Depot API & v4 (#298)

* feat: nginx + torrential basics & services system * fix: lint + i18n * fix: update torrential to remove openssl * feat: add torrential to Docker build * feat: move to self hosted runner * fix: move off self-hosted runner * fix: update nginx.conf * feat: torrential cache invalidation * fix: update torrential for cache invalidation * feat: integrity check task * fix: lint * feat: move to version ids * fix: client fixes and client-side checks * feat: new depot apis and version id fixes * feat: update torrential * feat: droplet bump and remove unsafe update functions * fix: lint * feat: v4 featureset: emulators, multi-launch commands * fix: lint * fix: mobile ui for game editor * feat: launch options * fix: lint * fix: remove axios, use $fetch * feat: metadata and task api improvements * feat: task actions * fix: slight styling issue * feat: fix style and lints * feat: totp backend routes * feat: oidc groups * fix: update drop-base * feat: creation of passkeys & totp * feat: totp signin * feat: webauthn mfa/signin * feat: launch selecting ui * fix: manually running tasks * feat: update add company game modal to use new SelectorGame * feat: executor selector * fix(docker): update rust to rust nightly for torrential build (#305) * feat: new version ui * feat: move package lookup to build time to allow for deno dev * fix: lint * feat: localisation cleanup * feat: apply localisation cleanup * feat: potential i18n refactor logic * feat: remove args from commands * fix: lint * fix: lockfile --------- Co-authored-by: Aden Lindsay <140392385+AdenMGB@users.noreply.github.com>
2026-07-26 09:44:40 +10:00 · 2026-01-13 15:32:39 +11:00
parent 8ef983304c
commit 63ac2b8ffc
190 changed files with 5848 additions and 2309 deletions
@@ -0,0 +1,61 @@
+import aclManager from "~/server/internal/acls";
+import { totp, SecretKey } from "otp-io";
+import { hmac } from "otp-io/crypto";
+import prisma from "~/server/internal/db/database";
+import { MFAMec } from "~/prisma/client/client";
+import type { TOTPv1Credentials } from "~/server/internal/auth/totp";
+import { dropDecodeArrayBase64 } from "~/server/internal/auth/totp";
+import { createError } from "h3";
+import { type } from "arktype";
+import { readDropValidatedBody, throwingArktype } from "~/server/arktype";
+
+const TOTPEnableBody = type({
+  code: "string",
+}).configure(throwingArktype);
+
+export default defineEventHandler(async (h3) => {
+  const userId = await aclManager.allowUserSuperlevel(h3); // No ACLs only allows session authentication
+  if (!userId)
+    throw createError({
+      statusCode: 403,
+      message: "Not signed in or superlevelled.",
+    });
+
+  const body = await readDropValidatedBody(h3, TOTPEnableBody);
+
+  const existing = await prisma.linkedMFAMec.findUnique({
+    where: {
+      userId_mec: {
+        userId,
+        mec: MFAMec.TOTP,
+      },
+      enabled: false,
+    },
+  });
+  if (!existing)
+    throw createError({ statusCode: 400, message: "TOTP not started" });
+
+  const secret = (existing.credentials as unknown as TOTPv1Credentials).secret;
+  const secretKeyBuffer = dropDecodeArrayBase64(secret);
+  const secretKey = new SecretKey(secretKeyBuffer);
+
+  const code = await totp(hmac, { secret: secretKey });
+  if (body.code !== code)
+    throw createError({ statusCode: 400, message: "Invalid TOTP code." });
+
+  // Safe because we're updating something we just queried
+  // eslint-disable-next-line drop/no-prisma-delete
+  await prisma.linkedMFAMec.update({
+    where: {
+      userId_mec: {
+        userId,
+        mec: MFAMec.TOTP,
+      },
+    },
+    data: {
+      enabled: true,
+    },
+  });
+
+  return;
+});
@@ -0,0 +1,63 @@
+import aclManager from "~/server/internal/acls";
+import { generateKey, getKeyUri } from "otp-io";
+import { randomBytes } from "otp-io/crypto";
+import prisma from "~/server/internal/db/database";
+import { MFAMec } from "~/prisma/client/client";
+import type { TOTPv1Credentials } from "~/server/internal/auth/totp";
+import { dropEncodeArrayBase64 } from "~/server/internal/auth/totp";
+import { b32e } from "~/server/internal/auth/base32";
+
+export default defineEventHandler(async (h3) => {
+  const userId = await aclManager.allowUserSuperlevel(h3); // No ACLs only allows session authentication
+  if (!userId)
+    throw createError({
+      statusCode: 403,
+      message: "Not signed in or superlevelled.",
+    });
+
+  const existing = await prisma.linkedMFAMec.findUnique({
+    where: {
+      userId_mec: {
+        userId,
+        mec: MFAMec.TOTP,
+      },
+    },
+  });
+
+  if (existing) {
+    if (!existing.enabled) {
+      // Safe because we're updating something we just queried
+      // eslint-disable-next-line drop/no-prisma-delete
+      await prisma.linkedMFAMec.delete({
+        where: { userId_mec: { userId: existing.userId, mec: existing.mec } },
+      });
+    } else {
+      throw createError({
+        statusCode: 400,
+        message: "Cannot set up TOTP authentication if already exists.",
+      });
+    }
+  }
+
+  const secret = generateKey(randomBytes, /* bytes: */ 20); // 5-20 good for Google Authenticator
+  const url = getKeyUri({
+    type: "totp",
+    secret,
+    name: userId,
+    issuer: "Drop",
+  });
+
+  await prisma.linkedMFAMec.create({
+    data: {
+      userId,
+      mec: MFAMec.TOTP,
+      version: 1,
+      credentials: {
+        secret: dropEncodeArrayBase64(secret.bytes),
+      } satisfies TOTPv1Credentials,
+      enabled: false,
+    },
+  });
+
+  return { url, secret: b32e(secret.bytes) };
+});