Implement login, user info and logout API and add to user test.

Author: flackr

src/server/db.ts

@@ -3,20 +3,29 @@ import type { PGInterface } from './types.ts';
 
 export interface User {
   id: number;
-}
+  email: string | null;
+  username: string;
+  hashed_password: string | null;
+  alias: string;
+  verification_email: string | null;
+  created_ip_address: string;
+  created_at: Date;
+  active_at: Date;
+};
 export interface VerificationEmail {
   email: string;
   verification_code: string;
   created_at: Date;
-}
+};
 export interface Session {
-  session_id: string;
+  id: number;
+  session_key?: string;
   url?: string;
   user_id: number;
   created_at: Date;
   active_ip_address: string;
   updated_at: Date;
-}
+};
 
 export async function cleanupDatabase(client: PGInterface) {
   const sqlTables = [
@@ -65,9 +74,9 @@ export async function initializeDatabase(client: PGInterface) {
     `CREATE TABLE users (
         id SERIAL PRIMARY KEY,
         email VARCHAR(255) NULL,
-        username VARCHAR(100) UNIQUE NOT NULL DEFAULT CONCAT('user-', currval('users_id_seq')::TEXT),
+        username VARCHAR(50) UNIQUE NOT NULL DEFAULT CONCAT('user-', currval('users_id_seq')::TEXT),
         hashed_password TEXT NULL,
-        alias VARCHAR(100) NOT NULL,
+        alias VARCHAR(50) NOT NULL,
         verification_email VARCHAR(255) NULL,
         created_ip_address INET NOT NULL,
         created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
@@ -84,14 +93,16 @@ export async function initializeDatabase(client: PGInterface) {
 
     // Sessions tracks associated users for each session cookie.
     `CREATE TABLE sessions (
-        session_id TEXT PRIMARY KEY,
+        id SERIAL PRIMARY KEY,
+        session_key TEXT UNIQUE NOT NULL,
         url TEXT NULL,
         user_id INTEGER,
         created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
         active_ip_address INET NOT NULL,
         updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
         FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     );`,
+    `CREATE UNIQUE INDEX unique_session_key ON sessions (session_key);`,
     `CREATE INDEX idx_sessions_updated ON sessions (updated_at);`,
     `CREATE INDEX idx_sessions_user_id ON sessions (user_id);`,
 

src/server/server.ts

@@ -199,6 +199,28 @@ export class Server {
       res.writeHead(result.resultCode, { ...headers, 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ message: result.message }));
       res.end();
+    } if (req.url == '/api/login' && req.method == 'POST') {
+      const form = formidable({});
+      let data : {username: string; password: string;} = {
+        username: '',
+        password: '',
+      }
+      try {
+        const fields = (await form.parse(req))[0];
+        data = {username: fields.username[0], password: fields.password[0]};
+      } catch (err) {
+        console.error(err);
+        res.writeHead(err.httpCode || 400, { ...headers, 'Content-Type': 'text/plain' });
+        res.end(String(err));
+        return;
+      }
+      const result = await this.#authHandler.loginUser(requestIp(req), data);
+      if (result.sessionId) {
+        headers['Set-Cookie'] = `sessionid=${result.sessionId}; HttpOnly; Secure; Path=/; SameSite=Strict`;
+      }
+      res.writeHead(result.resultCode, { ...headers, 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ message: result.message }));
+      res.end();
     } else if (req.url.startsWith('/api/')) {
       // These remaining API endpoints require that the user is logged in.
       const rawCookie = req.headers.cookie || "";
@@ -238,6 +260,34 @@ export class Server {
           result: success ? 'ok' : 'failed'
         }));
         return;
+      } else if (req.url == '/api/userinfo') {
+        const userInfo = await this.#authHandler.getUserInfo(session);
+        res.writeHead(200, { ...headers,
+          'Content-Type': 'application/json',
+        });
+        res.end(JSON.stringify(userInfo));
+        return;
+      } else if (req.url == '/api/logout' && req.method == 'POST') {
+        // Check if a session id was provided to log out instead of the current session.
+        const form = formidable({});
+        let logoutSessionId: number = session.id;
+        try {
+          const fields = (await form.parse(req))[0];
+          if (fields.sessionid) {
+            logoutSessionId = parseInt(fields.sessionid[0]);
+          }
+        } catch (err) {
+          console.error(err);
+          res.writeHead(err.httpCode || 400, { ...headers, 'Content-Type': 'text/plain' });
+          res.end(String(err));
+          return;
+        }
+        await this.#authHandler.logoutSession(session, logoutSessionId);
+        res.writeHead(200, { ...headers,
+          'Content-Type': 'application/json',
+        });
+        res.end(JSON.stringify({ result: 'ok' }));
+        return;
       }
       res.writeHead(404, headers);
       res.end();

src/server/user.ts

@@ -11,6 +11,10 @@ export type RegistrationData = {
   alias: string;
   email: string | null;
 };
+export type LoginData = {
+  username: string;
+  password: string;
+}
 export type RegistrationResult = {
   resultCode: number;
   message: string;
@@ -29,6 +33,11 @@ export type AuthenticationHandlerConfig = {
   limits: LimitsConfig;
 }
 
+export type UserInfo = {
+  user: User;
+  sessions: Session[];
+}
+
 const SALT_ROUNDS = 12;
 
 function generateSessionId() {
@@ -81,7 +90,7 @@ export class AuthenticationHandler {
     const userId = user.rows[0].id;
     const sessionId = generateSessionId();
     let session = await this.#config.db.query<Session>(
-      `INSERT INTO sessions (session_id, user_id, created_at, active_ip_address, updated_at)
+      `INSERT INTO sessions (session_key, user_id, created_at, active_ip_address, updated_at)
        VALUES ($1, $2, now(), $3, now());`,
       [
         sessionId,
@@ -169,15 +178,14 @@ Enjoy!`;
     return user.affectedRows > 0;
   }
 
-
   async getSession(address: string, sessionId?: string): Promise<Session | null> {
     if (!sessionId) {
       return null;
     }
     const session = await this.#config.db.query<Session>(
       `UPDATE sessions
        SET updated_at = now(), active_ip_address = $2
-       WHERE session_id = $1 AND updated_at >= now() - INTERVAL '7 days'
+       WHERE session_key = $1 AND updated_at >= now() - INTERVAL '7 days'
        RETURNING *;`,
       [sessionId, address]
     );
@@ -186,4 +194,74 @@ Enjoy!`;
     }
     return session.rows[0];
   }
+
+  async loginUser(address: string, data: LoginData): Promise<RegistrationResult> {
+    const { username, password } = data;
+    const userResult = await this.#config.db.query<User>(
+      `SELECT * FROM users WHERE username = $1;`,
+      [username]
+    );
+    if (userResult.rows.length == 0 || !userResult.rows[0].hashed_password ||
+        !await bcrypt.compare(password, userResult.rows[0].hashed_password)) {
+      return {
+        resultCode: 401,
+        message: 'Invalid username or password',
+      };
+    }
+    const user = userResult.rows[0];
+    const sessionId = generateSessionId();
+    let session = await this.#config.db.query<Session>(
+      `INSERT INTO sessions (session_key, user_id, created_at, active_ip_address, updated_at)
+       VALUES ($1, $2, now(), $3, now());`,
+      [
+        sessionId,
+        user.id,
+        address,
+      ]
+    );
+    if (session.affectedRows == 0) {
+      return {
+        resultCode: 500,
+        message: 'Failed to initialize session',
+      };
+    }
+    return {
+      resultCode: 200,
+      message: 'Login successful.',
+      sessionId: sessionId
+    };
+  }
+
+  async logoutSession(session: Session, id: number): Promise<void> {
+    await this.#config.db.query(
+      `DELETE FROM sessions WHERE id = $1 AND user_id = $2;`,
+      [id, session.user_id]
+    );
+  }
+
+  async getUserInfo(session: Session): Promise<UserInfo> {
+    const userData = await this.#config.db.query<User>(
+      `SELECT id, email, username, alias, verification_email, created_ip_address, created_at, active_at
+      FROM users WHERE id = $1;`,
+      [session.user_id]
+    );
+    if (userData.rows.length == 0) {
+      throw new Error('User not found');
+    }
+
+    // Don't include session_key for security reasons.
+    const sessions = await this.#config.db.query<Session>(
+      `SELECT id, url, user_id, created_at, active_ip_address, updated_at FROM sessions
+       WHERE user_id = $1
+       ORDER BY updated_at DESC;`,
+      [session.user_id]
+    );
+
+    return {
+      user: userData.rows[0],
+      sessions: sessions.rows,
+    };
+  }
+
+
 };

test/mock/environment.ts

@@ -195,6 +195,11 @@ export class MockClient {
   #listeners: Map<number, MockServer> = new Map();
   #listeningWebRTCConnections: Map<string, RTCPeerConnectionInterface> = new Map();
   #cookies: {[key: string]: {[key: string]: string}} = {};
+
+  get ip(): string {
+    return this.#options.ip;
+  }
+
   constructor(environment: MockEnvironment, options: Partial<ClientOptions>) {
     this.#environment = environment;
     this.#options = { ...this.#options, ...options };

test/server/user.test.ts

@@ -2,9 +2,9 @@ import { describe, expect, test } from '@jest/globals';
 
 import { MockEnvironment, MockClient } from '../mock/environment.ts';
 import { clock, lobbyDb, createLobbyServer } from '../mock/lobby.ts';
-import type { RegistrationData } from '../../src/server/user.ts';
+import type { RegistrationData, UserInfo } from '../../src/server/user.ts';
 
-describe('lobby server', () => {
+describe('user management', () => {
   const tryCreate = async (client: MockClient, address: string, fields: Partial<RegistrationData>) => {
     const data: RegistrationData = {
       username: 'user',
@@ -26,7 +26,7 @@ describe('lobby server', () => {
     return response;
   }
 
-  test('Registers a new user and verifies email', async () => {
+  test('Registers a new user, verifies email and tests login', async () => {
     await lobbyDb.initialized;
     const world = new MockEnvironment(clock);
     const { server, transport } = createLobbyServer(world);
@@ -55,6 +55,47 @@ describe('lobby server', () => {
       body: formData,
     });
     expect(response.status).toBe(200);
+
+    // Verify session
+    response = await client.fetch(`${address}/api/userinfo`);
+    expect(response.status).toBe(200);
+    let userInfo = await response.json() as UserInfo;
+    expect(userInfo.user.username).toBe('verify-test');
+    expect(userInfo.user.email).toBe('test@test.com');
+    expect(userInfo.sessions[0].active_ip_address).toBe(client.ip);
+
+    const client2 = world.createClient();
+    formData = new FormData();
+    formData.set('username', 'verify-test');
+    formData.set('password', 'supersecret');
+    response = await client2.fetch(`${address}/api/login`, {
+      method: 'POST',
+      body: formData,
+    });
+    expect(response.status).toBe(200);
+
+    response = await client2.fetch(`${address}/api/userinfo`);
+    expect(response.status).toBe(200);
+    userInfo = await response.json() as UserInfo;
+    expect(userInfo.sessions.length).toBe(2);
+    expect(userInfo.sessions[1].active_ip_address).toBe(client2.ip);
+
+    // Logout client2
+    response = await client2.fetch(`${address}/api/logout`, {
+      method: 'POST',
+    });
+    expect(response.status).toBe(200);
+
+    // Expect userinfo to fail now
+    response = await client2.fetch(`${address}/api/userinfo`);
+    expect(response.status).toBe(401);
+
+    // Ensure session was removed.
+    response = await client.fetch(`${address}/api/userinfo`);
+    expect(response.status).toBe(200);
+    userInfo = await response.json() as UserInfo;
+    expect(userInfo.sessions.length).toBe(1);
+
     await server.close();
   });