);
+            await persistRefreshSessions();
+        }
+        return { ok: false, status: 401, error: 'Unauthorized' };
+    }
+
+    session.lastSeenAt = nowIso();
+    refreshSessions.set(session.id, session);
+    return {
+        ok: true,
+        status: 200,
+        auth: {
+            sessionId: session.id,
+            accessTokenExpiresAt: accessEntry.expiresAt,
+            refreshTokenExpiresAt: session.refreshExpiresAt
+        }
+    };
+}
+
 export async function authMiddleware(ctx, next) {
     if (ctx.method === 'OPTIONS') {
         ctx.status = 204;
         return;
     }
 
-    // Allow health check without auth
-    if (ctx.path === '/healthz') {
+    if (
+        ctx.path === '/healthz'
+        || ctx.path === '/api/version'
+        || ctx.path === '/api/auth/login'
+        || ctx.path === '/api/auth/refresh'
+        || ctx.path === '/api/auth/logout'
+    ) {
         return next();
     }
 
-    // Check for Authorization header
     const authHeader = ctx.get('Authorization') || ctx.query.token;
-    // Expecting "Authorization: <sha256-hash>"
-    // Some clients might send "Bearer <hash>", let's handle raw hash for simplicity as per prompt
-    // "header中攜帶這個編碼過的密碼" -> implies the value is the hash.
-    
-    const { success, locked } = checkAuth(authHeader);
-
-    if (locked) {
-        ctx.status = 403;
-        ctx.body = { error: 'Service locked due to too many failed attempts. Please restart the service.' };
-        return;
-    }
-
-    if (!success) {
-        ctx.status = 401;
-        ctx.body = { error: 'Unauthorized' };
+    const result = await authenticateAccessToken(authHeader);
+    if (!result.ok) {
+        ctx.status = result.status;
+        ctx.body = { error: result.error };
         return;
     }
 
+    ctx.state.auth = result.auth;
     await next();
 }
 
 export function verifyClient(info, cb) {
     const { req } = info;
-    // WebSocket headers are in req.headers
     let authHeader = req.headers['authorization'];
 
-    // If no header, check query parameter
     if (!authHeader && req.url) {
         try {
             const url = new URL(req.url, `http://${req.headers.host}`);
             authHeader = url.searchParams.get('token');
         } catch {
-            // ignore invalid url
+            // Ignore malformed URL.
         }
     }
-    
-    const { success, locked } = checkAuth(authHeader);
 
-    if (locked) {
-        cb(false, 403, 'Service locked');
+    const normalizedToken = normalizeAuthHeader(authHeader);
+    if (!normalizedToken) {
+        cb(false, 401, 'Unauthorized');
         return;
     }
 
-    if (!success) {
+    pruneExpiredAccessTokens(nowTimestamp() + ACCESS_TOKEN_REPLAY_LEEWAY_MS);
+    const accessEntry = accessTokens.get(sha256(normalizedToken));
+    if (!accessEntry || isIsoExpired(accessEntry.expiresAt)) {
+        cb(false, 401, 'Unauthorized');
+        return;
+    }
+
+    const session = refreshSessions.get(accessEntry.sessionId);
+    if (
+        !session
+        || session.passwordFingerprint !== getPasswordFingerprint()
+        || session.revokedAt
+        || isIsoExpired(session.refreshExpiresAt)
+    ) {
         cb(false, 401, 'Unauthorized');
         return;
     }

package/src/persistence.mjs

@@ -9,6 +9,7 @@ const MEMORY_FILE = path.join(BASE_DIR, 'memory.json');
 const CLUSTER_FILE = path.join(BASE_DIR, 'cluster.json');
 const AGENT_TABS_FILE = path.join(BASE_DIR, 'agent-tabs.json');
 const AGENT_CONFIG_FILE = path.join(BASE_DIR, 'agent-config.json');
+const AUTH_SESSIONS_FILE = path.join(BASE_DIR, 'auth-sessions.json');
 const getSessionSnapshotPath = (id) => path.join(SESSIONS_DIR, `${id}.snapshot`);
 
 // Ensure directories exist
@@ -196,6 +197,80 @@ export const saveCluster = async (servers) => {
     }
 };
 
+// --- Auth Session Persistence ---
+
+function normalizeAuthSessions(sessions) {
+    if (!Array.isArray(sessions)) return [];
+    const normalized = [];
+    for (const entry of sessions) {
+        if (!entry || typeof entry !== 'object') continue;
+        const id = typeof entry.id === 'string' ? entry.id.trim() : '';
+        const passwordFingerprint = typeof entry.passwordFingerprint === 'string'
+            ? entry.passwordFingerprint.trim()
+            : '';
+        const refreshTokenHash = typeof entry.refreshTokenHash === 'string'
+            ? entry.refreshTokenHash.trim()
+            : '';
+        const createdAt = typeof entry.createdAt === 'string'
+            ? entry.createdAt.trim()
+            : '';
+        const lastSeenAt = typeof entry.lastSeenAt === 'string'
+            ? entry.lastSeenAt.trim()
+            : '';
+        const refreshExpiresAt = typeof entry.refreshExpiresAt === 'string'
+            ? entry.refreshExpiresAt.trim()
+            : '';
+        const rotatedAt = typeof entry.rotatedAt === 'string'
+            ? entry.rotatedAt.trim()
+            : '';
+        const revokedAt = typeof entry.revokedAt === 'string'
+            ? entry.revokedAt.trim()
+            : '';
+        const userAgent = typeof entry.userAgent === 'string'
+            ? entry.userAgent.trim()
+            : '';
+        if (!id || !passwordFingerprint || !refreshTokenHash) continue;
+        normalized.push({
+            id,
+            passwordFingerprint,
+            refreshTokenHash,
+            createdAt,
+            lastSeenAt,
+            refreshExpiresAt,
+            rotatedAt,
+            revokedAt,
+            userAgent
+        });
+    }
+    return normalized;
+}
+
+export const loadAuthSessions = async () => {
+    await init();
+    try {
+        const content = await fs.readFile(AUTH_SESSIONS_FILE, 'utf-8');
+        const parsed = JSON.parse(content);
+        if (Array.isArray(parsed)) {
+            return normalizeAuthSessions(parsed);
+        }
+        return normalizeAuthSessions(parsed?.sessions);
+    } catch {
+        return [];
+    }
+};
+
+export const saveAuthSessions = async (sessions) => {
+    await init();
+    const normalized = normalizeAuthSessions(sessions);
+    const payload = { sessions: normalized };
+    try {
+        await fs.writeFile(AUTH_SESSIONS_FILE, JSON.stringify(payload, null, 2));
+    } catch (e) {
+        console.error('[Persistence] Failed to save auth sessions:', e);
+        throw e;
+    }
+};
+
 // --- ACP Agent Tab Persistence ---
 
 function normalizeAgentTabs(tabs) {