Merge branch 'main' of github.com:devforth/adminforth

AdminForth/1731/security-audit

AdminForth/1731/security-audit

Author: yaroslav8765

adminforth/commands/createApp/templates/index.ts.hbs

@@ -16,6 +16,7 @@ export const admin = new AdminForth({
     usernameField: 'email',
     passwordHashField: 'password_hash',
     rememberMeDuration: '30d', 
+    rateLimit: ['500/5m', '5000/1h', '10000/1d'],
     loginBackgroundImage: 'https://images.unsplash.com/photo-1534239697798-120952b76f2b?q=80&w=3389&auto=format&fit=crop&ixlib=rb-4.0.3&ixid=M3wxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8fA%3D%3D',
     loginBackgroundPosition: '1/2',
     loginPromptHTML: async () => { 

adminforth/documentation/docs/tutorial/03-Customization/12-security.md

@@ -30,6 +30,31 @@ new AdminForth({
 In this case users who will check "Remember me" checkbox will be logged in for 7 days instead of 24 hours.
 
 
+## Login rate limits
+
+AdminForth rate-limits login attempts by client IP using `auth.rateLimit`. Password login, OAuth login, and passkey login use the same configured limits, but each login method has its own independent rate-limit bucket.
+
+By default AdminForth uses:
+
+```ts
+['500/5m', '5000/1h', '10000/1d']
+```
+
+You can override it in the app config:
+
+```ts ./index.ts
+new AdminForth({
+  ...
+  auth: {
+    rateLimit: ['10/5m', '100/1h', '500/1d']
+  }
+})
+```
+
+The format is `requests/period`, where period can use `s`, `m`, `h`, or `d`.
+Because rate limits are keyed by client IP, configure `auth.clientIpHeader` when AdminForth runs behind a trusted CDN or reverse proxy. See [Trusting client IP addresses](#trusting-client-ip-addresses).
+
+
 ## Password strength
 
 AdminForth allows to set validation RegExp based rules for any field. This can be reused for password strength validation.
@@ -284,4 +309,4 @@ This means that a user is allowed to make up to 20 requests within one day, and
 - h → hours (1h)
 - d → days (1d)
 
-> ☝ Сonsume(key) is used to check whether a specific key such as a userId, IP address, or any other identifier has exceeded its allowed request limit. If the limit has not been reached, it returns true, meaning the request is allowed to proceed.
+> ☝ Сonsume(key) is used to check whether a specific key such as a userId, IP address, or any other identifier has exceeded its allowed request limit. If the limit has not been reached, it returns true, meaning the request is allowed to proceed.

adminforth/modules/configValidator.ts

@@ -14,11 +14,12 @@ import {
   ShowInInput,
   ShowInLegacyInput,
   ShowInModernInput,
+  RateLimitString,
 } from "../types/Back.js";
 
 import fs from 'fs';
 import path from 'path';
-import { guessLabelFromName, md5hash, suggestIfTypo, slugifyString } from './utils.js';
+import { guessLabelFromName, md5hash, RateLimiter, suggestIfTypo, slugifyString } from './utils.js';
 import { 
   AdminForthSortDirections,
   type AdminForthComponentDeclarationFull,
@@ -34,6 +35,8 @@ import { afLogger } from "./logger.js";
 import {cascadeChildrenDelete} from './utils.js'
 
 const DEBOUNCE_TIME_MS = 300;
+const DEFAULT_AUTH_RATE_LIMIT: RateLimitString[] = ['500/5m', '5000/1h', '10000/1d'];
+
 export default class ConfigValidator implements IConfigValidator {
 
   customComponentsDir: string | undefined;
@@ -1213,6 +1216,19 @@ export default class ConfigValidator implements IConfigValidator {
         }
       }
 
+      newConfig.auth.rateLimit = newConfig.auth.rateLimit || [...DEFAULT_AUTH_RATE_LIMIT];
+      if (!Array.isArray(newConfig.auth.rateLimit)) {
+        errors.push(`auth.rateLimit must be an array of strings in format "500/5m"`);
+      } else {
+        for (const rateLimit of newConfig.auth.rateLimit) {
+          try {
+            RateLimiter.parseRate(rateLimit);
+          } catch (e) {
+            errors.push(`auth.rateLimit ${e.message}`);
+          }
+        }
+      }
+
       // normalize beforeLoginConfirmation hooks
       const blc = this.inputConfig.auth.beforeLoginConfirmation;
       if (!Array.isArray(blc)) {

adminforth/modules/restApi.ts

@@ -20,7 +20,7 @@ import {cascadeChildrenDelete} from './utils.js'
 
 import { afLogger } from "./logger.js";
 
-import { ADMINFORTH_VERSION, listify, md5hash, getLoginPromptHTML, hookResponseError, parseLooseJson } from './utils.js';
+import { ADMINFORTH_VERSION, listify, md5hash, getLoginPromptHTML, hookResponseError, parseLooseJson, RateLimiter } from './utils.js';
 
 import AdminForthAuth from "../auth.js";
 import { ActionCheckSource, AdminForthActionFront, AdminForthConfigMenuItem, AdminForthDataTypes, AdminForthFilterOperators, AdminForthResourceColumnInputCommon, AdminForthResourceFrontend, AdminForthResourcePages,
@@ -665,6 +665,7 @@ export async function interpretResource(
 export default class AdminForthRestAPI implements IAdminForthRestAPI {
 
   adminforth: IAdminForth;
+  loginRateLimiters: RateLimiter[] = [];
 
   constructor(adminforth: IAdminForth) {
     this.adminforth = adminforth;
@@ -718,13 +719,22 @@ export default class AdminForthRestAPI implements IAdminForthRestAPI {
   }
 
   registerEndpoints(server: IHttpServer) {
+    this.loginRateLimiters = this.adminforth.config.auth.rateLimit.map((rate) => new RateLimiter(rate));
+
     server.endpoint({
       noAuth: true,
       method: 'POST',
       path: '/login',
       handler: async ({ body, response, headers, query, cookies, requestUrl, tr }) => {
 
         const INVALID_MESSAGE = await tr('Invalid username or password', 'errors');
+        const loginRateLimitKey = this.adminforth.auth.getClientIp(headers) || 'unknown';
+        const rateLimitResults = await Promise.all(this.loginRateLimiters.map((limiter) => limiter.consume(loginRateLimitKey)));
+        if (!rateLimitResults.every(Boolean)) {
+          response.setStatus(429);
+          return { error: await tr('Too many login attempts, please try again later', 'errors') };
+        }
+
         const { username, password, rememberMe } = body;
         let adminUser: AdminUser;
         let toReturn: { redirectTo?: string, allowedLogin:boolean, error?: string } = { allowedLogin: true };

adminforth/modules/utils.ts

@@ -5,6 +5,7 @@ import Fuse from 'fuse.js';
 import crypto from 'crypto';
 import { AdminForthConfig, AdminForthResource, AdminForthResourceColumnInputCommon,Filters, IAdminForth, Predicate } from '../index.js';
 import { RateLimiterMemory, RateLimiterAbstract } from "rate-limiter-flexible";
+import { PERIOD_UNITS, type PeriodString, type PeriodUnit } from '../types/Back.js';
 // @ts-ignore-next-line
 
 
@@ -400,9 +401,26 @@ export function md5hash(str:string) {
   return crypto.createHash('md5').update(str).digest('hex');
 }
 
-export function convertPeriodToSeconds(period: string): number {
+function isPeriodUnit(unit: string): unit is PeriodUnit {
+  return (PERIOD_UNITS as readonly string[]).includes(unit);
+}
+
+function parsePositiveInteger(value: string, fieldName: string, source: string): number {
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${fieldName} must be a positive integer, got: "${source}"`);
+  }
+  return parsed;
+}
+
+export function convertPeriodToSeconds(period: PeriodString): number {
+    const value = period.slice(0, -1);
     const periodChar = period.slice(-1);
-    const duration = parseInt(period.slice(0, -1));
+    if (!isPeriodUnit(periodChar)) {
+      throw new Error(`Invalid period: ${period}`);
+    }
+
+    const duration = parsePositiveInteger(value, 'Period', period);
     if (periodChar === 's') {
       return duration;
     } else if (periodChar === 'm') {
@@ -420,23 +438,35 @@ export class RateLimiter {
 
   rateLimiter: RateLimiterAbstract;
 
+  static parseRate(rate: unknown): { points: number, duration: number } {
+    if (typeof rate !== 'string') {
+      throw new Error('Rate limit must be a string in format "500/5m"');
+    }
 
-  durStringToSeconds(rate: string): number {
-    if (!rate) {
-      throw new Error('Rate duration is required');
+    const parts = rate.split('/');
+    if (parts.length !== 2) {
+      throw new Error(`Rate limit must be in format "500/5m", got: "${rate}"`);
     }
 
+    const [pointsPart, period] = parts;
+    const periodValue = period.slice(0, -1);
+    const periodUnit = period.slice(-1);
+    if (!periodValue || !isPeriodUnit(periodUnit)) {
+      throw new Error(`Rate limit must be in format "500/5m", got: "${rate}"`);
+    }
 
-    return convertPeriodToSeconds(rate);
+    return {
+      points: parsePositiveInteger(pointsPart, 'Rate limit points', rate),
+      duration: convertPeriodToSeconds(period as PeriodString),
+    };
   }
 
 
   constructor(rate: string) {
-    const [points, duration] = rate.split('/');
-    const durationSeconds = this.durStringToSeconds(duration);
+    const { points, duration } = RateLimiter.parseRate(rate);
     const opts = {
-      points: parseInt(points),
-      duration: durationSeconds, // Per second
+      points,
+      duration, // Per second
     };
     this.rateLimiter = new RateLimiterMemory(opts);
   }

adminforth/types/Back.ts

@@ -18,6 +18,11 @@ import { ActionCheckSource, AdminForthFilterOperators, AdminForthSortDirections,
   type ColumnMinMaxValue,
 } from './Common.js';
 
+export const PERIOD_UNITS = ['s', 'm', 'h', 'd'] as const;
+export type PeriodUnit = typeof PERIOD_UNITS[number];
+export type PeriodString = `${bigint}${PeriodUnit}`;
+export type RateLimitString = `${bigint}/${PeriodString}`;
+
 export interface ICodeInjector {
   srcFoldersToSync: Object;
   allComponentNames: Object;
@@ -1719,6 +1724,13 @@ export interface AdminForthInputConfig {
        */ 
       rememberMeDays?: number,
 
+      /**
+       * Rate limits for login attempts.
+       * Format: "requests/period", where period is "1s", "1m", "1h", or "1d".
+       * Default: ['500/5m', '5000/1h', '10000/1d']
+       */
+      rateLimit?: RateLimitString[],
+
 
       /**
        * Can be used to limit user access when subscribing from frontend to websocket topics.

dev-demo/index.ts

@@ -2,6 +2,7 @@ import express from 'express';
 import AdminForth, {  AdminUser, Filters, IAdminForth } from '../adminforth/index.js';
 import * as z from 'zod';
 import usersResource from "./resources/adminuser.js";
+import externalIdentitiesResource from "./resources/external_identities.js";
 import { fileURLToPath } from 'url';
 import path from 'path';
 import { Decimal } from 'decimal.js';
@@ -39,6 +40,7 @@ const ADMIN_BASE_URL = '';
 export const admin = new AdminForth({
   baseUrl: ADMIN_BASE_URL,
   auth: {
+    rateLimit: ['5/5m'],
     usersResourceId: 'adminuser',
     usernameField: 'email',
     passwordHashField: 'password_hash',
@@ -126,6 +128,7 @@ export const admin = new AdminForth({
   ],
   resources: [
     usersResource,
+    externalIdentitiesResource,
     auditLogsResource,
     cars_SQLITE_resource,
     cars_MyS_resource,