openhands
5c638cd6bc
- Add DB index on bans.user_id to speed up per-request ban lookups (migration 0008) - Replace in-process rate limiter with Redis-backed implementation with in-memory fallback - Add Redis caching layer for site settings with TTL invalidation (migration 0009) - Add rate limiting to resetPassword to prevent token brute-force attacks - Update all rateLimit callers to await the now-async function - Flesh out RadioContests and RadioGiveaways models with title, description, prize, date, and winner columns - Update radio contest/giveaway pages to display new fields - Add tests for rate limiter (4 tests) and password-reset actions (3 tests) - Add REDIS_URL environment variable (optional, falls back to in-memory)
113 lines
3.8 KiB
TypeScript
113 lines
3.8 KiB
TypeScript
"use server";
|
|
|
|
import { revalidatePath } from "next/cache";
|
|
import { redirect } from "next/navigation";
|
|
import { randomBytes } from "node:crypto";
|
|
import { LaravelEncrypter } from "@/lib/auth/laravel-encrypter";
|
|
import { generateTotpSecret, verifyTotp } from "@/lib/auth/totp";
|
|
import { auth } from "@/lib/auth";
|
|
import { prisma } from "@/lib/prisma";
|
|
import { clientIp, rateLimit } from "@/lib/rate-limit";
|
|
import { env } from "@/env";
|
|
|
|
async function sessionUserId(): Promise<number> {
|
|
const session = await auth();
|
|
if (!session?.user?.id) redirect("/login");
|
|
return Number(session.user.id);
|
|
}
|
|
|
|
function generateRecoveryCodes(): string[] {
|
|
const codes: string[] = [];
|
|
for (let i = 0; i < 8; i++) {
|
|
codes.push(randomBytes(4).toString("hex").toUpperCase().replace(/(.{4})/, "$1-"));
|
|
}
|
|
return codes;
|
|
}
|
|
|
|
/** Verify a TOTP code OR a recovery code. Returns the updated recovery codes (minus used one) if a recovery code was used, or null on failure. */
|
|
async function verifyTwoFactorCode(
|
|
userId: number, code: string,
|
|
): Promise<{ ok: boolean; updatedRecoveryCodes?: string | null }> {
|
|
const user = await prisma.user.findUnique({
|
|
where: { id: userId },
|
|
select: { twoFactorSecret: true, twoFactorRecoveryCodes: true },
|
|
});
|
|
if (!user?.twoFactorSecret) return { ok: false };
|
|
|
|
// Try TOTP first
|
|
try {
|
|
const secret = new LaravelEncrypter(env.APP_KEY as string).decrypt(user.twoFactorSecret);
|
|
if (verifyTotp(code, secret)) return { ok: true };
|
|
} catch { /* fall through to recovery */ }
|
|
|
|
// Try recovery codes
|
|
if (user.twoFactorRecoveryCodes) {
|
|
let codes: string[];
|
|
try { codes = JSON.parse(user.twoFactorRecoveryCodes) as string[]; } catch { codes = []; }
|
|
const idx = codes.indexOf(code);
|
|
if (idx !== -1) {
|
|
codes.splice(idx, 1);
|
|
const remaining = codes.length > 0 ? JSON.stringify(codes) : null;
|
|
return { ok: true, updatedRecoveryCodes: remaining };
|
|
}
|
|
}
|
|
|
|
return { ok: false };
|
|
}
|
|
|
|
/** Step 1: generate a secret and recovery codes, store encrypted but UNconfirmed. */
|
|
export async function beginTwoFactor(): Promise<void> {
|
|
const id = await sessionUserId();
|
|
if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");
|
|
const secret = generateTotpSecret();
|
|
const encrypted = new LaravelEncrypter(env.APP_KEY).encrypt(secret);
|
|
const codes = generateRecoveryCodes();
|
|
await prisma.user.update({
|
|
where: { id },
|
|
data: {
|
|
twoFactorSecret: encrypted,
|
|
twoFactorConfirmedAt: null,
|
|
twoFactorRecoveryCodes: JSON.stringify(codes),
|
|
},
|
|
});
|
|
revalidatePath("/settings/2fa");
|
|
}
|
|
|
|
/** Step 2: verify a code against the pending secret, then confirm and show recovery codes. */
|
|
export async function confirmTwoFactor(formData: FormData): Promise<void> {
|
|
const id = await sessionUserId();
|
|
if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");
|
|
|
|
if (!(await rateLimit(`2fa-confirm:${id}`, 5, 30_000)).ok) redirect("/settings/2fa?error=ratelimit");
|
|
|
|
const code = String(formData.get("code") ?? "").trim();
|
|
|
|
const { ok } = await verifyTwoFactorCode(id, code);
|
|
if (!ok) redirect("/settings/2fa?error=badcode");
|
|
|
|
await prisma.user.update({ where: { id }, data: { twoFactorConfirmedAt: new Date() } });
|
|
redirect("/settings/2fa?enabled=1");
|
|
}
|
|
|
|
export async function disableTwoFactor(formData: FormData): Promise<void> {
|
|
const id = await sessionUserId();
|
|
if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");
|
|
|
|
if (!(await rateLimit(`2fa-disable:${id}`, 5, 30_000)).ok) redirect("/settings/2fa?error=ratelimit");
|
|
|
|
const code = String(formData.get("code") ?? "").trim();
|
|
|
|
const { ok } = await verifyTwoFactorCode(id, code);
|
|
if (!ok) redirect("/settings/2fa?error=badcode");
|
|
|
|
await prisma.user.update({
|
|
where: { id },
|
|
data: {
|
|
twoFactorSecret: null,
|
|
twoFactorRecoveryCodes: null,
|
|
twoFactorConfirmedAt: null,
|
|
},
|
|
});
|
|
redirect("/settings/2fa?disabled=1");
|
|
}
|