refactor: strict permission system with shared middleware

- Create middleware/permissions.js with permission constants and role definitions
- Enhance middleware/auth.js: authenticateToken now validates user existence, auth_restricted from DB, supports cookies; add requireAdmin, requireNotRestricted, requireOwnership factory
- Move requireAdmin to shared middleware, remove inline version from admin.js
- Add restricted to JWT payload for all auth endpoints
- Replace inline DB restriction/ownership checks with middleware on all server routes
- Replace manual JWT verification with authenticateToken on activity and avatar routes
- Add Host header validation middleware in production

Author: ddrayko

middleware/auth.js

@@ -1,40 +1,108 @@
-import jwt from 'jsonwebtoken';
-import { query } from '../config/db.js';
-
-const JWT_SECRET = process.env.JWT_SECRET;
-
-export async function authenticateToken(req, res, next) {
-  const authHeader = req.headers['authorization'];
-  const token = authHeader && authHeader.split(' ')[1];
-
-  if (!token) {
-    return res.status(401).json({ error: 'Access token required' });
-  }
-
-  try {
-    const decoded = jwt.verify(token, JWT_SECRET);
-    req.user = decoded;
-
-    if (decoded.tokenVersion !== undefined) {
-      try {
-        const rows = await query('SELECT token_version FROM users WHERE id = ?', [decoded.userId]);
-        if (rows.length > 0 && rows[0].token_version !== decoded.tokenVersion) {
-          return res.status(403).json({ error: 'Session expired. Please log in again.' });
-        }
-      } catch {
-        return res.status(403).json({ error: 'Session validation failed.' });
-      }
-    }
-
-    next();
-  } catch {
-    return res.status(403).json({ error: 'Invalid or expired token' });
-  }
-}
-
-export function generateToken(payload) {
-  return jwt.sign(payload, JWT_SECRET, {
-    expiresIn: process.env.JWT_EXPIRES_IN || '2h',
-    algorithm: 'HS256',
-  });
-}
+import jwt from 'jsonwebtoken';
+import { query } from '../config/db.js';
+
+const JWT_SECRET = process.env.JWT_SECRET;
+
+async function getUserById(userId) {
+  try {
+    const rows = await query(
+      'SELECT id, email, username, is_admin, restricted, auth_restricted, token_version, ptero_user_id FROM users WHERE id = ?',
+      [userId]
+    );
+    return rows.length > 0 ? rows[0] : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function authenticateToken(req, res, next) {
+  let token = null;
+  const authHeader = req.headers['authorization'];
+
+  if (authHeader && authHeader.startsWith('Bearer ')) {
+    token = authHeader.split(' ')[1];
+  } else if (req.cookies && req.cookies.token) {
+    token = req.cookies.token;
+  }
+
+  if (!token) {
+    return res.status(401).json({ error: 'Access token required' });
+  }
+
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET);
+    const user = await getUserById(decoded.userId);
+
+    if (!user) {
+      return res.status(403).json({ error: 'User no longer exists' });
+    }
+
+    if (user.auth_restricted) {
+      return res.status(403).json({ error: 'Your account has been restricted. Contact support for assistance.' });
+    }
+
+    if (user.token_version !== decoded.tokenVersion) {
+      return res.status(403).json({ error: 'Session expired. Please log in again.' });
+    }
+
+    req.user = {
+      userId: user.id,
+      email: user.email,
+      username: user.username,
+      pteroId: user.ptero_user_id,
+      isAdmin: !!user.is_admin,
+      restricted: !!user.restricted,
+      tokenVersion: user.token_version,
+    };
+
+    next();
+  } catch {
+    return res.status(403).json({ error: 'Invalid or expired token' });
+  }
+}
+
+export function requireAdmin(req, res, next) {
+  if (!req.user?.isAdmin) {
+    return res.status(403).json({ error: 'Admin access required' });
+  }
+  next();
+}
+
+export function requireNotRestricted(req, res, next) {
+  if (req.user?.restricted) {
+    return res.status(403).json({ error: 'Your account is restricted. This action is disabled.' });
+  }
+  next();
+}
+
+export function requireOwnership(table, column, paramName, idSource = 'params') {
+  return async (req, res, next) => {
+    try {
+      const id = parseInt(idSource === 'params' ? req.params[paramName] : req.body[paramName], 10);
+      if (isNaN(id)) {
+        return res.status(400).json({ error: 'Invalid ID' });
+      }
+
+      const rows = await query(`SELECT user_id FROM ${table} WHERE ${column} = ?`, [id]);
+      if (rows.length === 0) {
+        return res.status(404).json({ error: 'Resource not found' });
+      }
+
+      if (rows[0].user_id !== req.user.userId) {
+        return res.status(403).json({ error: 'Access denied. Resource does not belong to you.' });
+      }
+
+      next();
+    } catch (err) {
+      console.error('Ownership check error:', err.message);
+      res.status(500).json({ error: 'Ownership verification failed' });
+    }
+  };
+}
+
+export function generateToken(payload) {
+  return jwt.sign(payload, JWT_SECRET, {
+    expiresIn: process.env.JWT_EXPIRES_IN || '2h',
+    algorithm: 'HS256',
+  });
+}

middleware/permissions.js

@@ -0,0 +1,120 @@
+export const ROLES = {
+  USER: 'user',
+  ADMIN: 'admin',
+};
+
+export const PERMISSIONS = {
+  // Server actions
+  SERVER_CREATE: 'server:create',
+  SERVER_RENEW: 'server:renew',
+  SERVER_RENAME: 'server:rename',
+  SERVER_REINSTALL: 'server:reinstall',
+  SERVER_DELETE: 'server:delete',
+  SERVER_POWER: 'server:power',
+  SERVER_LIST: 'server:list',
+  SERVER_DETAILS: 'server:details',
+  SERVER_OVERVIEW: 'server:overview',
+  SERVER_RESOURCES: 'server:resources',
+
+  // API key actions
+  API_KEY_READ: 'api_key:read',
+  API_KEY_WRITE: 'api_key:write',
+  API_KEY_DELETE: 'api_key:delete',
+
+  // Account actions
+  ACCOUNT_CHANGE_PASSWORD: 'account:change_password',
+  ACCOUNT_CHANGE_EMAIL: 'account:change_email',
+  ACCOUNT_DELETE: 'account:delete',
+  ACCOUNT_EXPORT_DATA: 'account:export_data',
+  ACCOUNT_UPLOAD_AVATAR: 'account:upload_avatar',
+  ACCOUNT_VIEW_AVATAR: 'account:view_avatar',
+
+  // Notification actions
+  NOTIFICATION_LIST: 'notification:list',
+  NOTIFICATION_READ: 'notification:read',
+  NOTIFICATION_READ_ALL: 'notification:read_all',
+
+  // Activity actions
+  ACTIVITY_LIST: 'activity:list',
+
+  // Admin actions
+  ADMIN_LOGIN: 'admin:login',
+  ADMIN_CHECK: 'admin:check',
+  ADMIN_LIST_SERVERS: 'admin:list_servers',
+  ADMIN_VIEW_SERVER: 'admin:view_server',
+  ADMIN_SUSPEND_SERVER: 'admin:suspend_server',
+  ADMIN_UNSUSPEND_SERVER: 'admin:unsuspend_server',
+  ADMIN_STOP_SERVER: 'admin:stop_server',
+  ADMIN_FORCE_EXPIRE: 'admin:force_expire',
+  ADMIN_DELETE_SERVER: 'admin:delete_server',
+  ADMIN_LIST_USERS: 'admin:list_users',
+  ADMIN_VIEW_USER: 'admin:view_user',
+  ADMIN_TOGGLE_RESTRICTION: 'admin:toggle_restriction',
+  ADMIN_TOGGLE_AUTH_RESTRICTION: 'admin:toggle_auth_restriction',
+  ADMIN_TOGGLE_ADMIN: 'admin:toggle_admin',
+  ADMIN_NOTIFY_USER: 'admin:notify_user',
+  ADMIN_NOTIFY_ALL: 'admin:notify_all',
+  ADMIN_DELETE_USER: 'admin:delete_user',
+  ADMIN_VIEW_STATS: 'admin:view_stats',
+  ADMIN_VIEW_ACTIVITY: 'admin:view_activity',
+  ADMIN_MANAGE_NESTS: 'admin:manage_nests',
+  ADMIN_MANAGE_EGGS: 'admin:manage_eggs',
+};
+
+export const ROLE_PERMISSIONS = {
+  [ROLES.USER]: [
+    PERMISSIONS.SERVER_CREATE,
+    PERMISSIONS.SERVER_RENEW,
+    PERMISSIONS.SERVER_RENAME,
+    PERMISSIONS.SERVER_REINSTALL,
+    PERMISSIONS.SERVER_DELETE,
+    PERMISSIONS.SERVER_POWER,
+    PERMISSIONS.SERVER_LIST,
+    PERMISSIONS.SERVER_DETAILS,
+    PERMISSIONS.SERVER_OVERVIEW,
+    PERMISSIONS.SERVER_RESOURCES,
+    PERMISSIONS.API_KEY_READ,
+    PERMISSIONS.API_KEY_WRITE,
+    PERMISSIONS.API_KEY_DELETE,
+    PERMISSIONS.ACCOUNT_CHANGE_PASSWORD,
+    PERMISSIONS.ACCOUNT_CHANGE_EMAIL,
+    PERMISSIONS.ACCOUNT_DELETE,
+    PERMISSIONS.ACCOUNT_EXPORT_DATA,
+    PERMISSIONS.ACCOUNT_UPLOAD_AVATAR,
+    PERMISSIONS.ACCOUNT_VIEW_AVATAR,
+    PERMISSIONS.NOTIFICATION_LIST,
+    PERMISSIONS.NOTIFICATION_READ,
+    PERMISSIONS.NOTIFICATION_READ_ALL,
+    PERMISSIONS.ACTIVITY_LIST,
+  ],
+  [ROLES.ADMIN]: [
+    // Admin inherits all user permissions + admin-specific ones
+    PERMISSIONS.ADMIN_LOGIN,
+    PERMISSIONS.ADMIN_CHECK,
+    PERMISSIONS.ADMIN_LIST_SERVERS,
+    PERMISSIONS.ADMIN_VIEW_SERVER,
+    PERMISSIONS.ADMIN_SUSPEND_SERVER,
+    PERMISSIONS.ADMIN_UNSUSPEND_SERVER,
+    PERMISSIONS.ADMIN_STOP_SERVER,
+    PERMISSIONS.ADMIN_FORCE_EXPIRE,
+    PERMISSIONS.ADMIN_DELETE_SERVER,
+    PERMISSIONS.ADMIN_LIST_USERS,
+    PERMISSIONS.ADMIN_VIEW_USER,
+    PERMISSIONS.ADMIN_TOGGLE_RESTRICTION,
+    PERMISSIONS.ADMIN_TOGGLE_AUTH_RESTRICTION,
+    PERMISSIONS.ADMIN_TOGGLE_ADMIN,
+    PERMISSIONS.ADMIN_NOTIFY_USER,
+    PERMISSIONS.ADMIN_NOTIFY_ALL,
+    PERMISSIONS.ADMIN_DELETE_USER,
+    PERMISSIONS.ADMIN_VIEW_STATS,
+    PERMISSIONS.ADMIN_VIEW_ACTIVITY,
+    PERMISSIONS.ADMIN_MANAGE_NESTS,
+    PERMISSIONS.ADMIN_MANAGE_EGGS,
+  ],
+};
+
+export function hasPermission(user, permission) {
+  if (!user) return false;
+  if (user.isAdmin) return true;
+  return ROLE_PERMISSIONS[ROLES.USER].includes(permission);
+}