refractor server.js

2026-06-03 15:08:14 -04:00
parent e17a818deb
commit 346ecb217c
20 changed files with 5980 additions and 5947 deletions
@@ -0,0 +1,162 @@
+import rateLimit from 'express-rate-limit'
+import qrcode from 'qrcode'
+import { parseCookies } from '../helpers.js'
+import {
+  isAdminPasswordConfigured,
+  isValidAdminSession,
+  requireAdminAuth,
+  setAdminSessionCookie,
+  clearAdminSessionCookie,
+  createAdminSession,
+  deleteAdminSession,
+  isAdminPasswordValid,
+  isTotpEnabled,
+  loadTotpState,
+  saveTotpState,
+  generateTotpSecret,
+  getTotpUri,
+  verifyTotpCode,
+  generateRecoveryCodes,
+  hashRecoveryCode,
+  consumeRecoveryCode,
+  createPendingSession,
+  consumePendingSession,
+} from '../auth.js'
+
+const ADMIN_SESSION_COOKIE = 'vbn_admin_session'
+
+const loginRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 10,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { message: 'Too many login attempts. Please wait 15 minutes and try again.' },
+  skipSuccessfulRequests: true,
+})
+
+export function register(app) {
+  app.get('/api/admin-auth/status', async (req, res) => {
+    res.json({
+      authenticated: isValidAdminSession(req),
+      configured: isAdminPasswordConfigured(),
+      totpEnabled: await isTotpEnabled(),
+    })
+  })
+
+  app.post('/api/admin-auth/login', loginRateLimiter, async (req, res) => {
+    const password = typeof req.body?.password === 'string' ? req.body.password : ''
+
+    if (!isAdminPasswordConfigured()) {
+      res.status(503).json({ message: 'ADMIN_PASSWORD is not configured on the server.' })
+      return
+    }
+
+    if (!isAdminPasswordValid(password)) {
+      res.status(401).json({ message: 'Invalid password.' })
+      return
+    }
+
+    const totpOn = await isTotpEnabled()
+    if (totpOn) {
+      const pendingToken = createPendingSession()
+      res.json({ totpRequired: true, pendingToken })
+      return
+    }
+
+    const sessionToken = createAdminSession()
+    setAdminSessionCookie(res, sessionToken)
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-auth/totp-verify', loginRateLimiter, async (req, res) => {
+    const { pendingToken, code } = req.body ?? {}
+
+    if (!consumePendingSession(pendingToken)) {
+      res.status(401).json({ message: 'Session expired or invalid. Please sign in again.' })
+      return
+    }
+
+    const totpState = await loadTotpState()
+    if (!totpState?.secret || !totpState?.verified) {
+      res.status(400).json({ message: 'TOTP is not configured.' })
+      return
+    }
+
+    const codeStr = typeof code === 'string' ? code.trim() : ''
+
+    if (verifyTotpCode(totpState.secret, codeStr)) {
+      const sessionToken = createAdminSession()
+      setAdminSessionCookie(res, sessionToken)
+      res.json({ ok: true })
+      return
+    }
+
+    if (consumeRecoveryCode(totpState, codeStr)) {
+      await saveTotpState(totpState)
+      const sessionToken = createAdminSession()
+      setAdminSessionCookie(res, sessionToken)
+      res.json({ ok: true, usedRecoveryCode: true, remainingRecoveryCodes: totpState.hashedRecoveryCodes.length })
+      return
+    }
+
+    res.status(401).json({ message: 'Invalid code. Try again or use a recovery code.' })
+  })
+
+  app.post('/api/admin-auth/totp-setup-init', requireAdminAuth, async (req, res) => {
+    const secret = generateTotpSecret()
+    const uri = getTotpUri(secret)
+    const qrDataUrl = await qrcode.toDataURL(uri)
+    const existing = await loadTotpState()
+    await saveTotpState({ ...existing, secret, verified: false })
+    res.json({ qrDataUrl, secret })
+  })
+
+  app.post('/api/admin-auth/totp-setup-confirm', requireAdminAuth, async (req, res) => {
+    const { code } = req.body ?? {}
+    const totpState = await loadTotpState()
+
+    if (!totpState?.secret) {
+      res.status(400).json({ message: 'No TOTP setup in progress. Call /totp-setup-init first.' })
+      return
+    }
+
+    if (!verifyTotpCode(totpState.secret, typeof code === 'string' ? code.trim() : '')) {
+      res.status(401).json({ message: 'Code incorrect. Scan the QR code again and try once more.' })
+      return
+    }
+
+    const recoveryCodes = generateRecoveryCodes()
+    await saveTotpState({
+      secret: totpState.secret,
+      verified: true,
+      hashedRecoveryCodes: recoveryCodes.map(hashRecoveryCode),
+      enabledAt: new Date().toISOString(),
+    })
+
+    res.json({ ok: true, recoveryCodes })
+  })
+
+  app.post('/api/admin-auth/totp-disable', requireAdminAuth, async (req, res) => {
+    await saveTotpState({ secret: null, verified: false, hashedRecoveryCodes: [], disabledAt: new Date().toISOString() })
+    res.json({ ok: true })
+  })
+
+  app.post('/api/admin-auth/totp-regen-recovery', requireAdminAuth, async (req, res) => {
+    const totpState = await loadTotpState()
+    if (!totpState?.secret || !totpState?.verified) {
+      res.status(400).json({ message: 'TOTP is not enabled.' })
+      return
+    }
+    const recoveryCodes = generateRecoveryCodes()
+    await saveTotpState({ ...totpState, hashedRecoveryCodes: recoveryCodes.map(hashRecoveryCode) })
+    res.json({ ok: true, recoveryCodes })
+  })
+
+  app.post('/api/admin-auth/logout', (req, res) => {
+    const cookies = parseCookies(req.headers.cookie)
+    const sessionToken = cookies[ADMIN_SESSION_COOKIE]
+    deleteAdminSession(sessionToken)
+    clearAdminSessionCookie(res)
+    res.json({ ok: true })
+  })
+}