Chungus

server/auth/actions.ts

@@ -4,6 +4,7 @@ import { userActions, roleActions, userOrgs } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
+import { sendUsageNotification } from "@server/routers/org";
 
 export enum ActionsEnum {
     createOrgUser = "createOrgUser",
@@ -98,10 +99,23 @@ export enum ActionsEnum {
     listApiKeyActions = "listApiKeyActions",
     listApiKeys = "listApiKeys",
     getApiKey = "getApiKey",
+    getCertificate = "getCertificate",
+    restartCertificate = "restartCertificate",
+    billing = "billing",
     createOrgDomain = "createOrgDomain",
     deleteOrgDomain = "deleteOrgDomain",
     restartOrgDomain = "restartOrgDomain",
+    sendUsageNotification = "sendUsageNotification",
+    createRemoteExitNode = "createRemoteExitNode",
+    updateRemoteExitNode = "updateRemoteExitNode",
+    getRemoteExitNode = "getRemoteExitNode",
+    listRemoteExitNode = "listRemoteExitNode",
+    deleteRemoteExitNode = "deleteRemoteExitNode",
     updateOrgUser = "updateOrgUser",
+    createLoginPage = "createLoginPage",
+    updateLoginPage = "updateLoginPage",
+    getLoginPage = "getLoginPage",
+    deleteLoginPage = "deleteLoginPage",
     applyBlueprint = "applyBlueprint"
 }
 

server/auth/sessions/app.ts

@@ -3,13 +3,7 @@ import {
     encodeHexLowerCase
 } from "@oslojs/encoding";
 import { sha256 } from "@oslojs/crypto/sha2";
-import {
-    resourceSessions,
-    Session,
-    sessions,
-    User,
-    users
-} from "@server/db";
+import { resourceSessions, Session, sessions, User, users } from "@server/db";
 import { db } from "@server/db";
 import { eq, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
@@ -24,8 +18,9 @@ export const SESSION_COOKIE_EXPIRES =
     60 *
     60 *
     config.getRawConfig().server.dashboard_session_length_hours;
-export const COOKIE_DOMAIN = config.getRawConfig().app.dashboard_url ?
-    "." + new URL(config.getRawConfig().app.dashboard_url!).hostname : undefined;
+export const COOKIE_DOMAIN = config.getRawConfig().app.dashboard_url
+    ? new URL(config.getRawConfig().app.dashboard_url!).hostname
+    : undefined;
 
 export function generateSessionToken(): string {
     const bytes = new Uint8Array(20);
@@ -98,8 +93,8 @@ export async function invalidateSession(sessionId: string): Promise<void> {
     try {
         await db.transaction(async (trx) => {
             await trx
-            .delete(resourceSessions)
-            .where(eq(resourceSessions.userSessionId, sessionId));
+                .delete(resourceSessions)
+                .where(eq(resourceSessions.userSessionId, sessionId));
             await trx.delete(sessions).where(eq(sessions.sessionId, sessionId));
         });
     } catch (e) {
@@ -111,9 +106,9 @@ export async function invalidateAllSessions(userId: string): Promise<void> {
     try {
         await db.transaction(async (trx) => {
             const userSessions = await trx
-            .select()
-            .from(sessions)
-            .where(eq(sessions.userId, userId));
+                .select()
+                .from(sessions)
+                .where(eq(sessions.userId, userId));
             await trx.delete(resourceSessions).where(
                 inArray(
                     resourceSessions.userSessionId,

server/auth/sessions/privateRemoteExitNode.ts

@@ -0,0 +1,85 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import {
+    encodeHexLowerCase,
+} from "@oslojs/encoding";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { RemoteExitNode, remoteExitNodes, remoteExitNodeSessions, RemoteExitNodeSession } from "@server/db";
+import { db } from "@server/db";
+import { eq } from "drizzle-orm";
+
+export const EXPIRES = 1000 * 60 * 60 * 24 * 30;
+
+export async function createRemoteExitNodeSession(
+    token: string,
+    remoteExitNodeId: string,
+): Promise<RemoteExitNodeSession> {
+    const sessionId = encodeHexLowerCase(
+        sha256(new TextEncoder().encode(token)),
+    );
+    const session: RemoteExitNodeSession = {
+        sessionId: sessionId,
+        remoteExitNodeId,
+        expiresAt: new Date(Date.now() + EXPIRES).getTime(),
+    };
+    await db.insert(remoteExitNodeSessions).values(session);
+    return session;
+}
+
+export async function validateRemoteExitNodeSessionToken(
+    token: string,
+): Promise<SessionValidationResult> {
+    const sessionId = encodeHexLowerCase(
+        sha256(new TextEncoder().encode(token)),
+    );
+    const result = await db
+        .select({ remoteExitNode: remoteExitNodes, session: remoteExitNodeSessions })
+        .from(remoteExitNodeSessions)
+        .innerJoin(remoteExitNodes, eq(remoteExitNodeSessions.remoteExitNodeId, remoteExitNodes.remoteExitNodeId))
+        .where(eq(remoteExitNodeSessions.sessionId, sessionId));
+    if (result.length < 1) {
+        return { session: null, remoteExitNode: null };
+    }
+    const { remoteExitNode, session } = result[0];
+    if (Date.now() >= session.expiresAt) {
+        await db
+            .delete(remoteExitNodeSessions)
+            .where(eq(remoteExitNodeSessions.sessionId, session.sessionId));
+        return { session: null, remoteExitNode: null };
+    }
+    if (Date.now() >= session.expiresAt - (EXPIRES / 2)) {
+        session.expiresAt = new Date(
+            Date.now() + EXPIRES,
+        ).getTime();
+        await db
+            .update(remoteExitNodeSessions)
+            .set({
+                expiresAt: session.expiresAt,
+            })
+            .where(eq(remoteExitNodeSessions.sessionId, session.sessionId));
+    }
+    return { session, remoteExitNode };
+}
+
+export async function invalidateRemoteExitNodeSession(sessionId: string): Promise<void> {
+    await db.delete(remoteExitNodeSessions).where(eq(remoteExitNodeSessions.sessionId, sessionId));
+}
+
+export async function invalidateAllRemoteExitNodeSessions(remoteExitNodeId: string): Promise<void> {
+    await db.delete(remoteExitNodeSessions).where(eq(remoteExitNodeSessions.remoteExitNodeId, remoteExitNodeId));
+}
+
+export type SessionValidationResult =
+    | { session: RemoteExitNodeSession; remoteExitNode: RemoteExitNode }
+    | { session: null; remoteExitNode: null };

server/auth/sessions/resource.ts

@@ -199,14 +199,14 @@ export function serializeResourceSessionCookie(
     const now = new Date().getTime();
     if (!isHttp) {
         if (expiresAt === undefined) {
-            return `${cookieName}_s.${now}=${token}; HttpOnly; SameSite=Lax; Path=/; Secure; Domain=${"." + domain}`;
+            return `${cookieName}_s.${now}=${token}; HttpOnly; SameSite=Lax; Path=/; Secure; Domain=${domain}`;
         }
-        return `${cookieName}_s.${now}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Secure; Domain=${"." + domain}`;
+        return `${cookieName}_s.${now}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Secure; Domain=${domain}`;
     } else {
         if (expiresAt === undefined) {
-            return `${cookieName}.${now}=${token}; HttpOnly; SameSite=Lax; Path=/; Domain=${"." + domain}`;
+            return `${cookieName}.${now}=${token}; HttpOnly; SameSite=Lax; Path=/; Domain=$domain}`;
         }
-        return `${cookieName}.${now}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Domain=${"." + domain}`;
+        return `${cookieName}.${now}=${token}; HttpOnly; SameSite=Lax; Expires=${expiresAt.toUTCString()}; Path=/; Domain=${domain}`;
     }
 }
 
@@ -216,9 +216,9 @@ export function createBlankResourceSessionTokenCookie(
     isHttp: boolean = false
 ): string {
     if (!isHttp) {
-        return `${cookieName}_s=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Secure; Domain=${"." + domain}`;
+        return `${cookieName}_s=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Secure; Domain=${domain}`;
     } else {
-        return `${cookieName}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Domain=${"." + domain}`;
+        return `${cookieName}=; HttpOnly; SameSite=Lax; Max-Age=0; Path=/; Domain=${domain}`;
     }
 }