mirror of
https://github.com/dreamhunter2333/cloudflare_temp_email.git
synced 2026-09-09 09:27:04 +08:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dreamhunter2333
|
f40b99d877 |
@@ -21,6 +21,7 @@
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- fix: |邮箱鉴权| 修复旧邮箱凭证仍可访问 API、Telegram 越权解绑、重新绑定失效及外部发信保存凭证的问题
|
||||
- fix: |Frontend| 修复 AdSense 脚本包含不受支持的 `data-onload` 和 `data-onerror` 属性
|
||||
- fix: |Admin| 修复权限设置加载完成前短暂显示管理员密码输入框的问题
|
||||
- fix: |Admin| 修复切换一级标签页时二级标签页偶发无选中项、内容不显示及指示条偏移的问题
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- fix: |Mailbox Auth| Fix stale mailbox credentials retaining API access, unauthorized Telegram unbinding, ineffective rebinding and credential storage in external sent mail
|
||||
- fix: |Frontend| Remove unsupported `data-onload` and `data-onerror` attributes from the AdSense script
|
||||
- fix: |Admin| Avoid briefly showing the Admin password dialog before access settings finish loading
|
||||
- fix: |Admin| Fix secondary tabs occasionally losing their active item, hiding content, and leaving the indicator offset after switching primary tabs
|
||||
|
||||
@@ -15,6 +15,7 @@ USER_ROLES = [
|
||||
{ domains = [], role = "empty-role", prefix = "EMPTY" },
|
||||
]
|
||||
JWT_SECRET = "e2e-test-secret-key"
|
||||
TELEGRAM_BOT_TOKEN = "e2e-telegram-test-token"
|
||||
BLACK_LIST = ""
|
||||
ENABLE_USER_CREATE_EMAIL = true
|
||||
ENABLE_USER_DELETE_EMAIL = true
|
||||
|
||||
@@ -170,7 +170,17 @@ for (const { base, disabled } of [
|
||||
const inbox = await list(request, '/admin/mails', { address: mailbox.address });
|
||||
const sent = await list(request, '/admin/sendbox', { address: mailbox.address });
|
||||
const sender = await list(request, '/admin/address_sender', { address: mailbox.address });
|
||||
const reply = await (await call(request, '/api/auto_reply', { headers: addressAuth(mailbox) })).json();
|
||||
let replyMailbox = mailbox;
|
||||
if (!address) {
|
||||
await call(request, '/api/auto_reply', { headers: addressAuth(mailbox) }, 401);
|
||||
// A new credential lets us check that no old auto-reply data survived cleanup.
|
||||
const [name, domain] = mailbox.address.split('@');
|
||||
replyMailbox = await (await call(request, '/admin/new_address', {
|
||||
method: 'POST', data: { name, domain, enablePrefix: false },
|
||||
})).json();
|
||||
}
|
||||
const reply = await (await call(request, '/api/auto_reply', { headers: addressAuth(replyMailbox) })).json();
|
||||
if (!address) await call(request, `/admin/delete_address/${replyMailbox.address_id}`, { method: 'DELETE' });
|
||||
const bound = await (await call(request, '/user_api/bind_address', { headers: userAuth(user) })).json();
|
||||
return [Number(!!address), inbox.count, sent.count, sender.count, Number(!!reply.subject),
|
||||
bound.results.filter((row: { name: string }) => row.name === mailbox.address).length];
|
||||
|
||||
@@ -0,0 +1,122 @@
|
||||
import { expect, test, type APIRequestContext } from '@playwright/test';
|
||||
import { createHmac } from 'node:crypto';
|
||||
|
||||
import { WORKER_URL, TEST_DOMAIN, createTestAddress, deleteAddress, seedTestMail } from '../../fixtures/test-helpers';
|
||||
|
||||
function signToken(payload: Record<string, unknown>) {
|
||||
const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
|
||||
const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
|
||||
const signature = createHmac('sha256', 'e2e-test-secret-key')
|
||||
.update(`${header}.${body}`).digest('base64url');
|
||||
return `${header}.${body}.${signature}`;
|
||||
}
|
||||
|
||||
async function expectRejected(request: APIRequestContext, jwt: string) {
|
||||
for (const [method, path] of [
|
||||
['GET', '/api/settings'],
|
||||
['GET', '/api/mails?limit=20&offset=0'],
|
||||
['GET', '/api/mail/1'],
|
||||
['GET', '/api/parsed_mails?limit=20&offset=0'],
|
||||
['GET', '/api/parsed_mail/1'],
|
||||
['GET', '/api/sendbox?limit=20&offset=0'],
|
||||
['GET', '/api/auto_reply'],
|
||||
['POST', '/api/webhook/settings'],
|
||||
['POST', '/api/attachment/get_url'],
|
||||
['POST', '/api/address_change_password'],
|
||||
['POST', '/api/request_send_mail_access'],
|
||||
['POST', '/api/send_mail'],
|
||||
['PATCH', '/api/mails/1/read'],
|
||||
['DELETE', '/api/mails/1'],
|
||||
['DELETE', '/api/sendbox/1'],
|
||||
['DELETE', '/api/clear_inbox'],
|
||||
['DELETE', '/api/clear_sent_items'],
|
||||
['DELETE', '/api/delete_address'],
|
||||
]) {
|
||||
const response = await request.fetch(`${WORKER_URL}${path}`, {
|
||||
method,
|
||||
headers: { Authorization: `Bearer ${jwt}` },
|
||||
...(method === 'POST' || method === 'PATCH' ? { data: {} } : {}),
|
||||
});
|
||||
expect(response.status(), `${method} ${path}`).toBe(401);
|
||||
}
|
||||
const login = await request.post(`${WORKER_URL}/open_api/credential_login`, {
|
||||
data: { credential: jwt },
|
||||
});
|
||||
expect(login.status()).toBe(401);
|
||||
const send = await request.post(`${WORKER_URL}/external/api/send_mail`, {
|
||||
data: { token: jwt },
|
||||
});
|
||||
expect(send.status()).toBe(401);
|
||||
const bind = await request.post(`${WORKER_URL}/user_api/bind_address`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${jwt}`,
|
||||
'x-user-token': signToken({ user_id: 1, exp: Math.floor(Date.now() / 1000) + 60 }),
|
||||
},
|
||||
});
|
||||
expect(bind.status()).toBe(401);
|
||||
}
|
||||
|
||||
test('deleted credentials cannot access or delete a recreated mailbox', async ({ request }) => {
|
||||
const name = `credential${Date.now()}`;
|
||||
const create = async () => {
|
||||
const response = await request.post(`${WORKER_URL}/api/new_address`, {
|
||||
data: { name, domain: TEST_DOMAIN },
|
||||
});
|
||||
expect(response.ok()).toBe(true);
|
||||
return await response.json();
|
||||
};
|
||||
const original = await create();
|
||||
await deleteAddress(request, original.jwt);
|
||||
await expectRejected(request, original.jwt);
|
||||
|
||||
const recreated = await create();
|
||||
try {
|
||||
expect(recreated.address).toBe(original.address);
|
||||
expect(recreated.address_id).not.toBe(original.address_id);
|
||||
await seedTestMail(request, recreated.address, { subject: 'New owner mail' });
|
||||
await expectRejected(request, original.jwt);
|
||||
const mails = await request.get(`${WORKER_URL}/api/mails?limit=20&offset=0`, {
|
||||
headers: { Authorization: `Bearer ${recreated.jwt}` },
|
||||
});
|
||||
expect(mails.ok()).toBe(true);
|
||||
expect((await mails.json()).count).toBe(1);
|
||||
} finally {
|
||||
await deleteAddress(request, recreated.jwt);
|
||||
}
|
||||
});
|
||||
|
||||
test('valid numeric/string IDs work; missing, invalid and mismatched IDs are rejected', async ({ request }) => {
|
||||
const mailbox = await createTestAddress(request, 'credential-id');
|
||||
try {
|
||||
for (const address_id of [mailbox.address_id, String(mailbox.address_id)]) {
|
||||
const token = signToken({ address: mailbox.address, address_id });
|
||||
const settings = await request.get(`${WORKER_URL}/api/settings`, {
|
||||
headers: { Authorization: `Bearer ${token}` },
|
||||
});
|
||||
expect(settings.ok()).toBe(true);
|
||||
const login = await request.post(`${WORKER_URL}/open_api/credential_login`, {
|
||||
data: { credential: token },
|
||||
});
|
||||
expect(login.ok()).toBe(true);
|
||||
}
|
||||
for (const payload of [
|
||||
{ address: mailbox.address },
|
||||
...[0, -1, 1.5, true, null, '', '1e3', {}, Number.MAX_SAFE_INTEGER + 1]
|
||||
.map(address_id => ({ address: mailbox.address, address_id })),
|
||||
{ address: `other@${TEST_DOMAIN}`, address_id: mailbox.address_id },
|
||||
{ address_id: mailbox.address_id },
|
||||
]) {
|
||||
const jwt = signToken(payload);
|
||||
const response = await request.get(`${WORKER_URL}/api/mails?limit=20&offset=0`, {
|
||||
headers: { Authorization: `Bearer ${jwt}` },
|
||||
});
|
||||
expect(response.status(), JSON.stringify(payload)).toBe(401);
|
||||
const login = await request.post(`${WORKER_URL}/open_api/credential_login`, {
|
||||
data: { credential: jwt },
|
||||
});
|
||||
expect(login.status(), JSON.stringify(payload)).toBe(401);
|
||||
}
|
||||
} finally {
|
||||
await deleteAddress(request, mailbox.jwt);
|
||||
}
|
||||
});
|
||||
@@ -51,4 +51,33 @@ test.describe('Send Mail via SMTP', () => {
|
||||
// Cleanup
|
||||
await deleteAddress(request, jwt);
|
||||
});
|
||||
|
||||
test('external sending stores mail fields without bearer credentials', async ({ request }) => {
|
||||
const { jwt, address } = await createTestAddress(request, 'external-sender');
|
||||
const mail = {
|
||||
from_name: 'External sender', to_name: 'Recipient', to_mail: 'recipient@test.example.com',
|
||||
subject: `External ${Date.now()}`, content: 'External message', is_html: false,
|
||||
};
|
||||
try {
|
||||
const listener = onMailpitMessage(message => message.Subject === mail.subject);
|
||||
await listener.ready;
|
||||
const response = await request.post(`${WORKER_URL}/external/api/send_mail`, {
|
||||
data: { ...mail, token: jwt, extra_credential: 'must-not-be-stored' },
|
||||
});
|
||||
expect(response.ok(), await response.text()).toBe(true);
|
||||
expect((await listener.message).From.Address).toBe(address);
|
||||
const sendbox = await request.get(`${WORKER_URL}/api/sendbox?limit=20&offset=0`, {
|
||||
headers: { Authorization: `Bearer ${jwt}` },
|
||||
});
|
||||
expect(sendbox.ok()).toBe(true);
|
||||
const { results } = await sendbox.json();
|
||||
expect(results).toHaveLength(1);
|
||||
const stored = JSON.parse(results[0].raw);
|
||||
expect(stored).toMatchObject(mail);
|
||||
expect(stored).not.toHaveProperty('token');
|
||||
expect(stored).not.toHaveProperty('extra_credential');
|
||||
} finally {
|
||||
await deleteAddress(request, jwt);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -0,0 +1,99 @@
|
||||
import { expect, test, type APIRequestContext } from '@playwright/test';
|
||||
import { createHmac } from 'node:crypto';
|
||||
|
||||
import { WORKER_URL, createTestAddress } from '../../fixtures/test-helpers';
|
||||
|
||||
function initData(userId: number) {
|
||||
const fields = {
|
||||
auth_date: String(Math.floor(Date.now() / 1000)),
|
||||
user: JSON.stringify({ id: userId }),
|
||||
};
|
||||
const key = createHmac('sha256', 'WebAppData').update('e2e-telegram-test-token').digest();
|
||||
const hash = createHmac('sha256', key)
|
||||
.update(Object.entries(fields).map(([name, value]) => `${name}=${value}`).join('\n'))
|
||||
.digest('hex');
|
||||
return new URLSearchParams({ ...fields, hash }).toString();
|
||||
}
|
||||
|
||||
async function bind(request: APIRequestContext, userId: number, jwt: string) {
|
||||
const response = await request.post(`${WORKER_URL}/telegram/bind_address`, {
|
||||
data: { initData: initData(userId), jwt },
|
||||
});
|
||||
expect(response.ok(), await response.text()).toBe(true);
|
||||
}
|
||||
|
||||
async function unbind(request: APIRequestContext, userId: number, address: string, status = 200) {
|
||||
const response = await request.post(`${WORKER_URL}/telegram/unbind_address`, {
|
||||
data: { initData: initData(userId), address },
|
||||
});
|
||||
expect(response.status(), await response.text()).toBe(status);
|
||||
}
|
||||
|
||||
async function addressList(request: APIRequestContext, userId: number) {
|
||||
const response = await request.post(`${WORKER_URL}/telegram/get_bind_address`, {
|
||||
data: { initData: initData(userId) },
|
||||
});
|
||||
expect(response.ok(), await response.text()).toBe(true);
|
||||
return response.json();
|
||||
}
|
||||
|
||||
test('Telegram users can remove their own bindings after another user binds the mailbox', async ({ request }) => {
|
||||
const mailbox = await createTestAddress(request, 'tg-owner');
|
||||
const owner = Date.now();
|
||||
const other = owner + 1;
|
||||
try {
|
||||
await bind(request, owner, mailbox.jwt);
|
||||
await unbind(request, other, mailbox.address, 400);
|
||||
await unbind(request, owner, mailbox.address);
|
||||
|
||||
await bind(request, owner, mailbox.jwt);
|
||||
await bind(request, other, mailbox.jwt);
|
||||
await unbind(request, owner, mailbox.address);
|
||||
expect(await addressList(request, owner)).toEqual([]);
|
||||
expect(await addressList(request, other)).toEqual([{ address: mailbox.address, jwt: mailbox.jwt }]);
|
||||
await unbind(request, other, mailbox.address);
|
||||
expect(await addressList(request, other)).toEqual([]);
|
||||
|
||||
await bind(request, owner, mailbox.jwt);
|
||||
await bind(request, other, mailbox.jwt);
|
||||
await bind(request, owner, mailbox.jwt);
|
||||
expect(await addressList(request, owner)).toEqual([{ address: mailbox.address, jwt: mailbox.jwt }]);
|
||||
await unbind(request, other, mailbox.address);
|
||||
await unbind(request, owner, mailbox.address);
|
||||
expect(await addressList(request, owner)).toEqual([]);
|
||||
} finally {
|
||||
await request.delete(`${WORKER_URL}/api/delete_address`, {
|
||||
headers: { Authorization: `Bearer ${mailbox.jwt}` },
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
test('stale Telegram credentials cannot unbind; internal mailbox cleanup still works', async ({ request }) => {
|
||||
const original = await createTestAddress(request, 'tg-stale');
|
||||
const owner = Date.now();
|
||||
await bind(request, owner, original.jwt);
|
||||
const deletion = await request.delete(`${WORKER_URL}/admin/delete_address/${original.address_id}`);
|
||||
expect(deletion.ok()).toBe(true);
|
||||
const [name, domain] = original.address.split('@');
|
||||
const creation = await request.post(`${WORKER_URL}/admin/new_address`, {
|
||||
data: { name, domain, enablePrefix: false },
|
||||
});
|
||||
expect(creation.ok()).toBe(true);
|
||||
const recreated = await creation.json();
|
||||
try {
|
||||
expect(recreated.address_id).not.toBe(original.address_id);
|
||||
await unbind(request, owner, recreated.address, 400);
|
||||
const response = await request.delete(`${WORKER_URL}/api/delete_address`, {
|
||||
headers: { Authorization: `Bearer ${recreated.jwt}` },
|
||||
});
|
||||
expect(response.ok(), await response.text()).toBe(true);
|
||||
|
||||
const listing = await request.post(`${WORKER_URL}/telegram/get_bind_address`, {
|
||||
data: { initData: initData(owner) },
|
||||
});
|
||||
expect(listing.ok()).toBe(true);
|
||||
expect(await listing.json()).toEqual([]);
|
||||
} finally {
|
||||
await request.delete(`${WORKER_URL}/admin/delete_address/${recreated.address_id}`);
|
||||
}
|
||||
});
|
||||
@@ -1,59 +0,0 @@
|
||||
import { test, expect } from '@playwright/test';
|
||||
import { createHmac } from 'node:crypto';
|
||||
import { WORKER_URL, WORKER_URL_SITE_PASSWORD } from '../../fixtures/test-helpers';
|
||||
|
||||
for (const scenario of ['expired role', 'valid role', 'invalid signature', 'missing expiry', 'admin password', 'wrong password'] as const) {
|
||||
test(`Admin role token errors remain distinct from password errors: ${scenario}`, async ({ request }) => {
|
||||
const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
|
||||
const payload = Buffer.from(JSON.stringify({
|
||||
user_id: 1, user_role: 'admin',
|
||||
exp: scenario === 'missing expiry' ? undefined
|
||||
: Math.floor(Date.now() / 1000) + (scenario === 'valid role' || scenario === 'invalid signature' ? 3600 : -60),
|
||||
})).toString('base64url');
|
||||
const signature = createHmac('sha256', scenario === 'invalid signature' ? 'wrong-secret' : 'e2e-site-password-secret')
|
||||
.update(`${header}.${payload}`).digest('base64url');
|
||||
const headers: Record<string, string> = { 'x-custom-auth': 'e2e-site-pass', 'x-lang': 'en' };
|
||||
if (scenario !== 'wrong password') headers['x-user-access-token'] = `${header}.${payload}.${signature}`;
|
||||
if (scenario === 'admin password') headers['x-admin-auth'] = 'e2e-admin-pass';
|
||||
if (scenario === 'wrong password') headers['x-admin-auth'] = 'wrong-password';
|
||||
const response = await request.get(`${WORKER_URL_SITE_PASSWORD}/admin/db_version`, { headers });
|
||||
if (scenario === 'expired role') {
|
||||
expect(response.status()).toBe(401);
|
||||
expect(await response.json()).toEqual({
|
||||
code: 'AUTH_USER_ACCESS_TOKEN_EXPIRED',
|
||||
message: 'Your access token has expired, please refresh the page',
|
||||
});
|
||||
} else if (scenario === 'missing expiry') {
|
||||
expect(response.status()).toBe(401);
|
||||
expect(await response.text()).toBe('Your access token has expired, please refresh the page');
|
||||
} else if (scenario === 'valid role' || scenario === 'admin password') {
|
||||
expect(response.ok()).toBe(true);
|
||||
} else {
|
||||
expect(response.status()).toBe(401);
|
||||
expect(await response.text()).toBe('You need to provide the admin password to access this page');
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
test('generic authentication errors preserve their text messages and CORS headers', async ({ request }) => {
|
||||
for (const { path, message } of [
|
||||
{ path: '/api/settings', message: 'Invalid address credential' },
|
||||
{ path: '/user_api/settings', message: 'Your token has expired, please login again' },
|
||||
]) {
|
||||
const response = await request.get(`${WORKER_URL}${path}`, { headers: { 'x-lang': 'en' } });
|
||||
expect(response.status()).toBe(401);
|
||||
expect(response.headers()['content-type']).toContain('text/plain');
|
||||
expect(response.headers()['access-control-allow-origin']).toBe('*');
|
||||
expect(await response.text()).toBe(message);
|
||||
}
|
||||
});
|
||||
|
||||
test('uncaught server errors return JSON with the original error detail', async ({ request }) => {
|
||||
const response = await request.post(`${WORKER_URL}/open_api/admin_login`, {
|
||||
headers: { 'content-type': 'application/json' },
|
||||
data: Buffer.from('{invalid-json'),
|
||||
});
|
||||
expect(response.status()).toBe(500);
|
||||
expect(response.headers()['content-type']).toContain('application/json');
|
||||
expect(await response.json()).toEqual({ code: 'INTERNAL_SERVER_ERROR', message: expect.stringContaining('SyntaxError') });
|
||||
});
|
||||
@@ -1,382 +0,0 @@
|
||||
import { expect, test, type Page } from '@playwright/test';
|
||||
import { createHmac } from 'node:crypto';
|
||||
import { FRONTEND_URL, WORKER_URL, createTestAddress, deleteAddress, hashPassword, getAddressSender, onMailpitMessage } from '../../fixtures/test-helpers';
|
||||
|
||||
const accessToken = (expiresIn: number) => {
|
||||
const payload = Buffer.from(JSON.stringify({ exp: Math.floor(Date.now() / 1000) + expiresIn })).toString('base64url');
|
||||
return `e30.${payload}.signature`;
|
||||
};
|
||||
|
||||
const openApiTestPage = async (page: Page) => {
|
||||
// Isolate API calls from the application's automatic settings requests.
|
||||
await page.route(`${FRONTEND_URL}/api-test`, (route) => route.fulfill({
|
||||
contentType: 'text/html', body: '<!doctype html><html><body></body></html>',
|
||||
}));
|
||||
await page.goto(`${FRONTEND_URL}/api-test`);
|
||||
};
|
||||
|
||||
const expiredTokenResponse = { status: 401, json: { code: 'AUTH_USER_ACCESS_TOKEN_EXPIRED', message: 'Access token expired' } };
|
||||
|
||||
for (const scenario of ['expired', 'expiring', 'valid', 'no account', 'login expired', 'wrong password', 'text zh', 'text en', 'retry expired', 'retry unauthorized', 'unmatched path', 'server error', 'json client error', 'json server error'] as const) {
|
||||
test(`Access token response handling: ${scenario}`, async ({ page }) => {
|
||||
await openApiTestPage(page);
|
||||
|
||||
const initialToken = accessToken(scenario === 'valid' ? 3600 : scenario === 'expiring' ? 20 : -60);
|
||||
const freshToken = accessToken(7200);
|
||||
const path = scenario === 'unmatched path' ? '/open_api/settings' : '/admin/db_version';
|
||||
let refreshCount = 0;
|
||||
const attempts: string[] = [];
|
||||
await page.route('**/user_api/settings', async (route) => {
|
||||
refreshCount++;
|
||||
expect(route.request().headers()['x-user-token']).toBe('account-token');
|
||||
await route.fulfill(scenario === 'login expired'
|
||||
? { status: 401, contentType: 'text/plain', body: 'Please login again' }
|
||||
: { json: { access_token: freshToken } });
|
||||
});
|
||||
await page.route(`**${path}`, async (route) => {
|
||||
attempts.push(route.request().headers()['x-user-access-token']);
|
||||
if (scenario.startsWith('json')) {
|
||||
await route.fulfill({
|
||||
status: scenario === 'json client error' ? 403 : 503,
|
||||
json: { code: 'OPERATION_FAILED', message: 'Operation failed' },
|
||||
});
|
||||
return;
|
||||
}
|
||||
if (scenario === 'server error') {
|
||||
await route.fulfill({ status: 500, body: 'Server error' });
|
||||
return;
|
||||
}
|
||||
if (!['valid', 'expiring', 'wrong password'].includes(scenario)
|
||||
&& (attempts.length === 1 || scenario === 'retry expired')) {
|
||||
await route.fulfill(scenario.startsWith('text')
|
||||
? { status: 401, body: scenario === 'text zh' ? '您的访问令牌已过期, 请刷新页面' : 'Your access token has expired, please refresh the page' }
|
||||
: expiredTokenResponse);
|
||||
return;
|
||||
}
|
||||
await route.fulfill(['wrong password', 'retry unauthorized'].includes(scenario)
|
||||
? { status: 401, contentType: 'text/plain', body: 'Admin password required' }
|
||||
: { json: { current_db_version: 'test-version' } });
|
||||
});
|
||||
|
||||
const result = await page.evaluate(async ({ initialToken, scenario, path }) => {
|
||||
const apiModule = '/src/api/index.js';
|
||||
const storeModule = '/src/store/index.js';
|
||||
const { api } = await import(apiModule);
|
||||
const state = (await import(storeModule)).useGlobalState();
|
||||
state.userJwt.value = scenario === 'no account' ? '' : 'account-token';
|
||||
state.userSettings.value.access_token = initialToken;
|
||||
state.adminAuth.value = scenario === 'wrong password' ? 'wrong-password' : '';
|
||||
state.showAdminAuth.value = false;
|
||||
try {
|
||||
return { data: await api.fetch(path), error: null, showAdminAuth: state.showAdminAuth.value };
|
||||
} catch (error) {
|
||||
return { data: null, error: String(error), showAdminAuth: state.showAdminAuth.value };
|
||||
}
|
||||
}, { initialToken, scenario, path });
|
||||
|
||||
const needsRefresh = !['valid', 'expiring', 'no account', 'wrong password', 'text zh', 'text en', 'unmatched path', 'server error', 'json client error', 'json server error'].includes(scenario);
|
||||
expect(refreshCount).toBe(needsRefresh ? 1 : 0);
|
||||
expect(attempts).toEqual(needsRefresh && scenario !== 'login expired' ? [initialToken, freshToken] : [initialToken]);
|
||||
expect(result.showAdminAuth).toBe(['wrong password', 'retry unauthorized'].includes(scenario) || scenario.startsWith('text'));
|
||||
if (scenario === 'login expired') expect(result.error).toContain('Please login again');
|
||||
else if (['wrong password', 'retry unauthorized'].includes(scenario)) expect(result.error).toContain('Admin password required');
|
||||
else if (['retry expired', 'no account', 'unmatched path'].includes(scenario)) expect(result.error).toContain('Access token expired');
|
||||
else if (scenario === 'server error') expect(result.error).toContain('Server error');
|
||||
else if (scenario.startsWith('text')) {
|
||||
expect(result.error).toContain(scenario === 'text zh'
|
||||
? '您的访问令牌已过期, 请刷新页面'
|
||||
: 'Your access token has expired, please refresh the page');
|
||||
}
|
||||
else if (scenario.startsWith('json')) {
|
||||
expect(result.error).toContain('Operation failed');
|
||||
expect(result.error).not.toContain('[object Object]');
|
||||
}
|
||||
else expect(result.data).toEqual({ current_db_version: 'test-version' });
|
||||
});
|
||||
}
|
||||
|
||||
test('concurrent and late responses share one access token refresh', async ({ page }) => {
|
||||
await openApiTestPage(page);
|
||||
const initialToken = accessToken(-60);
|
||||
const freshToken = accessToken(7200);
|
||||
const paths = ['/admin/db_version', '/api/settings', '/api/send_mail',
|
||||
'/user_api/bind_address', '/user_api/address/1/settings'];
|
||||
let refreshCount = 0;
|
||||
const initialPaths: string[] = [];
|
||||
const attempts: string[] = [];
|
||||
let release!: () => void;
|
||||
let releaseLate!: () => void;
|
||||
const refreshPending = new Promise<void>((resolve) => { release = resolve; });
|
||||
const lateResponse = new Promise<void>((resolve) => { releaseLate = resolve; });
|
||||
await page.route('**/user_api/settings', async (route) => {
|
||||
refreshCount++;
|
||||
await refreshPending;
|
||||
await route.fulfill({ json: { access_token: freshToken } });
|
||||
});
|
||||
await page.route((url) => paths.includes(url.pathname), async (route) => {
|
||||
if (route.request().headers()['x-user-access-token'] === initialToken) {
|
||||
const requestPath = new URL(route.request().url()).pathname;
|
||||
initialPaths.push(requestPath);
|
||||
if (requestPath === paths.at(-1)) await lateResponse;
|
||||
await route.fulfill(expiredTokenResponse);
|
||||
return;
|
||||
}
|
||||
attempts.push(route.request().headers()['x-user-access-token']);
|
||||
await route.fulfill({ json: { success: true } });
|
||||
});
|
||||
const pending = page.evaluate(async ({ initialToken, paths }) => {
|
||||
const apiModule = '/src/api/index.js';
|
||||
const storeModule = '/src/store/index.js';
|
||||
const { api } = await import(apiModule);
|
||||
const state = (await import(storeModule)).useGlobalState();
|
||||
state.userJwt.value = 'account-token';
|
||||
state.userSettings.value.access_token = initialToken;
|
||||
return Promise.all(paths.map((path) => api.fetch(path, {
|
||||
method: path === '/api/send_mail' ? 'POST' : 'GET',
|
||||
})));
|
||||
}, { initialToken, paths });
|
||||
try {
|
||||
await expect.poll(() => refreshCount).toBe(1);
|
||||
await expect.poll(() => initialPaths.length).toBe(paths.length);
|
||||
expect(attempts).toEqual([]);
|
||||
release();
|
||||
await expect.poll(() => attempts.length).toBe(paths.length - 1);
|
||||
} finally {
|
||||
release();
|
||||
releaseLate();
|
||||
}
|
||||
expect(await pending).toEqual(paths.map(() => ({ success: true })));
|
||||
expect(refreshCount).toBe(1);
|
||||
expect(attempts).toEqual(paths.map(() => freshToken));
|
||||
});
|
||||
|
||||
for (const failure of [400, 401, 500, 'network'] as const) {
|
||||
test(`failed shared refresh preserves independent mailbox requests: ${failure}`, async ({ page }) => {
|
||||
await openApiTestPage(page);
|
||||
const paths = ['/admin/db_version', '/user_api/bind_address', '/user_api/address/1/settings',
|
||||
'/api/settings', '/api/send_mail'];
|
||||
const attempts: string[] = [];
|
||||
let initialResponses = 0;
|
||||
page.on('response', async (response) => {
|
||||
if (paths.includes(new URL(response.url()).pathname) && response.status() === 401) {
|
||||
await response.finished();
|
||||
initialResponses++;
|
||||
}
|
||||
});
|
||||
let refreshCount = 0;
|
||||
let release!: () => void;
|
||||
const refreshPending = new Promise<void>((resolve) => { release = resolve; });
|
||||
const freshToken = accessToken(7200);
|
||||
await page.route('**/user_api/settings', async (route) => {
|
||||
refreshCount++;
|
||||
if (refreshCount > 1) {
|
||||
await route.fulfill({ json: { access_token: freshToken } });
|
||||
return;
|
||||
}
|
||||
await refreshPending;
|
||||
if (failure === 'network') await route.abort('failed');
|
||||
else await route.fulfill({ status: failure, body: 'Refresh failed' });
|
||||
});
|
||||
await page.route((url) => paths.includes(url.pathname), async (route) => {
|
||||
const path = new URL(route.request().url()).pathname;
|
||||
if (route.request().headers()['x-user-access-token'] && route.request().headers()['x-user-access-token'] !== freshToken) {
|
||||
await route.fulfill(expiredTokenResponse);
|
||||
return;
|
||||
}
|
||||
attempts.push(path);
|
||||
await route.fulfill(path === '/api/send_mail'
|
||||
? { status: 403, body: 'No send balance' }
|
||||
: { json: { success: true } });
|
||||
});
|
||||
const pending = page.evaluate(async ({ paths, initialToken }) => {
|
||||
const apiModule = '/src/api/index.js';
|
||||
const storeModule = '/src/store/index.js';
|
||||
const { api } = await import(apiModule);
|
||||
const state = (await import(storeModule)).useGlobalState();
|
||||
state.userJwt.value = 'account-token';
|
||||
state.userSettings.value.access_token = initialToken;
|
||||
state.adminAuth.value = '';
|
||||
state.openSettings.value.needAuth = true;
|
||||
state.showAuth.value = false;
|
||||
state.showAdminAuth.value = false;
|
||||
const results = await Promise.all(paths.map(async (path) => {
|
||||
try {
|
||||
return { data: await api.fetch(path, { method: path === '/api/send_mail' ? 'POST' : 'GET' }) };
|
||||
} catch (error) {
|
||||
return { error: String(error) };
|
||||
}
|
||||
}));
|
||||
const flags = { showAuth: state.showAuth.value, showAdminAuth: state.showAdminAuth.value, loading: state.loading.value };
|
||||
await api.fetch('/admin/db_version');
|
||||
return { results, flags };
|
||||
}, { paths, initialToken: accessToken(-60) });
|
||||
try {
|
||||
await expect.poll(() => initialResponses).toBe(paths.length);
|
||||
await expect.poll(() => refreshCount).toBe(1);
|
||||
expect(attempts).toEqual([]);
|
||||
} finally {
|
||||
release();
|
||||
}
|
||||
const { results, flags } = await pending;
|
||||
for (const result of results.slice(0, 3)) {
|
||||
expect(result.error).toContain(failure === 'network' ? 'Network Error' : 'Refresh failed');
|
||||
}
|
||||
expect(results[3].data).toEqual({ success: true });
|
||||
expect(results[4].error).toContain('[403]: No send balance');
|
||||
expect(flags).toEqual({ showAuth: false, showAdminAuth: false, loading: false });
|
||||
expect(refreshCount).toBe(2);
|
||||
expect(attempts.slice(0, 2).sort()).toEqual(['/api/send_mail', '/api/settings']);
|
||||
expect(attempts.slice(2)).toEqual(['/admin/db_version']);
|
||||
});
|
||||
}
|
||||
|
||||
for (const changedCredential of ['account', 'mailbox'] as const) {
|
||||
test(`a changed ${changedCredential} stops the waiting request after refresh`, async ({ page }) => {
|
||||
await openApiTestPage(page);
|
||||
const path = changedCredential === 'mailbox' ? '/api/send_mail' : '/admin/db_version';
|
||||
const freshToken = accessToken(7200);
|
||||
let attempts = 0;
|
||||
await page.route(`**${path}`, async (route) => {
|
||||
attempts++;
|
||||
await route.fulfill(attempts === 1 ? expiredTokenResponse : { json: { success: true } });
|
||||
});
|
||||
await page.route('**/user_api/settings', async (route) => {
|
||||
await page.evaluate(async (changedCredential) => {
|
||||
const storeModule = '/src/store/index.js';
|
||||
const state = (await import(storeModule)).useGlobalState();
|
||||
if (changedCredential === 'account') {
|
||||
state.userJwt.value = 'other-account';
|
||||
state.userSettings.value = { access_token: 'other-access-token' };
|
||||
} else {
|
||||
state.jwt.value = 'other-mailbox';
|
||||
}
|
||||
}, changedCredential);
|
||||
await route.fulfill({ json: { access_token: freshToken } });
|
||||
});
|
||||
const result = await page.evaluate(async ({ initialToken, path }) => {
|
||||
const apiModule = '/src/api/index.js';
|
||||
const storeModule = '/src/store/index.js';
|
||||
const { api } = await import(apiModule);
|
||||
const state = (await import(storeModule)).useGlobalState();
|
||||
state.userJwt.value = 'account-token';
|
||||
state.jwt.value = 'mailbox-token';
|
||||
state.userSettings.value.access_token = initialToken;
|
||||
state.adminAuth.value = '';
|
||||
try {
|
||||
await api.fetch(path, { method: path === '/api/send_mail' ? 'POST' : 'GET' });
|
||||
return null;
|
||||
} catch (error) {
|
||||
return { error: String(error), token: state.userSettings.value.access_token, loading: state.loading.value };
|
||||
}
|
||||
}, { initialToken: accessToken(-60), path });
|
||||
expect(result).toEqual({
|
||||
error: 'Error: User session changed, please retry',
|
||||
token: changedCredential === 'account' ? 'other-access-token' : freshToken,
|
||||
loading: false,
|
||||
});
|
||||
expect(attempts).toBe(1);
|
||||
});
|
||||
}
|
||||
|
||||
for (const [scenario, query] of [
|
||||
['expired account', ''],
|
||||
['deleted account', ''],
|
||||
['valid account', ''],
|
||||
['missing account', ''],
|
||||
['missing expiry', ''],
|
||||
['expired account', '?refresh=1&source=e2e'],
|
||||
['deleted account', '?refresh=1&source=e2e'],
|
||||
['valid account', '?refresh=1&source=e2e'],
|
||||
['missing account', '?refresh=1&source=e2e'],
|
||||
['missing expiry', '?refresh=1&source=e2e'],
|
||||
] as const) {
|
||||
test(`mailbox operations use the real Worker when ${scenario}, query: ${query || 'none'}`, async ({ page, request }) => {
|
||||
const address = await createTestAddress(request, 'refresh-mailbox-');
|
||||
let userId: number | undefined;
|
||||
try {
|
||||
const email = `refresh-account-${Date.now()}@test.example.com`;
|
||||
const created = await request.post(`${WORKER_URL}/admin/users`, {
|
||||
data: { email, password: hashPassword('test-password-123') },
|
||||
});
|
||||
expect(created.ok()).toBe(true);
|
||||
const users = await request.get(`${WORKER_URL}/admin/users`, {
|
||||
params: { limit: 10, offset: 0, query: email },
|
||||
});
|
||||
expect(users.ok()).toBe(true);
|
||||
userId = (await users.json()).results.find((user: any) => user.user_email === email).id;
|
||||
|
||||
const sign = (payload: Record<string, unknown>) => {
|
||||
const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
|
||||
const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
|
||||
const signature = createHmac('sha256', 'e2e-test-secret-key').update(`${header}.${body}`).digest('base64url');
|
||||
return `${header}.${body}.${signature}`;
|
||||
};
|
||||
const now = Math.floor(Date.now() / 1000);
|
||||
const claims = { user_id: userId, user_email: email, iat: now - 3600 };
|
||||
const userJwt = scenario === 'missing account' ? ''
|
||||
: sign({ ...claims, exp: now + (scenario === 'expired account' ? -60 : 3600) });
|
||||
const expiredAccessToken = sign({ ...claims, exp: scenario === 'missing expiry' ? undefined : now - 60, user_role: 'case-role' });
|
||||
if (scenario === 'deleted account') {
|
||||
expect((await request.delete(`${WORKER_URL}/admin/users/${userId}`)).ok()).toBe(true);
|
||||
}
|
||||
|
||||
// Exercise the browser API module without the UI's automatic settings requests.
|
||||
await page.route(`${FRONTEND_URL}/api-test`, (route) => route.fulfill({
|
||||
contentType: 'text/html', body: '<!doctype html><html><body></body></html>',
|
||||
}));
|
||||
await page.goto(`${FRONTEND_URL}/api-test`);
|
||||
const refreshStatuses: number[] = [];
|
||||
let sendCount = 0;
|
||||
page.on('response', (response) => {
|
||||
if (new URL(response.url()).pathname === '/user_api/settings') refreshStatuses.push(response.status());
|
||||
});
|
||||
page.on('request', (req) => {
|
||||
const url = new URL(req.url());
|
||||
if (['/api/settings', '/api/send_mail'].includes(url.pathname)) expect(url.search).toBe(query);
|
||||
if (url.pathname === '/api/send_mail') sendCount++;
|
||||
});
|
||||
const settings = await page.evaluate(async ({ userJwt, expiredAccessToken, mailboxJwt, query }) => {
|
||||
const apiModule = '/src/api/index.js';
|
||||
const storeModule = '/src/store/index.js';
|
||||
const { api } = await import(apiModule);
|
||||
const state = (await import(storeModule)).useGlobalState();
|
||||
state.userJwt.value = userJwt;
|
||||
state.userSettings.value.access_token = expiredAccessToken;
|
||||
state.jwt.value = mailboxJwt;
|
||||
state.adminAuth.value = '';
|
||||
return api.fetch(`/api/settings${query}`);
|
||||
}, { userJwt, expiredAccessToken, mailboxJwt: address.jwt, query });
|
||||
expect(settings.address).toBe(address.address);
|
||||
expect(settings.send_balance).toBe(10);
|
||||
|
||||
const subject = `Mailbox refresh regression ${scenario} ${Date.now()}`;
|
||||
const listener = onMailpitMessage((mail) => mail.Subject === subject);
|
||||
await listener.ready;
|
||||
const [mail] = await Promise.all([
|
||||
listener.message,
|
||||
page.evaluate(async ({ subject, query }) => {
|
||||
const apiModule = '/src/api/index.js';
|
||||
const { api } = await import(apiModule);
|
||||
await api.fetch(`/api/send_mail${query}`, {
|
||||
method: 'POST',
|
||||
body: { to_mail: 'recipient@test.example.com', subject, content: 'Independent mailbox credential', is_html: false },
|
||||
});
|
||||
}, { subject, query }),
|
||||
]);
|
||||
expect(mail.From.Address).toBe(address.address);
|
||||
expect(sendCount).toBe(scenario === 'valid account' || scenario === 'missing expiry' ? 1 : 2);
|
||||
expect((await getAddressSender(request, address.address)).balance).toBe(9);
|
||||
const sent = await request.get(`${WORKER_URL}/admin/sendbox`, {
|
||||
params: { address: address.address, limit: 10, offset: 0 },
|
||||
});
|
||||
expect(sent.ok()).toBe(true);
|
||||
expect((await sent.json()).results).toHaveLength(1);
|
||||
expect(refreshStatuses).toEqual(scenario === 'valid account' ? [200]
|
||||
: scenario === 'missing account' || scenario === 'missing expiry' ? []
|
||||
: scenario === 'expired account' ? [401, 401] : [400, 400]);
|
||||
} finally {
|
||||
await deleteAddress(request, address.jwt);
|
||||
if (userId !== undefined) await request.delete(`${WORKER_URL}/admin/users/${userId}`);
|
||||
}
|
||||
});
|
||||
}
|
||||
@@ -1,4 +0,0 @@
|
||||
export const ErrorCode = {
|
||||
INTERNAL_SERVER_ERROR: 'INTERNAL_SERVER_ERROR',
|
||||
AUTH_USER_ACCESS_TOKEN_EXPIRED: 'AUTH_USER_ACCESS_TOKEN_EXPIRED',
|
||||
};
|
||||
@@ -7,7 +7,6 @@ import { getFingerprint } from '../utils/fingerprint'
|
||||
import { safeBearerHeader, safeHeaderValue } from '../utils/headers'
|
||||
import { sanitizeHtml } from '../utils/sanitize-html'
|
||||
import { APP_CONFIG } from '../config'
|
||||
import { isUserAccessTokenError, createUserAccessTokenInterceptor } from './user-access-token-interceptor'
|
||||
|
||||
const API_BASE = APP_CONFIG.API_BASE || "";
|
||||
const {
|
||||
@@ -22,15 +21,6 @@ const instance = axios.create({
|
||||
validateStatus: (status) => status >= 200 && status <= 500
|
||||
});
|
||||
|
||||
const responseInterceptors = [createUserAccessTokenInterceptor(instance)];
|
||||
|
||||
const interceptResponse = async (path, response) => {
|
||||
for (const { matches, handle } of responseInterceptors) {
|
||||
if (matches(path, response)) return await handle(response);
|
||||
}
|
||||
return response;
|
||||
};
|
||||
|
||||
const apiFetch = async (path, options = {}) => {
|
||||
const showLoading = options.showLoading !== false;
|
||||
if (showLoading) loading.value = true;
|
||||
@@ -57,26 +47,25 @@ const apiFetch = async (path, options = {}) => {
|
||||
const authorizationHeader = safeBearerHeader(jwt.value);
|
||||
if (authorizationHeader) headers['Authorization'] = authorizationHeader;
|
||||
|
||||
const initialResponse = await instance.request(path, {
|
||||
const response = await instance.request(path, {
|
||||
method: options.method || 'GET',
|
||||
data: options.body || null,
|
||||
headers,
|
||||
});
|
||||
const response = await interceptResponse(path, initialResponse);
|
||||
if (response.status === 401 && path.startsWith("/admin") && !isUserAccessTokenError(response)) {
|
||||
if (response.status === 401 && path.startsWith("/admin")) {
|
||||
showAdminAuth.value = true;
|
||||
}
|
||||
if (response.status === 401 && openSettings.value.needAuth && !isUserAccessTokenError(response)) {
|
||||
if (response.status === 401 && openSettings.value.needAuth) {
|
||||
showAuth.value = true;
|
||||
}
|
||||
if (response.status >= 300) {
|
||||
throw new Error(`[${response.status}]: ${response.data?.message || response.data}`);
|
||||
throw new Error(`[${response.status}]: ${response.data}` || "error");
|
||||
}
|
||||
const data = response.data;
|
||||
return data;
|
||||
} catch (error) {
|
||||
if (error.response) {
|
||||
throw new Error(`Code ${error.response.status}: ${error.response.data?.message || error.response.data}`);
|
||||
throw new Error(`Code ${error.response.status}: ${error.response.data}` || "error");
|
||||
}
|
||||
throw error;
|
||||
} finally {
|
||||
|
||||
@@ -1,80 +0,0 @@
|
||||
import { AxiosHeaders } from 'axios';
|
||||
import { useGlobalState } from '../store';
|
||||
import { safeBearerHeader, safeHeaderValue } from '../utils/headers';
|
||||
import { ErrorCode } from './error-codes';
|
||||
|
||||
const { userJwt, userSettings, jwt } = useGlobalState();
|
||||
const mailboxPaths = new Set(['/api/settings', '/api/send_mail']);
|
||||
const paths = ['/admin/', ...mailboxPaths, '/user_api/bind_address', '/user_api/address/'];
|
||||
const getPathname = (url) => new URL(url, window.location.origin).pathname;
|
||||
|
||||
export const isUserAccessTokenError = (response) => response.status === 401
|
||||
&& response.data?.code === ErrorCode.AUTH_USER_ACCESS_TOKEN_EXPIRED;
|
||||
|
||||
const isCurrentSession = ({ headers }) =>
|
||||
safeHeaderValue(headers.get('x-user-token')) === safeHeaderValue(userJwt.value)
|
||||
&& safeHeaderValue(headers.get('Authorization')) === safeBearerHeader(jwt.value);
|
||||
|
||||
const matches = (path, response) => {
|
||||
if (!isUserAccessTokenError(response)) return false;
|
||||
const pathname = getPathname(path);
|
||||
if (!paths.some(prefix => pathname.startsWith(prefix))) return false;
|
||||
const { config } = response;
|
||||
if (!isCurrentSession(config)) return false;
|
||||
if (!safeHeaderValue(config.headers.get('x-user-access-token'))) return false;
|
||||
|
||||
const token = safeHeaderValue(config.headers.get('x-user-token'));
|
||||
return Boolean(token) || mailboxPaths.has(pathname);
|
||||
};
|
||||
|
||||
async function loadUserSettings(token, client, headers) {
|
||||
const response = await client.get('/user_api/settings', { headers });
|
||||
if (response.status >= 300) {
|
||||
throw new Error(`[${response.status}]: ${response.data?.message || response.data}`);
|
||||
}
|
||||
if (safeHeaderValue(userJwt.value) === token) {
|
||||
Object.assign(userSettings.value, response.data);
|
||||
}
|
||||
}
|
||||
|
||||
export const createUserAccessTokenInterceptor = (client) => {
|
||||
const pendingRefreshes = new Map();
|
||||
|
||||
async function refreshUserSettings(token, headers) {
|
||||
if (pendingRefreshes.has(token)) return await pendingRefreshes.get(token);
|
||||
const request = loadUserSettings(token, client, headers);
|
||||
pendingRefreshes.set(token, request);
|
||||
try {
|
||||
await request;
|
||||
} finally {
|
||||
pendingRefreshes.delete(token);
|
||||
}
|
||||
}
|
||||
|
||||
async function resolveAccessToken(config) {
|
||||
const token = safeHeaderValue(config.headers.get('x-user-token'));
|
||||
if (!token) return;
|
||||
const currentToken = safeHeaderValue(userSettings.value.access_token);
|
||||
if (currentToken !== safeHeaderValue(config.headers.get('x-user-access-token'))) return currentToken;
|
||||
|
||||
try {
|
||||
await refreshUserSettings(token, config.headers);
|
||||
} catch (error) {
|
||||
if (!mailboxPaths.has(getPathname(config.url))) throw error;
|
||||
return;
|
||||
}
|
||||
return safeHeaderValue(userSettings.value.access_token);
|
||||
}
|
||||
|
||||
return {
|
||||
matches,
|
||||
handle: async ({ config }) => {
|
||||
const accessToken = await resolveAccessToken(config);
|
||||
if (!isCurrentSession(config)) throw new Error('User session changed, please retry');
|
||||
const headers = new AxiosHeaders(config.headers);
|
||||
headers.delete('x-user-access-token');
|
||||
if (accessToken) headers.set('x-user-access-token', accessToken);
|
||||
return await client.request({ ...config, headers });
|
||||
},
|
||||
};
|
||||
};
|
||||
@@ -0,0 +1,46 @@
|
||||
import { Context, Next } from 'hono';
|
||||
import { jwt } from 'hono/jwt';
|
||||
import { Jwt } from 'hono/utils/jwt';
|
||||
|
||||
import i18n from './i18n';
|
||||
|
||||
const validateAddressPayload = async (
|
||||
c: Context<HonoCustomType>,
|
||||
payload: Record<string, unknown>,
|
||||
): Promise<JwtPayload | null> => {
|
||||
const { address, address_id } = payload;
|
||||
if (typeof address !== 'string' || !address) return null;
|
||||
if (typeof address_id !== 'number'
|
||||
&& (typeof address_id !== 'string' || !/^\d+$/.test(address_id))
|
||||
) return null;
|
||||
const addressId = Number(address_id);
|
||||
if (!Number.isSafeInteger(addressId) || addressId <= 0) return null;
|
||||
const exists = await c.env.DB.prepare(
|
||||
`SELECT id FROM address WHERE id = ? AND name = ?`
|
||||
).bind(addressId, address).first<number>('id');
|
||||
return exists ? { address, address_id: addressId } : null;
|
||||
};
|
||||
|
||||
export const verifyAddressToken = async (
|
||||
c: Context<HonoCustomType>,
|
||||
token: string,
|
||||
): Promise<JwtPayload> => {
|
||||
const payload = await Jwt.verify(token, c.env.JWT_SECRET, 'HS256');
|
||||
const addressPayload = await validateAddressPayload(c, payload);
|
||||
if (!addressPayload) {
|
||||
throw new Error(i18n.getMessagesbyContext(c).InvalidAddressCredentialMsg);
|
||||
}
|
||||
return addressPayload;
|
||||
};
|
||||
|
||||
export const addressJwtAuth = async (c: Context<HonoCustomType>, next: Next) => (
|
||||
jwt({ secret: c.env.JWT_SECRET, alg: 'HS256' })(c, async () => {
|
||||
const payload = await validateAddressPayload(c, c.get('jwtPayload'));
|
||||
if (!payload) {
|
||||
c.res = c.text(i18n.getMessagesbyContext(c).InvalidAddressCredentialMsg, 401);
|
||||
return;
|
||||
}
|
||||
c.set('jwtPayload', payload);
|
||||
await next();
|
||||
})
|
||||
);
|
||||
@@ -1,4 +0,0 @@
|
||||
export enum ErrorCode {
|
||||
INTERNAL_SERVER_ERROR = 'INTERNAL_SERVER_ERROR',
|
||||
AUTH_USER_ACCESS_TOKEN_EXPIRED = 'AUTH_USER_ACCESS_TOKEN_EXPIRED',
|
||||
}
|
||||
@@ -62,32 +62,7 @@ const deleteMail = async (c: Context<HonoCustomType>) => {
|
||||
};
|
||||
|
||||
const getSettings = async (c: Context<HonoCustomType>) => {
|
||||
const { address, address_id } = c.get("jwtPayload")
|
||||
const msgs = i18n.getMessagesbyContext(c);
|
||||
if (address_id && address_id > 0) {
|
||||
try {
|
||||
const db_address_id = await c.env.DB.prepare(
|
||||
`SELECT id FROM address where id = ? `
|
||||
).bind(address_id).first("id");
|
||||
if (!db_address_id) {
|
||||
return c.text(msgs.InvalidAddressMsg, 400)
|
||||
}
|
||||
} catch (error) {
|
||||
return c.text(msgs.InvalidAddressMsg, 400)
|
||||
}
|
||||
}
|
||||
try {
|
||||
if (!address_id) {
|
||||
const db_address_id = await c.env.DB.prepare(
|
||||
`SELECT id FROM address where name = ? `
|
||||
).bind(address).first("id");
|
||||
if (!db_address_id) {
|
||||
return c.text(msgs.InvalidAddressMsg, 400)
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
return c.text(msgs.InvalidAddressMsg, 400)
|
||||
}
|
||||
const { address } = c.get("jwtPayload")
|
||||
|
||||
updateAddressUpdatedAt(c, address);
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { Context, Hono } from 'hono'
|
||||
import { Jwt } from 'hono/utils/jwt'
|
||||
import { verifyAddressToken } from '../address_auth';
|
||||
import { createMimeMessage } from 'mimetext';
|
||||
import { Resend } from 'resend';
|
||||
import { WorkerMailer, WorkerMailerOptions } from 'worker-mailer';
|
||||
@@ -261,15 +261,14 @@ api.post('/api/send_mail', async (c) => {
|
||||
})
|
||||
|
||||
api.post('/external/api/send_mail', async (c) => {
|
||||
const msgs = i18n.getMessagesbyContext(c);
|
||||
const { token } = await c.req.json();
|
||||
const reqJson = await c.req.json();
|
||||
const payload = await verifyAddressToken(c, reqJson?.token).catch(() => null);
|
||||
if (!payload) {
|
||||
return c.text(i18n.getMessagesbyContext(c).InvalidAddressCredentialMsg, 401);
|
||||
}
|
||||
try {
|
||||
const { address } = await Jwt.verify(token, c.env.JWT_SECRET, "HS256");
|
||||
if (!address) {
|
||||
return c.text(msgs.AddressNotFoundMsg, 400)
|
||||
}
|
||||
const reqJson = await c.req.json();
|
||||
await sendMail(c, address as string, reqJson);
|
||||
const { from_name, to_mail, to_name, subject, content, is_html } = reqJson;
|
||||
await sendMail(c, payload.address, { from_name, to_mail, to_name, subject, content, is_html });
|
||||
return c.json({ status: "ok" })
|
||||
} catch (e) {
|
||||
console.error("Failed to send mail", e);
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { Hono } from 'hono'
|
||||
import { Jwt } from 'hono/utils/jwt'
|
||||
import { verifyAddressToken } from '../address_auth';
|
||||
|
||||
import utils, { checkCfTurnstile, getPasswords, getAdminPasswords, hashPassword } from '../utils';
|
||||
import i18n from '../i18n';
|
||||
@@ -56,10 +56,7 @@ api.post('/open_api/credential_login', async (c) => {
|
||||
return c.text(msgs.InvalidAddressCredentialMsg, 401)
|
||||
}
|
||||
try {
|
||||
const payload = await Jwt.verify(credential, c.env.JWT_SECRET, "HS256");
|
||||
if (!payload.address) {
|
||||
return c.text(msgs.InvalidAddressCredentialMsg, 401)
|
||||
}
|
||||
await verifyAddressToken(c, credential);
|
||||
} catch (error) {
|
||||
return c.text(msgs.InvalidAddressCredentialMsg, 401)
|
||||
}
|
||||
|
||||
@@ -1,9 +1,11 @@
|
||||
import { Context } from "hono";
|
||||
import { Jwt } from "hono/utils/jwt";
|
||||
import { verifyAddressToken } from '../address_auth';
|
||||
import { CONSTANTS } from "../constants";
|
||||
import { getBooleanValue, getIntValue, getJsonSetting } from "../utils";
|
||||
import { deleteAddressWithData, newAddress, generateRandomName } from "../common";
|
||||
import { LocaleMessages } from "../i18n/type";
|
||||
import i18n from '../i18n';
|
||||
|
||||
export const tgUserNewAddress = async (
|
||||
c: Context<HonoCustomType>, userId: string, address: string,
|
||||
@@ -63,17 +65,9 @@ export const jwtListToAddressData = async (
|
||||
const invalidJwtList = [] as string[];
|
||||
for (const jwt of jwtList) {
|
||||
try {
|
||||
const { address, address_id } = await Jwt.verify(jwt, c.env.JWT_SECRET, "HS256");
|
||||
const name = await c.env.DB.prepare(
|
||||
`SELECT name FROM address WHERE id = ? `
|
||||
).bind(address_id).first("name");
|
||||
if (!name) {
|
||||
addressList.push(msgs.TgInvalidAddressMsg);
|
||||
invalidJwtList.push(jwt);
|
||||
continue;
|
||||
}
|
||||
addressList.push(address as string);
|
||||
addressIdMap[address as string] = address_id as number;
|
||||
const { address, address_id } = await verifyAddressToken(c, jwt);
|
||||
addressList.push(address);
|
||||
addressIdMap[address] = address_id;
|
||||
} catch (e) {
|
||||
addressList.push(msgs.TgInvalidCredentialMsg);
|
||||
invalidJwtList.push(jwt);
|
||||
@@ -87,13 +81,11 @@ export const bindTelegramAddress = async (
|
||||
c: Context<HonoCustomType>, userId: string, jwt: string,
|
||||
msgs: LocaleMessages
|
||||
): Promise<string> => {
|
||||
const { address } = await Jwt.verify(jwt, c.env.JWT_SECRET, "HS256");
|
||||
if (!address) {
|
||||
throw Error(msgs.TgInvalidCredentialMsg);
|
||||
}
|
||||
const { address } = await verifyAddressToken(c, jwt);
|
||||
const jwtList = await c.env.KV.get<string[]>(`${CONSTANTS.TG_KV_PREFIX}:${userId}`, 'json') || [];
|
||||
const { addressIdMap } = await jwtListToAddressData(c, jwtList, msgs);
|
||||
if (address as string in addressIdMap) {
|
||||
await c.env.KV.put(`${CONSTANTS.TG_KV_PREFIX}:${address}`, userId.toString());
|
||||
return address as string;
|
||||
}
|
||||
if (jwtList.length >= getIntValue(c.env.TG_MAX_ADDRESS, 5)) {
|
||||
@@ -105,10 +97,9 @@ export const bindTelegramAddress = async (
|
||||
return address as string;
|
||||
}
|
||||
|
||||
export const unbindTelegramAddress = async (
|
||||
c: Context<HonoCustomType>, userId: string, address: string
|
||||
const removeTelegramBinding = async (
|
||||
c: Context<HonoCustomType>, userId: string, address: string, jwtList: string[]
|
||||
): Promise<boolean> => {
|
||||
const jwtList = await c.env.KV.get<string[]>(`${CONSTANTS.TG_KV_PREFIX}:${userId}`, 'json') || [];
|
||||
const newJwtList = [];
|
||||
for (const jwt of jwtList) {
|
||||
try {
|
||||
@@ -122,17 +113,29 @@ export const unbindTelegramAddress = async (
|
||||
newJwtList.push(jwt);
|
||||
}
|
||||
await c.env.KV.put(`${CONSTANTS.TG_KV_PREFIX}:${userId}`, JSON.stringify(newJwtList));
|
||||
await c.env.KV.delete(`${CONSTANTS.TG_KV_PREFIX}:${address}`);
|
||||
const owner = await c.env.KV.get<string>(`${CONSTANTS.TG_KV_PREFIX}:${address}`);
|
||||
if (owner === userId) await c.env.KV.delete(`${CONSTANTS.TG_KV_PREFIX}:${address}`);
|
||||
return true;
|
||||
}
|
||||
|
||||
export const unbindTelegramAddress = async (
|
||||
c: Context<HonoCustomType>, userId: string, address: string
|
||||
): Promise<boolean> => {
|
||||
const msgs = i18n.getMessagesbyContext(c);
|
||||
const jwtList = await c.env.KV.get<string[]>(`${CONSTANTS.TG_KV_PREFIX}:${userId}`, 'json') || [];
|
||||
const { addressIdMap } = await jwtListToAddressData(c, jwtList, msgs);
|
||||
if (!Object.hasOwn(addressIdMap, address)) throw Error(msgs.TgAddressNotYoursMsg);
|
||||
return await removeTelegramBinding(c, userId, address, jwtList);
|
||||
}
|
||||
|
||||
export const unbindTelegramByAddress = async (
|
||||
c: Context<HonoCustomType>, address: string
|
||||
): Promise<boolean> => {
|
||||
if (!c.env.KV) return true;
|
||||
const userId = await c.env.KV.get<string>(`${CONSTANTS.TG_KV_PREFIX}:${address}`)
|
||||
if (userId) {
|
||||
return await unbindTelegramAddress(c, userId, address);
|
||||
const jwtList = await c.env.KV.get<string[]>(`${CONSTANTS.TG_KV_PREFIX}:${userId}`, 'json') || [];
|
||||
return await removeTelegramBinding(c, userId, address, jwtList);
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import { Context } from "hono";
|
||||
import { Jwt } from 'hono/utils/jwt'
|
||||
import { verifyAddressToken } from '../address_auth';
|
||||
import { CONSTANTS } from "../constants";
|
||||
import { bindTelegramAddress, jwtListToAddressData, tgUserNewAddress, unbindTelegramAddress } from "./common";
|
||||
import { checkCfTurnstile, checkIsAdmin, getBooleanValue } from "../utils";
|
||||
@@ -69,7 +69,7 @@ async function getTelegramBindAddress(c: Context<HonoCustomType>): Promise<Respo
|
||||
const res = [];
|
||||
for (const jwt of jwtList) {
|
||||
try {
|
||||
const { address } = await Jwt.verify(jwt, c.env.JWT_SECRET, "HS256");
|
||||
const { address } = await verifyAddressToken(c, jwt);
|
||||
res.push({ address, jwt });
|
||||
} catch (e) {
|
||||
console.error(`failed to verify jwt with error: ${e}`)
|
||||
|
||||
+11
-15
@@ -1,7 +1,7 @@
|
||||
import { Context, Hono } from 'hono'
|
||||
import { cors } from 'hono/cors';
|
||||
import { jwt } from 'hono/jwt'
|
||||
import { Jwt } from 'hono/utils/jwt'
|
||||
import { addressJwtAuth } from './address_auth';
|
||||
|
||||
import { api as commonApi } from './commom_api';
|
||||
import { api as openAuthApi } from './open_api/auth';
|
||||
@@ -13,7 +13,6 @@ import { api as telegramApi } from './telegram_api'
|
||||
import { api as redeemApi } from './redeem_api'
|
||||
|
||||
import i18n from './i18n';
|
||||
import { ErrorCode } from './error_codes';
|
||||
import { email } from './email';
|
||||
import { scheduled } from './scheduled';
|
||||
import { getPasswords, getBooleanValue, getDomains, checkIsAdmin, getEnvStringList } from './utils';
|
||||
@@ -35,7 +34,7 @@ app.use('/*', cors());
|
||||
// error handler
|
||||
app.onError((err, c) => {
|
||||
console.error(err)
|
||||
return c.json({ code: ErrorCode.INTERNAL_SERVER_ERROR, message: `${err.name} ${err.message}` }, 500)
|
||||
return c.text(`${err.name} ${err.message}`, 500)
|
||||
})
|
||||
// global middlewares
|
||||
app.use('/*', async (c, next) => {
|
||||
@@ -135,16 +134,16 @@ const checkUserPayload = async (
|
||||
const checkoutUserRolePayload = async (
|
||||
c: Context<HonoCustomType>,
|
||||
userId?: number
|
||||
): Promise<Response | void> => {
|
||||
): Promise<void> => {
|
||||
try {
|
||||
const token = c.req.raw.headers.get("x-user-access-token");
|
||||
if (!token) return;
|
||||
const payload = await Jwt.verify(token, c.env.JWT_SECRET, { alg: "HS256", exp: false });
|
||||
const payload = await Jwt.verify(token, c.env.JWT_SECRET, "HS256");
|
||||
// check expired
|
||||
if (!payload.exp) return;
|
||||
// exp is in seconds
|
||||
if (payload.exp < Math.floor(Date.now() / 1000)) {
|
||||
return c.json({ code: ErrorCode.AUTH_USER_ACCESS_TOKEN_EXPIRED, message: i18n.getMessagesbyContext(c).UserAcceesTokenExpiredMsg }, 401);
|
||||
return;
|
||||
}
|
||||
if (typeof payload?.user_role !== "string") return;
|
||||
if (userId !== undefined && payload.user_id !== userId) return;
|
||||
@@ -164,8 +163,7 @@ app.use('/api/*', async (c, next) => {
|
||||
if (c.req.path.startsWith("/api/settings")
|
||||
|| c.req.path.startsWith("/api/send_mail")
|
||||
) {
|
||||
const response = await checkoutUserRolePayload(c);
|
||||
if (response) return response;
|
||||
await checkoutUserRolePayload(c);
|
||||
}
|
||||
if (c.req.path.startsWith("/api/address_login")) {
|
||||
await next();
|
||||
@@ -173,7 +171,7 @@ app.use('/api/*', async (c, next) => {
|
||||
}
|
||||
|
||||
try {
|
||||
return await jwt({ secret: c.env.JWT_SECRET, alg: "HS256" })(c, next);
|
||||
return await addressJwtAuth(c, next);
|
||||
} catch (e) {
|
||||
console.warn(e);
|
||||
const lang = c.get("lang") || c.env.DEFAULT_LANG;
|
||||
@@ -218,13 +216,12 @@ app.use('/user_api/*', async (c, next) => {
|
||||
|| c.req.path.startsWith("/user_api/address/")
|
||||
) {
|
||||
const { user_id } = c.get("userPayload");
|
||||
const response = await checkoutUserRolePayload(c, user_id);
|
||||
if (response) return response;
|
||||
await checkoutUserRolePayload(c, user_id);
|
||||
}
|
||||
if (c.req.path.startsWith('/user_api/bind_address')
|
||||
&& c.req.method === 'POST'
|
||||
) {
|
||||
return jwt({ secret: c.env.JWT_SECRET, alg: "HS256" })(c, next);
|
||||
return addressJwtAuth(c, next);
|
||||
}
|
||||
await next();
|
||||
});
|
||||
@@ -256,13 +253,12 @@ app.use('/admin/*', async (c, next) => {
|
||||
const access_token = c.req.raw.headers.get("x-user-access-token");
|
||||
if (c.env.ADMIN_USER_ROLE && access_token) {
|
||||
try {
|
||||
const payload = await Jwt.verify(access_token, c.env.JWT_SECRET, { alg: "HS256", exp: false });
|
||||
const payload = await Jwt.verify(access_token, c.env.JWT_SECRET, "HS256");
|
||||
// check expired
|
||||
if (!payload.exp) return c.text(msgs.UserAcceesTokenExpiredMsg, 401);
|
||||
// exp is in seconds
|
||||
if (payload.exp < Math.floor(Date.now() / 1000)) {
|
||||
if (getBooleanValue(c.env.DISABLE_ADMIN_PASSWORD_CHECK)) return await next();
|
||||
return c.json({ code: ErrorCode.AUTH_USER_ACCESS_TOKEN_EXPIRED, message: msgs.UserAcceesTokenExpiredMsg }, 401);
|
||||
return c.text(msgs.UserAcceesTokenExpiredMsg, 401)
|
||||
}
|
||||
if (payload.user_role !== c.env.ADMIN_USER_ROLE) {
|
||||
return c.text(msgs.UserRoleIsNotAdminMsg, 401)
|
||||
|
||||
Reference in New Issue
Block a user