v12.0.0 - initial commit

packages/server/lib/new-admin/middlewares/cleanUserSessions.js

@@ -0,0 +1,25 @@
+const db = require('../../db')
+const { USER_SESSIONS_TABLE_NAME } = require('../../constants')
+const logger = require('../../logger')
+
+let schemaCache = Date.now()
+
+const cleanUserSessions = cleanInterval => (req, res, next) => {
+  const now = Date.now()
+
+  if (schemaCache + cleanInterval > now) return next()
+
+  logger.debug(`Clearing expired sessions for schema 'public'`)
+  return db
+    .none('DELETE FROM $1^ WHERE expire < to_timestamp($2 / 1000.0)', [
+      USER_SESSIONS_TABLE_NAME,
+      now,
+    ])
+    .then(() => {
+      schemaCache = now
+      return next()
+    })
+    .catch(next)
+}
+
+module.exports = cleanUserSessions

packages/server/lib/new-admin/middlewares/context.js

@@ -0,0 +1,29 @@
+const users = require('../../users')
+
+const { AuthenticationError } = require('../graphql/errors')
+
+const buildApolloContext = async ({ req, res }) => {
+  if (!req.session.user) return { req, res }
+
+  const user = await users.verifyAndUpdateUser(
+    req.session.user.id,
+    req.headers['user-agent'] || 'Unknown',
+    req.ip,
+  )
+  if (!user || !user.enabled)
+    throw new AuthenticationError('Authentication failed')
+
+  req.session.ua = req.headers['user-agent'] || 'Unknown'
+  req.session.ipAddress = req.ip
+  req.session.lastUsed = new Date(Date.now()).toISOString()
+  req.session.user.id = user.id
+  req.session.user.username = user.username
+  req.session.user.role = user.role
+
+  res.set('lamassu_role', user.role)
+  res.set('Access-Control-Expose-Headers', 'lamassu_role')
+
+  return { req, res }
+}
+
+module.exports = buildApolloContext

packages/server/lib/new-admin/middlewares/index.js

@@ -0,0 +1,9 @@
+const cleanUserSessions = require('./cleanUserSessions')
+const buildApolloContext = require('./context')
+const session = require('./session')
+
+module.exports = {
+  cleanUserSessions,
+  buildApolloContext,
+  session,
+}

packages/server/lib/new-admin/middlewares/session.js

@@ -0,0 +1,29 @@
+const express = require('express')
+const router = express.Router()
+const session = require('express-session')
+const PgSession = require('connect-pg-simple')(session)
+const db = require('../../db')
+const { USER_SESSIONS_TABLE_NAME } = require('../../constants')
+const { getOperatorId } = require('../../operator')
+
+router.use('*', async (req, res, next) =>
+  getOperatorId('authentication').then(operatorId =>
+    session({
+      store: new PgSession({
+        pgPromise: db,
+        tableName: USER_SESSIONS_TABLE_NAME,
+      }),
+      name: 'lamassu_sid',
+      secret: operatorId,
+      resave: false,
+      saveUninitialized: false,
+      cookie: {
+        httpOnly: true,
+        secure: true,
+        sameSite: true,
+      },
+    })(req, res, next),
+  ),
+)
+
+module.exports = router