Fixed 267U.pre2

2026-07-26 18:25:37 +09:00
parent 50bfaeafdf
commit 317d00a284
1286 changed files with 80222 additions and 1 deletions
@@ -0,0 +1,226 @@
+import * as OTPAuth from "otpauth";
+import signin from "../common/signin.js";
+import config from "../../../config/index.js";
+import { Users, Signins, UserProfiles, UserSecurityKeys, AttestationChallenges } from "../../../models/index.js";
+import { genId } from "../../../misc/gen-id.js";
+import { comparePassword, hashPassword, isOldAlgorithm } from "../../../misc/password.js";
+import { verifyLogin, hash } from "../2fa.js";
+import { randomBytes } from "node:crypto";
+import { IsNull } from "typeorm";
+import { limiter } from "../limiter.js";
+import { getIpHash } from "../../../misc/get-ip-hash.js";
+export default (async (ctx)=>{
+    ctx.set("Access-Control-Allow-Origin", config.url);
+    ctx.set("Access-Control-Allow-Credentials", "true");
+    const body = ctx.request.body;
+    const username = body["username"];
+    const password = body["password"];
+    const token = body["token"];
+    function error(status, error) {
+        ctx.status = status;
+        ctx.body = {
+            error
+        };
+    }
+    try {
+        // not more than 1 attempt per second and not more than 10 attempts per hour
+        await limiter({
+            key: "signin",
+            duration: 60 * 60 * 1000,
+            max: 10,
+            minInterval: 1000
+        }, getIpHash(ctx.ip));
+    } catch (err) {
+        ctx.status = 429;
+        ctx.body = {
+            error: {
+                message: "Too many failed attempts to sign in. Try again later.",
+                code: "TOO_MANY_AUTHENTICATION_FAILURES",
+                id: "22d05606-fbcf-421a-a2db-b32610dcfd1b"
+            }
+        };
+        return;
+    }
+    if (typeof username !== "string") {
+        ctx.status = 400;
+        return;
+    }
+    if (typeof password !== "string") {
+        ctx.status = 400;
+        return;
+    }
+    if (token != null && typeof token !== "string") {
+        ctx.status = 400;
+        return;
+    }
+    // Fetch user
+    const user = await Users.findOneBy({
+        usernameLower: username.toLowerCase(),
+        host: IsNull()
+    });
+    if (user == null) {
+        error(404, {
+            id: "6cc579cc-885d-43d8-95c2-b8c7fc963280"
+        });
+        return;
+    }
+    if (user.isSuspended) {
+        error(403, {
+            id: "e03a5f46-d309-4865-9b69-56282d94e1eb"
+        });
+        return;
+    }
+    const profile = await UserProfiles.findOneByOrFail({
+        userId: user.id
+    });
+    // Compare password
+    const same = await comparePassword(password, profile.password);
+    if (same && isOldAlgorithm(profile.password)) {
+        profile.password = await hashPassword(password);
+        await UserProfiles.save(profile);
+    }
+    async function fail(status, failure) {
+        // Append signin history
+        await Signins.insert({
+            id: genId(),
+            createdAt: new Date(),
+            userId: user.id,
+            ip: ctx.ip,
+            headers: ctx.headers,
+            success: false
+        });
+        error(status || 500, failure || {
+            id: "4e30e80c-e338-45a0-8c8f-44455efa3b76"
+        });
+    }
+    if (!profile.twoFactorEnabled) {
+        if (same) {
+            signin(ctx, user);
+            return;
+        } else {
+            await fail(403, {
+                id: "932c904e-9460-45b7-9ce6-7ed33be7eb2c"
+            });
+            return;
+        }
+    }
+    if (token) {
+        if (!same) {
+            await fail(403, {
+                id: "932c904e-9460-45b7-9ce6-7ed33be7eb2c"
+            });
+            return;
+        }
+        if (profile.twoFactorSecret == null) {
+            throw new Error("Attempted 2FA signin without 2FA enabled.");
+        }
+        const delta = OTPAuth.TOTP.validate({
+            secret: OTPAuth.Secret.fromBase32(profile.twoFactorSecret),
+            digits: 6,
+            token,
+            window: 1
+        });
+        if (delta != null) {
+            signin(ctx, user);
+            return;
+        } else {
+            await fail(403, {
+                id: "cdf1235b-ac71-46d4-a3a6-84ccce48df6f"
+            });
+            return;
+        }
+    } else if (body.credentialId) {
+        if (!(same || profile.usePasswordLessLogin)) {
+            await fail(403, {
+                id: "932c904e-9460-45b7-9ce6-7ed33be7eb2c"
+            });
+            return;
+        }
+        const clientDataJSON = Buffer.from(body.clientDataJSON, "hex");
+        const clientData = JSON.parse(clientDataJSON.toString("utf-8"));
+        const challenge = await AttestationChallenges.findOneBy({
+            userId: user.id,
+            id: body.challengeId,
+            registrationChallenge: false,
+            challenge: hash(clientData.challenge).toString("hex")
+        });
+        if (!challenge) {
+            await fail(403, {
+                id: "2715a88a-2125-4013-932f-aa6fe72792da"
+            });
+            return;
+        }
+        await AttestationChallenges.delete({
+            userId: user.id,
+            id: body.challengeId
+        });
+        if (new Date().getTime() - challenge.createdAt.getTime() >= 5 * 60 * 1000) {
+            await fail(403, {
+                id: "2715a88a-2125-4013-932f-aa6fe72792da"
+            });
+            return;
+        }
+        const securityKey = await UserSecurityKeys.findOneBy({
+            id: Buffer.from(body.credentialId.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("hex")
+        });
+        if (!securityKey) {
+            await fail(403, {
+                id: "66269679-aeaf-4474-862b-eb761197e046"
+            });
+            return;
+        }
+        const isValid = verifyLogin({
+            publicKey: Buffer.from(securityKey.publicKey, "hex"),
+            authenticatorData: Buffer.from(body.authenticatorData, "hex"),
+            clientDataJSON,
+            clientData,
+            signature: Buffer.from(body.signature, "hex"),
+            challenge: challenge.challenge
+        });
+        if (isValid) {
+            signin(ctx, user);
+            return;
+        } else {
+            await fail(403, {
+                id: "93b86c4b-72f9-40eb-9815-798928603d1e"
+            });
+            return;
+        }
+    } else {
+        if (!(same || profile.usePasswordLessLogin)) {
+            await fail(403, {
+                id: "932c904e-9460-45b7-9ce6-7ed33be7eb2c"
+            });
+            return;
+        }
+        const keys = await UserSecurityKeys.findBy({
+            userId: user.id
+        });
+        if (keys.length === 0) {
+            await fail(403, {
+                id: "f27fd449-9af4-4841-9249-1f989b9fa4a4"
+            });
+            return;
+        }
+        // 32 byte challenge
+        const challenge = randomBytes(32).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+        const challengeId = genId();
+        await AttestationChallenges.insert({
+            userId: user.id,
+            id: challengeId,
+            challenge: hash(Buffer.from(challenge, "utf-8")).toString("hex"),
+            createdAt: new Date(),
+            registrationChallenge: false
+        });
+        ctx.body = {
+            challenge,
+            challengeId,
+            securityKeys: keys.map((key)=>({
+                    id: key.id
+                }))
+        };
+        ctx.status = 200;
+        return;
+    }
+// never get here
+});
@@ -0,0 +1,32 @@
+import { UserPendings, UserProfiles } from "../../../models/index.js";
+import { signup } from "../common/signup.js";
+import signin from "../common/signin.js";
+export default (async (ctx)=>{
+    const body = ctx.request.body;
+    const code = body["code"];
+    try {
+        const pendingUser = await UserPendings.findOneByOrFail({
+            code
+        });
+        const { account, secret } = await signup({
+            username: pendingUser.username,
+            passwordHash: pendingUser.password
+        });
+        UserPendings.delete({
+            id: pendingUser.id
+        });
+        const profile = await UserProfiles.findOneByOrFail({
+            userId: account.id
+        });
+        await UserProfiles.update({
+            userId: profile.userId
+        }, {
+            email: pendingUser.email,
+            emailVerified: true,
+            emailVerifyCode: null
+        });
+        signin(ctx, account);
+    } catch (e) {
+        ctx.throw(400, e);
+    }
+});
@@ -0,0 +1,94 @@
+import rndstr from "rndstr";
+import { fetchMeta } from "../../../misc/fetch-meta.js";
+import { verifyHcaptcha, verifyRecaptcha } from "../../../misc/captcha.js";
+import { Users, RegistrationTickets, UserPendings } from "../../../models/index.js";
+import { signup } from "../common/signup.js";
+import config from "../../../config/index.js";
+import { sendEmail } from "../../../services/send-email.js";
+import { genId } from "../../../misc/gen-id.js";
+import { validateEmailForAccount } from "../../../services/validate-email-for-account.js";
+import { hashPassword } from "../../../misc/password.js";
+export default (async (ctx)=>{
+    const body = ctx.request.body;
+    const instance = await fetchMeta(true);
+    // Verify *Captcha
+    // ただしテスト時はこの機構は障害となるため無効にする
+    if (process.env.NODE_ENV !== "test") {
+        if (instance.enableHcaptcha && instance.hcaptchaSecretKey) {
+            await verifyHcaptcha(instance.hcaptchaSecretKey, body["hcaptcha-response"]).catch((e)=>{
+                ctx.throw(400, e);
+            });
+        }
+        if (instance.enableRecaptcha && instance.recaptchaSecretKey) {
+            await verifyRecaptcha(instance.recaptchaSecretKey, body["g-recaptcha-response"]).catch((e)=>{
+                ctx.throw(400, e);
+            });
+        }
+    }
+    const username = body["username"];
+    const password = body["password"];
+    const host = process.env.NODE_ENV === "test" ? body["host"] || null : null;
+    const invitationCode = body["invitationCode"];
+    const emailAddress = body["emailAddress"];
+    if (config.reservedUsernames?.includes(username.toLowerCase())) {
+        ctx.status = 400;
+        return;
+    }
+    if (instance.emailRequiredForSignup) {
+        if (emailAddress == null || typeof emailAddress !== "string") {
+            ctx.status = 400;
+            return;
+        }
+        const { available } = await validateEmailForAccount(emailAddress);
+        if (!available) {
+            ctx.status = 400;
+            return;
+        }
+    }
+    if (instance.disableRegistration) {
+        if (invitationCode == null || typeof invitationCode !== "string") {
+            ctx.status = 400;
+            return;
+        }
+        const ticket = await RegistrationTickets.findOneBy({
+            code: invitationCode
+        });
+        if (ticket == null) {
+            ctx.status = 400;
+            return;
+        }
+        RegistrationTickets.delete(ticket.id);
+    }
+    if (instance.emailRequiredForSignup) {
+        const code = rndstr("a-z0-9", 16);
+        // Generate hash of password
+        const hash = await hashPassword(password);
+        await UserPendings.insert({
+            id: genId(),
+            createdAt: new Date(),
+            code,
+            email: emailAddress,
+            username: username,
+            password: hash
+        });
+        const link = `${config.url}/signup-complete/${code}`;
+        sendEmail(emailAddress, "Signup", `To complete signup, please click this link:<br><a href="${link}">${link}</a>`, `To complete signup, please click this link: ${link}`);
+        ctx.status = 204;
+    } else {
+        try {
+            const { account, secret } = await signup({
+                username,
+                password,
+                host
+            });
+            const res = await Users.pack(account, account, {
+                detail: true,
+                includeSecrets: true
+            });
+            res.token = secret;
+            ctx.body = res;
+        } catch (e) {
+            ctx.throw(400, e);
+        }
+    }
+});
@@ -0,0 +1,26 @@
+import { Users, UserProfiles } from "../../../models/index.js";
+import { publishMainStream } from "../../../services/stream.js";
+export default (async (ctx)=>{
+    const body = ctx.request.body;
+    const code = body["code"];
+    const profile = await UserProfiles.findOneByOrFail({
+        emailVerifyCode: code
+    });
+    if (profile != null) {
+        ctx.body = "Verify succeeded!";
+        await UserProfiles.update({
+            userId: profile.userId
+        }, {
+            emailVerified: true,
+            emailVerifyCode: null
+        });
+        publishMainStream(profile.userId, "meUpdated", await Users.pack(profile.userId, {
+            id: profile.userId
+        }, {
+            detail: true,
+            includeSecrets: true
+        }));
+    } else {
+        ctx.throw(404);
+    }
+});