feat: admin controls

server/api/recover/[token].post.ts

@@ -1,8 +1,9 @@
 import { and, eq, gt, sql } from 'drizzle-orm';
 import * as z from 'zod';
-import { providers, recoveryLinks, sessions, twoFactors, users } from '~~/drizzle/schema';
+import { accounts, providers, recoveryLinks, sessions, twoFactors, users } from '~~/drizzle/schema';
+import { lockAccount, revokeTwoFactorTrust } from "~~/server/lib/account-security";
+import { authTransaction } from "~~/server/lib/auth-transaction";
 import { auth } from '~~/lib/auth';
-import { db } from '~~/server/lib/db';
 
 /**
  * Sets a password with a one-time link.
@@ -33,24 +34,45 @@ export default defineEventHandler(async (event) => {
         });
     }
 
-    const tokenHash = hashRecoveryToken(getRouterParam(event, 'token')!);
+    const token = getRouterParam(event, 'token')!;
+    const tokenHash = hashRecoveryToken(token);
     const { password } = result.data;
 
+    const invalidLink = () => createError({
+        statusCode: 410,
+        statusMessage: 'This recovery link is not valid anymore',
+        data: {
+            code: 'RECOVERY_LINK_INVALID',
+        },
+    });
+
+    // Hashing a password is slow on purpose and anyone can call this, so a
+    // link that does not work is turned away before any of that is done.
+    const candidate = await findRecoveryLink(token);
+    if (!candidate) {
+        throw invalidLink();
+    }
+
     const { password: hasher, internalAdapter } = await auth.$context;
     const passwordHash = await hasher.hash(password);
 
-    const recovered = await db.transaction(async (tx) => {
+    const recovered = await authTransaction(async (tx) => {
+        await lockAccount(tx, candidate.userId);
         // deleting the link is what makes it work once: of two requests with
         // the same link only one gets a row back
         const [link] = await tx.delete(recoveryLinks)
             .where(and(eq(recoveryLinks.tokenHash, tokenHash), gt(recoveryLinks.expiresAt, new Date())))
             .returning({ userId: recoveryLinks.userId, resetSecurity: recoveryLinks.resetSecurity });
 
-        if (!link) return null;
+        if (!link) {
+            return null;
+        }
 
         // if either of these fails the link comes back with the rest of the
         // transaction
-        if (!await hasPassword(link.userId)) {
+        const [credential] = await tx.select({ id: accounts.id }).from(accounts)
+            .where(and(eq(accounts.userId, link.userId), eq(accounts.providerId, 'credential')));
+        if (!credential) {
             await internalAdapter.linkAccount({
                 providerId: 'credential',
                 accountId: link.userId,
@@ -63,32 +85,37 @@ export default defineEventHandler(async (event) => {
 
         await internalAdapter.updatePassword(link.userId, passwordHash);
 
+        await tx.update(providers).set({
+            updatedAt: sql`greatest(date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', ${providers.updatedAt}) + interval '1 millisecond')`,
+        }).where(eq(providers.userId, link.userId));
+
         // A provider without its key can't be used, so it is switched off
         // until the key is entered again. The provider and its models stay.
         await tx.update(providers)
             .set({
                 config: sql`${providers.config} - 'apiKey'`,
                 enabled: false,
+                updatedAt: sql`${providers.updatedAt}`,
             })
             .where(and(eq(providers.userId, link.userId), sql`coalesce(${providers.config}->>'apiKey', '') <> ''`));
 
+        // Every device is signed out, always: the ones still signed in hold
+        // an encryption key derived from the old password.
+        await tx.delete(sessions).where(eq(sessions.userId, link.userId));
+
+        await revokeTwoFactorTrust(tx, link.userId);
+
         if (link.resetSecurity) {
             await tx.delete(twoFactors).where(eq(twoFactors.userId, link.userId));
             await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, link.userId));
-            await tx.delete(sessions).where(eq(sessions.userId, link.userId));
         }
 
         return 'recovered';
     });
 
+    // used or expired between the check above and here
     if (recovered === null) {
-        throw createError({
-            statusCode: 410,
-            statusMessage: 'This recovery link is not valid anymore',
-            data: {
-                code: 'RECOVERY_LINK_INVALID',
-            },
-        });
+        throw invalidLink();
     }
 
     return { newAccount: recovered === 'created' };