Moduletrace/datasquirel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Cookie Expiry Logic

Browse Source
This commit is contained in:
Benjamin Toby
2025-03-23 07:52:28 +01:00
parent 870bc7fd17
commit e829ebd2ed
25 changed files with 289 additions and 345 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package-shared/actions/users/login-user.ts
+5 -3
View File
@@ -12,6 +12,8 @@ import {
PackageUserLoginRequestBody,
} from "../../types";
import debugLog from "../../utils/logging/debug-log";
import numberfy from "../../utils/numberfy";
import grabCookieExpiryDate from "../../utils/grab-cookie-expirt-date";
type Param = {
key?: string;
@@ -65,6 +67,7 @@ export default async function loginUser({
}: Param): Promise<APILoginFunctionReturn> {
const grabedHostNames = grabHostNames({ userId: user_id || apiUserID });
const { host, port, scheme } = grabedHostNames;
const COOKIE_EXPIRY_DATE = grabCookieExpiryDate();
const defaultTempLoginFieldName = "temp_login_code";
const emailLoginTempCodeFieldName = email_login
@@ -117,7 +120,6 @@ export default async function loginUser({
* Initialize HTTP response variable
*/
/** @type {import("../../types").APILoginFunctionReturn} */
let httpResponse: import("../../types").APILoginFunctionReturn = {
success: false,
};
@@ -268,10 +270,10 @@ export default async function loginUser({
}
response?.setHeader("Set-Cookie", [
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true${
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true;Expires=${COOKIE_EXPIRY_DATE}${
secureCookie ? ";Secure=true" : ""
}`,
`${csrfName}=${httpResponse.payload?.csrf_k};samesite=strict;path=/;HttpOnly=true`,
`${csrfName}=${httpResponse.payload?.csrf_k};samesite=strict;path=/;HttpOnly=true;Expires=${COOKIE_EXPIRY_DATE}`,
]);
if (debug) {
package-shared/actions/users/reauth-user.ts
+4 -3
View File
@@ -1,5 +1,4 @@
import http from "http";
import https from "https";
import fs from "fs";
import path from "path";
import encrypt from "../../functions/dsql/encrypt";
@@ -13,6 +12,7 @@ import {
} from "../../functions/backend/auth/write-auth-files";
import getAuthCookieNames from "../../functions/backend/cookies/get-auth-cookie-names";
import { APILoginFunctionReturn } from "../../types";
import grabCookieExpiryDate from "../../utils/grab-cookie-expirt-date";
type Param = {
key?: string;
@@ -51,6 +51,7 @@ export default async function reauthUser({
*/
const grabedHostNames = grabHostNames();
const { host, port, scheme } = grabedHostNames;
const COOKIE_EXPIRY_DATE = grabCookieExpiryDate();
const finalEncryptionKey =
encryptionKey || process.env.DSQL_ENCRYPTION_PASSWORD;
@@ -190,10 +191,10 @@ export default async function reauthUser({
const csrfName = cookieNames.csrfCookieName;
response?.setHeader("Set-Cookie", [
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true${
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true;Expires=${COOKIE_EXPIRY_DATE}${
secureCookie ? ";Secure=true" : ""
}`,
`${csrfName}=${httpResponse.payload?.csrf_k};samesite=strict;path=/;HttpOnly=true`,
`${csrfName}=${httpResponse.payload?.csrf_k};samesite=strict;path=/;HttpOnly=true;Expires=${COOKIE_EXPIRY_DATE}`,
]);
if (httpResponse.csrf) {
package-shared/actions/users/social/github-auth.ts
+4 -2
View File
@@ -4,6 +4,7 @@ import path from "path";
import encrypt from "../../../functions/dsql/encrypt";
import grabHostNames from "../../../utils/grab-host-names";
import apiGithubLogin from "../../../functions/api/users/social/api-github-login";
import grabCookieExpiryDate from "../../../utils/grab-cookie-expirt-date";
interface FunctionReturn {
success: boolean;
@@ -59,6 +60,7 @@ export default async function githubAuth({
*/
const grabedHostNames = grabHostNames();
const { host, port, scheme } = grabedHostNames;
const COOKIE_EXPIRY_DATE = grabCookieExpiryDate();
if (!code || code?.match(/ /)) {
return {
@@ -230,10 +232,10 @@ export default async function githubAuth({
const csrfName = `datasquirel_${dsqlUserId}_${database}_csrf`;
response.setHeader("Set-Cookie", [
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true${
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true;Expires=${COOKIE_EXPIRY_DATE}${
secureCookie ? ";Secure=true" : ""
}`,
`${csrfName}=${user.csrf_k};samesite=strict;path=/;HttpOnly=true`,
`${csrfName}=${user.csrf_k};samesite=strict;path=/;HttpOnly=true;Expires=${COOKIE_EXPIRY_DATE}`,
]);
}
package-shared/actions/users/social/google-auth.ts
+4 -2
View File
@@ -5,6 +5,7 @@ import apiGoogleLogin from "../../../functions/api/users/social/api-google-login
import getAuthCookieNames from "../../../functions/backend/cookies/get-auth-cookie-names";
import { writeAuthFile } from "../../../functions/backend/auth/write-auth-files";
import { APILoginFunctionReturn } from "../../../types";
import grabCookieExpiryDate from "../../../utils/grab-cookie-expirt-date";
type Param = {
key?: string;
@@ -40,6 +41,7 @@ export default async function googleAuth({
userId: apiUserID || process.env.DSQL_API_USER_ID,
});
const { host, port, scheme, user_id } = grabedHostNames;
const COOKIE_EXPIRY_DATE = grabCookieExpiryDate();
const finalEncryptionKey =
encryptionKey || process.env.DSQL_ENCRYPTION_PASSWORD;
@@ -194,10 +196,10 @@ export default async function googleAuth({
const csrfName = cookieNames.csrfCookieName;
response?.setHeader("Set-Cookie", [
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true${
`${authKeyName}=${encryptedPayload};samesite=strict;path=/;HttpOnly=true;;Expires=${COOKIE_EXPIRY_DATE}${
secureCookie ? ";Secure=true" : ""
}`,
`${csrfName}=${httpResponse.payload?.csrf_k};samesite=strict;path=/;HttpOnly=true`,
`${csrfName}=${httpResponse.payload?.csrf_k};samesite=strict;path=/;HttpOnly=true;;Expires=${COOKIE_EXPIRY_DATE}`,
]);
}
package-shared/shell/mariadb-users/handleGrants.ts
-3
View File
@@ -70,9 +70,6 @@ export default async function handleGrants({
}
}
/**
* @type {GrantType[]}
*/
const grantsArray: GrantType[] = grants;
for (let i = 0; i < grantsArray.length; i++) {
package-shared/shell/mariadb-users/refreshUsersAndGrants.ts
+56 -178
View File
@@ -1,15 +1,11 @@
import path from "path";
require("dotenv").config({ path: path.resolve(__dirname, "../../../.env") });
import generator from "generate-password";
import noDatabaseDbHandler from "../utils/noDatabaseDbHandler";
import dbHandler from "../utils/dbHandler";
import handleGrants, { GrantType } from "./handleGrants";
import handleGrants from "./handleGrants";
import encrypt from "../../functions/dsql/encrypt";
import decrypt from "../../functions/dsql/decrypt";
import { MYSQL_mariadb_users_table_def } from "../../types";
const defaultMariadbUserHost = process.env.DSQL_DB_HOST || "127.0.0.1";
import { DSQL_DATASQUIREL_MARIADB_USERS } from "@/package-shared/types/dsql";
import { MariaDBUser } from "@/package-shared/types";
type Param = {
userId?: number | string;
@@ -39,53 +35,38 @@ export default async function refreshUsersAndGrants({
? userId == Number(process.env.DSQL_SU_USER_ID)
: false;
const isWildcardHost = mariadbUserHost == "%";
if (isWildcardHost && !isRootUser) {
return;
}
for (let i = 0; i < mariadbUsers.length; i++) {
const mariadbUser = mariadbUsers[i];
const mariadbUser = mariadbUsers[i] as
| DSQL_DATASQUIREL_MARIADB_USERS
| undefined;
if (!mariadbUser) continue;
if (userId && mariadbUser.user_id != userId) continue;
if (sqlUserID && mariadbUser.id != sqlUserID) continue;
try {
const { mariadb_user, mariadb_host, mariadb_pass, user_id } =
mariadbUser;
const { username, password, host, user_id } = mariadbUser;
const existingUser = await noDatabaseDbHandler(
`SELECT * FROM mysql.user WHERE User = '${mariadb_user}' AND Host = '${mariadb_host}'`
`SELECT * FROM mysql.user WHERE User = '${username}' AND Host = '${host}'`
);
const existingMariaDBUserArray =
userId && sqlUserID
? await dbHandler({
query: `SELECT * FROM mariadb_users WHERE id = ? AND user_id = ?`,
values: [sqlUserID, userId],
})
: null;
const activeMariadbUserObject:
| import("../../types").MYSQL_mariadb_users_table_def
| undefined = Array.isArray(existingMariaDBUserArray)
? existingMariaDBUserArray?.[0]
: undefined;
const isPrimary = activeMariadbUserObject
? String(activeMariadbUserObject.primary)?.match(/1/)
? true
: false
: false;
const isUserExisting = Boolean(existingUser?.[0]?.User);
const isThisPrimaryHost = Boolean(
mariadbUserHost == defaultMariadbUserHost
);
const isPrimary = String(mariadbUser.primary)?.match(/1/)
? true
: false;
const dslUsername = isRootUser
? mariadbUsername
: `dsql_user_${user_id}`;
const dsqlPassword = activeMariadbUserObject?.password
? activeMariadbUserObject.password
: isUserExisting
? mariadb_pass
const dsqlPassword = mariadbUser?.password
? decrypt({ encryptedString: mariadbUser.password })
: isUserExisting && password
? decrypt({ encryptedString: password })
: generator.generate({
length: 16,
numbers: true,
@@ -94,160 +75,57 @@ export default async function refreshUsersAndGrants({
exclude: "*#.'`\"",
});
const encryptedPassword = activeMariadbUserObject?.password
? activeMariadbUserObject.password
const encryptedPassword = mariadbUser?.password
? mariadbUser.password
: isUserExisting
? mariadb_pass
: encrypt({
data: dsqlPassword,
encryptionKey: process.env.DSQL_ENCRYPTION_PASSWORD,
encryptionSalt: process.env.DSQL_ENCRYPTION_SALT,
});
? password
: encrypt({ data: dsqlPassword });
if (!isUserExisting) {
if (isWildcardHost) {
const _existingUsers = (await noDatabaseDbHandler(
`SELECT * FROM mysql.user WHERE user='${mariadbUsername}'`
)) as MariaDBUser[];
for (let i = 0; i < _existingUsers.length; i++) {
const exUsr = _existingUsers[i];
await noDatabaseDbHandler(
`DROP USER '${exUsr.User}'@'${exUsr.Host}'`
);
}
}
if (
!isUserExisting &&
!sqlUserID &&
!isPrimary &&
!mariadbUserHost &&
!mariadbUsername
) {
const createNewUser = await noDatabaseDbHandler(
`CREATE USER IF NOT EXISTS '${dslUsername}'@'${defaultMariadbUserHost}' IDENTIFIED BY '${dsqlPassword}'`
);
console.log("createNewUser", createNewUser);
console.log(
`User ${mariadbUser.id}: ${mariadbUser.first_name} ${mariadbUser.last_name} SQL credentials successfully updated.`
);
const updateUser = await dbHandler({
query: `UPDATE users SET mariadb_user = ?, mariadb_host = ?, mariadb_pass = ? WHERE id = ?`,
values: [
dslUsername,
defaultMariadbUserHost,
encryptedPassword,
mariadbUser.id,
],
});
} else if (!isUserExisting && mariadbUserHost) {
const createNewUser = await noDatabaseDbHandler(
`CREATE USER IF NOT EXISTS '${dslUsername}'@'${mariadbUserHost}' IDENTIFIED BY '${dsqlPassword}'`
`CREATE USER IF NOT EXISTS '${mariadbUsername}'@'${mariadbUserHost}' IDENTIFIED BY '${dsqlPassword}'`
);
}
if (isPrimary) {
const finalHost = mariadbUserHost
? mariadbUserHost
: mariadb_host;
const updateUser = await dbHandler({
query: `UPDATE users SET mariadb_user = ?, mariadb_host = ?, mariadb_pass = ? WHERE id = ?`,
values: [
dslUsername,
finalHost,
mariadbUsername,
mariadbUserHost,
encryptedPassword,
mariadbUser.id,
],
});
}
//////////////////////////////////////////////
//////////////////////////////////////////////
//////////////////////////////////////////////
/**
* @description Handle mariadb_users table
*/
const existingMariadbPrimaryUser = await dbHandler({
query: `SELECT * FROM mariadb_users WHERE user_id = ? AND \`primary\` = 1`,
values: [user_id],
});
const isPrimaryUserExisting = Boolean(
Array.isArray(existingMariadbPrimaryUser) &&
existingMariadbPrimaryUser?.[0]?.user_id
);
const primaryUserGrants: GrantType[] = [
{
database: "*",
table: "*",
privileges: ["ALL"],
},
];
if (!isPrimaryUserExisting) {
const insertPrimaryMariadbUser = await dbHandler({
query: `INSERT INTO mariadb_users (user_id, username, password, \`primary\`, grants) VALUES (?, ?, ?, ?, ?)`,
values: [
user_id,
dslUsername,
encryptedPassword,
"1",
JSON.stringify(primaryUserGrants),
],
});
}
//////////////////////////////////////////////
const existingExtraMariadbUsers = await dbHandler({
query: `SELECT * FROM mariadb_users WHERE user_id = ? AND \`primary\` != '1'`,
values: [user_id],
const isGrantHandled = await handleGrants({
username: mariadbUser.username,
host: mariadbUser.host,
grants:
mariadbUser.grants && typeof mariadbUser.grants == "string"
? JSON.parse(mariadbUser.grants)
: [],
userId: String(user_id),
});
if (Array.isArray(existingExtraMariadbUsers)) {
for (let i = 0; i < existingExtraMariadbUsers.length; i++) {
const _mariadbUser = existingExtraMariadbUsers[
i
] as MYSQL_mariadb_users_table_def;
if (
_mariadbUser &&
_mariadbUser.username != mariadbUsername
)
continue;
if (mariadbUserHost && _mariadbUser.host != mariadbUserHost)
continue;
const decrptedPassword = decrypt({
encryptedString: _mariadbUser.password || "",
encryptionKey: process.env.DSQL_ENCRYPTION_PASSWORD,
encryptionSalt: process.env.DSQL_ENCRYPTION_SALT,
});
const existingExtraMariadbUser = await noDatabaseDbHandler(
`SELECT * FROM mysql.user WHERE User='${_mariadbUser.username}' AND Host='${_mariadbUser.host}'`
);
const isExtraMariadbUserExisting = Boolean(
existingExtraMariadbUser?.[0]?.User
);
if (!isExtraMariadbUserExisting) {
await noDatabaseDbHandler(
`CREATE USER IF NOT EXISTS '${_mariadbUser.username}'@'${_mariadbUser.host}' IDENTIFIED BY '${decrptedPassword}'`
);
}
const isGrantHandled = await handleGrants({
username: _mariadbUser.username,
host: _mariadbUser.host,
grants:
_mariadbUser.grants &&
typeof _mariadbUser.grants == "string"
? JSON.parse(_mariadbUser.grants)
: [],
userId: String(userId),
});
if (!isGrantHandled) {
console.log(
`Error in handling grants for user ${_mariadbUser.username}@${_mariadbUser.host}`
);
}
}
if (!isGrantHandled) {
console.log(
`Error in handling grants for user ${mariadbUser.username}@${mariadbUser.host}`
);
}
} catch (error: any) {
global.ERROR_CALLBACK?.(
package-shared/types/index.ts
+50
View File
@@ -1525,3 +1525,53 @@ export type DsqlCrudParam<
};
export type ErrorCallback = (title: string, error: Error, data?: any) => void;
export interface MariaDBUser {
Host: string;
User: string;
Password: string;
Select_priv: string;
Insert_priv: string;
Update_priv: string;
Delete_priv: string;
Create_priv: string;
Drop_priv: string;
Reload_priv: string;
Shutdown_priv: string;
Process_priv: string;
File_priv: string;
Grant_priv: string;
References_priv: string;
Index_priv: string;
Alter_priv: string;
Show_db_priv: string;
Super_priv: string;
Create_tmp_table_priv: string;
Lock_tables_priv: string;
Execute_priv: string;
Repl_slave_priv: string;
Repl_client_priv: string;
Create_view_priv: string;
Show_view_priv: string;
Create_routine_priv: string;
Alter_routine_priv: string;
Create_user_priv: string;
Event_priv: string;
Trigger_priv: string;
Create_tablespace_priv: string;
Delete_history_priv: string;
ssl_type: string;
ssl_cipher: string;
x509_issuer: string;
x509_subject: string;
max_questions: number;
max_updates: number;
max_connections: number;
max_user_connections: number;
plugin: string;
authentication_string: string;
password_expired: string;
is_role: string;
default_role: string;
max_statement_time: number;
}
package-shared/utils/backend/export-mariadb-database.ts
+1 -1
View File
@@ -26,7 +26,7 @@ export default function exportMariadbDatabase({
const finalMariadbHost = mariadbHost || process.env.DSQL_DB_HOST;
const finalMariadbPass = mariadbPass || process.env.DSQL_DB_PASSWORD;
const cmd = `${mysqlDumpPath} -u ${finalMariadbUser} -h ${finalMariadbHost} -p${finalMariadbPass} ${dbFullName} > ${targetFilePath}`;
const cmd = `${mysqlDumpPath} -u ${finalMariadbUser} -h ${finalMariadbHost} -p"${finalMariadbPass}" ${dbFullName} > ${targetFilePath}`;
let execSyncOptions: ExecSyncOptions = {
encoding: "utf-8",
package-shared/utils/backend/import-mariadb-database.ts
+1 -1
View File
@@ -32,7 +32,7 @@ export default async function importMariadbDatabase({
`CREATE DATABASE IF NOT EXISTS ${dbFullName}`
);
const cmd = `${mysqlPath} -u ${finalMariadbUser} -h ${finalMariadbHost} -p${finalMariadbPass} ${dbFullName} < ${targetFilePath}`;
const cmd = `${mysqlPath} -u ${finalMariadbUser} -h ${finalMariadbHost} -p"${finalMariadbPass}" ${dbFullName} < ${targetFilePath}`;
let execSyncOptions: ExecSyncOptions = {
encoding: "utf-8",
package-shared/utils/backend/names/grab-dir-names.ts
+7
View File
@@ -73,7 +73,13 @@ export default function grabDirNames(param?: Param) {
const dockerComposeFile = path.join(appDir, "docker-compose.yml");
const testDockerComposeFile = path.join(appDir, "test.docker-compose.yml");
const extraDockerComposeFile = path.join(
appDir,
"extra.docker-compose.yml"
);
const siteSetupFile = path.join(appDir, "site-setup.json");
const envFile = path.join(appDir, ".env");
const testEnvFile = path.join(appDir, "test.env");
@@ -99,6 +105,7 @@ export default function grabDirNames(param?: Param) {
dbNginxLoadBalancerConfigFile,
dockerComposeFile,
testDockerComposeFile,
extraDockerComposeFile,
siteSetupFile,
envFile,
testEnvFile,
package-shared/utils/grab-cookie-expirt-date.ts
+18
View File
@@ -0,0 +1,18 @@
import numberfy from "./numberfy";
export default function grabCookieExpiryDate() {
const ONE_DAY_IN_SECONDS = 60 * 60 * 24;
const ONE_WEEK_IN_SECONDS = ONE_DAY_IN_SECONDS * 7;
const COOKIE_EXPIRY_TIME_IN_SECONDS = process.env.DSQL_SESSION_EXPIRY_TIME
? numberfy(process.env.DSQL_SESSION_EXPIRY_TIME)
: ONE_WEEK_IN_SECONDS;
const COOKIE_EXPIRY_IN_MILLISECONDS = COOKIE_EXPIRY_TIME_IN_SECONDS * 1000;
const COOKIE_EXPIRY_DATE = new Date(
Date.now() + COOKIE_EXPIRY_IN_MILLISECONDS
).toUTCString();
return COOKIE_EXPIRY_DATE;
}