Initial TicketTracker release

backend/src/auth.ts

@@ -0,0 +1,164 @@
+import crypto from "node:crypto";
+import { promisify } from "node:util";
+import type { NextFunction, Request, Response } from "express";
+import { query } from "./db.js";
+
+const scrypt = promisify(crypto.scrypt);
+const sessionCookieName = "tickettracker_session";
+const sessionMaxAgeMs = Number(process.env.SESSION_MAX_AGE_MS ?? 1000 * 60 * 60 * 24 * 14);
+
+export type UserRole = "admin" | "user";
+
+export type AuthUser = {
+  id: string;
+  username: string;
+  display_name: string;
+  role: UserRole;
+  active: boolean;
+};
+
+declare global {
+  namespace Express {
+    interface Request {
+      user?: AuthUser;
+      authSessionHash?: string;
+    }
+  }
+}
+
+export async function hashPassword(password: string) {
+  const salt = crypto.randomBytes(16).toString("base64url");
+  const key = (await scrypt(password, salt, 64)) as Buffer;
+  return `scrypt$${salt}$${key.toString("base64url")}`;
+}
+
+export async function verifyPassword(password: string, storedHash: string) {
+  const [algorithm, salt, expected] = storedHash.split("$");
+
+  if (algorithm !== "scrypt" || !salt || !expected) {
+    return false;
+  }
+
+  const expectedBuffer = Buffer.from(expected, "base64url");
+  const actualBuffer = (await scrypt(password, salt, expectedBuffer.length)) as Buffer;
+
+  return expectedBuffer.length === actualBuffer.length && crypto.timingSafeEqual(expectedBuffer, actualBuffer);
+}
+
+export function hashToken(token: string) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+
+function readCookie(req: Request, name: string) {
+  const rawCookie = req.headers.cookie;
+
+  if (!rawCookie) {
+    return null;
+  }
+
+  const cookies = rawCookie.split(";").map((part) => part.trim());
+  const prefix = `${name}=`;
+  const match = cookies.find((cookie) => cookie.startsWith(prefix));
+
+  if (!match) {
+    return null;
+  }
+
+  return decodeURIComponent(match.slice(prefix.length));
+}
+
+function publicUser(user: AuthUser) {
+  return {
+    id: user.id,
+    username: user.username,
+    display_name: user.display_name,
+    role: user.role,
+    active: user.active
+  };
+}
+
+export async function createAuthSession(res: Response, userId: string) {
+  const token = crypto.randomBytes(32).toString("base64url");
+  const tokenHash = hashToken(token);
+  const expiresAt = new Date(Date.now() + sessionMaxAgeMs);
+
+  await query(
+    `
+      INSERT INTO auth_sessions (token_hash, user_id, expires_at)
+      VALUES ($1, $2, $3);
+    `,
+    [tokenHash, userId, expiresAt.toISOString()]
+  );
+
+  res.cookie(sessionCookieName, token, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: process.env.COOKIE_SECURE === "true",
+    maxAge: sessionMaxAgeMs,
+    path: "/"
+  });
+}
+
+export async function clearAuthSession(req: Request, res: Response) {
+  if (req.authSessionHash) {
+    await query("DELETE FROM auth_sessions WHERE token_hash = $1;", [req.authSessionHash]);
+  }
+
+  res.clearCookie(sessionCookieName, {
+    sameSite: "lax",
+    secure: process.env.COOKIE_SECURE === "true",
+    path: "/"
+  });
+}
+
+export async function requireAuth(req: Request, res: Response, next: NextFunction) {
+  try {
+    const token = readCookie(req, sessionCookieName);
+
+    if (!token) {
+      res.status(401).json({ error: "Nicht angemeldet" });
+      return;
+    }
+
+    const tokenHash = hashToken(token);
+    const result = await query<AuthUser>(
+      `
+        SELECT u.id, u.username, u.display_name, u.role, u.active
+        FROM auth_sessions s
+        JOIN users u ON u.id = s.user_id
+        WHERE s.token_hash = $1
+          AND s.expires_at > now()
+          AND u.active = true;
+      `,
+      [tokenHash]
+    );
+
+    if (result.rows.length === 0) {
+      res.status(401).json({ error: "Sitzung ist abgelaufen" });
+      return;
+    }
+
+    req.user = publicUser(result.rows[0]);
+    req.authSessionHash = tokenHash;
+    next();
+  } catch (error) {
+    next(error);
+  }
+}
+
+export function requireAdmin(req: Request, res: Response, next: NextFunction) {
+  if (req.user?.role !== "admin") {
+    res.status(403).json({ error: "Adminrechte erforderlich" });
+    return;
+  }
+
+  next();
+}
+
+export function currentUser(req: Request) {
+  if (!req.user) {
+    throw Object.assign(new Error("Nicht angemeldet"), { status: 401 });
+  }
+
+  return req.user;
+}