164 lines
11 KiB
JavaScript
164 lines
11 KiB
JavaScript
import { cloudApi } from "./cloud-state.js";
|
|
|
|
const TABLES = {
|
|
memories: "lifeos_memories", goals: "lifeos_goals", tasks: "lifeos_tasks",
|
|
museum: "lifeos_favorites", profile: "lifeos_meta",
|
|
settings: "lifeos_meta", system: "lifeos_meta"
|
|
};
|
|
const META = new Set(["profile", "settings", "system"]);
|
|
const DURATION = 20 * 60 * 1000;
|
|
const ITERATIONS = 210_000;
|
|
const body = (value, status = 200) => Response.json(value, { status, headers: { "cache-control": "no-store" } });
|
|
const validId = value => typeof value === "string" && value.length > 0 && value.length <= 200;
|
|
const hash = async value => [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value)))].map(byte => byte.toString(16).padStart(2, "0")).join("");
|
|
const secureEqual = (first, second) => {
|
|
if (typeof first !== "string" || typeof second !== "string" || first.length !== second.length) return false;
|
|
let difference = 0;
|
|
for (let i = 0; i < first.length; i++) difference |= first.charCodeAt(i) ^ second.charCodeAt(i);
|
|
return difference === 0;
|
|
};
|
|
const hex = bytes => [...bytes].map(byte => byte.toString(16).padStart(2, "0")).join("");
|
|
const unhex = value => Uint8Array.from(value.match(/../g).map(pair => parseInt(pair, 16)));
|
|
async function derive(password, salt, iterations = ITERATIONS) {
|
|
const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
|
|
return hex(new Uint8Array(await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: unhex(salt), iterations }, key, 256)));
|
|
}
|
|
const validPassword = value => typeof value === "string" && value.length >= 12 && value.length <= 256;
|
|
const salt = () => hex(crypto.getRandomValues(new Uint8Array(16)));
|
|
const token = () => {
|
|
const bytes = crypto.getRandomValues(new Uint8Array(32));
|
|
return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
|
};
|
|
async function signedIn(request, db, userId) {
|
|
const raw = request.headers.get("x-lifeos-admin-session");
|
|
if (!raw || raw.length > 100) return false;
|
|
const record = await db.prepare("SELECT s.expires_at FROM lifeos_admin_sessions s JOIN lifeos_admin_credentials c ON c.user_id = s.user_id WHERE s.token_hash = ? AND s.user_id = ?").bind(await hash(raw), userId).first();
|
|
return !!record && record.expires_at > Date.now();
|
|
}
|
|
function originAllowed(request) {
|
|
const origin = request.headers.get("origin");
|
|
return !origin || origin === new URL(request.url).origin;
|
|
}
|
|
async function readInput(request) {
|
|
const text = await request.text();
|
|
if (text.length > 2048) return null;
|
|
try { return JSON.parse(text); } catch { return null; }
|
|
}
|
|
async function newSession(db, userId) {
|
|
const raw = token(), expiresAt = Date.now() + DURATION;
|
|
await db.prepare("INSERT INTO lifeos_admin_sessions(token_hash, user_id, expires_at) VALUES (?, ?, ?)").bind(await hash(raw), userId, expiresAt).run();
|
|
return body({ token: raw, expiresAt });
|
|
}
|
|
async function setup(request, db, userId) {
|
|
const input = await readInput(request);
|
|
if (input?.acknowledged !== true || input.username !== "lifeos-admin" || !validPassword(input.password)) return body({ error: "Invalid setup" }, 400);
|
|
const newSalt = salt(), passwordHash = await derive(input.password, newSalt);
|
|
const result = await db.prepare("INSERT INTO lifeos_admin_credentials(user_id, salt, password_hash, iterations, updated_at) VALUES (?, ?, ?, ?, ?) ON CONFLICT DO NOTHING")
|
|
.bind(userId, newSalt, passwordHash, ITERATIONS, new Date().toISOString()).run();
|
|
if (!result.meta.changes) return body({ error: "Password already configured" }, 409);
|
|
await db.prepare("DELETE FROM lifeos_admin_sessions WHERE user_id = ?").bind(userId).run();
|
|
await db.prepare("DELETE FROM lifeos_admin_attempts WHERE user_id = ?").bind(userId).run();
|
|
return newSession(db, userId);
|
|
}
|
|
async function login(request, env, userId) {
|
|
const credential = await env.DB.prepare("SELECT salt, password_hash, iterations FROM lifeos_admin_credentials WHERE user_id = ?").bind(userId).first();
|
|
if (!credential) return body({ error: "Set your password first" }, 409);
|
|
const row = await env.DB.prepare("SELECT failures, locked_until FROM lifeos_admin_attempts WHERE user_id = ?").bind(userId).first();
|
|
if (row?.locked_until > Date.now()) return body({ error: "Too many attempts", retryAt: row.locked_until }, 429);
|
|
const input = await readInput(request);
|
|
if (input?.acknowledged !== true) return body({ error: "Direct database access must be acknowledged" }, 400);
|
|
const matched = input.username === "lifeos-admin" && validPassword(input.password) &&
|
|
secureEqual(await derive(input.password, credential.salt, credential.iterations), credential.password_hash);
|
|
if (!matched) {
|
|
const failures = (row?.failures || 0) + 1, until = failures >= 5 ? Date.now() + 15 * 60_000 : 0;
|
|
await env.DB.prepare("INSERT INTO lifeos_admin_attempts(user_id, failures, locked_until) VALUES (?, ?, ?) ON CONFLICT(user_id) DO UPDATE SET failures = excluded.failures, locked_until = excluded.locked_until").bind(userId, failures >= 5 ? 0 : failures, until).run();
|
|
return body({ error: "Invalid credentials", retryAt: until || null }, 401);
|
|
}
|
|
await env.DB.prepare("DELETE FROM lifeos_admin_attempts WHERE user_id = ?").bind(userId).run();
|
|
return newSession(env.DB, userId);
|
|
}
|
|
async function changePassword(request, db, userId) {
|
|
const input = await readInput(request);
|
|
if (!validPassword(input?.currentPassword) || !validPassword(input?.newPassword)) return body({ error: "Invalid password" }, 400);
|
|
const credential = await db.prepare("SELECT salt, password_hash, iterations FROM lifeos_admin_credentials WHERE user_id = ?").bind(userId).first();
|
|
if (!credential || !secureEqual(await derive(input.currentPassword, credential.salt, credential.iterations), credential.password_hash))
|
|
return body({ error: "Current password is incorrect" }, 401);
|
|
if (input.newPassword === input.currentPassword) return body({ error: "Choose a different password" }, 400);
|
|
const newSalt = salt(), passwordHash = await derive(input.newPassword, newSalt);
|
|
await db.batch([
|
|
db.prepare("UPDATE lifeos_admin_credentials SET salt = ?, password_hash = ?, iterations = ?, updated_at = ? WHERE user_id = ?")
|
|
.bind(newSalt, passwordHash, ITERATIONS, new Date().toISOString(), userId),
|
|
db.prepare("DELETE FROM lifeos_admin_sessions WHERE user_id = ?").bind(userId)
|
|
]);
|
|
return newSession(db, userId);
|
|
}
|
|
async function list(db, userId, kind, page) {
|
|
const table = TABLES[kind], offset = page * 50;
|
|
const filter = META.has(kind) ? "user_id = ? AND kind = ?" : "user_id = ? AND deleted_at IS NULL";
|
|
const bindings = META.has(kind) ? [userId, kind] : [userId];
|
|
const rows = await db.prepare(`SELECT ${META.has(kind) ? "kind" : "id"} AS id, value_json, revision, updated_at FROM ${table} WHERE ${filter} ORDER BY updated_at DESC LIMIT 50 OFFSET ?`).bind(...bindings, offset).all();
|
|
const count = await db.prepare(`SELECT COUNT(*) AS total FROM ${table} WHERE ${filter}`).bind(...bindings).first();
|
|
return body({ rows: rows.results.map(row => ({
|
|
id: row.id, value: JSON.parse(row.value_json), revision: row.revision, updatedAt: row.updated_at
|
|
})), total: count.total, page });
|
|
}
|
|
async function mutate(request, env, userId, kind, id, method) {
|
|
if (!validId(id) || (META.has(kind) && id !== kind)) return body({ error: "Invalid record ID" }, 400);
|
|
let input = {};
|
|
if (method !== "DELETE") {
|
|
const text = await request.text();
|
|
if (text.length > 1_100_000) return body({ error: "Record is too large" }, 413);
|
|
try { input = JSON.parse(text); } catch { return body({ error: "Invalid JSON" }, 400); }
|
|
} else {
|
|
input.baseVersion = Number(new URL(request.url).searchParams.get("version"));
|
|
}
|
|
const baseVersion = input.baseVersion;
|
|
if (!Number.isInteger(baseVersion) || baseVersion < 0 || (method !== "POST" && baseVersion === 0)) return body({ error: "Invalid revision" }, 400);
|
|
if (method === "POST" && baseVersion !== 0) return body({ error: "New records start at revision zero" }, 400);
|
|
if (method === "DELETE" && META.has(kind)) {
|
|
const result = await env.DB.prepare("DELETE FROM lifeos_meta WHERE user_id = ? AND kind = ? AND revision = ?").bind(userId, kind, baseVersion).run();
|
|
return result.meta.changes ? body({ ok: true }) : body({ error: "Conflict" }, 409);
|
|
}
|
|
if (method !== "DELETE" && (!input.value || typeof input.value !== "object" || Array.isArray(input.value) ||
|
|
(!META.has(kind) && input.value.id !== id))) return body({ error: "Invalid record JSON" }, 400);
|
|
return cloudApi(new Request(new URL("/api/lifeos-sync", request.url), {
|
|
method: "POST", headers: { "content-type": "application/json" },
|
|
body: JSON.stringify({ kind, id, baseVersion, value: method === "DELETE" ? null : input.value })
|
|
}), env, userId, "/api/lifeos-sync");
|
|
}
|
|
export async function dbAdminApi(request, env, userId, pathname) {
|
|
if (!userId) return body({ error: "Authentication required" }, 401);
|
|
if (!env.DB) return body({ error: "Database unavailable" }, 503);
|
|
if (!originAllowed(request)) return body({ error: "Origin rejected" }, 403);
|
|
const segments = pathname.slice("/api/db-admin".length).split("/").filter(Boolean);
|
|
try {
|
|
if (segments[0] === "config" && segments.length === 1 && request.method === "GET") {
|
|
const credential = await env.DB.prepare("SELECT user_id FROM lifeos_admin_credentials WHERE user_id = ?").bind(userId).first();
|
|
return body({ configured: !!credential });
|
|
}
|
|
if (segments[0] === "setup" && segments.length === 1 && request.method === "POST") return setup(request, env.DB, userId);
|
|
if (segments[0] === "login" && segments.length === 1 && request.method === "POST") return login(request, env, userId);
|
|
if (!await signedIn(request, env.DB, userId)) return body({ error: "Admin session required" }, 401);
|
|
if (segments[0] === "password" && segments.length === 1 && request.method === "POST") return changePassword(request, env.DB, userId);
|
|
if (segments[0] === "session" && segments.length === 1 && request.method === "GET") return body({ ok: true });
|
|
if (segments[0] === "logout" && segments.length === 1 && request.method === "POST") {
|
|
await env.DB.prepare("DELETE FROM lifeos_admin_sessions WHERE token_hash = ? AND user_id = ?").bind(await hash(request.headers.get("x-lifeos-admin-session")), userId).run();
|
|
return body({ ok: true });
|
|
}
|
|
const kind = segments[1];
|
|
if (segments[0] !== "tables" || !Object.hasOwn(TABLES, kind)) return body({ error: "Unknown table" }, 404);
|
|
if (segments.length === 3 && segments[2] === "rows" && request.method === "GET") {
|
|
const page = Number(new URL(request.url).searchParams.get("page") || 0);
|
|
if (!Number.isInteger(page) || page < 0 || page > 1000) return body({ error: "Invalid page" }, 400);
|
|
return list(env.DB, userId, kind, page);
|
|
}
|
|
if (segments.length === 4 && segments[2] === "rows" && ["POST", "PATCH", "DELETE"].includes(request.method)) {
|
|
return mutate(request, env, userId, kind, decodeURIComponent(segments[3]), request.method);
|
|
}
|
|
return body({ error: "Method not allowed" }, 405);
|
|
} catch (error) {
|
|
console.error("Life OS database manager failed", error);
|
|
return body({ error: "Database operation failed" }, 500);
|
|
}
|
|
}
|