Source: utils/configCheck.js

/*Canopy - The next generation of stoner streaming software
Copyright (C) 2024-2025 Rainbownapkin and the TTN Community

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.*/

//Config
const config = require('../../config.json');

//Local
const loggerUtil = require('./loggerUtils');

//NPM Imports
const validator = require('validator');//We need validators for express-less code too!

/**
 * Basic security check which runs on startup.
 * Warns server admin against unsafe config options.
 */
module.exports.securityCheck = function(){
    //Check Protocol
    if(config.protocol.toLowerCase() != 'https'){
        //If it's insecure then warn the admin
        loggerUtil.consoleWarn("Starting in HTTP mode. This server should be used for development purposes only!");
    }

    //Check mail protocol
    if(!config.mail.secure){
        //If it's insecure then warn the admin
        loggerUtil.consoleWarn("Mail transport security disabled! This server should be used for development purposes only!");
    }

    //check session secret
    if(!validator.isStrongPassword(config.sessionSecret) || config.sessionSecret == "CHANGE_ME"){
        loggerUtil.consoleWarn("Insecure Session Secret! Change Session Secret!");
    }

    //check altcha secret
    if(!validator.isStrongPassword(config.altchaSecret) || config.altchaSecret == "CHANGE_ME"){
        loggerUtil.consoleWarn("Insecure Altcha Secret! Change Altcha Secret!");
    }

    //check ipHash secret
    if(!validator.isStrongPassword(config.ipSecret) || config.ipSecret == "CHANGE_ME"){
        loggerUtil.consoleWarn("Insecure IP Hashing Secret! Change IP Hashing Secret!");
    }

    //check DB pass
    if(!validator.isStrongPassword(config.db.pass) || config.db.pass == "CHANGE_ME" || config.db.pass == config.db.user){
        loggerUtil.consoleWarn("Insecure Database Password! Change Database password!");
    }

    //check email pass
    if(!validator.isStrongPassword(config.mail.pass) || config.mail.pass == "CHANGE_ME"){
        loggerUtil.consoleWarn("Insecure Email Password! Change Email password!");
    }
}