Rokojori
/
rokojori-auth
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Auth Polish

This commit is contained in:
Rokojori 2026-07-17 20:34:36 +02:00
parent d1445b7c77
commit 08859255df
4 changed files with 567 additions and 218 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
source/server/db.ts
View File

@ -94,15 +94,17 @@ export const refreshTokens =
find: ( token: string ): RefreshToken | undefined =>
read<RefreshToken>( 'refreshTokens' ).find( t => t.token === token ),
create( userId: string ): RefreshToken
create( userId: string, ttlMs: number = 30 * 24 * 60 * 60 * 1000 ): RefreshToken
{
const token: RefreshToken =
{
token: randomUUID(),
userId,
expiresAt: new Date( Date.now() + 30 * 24 * 60 * 60 * 1000 ).toISOString()
expiresAt: new Date( Date.now() + ttlMs ).toISOString()
};
write( 'refreshTokens', [ ...read<RefreshToken>( 'refreshTokens' ), token ] );
return token;
},

31
source/server/debug/LogColors.ts Normal file
View File

@ -0,0 +1,31 @@
export class LogColors
{
static readonly reset = "\x1b[0m";
static readonly bright = "\x1b[1m";
static readonly dim = "\x1b[2m";
static readonly underscore = "\x1b[4m";
static readonly blink = "\x1b[5m";
static readonly reverse = "\x1b[7m";
static readonly hidden = "\x1b[8m";
static readonly black_Foreground = "\x1b[30m";
static readonly red_Foreground = "\x1b[31m";
static readonly green_Foreground = "\x1b[32m";
static readonly yellow_Foreground = "\x1b[33m";
static readonly blue_Foreground = "\x1b[34m";
static readonly magenta_Foreground = "\x1b[35m";
static readonly cyan_Foreground = "\x1b[36m";
static readonly white_Foreground = "\x1b[37m";
static readonly gray_Foreground = "\x1b[90m";
static readonly black_Background = "\x1b[40m";
static readonly red_Background = "\x1b[41m";
static readonly green_Background = "\x1b[42m";
static readonly yellow_Background = "\x1b[43m";
static readonly blue_Background = "\x1b[44m";
static readonly magenta_Background = "\x1b[45m";
static readonly cyan_Background = "\x1b[46m";
static readonly white_Background = "\x1b[47m";
static readonly gray_Background = "\x1b[100m";
}

136
source/server/debug/RJLog.ts Normal file
View File

@ -0,0 +1,136 @@
import { LogColors } from "./LogColors";
export class RJLog
{
static readonly errorColor = LogColors.red_Background;
static readonly errorMessageColor = LogColors.red_Foreground;
static readonly warnColor = LogColors.yellow_Background;
static readonly logColor = LogColors.gray_Background
static readonly resetColor = LogColors.reset;
static readonly matcherWithFunction = /^\s+at\s(.+)\s\(.+?:(\d+:\d+)\)/;
static readonly matcherFile = /\(.+?\\(\w+)\.js:(\d+:\d+)\)/;
static readonly matcherAnonymous = /^\s+at\s(.+)\s\((.+)\)/;
static readonly logAlwaysLineInfo = true;
static _parseLineResult( line:string ):RegExpExecArray|null
{
let result = RJLog.matcherWithFunction.exec( line ) ||
RJLog.matcherFile.exec( line ) ||
RJLog.matcherAnonymous.exec( line );
return result;
}
static _parseLine( line:string ):string
{
let result = RJLog._parseLineResult( line );
if ( result )
{
return " " + result[ 1 ] + "(" + result[ 2 ] + ") ";
}
return line;
}
static logError( e:Error )
{
console.log( "\n" + RJLog._formatErrorMessage( ( e as any ) .stack ) );
}
static splitLines( text:string )
{
return text.split( /(?:\r\n)|\n|\r/g );
}
static _formatErrorMessage( stackTrace:string, color:string = RJLog.errorMessageColor )
{
let lines = RJLog.splitLines( stackTrace );
let output:string[] = [ color ];
lines.forEach(
( line, index ) =>
{
let lineInfo = RJLog._parseLine( line );
output.push( lineInfo );
if ( index !== lines.length - 1 )
{
output.push( "\n" );
}
}
)
output.push( RJLog.resetColor );
return output.join( "" );
}
static getLineInfo( color:string = RJLog.logColor, stackTrace?:string, lineIndex:number = 3 )
{
stackTrace = stackTrace || ( new Error().stack + "" );
let lines = RJLog.splitLines( stackTrace );
let result:RegExpExecArray|null = null;
while ( ! result && lineIndex < lines.length )
{
let line = lines[ lineIndex ];
result = RJLog._parseLineResult( line ) ;
lineIndex ++;
}
if ( ! result )
{
console.log( stackTrace );
return color + " <Unknown> " + RJLog.resetColor ;
}
return color + " " + result[ 1 ] + "(" + result[ 2 ] + ") " + RJLog.resetColor;
}
static error( ...params:any[] )
{
if ( RJLog.logAlwaysLineInfo || typeof process === "object" )
{
let lineInfo = RJLog.getLineInfo( RJLog.errorColor );
console.log( "\n" + lineInfo );
}
console.error.apply( console, params );
}
static warn( ...params:any[] )
{
if ( RJLog.logAlwaysLineInfo || typeof process === "object" )
{
let lineInfo = RJLog.getLineInfo( RJLog.warnColor );
console.log( "\n" + lineInfo );
}
console.warn.apply( console, params );
}
static log( ...params:any[] )
{
if ( RJLog.logAlwaysLineInfo || typeof process === "object" )
{
let lineInfo = RJLog.getLineInfo();
console.log( "\n" + lineInfo );
}
console.log.apply( console, params );
}
}

316
source/server/routes/auth.ts
View File

@ -6,10 +6,25 @@ import { requireAuth } from '../middleware/requireAuth';
import { EmailService } from '../email/EmailService';
import { checkForgotPasswordRate, checkLoginRate, checkRegisterRate, sleep } from '../rateLimiter';
import { isSuperAdmin } from '../roles';
import { RJLog } from '../debug/RJLog';
const router = Router();
function parseTtlMs( ttl: string ): number
{
const n = parseInt( ttl, 10 );
if ( ttl.endsWith( 'ms' ) ) return n;
if ( ttl.endsWith( 's' ) ) return n * 1_000;
if ( ttl.endsWith( 'm' ) ) return n * 60_000;
if ( ttl.endsWith( 'h' ) ) return n * 3_600_000;
if ( ttl.endsWith( 'd' ) ) return n * 86_400_000;
if ( ttl.endsWith( 'w' ) ) return n * 604_800_000;
return 3_600_000;
}
const ACCESS_TOKEN_TTL = ( process.env.ACCESS_TOKEN_TTL ?? '1h' ) as any;
const ACCESS_TOKEN_TTL_MS = parseTtlMs( process.env.ACCESS_TOKEN_TTL ?? '1h' );
const REFRESH_TOKEN_TTL_MS = parseTtlMs( process.env.REFRESH_TOKEN_TTL ?? '30d' );
const COOKIE_DOMAIN = process.env.COOKIE_DOMAIN ?? '.rokojori.com';
const RESET_BASE_URL = process.env.RESET_BASE_URL ?? 'https://account.rokojori.com';
const ACCOUNT_BASE_URL = process.env.RESET_BASE_URL ?? 'https://account.rokojori.com';
@ -17,6 +32,7 @@ const ACCOUNT_BASE_URL = process.env.RESET_BASE_URL ?? 'https://account.rokojor
function issueAccessToken( userId: string ): string
{
const user = users.findById( userId )!;
const payload =
{
userId: user.id,
@ -25,6 +41,7 @@ function issueAccessToken( userId: string ): string
products: user.products.map( p => p.id ),
settings: user.settings
};
return jwt.sign( payload, process.env.JWT_SECRET ?? '', { expiresIn: ACCESS_TOKEN_TTL } );
}
@ -41,12 +58,12 @@ function cookieOptions( maxAge: number )
function setTokenCookie( res: Response, accessToken: string ): void
{
res.cookie( 'accessToken', accessToken, { ...cookieOptions( 60 * 60 * 1000 ), maxAge: 60 * 60 * 1000 } );
res.cookie( 'accessToken', accessToken, { ...cookieOptions( ACCESS_TOKEN_TTL_MS ), maxAge: ACCESS_TOKEN_TTL_MS } );
}
function setRefreshTokenCookie( res: Response, token: string ): void
{
res.cookie( 'refreshToken', token, { ...cookieOptions( 30 * 24 * 60 * 60 * 1000 ), maxAge: 30 * 24 * 60 * 60 * 1000 } );
res.cookie( 'refreshToken', token, { ...cookieOptions( REFRESH_TOKEN_TTL_MS ), maxAge: REFRESH_TOKEN_TTL_MS } );
}
function clearAuthCookies( res: Response ): void
@ -59,37 +76,46 @@ function clearAuthCookies( res: Response ): void
function issueTokenPair( res: Response, userId: string ): { accessToken: string; refreshToken: string }
{
const accessToken = issueAccessToken( userId );
const refreshRecord = refreshTokens.create( userId );
const refreshRecord = refreshTokens.create( userId, REFRESH_TOKEN_TTL_MS );
setTokenCookie( res, accessToken );
setRefreshTokenCookie( res, refreshRecord.token );
return { accessToken, refreshToken: refreshRecord.token };
}
// POST /api/auth/register
router.post( '/register', async ( req, res ) =>
// POST /api/auth/register - Create new user
router.post( '/register',
async ( req, res ) =>
{
const ip = req.ip ?? 'unknown';
const { blocked } = checkRegisterRate( ip );
if ( blocked ) { res.status( 429 ).json( { error: 'Too many registrations. Try again later.' } ); return; }
const { email, password } = req.body as { email?: string; password?: string };
if ( ! email || ! password )
{
res.status( 400 ).json( { error: 'Email and password required' } );
return;
}
try
{
const passwordHash = await bcrypt.hash( password, 10 );
const user = users.create( email, passwordHash );
const superadminEmail = process.env.INITIAL_SUPERADMIN_EMAIL?.toLowerCase();
if ( superadminEmail && email.toLowerCase() === superadminEmail )
{
const alreadyHasSuperAdmin = users.all().some( u => u.id !== user.id && isSuperAdmin( u.roles ) );
if ( !alreadyHasSuperAdmin )
{
users.update( user.id, { roles: [ 'superadmin', 'user' ] } );
}
}
const tokens = issueTokenPair( res, user.id );
@ -106,104 +132,186 @@ router.post( '/register', async ( req, res ) =>
{
res.status( 409 ).json( { error: 'Email already registered' } );
}
} );
}
// POST /api/auth/login
router.post( '/login', async ( req, res ) =>
);
// POST /api/auth/login - Login user
router.post( '/login',
async ( req, res ) =>
{
const ip = req.ip ?? 'unknown';
const { blocked, delay } = checkLoginRate( ip );
if ( blocked ) { res.status( 429 ).json( { error: 'Too many attempts. Try again later.' } ); return; }
if ( delay ) await sleep( delay );
if ( blocked )
{
res.status( 429 ).json( { error: 'Too many attempts. Try again later.' } );
return;
}
if ( delay )
{
await sleep( delay );
}
const { email, password } = req.body as { email?: string; password?: string };
const user = email ? users.findByEmail( email ) : undefined;
if ( ! user || ! password || ! ( await bcrypt.compare( password, user.passwordHash ) ) )
{
res.status( 401 ).json( { error: 'Invalid credentials' } );
return;
}
res.json( issueTokenPair( res, user.id ) );
} );
let tokenData = issueTokenPair( res, user.id );
RJLog.log( "Logging in:", user.id, tokenData );
res.json( tokenData );
}
);
// POST /api/auth/logout
router.post( '/logout', ( req, res ) =>
router.post( '/logout',
( req, res ) =>
{
const tokenFromBody = ( req.body as { refreshToken?: string } ).refreshToken;
const tokenFromCookie = req.cookies?.refreshToken as string | undefined;
const token = tokenFromBody ?? tokenFromCookie;
if ( token ) refreshTokens.delete( token );
if ( token )
{
refreshTokens.delete( token );
}
clearAuthCookies( res );
res.json( { ok: true } );
} );
}
);
// GET /api/auth/logout?redirect=... — browser clients (link/redirect-based logout)
router.get( '/logout', ( req, res ) =>
router.get( '/logout',
( req, res ) =>
{
const redirectTo = req.query.redirect as string | undefined;
const token = req.cookies?.refreshToken as string | undefined;
if ( token ) refreshTokens.delete( token );
clearAuthCookies( res );
res.redirect( redirectTo ?? '/login.html' );
} );
}
);
// POST /api/auth/refresh — non-browser clients (token in body)
router.post( '/refresh', ( req, res ) =>
router.post( '/refresh',
( req, res ) =>
{
const { refreshToken } = req.body as { refreshToken?: string };
if ( !refreshToken ) { res.status( 400 ).json( { error: 'Refresh token required' } ); return; }
if ( ! refreshToken )
{
RJLog.log( "Refresh token required, but got", req.body );
res.status( 400 ).json( { error: 'Refresh token required' } );
return;
}
const record = refreshTokens.find( refreshToken );
if ( ! record || new Date( record.expiresAt ) < new Date() )
{
RJLog.log( "Invalid or expired refresh token", refreshToken );
res.status( 401 ).json( { error: 'Invalid or expired refresh token' } );
return;
}
const user = users.findById( record.userId );
if ( !user ) { res.status( 401 ).json( { error: 'User not found' } ); return; }
if ( ! user )
{
RJLog.log( "User not found", refreshToken, record );
res.status( 401 ).json( { error: 'User not found' } );
return;
}
refreshTokens.delete( refreshToken );
res.json( issueTokenPair( res, user.id ) );
} );
// GET /api/auth/refresh-session?redirect=... — browser clients (token from cookie)
router.get( '/refresh-session', ( req, res ) =>
{
const redirectTo = req.query.redirect as string | undefined;
const loginFallback = redirectTo
? `/login.html?redirect=${encodeURIComponent( redirectTo )}`
: '/login.html';
let tokenData = issueTokenPair( res, user.id );
const token = req.cookies?.refreshToken as string | undefined;
if ( !token ) { res.redirect( loginFallback ); return; }
RJLog.log( "Refreshing token", user.id, tokenData );
const record = refreshTokens.find( token );
if ( !record || new Date( record.expiresAt ) < new Date() )
{
clearAuthCookies( res );
res.redirect( loginFallback );
return;
res.json( tokenData );
}
const user = users.findById( record.userId );
if ( !user ) { clearAuthCookies( res ); res.redirect( loginFallback ); return; }
refreshTokens.delete( token );
issueTokenPair( res, user.id );
res.redirect( redirectTo ?? '/profile.html' );
} );
);
// DEPRECATED
// // GET /api/auth/refresh-session?redirect=... — browser clients (token from cookie)
// router.get( '/refresh-session',
// ( req, res ) =>
// {
// const redirectTo = req.query.redirect as string | undefined;
// const loginFallback = redirectTo
// ? `/login.html?redirect=${encodeURIComponent( redirectTo )}`
// : '/login.html';
// const token = req.cookies?.refreshToken as string | undefined;
// if ( !token ) { res.redirect( loginFallback ); return; }
// const record = refreshTokens.find( token );
// if ( !record || new Date( record.expiresAt ) < new Date() )
// {
// clearAuthCookies( res );
// res.redirect( loginFallback );
// return;
// }
// const user = users.findById( record.userId );
// if ( !user ) { clearAuthCookies( res ); res.redirect( loginFallback ); return; }
// refreshTokens.delete( token );
// issueTokenPair( res, user.id );
// res.redirect( redirectTo ?? '/profile.html' );
// }
// );
// POST /api/auth/forgot-password — rate-limited with escalating delay
router.post( '/forgot-password', async ( req, res ) =>
router.post( '/forgot-password',
async ( req, res ) =>
{
const ip = req.ip ?? 'unknown';
const { blocked, delay } = checkForgotPasswordRate( ip );
if ( blocked ) { res.status( 429 ).json( { error: 'Too many attempts. Try again later.' } ); return; }
if ( blocked )
{
res.status( 429 ).json( { error: 'Too many attempts. Try again later.' } );
return;
}
await sleep( delay );
const { email } = req.body as { email?: string };
if ( !email ) { res.status( 400 ).json( { error: 'Email required' } ); return; }
if ( !email )
{
res.status( 400 ).json( { error: 'Email required' } );
return;
}
const user = users.findByEmail( email );
if ( user )
{
const token = resetTokens.create( user.id );
@ -216,28 +324,41 @@ router.post( '/forgot-password', async ( req, res ) =>
}
res.json( { ok: true } );
} );
}
);
// POST /api/auth/reset-password
router.post( '/reset-password', async ( req, res ) =>
router.post( '/reset-password',
async ( req, res ) =>
{
const { token, password } = req.body as { token?: string; password?: string };
if ( !token || !password ) { res.status( 400 ).json( { error: 'Token and password required' } ); return; }
if ( ! token || ! password )
{
res.status( 400 ).json( { error: 'Token and password required' } );
return;
}
const record = resetTokens.find( token );
if ( ! record || new Date( record.expiresAt ) < new Date() )
{
res.status( 400 ).json( { error: 'Invalid or expired token' } );
return;
}
const passwordHash = await bcrypt.hash( password, 10 );
users.update( record.userId, { passwordHash } );
resetTokens.delete( token );
res.json( { ok: true } );
} );
}
);
// GET /api/auth/reset-token-email
router.get( '/reset-token-email', ( req, res ) =>
router.get( '/reset-token-email',
( req, res ) =>
{
const token = req.query.token as string | undefined;
const record = token ? resetTokens.find( token ) : undefined;
@ -249,10 +370,13 @@ router.get( '/reset-token-email', ( req, res ) =>
const user = users.findById( record.userId );
if ( !user ) { res.status( 400 ).json( { error: 'User not found' } ); return; }
res.json( { email: user.email } );
} );
}
);
// POST /api/auth/lookup-email — server-to-server; requires SERVICE_SECRET
router.post( '/lookup-email', ( req, res ) =>
router.post( '/lookup-email',
( req, res ) =>
{
const secret = process.env.SERVICE_SECRET;
const auth = req.headers.authorization;
@ -260,23 +384,45 @@ router.post( '/lookup-email', ( req, res ) =>
if ( ! secret || auth !== `Bearer ${secret}` )
{
res.status( 401 ).json( { error: 'Unauthorized' } );
return;
}
const { email } = req.body as { email?: string };
if ( !email ) { res.status( 400 ).json( { error: 'Email required' } ); return; }
if ( ! email )
{
res.status( 400 ).json( { error: 'Email required' } );
return;
}
const user = users.findByEmail( email );
if ( !user ) { res.status( 404 ).json( { error: 'No account found for that email' } ); return; }
if ( ! user )
{
res.status( 404 ).json( { error: 'No account found for that email' } );
return;
}
res.json( { id: user.id, email: user.email } );
} );
}
);
// GET /api/auth/me
router.get( '/me', requireAuth, ( req, res ) =>
router.get( '/me', requireAuth,
( req, res ) =>
{
const user = users.findById( req.auth!.userId );
if ( !user ) { res.status( 404 ).json( { error: 'User not found' } ); return; }
if ( !user )
{
res.status( 404 ).json( { error: 'User not found' } );
return;
}
res.json(
{
id: user.id,
@ -284,49 +430,83 @@ router.get( '/me', requireAuth, ( req, res ) =>
roles: user.roles,
products: user.products,
settings: user.settings
} );
} );
}
);
}
);
// PATCH /api/auth/me/settings
router.patch( '/me/settings', requireAuth, ( req, res ) =>
router.patch( '/me/settings', requireAuth,
( req, res ) =>
{
const user = users.findById( req.auth!.userId );
if ( !user ) { res.status( 404 ).json( { error: 'User not found' } ); return; }
if ( ! user )
{
res.status( 404 ).json( { error: 'User not found' } ); return;
}
const settings = { ...user.settings, ...( req.body as Record<string, unknown> ) };
users.update( req.auth!.userId, { settings } );
res.json( { settings } );
} );
}
);
// POST /api/auth/me/password
router.post( '/me/password', requireAuth, async ( req, res ) =>
router.post( '/me/password',
requireAuth, async ( req, res ) =>
{
const { currentPassword, newPassword } = req.body as { currentPassword?: string; newPassword?: string };
if ( ! currentPassword || ! newPassword )
{
res.status( 400 ).json( { error: 'Current and new password required' } );
return;
}
const user = users.findById( req.auth!.userId );
if ( !user ) { res.status( 404 ).json( { error: 'User not found' } ); return; }
if ( !user )
{
res.status( 404 ).json( { error: 'User not found' } );
return;
}
if ( ! ( await bcrypt.compare( currentPassword, user.passwordHash ) ) )
{
res.status( 401 ).json( { error: 'Current password is incorrect' } );
return;
}
const passwordHash = await bcrypt.hash( newPassword, 10 );
users.update( user.id, { passwordHash } );
res.json( { ok: true } );
} );
}
);
// DELETE /api/auth/me
router.delete( '/me', requireAuth, ( req, res ) =>
router.delete( '/me', requireAuth,
( req, res ) =>
{
const userId = req.auth!.userId;
refreshTokens.deleteForUser( userId );
resetTokens.deleteForUser( userId );
users.delete( userId );
clearAuthCookies( res );
res.json( { ok: true } );
} );
}
);
export default router;