Added liking and security measures

features/people/GET_profile.js

@@ -18,6 +18,9 @@ const {
   removeUploadedProfileFile,
   uploadDirectory,
 } = require("../../middleware/post_upload");
+const { areFriends } = require("../relations/friend_graph");
+const { authLimiter } = require("../../middleware/rate_limit");
+const { deletePostsByAuthor } = require("../posts/post_graph");
 
 const scrypt = promisify(crypto.scrypt);
 
@@ -49,16 +52,43 @@ function resolveProfileId(req) {
   return id;
 }
 
+function isPositiveInteger(value) {
+  const id = Number(value);
+  return Number.isInteger(id) && id > 0;
+}
+
+function limitedProfile(profile) {
+  return {
+    id: profile.id,
+    name: profile.name,
+    username: profile.username,
+  };
+}
+
 async function getProfile(req, res) {
   const id = resolveProfileId(req);
 
+  if (id !== req.user.id && !isPositiveInteger(id)) {
+    return res.status(400).send("Invalid profile id");
+  }
+
   try {
     const { rows } = await pool.query(
-      "SELECT id, name, username, profile_link FROM people WHERE id = $1",
+      "SELECT id, name, username, profile_link, private FROM people WHERE id = $1",
       [id],
     );
     if (rows.length === 0) return res.status(404).send("Profile not found");
-    return res.status(200).json(rows[0]);
+
+    const profile = rows[0];
+    const targetId = Number(id);
+    if (
+      profile.private &&
+      targetId !== req.user.id &&
+      !(await areFriends(req.user.id, targetId))
+    ) {
+      return res.status(200).json(limitedProfile(profile));
+    }
+    return res.status(200).json(profile);
   } catch (err) {
     console.error("profile query failed", {
       message: err.message,
@@ -132,6 +162,7 @@ async function updateProfile(req, res) {
     if (update.name !== undefined) addField("name", update.name);
     if (update.username !== undefined) addField("username", update.username);
     if (update.email !== undefined) addField("email", update.email);
+    if (update.private !== undefined) addField("private", update.private);
     if (update.password !== undefined) {
       addField("password", await hashPassword(update.password));
     }
@@ -142,7 +173,7 @@ async function updateProfile(req, res) {
     let rows;
     try {
       ({ rows } = await pool.query(
-        `UPDATE people SET ${fields.join(", ")} WHERE id = $${values.length} RETURNING id, name, username, profile_link`,
+        `UPDATE people SET ${fields.join(", ")} WHERE id = $${values.length} RETURNING id, name, username, profile_link, private`,
         values,
       ));
     } catch (err) {
@@ -156,6 +187,11 @@ async function updateProfile(req, res) {
       });
     }
 
+    if (update.password !== undefined) {
+      await pool.query("UPDATE people SET token_version = token_version + 1 WHERE id = $1", [req.user.id]);
+      await pool.query("DELETE FROM sessions WHERE user_id = $1", [req.user.id]);
+    }
+
     if (update.name !== undefined || update.username !== undefined) {
       await driver.executeQuery(
         "MATCH (p:Person {db_id: $db_id}) SET p.name = $name, p.username = $username",
@@ -207,9 +243,11 @@ async function deleteAccount(req, res) {
     }
     await removeImageLink(existing.rows[0].profile_link);
 
-    await pool.query("DELETE FROM posts WHERE author_id = $1", [req.user.id]);
+    await pool.query("DELETE FROM sessions WHERE user_id = $1", [req.user.id]);
+    await pool.query("UPDATE posts SET active = false WHERE author_id = $1", [req.user.id]);
     await pool.query("DELETE FROM people WHERE id = $1", [req.user.id]);
 
+    await deletePostsByAuthor(req.user.id);
     await driver.executeQuery(
       "MATCH (p:Person {db_id: $db_id}) DETACH DELETE p",
       { db_id: req.user.id },
@@ -237,12 +275,36 @@ async function deleteAccount(req, res) {
 router.get(
   "/image/:filename",
   strictInput(),
-  (req, res) => {
+  async (req, res) => {
     const filename = path.basename(req.params.filename);
     if (filename !== req.params.filename) return res.status(404).end();
-    res.sendFile(filename, { root: uploadDirectory }, (err) => {
-      if (err && !res.headersSent) res.status(err.statusCode === 404 ? 404 : 500).end();
-    });
+    try {
+      const { rows } = await pool.query(
+        "SELECT id, private FROM people WHERE profile_link = $1",
+        [`/profiles/image/${filename}`],
+      );
+      if (rows.length === 0) return res.status(404).send("Image not found");
+      const profile = rows[0];
+      if (
+        profile.private &&
+        Number(profile.id) !== req.user.id &&
+        !(await areFriends(req.user.id, profile.id))
+      ) {
+        return res.status(404).send("Image not found");
+      }
+      res.set("Cache-Control", "private, no-store");
+      res.sendFile(filename, { root: uploadDirectory }, (err) => {
+        if (err && !res.headersSent) res.status(err.statusCode === 404 ? 404 : 500).end();
+      });
+    } catch (err) {
+      console.error("profile image query failed", {
+        message: err.message,
+        code: err.code,
+        detail: err.detail,
+        hint: err.hint,
+      });
+      return res.status(500).send("Image could not be retrieved, request failed");
+    }
   },
 );
 
@@ -252,7 +314,7 @@ router.put(
   "/me",
   handleProfileUpload,
   strictInput({
-    body: ["name", "username", "email", "password", "current_password", "remove_image"],
+    body: ["name", "username", "email", "password", "current_password", "remove_image", "private"],
     cleanupUploadedFile: true,
   }),
   sanitizeProfileUpdate,
@@ -260,6 +322,7 @@ router.put(
 );
 router.delete(
   "/me",
+  authLimiter,
   strictInput({ body: ["password"] }),
   sanitizeAccountDelete,
   deleteAccount,

features/people/LOGIN_people.js

@@ -9,15 +9,20 @@ const { signToken } = require('../../middleware/authenticate_token');
 
 const scrypt = promisify(crypto.scrypt);
 
+// Fixed salt for unknown emails: the scrypt work is still performed so the
+// response time does not reveal whether the email address exists.
+const DUMMY_SALT = '00000000000000000000000000000000';
+
 async function login(req, res) {
     try {
         const { email, password } = req.loginInput;
         const { rows } = await pool.query(
-            'SELECT id, password FROM people WHERE email = $1',
+            'SELECT id, password, token_version FROM people WHERE email = $1',
             [email]
         );
 
         if (rows.length === 0) {
+            await scrypt(password, DUMMY_SALT, 64);
             res.status(401).send('Invalid email or password');
             return;
         }
@@ -34,7 +39,17 @@ async function login(req, res) {
             return;
         }
 
-        const { token, expiresAt } = signToken(rows[0].id);
+        const sessionId = crypto.randomUUID();
+        const deviceName = (req.headers['user-agent'] || 'unknown').slice(0, 255);
+        await pool.query(
+            'INSERT INTO sessions (id, user_id, device_name) VALUES ($1, $2, $3)',
+            [sessionId, rows[0].id, deviceName],
+        );
+
+        const { token, expiresAt } = signToken(rows[0].id, {
+            jti: sessionId,
+            tokenVersion: rows[0].token_version,
+        });
         res.cookie('fc_session_token', token, {
             httpOnly: true,
             secure: true,

features/people/LOGOUT_auth.js

@@ -0,0 +1,29 @@
+const express = require("express");
+const router = express.Router();
+const pool = require("../../db");
+const { strictInput } = require("../../middleware/strict_input");
+
+async function logout(req, res) {
+  try {
+    if (req.user.session_id) {
+      await pool.query(
+        "DELETE FROM sessions WHERE id = $1 AND user_id = $2",
+        [req.user.session_id, req.user.id],
+      );
+    }
+    res.clearCookie("fc_session_token", {
+      httpOnly: true,
+      secure: true,
+      sameSite: "Strict",
+      path: "/",
+    });
+    return res.status(200).json({ message: "Logged out" });
+  } catch (err) {
+    console.error("logout failed", { message: err.message, code: err.code });
+    return res.status(500).send("Logout failed, request could not be completed");
+  }
+}
+
+router.post("/", strictInput(), logout);
+
+module.exports = router;

features/people/MANAGE_sessions.js

@@ -0,0 +1,79 @@
+const express = require("express");
+const router = express.Router();
+const pool = require("../../db");
+const { strictInput } = require("../../middleware/strict_input");
+
+async function listSessions(req, res) {
+  try {
+    const { rows } = await pool.query(
+      `SELECT id, device_name, created_at, last_used_at
+       FROM sessions
+       WHERE user_id = $1
+       ORDER BY last_used_at DESC`,
+      [req.user.id],
+    );
+    const sessions = rows.map((s) => ({
+      ...s,
+      current: s.id === req.user.session_id,
+    }));
+    return res.status(200).json(sessions);
+  } catch (err) {
+    console.error("list sessions failed", {
+      message: err.message,
+      code: err.code,
+    });
+    return res.status(500).send("Sessions could not be retrieved, request failed");
+  }
+}
+
+async function deleteSession(req, res) {
+  try {
+    const { id } = req.params;
+    const uuidPattern =
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!uuidPattern.test(id)) {
+      return res.status(400).send("Invalid session id");
+    }
+    const result = await pool.query(
+      "DELETE FROM sessions WHERE id = $1 AND user_id = $2 RETURNING id",
+      [id, req.user.id],
+    );
+    if (result.rowCount === 0) {
+      return res.status(404).send("Session not found or does not belong to you");
+    }
+    return res.status(200).json({ message: "Session deleted" });
+  } catch (err) {
+    console.error("delete session failed", {
+      message: err.message,
+      code: err.code,
+    });
+    return res.status(500).send("Session could not be deleted, request failed");
+  }
+}
+
+async function deleteOtherSessions(req, res) {
+  if (!req.user.session_id) {
+    return res
+      .status(400)
+      .send("Current session could not be identified, please log in again");
+  }
+  try {
+    await pool.query(
+      "DELETE FROM sessions WHERE user_id = $1 AND id != $2",
+      [req.user.id, req.user.session_id],
+    );
+    return res.status(200).json({ message: "Other sessions deleted" });
+  } catch (err) {
+    console.error("delete other sessions failed", {
+      message: err.message,
+      code: err.code,
+    });
+    return res.status(500).send("Sessions could not be deleted, request failed");
+  }
+}
+
+router.get("/", strictInput(), listSessions);
+router.delete("/", strictInput(), deleteOtherSessions);
+router.delete("/:id", strictInput(), deleteSession);
+
+module.exports = router;

features/people/REGISTER_people.js

@@ -62,6 +62,17 @@ async function create_people(req, res) {
     const person = req.person;
     let db_id;
 
+    const existing = await pool
+        .query('SELECT 1 FROM people WHERE username = $1 OR email = $2 LIMIT 1', [
+            person.username,
+            person.email,
+        ])
+        .catch(() => null);
+    if (existing && existing.rowCount > 0) {
+        res.status(409).send('Username or email is already in use');
+        return;
+    }
+
     try {
         db_id = await insert_db(
             person.name,
@@ -71,6 +82,10 @@ async function create_people(req, res) {
         );
     }
     catch (err) {
+        if (err.code === '23505') {
+            res.status(409).send('Username or email is already in use');
+            return;
+        }
         res.status(500).send('Data was not pushed to database, request failed');
         return;
     }
@@ -80,6 +95,9 @@ async function create_people(req, res) {
         res.status(201).json({ id: db_id });
     }
     catch (err) {
+        // Compensate the SQL insert so the user does not exist in one database
+        // but not the other.
+        await pool.query('DELETE FROM people WHERE id = $1', [db_id]).catch(() => {});
         res.status(500).send('Data was not pushed to graph database, request failed');
     }
 };