minimal/dashboard
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

finish building login/logout flow

Browse Source
This commit is contained in:
James Brumond 2023-07-29 17:32:16 -07:00
parent 12a2ccaed3
commit 811629eda9
Signed by: james
GPG Key ID: E8F2FC44BAA3357A
8 changed files with 78 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/http-web/authentication/login-page.ts
View File

@ -4,6 +4,7 @@ import { HttpWebDependencies } from '../server';
import { ErrorCode, ErrorInfo } from '../../http/send-error'; import { ErrorCode, ErrorInfo } from '../../http/send-error';
import { redirect_303_see_other } from '../../http/redirects'; import { redirect_303_see_other } from '../../http/redirects';
import { FastifyInstance, FastifyReply, RouteShorthandOptions } from 'fastify'; import { FastifyInstance, FastifyReply, RouteShorthandOptions } from 'fastify';
import { csp_headers } from '../../http/content-security-policy';
export function register_login_page_endpoint(http_server: FastifyInstance, conf: HttpConfig, { pkce_cookie, session }: HttpWebDependencies) { export function register_login_page_endpoint(http_server: FastifyInstance, conf: HttpConfig, { pkce_cookie, session }: HttpWebDependencies) {
const opts: RouteShorthandOptions = { const opts: RouteShorthandOptions = {
@ -24,6 +25,7 @@ export function register_login_page_endpoint(http_server: FastifyInstance, conf:
function send_login_page(res: FastifyReply) { function send_login_page(res: FastifyReply) {
res.status(200); res.status(200);
res.header('content-type', 'text/html; charset=utf-8'); res.header('content-type', 'text/html; charset=utf-8');
csp_headers(res, conf.exposed_url);
session.reset(res); session.reset(res);
pkce_cookie.reset(res); pkce_cookie.reset(res);
return render_login_page(); return render_login_page();

46
src/http-web/root-page.ts Normal file
View File

@ -0,0 +1,46 @@
import { Req } from '../http/request';
import { UserData } from '../storage';
import { HttpConfig } from '../http/server';
import { HttpWebDependencies } from './server';
import { ErrorCode, ErrorInfo } from '../http/send-error';
import { csp_headers } from '../http/content-security-policy';
import { FastifyInstance, RouteShorthandOptions } from 'fastify';
export function register_root_page_endpoint(http_server: FastifyInstance, conf: HttpConfig, { session, logger }: HttpWebDependencies) {
const opts: RouteShorthandOptions = {
schema: { },
};
http_server.get('/', opts, async (req: Req, res) => {
try {
await session.check_login(req);
}
catch (error) {
session.reset(res);
}
res.status(200);
res.header('content-type', 'text/html; charset=utf-8');
csp_headers(res, conf.exposed_url);
return render_root_page(req.session?.user);
});
}
export const render_root_page = (user?: UserData, error_code?: ErrorCode, error?: ErrorInfo) => `<!doctype html>
<html>
<head>
<title>Node.js + TypeScript Service</title>
</head>
<body>
<h1>Node.js + TypeScript Service</h1>
${user
? `<p>Logged in as ${user.name} (${user.username})</p>
<form action="/logout" method="POST">
<button type="submit">Logout</button>
</form>`
: '<a href="/login">Login Page</a>'}
</body>
</html>
`;

6
src/http-web/server.ts
View File

@ -9,9 +9,11 @@ import { BaseHttpDependencies, HttpConfig, create_http_server } from '../http/se
import { SnowflakeProvider } from '../utilities/snowflake-uid'; import { SnowflakeProvider } from '../utilities/snowflake-uid';
import { register_csp_report_endpoint } from '../http/content-security-policy'; import { register_csp_report_endpoint } from '../http/content-security-policy';
import { register_root_page_endpoint } from './root-page';
import { register_login_page_endpoint } from './authentication/login-page'; import { register_login_page_endpoint } from './authentication/login-page';
import { register_submit_login_endpoint } from './authentication/submit-login'; import { register_submit_login_endpoint } from './authentication/submit-login';
import { register_login_callback_endpoint } from './authentication/login-callback'; import { register_login_callback_endpoint } from './authentication/login-callback';
import { register_logout_endpoint } from './authentication/logout';
export interface HttpWebDependencies extends BaseHttpDependencies { export interface HttpWebDependencies extends BaseHttpDependencies {
oidc: OIDCProvider; oidc: OIDCProvider;
@ -27,10 +29,14 @@ export function create_http_web_server(conf: HttpConfig, deps: HttpWebDependenci
endpoints: [ endpoints: [
register_csp_report_endpoint, register_csp_report_endpoint,
// Root page
register_root_page_endpoint,
// Login/logout // Login/logout
register_login_page_endpoint, register_login_page_endpoint,
register_submit_login_endpoint, register_submit_login_endpoint,
register_login_callback_endpoint, register_login_callback_endpoint,
register_logout_endpoint,
], ],
content_parsers: { content_parsers: {
// 'application/ld+json': json_content_parser, // 'application/ld+json': json_content_parser,

5
src/http/server.ts
View File

@ -52,6 +52,11 @@ export function create_http_server<Deps extends BaseHttpDependencies>(conf: Http
endpoint(server, conf, deps); endpoint(server, conf, deps);
} }
// Register content parsers
for (const [ media_type, parser ] of Object.entries(params.content_parsers)) {
parser(server, [ media_type ]);
}
let resolve: () => void; let resolve: () => void;
let status: ServerStatus = 'unstarted'; let status: ServerStatus = 'unstarted';

2
src/security/argon-hash.ts
View File

@ -28,7 +28,7 @@ export function create_argon_hash_provider(conf: Argon2HashConfig) {
parallelism: conf.parallelism, parallelism: conf.parallelism,
}); });
}, },
verify(password: string, hash: string) { verify(hash: string, password: string) {
return verify(hash, password, { return verify(hash, password, {
// //
}); });

18
src/security/session.ts
View File

@ -51,8 +51,8 @@ export function create_session_provider(conf: SessionCookieConfig, logger: pino.
return { prefix, raw_key, full_key }; return { prefix, raw_key, full_key };
}, },
verify_key(key: SessionKey, session: SessionData) : Promise<boolean> { verify_key(key: SessionKey, key_hash: string) : Promise<boolean> {
return argon2.verify(conf.pepper + key.raw_key, session.key_hash); return argon2.verify(key_hash, conf.pepper + key.raw_key);
}, },
write_to_cookie(res: FastifyReply, key: SessionKey) { write_to_cookie(res: FastifyReply, key: SessionKey) {
const session_expire = new Date(Date.now() + (conf.ttl * 1000)); const session_expire = new Date(Date.now() + (conf.ttl * 1000));
@ -65,7 +65,7 @@ export function create_session_provider(conf: SessionCookieConfig, logger: pino.
return { return {
user_id: user_id, user_id: user_id,
prefix: session_key.prefix, prefix: session_key.prefix,
key_hash: await argon2.hash(session_key.raw_key), key_hash: await self.hash_key(session_key),
started: new Date(), started: new Date(),
expires: new Date(Date.now() + (conf.ttl * 1000)), expires: new Date(Date.now() + (conf.ttl * 1000)),
}; };
@ -131,7 +131,17 @@ export function create_session_provider(conf: SessionCookieConfig, logger: pino.
log.debug({ session }, 'found session in store'); log.debug({ session }, 'found session in store');
const key_verified = await self.verify_key(key, session); if (session.expires.getTime() <= Date.now()) {
log.debug('session found, but it has expired');
storage.delete_session(key.prefix).then(() => { }, (error) => {
log.error({ error }, 'failed to delete an expired session');
});
throw new AuthTokenInvalidError();
}
const key_verified = await self.verify_key(key, session.key_hash);
if (! key_verified) { if (! key_verified) {
log.debug('session found, but the key failed verification against key hash'); log.debug('session found, but the key failed verification against key hash');

6
src/storage/sqlite3/v1/sessions.ts
View File

@ -18,7 +18,7 @@ const sql_get_session = `
select select
session.prefix as prefix, session.prefix as prefix,
session.key_hash as key_hash, session.key_hash as key_hash,
session.user_id as user_id, cast(session.user_id as text) as user_id,
session.started as started, session.started as started,
session.expires as expires session.expires as expires
from sessions session from sessions session
@ -57,8 +57,8 @@ export async function create_session(db: DB, data: SessionData) {
data.prefix, data.prefix,
data.key_hash, data.key_hash,
data.user_id, data.user_id,
data.started, data.started.toISOString(),
data.expires, data.expires.toISOString(),
]); ]);
} }

2
src/storage/sqlite3/v1/users.ts
View File

@ -20,7 +20,7 @@ export interface UserRow {
const sql_get_user = ` const sql_get_user = `
select select
user.id as id, cast(user.id as text) as id,
user.username as username, user.username as username,
user.oidc_subject as oidc_subject, user.oidc_subject as oidc_subject,
user.name as name, user.name as name,