fix a bug renaming bags and adjust referer checks

Author: Arlen22

ARCHITECTURE.md

@@ -126,3 +126,4 @@ These are the hooks that run on startup. The listen command starts the server an
 
 - improve the small screen form factor for the admin UI
 - make sure all the descriptions and labels make sense
+- something seems to be bugged in upserts

packages/mws/src/RequestState.ts

@@ -4,7 +4,7 @@ import { ServerState } from "./ServerState";
 import { BodyFormat, ParsedRequest, RouteMatch, Router, ServerRequest, Streamer, StreamerHeadersInput, SuperHeadersInit, SuperHeadersPropertyInit, truthy } from "@tiddlywiki/server";
 import { SendError, SendErrorReasonData } from "@tiddlywiki/server";
 import { ServerToReactAdmin } from './services/setupDevServer';
-import { AuthUser } from './services/sessions';
+import { AuthUser } from './new-managers/sessions';
 
 
 declare module "@tiddlywiki/server" {
@@ -60,13 +60,13 @@ export class StateObject<
 
   okUser() {
     if (!this.user.isLoggedIn)
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "User not authenticated" })
+      throw new SendError("ACCESS_DENIED", 403, { reason: "User not authenticated" })
   }
   okAdmin() {
-    if (!this.user.isLoggedIn) 
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "User not authenticated" })
-    if (!this.user.isAdmin) 
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "User is not an admin" })
+    if (!this.user.isLoggedIn)
+      throw new SendError("ACCESS_DENIED", 403, { reason: "User not authenticated" })
+    if (!this.user.isAdmin)
+      throw new SendError("ACCESS_DENIED", 403, { reason: "User is not an admin" })
   }
 
   async $transaction<T>(fn: (prisma: PrismaTxnClient) => Promise<T>): Promise<T> {
@@ -81,32 +81,47 @@ export class StateObject<
     return this.engine.$transaction(arg(this.engine), options);
   }
 
+  /** 
+   * This is intended to prevent malicious code attempting to access restricted
+   * bags using the credentials of more privelaged users and then saving the data
+   * to less restricted bags. Eventually this is intended to have a more complete 
+   * system where a page requests permission to access another page on behalf of the user.
+   */
   assertWikiReferer(recipe_slug: string) {
     const state = this;
     if (!state.headers.referer) return;
     const referer = new URL(state.headers.referer);
-    // console.log("Referer", state.headers.referer, referer);
+    // for now pages outside the path prefix are denied, but this should probably change
     if (!referer.pathname.startsWith(state.pathPrefix))
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
+      throw new SendError("ACCESS_DENIED", 403, { reason: "Referer check failed" })
+    // if a recipe endpoint somehow serves a page, it's definitely wiki content, so deny it
+    if (referer.pathname.startsWith(state.pathPrefix + "/recipe/"))
+      throw new SendError("ACCESS_DENIED", 403, { reason: "Referer check failed" })
+    // pages outside the wiki path are allowed to access wiki endpoints if they want
     if (!referer.pathname.startsWith(state.pathPrefix + "/wiki/"))
-      return; // keep going
+      return;
     // we now get the recipe name from the referer
     const recipe_name = referer.pathname.substring(state.pathPrefix.length + "/wiki/".length);
     const referer_slug = decodeURIComponent(recipe_name) as PrismaField<"Recipe", "id">;
     if (referer_slug !== recipe_slug)
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
+      throw new SendError("ACCESS_DENIED", 403, { reason: "Referer check failed" })
   }
 
-  assertAdminReferer() {
+  /** 
+   * If this throws in the wrong situation it may be a bug.
+   * Normally this is intended to keep wiki code from trying to acces admin or login paths,
+   * since malicious code would be accessing it from every computer that opens the wiki.
+   * It is not intended to restrict legitimate scenarios, especially not scenarios coded into
+   * the admin-vanilla client. If it throws under stock conditions, it's a bug.
+   */
+  assertRefererPrefix(prefix: string[]) {
     const state = this;
     // referer is a voluntary header
     if (!state.headers.referer) return;
     const referer = new URL(state.headers.referer);
     // deny referers from outside our pathprefix
-    if (!referer.pathname.startsWith(state.pathPrefix))
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
-    if (referer.pathname.startsWith(state.pathPrefix + "/wiki/"))
-      throw new SendError("ACCESS_DENIED", 403, { reason:  "Referer check failed" })
+    if (!prefix.some(e => referer.pathname.startsWith(state.pathPrefix + e)))
+      throw new SendError("ACCESS_DENIED", 403, { reason: "Referer check failed" })
   }
 
 

packages/mws/src/ServerState.ts

@@ -3,11 +3,11 @@ import { ITXClientDenyList } from "@tiddlywiki/mws-prisma";
 import { TW } from "tiddlywiki";
 import pkg from "../package.json";
 import { createPasswordService } from "./services/PasswordService";
-import { startupCache } from "./services/cache";
+import { startupCache } from "./new-managers/plugin-cache";
 import { Types } from "@tiddlywiki/mws-prisma";
 import { dist_resolve } from "@tiddlywiki/server";
 import { readFileSync } from "fs";
-import { SessionManager, SessionManagerObject } from "./services/sessions";
+import { SessionManager, SessionManagerObject } from "./new-managers/sessions";
 
 /** This is an alias for ServerState in case we want to separate the two purposes. */
 export type SiteConfig = ServerState;

packages/mws/src/index.ts

@@ -16,8 +16,8 @@ import "./zodAssert";
 import "./RequestState";
 import "./ServerState";
 import "./services/tw-routes";
-import "./services/cache";
-import "./services/sessions";
+import "./new-managers/plugin-cache";
+import "./new-managers/sessions";
 import "./SendError";
 
 // startup
@@ -33,7 +33,7 @@ export {
   SessionManager,
   SessionManagerObject,
   AuthUser
-} from "./services/sessions";
+} from "./new-managers/sessions";
 export {
   PasswordService
 } from "./services/PasswordService";
@@ -42,7 +42,7 @@ export {
   PluginDefinition,
   TiddlerHasher,
   defaultPreloadFunction,
-} from "./services/cache";
+} from "./new-managers/plugin-cache";
 export * from "./services/setupDevServer";
 export * from "./services/tiddlywiki";
 export {

packages/mws/src/new-commands/load-wiki-folder.ts

@@ -1,5 +1,5 @@
 import { BaseCommand, CommandInfo } from "@tiddlywiki/commander";
-import { WikiPluginCache } from "../services/cache";
+import { WikiPluginCache } from "../new-managers/plugin-cache";
 import { TiddlerFields, TW } from "tiddlywiki";
 import * as fs from "fs";
 import * as path from "path";

packages/mws/src/new-managers/RecipeResolver.ts

@@ -15,7 +15,7 @@ import { join, resolve } from "node:path";
 import { mapGetInit } from "./wiki-utils";
 import { IdString } from "@mws/admin-vanilla/src/definition/tabs";
 import { serverEvents } from "@tiddlywiki/events";
-import { defaultPreloadFunction, TiddlerHasher, WikiPluginCache } from "../services/cache";
+import { defaultPreloadFunction, TiddlerHasher, WikiPluginCache } from "./plugin-cache";
 
 // ---------------------------------------------------------------------------
 // Types

packages/mws/src/new-managers/TabDataAdapter.ts

@@ -33,6 +33,10 @@ import {
   UpsertTemplateInput
 } from "./wiki-contract";
 import { createHash } from "crypto";
+import { debuglog } from "util";
+import { Debug } from "@prisma/client/runtime/client";
+
+
 
 type IRecipeRow = DataStore["wikis"][number];
 type ITemplateRow = DataStore["templates"][number];
@@ -532,7 +536,7 @@ export const AdminSave = zodRoute({
   }),
   zodRequestBody: z => z.any(),
   inner: async (state) => {
-    state.assertAdminReferer();
+    state.assertRefererPrefix(["/admin/"]);
     state.asserted = state.user.isLoggedIn;
     state.data = JSON.parse(JSON.stringify(state.data), (key: any, val: any) => {
       if (typeof val === "string" && val.startsWith(IdString.prefix))
@@ -584,7 +588,7 @@ export const AdminLoad = zodRoute({
   securityChecks: { requestedWithHeader: true },
   zodPathParams: z => ({}),
   inner: async (state) => {
-    state.assertAdminReferer();
+    state.assertRefererPrefix(["/admin/"]);
     state.asserted = state.user.isLoggedIn;
     const res = await state.$transaction(async prisma => {
       const roles = await new RoleImportWriter(prisma, false).getIdMapper();

packages/mws/src/new-managers/TabUpserts.ts

@@ -11,6 +11,7 @@ import {
 import { Prisma } from "@tiddlywiki/mws-prisma";
 import { mapGetInit, thrower } from "./wiki-utils";
 import { IdString, TabId } from "@mws/admin-vanilla/src/definition/tabs";
+import { Debug } from "@prisma/client/runtime/client";
 
 
 export type ImportedRoleRows = Awaited<ReturnType<PrismaTxnClient["roles"]["findMany"]>>;
@@ -78,19 +79,22 @@ export abstract class PerClassImportWriter<Modal extends PrismaModalKeys> {
     protected initStore: boolean,
   ) {
     if (initStore) this.asserted = true;
+    this.debug = Debug("mws:admin:" + tabid)
   }
-
+  debug: ART<typeof Debug>;
   private asserted = false;
   assertPermissions() {
     if (!this.asserted)
       throw new Error("Permissions must be asserted first.")
   }
 
   async checkExisting(id: IdString, name: string, user: ServerRequest["user"]) {
-    if (user.isAdmin) { this.asserted = true; }
+    if (user.isAdmin) { this.debug("isAdmin: true"); this.asserted = true; }
     if (this.initStore && typeof user.isLoggedIn === "boolean")
       throw new Error("This shouldn't happen.");
 
+    this.debug("id.toString()", !!id.toString());
+
     if (!user.isAdmin && this.adminLevel) {
 
       if (!id.toString())
@@ -127,21 +131,26 @@ export abstract class PerClassImportWriter<Modal extends PrismaModalKeys> {
         where: { [this.id]: id.toString() },
         select: { [this.id]: true, [this.name]: true }
       });
+      this.debug("existing", existing[this.id], existing[this.name], name)
       if (!existing)
         throw new Error("existing wiki not found");
-      if (existing[this.name] !== name)
+      if (existing[this.name] !== name) {
         await this.rename([[existing[this.name], name]]);
+      }
     }
 
   }
 
   async rename(renames: [string, string][]) {
     this.assertPermissions();
-    await Promise.all(renames.map(([oldName, newName]) =>
-      (this.tx[this.modal] as any).update({
+    this.debug("renames", renames);
+    await Promise.all(renames.map(async ([oldName, newName]) => {
+      this.debug("rename", this.modal, this.name, oldName, newName);
+      await (this.tx[this.modal] as any).update({
         where: { [this.name]: oldName },
         data: { [this.name]: newName }
-      })));
+      });
+    }));
   }
   /** Maps names to ids */
   async getNameMapper(names?: readonly string[]) {
@@ -233,14 +242,15 @@ export class UserImportWriter extends PerClassImportWriter<"users"> {
 
 export class BagImportWriter extends PerClassImportWriter<"bag"> {
   constructor(tx: PrismaTxnClient, initStore: boolean) {
-    super(tx, "bags", "bag", "name", "id", "C_admin", initStore)
+    super(tx, "bags", "bag", "name", "id", "C_admin", initStore);
   }
 
   async rename(renames: [string, string][]) {
     this.assertPermissions();
     const renamesMap = new Map(renames);
+    this.debug("renames", ...renamesMap.entries());
     const bags = await this.tx.bag.findMany({
-      where: { name: { in: Array.from(renamesMap.keys(), e => e) } },
+      where: { name: { in: Array.from(renamesMap.keys()) } },
       include: { recipe_bags: { select: { recipe: { select: { id: true, template_id: true } } } }, }
     });
 
@@ -252,6 +262,8 @@ export class BagImportWriter extends PerClassImportWriter<"bag"> {
         mapGetInit(recipesInvolved, bag.name, () => new Set()).add(rb.recipe.id);
         mapGetInit(templatesInvolved, bag.name, () => new Set()).add(rb.recipe.template_id);
       });
+      this.debug(bag.name, "recipes involved", recipesInvolved.size);
+      this.debug(bag.name, "templates involved", templatesInvolved.size);
     });
 
     const recipesToEdit = Array.from(new Set(Array.from(recipesInvolved.values(), e => [...e]).flat()));
@@ -294,6 +306,8 @@ export class BagImportWriter extends PerClassImportWriter<"bag"> {
       });
     }
 
+    super.rename(renames);
+
   }
 
   async upsert(bags: UpsertBagInput[]) {

packages/mws/src/services/cache.ts …ges/mws/src/new-managers/plugin-cache.tspackages/mws/src/services/cache.ts renamed to packages/mws/src/new-managers/plugin-cache.ts packages/mws/src/services/cache.ts renamed to packages/mws/src/new-managers/plugin-cache.ts

@@ -6,7 +6,7 @@ import { TW } from "tiddlywiki";
 import { createGzip, gzipSync } from "zlib";
 import { awaitPipe, BodyFormat, checkPath, checkQueryKeys, dist_resolve, SendFileOptions, ServerRequest } from "@tiddlywiki/server";
 import { serverEvents } from "@tiddlywiki/events";
-import { mapGetInit } from "../new-managers";
+import { mapGetInit } from ".";
 import { open, stat } from "fs/promises";
 import { PassThrough, Readable } from "stream";
 import { pipeline } from "stream/promises";

packages/mws/src/services/sessions.ts packages/mws/src/new-managers/sessions.tspackages/mws/src/services/sessions.ts renamed to packages/mws/src/new-managers/sessions.ts

@@ -177,7 +177,7 @@ export class SessionManager {
   login1 = zodSession("/login/1", z => z.object({
     username: z.prismaField("Users", "username", "string"),
     startLoginRequest: z.string(),
-  }), async () => { }, async (state, prisma) => {
+  }), async (state) => { state.assertRefererPrefix(["/login"]); }, async (state, prisma) => {
     const { username, startLoginRequest } = state.data;
 
     const user = await prisma.users.findUnique({
@@ -209,7 +209,7 @@ export class SessionManager {
     finishLoginRequest: z.string(),
     loginSession: z.string(),
     skipCookie: z.boolean().optional().default(false),
-  }), async () => { }, async (state, prisma) => {
+  }), async (state) => { state.assertRefererPrefix(["/login"]); }, async (state, prisma) => {
     const { finishLoginRequest, skipCookie, loginSession } = state.data;
 
     if (!loginSession) throw "Login session not found.";
@@ -284,6 +284,7 @@ export class SessionManager {
     emailOrUsername: z.string(),
     resetCode: z.string().optional(),
   }), async state => {
+    state.assertRefererPrefix(["/login"]);
     if (state.data.resetCode)
       await passwordLookupRateLimiter.wait(state, "");
   }, async (state, prisma) => {
@@ -307,7 +308,7 @@ export class SessionManager {
     user_id: z.string(),
     registrationRequest: z.string().optional(),
     registrationRecord: z.string().optional(),
-  }), async () => { }, async (state, prisma) => {
+  }), async (state) => { state.assertRefererPrefix(["/login"]); }, async (state, prisma) => {
     const user = await prisma.users.findUnique({ where: { user_id: state.data.user_id, }, });
     if (!user)
       throw new SendError("RECORD_KEY_NOT_FOUND", 400, { table: "users", name: "user_id" });
@@ -348,7 +349,10 @@ export class SessionManager {
       session_id: z.string().optional(),
       signature: z.string().optional(),
     }),
-    async (state) => { state.okUser(); },
+    async (state) => {
+      state.okUser();
+      state.assertRefererPrefix(["/profile"]);
+    },
     async (state, prisma) => {
 
       const { user_id, registrationRecord, registrationRequest } = state.data;