Merge pull request #2558 from Computroniks/feature/1685-prometheus-api-key

Added #1685: Add API keys for API authentication

server/auth.js

@@ -2,7 +2,9 @@ const basicAuth = require("express-basic-auth");
 const passwordHash = require("./password-hash");
 const { R } = require("redbean-node");
 const { setting } = require("./util-server");
-const { loginRateLimiter } = require("./rate-limiter");
+const { loginRateLimiter, apiRateLimiter } = require("./rate-limiter");
+const { Settings } = require("./settings");
+const dayjs = require("dayjs");
 
 /**
  * Login to web app
@@ -34,8 +36,36 @@ exports.login = async function (username, password) {
 };
 
 /**
- * Callback for myAuthorizer
- * @callback myAuthorizerCB
+ * Validate a provided API key
+ * @param {string} key API key to verify
+ */
+async function verifyAPIKey(key) {
+    if (typeof key !== "string") {
+        return false;
+    }
+
+    // uk prefix + key ID is before _
+    let index = key.substring(2, key.indexOf("_"));
+    let clear = key.substring(key.indexOf("_") + 1, key.length);
+
+    let hash = await R.findOne("api_key", " id=? ", [ index ]);
+
+    if (hash === null) {
+        return false;
+    }
+
+    let current = dayjs();
+    let expiry = dayjs(hash.expires);
+    if (expiry.diff(current) < 0 || !hash.active) {
+        return false;
+    }
+
+    return hash && passwordHash.verify(clear, hash.key);
+}
+
+/**
+ * Callback for basic auth authorizers
+ * @callback authCallback
  * @param {any} err Any error encountered
  * @param {boolean} authorized Is the client authorized?
  */
@@ -44,9 +74,31 @@ exports.login = async function (username, password) {
  * Custom authorizer for express-basic-auth
  * @param {string} username
  * @param {string} password
- * @param {myAuthorizerCB} callback
+ * @param {authCallback} callback
  */
-function myAuthorizer(username, password, callback) {
+function apiAuthorizer(username, password, callback) {
+    // API Rate Limit
+    apiRateLimiter.pass(null, 0).then((pass) => {
+        if (pass) {
+            verifyAPIKey(password).then((valid) => {
+                callback(null, valid);
+                // Only allow a set number of api requests per minute
+                // (currently set to 60)
+                apiRateLimiter.removeTokens(1);
+            });
+        } else {
+            callback(null, false);
+        }
+    });
+}
+
+/**
+ * Custom authorizer for express-basic-auth
+ * @param {string} username
+ * @param {string} password
+ * @param {authCallback} callback
+ */
+function userAuthorizer(username, password, callback) {
     // Login Rate Limit
     loginRateLimiter.pass(null, 0).then((pass) => {
         if (pass) {
@@ -71,7 +123,7 @@ function myAuthorizer(username, password, callback) {
  */
 exports.basicAuth = async function (req, res, next) {
     const middleware = basicAuth({
-        authorizer: myAuthorizer,
+        authorizer: userAuthorizer,
         authorizeAsync: true,
         challenge: true,
     });
@@ -84,3 +136,32 @@ exports.basicAuth = async function (req, res, next) {
         next();
     }
 };
+
+/**
+ * Use use API Key if API keys enabled, else use basic auth
+ * @param {express.Request} req Express request object
+ * @param {express.Response} res Express response object
+ * @param {express.NextFunction} next
+ */
+exports.apiAuth = async function (req, res, next) {
+    if (!await Settings.get("disableAuth")) {
+        let usingAPIKeys = await Settings.get("apiKeysEnabled");
+        let middleware;
+        if (usingAPIKeys) {
+            middleware = basicAuth({
+                authorizer: apiAuthorizer,
+                authorizeAsync: true,
+                challenge: true,
+            });
+        } else {
+            middleware = basicAuth({
+                authorizer: userAuthorizer,
+                authorizeAsync: true,
+                challenge: true,
+            });
+        }
+        middleware(req, res, next);
+    } else {
+        next();
+    }
+};

server/client.js

@@ -113,6 +113,31 @@ async function sendProxyList(socket) {
     return list;
 }
 
+/**
+ * Emit API key list to client
+ * @param {Socket} socket Socket.io socket instance
+ * @returns {Promise<void>}
+ */
+async function sendAPIKeyList(socket) {
+    const timeLogger = new TimeLogger();
+
+    let result = [];
+    const list = await R.find(
+        "api_key",
+        "user_id=?",
+        [ socket.userID ],
+    );
+
+    for (let bean of list) {
+        result.push(bean.toPublicJSON());
+    }
+
+    io.to(socket.userID).emit("apiKeyList", result);
+    timeLogger.print("Sent API Key List");
+
+    return list;
+}
+
 /**
  * Emits the version information to the client.
  * @param {Socket} socket Socket.io socket instance
@@ -157,6 +182,7 @@ module.exports = {
     sendImportantHeartbeatList,
     sendHeartbeatList,
     sendProxyList,
+    sendAPIKeyList,
     sendInfo,
     sendDockerHostList
 };

server/database.js

@@ -68,6 +68,7 @@ class Database {
         "patch-monitor-add-resend-interval.sql": true,
         "patch-ping-packet-size.sql": true,
         "patch-maintenance-table2.sql": true,
+        "patch-api-key-table.sql": true,
         "patch-add-gamedig-monitor.sql": true,
         "patch-add-google-analytics-status-page-tag.sql": true,
         "patch-http-body-encoding.sql": true,

server/model/api_key.js

@@ -0,0 +1,76 @@
+const { BeanModel } = require("redbean-node/dist/bean-model");
+const { R } = require("redbean-node");
+const dayjs = require("dayjs");
+
+class APIKey extends BeanModel {
+    /**
+     * Get the current status of this API key
+     * @returns {string} active, inactive or expired
+     */
+    getStatus() {
+        let current = dayjs();
+        let expiry = dayjs(this.expires);
+        if (expiry.diff(current) < 0) {
+            return "expired";
+        }
+
+        return this.active ? "active" : "inactive";
+    }
+
+    /**
+     * Returns an object that ready to parse to JSON
+     * @returns {Object}
+     */
+    toJSON() {
+        return {
+            id: this.id,
+            key: this.key,
+            name: this.name,
+            userID: this.user_id,
+            createdDate: this.created_date,
+            active: this.active,
+            expires: this.expires,
+            status: this.getStatus(),
+        };
+    }
+
+    /**
+     * Returns an object that ready to parse to JSON with sensitive fields
+     * removed
+     * @returns {Object}
+     */
+    toPublicJSON() {
+        return {
+            id: this.id,
+            name: this.name,
+            userID: this.user_id,
+            createdDate: this.created_date,
+            active: this.active,
+            expires: this.expires,
+            status: this.getStatus(),
+        };
+    }
+
+    /**
+     * Create a new API Key and store it in the database
+     * @param {Object} key Object sent by client
+     * @param {int} userID ID of socket user
+     * @returns {Promise<bean>}
+     */
+    static async save(key, userID) {
+        let bean;
+        bean = R.dispense("api_key");
+
+        bean.key = key.key;
+        bean.name = key.name;
+        bean.user_id = userID;
+        bean.active = key.active;
+        bean.expires = key.expires;
+
+        await R.store(bean);
+
+        return bean;
+    }
+}
+
+module.exports = APIKey;

server/rate-limiter.js

@@ -54,6 +54,13 @@ const loginRateLimiter = new KumaRateLimiter({
     errorMessage: "Too frequently, try again later."
 });
 
+const apiRateLimiter = new KumaRateLimiter({
+    tokensPerInterval: 60,
+    interval: "minute",
+    fireImmediately: true,
+    errorMessage: "Too frequently, try again later."
+});
+
 const twoFaRateLimiter = new KumaRateLimiter({
     tokensPerInterval: 30,
     interval: "minute",
@@ -63,5 +70,6 @@ const twoFaRateLimiter = new KumaRateLimiter({
 
 module.exports = {
     loginRateLimiter,
+    apiRateLimiter,
     twoFaRateLimiter,
 };

server/server.js

@@ -87,7 +87,7 @@ log.debug("server", "Importing Background Jobs");
 const { initBackgroundJobs, stopBackgroundJobs } = require("./jobs");
 const { loginRateLimiter, twoFaRateLimiter } = require("./rate-limiter");
 
-const { basicAuth } = require("./auth");
+const { apiAuth } = require("./auth");
 const { login } = require("./auth");
 const passwordHash = require("./password-hash");
 
@@ -129,7 +129,7 @@ if (config.demoMode) {
 }
 
 // Must be after io instantiation
-const { sendNotificationList, sendHeartbeatList, sendImportantHeartbeatList, sendInfo, sendProxyList, sendDockerHostList } = require("./client");
+const { sendNotificationList, sendHeartbeatList, sendImportantHeartbeatList, sendInfo, sendProxyList, sendDockerHostList, sendAPIKeyList } = require("./client");
 const { statusPageSocketHandler } = require("./socket-handlers/status-page-socket-handler");
 const databaseSocketHandler = require("./socket-handlers/database-socket-handler");
 const TwoFA = require("./2fa");
@@ -138,6 +138,7 @@ const { cloudflaredSocketHandler, autoStart: cloudflaredAutoStart, stop: cloudfl
 const { proxySocketHandler } = require("./socket-handlers/proxy-socket-handler");
 const { dockerSocketHandler } = require("./socket-handlers/docker-socket-handler");
 const { maintenanceSocketHandler } = require("./socket-handlers/maintenance-socket-handler");
+const { apiKeySocketHandler } = require("./socket-handlers/api-key-socket-handler");
 const { generalSocketHandler } = require("./socket-handlers/general-socket-handler");
 const { Settings } = require("./settings");
 const { CacheableDnsHttpAgent } = require("./cacheable-dns-http-agent");
@@ -229,7 +230,7 @@ let needSetup = false;
 
     // Prometheus API metrics  /metrics
     // With Basic Auth using the first user's username/password
-    app.get("/metrics", basicAuth, prometheusAPIMetrics());
+    app.get("/metrics", apiAuth, prometheusAPIMetrics());
 
     app.use("/", expressStaticGzip("dist", {
         enableBrotli: true,
@@ -1503,6 +1504,7 @@ let needSetup = false;
         proxySocketHandler(socket);
         dockerSocketHandler(socket);
         maintenanceSocketHandler(socket);
+        apiKeySocketHandler(socket);
         generalSocketHandler(socket, server);
         pluginsHandler(socket, server);
 
@@ -1611,6 +1613,7 @@ async function afterLogin(socket, user) {
     sendNotificationList(socket);
     sendProxyList(socket);
     sendDockerHostList(socket);
+    sendAPIKeyList(socket);
 
     await sleep(500);
 

server/socket-handlers/api-key-socket-handler.js

@@ -0,0 +1,150 @@
+const { checkLogin } = require("../util-server");
+const { log } = require("../../src/util");
+const { R } = require("redbean-node");
+const { nanoid } = require("nanoid");
+const passwordHash = require("../password-hash");
+const apicache = require("../modules/apicache");
+const APIKey = require("../model/api_key");
+const { Settings } = require("../settings");
+const { sendAPIKeyList } = require("../client");
+
+/**
+ * Handlers for Maintenance
+ * @param {Socket} socket Socket.io instance
+ */
+module.exports.apiKeySocketHandler = (socket) => {
+    // Add a new api key
+    socket.on("addAPIKey", async (key, callback) => {
+        try {
+            checkLogin(socket);
+
+            let clearKey = nanoid(40);
+            let hashedKey = passwordHash.generate(clearKey);
+            key["key"] = hashedKey;
+            let bean = await APIKey.save(key, socket.userID);
+
+            log.debug("apikeys", "Added API Key");
+            log.debug("apikeys", key);
+
+            // Append key ID and prefix to start of key seperated by _, used to get
+            // correct hash when validating key.
+            let formattedKey = "uk" + bean.id + "_" + clearKey;
+            await sendAPIKeyList(socket);
+
+            // Enable API auth if the user creates a key, otherwise only basic
+            // auth will be used for API.
+            await Settings.set("apiKeysEnabled", true);
+
+            callback({
+                ok: true,
+                msg: "Added Successfully.",
+                key: formattedKey,
+                keyID: bean.id,
+            });
+
+        } catch (e) {
+            callback({
+                ok: false,
+                msg: e.message,
+            });
+        }
+    });
+
+    socket.on("getAPIKeyList", async (callback) => {
+        try {
+            checkLogin(socket);
+            await sendAPIKeyList(socket);
+            callback({
+                ok: true,
+            });
+        } catch (e) {
+            console.error(e);
+            callback({
+                ok: false,
+                msg: e.message,
+            });
+        }
+    });
+
+    socket.on("deleteAPIKey", async (keyID, callback) => {
+        try {
+            checkLogin(socket);
+
+            log.debug("apikeys", `Deleted API Key: ${keyID} User ID: ${socket.userID}`);
+
+            await R.exec("DELETE FROM api_key WHERE id = ? AND user_id = ? ", [
+                keyID,
+                socket.userID,
+            ]);
+
+            apicache.clear();
+
+            callback({
+                ok: true,
+                msg: "Deleted Successfully.",
+            });
+
+            await sendAPIKeyList(socket);
+
+        } catch (e) {
+            callback({
+                ok: false,
+                msg: e.message,
+            });
+        }
+    });
+
+    socket.on("disableAPIKey", async (keyID, callback) => {
+        try {
+            checkLogin(socket);
+
+            log.debug("apikeys", `Disabled Key: ${keyID} User ID: ${socket.userID}`);
+
+            await R.exec("UPDATE api_key SET active = 0 WHERE id = ? ", [
+                keyID,
+            ]);
+
+            apicache.clear();
+
+            callback({
+                ok: true,
+                msg: "Disabled Successfully.",
+            });
+
+            await sendAPIKeyList(socket);
+
+        } catch (e) {
+            callback({
+                ok: false,
+                msg: e.message,
+            });
+        }
+    });
+
+    socket.on("enableAPIKey", async (keyID, callback) => {
+        try {
+            checkLogin(socket);
+
+            log.debug("apikeys", `Enabled Key: ${keyID} User ID: ${socket.userID}`);
+
+            await R.exec("UPDATE api_key SET active = 1 WHERE id = ? ", [
+                keyID,
+            ]);
+
+            apicache.clear();
+
+            callback({
+                ok: true,
+                msg: "Enabled Successfully",
+            });
+
+            await sendAPIKeyList(socket);
+
+        } catch (e) {
+            callback({
+                ok: false,
+                msg: e.message,
+            });
+        }
+    });
+};