import { deleteCookie, getCookies, setCookie } from "https://deno.land/std/http/cookie.ts"; import { inferRequestVal } from "https://esm.town/v/andreterron/inferRequestVal?v=2"; import { email as sendEmail } from "https://esm.town/v/std/email?v=11"; import { sqlite } from "https://esm.town/v/std/sqlite?v=4"; import { html } from "https://esm.town/v/stevekrouse/html?v=5"; import { zip } from "npm:lodash-es"; import { nanoid } from "npm:nanoid"; import { createDate, TimeSpan } from "npm:oslo"; import { alphabet, generateRandomString } from "npm:oslo/crypto"; type Session = { id: string; email: string; expiresAt: number; }; async function createSessionTable(sessionTableName: string) { await sqlite.execute(`CREATE TABLE ${sessionTableName} ( id TEXT NOT NULL PRIMARY KEY, expires_at INTEGER NOT NULL, email STRING NOT NULL, val_slug STRING NOT NULL );`); } async function createCodeTable(tableName: string) { await sqlite.execute(`CREATE TABLE ${tableName} ( id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, code STRING NOT NULL, email STRING NOT NULL, expires_at INTEGER NOT NULL )`); } async function generateEmailVerificationCode(tableName, email: string): Promise { try { await sqlite.execute({ sql: `DELETE FROM ${tableName} WHERE email = ?`, args: [email] }); const code = generateRandomString(8, alphabet("0-9")); const expires_at = createDate(new TimeSpan(5, "m")); // 5 minutes await sqlite.execute({ sql: `INSERT INTO ${tableName} (email, code, expires_at) VALUES (?, ?, ?)`, args: [email, code, expires_at.getTime() / 1000], }); return code; } catch (e) { if (e.message.includes("no such table")) { await createCodeTable(tableName); return generateEmailVerificationCode(tableName, email); } throw e; } } async function createSession(tableName: string, valSlug: string, email: string): Promise { try { const expiresAt = new Date(); expiresAt.setDate(expiresAt.getDate() + 7); const sessionID = nanoid(); await sqlite.execute({ sql: `INSERT INTO ${tableName} (id, val_slug, expires_at, email) VALUES (?, ?, ?, ?)`, args: [sessionID, valSlug, expiresAt.getTime() / 1000, email], }); return { id: sessionID, email, expiresAt: expiresAt.getTime(), }; } catch (e) { if (e.message.includes("no such table")) { await createSessionTable(tableName); return createSession(tableName, valSlug, email); } throw e; } } async function getSession(tableName: string, sessionID: string, valSlug: string): Promise { try { const { rows, columns } = await sqlite.execute({ sql: `SELECT * FROM ${tableName} WHERE id = ? AND val_slug = ?`, args: [sessionID, valSlug], }); if (rows.length == 0) { return null; } return Object.fromEntries(zip(columns, rows.at(0))) as Session; } catch (e) { if (e.message.includes("no such table")) { return null; } throw e; } } type VerificationCode = { code: string; expires_at: number; email: string; }; async function getEmailVerificationCode(tableName: string, email: string) { try { const { rows, columns } = await sqlite.execute({ sql: `SELECT * FROM ${tableName} WHERE email = ?`, args: [email], }); if (rows.length == 0) { return null; } return Object.fromEntries(zip(columns, rows.at(0))) as VerificationCode; } catch (e) { if (e.message.includes("no such table")) { return null; } throw e; } } const loginPage = (handle) => `

Please enter your email to access this val.

`; const verifyPage = (email) => `

A confirmation code has been sent to ${email}

`; export function redirect(location: string): Response { return new Response(null, { headers: { location, }, status: 302, }); } type Handler = (req?: Request) => Response | Promise; export type PasswordAuthOptions = { verifyEmail: (email: string) => boolean | Promise; sessionTable?: string; codeTable?: string; }; const cookieName = "auth_session"; export function emailAuth( next: Handler, options?: PasswordAuthOptions, ): Handler { const sessionTable = options?.sessionTable || "email_auth_session"; const codeTable = options?.sessionTable || "email_auth_code"; return async (req: Request, ctx?: { [key: string]: any }) => { const val = inferRequestVal(req); const valSlug = `${val.handle}/${val.name}`; const url = new URL(req.url); if (url.pathname == "/signin" && req.method == "GET") { return html(loginPage(val.handle)); } if (url.pathname == "/signin" && req.method == "POST") { const formData = await req.formData(); const email = formData.get("email") as string; if (options?.allowList && !options?.allowSignup && !options.allowList.includes(email)) { return html(`You are not allowed to view this val`); } const code = await generateEmailVerificationCode(codeTable, email); sendEmail({ to: email, subject: `@${val.handle}/${val.name} Verification Code`, text: `Your code is ${code}`, }); return redirect(`/verify?email=${encodeURIComponent(email)}`); } if (url.pathname == "/verify" && req.method == "GET") { const email = url.searchParams.get("email"); if (!email) { return new Response("Bad Request", { status: 400 }); } return html(verifyPage(email)); } if (url.pathname == "/verify" && req.method == "POST") { const formData = await req.formData(); const email = formData.get("email") as string; const code = await getEmailVerificationCode(codeTable, email); if (code.expires_at < Date.now() / 1000) { return new Response("Code has expired", { status: 403, }); } if (code.code != formData.get("code")) { return new Response("Bad Request", { status: 400, }); } const session = await createSession(sessionTable, valSlug, email); const res = redirect(url.searchParams.get("redirect") || "/"); setCookie(res.headers, { name: cookieName, value: session.id, maxAge: session.expiresAt, httpOnly: true, secure: true, // to work in val.town iframes sameSite: "None", }); return res; } if (url.pathname == "/signout") { const res = redirect("/signin"); deleteCookie(res.headers, cookieName); return res; } const sessionID = getCookies(req.headers)[cookieName]; if (!sessionID) { return redirect("/signout"); } const session = await getSession(sessionTable, sessionID, valSlug); if (!session) { const res = redirect(`/signin`); deleteCookie(res.headers, cookieName); return res; } if (session.expiresAt < Date.now() / 1000) { const res = redirect(`/signin`); deleteCookie(res.headers, cookieName); return res; } if (!await options.verifyEmail(session.email)) { await sendEmail({ subject: `Someone tried to login to ${val.name}/${val.handle}`, cc: session.email, text: `${session.email} has tried to access ${val.name}/${val.handle}. `, }); return html(`You are not allowed to view this val`, { status: 403, }); } req.headers.set("X-User-Email", session.email); return next(req); }; }