From 42041d49bccec3af28994537c9f47fc9dae5412b Mon Sep 17 00:00:00 2001 From: sam Date: Tue, 1 Oct 2024 21:25:51 +0200 Subject: [PATCH 1/5] feat: add force log out endpoint --- .../Controllers/InternalController.cs | 20 +++++++++++++++- Foxnouns.Frontend/app/env.server.ts | 1 + Foxnouns.Frontend/app/lib/request.server.ts | 24 +++++++++++++++---- .../app/routes/settings._index/route.tsx | 20 ++++++++-------- .../routes/settings.force-log-out/route.tsx | 19 +++++++++++++++ Foxnouns.Frontend/public/locales/en.json | 2 ++ docker-compose.yml | 1 + 7 files changed, 72 insertions(+), 15 deletions(-) create mode 100644 Foxnouns.Frontend/app/routes/settings.force-log-out/route.tsx diff --git a/Foxnouns.Backend/Controllers/InternalController.cs b/Foxnouns.Backend/Controllers/InternalController.cs index b79de1c..2048f59 100644 --- a/Foxnouns.Backend/Controllers/InternalController.cs +++ b/Foxnouns.Backend/Controllers/InternalController.cs @@ -1,17 +1,35 @@ using System.Text.RegularExpressions; using Foxnouns.Backend.Database; +using Foxnouns.Backend.Middleware; using Foxnouns.Backend.Utils; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Controllers; using Microsoft.AspNetCore.Mvc.Routing; using Microsoft.AspNetCore.Routing.Template; +using Microsoft.EntityFrameworkCore; namespace Foxnouns.Backend.Controllers; [ApiController] [Route("/api/internal")] -public partial class InternalController(DatabaseContext db) : ControllerBase +public partial class InternalController(ILogger logger, DatabaseContext db) : ControllerBase { + private readonly ILogger _logger = logger.ForContext(); + + [HttpPost("force-log-out")] + [Authenticate] + [Authorize("identify")] + public async Task ForceLogoutAsync() + { + var user = HttpContext.GetUser()!; + + _logger.Information("Invalidating all tokens for user {UserId}", user.Id); + await db.Tokens.Where(t => t.UserId == user.Id) + .ExecuteUpdateAsync(s => s.SetProperty(t => t.ManuallyExpired, true)); + + return NoContent(); + } + [GeneratedRegex(@"(\{\w+\})")] private static partial Regex PathVarRegex(); diff --git a/Foxnouns.Frontend/app/env.server.ts b/Foxnouns.Frontend/app/env.server.ts index 2add747..5e5e84b 100644 --- a/Foxnouns.Frontend/app/env.server.ts +++ b/Foxnouns.Frontend/app/env.server.ts @@ -2,4 +2,5 @@ import "dotenv/config"; import { env } from "node:process"; export const API_BASE = env.API_BASE || "https://pronouns.localhost/api"; +export const INTERNAL_API_BASE = env.INTERNAL_API_BASE || "https://localhost:5000/api"; export const LANGUAGE = env.LANGUAGE || "en"; diff --git a/Foxnouns.Frontend/app/lib/request.server.ts b/Foxnouns.Frontend/app/lib/request.server.ts index 4648d5f..7777422 100644 --- a/Foxnouns.Frontend/app/lib/request.server.ts +++ b/Foxnouns.Frontend/app/lib/request.server.ts @@ -1,5 +1,5 @@ import { parse as parseCookie, serialize as serializeCookie } from "cookie"; -import { API_BASE } from "~/env.server"; +import { API_BASE, INTERNAL_API_BASE } from "~/env.server"; import { ApiError, ErrorCode } from "./api/error"; import { tokenCookieName } from "~/lib/utils"; @@ -8,14 +8,17 @@ export type RequestParams = { // eslint-disable-next-line @typescript-eslint/no-explicit-any body?: any; headers?: Record; + isInternal?: boolean; }; -export default async function serverRequest( +async function requestInternal( method: string, path: string, params: RequestParams = {}, -) { - const url = `${API_BASE}/v2${path}`; +): Promise { + const base = params.isInternal ? INTERNAL_API_BASE : API_BASE + "/v2"; + + const url = `${base}${path}`; const resp = await fetch(url, { method, body: params.body ? JSON.stringify(params.body) : undefined, @@ -37,6 +40,19 @@ export default async function serverRequest( } if (resp.status < 200 || resp.status >= 400) throw (await resp.json()) as ApiError; + return resp; +} + +export async function fastRequest(method: string, path: string, params: RequestParams = {}) { + await requestInternal(method, path, params); +} + +export default async function serverRequest( + method: string, + path: string, + params: RequestParams = {}, +) { + const resp = await requestInternal(method, path, params); return (await resp.json()) as T; } diff --git a/Foxnouns.Frontend/app/routes/settings._index/route.tsx b/Foxnouns.Frontend/app/routes/settings._index/route.tsx index d575108..5b90851 100644 --- a/Foxnouns.Frontend/app/routes/settings._index/route.tsx +++ b/Foxnouns.Frontend/app/routes/settings._index/route.tsx @@ -1,6 +1,6 @@ import { Button, Form, InputGroup, Table } from "react-bootstrap"; import { useTranslation } from "react-i18next"; -import { Form as RemixForm, useActionData, useRouteLoaderData } from "@remix-run/react"; +import { Form as RemixForm, useActionData, useFetcher, useRouteLoaderData } from "@remix-run/react"; import { loader as settingsLoader } from "../settings/route"; import { loader as rootLoader } from "../../root"; import { DateTime } from "luxon"; @@ -43,6 +43,7 @@ export default function SettingsIndex() { const actionData = useActionData(); const { meta } = useRouteLoaderData("root")!; const { t } = useTranslation(); + const fetcher = useFetcher(); const createdAt = idTimestamp(user.id); @@ -55,13 +56,7 @@ export default function SettingsIndex() { {t("settings.general.username")} - + @@ -85,9 +80,14 @@ export default function SettingsIndex() {

{t("settings.general.log-out-everywhere")}

-

+

{t("settings.general.log-out-everywhere-hint")}

+ + +
-

{t("settings.general.table-header")}

+

{t("settings.general.table-header")}

diff --git a/Foxnouns.Frontend/app/routes/settings.force-log-out/route.tsx b/Foxnouns.Frontend/app/routes/settings.force-log-out/route.tsx new file mode 100644 index 0000000..caa9d4a --- /dev/null +++ b/Foxnouns.Frontend/app/routes/settings.force-log-out/route.tsx @@ -0,0 +1,19 @@ +import { ActionFunction, redirect } from "@remix-run/node"; +import { fastRequest, getToken, writeCookie } from "~/lib/request.server"; +import { tokenCookieName } from "~/lib/utils"; + +export const action: ActionFunction = async ({ request }) => { + const token = getToken(request); + if (!token) + return redirect("/", { + status: 303, + headers: { "Set-Cookie": writeCookie(tokenCookieName, "token", 0) }, + }); + + await fastRequest("POST", "/internal/force-log-out", { token, isInternal: true }); + + return redirect("/", { + status: 303, + headers: { "Set-Cookie": writeCookie(tokenCookieName, "token", 0) }, + }); +}; diff --git a/Foxnouns.Frontend/public/locales/en.json b/Foxnouns.Frontend/public/locales/en.json index 279173b..c35a1d7 100644 --- a/Foxnouns.Frontend/public/locales/en.json +++ b/Foxnouns.Frontend/public/locales/en.json @@ -96,6 +96,8 @@ "change-username": "Change username", "username-change-hint": "Changing your username will make any existing links to your or your members' profiles invalid.\nYour username must be unique, be at most 40 characters long, and only contain letters from the basic English alphabet, dashes, underscores, and periods. Your username is used as part of your profile link, you can set a separate display name.", "log-out-everywhere": "Log out everywhere", + "log-out-everywhere-hint": "If you think one of your tokens might have been compromised, you can log out on all devices by clicking this button.", + "force-log-out-button": "Force log out", "table-header": "General account information", "id": "Your user ID", "created": "Account created at", diff --git a/docker-compose.yml b/docker-compose.yml index 7176fc2..6fafd18 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -18,6 +18,7 @@ services: build: ./Foxnouns.Frontend environment: - "API_BASE=http://rate:5003/api" + - "INTERNAL_API_BASE=http://backend:5000/api" restart: unless-stopped volumes: - ./docker/frontend.env:/app/.env From aa756ac56ad93255d0e3af1514f71b412dc2c5c4 Mon Sep 17 00:00:00 2001 From: sam Date: Tue, 1 Oct 2024 21:58:13 +0200 Subject: [PATCH 2/5] chore(backend): format --- .../Controllers/Authentication/EmailAuthController.cs | 2 +- Foxnouns.Backend/Controllers/UsersController.cs | 3 ++- Foxnouns.Backend/Utils/ValidationUtils.cs | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Foxnouns.Backend/Controllers/Authentication/EmailAuthController.cs b/Foxnouns.Backend/Controllers/Authentication/EmailAuthController.cs index 1649948..18fbacc 100644 --- a/Foxnouns.Backend/Controllers/Authentication/EmailAuthController.cs +++ b/Foxnouns.Backend/Controllers/Authentication/EmailAuthController.cs @@ -125,7 +125,7 @@ public class EmailAuthController( private void CheckRequirements() { - if (!config.DiscordAuth.Enabled) + if (!config.EmailAuth.Enabled) throw new ApiError.BadRequest("Email authentication is not enabled on this instance."); } diff --git a/Foxnouns.Backend/Controllers/UsersController.cs b/Foxnouns.Backend/Controllers/UsersController.cs index 9a182f4..fb0e301 100644 --- a/Foxnouns.Backend/Controllers/UsersController.cs +++ b/Foxnouns.Backend/Controllers/UsersController.cs @@ -186,7 +186,8 @@ public class UsersController( if (preferences.Count > MaxCustomPreferences) errors.Add(("custom_preferences", - ValidationError.LengthError("Too many custom preferences", 0, MaxCustomPreferences, preferences.Count))); + ValidationError.LengthError("Too many custom preferences", 0, MaxCustomPreferences, + preferences.Count))); if (preferences.Count > 50) return errors; // TODO: validate individual preferences diff --git a/Foxnouns.Backend/Utils/ValidationUtils.cs b/Foxnouns.Backend/Utils/ValidationUtils.cs index 392e5ed..2dd52b9 100644 --- a/Foxnouns.Backend/Utils/ValidationUtils.cs +++ b/Foxnouns.Backend/Utils/ValidationUtils.cs @@ -289,6 +289,7 @@ public static partial class ValidationUtils [GeneratedRegex(@"^[a-zA-Z_0-9\-\.]{2,40}$", RegexOptions.IgnoreCase, "en-NL")] private static partial Regex UsernameRegex(); + [GeneratedRegex("""^[^@'$%&()+<=>^|~`,*!#/\\\[\]""\{\}\?]{1,100}$""", RegexOptions.IgnoreCase, "en-NL")] private static partial Regex MemberRegex(); } \ No newline at end of file From eac0a17473a6bdb0a2b329a9062dbc0255a6bc39 Mon Sep 17 00:00:00 2001 From: sam Date: Tue, 1 Oct 2024 22:35:17 +0200 Subject: [PATCH 3/5] chore: add husky + prettier/dotnet format pre-commit --- .config/dotnet-tools.json | 13 +++++++++++ .husky/pre-commit | 22 +++++++++++++++++++ .husky/task-runner.json | 21 ++++++++++++++++++ .../.idea/jsLinters/eslint.xml | 1 + .idea/.idea.Foxnouns.NET/.idea/prettier.xml | 2 +- package.json | 3 ++- 6 files changed, 60 insertions(+), 2 deletions(-) create mode 100644 .config/dotnet-tools.json create mode 100755 .husky/pre-commit create mode 100644 .husky/task-runner.json diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json new file mode 100644 index 0000000..e6df774 --- /dev/null +++ b/.config/dotnet-tools.json @@ -0,0 +1,13 @@ +{ + "version": 1, + "isRoot": true, + "tools": { + "husky": { + "version": "0.7.1", + "commands": [ + "husky" + ], + "rollForward": false + } + } +} \ No newline at end of file diff --git a/.husky/pre-commit b/.husky/pre-commit new file mode 100755 index 0000000..fd85d23 --- /dev/null +++ b/.husky/pre-commit @@ -0,0 +1,22 @@ +#!/bin/sh +. "$(dirname "$0")/_/husky.sh" + +## husky task runner examples ------------------- +## Note : for local installation use 'dotnet' prefix. e.g. 'dotnet husky' + +## run all tasks +#husky run + +### run all tasks with group: 'group-name' +#husky run --group group-name + +## run task with name: 'task-name' +#husky run --name task-name + +## pass hook arguments to task +#husky run --args "$1" "$2" + +## or put your custom commands ------------------- +#echo 'Husky.Net is awesome!' + +dotnet husky run diff --git a/.husky/task-runner.json b/.husky/task-runner.json new file mode 100644 index 0000000..bb845ca --- /dev/null +++ b/.husky/task-runner.json @@ -0,0 +1,21 @@ +{ + "$schema": "https://alirezanet.github.io/Husky.Net/schema.json", + "tasks": [ + { + "name": "run-prettier", + "command": "yarn", + "args": [ + "format", + "${staged}" + ], + "pathMode": "absolute" + }, + { + "name": "dotnet-format", + "command": "dotnet", + "args": [ + "format" + ] + } + ] +} diff --git a/.idea/.idea.Foxnouns.NET/.idea/jsLinters/eslint.xml b/.idea/.idea.Foxnouns.NET/.idea/jsLinters/eslint.xml index 204acf7..5f8621e 100644 --- a/.idea/.idea.Foxnouns.NET/.idea/jsLinters/eslint.xml +++ b/.idea/.idea.Foxnouns.NET/.idea/jsLinters/eslint.xml @@ -2,5 +2,6 @@ + \ No newline at end of file diff --git a/.idea/.idea.Foxnouns.NET/.idea/prettier.xml b/.idea/.idea.Foxnouns.NET/.idea/prettier.xml index 653a9e0..ffcf89b 100644 --- a/.idea/.idea.Foxnouns.NET/.idea/prettier.xml +++ b/.idea/.idea.Foxnouns.NET/.idea/prettier.xml @@ -1,7 +1,7 @@ -