uptime-kuma/server/auth.js

179 lines
5.2 KiB
JavaScript
Raw Normal View History

2021-10-23 09:35:13 +01:00
const basicAuth = require("express-basic-auth");
2021-07-27 18:47:13 +01:00
const passwordHash = require("./password-hash");
const { R } = require("redbean-node");
2023-06-25 21:49:49 +01:00
const { log } = require("../src/util");
const { loginRateLimiter, apiRateLimiter } = require("./rate-limiter");
const { Settings } = require("./settings");
const dayjs = require("dayjs");
2021-07-27 17:52:31 +01:00
/**
* Login to web app
* @param {string} username Username to login with
* @param {string} password Password to login with
* @returns {Promise<(Bean|null)>} User or null if login failed
2021-07-27 17:52:31 +01:00
*/
exports.login = async function (username, password) {
2022-03-29 10:38:48 +01:00
if (typeof username !== "string" || typeof password !== "string") {
return null;
}
let user = await R.findOne("user", " username = ? AND active = 1 ", [
2021-07-27 18:47:13 +01:00
username,
2021-10-23 09:35:13 +01:00
]);
2021-07-27 17:52:31 +01:00
if (user && passwordHash.verify(password, user.password)) {
// Upgrade the hash to bcrypt
if (passwordHash.needRehash(user.password)) {
await R.exec("UPDATE `user` SET password = ? WHERE id = ? ", [
passwordHash.generate(password),
2021-07-27 18:47:13 +01:00
user.id,
2021-07-27 17:52:31 +01:00
]);
}
return user;
}
2021-07-27 18:47:13 +01:00
return null;
2021-10-23 09:35:13 +01:00
};
2021-07-27 17:52:31 +01:00
/**
* Validate a provided API key
* @param {string} key API key to verify
* @returns {boolean} API is ok?
*/
async function verifyAPIKey(key) {
if (typeof key !== "string") {
return false;
}
// uk prefix + key ID is before _
let index = key.substring(2, key.indexOf("_"));
let clear = key.substring(key.indexOf("_") + 1, key.length);
let hash = await R.findOne("api_key", " id=? ", [ index ]);
if (hash === null) {
return false;
}
let current = dayjs();
let expiry = dayjs(hash.expires);
if (expiry.diff(current) < 0 || !hash.active) {
return false;
}
return hash && passwordHash.verify(clear, hash.key);
}
/**
* Callback for basic auth authorizers
* @callback authCallback
* @param {any} err Any error encountered
* @param {boolean} authorized Is the client authorized?
*/
/**
* Custom authorizer for express-basic-auth
* @param {string} username Username to login with
* @param {string} password Password to login with
* @param {authCallback} callback Callback to handle login result
* @returns {void}
*/
function apiAuthorizer(username, password, callback) {
// API Rate Limit
apiRateLimiter.pass(null, 0).then((pass) => {
if (pass) {
verifyAPIKey(password).then((valid) => {
2023-06-25 21:49:49 +01:00
if (!valid) {
log.warn("api-auth", "Failed API auth attempt: invalid API Key");
}
callback(null, valid);
// Only allow a set number of api requests per minute
// (currently set to 60)
apiRateLimiter.removeTokens(1);
});
} else {
2023-06-25 21:49:49 +01:00
log.warn("api-auth", "Failed API auth attempt: rate limit exceeded");
callback(null, false);
}
});
}
/**
* Custom authorizer for express-basic-auth
* @param {string} username Username to login with
* @param {string} password Password to login with
* @param {authCallback} callback Callback to handle login result
* @returns {void}
*/
function userAuthorizer(username, password, callback) {
// Login Rate Limit
loginRateLimiter.pass(null, 0).then((pass) => {
if (pass) {
exports.login(username, password).then((user) => {
callback(null, user != null);
2021-10-23 09:35:13 +01:00
if (user == null) {
2023-06-25 21:49:49 +01:00
log.warn("basic-auth", "Failed basic auth attempt: invalid username/password");
loginRateLimiter.removeTokens(1);
2021-10-23 09:35:13 +01:00
}
});
} else {
2023-06-25 21:49:49 +01:00
log.warn("basic-auth", "Failed basic auth attempt: rate limit exceeded");
callback(null, false);
2021-10-23 09:35:13 +01:00
}
});
2021-07-27 17:52:31 +01:00
}
/**
* Use basic auth if auth is not disabled
* @param {express.Request} req Express request object
* @param {express.Response} res Express response object
* @param {express.NextFunction} next Next handler in chain
* @returns {Promise<void>}
*/
exports.basicAuth = async function (req, res, next) {
const middleware = basicAuth({
authorizer: userAuthorizer,
authorizeAsync: true,
challenge: true,
});
const disabledAuth = await Settings.get("disableAuth");
if (!disabledAuth) {
middleware(req, res, next);
} else {
next();
}
};
/**
* Use use API Key if API keys enabled, else use basic auth
* @param {express.Request} req Express request object
* @param {express.Response} res Express response object
* @param {express.NextFunction} next Next handler in chain
* @returns {Promise<void>}
*/
exports.apiAuth = async function (req, res, next) {
if (!await Settings.get("disableAuth")) {
let usingAPIKeys = await Settings.get("apiKeysEnabled");
let middleware;
if (usingAPIKeys) {
middleware = basicAuth({
authorizer: apiAuthorizer,
authorizeAsync: true,
challenge: true,
});
} else {
middleware = basicAuth({
authorizer: userAuthorizer,
authorizeAsync: true,
challenge: true,
});
}
middleware(req, res, next);
} else {
next();
}
};