KisAssistant 0.2.0: React UI, SQLite accounts, shares, drivers, NixOS module

2026-09-21 11:00:32 +02:00
commit 739c14324a
47 changed files with 8263 additions and 0 deletions
@@ -0,0 +1,115 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { config } from "./config.ts";
+import {
+  createSession,
+  deleteSession,
+  getDb,
+  getSession,
+  getUserById,
+  getUserByUsername,
+  toPublicUser,
+  type PublicUser,
+} from "./db.ts";
+
+// Ensure DB + admin row exist at startup.
+getDb();
+
+export type { PublicUser };
+
+function sha256hex(s: string): string {
+  return createHash("sha256").update(s).digest("hex");
+}
+
+/** Compare two secrets in constant time (via their hashes so lengths match). */
+export function secretsEqual(a: string, bHash: string): boolean {
+  const aHash = sha256hex(a);
+  const ab = Buffer.from(aHash, "utf8");
+  const bb = Buffer.from(bHash, "utf8");
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+
+export function hashSecret(s: string): string {
+  return sha256hex(s);
+}
+
+/** Fresh random per-account access key (No-KYC: admin hands it to the user). Shown only once. */
+export function newAccessKey(): string {
+  return "ka_" + randomBytes(24).toString("base64url");
+}
+
+function checkAdminKey(candidate: string): boolean {
+  const a = createHash("sha256").update(candidate).digest();
+  const b = createHash("sha256").update(config.appPassword).digest();
+  return timingSafeEqual(a, b);
+}
+
+/**
+ * Login with { username, key }.
+ * - username "admin" authenticates against APP_PASSWORD (.env).
+ * - other usernames authenticate against their admin-issued access key.
+ */
+export function login(username: string, key: string): PublicUser | null {
+  if (username === "admin") {
+    if (!checkAdminKey(key)) return null;
+    const admin = getUserByUsername("admin");
+    if (!admin) return null;
+    return toPublicUser(admin);
+  }
+  const u = getUserByUsername(username);
+  if (!u || !u.key_hash) return null;
+  if (!secretsEqual(key, u.key_hash)) return null;
+  return toPublicUser(u);
+}
+
+/** Issue a fresh one-time Bearer token per successful login (stored hashed in SQLite). */
+export function issueToken(user: PublicUser): { token: string; expiresAt: number } {
+  const token = randomBytes(32).toString("hex"); // 256-bit
+  const expiresAt = Date.now() + config.sessionTtlMs;
+  createSession(sha256hex(token), user.id, expiresAt);
+  return { token, expiresAt };
+}
+
+export function verifyToken(token: string): PublicUser | null {
+  const s = getSession(sha256hex(token));
+  if (!s) return null;
+  const u = getUserById(s.user_id);
+  if (!u) {
+    deleteSession(sha256hex(token));
+    return null;
+  }
+  return toPublicUser(u);
+}
+
+export function revokeToken(token: string): void {
+  deleteSession(sha256hex(token));
+}
+
+export function extractBearer(req: Request): string | null {
+  const h = req.headers.get("authorization");
+  if (!h) return null;
+  const m = h.match(/^Bearer\s+(.+)$/i);
+  return m ? m[1]!.trim() : null;
+}
+
+// --- sliding-window rate limiter (per IP) for /api/auth/login ---
+
+const attempts = new Map<string, number[]>();
+
+export function isRateLimited(ip: string): boolean {
+  const now = Date.now();
+  const windowStart = now - config.rateLimitWindowMs;
+  const list = (attempts.get(ip) ?? []).filter((t) => t > windowStart);
+  attempts.set(ip, list);
+  return list.length >= config.rateLimitMax;
+}
+
+export function recordAttempt(ip: string): void {
+  const list = attempts.get(ip) ?? [];
+  list.push(Date.now());
+  attempts.set(ip, list);
+}
+
+export function clearAttempts(ip: string): void {
+  attempts.delete(ip);
+}