mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
fix(security): close the gaps a full 2.0 re-audit left open (#620)
Follow-up to a full re-audit of the 2.0 tree. Most prior findings were already fixed; this closes the ones that were not: - SAML assertion replay: validateInResponseTo ifPresent plus a Redis-backed CacheProvider, so a captured signed assertion cannot be replayed. ifPresent keeps IdP-initiated SSO working. - MFA login challenge burned after 5 wrong TOTP codes. - api_keys.key_prefix indexed; the per-request lookup was a full table scan. - MAX_AI_JOBS_PER_USER caps a user's in-flight single-file AI jobs (the AI pool runs at concurrency 1). Batch and pipeline AI stay uncapped. - MAX_WORKSPACE_SIZE_GB enforced instead of being dead config. - SUBPROCESS_MEMORY_LIMIT_MB (default off) for the native media and doc engines; not applied to the AI sidecar. - SVG sanitizer closes unquoted and whitespace-prefixed javascript: hrefs and the animateTransform/animateMotion/handler/mpath elements. - Windows-style paths stripped from error output to match the Sentry scrubber. - Postgres and Redis compose services get cap_drop plus pids_limit and cpus. - .env.example ships MAX_SVG_SIZE_MB=50 (0 disabled the cap). Adds security-focused unit and integration tests. typecheck, biome, and the full unit and integration suites pass.
This commit is contained in:
SnapOtter
@@ -0,0 +1 @@
|
||||
CREATE INDEX "api_keys_key_prefix_idx" ON "api_keys" USING btree ("key_prefix");
|
||||
@@ -0,0 +1,992 @@
|
||||
{
|
||||
"id": "5634b76b-9b83-4a81-9307-bebc895cbf65",
|
||||
"prevId": "9e790b1b-8a07-4885-b3d9-3d3f81d0d4e8",
|
||||
"version": "7",
|
||||
"dialect": "postgresql",
|
||||
"tables": {
|
||||
"public.api_keys": {
|
||||
"name": "api_keys",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"user_id": {
|
||||
"name": "user_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"key_hash": {
|
||||
"name": "key_hash",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"key_prefix": {
|
||||
"name": "key_prefix",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"name": {
|
||||
"name": "name",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "'Default API Key'"
|
||||
},
|
||||
"permissions": {
|
||||
"name": "permissions",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"last_used_at": {
|
||||
"name": "last_used_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"expires_at": {
|
||||
"name": "expires_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
}
|
||||
},
|
||||
"indexes": {
|
||||
"api_keys_key_prefix_idx": {
|
||||
"name": "api_keys_key_prefix_idx",
|
||||
"columns": [
|
||||
{
|
||||
"expression": "key_prefix",
|
||||
"isExpression": false,
|
||||
"asc": true,
|
||||
"nulls": "last"
|
||||
}
|
||||
],
|
||||
"isUnique": false,
|
||||
"concurrently": false,
|
||||
"method": "btree",
|
||||
"with": {}
|
||||
}
|
||||
},
|
||||
"foreignKeys": {
|
||||
"api_keys_user_id_users_id_fk": {
|
||||
"name": "api_keys_user_id_users_id_fk",
|
||||
"tableFrom": "api_keys",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["user_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "cascade",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.audit_log": {
|
||||
"name": "audit_log",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"actor_id": {
|
||||
"name": "actor_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"actor_username": {
|
||||
"name": "actor_username",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"action": {
|
||||
"name": "action",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"target_type": {
|
||||
"name": "target_type",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"target_id": {
|
||||
"name": "target_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"details": {
|
||||
"name": "details",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"ip_address": {
|
||||
"name": "ip_address",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"integrity": {
|
||||
"name": "integrity",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"request_id": {
|
||||
"name": "request_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {
|
||||
"audit_log_created_at_idx": {
|
||||
"name": "audit_log_created_at_idx",
|
||||
"columns": [
|
||||
{
|
||||
"expression": "created_at",
|
||||
"isExpression": false,
|
||||
"asc": true,
|
||||
"nulls": "last"
|
||||
}
|
||||
],
|
||||
"isUnique": false,
|
||||
"concurrently": false,
|
||||
"method": "btree",
|
||||
"with": {}
|
||||
},
|
||||
"audit_log_action_idx": {
|
||||
"name": "audit_log_action_idx",
|
||||
"columns": [
|
||||
{
|
||||
"expression": "action",
|
||||
"isExpression": false,
|
||||
"asc": true,
|
||||
"nulls": "last"
|
||||
}
|
||||
],
|
||||
"isUnique": false,
|
||||
"concurrently": false,
|
||||
"method": "btree",
|
||||
"with": {}
|
||||
},
|
||||
"audit_log_actor_id_idx": {
|
||||
"name": "audit_log_actor_id_idx",
|
||||
"columns": [
|
||||
{
|
||||
"expression": "actor_id",
|
||||
"isExpression": false,
|
||||
"asc": true,
|
||||
"nulls": "last"
|
||||
}
|
||||
],
|
||||
"isUnique": false,
|
||||
"concurrently": false,
|
||||
"method": "btree",
|
||||
"with": {}
|
||||
}
|
||||
},
|
||||
"foreignKeys": {
|
||||
"audit_log_actor_id_users_id_fk": {
|
||||
"name": "audit_log_actor_id_users_id_fk",
|
||||
"tableFrom": "audit_log",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["actor_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "set null",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.jobs": {
|
||||
"name": "jobs",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"user_id": {
|
||||
"name": "user_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"tool_id": {
|
||||
"name": "tool_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"pool": {
|
||||
"name": "pool",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"type": {
|
||||
"name": "type",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"status": {
|
||||
"name": "status",
|
||||
"type": "job_status",
|
||||
"typeSchema": "public",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "'queued'"
|
||||
},
|
||||
"attempts": {
|
||||
"name": "attempts",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": 0
|
||||
},
|
||||
"progress": {
|
||||
"name": "progress",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"input_refs": {
|
||||
"name": "input_refs",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"output_refs": {
|
||||
"name": "output_refs",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"settings": {
|
||||
"name": "settings",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"error": {
|
||||
"name": "error",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"bytes_in": {
|
||||
"name": "bytes_in",
|
||||
"type": "bigint",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"bytes_out": {
|
||||
"name": "bytes_out",
|
||||
"type": "bigint",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"duration_ms": {
|
||||
"name": "duration_ms",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"started_at": {
|
||||
"name": "started_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"completed_at": {
|
||||
"name": "completed_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"delete_after": {
|
||||
"name": "delete_after",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
}
|
||||
},
|
||||
"indexes": {
|
||||
"jobs_created_at_idx": {
|
||||
"name": "jobs_created_at_idx",
|
||||
"columns": [
|
||||
{
|
||||
"expression": "created_at",
|
||||
"isExpression": false,
|
||||
"asc": true,
|
||||
"nulls": "last"
|
||||
}
|
||||
],
|
||||
"isUnique": false,
|
||||
"concurrently": false,
|
||||
"method": "btree",
|
||||
"with": {}
|
||||
},
|
||||
"jobs_status_idx": {
|
||||
"name": "jobs_status_idx",
|
||||
"columns": [
|
||||
{
|
||||
"expression": "status",
|
||||
"isExpression": false,
|
||||
"asc": true,
|
||||
"nulls": "last"
|
||||
}
|
||||
],
|
||||
"isUnique": false,
|
||||
"concurrently": false,
|
||||
"method": "btree",
|
||||
"with": {}
|
||||
}
|
||||
},
|
||||
"foreignKeys": {
|
||||
"jobs_user_id_users_id_fk": {
|
||||
"name": "jobs_user_id_users_id_fk",
|
||||
"tableFrom": "jobs",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["user_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "set null",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.pipelines": {
|
||||
"name": "pipelines",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"user_id": {
|
||||
"name": "user_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"name": {
|
||||
"name": "name",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"description": {
|
||||
"name": "description",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"steps": {
|
||||
"name": "steps",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {
|
||||
"pipelines_user_id_users_id_fk": {
|
||||
"name": "pipelines_user_id_users_id_fk",
|
||||
"tableFrom": "pipelines",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["user_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "cascade",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.roles": {
|
||||
"name": "roles",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"name": {
|
||||
"name": "name",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"description": {
|
||||
"name": "description",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "''"
|
||||
},
|
||||
"permissions": {
|
||||
"name": "permissions",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"tool_permissions": {
|
||||
"name": "tool_permissions",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"is_builtin": {
|
||||
"name": "is_builtin",
|
||||
"type": "boolean",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": false
|
||||
},
|
||||
"created_by": {
|
||||
"name": "created_by",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"updated_at": {
|
||||
"name": "updated_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {
|
||||
"roles_created_by_users_id_fk": {
|
||||
"name": "roles_created_by_users_id_fk",
|
||||
"tableFrom": "roles",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["created_by"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "set null",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {
|
||||
"roles_name_unique": {
|
||||
"name": "roles_name_unique",
|
||||
"nullsNotDistinct": false,
|
||||
"columns": ["name"]
|
||||
}
|
||||
},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.sessions": {
|
||||
"name": "sessions",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"user_id": {
|
||||
"name": "user_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"expires_at": {
|
||||
"name": "expires_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"id_token": {
|
||||
"name": "id_token",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"last_activity": {
|
||||
"name": "last_activity",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {
|
||||
"sessions_user_id_users_id_fk": {
|
||||
"name": "sessions_user_id_users_id_fk",
|
||||
"tableFrom": "sessions",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["user_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "cascade",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.settings": {
|
||||
"name": "settings",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"key": {
|
||||
"name": "key",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"value": {
|
||||
"name": "value",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"updated_at": {
|
||||
"name": "updated_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.teams": {
|
||||
"name": "teams",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"name": {
|
||||
"name": "name",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"legal_hold": {
|
||||
"name": "legal_hold",
|
||||
"type": "boolean",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": false
|
||||
},
|
||||
"storage_quota": {
|
||||
"name": "storage_quota",
|
||||
"type": "bigint",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"retention_hours": {
|
||||
"name": "retention_hours",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {
|
||||
"teams_name_unique": {
|
||||
"name": "teams_name_unique",
|
||||
"nullsNotDistinct": false,
|
||||
"columns": ["name"]
|
||||
}
|
||||
},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.user_files": {
|
||||
"name": "user_files",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"user_id": {
|
||||
"name": "user_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"original_name": {
|
||||
"name": "original_name",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"stored_name": {
|
||||
"name": "stored_name",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"mime_type": {
|
||||
"name": "mime_type",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"size": {
|
||||
"name": "size",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"width": {
|
||||
"name": "width",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"height": {
|
||||
"name": "height",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"version": {
|
||||
"name": "version",
|
||||
"type": "integer",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": 1
|
||||
},
|
||||
"parent_id": {
|
||||
"name": "parent_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"tool_chain": {
|
||||
"name": "tool_chain",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {
|
||||
"user_files_user_id_users_id_fk": {
|
||||
"name": "user_files_user_id_users_id_fk",
|
||||
"tableFrom": "user_files",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["user_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "cascade",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.user_preferences": {
|
||||
"name": "user_preferences",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"user_id": {
|
||||
"name": "user_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"key": {
|
||||
"name": "key",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"value": {
|
||||
"name": "value",
|
||||
"type": "jsonb",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"updated_at": {
|
||||
"name": "updated_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "now()"
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {
|
||||
"user_preferences_user_id_users_id_fk": {
|
||||
"name": "user_preferences_user_id_users_id_fk",
|
||||
"tableFrom": "user_preferences",
|
||||
"tableTo": "users",
|
||||
"columnsFrom": ["user_id"],
|
||||
"columnsTo": ["id"],
|
||||
"onDelete": "cascade",
|
||||
"onUpdate": "no action"
|
||||
}
|
||||
},
|
||||
"compositePrimaryKeys": {
|
||||
"user_preferences_user_id_key_pk": {
|
||||
"name": "user_preferences_user_id_key_pk",
|
||||
"columns": ["user_id", "key"]
|
||||
}
|
||||
},
|
||||
"uniqueConstraints": {},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
},
|
||||
"public.users": {
|
||||
"name": "users",
|
||||
"schema": "",
|
||||
"columns": {
|
||||
"id": {
|
||||
"name": "id",
|
||||
"type": "text",
|
||||
"primaryKey": true,
|
||||
"notNull": true
|
||||
},
|
||||
"username": {
|
||||
"name": "username",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"password_hash": {
|
||||
"name": "password_hash",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"role": {
|
||||
"name": "role",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "'user'"
|
||||
},
|
||||
"team": {
|
||||
"name": "team",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "'Default'"
|
||||
},
|
||||
"must_change_password": {
|
||||
"name": "must_change_password",
|
||||
"type": "boolean",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": true
|
||||
},
|
||||
"auth_provider": {
|
||||
"name": "auth_provider",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": "'local'"
|
||||
},
|
||||
"external_id": {
|
||||
"name": "external_id",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"email": {
|
||||
"name": "email",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"legal_hold": {
|
||||
"name": "legal_hold",
|
||||
"type": "boolean",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": false
|
||||
},
|
||||
"storage_used": {
|
||||
"name": "storage_used",
|
||||
"type": "bigint",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": 0
|
||||
},
|
||||
"storage_quota": {
|
||||
"name": "storage_quota",
|
||||
"type": "bigint",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"created_at": {
|
||||
"name": "created_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"updated_at": {
|
||||
"name": "updated_at",
|
||||
"type": "timestamp with time zone",
|
||||
"primaryKey": false,
|
||||
"notNull": true
|
||||
},
|
||||
"totp_secret": {
|
||||
"name": "totp_secret",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
},
|
||||
"totp_enabled": {
|
||||
"name": "totp_enabled",
|
||||
"type": "boolean",
|
||||
"primaryKey": false,
|
||||
"notNull": true,
|
||||
"default": false
|
||||
},
|
||||
"recovery_codes_hash": {
|
||||
"name": "recovery_codes_hash",
|
||||
"type": "text",
|
||||
"primaryKey": false,
|
||||
"notNull": false
|
||||
}
|
||||
},
|
||||
"indexes": {},
|
||||
"foreignKeys": {},
|
||||
"compositePrimaryKeys": {},
|
||||
"uniqueConstraints": {
|
||||
"users_username_unique": {
|
||||
"name": "users_username_unique",
|
||||
"nullsNotDistinct": false,
|
||||
"columns": ["username"]
|
||||
}
|
||||
},
|
||||
"policies": {},
|
||||
"checkConstraints": {},
|
||||
"isRLSEnabled": false
|
||||
}
|
||||
},
|
||||
"enums": {
|
||||
"public.job_status": {
|
||||
"name": "job_status",
|
||||
"schema": "public",
|
||||
"values": ["queued", "processing", "completed", "failed", "canceled"]
|
||||
}
|
||||
},
|
||||
"schemas": {},
|
||||
"sequences": {},
|
||||
"roles": {},
|
||||
"policies": {},
|
||||
"views": {},
|
||||
"_meta": {
|
||||
"columns": {},
|
||||
"schemas": {},
|
||||
"tables": {}
|
||||
}
|
||||
}
|
||||
@@ -43,6 +43,13 @@
|
||||
"when": 1782266352290,
|
||||
"tag": "0005_special_exodus",
|
||||
"breakpoints": true
|
||||
},
|
||||
{
|
||||
"idx": 6,
|
||||
"version": "7",
|
||||
"when": 1784729211461,
|
||||
"tag": "0006_majestic_sinister_six",
|
||||
"breakpoints": true
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
+22
-15
@@ -110,21 +110,28 @@ export const jobs = pgTable(
|
||||
],
|
||||
);
|
||||
|
||||
export const apiKeys = pgTable("api_keys", {
|
||||
id: text("id").primaryKey(),
|
||||
userId: text("user_id")
|
||||
.notNull()
|
||||
.references(() => users.id, { onDelete: "cascade" }),
|
||||
keyHash: text("key_hash").notNull(),
|
||||
keyPrefix: text("key_prefix"),
|
||||
name: text("name").notNull().default("Default API Key"),
|
||||
permissions: jsonb("permissions").$type<string[]>(),
|
||||
createdAt: timestamp("created_at", { withTimezone: true })
|
||||
.notNull()
|
||||
.$defaultFn(() => new Date()),
|
||||
lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
|
||||
expiresAt: timestamp("expires_at", { withTimezone: true }),
|
||||
});
|
||||
export const apiKeys = pgTable(
|
||||
"api_keys",
|
||||
{
|
||||
id: text("id").primaryKey(),
|
||||
userId: text("user_id")
|
||||
.notNull()
|
||||
.references(() => users.id, { onDelete: "cascade" }),
|
||||
keyHash: text("key_hash").notNull(),
|
||||
keyPrefix: text("key_prefix"),
|
||||
name: text("name").notNull().default("Default API Key"),
|
||||
permissions: jsonb("permissions").$type<string[]>(),
|
||||
createdAt: timestamp("created_at", { withTimezone: true })
|
||||
.notNull()
|
||||
.$defaultFn(() => new Date()),
|
||||
lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
|
||||
expiresAt: timestamp("expires_at", { withTimezone: true }),
|
||||
},
|
||||
// Prefix lookup runs on every API-key auth; without this index it is a full
|
||||
// table scan. The prefix is a SHA-256 slice (not unique by construction), so
|
||||
// a non-unique index is correct.
|
||||
(table) => [index("api_keys_key_prefix_idx").on(table.keyPrefix)],
|
||||
);
|
||||
|
||||
export const pipelines = pgTable("pipelines", {
|
||||
id: text("id").primaryKey(),
|
||||
|
||||
@@ -10,6 +10,7 @@ import { FlowProducer, type Job, QueueEvents } from "bullmq";
|
||||
import { eq } from "drizzle-orm";
|
||||
import { env } from "../config.js";
|
||||
import { db, schema } from "../db/index.js";
|
||||
import { assertAiJobQuota } from "../lib/ai-quota.js";
|
||||
import { createBullMQConnection } from "./connection.js";
|
||||
import { getQueue } from "./queues.js";
|
||||
import { POOLS, type Pool, queueName, type ToolJobData, type ToolJobResult } from "./types.js";
|
||||
@@ -114,6 +115,13 @@ export function injectTraceContext(data: ToolJobData): void {
|
||||
* Returns the BullMQ Job instance.
|
||||
*/
|
||||
export async function enqueueToolJob(data: ToolJobData): Promise<Job<ToolJobData, ToolJobResult>> {
|
||||
// Per-user concurrency cap for single-file AI jobs (kind "ai-tool"). Checked
|
||||
// before the row insert so a rejected request leaves no job behind. Batch and
|
||||
// pipeline AI use other kinds and are intentionally not capped here.
|
||||
if (data.kind === "ai-tool") {
|
||||
await assertAiJobQuota(data.userId);
|
||||
}
|
||||
|
||||
// Insert the durable DB row first (crash-safe: row exists even if
|
||||
// Redis add fails and the job is retried on next boot).
|
||||
// When dbSettings is provided, persist the redacted version instead of
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
/**
|
||||
* Per-user concurrent AI-job cap.
|
||||
*
|
||||
* The AI BullMQ pool runs at concurrency 1, so a single user who enqueues many
|
||||
* single-file AI jobs (each a heavy Python model load) monopolizes the worker
|
||||
* and starves everyone else. This bounds a user's in-flight AI jobs. Batch and
|
||||
* pipeline AI use other job kinds and are deliberately not counted here: they
|
||||
* are already bounded by MAX_BATCH_SIZE and the pipeline step count, and capping
|
||||
* them would break legitimate multi-file AI runs.
|
||||
*/
|
||||
import { and, count, eq, inArray } from "drizzle-orm";
|
||||
import { env } from "../config.js";
|
||||
import { db, schema } from "../db/index.js";
|
||||
|
||||
/** Pure threshold check exported for unit testing. cap <= 0 disables the limit. */
|
||||
export function isOverAiJobCap(inFlight: number, cap: number): boolean {
|
||||
return cap > 0 && inFlight >= cap;
|
||||
}
|
||||
|
||||
/** Count a user's queued + processing single-file AI jobs (job kind "ai-tool"). */
|
||||
export async function countInFlightAiJobs(userId: string): Promise<number> {
|
||||
const rows = await db
|
||||
.select({ c: count() })
|
||||
.from(schema.jobs)
|
||||
.where(
|
||||
and(
|
||||
eq(schema.jobs.userId, userId),
|
||||
eq(schema.jobs.type, "ai-tool"),
|
||||
inArray(schema.jobs.status, ["queued", "processing"]),
|
||||
),
|
||||
);
|
||||
return rows[0]?.c ?? 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Throw a 429-tagged error when the user already has MAX_AI_JOBS_PER_USER
|
||||
* single-file AI jobs in flight. No-op when the cap is disabled (<= 0) or the
|
||||
* request is unauthenticated (no user to key on).
|
||||
*/
|
||||
export async function assertAiJobQuota(userId: string | null | undefined): Promise<void> {
|
||||
const cap = env.MAX_AI_JOBS_PER_USER;
|
||||
if (cap <= 0 || !userId) return;
|
||||
const inFlight = await countInFlightAiJobs(userId);
|
||||
if (isOverAiJobCap(inFlight, cap)) {
|
||||
const error = new Error(
|
||||
"Too many concurrent AI jobs. Please wait for existing jobs to finish.",
|
||||
);
|
||||
(error as Error & { statusCode: number }).statusCode = 429;
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
@@ -59,6 +59,16 @@ const envSchema = z
|
||||
MAX_SPLIT_GRID: z.coerce.number().default(100),
|
||||
MAX_STORAGE_PER_USER_MB: z.coerce.number().default(5000),
|
||||
MAX_WORKSPACE_SIZE_GB: z.coerce.number().default(10),
|
||||
// Max single-file AI jobs one user may have queued/processing at once. The
|
||||
// AI pool runs at concurrency 1, so this stops one user from starving it.
|
||||
// 0 = unlimited. Batch/pipeline AI are bounded separately and not counted.
|
||||
MAX_AI_JOBS_PER_USER: z.coerce.number().default(5),
|
||||
// Optional per-process address-space cap (MB) for the native media/doc
|
||||
// engines (ffmpeg, ghostscript, qpdf, libreoffice, pandoc, pdfcpu). 0 =
|
||||
// disabled (the container memory limit is the primary backstop). Not applied
|
||||
// to the AI sidecar (torch/CUDA reserve huge virtual space). See
|
||||
// packages/shared/src/subprocess-limit.ts.
|
||||
SUBPROCESS_MEMORY_LIMIT_MB: z.coerce.number().default(0),
|
||||
MAX_PDF_PAGES: z.coerce.number().default(0),
|
||||
MAX_VIDEO_DURATION_S: z.coerce.number().default(0),
|
||||
MAX_AUDIO_DURATION_S: z.coerce.number().default(0),
|
||||
|
||||
@@ -11,7 +11,10 @@ export function formatZodErrors(issues: ZodIssue[]): string {
|
||||
* leaking server directory structure to API consumers.
|
||||
*/
|
||||
export function stripInternalPaths(message: string): string {
|
||||
return message.replace(/\/(tmp|data|app|opt|home|workspace)\b[^\s'")}]*/g, "[internal]");
|
||||
return message.replace(
|
||||
/\/(?:tmp|data|app|opt|home|workspace)\b[^\s'")}]*|[A-Za-z]:\\[^\s'")}]*/g,
|
||||
"[internal]",
|
||||
);
|
||||
}
|
||||
|
||||
// Matching control characters is the entire point of these patterns (we strip
|
||||
@@ -36,10 +39,16 @@ export function stripControlChars(message: string): string {
|
||||
/**
|
||||
* Unambiguous markers of a raw external-tool failure dump: the
|
||||
* `ffmpeg/ffprobe exited N:` prefix that media-engine throws, a Python
|
||||
* traceback, or a crash. These are matched precisely (not by content
|
||||
* keywords like "pixel format" or "conversion failed", which can appear in
|
||||
* legitimate validation messages) -- longer or multi-line raw dumps are
|
||||
* caught separately by the length/line-count check below.
|
||||
* traceback, or a crash. Matched precisely (not by content keywords like
|
||||
* "pixel format" or "conversion failed", which appear in legitimate validation
|
||||
* messages); longer or multi-line raw dumps are caught by the length/line-count
|
||||
* check below.
|
||||
*
|
||||
* Doc-engine tools (qpdf, gs, pdfcpu, pandoc, LibreOffice) are deliberately NOT
|
||||
* matched here. Their short stderr is already path-scrubbed and often carries
|
||||
* the actionable reason (qpdf surfaces "invalid password" this way), so
|
||||
* collapsing it to the generic sentence would hide errors users need. The
|
||||
* genuinely verbose dumps are still caught by the length/line-count guard.
|
||||
*/
|
||||
const RAW_TOOL_FAILURE =
|
||||
/ff(?:mpeg|probe) exited \d|traceback \(most recent call|segmentation fault|core dumped/i;
|
||||
|
||||
@@ -79,6 +79,69 @@ export function isBelowCapacity(freeBytes: number): boolean {
|
||||
return freeBytes / 1024 ** 3 < CAPACITY_CRITICAL_GB;
|
||||
}
|
||||
|
||||
// ── Aggregate workspace-size cap (MAX_WORKSPACE_SIZE_GB) ──────────
|
||||
// A free-space floor alone does not stop SnapOtter from filling a large shared
|
||||
// volume before that floor trips. The configured cap bounds uploads/ + outputs/
|
||||
// regardless of how much room the underlying disk has. The total is cached
|
||||
// briefly so a busy instance does not re-walk the tree on every write.
|
||||
|
||||
let workspaceSizeCache: { bytes: number; at: number } | null = null;
|
||||
const WORKSPACE_SIZE_CACHE_MS = 30_000;
|
||||
|
||||
/**
|
||||
* Sum the sizes of every file under `<root>/uploads` and `<root>/outputs`. Keys
|
||||
* are always `<prefix>/<jobId>/<filename>` (two levels), so a shallow job-dir
|
||||
* walk suffices. Missing or unreadable paths contribute 0.
|
||||
*/
|
||||
export async function computeWorkspaceUsedBytes(root: string): Promise<number> {
|
||||
let total = 0;
|
||||
for (const prefix of ["uploads", "outputs"] as const) {
|
||||
let jobDirs: string[];
|
||||
try {
|
||||
jobDirs = await readdir(join(root, prefix));
|
||||
} catch {
|
||||
continue;
|
||||
}
|
||||
for (const jobDir of jobDirs) {
|
||||
const dir = join(root, prefix, jobDir);
|
||||
let names: string[];
|
||||
try {
|
||||
names = await readdir(dir);
|
||||
} catch {
|
||||
continue;
|
||||
}
|
||||
for (const name of names) {
|
||||
const s = await stat(join(dir, name)).catch(() => null);
|
||||
if (s?.isFile()) total += s.size;
|
||||
}
|
||||
}
|
||||
}
|
||||
return total;
|
||||
}
|
||||
|
||||
/** Pure threshold check exported for unit testing. maxGb <= 0 disables the cap. */
|
||||
export function isOverWorkspaceCap(usedBytes: number, maxGb: number): boolean {
|
||||
return maxGb > 0 && usedBytes / 1024 ** 3 > maxGb;
|
||||
}
|
||||
|
||||
async function assertWorkspaceSizeCap(root: string): Promise<void> {
|
||||
const maxGb = env.MAX_WORKSPACE_SIZE_GB;
|
||||
if (maxGb <= 0) return;
|
||||
const now = Date.now();
|
||||
let used: number;
|
||||
if (workspaceSizeCache && now - workspaceSizeCache.at < WORKSPACE_SIZE_CACHE_MS) {
|
||||
used = workspaceSizeCache.bytes;
|
||||
} else {
|
||||
used = await computeWorkspaceUsedBytes(root);
|
||||
workspaceSizeCache = { bytes: used, at: now };
|
||||
}
|
||||
if (isOverWorkspaceCap(used, maxGb)) {
|
||||
const error = new Error("Workspace storage limit reached; try again shortly");
|
||||
(error as Error & { statusCode: number }).statusCode = 503;
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Asserts that the local storage volume has enough free space.
|
||||
* Called by putObject / putObjectStream for the local backend only.
|
||||
@@ -87,6 +150,8 @@ export function isBelowCapacity(freeBytes: number): boolean {
|
||||
export async function assertLocalCapacity(): Promise<void> {
|
||||
const root = env.WORKSPACE_PATH;
|
||||
if (!existsSync(root)) return;
|
||||
// Aggregate size cap first: it applies even where statfs is unavailable.
|
||||
await assertWorkspaceSizeCap(root);
|
||||
let fsStats: Awaited<ReturnType<typeof statfs>>;
|
||||
try {
|
||||
fsStats = await statfs(root);
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
import type { CacheItem, CacheProvider } from "@node-saml/node-saml";
|
||||
import { sharedRedis } from "../jobs/connection.js";
|
||||
|
||||
const KEY_PREFIX = "saml:req:";
|
||||
|
||||
/**
|
||||
* Matches node-saml's default requestIdExpirationPeriodMs (8h). The Redis TTL
|
||||
* must be at least as long, or a slow-but-legitimate SP-initiated login would
|
||||
* find its request id already gone and fail InResponseTo validation.
|
||||
*/
|
||||
export const SAML_REQUEST_TTL_SECONDS = 8 * 60 * 60;
|
||||
|
||||
/**
|
||||
* Redis-backed CacheProvider for node-saml InResponseTo validation.
|
||||
*
|
||||
* `saveAsync` uses SET NX, so a request id is stored exactly once. node-saml
|
||||
* removes the id when it consumes a valid SAML Response, so a replayed Response
|
||||
* whose InResponseTo was already consumed finds nothing and is rejected. Backed
|
||||
* by the shared Redis so the id written during the login redirect is visible to
|
||||
* the callback even though each handler builds a fresh SAML instance.
|
||||
*/
|
||||
export function makeRedisSamlCacheProvider(
|
||||
ttlSeconds: number = SAML_REQUEST_TTL_SECONDS,
|
||||
): CacheProvider {
|
||||
return {
|
||||
async saveAsync(key: string, value: string): Promise<CacheItem | null> {
|
||||
const ok = await sharedRedis().set(`${KEY_PREFIX}${key}`, value, "EX", ttlSeconds, "NX");
|
||||
return ok === "OK" ? { value, createdAt: Date.now() } : null;
|
||||
},
|
||||
async getAsync(key: string): Promise<string | null> {
|
||||
return sharedRedis().get(`${KEY_PREFIX}${key}`);
|
||||
},
|
||||
async removeAsync(key: string | null): Promise<string | null> {
|
||||
if (key === null) return null;
|
||||
const removed = await sharedRedis().del(`${KEY_PREFIX}${key}`);
|
||||
return removed > 0 ? key : null;
|
||||
},
|
||||
};
|
||||
}
|
||||
@@ -73,7 +73,22 @@ export function sanitizeSvg(buffer: Buffer): Buffer {
|
||||
// close tag -- repeating until stable so nested or overlapping tags cannot
|
||||
// survive a single pass (foreignObject/iframe/embed can embed HTML; set/animate
|
||||
// can inject attributes/URIs at runtime).
|
||||
for (const tag of ["script", "foreignObject", "iframe", "embed", "set", "animate"]) {
|
||||
// animateTransform/animateMotion/animateColor are distinct element names (a
|
||||
// word boundary stops the "animate" pattern from matching them), and <handler>
|
||||
// is the SVG-Tiny event-handler element; all can carry runtime script/URIs.
|
||||
for (const tag of [
|
||||
"script",
|
||||
"foreignObject",
|
||||
"iframe",
|
||||
"embed",
|
||||
"set",
|
||||
"animate",
|
||||
"animateTransform",
|
||||
"animateMotion",
|
||||
"animateColor",
|
||||
"handler",
|
||||
"mpath",
|
||||
]) {
|
||||
svg = stripUntilStable(
|
||||
svg,
|
||||
new RegExp(`<${tag}\\b[\\s\\S]*?<\\/${tag}\\s*>`, "gi"),
|
||||
@@ -97,13 +112,17 @@ export function sanitizeSvg(buffer: Buffer): Buffer {
|
||||
svg = svg.replace(/<feImage\b[^>]*href\s*=\s*["']file:[^"']*["'][^>]*\/?>/gi, "");
|
||||
svg = svg.replace(/<feImage\b[^>]*href\s*=\s*["']data:[^"']*["'][^>]*\/?>/gi, "");
|
||||
|
||||
// ── Block dangerous URI schemes in href attributes ──
|
||||
svg = svg.replace(/xlink:href\s*=\s*["']https?:\/\//gi, 'xlink:href="data:,');
|
||||
svg = svg.replace(/href\s*=\s*["']https?:\/\//gi, 'href="data:,');
|
||||
svg = svg.replace(/href\s*=\s*["']javascript:/gi, 'href="data:,');
|
||||
// Block ALL data: URIs in href (not just data:text/html)
|
||||
svg = svg.replace(/href\s*=\s*["']data:/gi, 'href="data:,');
|
||||
svg = svg.replace(/href\s*=\s*["']file:/gi, 'href="data:,');
|
||||
// ── Block dangerous URI schemes in href / xlink:href ──
|
||||
// One pass covers javascript:, data:, file:, and http(s): on both `href` and
|
||||
// `xlink:href`, tolerating unquoted values and leading whitespace before the
|
||||
// scheme (browsers trim it) which the older per-scheme patterns missed. The
|
||||
// capture preserves the `xlink:` prefix so the neutralized attribute stays
|
||||
// well-formed. Durable follow-up: replace this regex sanitizer with an XML
|
||||
// parse + allowlist, which is the real fix for regex whack-a-mole.
|
||||
svg = svg.replace(
|
||||
/((?:xlink:)?href)\s*=\s*(?:["']\s*)?(?:javascript|data|file|https?):/gi,
|
||||
'$1="data:,',
|
||||
);
|
||||
|
||||
// ── Block dangerous schemes in url() values ──
|
||||
svg = svg.replace(/url\s*\(\s*["']?https?:\/\//gi, 'url("data:,');
|
||||
|
||||
@@ -21,6 +21,10 @@ import { createSessionToken, requireAuth } from "./auth.js";
|
||||
|
||||
const RECOVERY_CODE_COUNT = 8;
|
||||
const SESSION_DURATION_MS = env.SESSION_DURATION_HOURS * 60 * 60 * 1000;
|
||||
/** Wrong-code budget before a pending MFA challenge is burned (forces re-login). */
|
||||
const MFA_MAX_FAILED_ATTEMPTS = 5;
|
||||
/** Mirrors the 300s TTL set on `mfa:<token>` at login (auth/oidc/saml). */
|
||||
const MFA_CHALLENGE_TTL_SECONDS = 300;
|
||||
|
||||
// ── Zod schemas ───────────────────────────────────────────────────
|
||||
|
||||
@@ -329,6 +333,15 @@ export async function registerMfa(app: FastifyInstance): Promise<void> {
|
||||
}
|
||||
|
||||
if (!verified) {
|
||||
// Burn the challenge after a few wrong codes so an attacker who already
|
||||
// holds valid credentials cannot grind TOTP guesses within the challenge
|
||||
// window. The counter shares the challenge's lifetime.
|
||||
const attemptsKey = `mfa:attempts:${mfaToken}`;
|
||||
const attempts = await redis.incr(attemptsKey);
|
||||
if (attempts === 1) await redis.expire(attemptsKey, MFA_CHALLENGE_TTL_SECONDS);
|
||||
if (attempts >= MFA_MAX_FAILED_ATTEMPTS) {
|
||||
await redis.del(`mfa:${mfaToken}`, attemptsKey);
|
||||
}
|
||||
await audit("MFA_VERIFY_FAILED", { userId, username: dbUser.username });
|
||||
return reply.status(401).send({
|
||||
error: "Invalid TOTP or recovery code",
|
||||
@@ -336,8 +349,8 @@ export async function registerMfa(app: FastifyInstance): Promise<void> {
|
||||
});
|
||||
}
|
||||
|
||||
// Delete the challenge token
|
||||
await redis.del(`mfa:${mfaToken}`);
|
||||
// Delete the challenge token and any failed-attempt counter
|
||||
await redis.del(`mfa:${mfaToken}`, `mfa:attempts:${mfaToken}`);
|
||||
|
||||
// Create session (same as normal login completion)
|
||||
const token = createSessionToken();
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { parse as parseQs } from "node:querystring";
|
||||
import type {} from "@fastify/cookie";
|
||||
import { SAML } from "@node-saml/node-saml";
|
||||
import { SAML, ValidateInResponseTo } from "@node-saml/node-saml";
|
||||
import { eq } from "drizzle-orm";
|
||||
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
|
||||
import { env } from "../config.js";
|
||||
@@ -14,10 +14,16 @@ import {
|
||||
sanitizeUsername,
|
||||
} from "../lib/external-auth-resolver.js";
|
||||
import { authAttempts } from "../lib/metrics.js";
|
||||
import { makeRedisSamlCacheProvider } from "../lib/saml-cache.js";
|
||||
import { createSessionToken } from "./auth.js";
|
||||
|
||||
// -- SAML instance factory ----------------------------------------------------
|
||||
|
||||
// One shared, Redis-backed cache so a request id written during the login
|
||||
// redirect is visible to the callback (each handler builds a fresh SAML
|
||||
// instance). This is what makes InResponseTo replay protection work.
|
||||
const samlCacheProvider = makeRedisSamlCacheProvider();
|
||||
|
||||
function getSamlInstance(): SAML {
|
||||
return new SAML({
|
||||
callbackUrl: env.SAML_CALLBACK_URL || `${env.EXTERNAL_URL}/api/auth/saml/callback`,
|
||||
@@ -26,6 +32,12 @@ function getSamlInstance(): SAML {
|
||||
idpCert: env.SAML_IDP_CERTIFICATE,
|
||||
wantAuthnResponseSigned: true,
|
||||
wantAssertionsSigned: true,
|
||||
// Bind each SAML Response to the AuthnRequest we issued and consume that id,
|
||||
// so a captured, still-signed assertion cannot be replayed to mint a second
|
||||
// session. "ifPresent" (not "always") keeps IdP-initiated SSO working, since
|
||||
// those responses carry no InResponseTo.
|
||||
validateInResponseTo: ValidateInResponseTo.ifPresent,
|
||||
cacheProvider: samlCacheProvider,
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user