949 lines
34 KiB
Plaintext
949 lines
34 KiB
Plaintext
// TaskForge server: users, sessions and the shared project, stored in SQLite (WAL mode).
|
|
// Also serves the web client. Meant to sit behind Caddy (or nginx) for HTTPS.
|
|
//
|
|
// taskforge-server [--port 8080] [--listen 127.0.0.1] [--db taskforge.db] [--web ./web] [--threads 8] [--demo]
|
|
// taskforge-server [--db taskforge.db] add-user <username> "<Display Name>" [--admin] (password read from stdin)
|
|
// taskforge-server [--db taskforge.db] set-password <username> (password read from stdin)
|
|
// taskforge-server [--db taskforge.db] list-users
|
|
//
|
|
// Sync model: the project is a set of records (one text line per entity, see src/storage.jai), each with a key
|
|
// like "task 42" or "val 42 7". Every write bumps a global revision; clients send their changed records and
|
|
// receive everything changed since the revision they last saw. Last writer wins per record.
|
|
|
|
Config :: struct {
|
|
port: u16 = 8080;
|
|
listen_on := "127.0.0.1";
|
|
db_path := "taskforge.db";
|
|
web_dir := "web";
|
|
blob_dir := ""; // Defaults to "blobs" next to the database.
|
|
threads: s32 = 8;
|
|
demo: bool;
|
|
}
|
|
|
|
config: Config;
|
|
listen_socket: Socket;
|
|
|
|
PBKDF2_ITERATIONS :: 310000;
|
|
SESSION_DAYS :: 30;
|
|
ID_BLOCK :: 1000;
|
|
MAX_BODY :: 16 * 1024 * 1024;
|
|
|
|
main :: () {
|
|
args := get_command_line_arguments();
|
|
command := "serve";
|
|
positional: [..] string;
|
|
admin_flag := false;
|
|
i := 1;
|
|
while i < args.count {
|
|
a := args[i];
|
|
has_value := i + 1 < args.count;
|
|
if a == "--port" && has_value { config.port = cast(u16) string_to_int(args[i + 1]); i += 2; continue; }
|
|
if a == "--listen" && has_value { config.listen_on = args[i + 1]; i += 2; continue; }
|
|
if a == "--db" && has_value { config.db_path = args[i + 1]; i += 2; continue; }
|
|
if a == "--web" && has_value { config.web_dir = args[i + 1]; i += 2; continue; }
|
|
if a == "--blobs" && has_value { config.blob_dir = args[i + 1]; i += 2; continue; }
|
|
if a == "--threads" && has_value { config.threads = cast(s32) string_to_int(args[i + 1]); i += 2; continue; }
|
|
if a == "--demo" { config.demo = true; i += 1; continue; }
|
|
if a == "--admin" { admin_flag = true; i += 1; continue; }
|
|
if a == "--help" || a == "-h" { print_usage(); return; }
|
|
if !positional.count && (a == "serve" || a == "add-user" || a == "set-password" || a == "list-users") {
|
|
command = a;
|
|
array_add(*positional, a);
|
|
} else {
|
|
array_add(*positional, a);
|
|
}
|
|
i += 1;
|
|
}
|
|
|
|
if !config.blob_dir.count {
|
|
dir := path_strip_filename(config.db_path);
|
|
// Heap copy: temporary storage is reset between requests, and this must live for the whole run.
|
|
config.blob_dir = ifx dir.count then sprint("%blobs", dir) else "blobs";
|
|
}
|
|
make_directory_if_it_does_not_exist(config.blob_dir);
|
|
|
|
if !load_sqlite() exit(1);
|
|
db, ok := db_open(config.db_path);
|
|
if !ok exit(1);
|
|
if !migrate(db) exit(1);
|
|
|
|
if command == {
|
|
case "add-user";
|
|
if positional.count < 3 { print_usage(); exit(1); }
|
|
password := read_password();
|
|
error := add_user(db, positional[1], positional[2], password, admin_flag);
|
|
if error { log_error("%", error); exit(1); }
|
|
print("Added user %.\n", positional[1]);
|
|
case "set-password";
|
|
if positional.count < 2 { print_usage(); exit(1); }
|
|
id := find_user_id(db, positional[1]);
|
|
if !id { log_error("No user named %.", positional[1]); exit(1); }
|
|
password := read_password();
|
|
error := set_password(db, id, password);
|
|
if error { log_error("%", error); exit(1); }
|
|
print("Password updated.\n");
|
|
case "list-users";
|
|
s := prepare(db, "SELECT id, username, display_name, is_admin, active FROM users ORDER BY id");
|
|
while step(s) print("% % \"%\"% %\n", column_int(s, 0), column_text(s, 1), column_text(s, 2),
|
|
ifx column_int(s, 3) then " admin" else "", ifx column_int(s, 4) then "" else "(deactivated)");
|
|
finalize(s);
|
|
case;
|
|
serve();
|
|
}
|
|
}
|
|
|
|
print_usage :: () {
|
|
print(#string TXT
|
|
Usage:
|
|
taskforge-server [--port 8080] [--listen 127.0.0.1] [--db taskforge.db] [--web ./web] [--threads 8] [--demo]
|
|
taskforge-server [--db taskforge.db] add-user <username> "<Display Name>" [--admin] (reads password from stdin)
|
|
taskforge-server [--db taskforge.db] set-password <username> (reads password from stdin)
|
|
taskforge-server [--db taskforge.db] list-users
|
|
TXT);
|
|
}
|
|
|
|
//
|
|
// Database
|
|
//
|
|
|
|
SCHEMA :: #string SQL
|
|
CREATE TABLE IF NOT EXISTS meta (
|
|
key TEXT PRIMARY KEY,
|
|
value INTEGER NOT NULL
|
|
);
|
|
CREATE TABLE IF NOT EXISTS records (
|
|
key TEXT PRIMARY KEY,
|
|
line TEXT NOT NULL,
|
|
rev INTEGER NOT NULL,
|
|
deleted INTEGER NOT NULL DEFAULT 0,
|
|
user_id INTEGER
|
|
);
|
|
CREATE INDEX IF NOT EXISTS records_by_rev ON records(rev);
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY,
|
|
username TEXT NOT NULL UNIQUE COLLATE NOCASE,
|
|
display_name TEXT NOT NULL,
|
|
pw_hash BLOB NOT NULL,
|
|
pw_salt BLOB NOT NULL,
|
|
pw_iter INTEGER NOT NULL,
|
|
is_admin INTEGER NOT NULL DEFAULT 0,
|
|
active INTEGER NOT NULL DEFAULT 1,
|
|
created INTEGER NOT NULL
|
|
);
|
|
CREATE TABLE IF NOT EXISTS sessions (
|
|
token_hash BLOB PRIMARY KEY,
|
|
user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
expires INTEGER NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS sessions_by_user ON sessions(user_id);
|
|
CREATE TABLE IF NOT EXISTS login_failures (
|
|
username TEXT NOT NULL COLLATE NOCASE,
|
|
at INTEGER NOT NULL
|
|
);
|
|
CREATE INDEX IF NOT EXISTS login_failures_by_name ON login_failures(username, at);
|
|
CREATE TABLE IF NOT EXISTS blobs (
|
|
hash TEXT PRIMARY KEY,
|
|
size INTEGER NOT NULL,
|
|
created INTEGER NOT NULL,
|
|
user_id INTEGER
|
|
);
|
|
SQL
|
|
|
|
migrate :: (db: Db) -> bool {
|
|
if !db_exec(db, SCHEMA) return false;
|
|
if get_meta(db, "seeded") return true;
|
|
|
|
// First start: seed the project.
|
|
p := starter_project(config.demo);
|
|
lines: [..] string;
|
|
project_records(p, *lines);
|
|
db_exec(db, "BEGIN IMMEDIATE;");
|
|
s := prepare(db, "INSERT OR REPLACE INTO records(key, line, rev, deleted) VALUES (?, ?, 1, 0)");
|
|
for lines {
|
|
bind(s, 1, record_key(it));
|
|
bind(s, 2, it);
|
|
run(s);
|
|
reset(s);
|
|
}
|
|
finalize(s);
|
|
set_meta(db, "rev", 1);
|
|
set_meta(db, "next_id", p.next_id);
|
|
set_meta(db, "users_rev", 1);
|
|
set_meta(db, "seeded", 1);
|
|
db_exec(db, "COMMIT;");
|
|
log("Created a new % project in %.", ifx config.demo then "demo" else "starter", config.db_path);
|
|
return true;
|
|
}
|
|
|
|
get_meta :: (db: Db, key: string) -> s64 {
|
|
s := prepare(db, "SELECT value FROM meta WHERE key = ?");
|
|
bind(s, 1, key);
|
|
value: s64;
|
|
if step(s) value = column_int(s, 0);
|
|
finalize(s);
|
|
return value;
|
|
}
|
|
|
|
set_meta :: (db: Db, key: string, value: s64) {
|
|
s := prepare(db, "INSERT INTO meta(key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value");
|
|
bind(s, 1, key);
|
|
bind(s, 2, value);
|
|
run(s);
|
|
finalize(s);
|
|
}
|
|
|
|
NOW_SQL :: "CAST(strftime('%s', 'now') AS INTEGER)";
|
|
|
|
//
|
|
// Users
|
|
//
|
|
|
|
valid_username :: (name: string) -> bool {
|
|
if name.count < 1 || name.count > 32 return false;
|
|
for i: 0..name.count-1 {
|
|
c := name[i];
|
|
ok := (c >= #char "a" && c <= #char "z") || (c >= #char "A" && c <= #char "Z") || (c >= #char "0" && c <= #char "9") ||
|
|
c == #char "." || c == #char "_" || c == #char "-";
|
|
if !ok return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
hash_password :: (password: string, salt: string, iterations: int) -> string {
|
|
digest := pbkdf2_sha256(password, salt, iterations);
|
|
result := alloc_string(32,, temp);
|
|
memcpy(result.data, digest.data, 32);
|
|
return result;
|
|
}
|
|
|
|
new_salt :: () -> string {
|
|
salt := alloc_string(16,, temp);
|
|
random_bytes(salt.data, 16);
|
|
return salt;
|
|
}
|
|
|
|
add_user :: (db: Db, username: string, display_name: string, password: string, admin: bool) -> error: string {
|
|
if !valid_username(username) return "Usernames are 1-32 characters: letters, digits, '.', '_' or '-'.";
|
|
if !display_name.count return "Display name can't be empty.";
|
|
if password.count < 8 return "Passwords need at least 8 characters.";
|
|
if find_user_id(db, username) return "That username is taken.";
|
|
salt := new_salt();
|
|
s := prepare(db, tprint("INSERT INTO users(username, display_name, pw_hash, pw_salt, pw_iter, is_admin, active, created) VALUES (?, ?, ?, ?, ?, ?, 1, %)", NOW_SQL));
|
|
bind(s, 1, username);
|
|
bind(s, 2, display_name);
|
|
bind_blob(s, 3, hash_password(password, salt, PBKDF2_ITERATIONS));
|
|
bind_blob(s, 4, salt);
|
|
bind(s, 5, PBKDF2_ITERATIONS);
|
|
bind(s, 6, cast(s64) admin);
|
|
ok := run(s);
|
|
finalize(s);
|
|
if !ok return "Could not add the user.";
|
|
bump_users_rev(db);
|
|
return "";
|
|
}
|
|
|
|
set_password :: (db: Db, user_id: s64, password: string, keep_session := "") -> error: string {
|
|
if password.count < 8 return "Passwords need at least 8 characters.";
|
|
salt := new_salt();
|
|
s := prepare(db, "UPDATE users SET pw_hash = ?, pw_salt = ?, pw_iter = ? WHERE id = ?");
|
|
bind_blob(s, 1, hash_password(password, salt, PBKDF2_ITERATIONS));
|
|
bind_blob(s, 2, salt);
|
|
bind(s, 3, PBKDF2_ITERATIONS);
|
|
bind(s, 4, user_id);
|
|
run(s);
|
|
finalize(s);
|
|
// Changing a password signs out every other session of that user.
|
|
s = prepare(db, "DELETE FROM sessions WHERE user_id = ? AND token_hash != ?");
|
|
bind(s, 1, user_id);
|
|
bind_blob(s, 2, keep_session);
|
|
run(s);
|
|
finalize(s);
|
|
return "";
|
|
}
|
|
|
|
find_user_id :: (db: Db, username: string) -> s64 {
|
|
s := prepare(db, "SELECT id FROM users WHERE username = ?");
|
|
bind(s, 1, username);
|
|
id: s64;
|
|
if step(s) id = column_int(s, 0);
|
|
finalize(s);
|
|
return id;
|
|
}
|
|
|
|
check_password :: (db: Db, user_id: s64, password: string) -> bool {
|
|
s := prepare(db, "SELECT pw_hash, pw_salt, pw_iter FROM users WHERE id = ?");
|
|
bind(s, 1, user_id);
|
|
ok := false;
|
|
if step(s) ok = constant_time_equal(hash_password(password, column_text(s, 1), column_int(s, 2)), column_text(s, 0));
|
|
finalize(s);
|
|
return ok;
|
|
}
|
|
|
|
bump_users_rev :: (db: Db) {
|
|
set_meta(db, "users_rev", get_meta(db, "users_rev") + 1);
|
|
}
|
|
|
|
read_password :: () -> string {
|
|
print("Password: ");
|
|
line := read_stdin_line();
|
|
// PowerShell prefixes piped input with a UTF-8 byte order mark.
|
|
if begins_with(line, "\xEF\xBB\xBF") advance(*line, 3);
|
|
while line.count && (line[line.count - 1] == #char "\n" || line[line.count - 1] == #char "\r") line.count -= 1;
|
|
return line;
|
|
}
|
|
|
|
#if OS == .WINDOWS {
|
|
read_stdin_line :: () -> string {
|
|
tf_k32 :: #system_library "kernel32";
|
|
GetStdHandle_ :: (which: s32) -> *void #foreign tf_k32 "GetStdHandle";
|
|
ReadFile_ :: (file: *void, buffer: *u8, to_read: u32, did_read: *u32, overlapped: *void) -> s32 #foreign tf_k32 "ReadFile";
|
|
handle := GetStdHandle_(-10);
|
|
b: String_Builder;
|
|
c: u8;
|
|
n: u32;
|
|
while ReadFile_(handle, *c, 1, *n, null) && n == 1 {
|
|
if c == #char "\n" break;
|
|
append(*b, c);
|
|
}
|
|
return builder_to_string(*b);
|
|
}
|
|
} else {
|
|
read_stdin_line :: () -> string {
|
|
b: String_Builder;
|
|
c: u8;
|
|
while read(0, *c, 1) == 1 {
|
|
if c == #char "\n" break;
|
|
append(*b, c);
|
|
}
|
|
return builder_to_string(*b);
|
|
}
|
|
}
|
|
|
|
//
|
|
// HTTP
|
|
//
|
|
|
|
serve :: () {
|
|
if !socket_init() exit(1);
|
|
listen_socket = socket(AF_INET, .STREAM, .TCP);
|
|
if listen_socket == INVALID_SOCKET { log_error("socket() failed"); exit(1); }
|
|
yes: s32 = 1;
|
|
setsockopt(listen_socket, SOL_SOCKET, SO_REUSEADDR, xx *yes, size_of(s32));
|
|
|
|
addr: sockaddr_in;
|
|
addr.sin_family = AF_INET;
|
|
addr.sin_port = htons(config.port);
|
|
ip := inet_addr(temp_c_string(config.listen_on));
|
|
memcpy(*addr.sin_addr, *ip, 4);
|
|
if bind(listen_socket, cast(*sockaddr) *addr, size_of(sockaddr_in)) != 0 {
|
|
log_error("Could not bind %:% (already in use?)", config.listen_on, config.port);
|
|
exit(1);
|
|
}
|
|
if listen(listen_socket, 128) != 0 { log_error("listen() failed"); exit(1); }
|
|
|
|
log("TaskForge server listening on http://%:% (db: %, web: %, % threads, SQLite %)",
|
|
config.listen_on, config.port, config.db_path, config.web_dir, config.threads, to_string(sql.sqlite3_libversion()));
|
|
|
|
// Every worker blocks in accept() on the shared socket and owns its own SQLite connection.
|
|
threads := NewArray(max(config.threads, 1) - 1, Thread);
|
|
for * threads {
|
|
thread_init(it, (t: *Thread) -> s64 { worker(); return 0; });
|
|
thread_start(it);
|
|
}
|
|
worker();
|
|
}
|
|
|
|
worker :: () {
|
|
db, ok := db_open(config.db_path);
|
|
if !ok return;
|
|
while true {
|
|
client := accept(listen_socket, null, null);
|
|
if client == INVALID_SOCKET continue;
|
|
set_timeouts(client, 15);
|
|
handle_connection(db, client);
|
|
#if OS == .WINDOWS closesocket(client);
|
|
else close(client);
|
|
reset_temporary_storage();
|
|
}
|
|
}
|
|
|
|
set_timeouts :: (s: Socket, seconds: s32) {
|
|
#if OS == .WINDOWS {
|
|
ms: u32 = cast(u32) seconds * 1000;
|
|
setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, xx *ms, size_of(u32));
|
|
setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, xx *ms, size_of(u32));
|
|
} else {
|
|
tv: timeval;
|
|
tv.tv_sec = seconds;
|
|
setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, *tv, size_of(timeval));
|
|
setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, *tv, size_of(timeval));
|
|
}
|
|
}
|
|
|
|
Request :: struct {
|
|
method: string;
|
|
path: string;
|
|
authorization: string;
|
|
body: string;
|
|
// Streamed uploads: the body isn't read up front; `body` holds what arrived with the headers.
|
|
streamed: bool;
|
|
content_length: s64;
|
|
}
|
|
|
|
MAX_UPLOAD :: 600 * 1024 * 1024;
|
|
|
|
handle_connection :: (db: Db, s: Socket) {
|
|
request, ok := read_request(s);
|
|
if !ok {
|
|
respond(s, 400, "text/plain", "Bad request\n");
|
|
return;
|
|
}
|
|
|
|
if request.method == "GET" && begins_with(request.path, "/api/blob/") {
|
|
handle_blob_download(db, s, request);
|
|
return;
|
|
}
|
|
if request.method == "POST" && request.path == "/api/blob" {
|
|
handle_blob_upload(db, s, request);
|
|
return;
|
|
}
|
|
if request.method == "GET" {
|
|
if request.path == "/api/info" {
|
|
respond(s, 200, "text/plain", "taskforge-server 1\n");
|
|
return;
|
|
}
|
|
serve_static(s, request.path);
|
|
return;
|
|
}
|
|
if request.method != "POST" {
|
|
respond(s, 405, "text/plain", "Method not allowed\n");
|
|
return;
|
|
}
|
|
|
|
if request.path == {
|
|
case "/api/login"; handle_login(db, s, request);
|
|
case "/api/logout"; handle_logout(db, s, request);
|
|
case "/api/sync"; handle_sync(db, s, request);
|
|
case "/api/users"; handle_users(db, s, request);
|
|
case; respond(s, 404, "text/plain", "Not found\n");
|
|
}
|
|
}
|
|
|
|
read_request :: (s: Socket) -> Request, bool {
|
|
request: Request;
|
|
buffer: [..] u8;
|
|
buffer.allocator = temp;
|
|
header_end := -1;
|
|
chunk: [16384] u8;
|
|
while header_end < 0 {
|
|
n := recv(s, chunk.data, xx chunk.count, 0);
|
|
if n <= 0 return request, false;
|
|
old := buffer.count;
|
|
array_resize(*buffer, old + n, initialize = false);
|
|
memcpy(buffer.data + old, chunk.data, n);
|
|
// Look for the blank line ending the headers.
|
|
start := max(0, old - 3);
|
|
for i: start..buffer.count-4 {
|
|
if buffer[i] == #char "\r" && buffer[i+1] == #char "\n" && buffer[i+2] == #char "\r" && buffer[i+3] == #char "\n" {
|
|
header_end = i + 4;
|
|
break;
|
|
}
|
|
}
|
|
if header_end < 0 && buffer.count > 65536 return request, false;
|
|
}
|
|
|
|
head: string;
|
|
head.data = buffer.data;
|
|
head.count = header_end;
|
|
lines := split(head, "\r\n",, temp);
|
|
if !lines.count return request, false;
|
|
parts := split(lines[0], " ",, temp);
|
|
if parts.count < 2 return request, false;
|
|
request.method = parts[0];
|
|
request.path = parts[1];
|
|
query := find_index_from_left(request.path, #char "?");
|
|
if query >= 0 request.path.count = query;
|
|
|
|
content_length := 0;
|
|
for line: lines {
|
|
colon := find_index_from_left(line, #char ":");
|
|
if colon <= 0 continue;
|
|
name := to_lower_copy(substring(line, 0, colon),, temp);
|
|
value := trim(substring(line, colon + 1, line.count));
|
|
if name == "content-length" content_length = string_to_int(value);
|
|
if name == "authorization" request.authorization = value;
|
|
}
|
|
have := min(buffer.count - header_end, content_length);
|
|
if request.method == "POST" && request.path == "/api/blob" {
|
|
if content_length < 0 || content_length > MAX_UPLOAD return request, false;
|
|
request.streamed = true;
|
|
request.content_length = content_length;
|
|
request.body = substring(string.{buffer.count, buffer.data}, header_end, header_end + have);
|
|
return request, true;
|
|
}
|
|
if content_length < 0 || content_length > MAX_BODY return request, false;
|
|
|
|
body := alloc_string(content_length,, temp);
|
|
memcpy(body.data, buffer.data + header_end, have);
|
|
while have < content_length {
|
|
n := recv(s, body.data + have, xx min(content_length - have, 1 << 20), 0);
|
|
if n <= 0 return request, false;
|
|
have += n;
|
|
}
|
|
request.body = body;
|
|
return request, true;
|
|
}
|
|
|
|
respond :: (s: Socket, status: int, content_type: string, body: string, extra_headers := "") {
|
|
reason := "OK";
|
|
if status == {
|
|
case 400; reason = "Bad Request";
|
|
case 401; reason = "Unauthorized";
|
|
case 403; reason = "Forbidden";
|
|
case 404; reason = "Not Found";
|
|
case 405; reason = "Method Not Allowed";
|
|
case 413; reason = "Payload Too Large";
|
|
case 415; reason = "Unsupported Media Type";
|
|
case 429; reason = "Too Many Requests";
|
|
case 500; reason = "Internal Server Error";
|
|
}
|
|
header := tprint("HTTP/1.1 % %\r\nContent-Type: %\r\nContent-Length: %\r\nConnection: close\r\nX-Content-Type-Options: nosniff\r\nCache-Control: no-cache\r\n%\r\n",
|
|
status, reason, content_type, body.count, extra_headers);
|
|
send_all(s, header);
|
|
send_all(s, body);
|
|
}
|
|
|
|
send_all :: (s: Socket, data: string) {
|
|
sent := 0;
|
|
while sent < data.count {
|
|
n := send(s, data.data + sent, xx min(data.count - sent, 1 << 20), 0);
|
|
if n <= 0 return;
|
|
sent += n;
|
|
}
|
|
}
|
|
|
|
serve_static :: (s: Socket, path: string) {
|
|
name := ifx path == "/" then "index.html" else substring(path, 1, path.count);
|
|
// Only plain file names from the web directory.
|
|
for i: 0..name.count-1 {
|
|
c := name[i];
|
|
ok := (c >= #char "a" && c <= #char "z") || (c >= #char "A" && c <= #char "Z") || (c >= #char "0" && c <= #char "9") ||
|
|
c == #char "." || c == #char "_" || c == #char "-";
|
|
if !ok || (c == #char "." && i == 0) {
|
|
respond(s, 404, "text/plain", "Not found\n");
|
|
return;
|
|
}
|
|
}
|
|
data, ok := read_entire_file(tprint("%/%", config.web_dir, name), log_errors = false);
|
|
if !ok {
|
|
respond(s, 404, "text/plain", "Not found\n");
|
|
return;
|
|
}
|
|
type := "application/octet-stream";
|
|
if ends_with(name, ".html") type = "text/html; charset=utf-8";
|
|
else if ends_with(name, ".js") type = "text/javascript; charset=utf-8";
|
|
else if ends_with(name, ".wasm") type = "application/wasm";
|
|
else if ends_with(name, ".css") type = "text/css; charset=utf-8";
|
|
respond(s, 200, type, data);
|
|
free(data);
|
|
}
|
|
|
|
//
|
|
// API
|
|
//
|
|
|
|
Session :: struct {
|
|
user_id: s64;
|
|
is_admin: bool;
|
|
token_hash: string;
|
|
}
|
|
|
|
authenticate :: (db: Db, request: Request) -> Session, bool {
|
|
session: Session;
|
|
prefix :: "Bearer ";
|
|
if !begins_with(request.authorization, prefix) return session, false;
|
|
token := substring(request.authorization, prefix.count, request.authorization.count);
|
|
token_hash := sha256(token);
|
|
s := prepare(db, tprint("SELECT u.id, u.is_admin, s.expires - % FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token_hash = ? AND s.expires > % AND u.active = 1", NOW_SQL, NOW_SQL));
|
|
bind_blob(s, 1, as_string(*token_hash));
|
|
ok := step(s);
|
|
remaining: s64;
|
|
if ok {
|
|
session.user_id = column_int(s, 0);
|
|
session.is_admin = column_int(s, 1) != 0;
|
|
session.token_hash = copy_string(as_string(*token_hash),, temp);
|
|
remaining = column_int(s, 2);
|
|
}
|
|
finalize(s);
|
|
// Sliding expiry, refreshed at most about once a day.
|
|
if ok && remaining < (SESSION_DAYS - 1) * 86400 {
|
|
u := prepare(db, tprint("UPDATE sessions SET expires = % + % WHERE token_hash = ?", NOW_SQL, SESSION_DAYS * 86400));
|
|
bind_blob(u, 1, as_string(*token_hash));
|
|
run(u);
|
|
finalize(u);
|
|
}
|
|
return session, ok;
|
|
}
|
|
|
|
handle_login :: (db: Db, s: Socket, request: Request) {
|
|
r := Line_Reader.{line = request.body};
|
|
username := next_token(*r);
|
|
password := next_token(*r);
|
|
|
|
// Throttle password guessing: 10 failures within 10 minutes locks the username for a while.
|
|
MAX_FAILURES :: 10;
|
|
WINDOW_SECONDS :: 600;
|
|
f := prepare(db, tprint("SELECT COUNT(*) FROM login_failures WHERE username = ? AND at > % - %", NOW_SQL, WINDOW_SECONDS));
|
|
bind(f, 1, username);
|
|
failures: s64;
|
|
if step(f) failures = column_int(f, 0);
|
|
finalize(f);
|
|
if failures >= MAX_FAILURES {
|
|
respond(s, 429, "text/plain", "error \"Too many failed attempts. Try again in a few minutes.\"\n");
|
|
return;
|
|
}
|
|
|
|
q := prepare(db, "SELECT id, pw_hash, pw_salt, pw_iter, active FROM users WHERE username = ?");
|
|
bind(q, 1, username);
|
|
found := step(q);
|
|
user_id: s64;
|
|
ok := false;
|
|
if found {
|
|
user_id = column_int(q, 0);
|
|
hash := hash_password(password, column_text(q, 2), column_int(q, 3));
|
|
ok = constant_time_equal(hash, column_text(q, 1)) && column_int(q, 4) != 0;
|
|
} else {
|
|
hash_password(password, "timing-equalizer", PBKDF2_ITERATIONS); // Don't reveal which usernames exist.
|
|
}
|
|
finalize(q);
|
|
if !ok {
|
|
record := prepare(db, tprint("INSERT INTO login_failures(username, at) VALUES (?, %)", NOW_SQL));
|
|
bind(record, 1, username);
|
|
run(record);
|
|
finalize(record);
|
|
db_exec(db, tprint("DELETE FROM login_failures WHERE at < % - 86400;", NOW_SQL));
|
|
respond(s, 401, "text/plain", "error \"Wrong username or password.\"\n");
|
|
return;
|
|
}
|
|
clear := prepare(db, "DELETE FROM login_failures WHERE username = ?");
|
|
bind(clear, 1, username);
|
|
run(clear);
|
|
finalize(clear);
|
|
|
|
token_bytes: [32] u8;
|
|
random_bytes(token_bytes.data, 32);
|
|
token := to_hex(token_bytes.data, 32);
|
|
token_hash := sha256(token);
|
|
db_exec(db, tprint("DELETE FROM sessions WHERE expires < %;", NOW_SQL));
|
|
ins := prepare(db, tprint("INSERT INTO sessions(token_hash, user_id, expires) VALUES (?, ?, % + %)", NOW_SQL, SESSION_DAYS * 86400));
|
|
bind_blob(ins, 1, as_string(*token_hash));
|
|
bind(ins, 2, user_id);
|
|
run(ins);
|
|
finalize(ins);
|
|
respond(s, 200, "text/plain", tprint("token %\n", token));
|
|
free(token);
|
|
}
|
|
|
|
handle_logout :: (db: Db, s: Socket, request: Request) {
|
|
prefix :: "Bearer ";
|
|
if begins_with(request.authorization, prefix) {
|
|
token := substring(request.authorization, prefix.count, request.authorization.count);
|
|
token_hash := sha256(token);
|
|
d := prepare(db, "DELETE FROM sessions WHERE token_hash = ?");
|
|
bind_blob(d, 1, as_string(*token_hash));
|
|
run(d);
|
|
finalize(d);
|
|
}
|
|
respond(s, 200, "text/plain", "ok\n");
|
|
}
|
|
|
|
handle_sync :: (db: Db, s: Socket, request: Request) {
|
|
session, authed := authenticate(db, request);
|
|
if !authed {
|
|
respond(s, 401, "text/plain", "error \"Please sign in again.\"\n");
|
|
return;
|
|
}
|
|
|
|
since: s64;
|
|
client_users_rev: s64;
|
|
want_ids := false;
|
|
puts: [..] string;
|
|
puts.allocator = temp;
|
|
dels: [..] string;
|
|
dels.allocator = temp;
|
|
|
|
body := request.body;
|
|
while body.count {
|
|
end := find_index_from_left(body, #char "\n");
|
|
if end < 0 end = body.count;
|
|
line := substring(body, 0, end);
|
|
advance(*body, min(end + 1, body.count));
|
|
if begins_with(line, "put ") array_add(*puts, substring(line, 4, line.count));
|
|
else if begins_with(line, "del ") array_add(*dels, substring(line, 4, line.count));
|
|
else if begins_with(line, "since ") since = string_to_int(substring(line, 6, line.count));
|
|
else if begins_with(line, "users_rev ") client_users_rev = string_to_int(substring(line, 10, line.count));
|
|
else if line == "ids" want_ids = true;
|
|
}
|
|
|
|
out: String_Builder;
|
|
out.allocator = temp;
|
|
|
|
db_exec(db, "BEGIN IMMEDIATE;");
|
|
rev := get_meta(db, "rev");
|
|
if puts.count || dels.count {
|
|
rev += 1;
|
|
up := prepare(db, "INSERT INTO records(key, line, rev, deleted, user_id) VALUES (?, ?, ?, 0, ?) ON CONFLICT(key) DO UPDATE SET line = excluded.line, rev = excluded.rev, deleted = 0, user_id = excluded.user_id");
|
|
for puts {
|
|
key := record_key(it);
|
|
if !key.count continue;
|
|
bind(up, 1, key);
|
|
bind(up, 2, it);
|
|
bind(up, 3, rev);
|
|
bind(up, 4, session.user_id);
|
|
run(up);
|
|
reset(up);
|
|
}
|
|
finalize(up);
|
|
del := prepare(db, "UPDATE records SET deleted = 1, line = '', rev = ?, user_id = ? WHERE key = ?");
|
|
for dels {
|
|
bind(del, 1, rev);
|
|
bind(del, 2, session.user_id);
|
|
bind(del, 3, it);
|
|
run(del);
|
|
reset(del);
|
|
}
|
|
finalize(del);
|
|
set_meta(db, "rev", rev);
|
|
}
|
|
if want_ids {
|
|
start := get_meta(db, "next_id");
|
|
set_meta(db, "next_id", start + ID_BLOCK);
|
|
print_to_builder(*out, "ids % %\n", start, ID_BLOCK);
|
|
}
|
|
|
|
print_to_builder(*out, "rev %\n", rev);
|
|
print_to_builder(*out, "me % %\n", session.user_id, cast(int) session.is_admin);
|
|
users_rev := get_meta(db, "users_rev");
|
|
if users_rev != client_users_rev {
|
|
print_to_builder(*out, "users_rev %\n", users_rev);
|
|
u := prepare(db, "SELECT id, username, display_name, is_admin, active FROM users ORDER BY display_name COLLATE NOCASE");
|
|
while step(u) {
|
|
print_to_builder(*out, "user % % % % %\n", column_int(u, 0), quoted(column_text(u, 1)), quoted(column_text(u, 2)), column_int(u, 3), column_int(u, 4));
|
|
}
|
|
finalize(u);
|
|
}
|
|
|
|
q := prepare(db, ifx since == 0 then "SELECT key, line, deleted FROM records WHERE rev > ? AND deleted = 0" else "SELECT key, line, deleted FROM records WHERE rev > ? ORDER BY rev");
|
|
bind(q, 1, since);
|
|
while step(q) {
|
|
if column_int(q, 2) print_to_builder(*out, "del %\n", column_text(q, 0));
|
|
else print_to_builder(*out, "put %\n", column_text(q, 1));
|
|
}
|
|
finalize(q);
|
|
db_exec(db, "COMMIT;");
|
|
|
|
respond(s, 200, "text/plain; charset=utf-8", builder_to_string(*out,, temp));
|
|
}
|
|
|
|
// Commands (one per request):
|
|
// add "username" "Display Name" "password" <admin> admin only
|
|
// update <id> "Display Name" <admin> <active> admin only
|
|
// password <id> "new password" "current password" admin, or yourself with your current password
|
|
handle_users :: (db: Db, s: Socket, request: Request) {
|
|
session, authed := authenticate(db, request);
|
|
if !authed {
|
|
respond(s, 401, "text/plain", "error \"Please sign in again.\"\n");
|
|
return;
|
|
}
|
|
error := users_command(db, session, request.body, session.token_hash);
|
|
if error respond(s, 400, "text/plain", tprint("error %\n", quoted(error)));
|
|
else respond(s, 200, "text/plain", "ok\n");
|
|
}
|
|
|
|
//
|
|
// Attachments: content-addressed blobs (images, videos) stored as files, named by their SHA-256.
|
|
//
|
|
|
|
blob_path :: (hash: string) -> string {
|
|
return tprint("%/%/%", config.blob_dir, substring(hash, 0, 2), hash);
|
|
}
|
|
|
|
valid_hash :: (hash: string) -> bool {
|
|
if hash.count != 64 return false;
|
|
for i: 0..63 {
|
|
c := hash[i];
|
|
if !((c >= #char "0" && c <= #char "9") || (c >= #char "a" && c <= #char "f")) return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
// Only images and videos may be stored.
|
|
allowed_media :: (head: string) -> bool {
|
|
starts :: (data: string, offset: int, magic: string) -> bool {
|
|
if data.count < offset + magic.count return false;
|
|
return memcmp(data.data + offset, magic.data, magic.count) == 0;
|
|
}
|
|
return starts(head, 0, "\x89PNG") || starts(head, 0, "\xFF\xD8\xFF") || starts(head, 0, "GIF8") || starts(head, 0, "BM") ||
|
|
(starts(head, 0, "RIFF") && (starts(head, 8, "WEBP") || starts(head, 8, "AVI "))) ||
|
|
starts(head, 4, "ftyp") || starts(head, 0, "\x1A\x45\xDF\xA3");
|
|
}
|
|
|
|
handle_blob_upload :: (db: Db, s: Socket, request: Request) {
|
|
session, authed := authenticate(db, request);
|
|
if !authed {
|
|
respond(s, 401, "text/plain", "error \"Please sign in again.\"\n");
|
|
return;
|
|
}
|
|
total := request.content_length;
|
|
|
|
// Stream to a temp file while hashing, so large videos never sit in memory.
|
|
token: [8] u8;
|
|
random_bytes(token.data, 8);
|
|
temp_path := tprint("%/upload-%.tmp", config.blob_dir, to_hex(token.data, 8));
|
|
file, ok := file_open(temp_path, for_writing = true);
|
|
if !ok {
|
|
respond(s, 500, "text/plain", "error \"Could not store the file.\"\n");
|
|
return;
|
|
}
|
|
hasher: Sha256;
|
|
sha256_init(*hasher);
|
|
head: [16] u8;
|
|
head_count := 0;
|
|
received := 0;
|
|
failed := false;
|
|
|
|
consume :: (data: *u8, count: int) #expand {
|
|
sha256_update(*hasher, data, count);
|
|
take := min(count, head.count - head_count);
|
|
if take > 0 { memcpy(head.data + head_count, data, take); head_count += take; }
|
|
if !file_write(*file, data, count) failed = true;
|
|
received += count;
|
|
}
|
|
|
|
if request.body.count consume(request.body.data, request.body.count);
|
|
chunk := NewArray(1 << 20, u8,, temp);
|
|
while received < total && !failed {
|
|
n := recv(s, chunk.data, xx min(total - received, chunk.count), 0);
|
|
if n <= 0 { failed = true; break; }
|
|
consume(chunk.data, n);
|
|
}
|
|
file_close(*file);
|
|
|
|
head_string := string.{head_count, head.data};
|
|
if failed || received != total || !allowed_media(head_string) {
|
|
file_delete(temp_path);
|
|
if !failed && received == total respond(s, 415, "text/plain", "error \"Only images and videos can be attached.\"\n");
|
|
else respond(s, 400, "text/plain", "error \"Upload interrupted.\"\n");
|
|
return;
|
|
}
|
|
|
|
digest := sha256_final(*hasher);
|
|
hash := to_hex(digest.data, 32);
|
|
final_path := blob_path(hash);
|
|
make_directory_if_it_does_not_exist(path_strip_filename(final_path));
|
|
if file_exists(final_path) file_delete(temp_path);
|
|
else file_move(temp_path, final_path);
|
|
|
|
ins := prepare(db, tprint("INSERT OR IGNORE INTO blobs(hash, size, created, user_id) VALUES (?, ?, %, ?)", NOW_SQL));
|
|
bind(ins, 1, hash);
|
|
bind(ins, 2, total);
|
|
bind(ins, 3, session.user_id);
|
|
run(ins);
|
|
finalize(ins);
|
|
respond(s, 200, "text/plain", tprint("hash %\n", hash));
|
|
}
|
|
|
|
handle_blob_download :: (db: Db, s: Socket, request: Request) {
|
|
_, authed := authenticate(db, request);
|
|
if !authed {
|
|
respond(s, 401, "text/plain", "error \"Please sign in again.\"\n");
|
|
return;
|
|
}
|
|
hash := substring(request.path, "/api/blob/".count, request.path.count);
|
|
if !valid_hash(hash) {
|
|
respond(s, 404, "text/plain", "Not found\n");
|
|
return;
|
|
}
|
|
file, ok := file_open(blob_path(hash), log_errors = false);
|
|
if !ok {
|
|
respond(s, 404, "text/plain", "Not found\n");
|
|
return;
|
|
}
|
|
defer file_close(*file);
|
|
length := file_length(file);
|
|
header := tprint("HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream\r\nContent-Length: %\r\nConnection: close\r\nX-Content-Type-Options: nosniff\r\nCache-Control: private, max-age=31536000, immutable\r\n\r\n", length);
|
|
send_all(s, header);
|
|
chunk := NewArray(1 << 20, u8,, temp);
|
|
sent := 0;
|
|
while sent < length {
|
|
ok, n := file_read(file, chunk.data, min(length - sent, chunk.count));
|
|
if !ok || n <= 0 break;
|
|
send_all(s, string.{n, chunk.data});
|
|
sent += n;
|
|
}
|
|
}
|
|
|
|
users_command :: (db: Db, session: Session, body: string, token_hash: string) -> error: string {
|
|
r := Line_Reader.{line = body};
|
|
command := next_token(*r);
|
|
if command == {
|
|
case "add";
|
|
if !session.is_admin { return "Only admins can add users."; }
|
|
username := next_token(*r);
|
|
name := next_token(*r);
|
|
password := next_token(*r);
|
|
admin := next_u32(*r) != 0;
|
|
return add_user(db, username, name, password, admin);
|
|
case "update";
|
|
if !session.is_admin { return "Only admins can change users."; }
|
|
id := cast(s64) next_u32(*r);
|
|
name := next_token(*r);
|
|
admin := next_u32(*r) != 0;
|
|
active := next_u32(*r) != 0;
|
|
if id == session.user_id && (!admin || !active) { return "You can't remove your own admin rights or deactivate yourself."; }
|
|
if !name.count { return "Display name can't be empty."; }
|
|
u := prepare(db, "UPDATE users SET display_name = ?, is_admin = ?, active = ? WHERE id = ?");
|
|
bind(u, 1, name);
|
|
bind(u, 2, cast(s64) admin);
|
|
bind(u, 3, cast(s64) active);
|
|
bind(u, 4, id);
|
|
run(u);
|
|
finalize(u);
|
|
if !active {
|
|
d := prepare(db, "DELETE FROM sessions WHERE user_id = ?");
|
|
bind(d, 1, id);
|
|
run(d);
|
|
finalize(d);
|
|
}
|
|
bump_users_rev(db);
|
|
case "password";
|
|
id := cast(s64) next_u32(*r);
|
|
password := next_token(*r);
|
|
current := next_token(*r);
|
|
if id != session.user_id && !session.is_admin { return "You can only change your own password."; }
|
|
if id == session.user_id && !check_password(db, id, current) { return "Your current password is wrong."; }
|
|
return set_password(db, id, password, ifx id == session.user_id then token_hash else "");
|
|
case;
|
|
return "Unknown command.";
|
|
}
|
|
return "";
|
|
}
|
|
|
|
#load "sqlite.jai";
|
|
#load "crypto.jai";
|
|
#load "../src/sha256.jai";
|
|
#load "../src/common.jai";
|
|
#load "../src/model.jai";
|
|
#load "../src/storage.jai";
|
|
|
|
#import "Basic";
|
|
#import "String";
|
|
#import "Math";
|
|
#import "File";
|
|
#import "Socket";
|
|
#import "Thread";
|
|
#import "File_Utilities";
|
|
#if OS != .WINDOWS {
|
|
#import "POSIX";
|
|
}
|