add0b17e04
Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
78 lines
2.5 KiB
TypeScript
78 lines
2.5 KiB
TypeScript
import { Request, Response, NextFunction } from 'express';
|
|
import jwt from 'jsonwebtoken';
|
|
import { db } from '../db/database';
|
|
import { JWT_SECRET } from '../config';
|
|
import { AuthRequest, OptionalAuthRequest, User } from '../types';
|
|
|
|
function extractToken(req: Request): string | null {
|
|
// Prefer httpOnly cookie; fall back to Authorization: Bearer (MCP, API clients)
|
|
const cookieToken = (req as any).cookies?.trek_session;
|
|
if (cookieToken) return cookieToken;
|
|
const authHeader = req.headers['authorization'];
|
|
return (authHeader && authHeader.split(' ')[1]) || null;
|
|
}
|
|
|
|
const authenticate = (req: Request, res: Response, next: NextFunction): void => {
|
|
const token = extractToken(req);
|
|
|
|
if (!token) {
|
|
res.status(401).json({ error: 'Access token required' });
|
|
return;
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
|
|
const user = db.prepare(
|
|
'SELECT id, username, email, role FROM users WHERE id = ?'
|
|
).get(decoded.id) as User | undefined;
|
|
if (!user) {
|
|
res.status(401).json({ error: 'User not found' });
|
|
return;
|
|
}
|
|
(req as AuthRequest).user = user;
|
|
next();
|
|
} catch (err: unknown) {
|
|
res.status(401).json({ error: 'Invalid or expired token' });
|
|
}
|
|
};
|
|
|
|
const optionalAuth = (req: Request, res: Response, next: NextFunction): void => {
|
|
const token = extractToken(req);
|
|
|
|
if (!token) {
|
|
(req as OptionalAuthRequest).user = null;
|
|
return next();
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
|
|
const user = db.prepare(
|
|
'SELECT id, username, email, role FROM users WHERE id = ?'
|
|
).get(decoded.id) as User | undefined;
|
|
(req as OptionalAuthRequest).user = user || null;
|
|
} catch (err: unknown) {
|
|
(req as OptionalAuthRequest).user = null;
|
|
}
|
|
next();
|
|
};
|
|
|
|
const adminOnly = (req: Request, res: Response, next: NextFunction): void => {
|
|
const authReq = req as AuthRequest;
|
|
if (!authReq.user || authReq.user.role !== 'admin') {
|
|
res.status(403).json({ error: 'Admin access required' });
|
|
return;
|
|
}
|
|
next();
|
|
};
|
|
|
|
const demoUploadBlock = (req: Request, res: Response, next: NextFunction): void => {
|
|
const authReq = req as AuthRequest;
|
|
if (process.env.DEMO_MODE === 'true' && authReq.user?.email === 'demo@nomad.app') {
|
|
res.status(403).json({ error: 'Uploads are disabled in demo mode. Self-host NOMAD for full functionality.' });
|
|
return;
|
|
}
|
|
next();
|
|
};
|
|
|
|
export { authenticate, optionalAuth, adminOnly, demoUploadBlock };
|