uptime-kuma/server/auth.js

81 lines
2.1 KiB
JavaScript
Raw Normal View History

2021-10-23 11:35:13 +03:00
const basicAuth = require("express-basic-auth");
2021-07-27 20:47:13 +03:00
const passwordHash = require("./password-hash");
const { R } = require("redbean-node");
const { setting } = require("./util-server");
2021-10-23 11:35:13 +03:00
const { loginRateLimiter } = require("./rate-limiter");
2021-07-27 19:52:31 +03:00
/**
* Login to web app
* @param {string} username
* @param {string} password
* @returns {Promise<(Bean|null)>}
2021-07-27 19:52:31 +03:00
*/
exports.login = async function (username, password) {
2022-03-29 12:38:48 +03:00
if (typeof username !== "string" || typeof password !== "string") {
return null;
}
2021-07-27 19:52:31 +03:00
let user = await R.findOne("user", " username = ? AND active = 1 ", [
2021-07-27 20:47:13 +03:00
username,
2021-10-23 11:35:13 +03:00
]);
2021-07-27 19:52:31 +03:00
if (user && passwordHash.verify(password, user.password)) {
// Upgrade the hash to bcrypt
if (passwordHash.needRehash(user.password)) {
await R.exec("UPDATE `user` SET password = ? WHERE id = ? ", [
passwordHash.generate(password),
2021-07-27 20:47:13 +03:00
user.id,
2021-07-27 19:52:31 +03:00
]);
}
return user;
}
2021-07-27 20:47:13 +03:00
return null;
2021-10-23 11:35:13 +03:00
};
2021-07-27 19:52:31 +03:00
/**
* Callback for myAuthorizer
* @callback myAuthorizerCB
* @param {any} err Any error encountered
* @param {boolean} authorized Is the client authorized?
*/
/**
* Custom authorizer for express-basic-auth
* @param {string} username
* @param {string} password
* @param {myAuthorizerCB} callback
*/
2021-07-27 19:52:31 +03:00
function myAuthorizer(username, password, callback) {
// Login Rate Limit
loginRateLimiter.pass(null, 0).then((pass) => {
if (pass) {
exports.login(username, password).then((user) => {
callback(null, user != null);
2021-10-23 11:35:13 +03:00
if (user == null) {
loginRateLimiter.removeTokens(1);
2021-10-23 11:35:13 +03:00
}
});
} else {
callback(null, false);
2021-10-23 11:35:13 +03:00
}
});
2021-07-27 19:52:31 +03:00
}
exports.basicAuth = async function (req, res, next) {
const middleware = basicAuth({
authorizer: myAuthorizer,
authorizeAsync: true,
challenge: true,
});
const disabledAuth = await setting("disableAuth");
if (!disabledAuth) {
middleware(req, res, next);
} else {
next();
}
};