thatcher 1.0.65 → 1.0.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.65",
+  "version": "1.0.67",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/oauth-state-store.js

@@ -0,0 +1,39 @@
+import crypto from 'crypto';
+
+// Short-lived (5 min), single-use state store for OAuth CSRF protection. A
+// long-lived state (e.g. reusing the session TTL, as the orphaned
+// app/api/auth/google route did) widens the CSRF window far past what an
+// authorization-code round trip needs; 5 minutes is generous for a login flow
+// and small for an attacker to exploit.
+const TTL_MS = 5 * 60 * 1000;
+const store = new Map();
+
+let sweepHandle = null;
+function ensureSweep() {
+  if (sweepHandle) return;
+  sweepHandle = setInterval(() => {
+    const now = Date.now();
+    for (const [key, entry] of store) {
+      if (entry.expiresAt < now) store.delete(key);
+    }
+  }, TTL_MS);
+  if (sweepHandle.unref) sweepHandle.unref();
+}
+
+export function createOAuthState(data) {
+  ensureSweep();
+  const key = crypto.randomBytes(32).toString('hex');
+  store.set(key, { data, expiresAt: Date.now() + TTL_MS });
+  return key;
+}
+
+// Single-use: a matched state is deleted on first read, so a replayed
+// callback URL (e.g. from browser history or a leaked Referer) cannot
+// re-consume the same state a second time.
+export function consumeOAuthState(key) {
+  const entry = store.get(key);
+  if (!entry) return null;
+  store.delete(key);
+  if (entry.expiresAt < Date.now()) return null;
+  return entry.data;
+}

package/src/lib/rate-limiter.js

@@ -0,0 +1,37 @@
+// Fixed-window per-key rate limiter, in-memory. Keyed by authenticated user id
+// when available, otherwise by remote IP, so one anonymous IP hammering the
+// API can't exhaust a budget shared with real users behind the same NAT --
+// each authenticated user gets their own independent window.
+const WINDOW_MS = 60 * 1000;
+const DEFAULT_LIMIT = 300;
+const buckets = new Map();
+
+let sweepHandle = null;
+function ensureSweep() {
+  if (sweepHandle) return;
+  sweepHandle = setInterval(() => {
+    const now = Date.now();
+    for (const [key, bucket] of buckets) {
+      if (now - bucket.windowStart > WINDOW_MS) buckets.delete(key);
+    }
+  }, WINDOW_MS);
+  if (sweepHandle.unref) sweepHandle.unref();
+}
+
+export function checkRateLimit(key, limit = DEFAULT_LIMIT) {
+  ensureSweep();
+  const now = Date.now();
+  let bucket = buckets.get(key);
+  if (!bucket || now - bucket.windowStart >= WINDOW_MS) {
+    bucket = { windowStart: now, count: 0 };
+    buckets.set(key, bucket);
+  }
+  bucket.count += 1;
+  const remaining = Math.max(0, limit - bucket.count);
+  const resetMs = bucket.windowStart + WINDOW_MS - now;
+  return { allowed: bucket.count <= limit, remaining, resetMs, limit };
+}
+
+export function resetRateLimiter() {
+  buckets.clear();
+}

package/src/server/server.js

@@ -93,6 +93,20 @@ export function createServer(options) {
       // API routes
       if (pathname.startsWith('/api/')) {
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
+
+        const { checkRateLimit } = await import('../lib/rate-limiter.js');
+        const rateUser = await resolveRequestUser(req);
+        const rateKey = rateUser ? `user:${rateUser.id}` : `ip:${req.socket?.remoteAddress || 'unknown'}`;
+        const rate = checkRateLimit(rateKey);
+        res.setHeader('X-RateLimit-Limit', String(rate.limit));
+        res.setHeader('X-RateLimit-Remaining', String(rate.remaining));
+        res.setHeader('X-RateLimit-Reset', String(Math.ceil(rate.resetMs / 1000)));
+        if (!rate.allowed) {
+          res.setHeader('Retry-After', String(Math.ceil(rate.resetMs / 1000)));
+          res.writeHead(429);
+          res.end(JSON.stringify({ error: 'Rate limit exceeded, try again later' }));
+          return;
+        }
         const parts = pathname.slice(5).split('/').filter(Boolean); // remove /api/
 
         if (parts.length === 0) {
@@ -105,6 +119,14 @@ export function createServer(options) {
         const id = parts[1] || null;
         const action = parts[2] || null;
 
+        if (req.method === 'GET' && entity === 'auth' && id === 'google' && !action) {
+          return await handleOAuthGoogleStart(req, res);
+        }
+
+        if (req.method === 'GET' && entity === 'auth' && id === 'google' && action === 'callback') {
+          return await handleOAuthGoogleCallback(req, res);
+        }
+
         if (req.method === 'POST' && id === 'import' && !action) {
           return await handleCsvImport(req, res, entity, thatcher, configEngine);
         }
@@ -1112,6 +1134,112 @@ async function handleCsvImport(req, res, entity, thatcher, configEngineArg) {
   }
 }
 
+function oauthRedirectUri(req) {
+  const protocol = req.headers['x-forwarded-proto'] || 'http';
+  const host = req.headers['x-forwarded-host'] || req.headers.host || 'localhost:3000';
+  return `${protocol}://${host}/api/auth/google/callback`;
+}
+
+async function handleOAuthGoogleStart(req, res) {
+  const { getGoogle } = await import('../engine.server.js');
+  let google;
+  try {
+    google = getGoogle();
+  } catch (e) {
+    apiLog.error(e.message);
+    google = null;
+  }
+  if (!google) {
+    res.writeHead(302, { Location: '/login?error=oauth_not_configured' });
+    res.end();
+    return;
+  }
+
+  const { generateState, generateCodeVerifier } = await import('arctic');
+  const { createOAuthState } = await import('../lib/oauth-state-store.js');
+  const state = generateState();
+  const codeVerifier = generateCodeVerifier();
+  const stateKey = createOAuthState({ state, codeVerifier });
+
+  const url = google.createAuthorizationURL(state, codeVerifier, ['profile', 'email']);
+  url.searchParams.set('state', stateKey);
+
+  res.writeHead(302, { Location: url.toString() });
+  res.end();
+}
+
+async function handleOAuthGoogleCallback(req, res) {
+  const url = new URL(req.url, `http://${req.headers.host}`);
+  const code = url.searchParams.get('code');
+  const stateKey = url.searchParams.get('state');
+
+  const { consumeOAuthState } = await import('../lib/oauth-state-store.js');
+  // Single-use consume: a matched key is deleted here on first read, so a
+  // replayed callback URL cannot ride the same state twice, and a stateKey
+  // this server never issued (or one already spent) fails the lookup outright.
+  const stored = stateKey ? consumeOAuthState(stateKey) : null;
+  if (!code || !stateKey || !stored) {
+    res.writeHead(302, { Location: '/login?error=state_mismatch' });
+    res.end();
+    return;
+  }
+
+  try {
+    const { getGoogle, createSession } = await import('../engine.server.js');
+    const google = getGoogle();
+    if (!google) throw new Error('OAuth not configured');
+
+    const tokens = await google.validateAuthorizationCode(code, stored.codeVerifier);
+    const accessToken = tokens.accessToken();
+
+    const userInfoRes = await fetch('https://openidconnect.googleapis.com/v1/userinfo', {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!userInfoRes.ok) throw new Error('Failed to fetch user info');
+    const googleUser = await userInfoRes.json();
+
+    // Never trust an unverified email to link/create a local account -- Google
+    // returns email_verified=false for e.g. an unverified alias, and creating
+    // or matching an account on that claim would let an attacker who controls
+    // an unverified address impersonate a real user's account.
+    if (!googleUser.email || googleUser.email_verified !== true) {
+      res.writeHead(302, { Location: '/login?error=email_not_verified' });
+      res.end();
+      return;
+    }
+
+    const { getBy, create } = await import('../lib/busybase/store.js');
+    let user = await getBy('user', 'email', googleUser.email);
+    if (!user) {
+      const { getConfigEngineSync } = await import('../lib/config-generator-engine.js');
+      const configEngine = getConfigEngineSync();
+      const roles = configEngine.getRoles();
+      const defaultRole = Object.keys(roles)[0] || 'clerk';
+      user = await create('user', {
+        email: googleUser.email,
+        name: googleUser.name || googleUser.email,
+        avatar: googleUser.picture || null,
+        type: 'auditor',
+        role: defaultRole,
+        status: 'active',
+      });
+    }
+
+    const { sessionCookie } = await createSession(user.id);
+    const cookieAttrs = [`Path=${sessionCookie.attributes.path || '/'}`, 'HttpOnly', `SameSite=${sessionCookie.attributes.sameSite || 'Lax'}`];
+    if (sessionCookie.attributes.secure) cookieAttrs.push('Secure');
+    res.writeHead(302, {
+      Location: '/',
+      'Set-Cookie': `${sessionCookie.name}=${sessionCookie.value}; ${cookieAttrs.join('; ')}`,
+    });
+    res.end();
+  } catch (err) {
+    apiLog.error(err.message);
+    res.writeHead(302, { Location: '/login?error=oauth_failed' });
+    res.end();
+  }
+}
+
 const UPLOAD_ALLOWED_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'application/pdf', 'text/plain', 'text/csv', 'application/json']);
 const UPLOAD_MAX_SIZE = 10 * 1024 * 1024;
 const UPLOAD_DIR = path.join(process.cwd(), 'uploads');

package/src/ui/dashboard-renderer.js

@@ -89,12 +89,12 @@ export function renderAuditDashboard(user, auditData = {}) {
   const { summary = {}, recentActivity = [] } = auditData;
   const actRows = recentActivity.slice(0, 20).map(a =>
     `<tr data-row>
-      <td data-col="time">${new Date((a.timestamp||a.created_at)*1000).toLocaleString('en-ZA')}</td>
-      <td data-col="action"><span class="pill pill-info">${a.action||'-'}</span></td>
-      <td data-col="entity">${a.entity_type||'-'}</td>
-      <td data-col="id" style="font-size:12px">${a.entity_id||'-'}</td>
-      <td data-col="user">${a.user_name||a.user_id||'-'}</td>
-      <td data-col="reason" style="font-size:12px;color:var(--color-text-muted)">${a.reason||'-'}</td>
+      <td data-col="time">${esc(new Date((a.timestamp||a.created_at)*1000).toLocaleString('en-ZA'))}</td>
+      <td data-col="action"><span class="pill pill-info">${esc(a.action||'-')}</span></td>
+      <td data-col="entity">${esc(a.entity_type||'-')}</td>
+      <td data-col="id" style="font-size:12px">${esc(a.entity_id||'-')}</td>
+      <td data-col="user">${esc(a.user_name||a.user_id||'-')}</td>
+      <td data-col="reason" style="font-size:12px;color:var(--color-text-muted)">${esc(a.reason||'-')}</td>
     </tr>`
    ).join('') || emptyRow(6, 'No audit records found');
 
@@ -124,7 +124,7 @@ export function renderAuditDashboard(user, auditData = {}) {
 export function renderSystemHealth(user, healthData = {}) {
   const { database = {}, server: srv = {}, entities = {} } = healthData;
   const entRows = Object.entries(entities).map(([n, c]) =>
-    `<tr data-row><td data-col="entity">${n}</td><td data-col="count" style="text-align:right">${c}</td></tr>`
+    `<tr data-row><td data-col="entity">${esc(n)}</td><td data-col="count" style="text-align:right">${esc(String(c))}</td></tr>`
    ).join('') || emptyRow(2, 'No data');
 
   const statsHtml = `<div class="stats-row">${[

package/src/app/api/auth/google/callback/route.js

@@ -1,97 +0,0 @@
-import { createLogger } from '@/lib/logger.js';
-import { createSession } from '@/engine.server';
-
-const log = createLogger('[OAuth]');
-import { getBy, create } from '@/engine';
-import { Google } from 'arctic';
-import { GOOGLE_APIS } from '@/config/constants';
-import { config } from '@/config';
-import { getConfigEngine } from '@/lib/config-generator-engine';
-import { globalManager } from '@/lib/hot-reload/mutex';
-import { NextResponse } from '@/lib/next-shim';
-import {
-  validateOAuthProvider,
-  getOAuthCookie,
-  deleteOAuthCookie,
-  buildOAuthErrorResponse,
-  validateOAuthState,
-} from '@/lib/auth-route-helpers';
-
-export async function GET(request) {
-  const protocol = request.headers['x-forwarded-proto'] || 'http';
-  const host = request.headers['x-forwarded-host'] || request.headers.host || 'localhost:3000';
-  const redirectUri = `${protocol}://${host}/api/auth/google/callback`;
-
-  const dynamicGoogle = new Google(
-    config.auth.google.clientId,
-    config.auth.google.clientSecret,
-    redirectUri
-  );
-
-  const { valid, error } = validateOAuthProvider(dynamicGoogle);
-  if (!valid) {
-    return buildOAuthErrorResponse(error, request);
-  }
-
-  const url = new URL(request.url);
-  const code = url.searchParams.get('code');
-  const stateKey = url.searchParams.get('state');  // Google returns the key we sent
-
-  const storedData = await getOAuthCookie(stateKey);
-  const state = storedData?.state;
-  const codeVerifier = storedData?.codeVerifier;
-
-  const stateValidation = validateOAuthState(code, stateKey, state, codeVerifier);
-  if (!stateValidation.valid) {
-    log.warn('state validation failed:', { error: stateValidation.error });
-    return buildOAuthErrorResponse(stateValidation.error, request);
-  }
-
-  try {
-    const tokens = await dynamicGoogle.validateAuthorizationCode(code, codeVerifier);
-    const accessToken = tokens.accessToken;
-
-    const googleResponse = await fetch(GOOGLE_APIS.oauth2, {
-      headers: { Authorization: `Bearer ${accessToken}` },
-    });
-
-    if (!googleResponse.ok) {
-      throw new Error('Failed to fetch user info');
-    }
-
-    const googleUser = await googleResponse.json();
-
-    const user = await globalManager.lock('oauth-user-create', async () => {
-      let existing = getBy('user', 'email', googleUser.email);
-      if (existing) return existing;
-
-      const engine = await getConfigEngine();
-      const roles = engine.getRoles();
-      const defaultRole = Object.keys(roles)[0] || 'clerk';
-
-      return create('user', {
-        email: googleUser.email,
-        name: googleUser.name,
-        avatar: googleUser.picture,
-        type: 'auditor',
-        role: defaultRole,
-        status: 'active',
-      });
-    });
-
-    const { sessionCookie } = await createSession(user.id);
-
-    await deleteOAuthCookie(stateKey);
-
-    const redirectUrl = new URL('/', request.url);
-    const response = NextResponse.redirect(redirectUrl);
-
-    const cookieValue = `${sessionCookie.value}; Path=${sessionCookie.attributes.path || '/'}; HttpOnly${sessionCookie.attributes.secure ? '; Secure' : ''}; SameSite=${sessionCookie.attributes.sameSite || 'Lax'}`;
-    response.headers.set('Set-Cookie', `${sessionCookie.name}=${cookieValue}`);
-
-    return response;
-  } catch (error) {
-    log.error('Google OAuth error:', { message: error.message });
-    return buildOAuthErrorResponse('oauth_failed', request);
-  }
-}

package/src/app/api/auth/google/route.js

@@ -1,61 +0,0 @@
-import { NextResponse } from '@/lib/next-shim';
-import { createLogger } from '@/lib/logger.js';
-
-const log = createLogger('[OAuth]');
-import { google } from '@/engine.server';
-import { Google } from 'arctic';
-import { generateState, generateCodeVerifier } from 'arctic';
-import { globalManager } from '@/lib/hot-reload/mutex';
-import { config } from '@/config';
-import { validateOAuthProvider, setOAuthCookie, buildOAuthErrorResponse } from '@/lib/auth-route-helpers';
-
-export async function GET(request) {
-  const url = new URL(request.url);
-  const isCheck = url.searchParams.get('check') === '1';
-
-  if (isCheck) {
-    const { valid } = validateOAuthProvider(google);
-    return new Response(JSON.stringify({ configured: valid }), {
-      status: 200,
-      headers: { 'Content-Type': 'application/json' }
-    });
-  }
-
-  const protocol = request.headers['x-forwarded-proto'] || 'http';
-  const host = request.headers['x-forwarded-host'] || request.headers.host || 'localhost:3000';
-  const redirectUri = `${protocol}://${host}/api/auth/google/callback`;
-
-  const dynamicGoogle = new Google(
-    config.auth.google.clientId,
-    config.auth.google.clientSecret,
-    redirectUri
-  );
-
-  const { valid, error } = validateOAuthProvider(dynamicGoogle);
-  if (!valid) {
-    return buildOAuthErrorResponse(error);
-  }
-
-  return globalManager.lock('oauth-state-init', async () => {
-    const state = generateState();
-    const codeVerifier = generateCodeVerifier();
-
-    const stateKey = await setOAuthCookie('google_oauth_state', { state, codeVerifier });
-
-    const url = await dynamicGoogle.createAuthorizationURL(stateKey, codeVerifier, {
-      scopes: ['profile', 'email'],
-    });
-
-    return NextResponse.redirect(url);
-  });
-}
-
-export async function HEAD(_request) {
-  try {
-    const { valid } = validateOAuthProvider(google);
-    return new Response(null, { status: valid ? 200 : 503 });
-  } catch (error) {
-    log.error('HEAD error:', { message: error.message });
-    return new Response(null, { status: 500 });
-  }
-}