You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
345 lines
11 KiB
345 lines
11 KiB
import {
|
|
FastifyInstance,
|
|
Plugin,
|
|
DefaultQuery,
|
|
DefaultParams,
|
|
DefaultHeaders,
|
|
DefaultBody,
|
|
RouteShorthandOptions,
|
|
} from 'fastify'
|
|
|
|
import { Server, IncomingMessage, ServerResponse } from 'http'
|
|
|
|
import { MIN_ID_LENGTH, MAX_ID_LENGTH, MAX_NAME_LENGTH, MIN_PASSWORD_LENGTH } from '../../constants'
|
|
import { tokenResponseSchema, userSchema, errorSchema } from '../../schemas'
|
|
import { createAccessToken, createRefreshToken } from '../../lib/authentication'
|
|
import { hashPassword, verifyPassword, JWT } from '../../lib/crypto'
|
|
import { containerFor, getItem, queryItems, normalize, createQuerySpec } from '../../lib/database'
|
|
import { badRequestError, badRequestFormError, unauthorizedError, serverError } from '../../lib/errors'
|
|
import { tokenFromHeader } from '../../lib/http'
|
|
|
|
import { User, UserToken, Group, GroupInvitation, GroupPartial, GroupMembership } from '../../types/collections'
|
|
|
|
interface PluginOptions {}
|
|
|
|
function registerRoute(server: FastifyInstance<Server, IncomingMessage, ServerResponse>) {
|
|
interface Body {
|
|
id: string
|
|
name: string
|
|
email: string
|
|
password: string
|
|
group?: string
|
|
invitation?: string
|
|
}
|
|
|
|
const options: RouteShorthandOptions = {
|
|
schema: {
|
|
body: {
|
|
type: 'object',
|
|
required: ['id', 'email', 'password'],
|
|
properties: {
|
|
id: {
|
|
type: 'string',
|
|
minLength: MIN_ID_LENGTH,
|
|
maxLength: MAX_ID_LENGTH,
|
|
},
|
|
name: {
|
|
type: 'string',
|
|
maxLength: MAX_NAME_LENGTH,
|
|
},
|
|
email: {
|
|
type: 'string',
|
|
format: 'email',
|
|
},
|
|
password: {
|
|
type: 'string',
|
|
minLength: MIN_PASSWORD_LENGTH,
|
|
},
|
|
group: { type: 'string' },
|
|
invitation: { type: 'string' },
|
|
},
|
|
},
|
|
response: {
|
|
201: tokenResponseSchema,
|
|
400: errorSchema,
|
|
},
|
|
},
|
|
}
|
|
|
|
server.post<DefaultQuery, DefaultParams, DefaultHeaders, Body>('/api/register', options, async (request, reply) => {
|
|
if (!server.database) return serverError(reply)
|
|
|
|
const { name, email, password, invitation } = request.body
|
|
const id = normalize(request.body.id)
|
|
|
|
const userContainer = containerFor(server.database.client, 'Users')
|
|
const groupContainer = containerFor(server.database.client, 'Groups')
|
|
|
|
const existingUser = await getItem<User>({
|
|
container: userContainer,
|
|
id,
|
|
logger: request.log
|
|
})
|
|
|
|
if (existingUser) return badRequestFormError(reply, 'id', 'User id already taken')
|
|
|
|
let userPending = false
|
|
let group: Group | undefined
|
|
let groupPartial: GroupPartial | undefined
|
|
|
|
if (request.body.group) {
|
|
group = await getItem<Group>({
|
|
container: groupContainer,
|
|
id: request.body.group,
|
|
logger: request.log
|
|
})
|
|
|
|
if (!group) return badRequestFormError(reply, 'group', 'Group not found')
|
|
|
|
if (invitation) {
|
|
const invitationQuery = createQuerySpec(`
|
|
SELECT g.id FROM Groups g WHERE
|
|
g.id = @invitation
|
|
g.pk = @group AND
|
|
g.type = 'invitation' AND
|
|
g.active = true AND
|
|
g.expiration < GETCURRENTTIMESTAMP() AND
|
|
g.uses < g.limit
|
|
`, {
|
|
invitation,
|
|
group: group.id,
|
|
})
|
|
|
|
const invitations = await queryItems<GroupInvitation>({
|
|
container: groupContainer,
|
|
query: invitationQuery,
|
|
logger: request.log,
|
|
})
|
|
|
|
if (invitations.length === 0) return badRequestFormError(reply, 'invitation', 'Invalid invitation code')
|
|
}
|
|
|
|
if (!group.open && !invitation) return badRequestFormError(reply, 'group', 'Group registration closed')
|
|
|
|
if (group.requiresApproval) userPending = true
|
|
|
|
groupPartial = {
|
|
id: group.id,
|
|
name: group.name,
|
|
imageUrl: group.imageUrl,
|
|
coverImageUrl: group.coverImageUrl,
|
|
}
|
|
}
|
|
|
|
const user: User = {
|
|
id,
|
|
pk: id,
|
|
t: 'user',
|
|
group: groupPartial,
|
|
name,
|
|
about: '',
|
|
email,
|
|
emailVerified: false,
|
|
passwordHash: await hashPassword(password),
|
|
installations: [],
|
|
awards: 0,
|
|
points: 0,
|
|
balance: 0,
|
|
subscriberCount: 0,
|
|
subscribedCount: 0,
|
|
pending: userPending,
|
|
requiresApproval: false,
|
|
privacy: 'public',
|
|
paid: false,
|
|
active: true,
|
|
created: Date.now(),
|
|
}
|
|
|
|
const refreshToken = createRefreshToken(id, request.headers['user-agent'], request.ip)
|
|
|
|
await userContainer.items.create<User>(user)
|
|
await userContainer.items.create<UserToken>(refreshToken)
|
|
|
|
if (group) {
|
|
await groupContainer.items.create<GroupMembership>({
|
|
pk: group.id,
|
|
t: 'membership',
|
|
userId: user.id,
|
|
pending: userPending,
|
|
membership: 'member',
|
|
invitation,
|
|
created: Date.now(),
|
|
})
|
|
}
|
|
|
|
return {
|
|
id,
|
|
access: await createAccessToken(id),
|
|
refresh: refreshToken.id,
|
|
}
|
|
})
|
|
}
|
|
|
|
function authenticateRoute(server: FastifyInstance<Server, IncomingMessage, ServerResponse>) {
|
|
interface Body {
|
|
id: string
|
|
password: string
|
|
}
|
|
|
|
const options: RouteShorthandOptions = {
|
|
schema: {
|
|
body: {
|
|
type: 'object',
|
|
required: ['id', 'password'],
|
|
properties: {
|
|
id: { type: 'string' },
|
|
password: { type: 'string' },
|
|
},
|
|
},
|
|
response: {
|
|
200: tokenResponseSchema,
|
|
400: errorSchema,
|
|
},
|
|
},
|
|
}
|
|
|
|
server.post<DefaultQuery, DefaultParams, DefaultHeaders, Body>('/api/authenticate', options, async (request, reply) => {
|
|
if (!server.database) return serverError(reply)
|
|
|
|
const container = containerFor(server.database.client, 'Users')
|
|
const id = normalize(request.body.id)
|
|
|
|
const user = await getItem<User>({
|
|
container,
|
|
id,
|
|
logger: request.log
|
|
})
|
|
if (!user) return badRequestFormError(reply, 'id', 'User not found')
|
|
|
|
const result = await verifyPassword(user.passwordHash, request.body.password)
|
|
if (!result) return badRequestFormError(reply, 'password', 'Incorrect password')
|
|
|
|
const refreshToken = createRefreshToken(user.id, request.headers['user-agent'], request.ip)
|
|
await container.items.create(refreshToken)
|
|
|
|
return {
|
|
id,
|
|
access: await createAccessToken(user.id),
|
|
refresh: refreshToken.id,
|
|
}
|
|
})
|
|
}
|
|
|
|
function refreshRoute(server: FastifyInstance<Server, IncomingMessage, ServerResponse>) {
|
|
interface Headers {
|
|
[key: string]: string
|
|
authorization: string
|
|
}
|
|
|
|
interface Body {
|
|
refresh: string
|
|
}
|
|
|
|
const options: RouteShorthandOptions = {
|
|
schema: {
|
|
headers: {
|
|
type: 'object',
|
|
properties: {
|
|
authorization: { type: 'string' },
|
|
},
|
|
},
|
|
body: {
|
|
type: 'object',
|
|
required: ['refresh'],
|
|
properties: {
|
|
refresh: { type: 'string' },
|
|
},
|
|
},
|
|
response: {
|
|
201: tokenResponseSchema,
|
|
400: errorSchema,
|
|
},
|
|
},
|
|
}
|
|
|
|
server.post<DefaultQuery, DefaultParams, Headers, Body>('/api/refresh', options, async (request, reply) => {
|
|
if (!server.database) return serverError(reply)
|
|
|
|
const tokenString = tokenFromHeader(request.headers.authorization)
|
|
if (!tokenString) return badRequestError(reply, 'Access token required')
|
|
|
|
let userId: string | undefined
|
|
|
|
try {
|
|
const tokenData = await JWT.verify(tokenString, {
|
|
ignoreExpiration: true,
|
|
})
|
|
|
|
if (!tokenData.sub) return badRequestError(reply, 'Invalid token')
|
|
if (!tokenData.exp) return badRequestError(reply, 'Invalid token')
|
|
|
|
if ((tokenData.exp * 1000) > Date.now()) return badRequestError(reply, 'Token must be expired')
|
|
userId = tokenData.sub
|
|
} catch (err) {
|
|
request.log.error(err)
|
|
return badRequestError(reply, 'Invalid token')
|
|
}
|
|
|
|
const container = containerFor(server.database.client, 'Users')
|
|
const tokenItem = container.item(request.body.refresh, userId)
|
|
|
|
if (!tokenItem) return badRequestError(reply, 'Invalid refresh token')
|
|
const { resource: token, requestCharge } = await tokenItem.read<UserToken>()
|
|
request.log.trace('Get: %d', requestCharge)
|
|
|
|
if (token.expires < Date.now()) return badRequestError(reply, 'Refresh token expired')
|
|
|
|
await tokenItem.delete()
|
|
|
|
const newRefreshToken = createRefreshToken(userId, request.headers['user-agent'], request.ip)
|
|
await container.items.create(newRefreshToken)
|
|
|
|
reply.code(201)
|
|
|
|
return {
|
|
id: userId,
|
|
access: await createAccessToken(userId),
|
|
refresh: newRefreshToken.id,
|
|
expires: newRefreshToken.expires,
|
|
}
|
|
})
|
|
}
|
|
|
|
function selfRoute(server: FastifyInstance<Server, IncomingMessage, ServerResponse>) {
|
|
const options: RouteShorthandOptions = {
|
|
schema: {
|
|
response: {
|
|
200: userSchema,
|
|
400: errorSchema,
|
|
},
|
|
},
|
|
}
|
|
|
|
server.get<DefaultQuery, DefaultParams, DefaultHeaders, DefaultBody>('/api/self', options, async (request, reply) => {
|
|
if (!server.database) return serverError(reply)
|
|
if (!request.viewer) return unauthorizedError(reply)
|
|
|
|
const viewer = await getItem<User>({
|
|
container: containerFor(server.database.client, 'Users'),
|
|
id: request.viewer.id,
|
|
logger: request.log
|
|
})
|
|
|
|
if (!viewer) return unauthorizedError(reply)
|
|
return viewer
|
|
})
|
|
}
|
|
|
|
const plugin: Plugin<Server, IncomingMessage, ServerResponse, PluginOptions> = async server => {
|
|
registerRoute(server)
|
|
authenticateRoute(server)
|
|
refreshRoute(server)
|
|
selfRoute(server)
|
|
}
|
|
|
|
export default plugin
|