246 lines
14 KiB
HTML
246 lines
14 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>JSDoc: Source: utils/sessionUtils.js</title>
|
|
|
|
<script src="scripts/prettify/prettify.js"> </script>
|
|
<script src="scripts/prettify/lang-css.js"> </script>
|
|
<!--[if lt IE 9]>
|
|
<script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script>
|
|
<![endif]-->
|
|
<link type="text/css" rel="stylesheet" href="styles/prettify-tomorrow.css">
|
|
<link type="text/css" rel="stylesheet" href="styles/jsdoc-default.css">
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="main">
|
|
|
|
<h1 class="page-title">Source: utils/sessionUtils.js</h1>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<section>
|
|
<article>
|
|
<pre class="prettyprint source linenums"><code>/*Canopy - The next generation of stoner streaming software
|
|
Copyright (C) 2024-2025 Rainbownapkin and the TTN Community
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU Affero General Public License as
|
|
published by the Free Software Foundation, either version 3 of the
|
|
License, or (at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU Affero General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Affero General Public License
|
|
along with this program. If not, see <https://www.gnu.org/licenses/>.*/
|
|
|
|
//Local Imports
|
|
const config = require('../../config.json');
|
|
const {userModel} = require('../schemas/user/userSchema.js');
|
|
const userBanModel = require('../schemas/user/userBanSchema.js')
|
|
const altchaUtils = require('../utils/altchaUtils.js');
|
|
const loggerUtils = require('../utils/loggerUtils.js');
|
|
|
|
/**
|
|
* Create failed sign-in cache since it's easier and more preformant to implement it this way than adding extra burdon to the database
|
|
* Server restarts are far and few between. It would take multiple during a single bruteforce attempt for this to become an issue.
|
|
*/
|
|
const failedAttempts = new Map();
|
|
|
|
/**
|
|
* How many failed attempts required to throttle with altcha
|
|
*/
|
|
const throttleAttempts = 5;
|
|
|
|
/**
|
|
* How many attempts to lock user account out for the day
|
|
*/
|
|
const maxAttempts = 200;
|
|
|
|
/**
|
|
* Sole and Singular Session Authentication method.
|
|
* All logins should happen through here, all other site-wide authentication should happen by sessions authenticated by this model.
|
|
* This is important, as reducing authentication endpoints reduces attack surface.
|
|
* @param {String} user - Username to login as
|
|
* @param {String} pass - Password to authenticat session with
|
|
* @param {express.Request} req - Express request object w/ session to authenticate
|
|
* @returns Username of authticated user upon success
|
|
*/
|
|
module.exports.authenticateSession = async function(user, pass, req){
|
|
//Fuck you yoda
|
|
try{
|
|
//Grab previous attempts
|
|
const attempt = failedAttempts.get(user);
|
|
|
|
//If we're proxied use passthrough IP
|
|
const ip = config.proxied ? req.headers['x-forwarded-for'] : req.ip;
|
|
|
|
//Look for ban by IP
|
|
const ipBanDB = await userBanModel.checkBanByIP(ip);
|
|
|
|
//If this ip is randy bobandy
|
|
if(ipBanDB != null){
|
|
//Make the number a little prettier despite the lack of precision since we're not doing calculations here :P
|
|
const expiration = ipBanDB.getDaysUntilExpiration() < 1 ? 0 : ipBanDB.getDaysUntilExpiration();
|
|
|
|
//If the ban is permanent
|
|
if(ipBanDB.permanent){
|
|
//tell it to fuck off
|
|
throw loggerUtils.exceptionSmith(`The IP address you are trying to login from has been permanently banned. Your cleartext IP has been saved to the database. Any associated accounts will be nuked in ${expiration} day(s).`, "unauthorized");
|
|
}else{
|
|
//tell it to fuck off
|
|
throw loggerUtils.exceptionSmith(`The IP address you are trying to login from has been temporarily banned. Your cleartext IP has been saved to the database until the ban expires in ${expiration} day(s).`, "unauthorized");
|
|
}
|
|
}
|
|
|
|
//If we have failed attempts
|
|
if(attempt != null){
|
|
//If we have more failed attempts than allowed
|
|
if(attempt.count > maxAttempts){
|
|
throw loggerUtils.exceptionSmith("This account has been locked for at 24 hours due to a large amount of failed log-in attempts", "unauthorized");
|
|
}
|
|
|
|
//If we're throttling logins
|
|
if(attempt.count > throttleAttempts){
|
|
//Verification doesnt get sanatized or checked since that would most likely break the cryptography
|
|
//Since we've already got access to the request and dont need to import anything, why bother getting it from a parameter?
|
|
if(req.body.verification == null){
|
|
throw loggerUtils.exceptionSmith("Verification failed!", "unauthorized");
|
|
}else if(!altchaUtils.verify(req.body.verification, user)){
|
|
throw loggerUtils.exceptionSmith("Verification failed!", "");
|
|
}
|
|
}
|
|
}
|
|
|
|
//Authenticate the session
|
|
const userDB = await userModel.authenticate(user, pass);
|
|
|
|
//Check for user ban
|
|
const userBanDB = await userBanModel.checkBanByUserDoc(userDB);
|
|
|
|
//If the user is banned
|
|
if(userBanDB){
|
|
//Make the number a little prettier despite the lack of precision since we're not doing calculations here :P
|
|
const expiration = userBanDB.getDaysUntilExpiration() < 1 ? 0 : userBanDB.getDaysUntilExpiration();
|
|
if(userBanDB.permanent){
|
|
throw loggerUtils.exceptionSmith(`Your account has been permanently banned, and will be nuked from the database in: ${expiration} day(s)`, "unauthorized");
|
|
}else{
|
|
throw loggerUtils.exceptionSmith(`Your account has been temporarily banned, and will be reinstated in: ${expiration} day(s)`, "unauthorized");
|
|
}
|
|
}
|
|
|
|
//Tattoo the session with user and metadata
|
|
//unfortunately store.all() does not return sessions w/ their ID so we had to improvise...
|
|
//Not sure if this is just how connect-mongo is implemented or if it's an express issue, but connect-mongodb-session seems to not implement the all() function what so ever...
|
|
req.session.seshid = req.session.id;
|
|
req.session.authdate = new Date();
|
|
req.session.user = {
|
|
user: userDB.user,
|
|
id: userDB.id,
|
|
rank: userDB.rank
|
|
}
|
|
|
|
//Tattoo hashed IP address to user account for seven days
|
|
userDB.tattooIPRecord(ip);
|
|
|
|
//If we got to here then the log-in was successful. We should clear-out any failed attempts.
|
|
failedAttempts.delete(user);
|
|
|
|
//return user
|
|
return userDB.user;
|
|
}catch(err){
|
|
//Look for previous failed attempts
|
|
var attempt = failedAttempts.get(user);
|
|
|
|
//If this is the first attempt
|
|
if(attempt == null){
|
|
//Create new attempt object
|
|
attempt = {
|
|
count: 1,
|
|
lastAttempt: new Date()
|
|
}
|
|
}else{
|
|
//Create updated attempt object
|
|
attempt = {
|
|
count: attempt.count + 1,
|
|
lastAttempt: new Date()
|
|
}
|
|
}
|
|
|
|
//Commit the failed attempt to the failed sign-in cache
|
|
failedAttempts.set(user, attempt);
|
|
|
|
//y33t
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Logs user out and destroys all server-side traces of a given session
|
|
* @param {express-session.session} session
|
|
*/
|
|
module.exports.killSession = async function(session){
|
|
session.destroy();
|
|
}
|
|
|
|
/**
|
|
* Returns how many failed login attempts within the past day or so since the last login has occured for a given user
|
|
* @param {String} user - User to check map against
|
|
* @returns {Number} of failed login attempts
|
|
*/
|
|
module.exports.getLoginAttempts = function(user){
|
|
//Read the code, i'm not explaining this
|
|
return failedAttempts.get(user);
|
|
}
|
|
|
|
/**
|
|
* Nightly Function Call which iterates through the failed login attempts map, removing any which haven't been attempted in over a da yeahy
|
|
*/
|
|
module.exports.processExpiredAttempts = function(){
|
|
for(user of failedAttempts.keys()){
|
|
//Get attempt by user
|
|
const attempt = failedAttempts.get(user);
|
|
//Check how long its been
|
|
const daysSinceLastAttempt = ((new Date() - attempt.lastAttempt) / (1000 * 60 * 60 * 24)).toFixed(1);
|
|
|
|
//If it's been more than a day since anyones tried to log in as this user
|
|
if(daysSinceLastAttempt >= 1){
|
|
//Clear out the attempts so that they don't need to fuck with a captcha anymore
|
|
failedAttempts.delete(user);
|
|
}
|
|
}
|
|
}
|
|
|
|
module.exports.throttleAttempts = throttleAttempts;
|
|
module.exports.maxAttempts = maxAttempts;</code></pre>
|
|
</article>
|
|
</section>
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
<nav>
|
|
<h2><a href="index.html">Home</a></h2><h3>Classes</h3><ul><li><a href="activeChannel.html">activeChannel</a></li><li><a href="channelManager.html">channelManager</a></li><li><a href="chat.html">chat</a></li><li><a href="chatBuffer.html">chatBuffer</a></li><li><a href="chatHandler.html">chatHandler</a></li><li><a href="commandPreprocessor.html">commandPreprocessor</a></li><li><a href="commandProcessor.html">commandProcessor</a></li><li><a href="connectedUser.html">connectedUser</a></li><li><a href="media.html">media</a></li><li><a href="playlistHandler.html">playlistHandler</a></li><li><a href="queue.html">queue</a></li><li><a href="queuedMedia.html">queuedMedia</a></li><li><a href="tokebot.html">tokebot</a></li></ul><h3>Global</h3><ul><li><a href="global.html#authenticateSession">authenticateSession</a></li><li><a href="global.html#cache">cache</a></li><li><a href="global.html#channelBanSchema">channelBanSchema</a></li><li><a href="global.html#channelPermissionSchema">channelPermissionSchema</a></li><li><a href="global.html#channelSchema">channelSchema</a></li><li><a href="global.html#chatSchema">chatSchema</a></li><li><a href="global.html#comparePassword">comparePassword</a></li><li><a href="global.html#consoleWarn">consoleWarn</a></li><li><a href="global.html#daysToExpire">daysToExpire</a></li><li><a href="global.html#emailChangeSchema">emailChangeSchema</a></li><li><a href="global.html#emoteSchema">emoteSchema</a></li><li><a href="global.html#errorHandler">errorHandler</a></li><li><a href="global.html#errorMiddleware">errorMiddleware</a></li><li><a href="global.html#escapeRegex">escapeRegex</a></li><li><a href="global.html#exceptionHandler">exceptionHandler</a></li><li><a href="global.html#exceptionSmith">exceptionSmith</a></li><li><a href="global.html#failedAttempts">failedAttempts</a></li><li><a href="global.html#fetchMetadata">fetchMetadata</a></li><li><a href="global.html#fetchVideoMetadata">fetchVideoMetadata</a></li><li><a href="global.html#fetchYoutubeMetadata">fetchYoutubeMetadata</a></li><li><a href="global.html#fetchYoutubePlaylistMetadata">fetchYoutubePlaylistMetadata</a></li><li><a href="global.html#flairSchema">flairSchema</a></li><li><a href="global.html#genCaptcha">genCaptcha</a></li><li><a href="global.html#getLoginAttempts">getLoginAttempts</a></li><li><a href="global.html#getMediaType">getMediaType</a></li><li><a href="global.html#hashIP">hashIP</a></li><li><a href="global.html#hashPassword">hashPassword</a></li><li><a href="global.html#kickoff">kickoff</a></li><li><a href="global.html#killSession">killSession</a></li><li><a href="global.html#lifetime">lifetime</a></li><li><a href="global.html#localExceptionHandler">localExceptionHandler</a></li><li><a href="global.html#mailem">mailem</a></li><li><a href="global.html#markLink">markLink</a></li><li><a href="global.html#maxAttempts">maxAttempts</a></li><li><a href="global.html#mediaSchema">mediaSchema</a></li><li><a href="global.html#passwordResetSchema">passwordResetSchema</a></li><li><a href="global.html#permissionSchema">permissionSchema</a></li><li><a href="global.html#playlistMediaProperties">playlistMediaProperties</a></li><li><a href="global.html#playlistSchema">playlistSchema</a></li><li><a href="global.html#processExpiredAttempts">processExpiredAttempts</a></li><li><a href="global.html#queuedProperties">queuedProperties</a></li><li><a href="global.html#rankEnum">rankEnum</a></li><li><a href="global.html#refreshRawLink">refreshRawLink</a></li><li><a href="global.html#schedule">schedule</a></li><li><a href="global.html#securityCheck">securityCheck</a></li><li><a href="global.html#sendAddressVerification">sendAddressVerification</a></li><li><a href="global.html#socketCriticalExceptionHandler">socketCriticalExceptionHandler</a></li><li><a href="global.html#socketErrorHandler">socketErrorHandler</a></li><li><a href="global.html#socketExceptionHandler">socketExceptionHandler</a></li><li><a href="global.html#spent">spent</a></li><li><a href="global.html#statSchema">statSchema</a></li><li><a href="global.html#throttleAttempts">throttleAttempts</a></li><li><a href="global.html#tokeCommandSchema">tokeCommandSchema</a></li><li><a href="global.html#transporter">transporter</a></li><li><a href="global.html#typeEnum">typeEnum</a></li><li><a href="global.html#userBanSchema">userBanSchema</a></li><li><a href="global.html#userSchema">userSchema</a></li><li><a href="global.html#verify">verify</a></li><li><a href="global.html#yankMedia">yankMedia</a></li><li><a href="global.html#ytdlpFetch">ytdlpFetch</a></li></ul>
|
|
</nav>
|
|
|
|
<br class="clear">
|
|
|
|
<footer>
|
|
Documentation generated by <a href="https://github.com/jsdoc/jsdoc">JSDoc 4.0.4</a> on Fri Sep 05 2025 05:55:07 GMT-0400 (Eastern Daylight Time)
|
|
</footer>
|
|
|
|
<script> prettyPrint(); </script>
|
|
<script src="scripts/linenumber.js"> </script>
|
|
</body>
|
|
</html>
|