tinywebui 0.1.4 → 0.1.5

package/src/access/auth.js

@@ -2,159 +2,149 @@ import { randomBytes, createHmac, createHash, timingSafeEqual, scryptSync } from
 import { BlockList, isIP } from 'node:net';
 import { resolveAccess } from './policy.js';
 import { audit } from '../audit.js';
-
 /**
- * Session/cookie plumbing for authMode 'single' (password login), plus the
- * identity resolution for 'trusted-header' further down.
+ * Session/cookie plumbing for local password login ('single' and 'multiuser'),
+ * plus the identity resolution for 'trusted-header' further down.
  * No framework, no dependency: a signed HTTP-only cookie names a session
  * token, and the token itself is looked up (by its hash, never the raw
- * value) against the `sessions` table. When authMode is 'none' none of this
+ * value) against the `sessions` table. When authMode is 'local' none of this
  * is ever called -- see auth_gate.js.
  */
-
 const COOKIE_NAME = 'tinywebui_session';
-
 function sha256(value) {
-  return createHash('sha256').update(value).digest('hex');
+    return createHash('sha256').update(value).digest('hex');
 }
-
+/** Digests bearer-style secrets before persistence. */
+export const hashToken = (value) => sha256(String(value));
 /** HMAC-signs a value so a client can hold it without being able to forge it. */
 function sign(value, secret) {
-  return createHmac('sha256', secret).update(value).digest('hex');
+    return createHmac('sha256', secret).update(value).digest('hex');
 }
-
 function verify(value, sig, secret) {
-  const expected = sign(value, secret);
-  const a = Buffer.from(sig, 'hex');
-  const b = Buffer.from(expected, 'hex');
-  return a.length === b.length && timingSafeEqual(a, b);
+    const expected = sign(value, secret);
+    const a = Buffer.from(sig, 'hex');
+    const b = Buffer.from(expected, 'hex');
+    return a.length === b.length && timingSafeEqual(a, b);
 }
-
 export function createSession(store, userId, ttlDays = 30) {
-  const token = randomBytes(32).toString('hex');
-  store.users.addSession(sha256(token), userId, Date.now() + ttlDays * 86400_000);
-  return token;
+    const token = randomBytes(32).toString('hex');
+    store.users.addSession(sha256(token), userId, Date.now() + ttlDays * 86400_000);
+    return token;
 }
-
 export function destroySession(store, token) {
-  store.users.deleteSession(sha256(token));
+    store.users.deleteSession(sha256(token));
 }
-
 export function destroyUserSessions(store, userId) {
-  store.users.deleteUserSessions(userId);
+    store.users.deleteUserSessions(userId);
 }
-
 /** Builds the Set-Cookie header value for a freshly created session token. */
 export function sessionCookie(token, secret, { secure = false } = {}) {
-  const signature = sign(token, secret);
-  const parts = [
-    `${COOKIE_NAME}=${token}.${signature}`,
-    'Path=/', 'HttpOnly', 'SameSite=Lax',
-  ];
-  if (secure) parts.push('Secure');
-  return parts.join('; ');
-}
-
+    const signature = sign(token, secret);
+    const parts = [
+        `${COOKIE_NAME}=${token}.${signature}`,
+        'Path=/', 'HttpOnly', 'SameSite=Lax',
+    ];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
 export function clearCookie({ secure = false } = {}) {
-  const parts = [`${COOKIE_NAME}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
-  if (secure) parts.push('Secure');
-  return parts.join('; ');
+    const parts = [`${COOKIE_NAME}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
+    if (secure)
+        parts.push('Secure');
+    return parts.join('; ');
 }
-
-/* ---------- password (authMode 'single') ---------- */
-
+/* ---------- local passwords ---------- */
 const SCRYPT = { N: 16384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
-
 /** `scrypt$<salt hex>$<hash hex>` -- what authPassword holds. Never plaintext. */
 export function hashPassword(password) {
-  const salt = randomBytes(16);
-  const hash = scryptSync(String(password), salt, 32, SCRYPT);
-  return `scrypt$${salt.toString('hex')}$${hash.toString('hex')}`;
+    const salt = randomBytes(16);
+    const hash = scryptSync(String(password), salt, 32, SCRYPT);
+    return `scrypt$${salt.toString('hex')}$${hash.toString('hex')}`;
 }
-
 export function verifyPassword(password, stored) {
-  const [kind, saltHex, hashHex] = String(stored || '').split('$');
-  if (kind !== 'scrypt' || !saltHex || !hashHex) return false;
-  const expected = Buffer.from(hashHex, 'hex');
-  const actual = scryptSync(String(password ?? ''), Buffer.from(saltHex, 'hex'), expected.length, SCRYPT);
-  return timingSafeEqual(actual, expected);
+    const [kind, saltHex, hashHex] = String(stored || '').split('$');
+    if (kind !== 'scrypt' || !saltHex || !hashHex)
+        return false;
+    const expected = Buffer.from(hashHex, 'hex');
+    const actual = scryptSync(String(password ?? ''), Buffer.from(saltHex, 'hex'), expected.length, SCRYPT);
+    return timingSafeEqual(actual, expected);
 }
-
 /** The raw session token from a validly signed cookie, or null. */
 export function sessionToken(req, cfg) {
-  const raw = readCookie(req);
-  if (!raw) return null;
-  const dot = raw.lastIndexOf('.');
-  if (dot === -1) return null;
-  const token = raw.slice(0, dot);
-  return cfg.sessionSecret && verify(token, raw.slice(dot + 1), cfg.sessionSecret) ? token : null;
-}
-
+    const raw = readCookie(req);
+    if (!raw)
+        return null;
+    const dot = raw.lastIndexOf('.');
+    if (dot === -1)
+        return null;
+    const token = raw.slice(0, dot);
+    return cfg.sessionSecret && verify(token, raw.slice(dot + 1), cfg.sessionSecret) ? token : null;
+}
 function readCookie(req) {
-  const header = req.headers.cookie;
-  if (!header) return null;
-  for (const part of header.split(';')) {
-    const idx = part.indexOf('=');
-    if (idx === -1) continue;
-    const name = part.slice(0, idx).trim();
-    if (name === COOKIE_NAME) return part.slice(idx + 1).trim();
-  }
-  return null;
-}
-
+    const header = req.headers.cookie;
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const idx = part.indexOf('=');
+        if (idx === -1)
+            continue;
+        const name = part.slice(0, idx).trim();
+        if (name === COOKIE_NAME)
+            return part.slice(idx + 1).trim();
+    }
+    return null;
+}
 /** Whether the connection looks TLS-terminated, for the cookie's Secure flag. */
 export function isSecureRequest(req, trustedProxyCidrs = []) {
-  if (req.socket?.encrypted === true) return true;
-  // X-Forwarded-Proto is a claim only a known proxy may make.
-  return req.headers['x-forwarded-proto'] === 'https' && ipInCidrs(req.socket?.remoteAddress, trustedProxyCidrs);
+    if (req.socket?.encrypted === true)
+        return true;
+    // X-Forwarded-Proto is a claim only a known proxy may make.
+    return req.headers['x-forwarded-proto'] === 'https' && ipInCidrs(req.socket?.remoteAddress, trustedProxyCidrs);
 }
-
 /**
  * Resolves the logged-in user for a request, or null. Verifies the cookie's
  * signature first (cheap, rejects tampering/forgery), then looks up the
  * token's hash in `sessions` and checks expiry.
  */
 export function getSessionUser(req, store, cfg) {
-  const token = sessionToken(req, cfg);
-  if (!token) return null;
-
-  const session = store.users.getSession(sha256(token));
-  if (!session || session.expires_at < Date.now()) return null;
-
-  return store.users.get(session.user_id);
-}
-
+    const token = sessionToken(req, cfg);
+    if (!token)
+        return null;
+    const session = store.users.getSession(sha256(token));
+    if (!session || session.expires_at < Date.now())
+        return null;
+    return store.users.get(session.user_id);
+}
 /* ---------- trusted-header mode ---------- */
-
 /** Parsed once per cidr list; `::ffff:1.2.3.4` peers are checked as IPv4. */
 const blockLists = new WeakMap();
 export function ipInCidrs(ip, cidrs) {
-  if (!ip || !Array.isArray(cidrs) || !cidrs.length) return false;
-  let list = blockLists.get(cidrs);
-  if (!list) {
-    list = new BlockList();
-    for (const cidr of cidrs) {
-      const [addr, bits] = String(cidr).split('/');
-      const family = isIP(addr) === 6 ? 'ipv6' : 'ipv4';
-      const prefix = bits === undefined ? (family === 'ipv6' ? 128 : 32) : Number(bits);
-      list.addSubnet(addr, prefix, family);
+    if (!ip || !Array.isArray(cidrs) || !cidrs.length)
+        return false;
+    let list = blockLists.get(cidrs);
+    if (!list) {
+        list = new BlockList();
+        for (const cidr of cidrs) {
+            const [addr, bits] = String(cidr).split('/');
+            const family = isIP(addr) === 6 ? 'ipv6' : 'ipv4';
+            const prefix = bits === undefined ? (family === 'ipv6' ? 128 : 32) : Number(bits);
+            list.addSubnet(addr, prefix, family);
+        }
+        blockLists.set(cidrs, list);
     }
-    blockLists.set(cidrs, list);
-  }
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
-  if (mapped) return list.check(mapped[1], 'ipv4');
-  return list.check(ip, isIP(ip) === 6 ? 'ipv6' : 'ipv4');
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(ip);
+    if (mapped)
+        return list.check(mapped[1], 'ipv4');
+    return list.check(ip, isIP(ip) === 6 ? 'ipv6' : 'ipv4');
 }
-
 const HEADER_ROLES = new Set(['admin', 'user']);
 const LOGIN_TOUCH_MS = 60_000;
-
 function header(req, name) {
-  const v = req.headers[String(name).toLowerCase()];
-  const s = Array.isArray(v) ? v[0] : v;
-  return typeof s === 'string' ? s.trim() : '';
+    const v = req.headers[String(name).toLowerCase()];
+    const s = Array.isArray(v) ? v[0] : v;
+    return typeof s === 'string' ? s.trim() : '';
 }
-
 /**
  * Resolves (and on first sight provisions) the user an upstream gateway has
  * vouched for. Returns { user } or { reject: reason }.
@@ -166,63 +156,73 @@ function header(req, name) {
  * ever set here on creation and otherwise belongs to TinyWebUI admins.
  */
 export function resolveTrustedUser(req, store, cfg) {
-  if (!ipInCidrs(req.socket?.remoteAddress, cfg.trustedProxyCidrs)) return { reject: 'untrusted_peer' };
-  const externalId = header(req, cfg.trustedUserIdHeader).slice(0, 256);
-  if (!externalId) return { reject: 'missing_identity' };
-  const email = header(req, cfg.trustedEmailHeader).slice(0, 320).toLowerCase() || null;
-  const name = header(req, cfg.trustedNameHeader).slice(0, 200) || null;
-  const rawRole = header(req, cfg.trustedRoleHeader).toLowerCase();
-  const role = HEADER_ROLES.has(rawRole) ? rawRole : null;
-
-  const now = Date.now();
-  // Precedence: the files (bootstrapAdmins, access.users) > gateway role
-  // header > defaults. What an admin decided is in access.users, so the file
-  // outranks a gateway that still says otherwise.
-  const policy = resolveAccess(cfg);
-  const pinned = policy.bootstrapAdmins.includes(externalId)
-    ? { role: 'admin', status: 'approved' }
-    : policy.users[externalId] || {};
-  const wantRole = pinned.role || role;
-  const status = pinned.status || policy.newUsers;
-  let { user, created } = store.users.provision({ externalId, role: wantRole || 'user', status, now });
-  if (created) audit('user.provisioned', { userId: user.id, role: user.role, status: user.status });
-
-  const changes = {};
-  if (email !== user.email) {
-    // Emails are unique; one held by another account is dropped, never merged.
-    const next = email && store.users.emailTaken(email, user.id) ? null : email;
-    if (next !== user.email) changes.email = next;
-  }
-  if (name !== user.name) changes.name = name;
-  if (wantRole && wantRole !== user.role) {
-    changes.role = wantRole;
-    audit('user.role_changed', { userId: user.id, from: user.role, to: wantRole, by: pinned.role ? 'policy' : 'gateway' });
-  }
-  if (pinned.status && pinned.status !== user.status) {
-    changes.status = pinned.status;
-    audit('user.status_changed', { userId: user.id, from: user.status, to: pinned.status, by: 'policy' });
-  }
-  if (!user.last_login_at || now - user.last_login_at > LOGIN_TOUCH_MS) changes.last_login_at = now;
-  if (Object.keys(changes).length) user = store.users.sync(user.id, changes);
-  return { user };
-}
-
+    if (!ipInCidrs(req.socket?.remoteAddress, cfg.trustedProxyCidrs))
+        return { reject: 'untrusted_peer' };
+    const externalId = header(req, cfg.trustedUserIdHeader).slice(0, 256);
+    if (!externalId)
+        return { reject: 'missing_identity' };
+    const email = header(req, cfg.trustedEmailHeader).slice(0, 320).toLowerCase() || null;
+    const name = header(req, cfg.trustedNameHeader).slice(0, 200) || null;
+    const rawRole = header(req, cfg.trustedRoleHeader).toLowerCase();
+    const role = HEADER_ROLES.has(rawRole) ? rawRole : null;
+    const now = Date.now();
+    // Precedence: the files (bootstrapAdmins, access.users) > gateway role
+    // header > defaults. What an admin decided is in access.users, so the file
+    // outranks a gateway that still says otherwise.
+    const policy = resolveAccess(cfg);
+    const pinned = policy.bootstrapAdmins.includes(externalId)
+        ? { role: 'admin', status: 'approved' }
+        : policy.users[externalId] || {};
+    const wantRole = pinned.role || role;
+    const status = pinned.status || policy.newUsers;
+    // provision() reads back the row it just made sure exists.
+    const provisioned = store.users.provision({ externalId, role: wantRole || 'user', status, now });
+    let user = provisioned.user;
+    const { created } = provisioned;
+    if (created)
+        audit('user.provisioned', { userId: user.id, role: user.role, status: user.status });
+    const changes = {};
+    if (email !== user.email) {
+        // Emails are unique; one held by another account is dropped, never merged.
+        const next = email && store.users.emailTaken(email, user.id) ? null : email;
+        if (next !== user.email)
+            changes.email = next;
+    }
+    if (name !== user.name)
+        changes.name = name;
+    if (wantRole && wantRole !== user.role) {
+        changes.role = wantRole;
+        audit('user.role_changed', { userId: user.id, from: user.role, to: wantRole, by: pinned.role ? 'policy' : 'gateway' });
+    }
+    if (pinned.status && pinned.status !== user.status) {
+        changes.status = pinned.status;
+        audit('user.status_changed', { userId: user.id, from: user.status, to: pinned.status, by: 'policy' });
+    }
+    if (!user.last_login_at || now - user.last_login_at > LOGIN_TOUCH_MS)
+        changes.last_login_at = now;
+    if (Object.keys(changes).length)
+        user = store.users.sync(user.id, changes);
+    return { user };
+}
 /**
  * Brings every provisioned user in line with the files' access.users and
  * bootstrapAdmins, so a status decided in a file (a ban, say) holds even for
  * someone who has not made a request since -- their automations included.
  */
 export function applyAccessPolicy(store, cfg) {
-  const policy = resolveAccess(cfg);
-  const pins = { ...policy.users };
-  for (const id of policy.bootstrapAdmins) pins[id] = { role: 'admin', status: 'approved' };
-  for (const [externalId, pin] of Object.entries(pins)) {
-    const user = store.users.byExternalId(externalId);
-    if (!user) continue;
-    const role = pin.role && pin.role !== user.role ? pin.role : null;
-    const status = pin.status && pin.status !== user.status ? pin.status : null;
-    if (!role && !status) continue;
-    store.users.update(user.id, { ...(role ? { role } : {}), ...(status ? { status } : {}) });
-    audit('user.policy_applied', { userId: user.id, ...(role ? { role } : {}), ...(status ? { status } : {}) });
-  }
+    const policy = resolveAccess(cfg);
+    const pins = { ...policy.users };
+    for (const id of policy.bootstrapAdmins)
+        pins[id] = { role: 'admin', status: 'approved' };
+    for (const [externalId, pin] of Object.entries(pins)) {
+        const user = store.users.byExternalId(externalId);
+        if (!user)
+            continue;
+        const role = pin.role && pin.role !== user.role ? pin.role : null;
+        const status = pin.status && pin.status !== user.status ? pin.status : null;
+        if (!role && !status)
+            continue;
+        store.users.update(user.id, { ...(role ? { role } : {}), ...(status ? { status } : {}) });
+        audit('user.policy_applied', { userId: user.id, ...(role ? { role } : {}), ...(status ? { status } : {}) });
+    }
 }

package/src/access/auth_gate.js

@@ -3,65 +3,66 @@ import { featuresFor } from './policy.js';
 import { getSessionUser, resolveTrustedUser } from './auth.js';
 import { audit } from '../audit.js';
 import { FEATURE } from '../../public/shared/features.js';
-
-/** The one account behind a 'single' password. */
+/** Historical owner row removed when an old installation claims its first account. */
 export const OWNER_ID = 'owner';
-
+/** Holding any feature implies this (resolveAuth grants none without a user); the check makes it explicit. */
+export const isSignedIn = (auth) => auth.userId !== undefined;
 // Reachable without a session: the login/OAuth dance itself, plus static
 // assets so the login page can load before there's anyone to authenticate.
 const PRE_AUTH_PATHS = /^\/api\/auth\//;
 const isPreAuthPath = (pathname) => PRE_AUTH_PATHS.test(pathname) || !pathname.startsWith('/api/');
-
 // In trusted-header mode the gateway owns login and logout; these two are
 // the only /api/auth routes that exist, and both need the resolved user.
 const TRUSTED_AUTH_PATHS = new Set(['/api/auth/me', '/api/auth/logout']);
 // Still answered for a pending/disabled user, so the UI can say why.
 const STATUS_EXEMPT_PATHS = TRUSTED_AUTH_PATHS;
-
 function resolveIdentity(req, pathname, cfg, store) {
-  if (cfg.authMode === 'none') return { userId: ALL_USERS, role: null, user: null, isAdmin: true };
-  let user;
-  if (cfg.authMode === 'trusted-header') {
-    if (!pathname.startsWith('/api/')) return { userId: undefined, user: null, isAdmin: false };
-    if (pathname.startsWith('/api/auth/') && !TRUSTED_AUTH_PATHS.has(pathname)) return { notFound: true };
-    const result = resolveTrustedUser(req, store, cfg);
-    if (result.reject) {
-      audit('auth.rejected', { reason: result.reject, path: pathname });
-      return { unauthorized: true };
+    if (cfg.authMode === 'local')
+        return { userId: ALL_USERS, role: null, user: null, isAdmin: true };
+    let user;
+    if (cfg.authMode === 'trusted-header') {
+        if (!pathname.startsWith('/api/'))
+            return { userId: undefined, user: null, isAdmin: false };
+        if (pathname.startsWith('/api/auth/') && !TRUSTED_AUTH_PATHS.has(pathname))
+            return { notFound: true };
+        const result = resolveTrustedUser(req, store, cfg);
+        if (result.reject) {
+            audit('auth.rejected', { reason: result.reject, path: pathname });
+            return { unauthorized: true };
+        }
+        user = result.user;
     }
-    user = result.user;
-  } else {
-    user = getSessionUser(req, store, cfg);
-    if (!user) {
-      if (!isPreAuthPath(pathname)) return { unauthorized: true };
-      return { userId: undefined, user: null, isAdmin: false };
+    else {
+        user = getSessionUser(req, store, cfg);
+        if (!user) {
+            if (!isPreAuthPath(pathname))
+                return { unauthorized: true };
+            return { userId: undefined, user: null, isAdmin: false };
+        }
     }
-  }
-  if (!STATUS_EXEMPT_PATHS.has(pathname) && !(cfg.authMode !== 'trusted-header' && isPreAuthPath(pathname))) {
-    if (user.status === 'disabled') return { disabled: true };
-    if (user.status !== 'approved') return { pending: true };
-  }
-  // 'single': sessions hang off OWNER_ID but data stays unowned (ALL_USERS),
-  // so switching between 'none' and 'single' never hides a chat.
-  if (cfg.authMode === 'single') return { userId: ALL_USERS, role: 'admin', user, isAdmin: true };
-  return { userId: user.id, role: user.role, user, isAdmin: user.role === 'admin' && user.status === 'approved' };
+    if (!STATUS_EXEMPT_PATHS.has(pathname) && !(cfg.authMode !== 'trusted-header' && isPreAuthPath(pathname))) {
+        if (user.status === 'disabled')
+            return { disabled: true };
+        if (user.status !== 'approved')
+            return { pending: true };
+    }
+    return { userId: user.id, role: user.role, user, isAdmin: user.role === 'admin' && user.status === 'approved' };
 }
-
 /**
  * The one auth gate for the whole handler. Fails closed: with auth on, a
  * request either resolves to a real user or carries `userId: undefined`,
- * which every scoped store method refuses. 'none' is a single-person
+ * which every scoped store method refuses. 'local' is a single-person
  * install and sees everything, exactly as before auth existed. A refusal
  * comes back as one of notFound / unauthorized / disabled / pending.
  */
 export function resolveAuth(req, pathname, cfg, store) {
-  const auth = resolveIdentity(req, pathname, cfg, store);
-  // Features come from the policy for the caller's role; nobody signed in
-  // gets none, which leaves only the routes the table marks open.
-  auth.features = auth.userId !== undefined ? featuresFor(cfg, auth.role) : new Set();
-  if (cfg.authMode === 'trusted-header' && auth.user) auth.isAdmin = auth.features.has(FEATURE.ADMIN);
-  return auth;
+    const auth = resolveIdentity(req, pathname, cfg, store);
+    // Features come from the policy for the caller's role; nobody signed in
+    // gets none, which leaves only the routes the table marks open.
+    auth.features = auth.userId !== undefined ? featuresFor(cfg, auth.role) : new Set();
+    if (cfg.authMode === 'trusted-header' && auth.user)
+        auth.isAdmin = auth.features.has(FEATURE.ADMIN);
+    return auth;
 }
-
 /** Who to name in the audit log for a change: the user, or 'local' (tiers 1-2). */
 export const actor = (auth) => (auth.user?.id && auth.user.id !== OWNER_ID ? auth.user.id : 'local');

package/src/access/email.js

@@ -0,0 +1,17 @@
+export const normalizeEmail = (value) => typeof value === 'string' ? value.trim().toLowerCase() : '';
+export function validEmail(email) {
+    if (typeof email !== 'string' || email.length > 320)
+        return false;
+    const parts = email.split('@');
+    if (parts.length !== 2)
+        return false;
+    const [local, domain] = parts;
+    if (!local || local.length > 64 || !domain || domain.length > 253)
+        return false;
+    if (local.startsWith('.') || local.endsWith('.') || local.includes('..'))
+        return false;
+    if (!/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+$/.test(local))
+        return false;
+    const labels = domain.split('.');
+    return labels.length >= 2 && labels.every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+}