123 lines
4.6 KiB
TypeScript
123 lines
4.6 KiB
TypeScript
import { and, eq, gt, sql } from 'drizzle-orm';
|
|
import * as z from 'zod';
|
|
import { accounts, providers, recoveryLinks, sessions, twoFactors, users } from '~~/drizzle/schema';
|
|
import { lockAccount, revokeTwoFactorTrust } from "~~/server/lib/account-security";
|
|
import { authTransaction } from "~~/server/lib/auth-transaction";
|
|
import { auth } from '~~/lib/auth';
|
|
|
|
/**
|
|
* Sets a password with a one-time link.
|
|
*
|
|
* For an account an admin just created this is its first password, and there
|
|
* is nothing else to do. For a forgotten password it is a recovery:
|
|
*
|
|
* The saved API keys are encrypted with a key derived from the old password.
|
|
* Nobody has that password anymore, so the keys can never be read again and
|
|
* are deleted here. Chats, agents, files and everything else stay.
|
|
*/
|
|
export default defineEventHandler(async (event) => {
|
|
const result = await readValidatedBody(event, (body) =>
|
|
z
|
|
.object({
|
|
password: z.string().min(8).max(128),
|
|
})
|
|
.safeParse(body),
|
|
);
|
|
|
|
if (!result.success) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: result.error.issues[0]!.message,
|
|
data: {
|
|
code: 'INVALID_BODY',
|
|
},
|
|
});
|
|
}
|
|
|
|
const token = getRouterParam(event, 'token')!;
|
|
const tokenHash = hashRecoveryToken(token);
|
|
const { password } = result.data;
|
|
|
|
const invalidLink = () => createError({
|
|
statusCode: 410,
|
|
statusMessage: 'This recovery link is not valid anymore',
|
|
data: {
|
|
code: 'RECOVERY_LINK_INVALID',
|
|
},
|
|
});
|
|
|
|
// Hashing a password is slow on purpose and anyone can call this, so a
|
|
// link that does not work is turned away before any of that is done.
|
|
const candidate = await findRecoveryLink(token);
|
|
if (!candidate) {
|
|
throw invalidLink();
|
|
}
|
|
|
|
const { password: hasher, internalAdapter } = await auth.$context;
|
|
const passwordHash = await hasher.hash(password);
|
|
|
|
const recovered = await authTransaction(async (tx) => {
|
|
await lockAccount(tx, candidate.userId);
|
|
// deleting the link is what makes it work once: of two requests with
|
|
// the same link only one gets a row back
|
|
const [link] = await tx.delete(recoveryLinks)
|
|
.where(and(eq(recoveryLinks.tokenHash, tokenHash), gt(recoveryLinks.expiresAt, new Date())))
|
|
.returning({ userId: recoveryLinks.userId, resetSecurity: recoveryLinks.resetSecurity });
|
|
|
|
if (!link) {
|
|
return null;
|
|
}
|
|
|
|
// if either of these fails the link comes back with the rest of the
|
|
// transaction
|
|
const [credential] = await tx.select({ id: accounts.id }).from(accounts)
|
|
.where(and(eq(accounts.userId, link.userId), eq(accounts.providerId, 'credential')));
|
|
if (!credential) {
|
|
await internalAdapter.linkAccount({
|
|
providerId: 'credential',
|
|
accountId: link.userId,
|
|
password: passwordHash,
|
|
userId: link.userId,
|
|
});
|
|
|
|
return 'created';
|
|
}
|
|
|
|
await internalAdapter.updatePassword(link.userId, passwordHash);
|
|
|
|
await tx.update(providers).set({
|
|
updatedAt: sql`greatest(date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', ${providers.updatedAt}) + interval '1 millisecond')`,
|
|
}).where(eq(providers.userId, link.userId));
|
|
|
|
// A provider without its key can't be used, so it is switched off
|
|
// until the key is entered again. The provider and its models stay.
|
|
await tx.update(providers)
|
|
.set({
|
|
config: sql`${providers.config} - 'apiKey'`,
|
|
enabled: false,
|
|
updatedAt: sql`${providers.updatedAt}`,
|
|
})
|
|
.where(and(eq(providers.userId, link.userId), sql`coalesce(${providers.config}->>'apiKey', '') <> ''`));
|
|
|
|
// Every device is signed out, always: the ones still signed in hold
|
|
// an encryption key derived from the old password.
|
|
await tx.delete(sessions).where(eq(sessions.userId, link.userId));
|
|
|
|
await revokeTwoFactorTrust(tx, link.userId);
|
|
|
|
if (link.resetSecurity) {
|
|
await tx.delete(twoFactors).where(eq(twoFactors.userId, link.userId));
|
|
await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, link.userId));
|
|
}
|
|
|
|
return 'recovered';
|
|
});
|
|
|
|
// used or expired between the check above and here
|
|
if (recovered === null) {
|
|
throw invalidLink();
|
|
}
|
|
|
|
return { newAccount: recovered === 'created' };
|
|
});
|