832 lines
28 KiB
JavaScript
832 lines
28 KiB
JavaScript
/* jslint node: true */
|
|
'use strict';
|
|
|
|
// ENiGMA½
|
|
const userDb = require('./database.js').dbs.user;
|
|
const Config = require('./config.js').get;
|
|
const userGroup = require('./user_group.js');
|
|
const {
|
|
Errors,
|
|
ErrorReasons
|
|
} = require('./enig_error.js');
|
|
const Events = require('./events.js');
|
|
const UserProps = require('./user_property.js');
|
|
const Log = require('./logger.js').log;
|
|
const StatLog = require('./stat_log.js');
|
|
|
|
// deps
|
|
const crypto = require('crypto');
|
|
const assert = require('assert');
|
|
const async = require('async');
|
|
const _ = require('lodash');
|
|
const moment = require('moment');
|
|
const sanatizeFilename = require('sanitize-filename');
|
|
const ssh2 = require('ssh2');
|
|
|
|
exports.isRootUserId = function(id) { return 1 === id; };
|
|
|
|
module.exports = class User {
|
|
constructor() {
|
|
this.userId = 0;
|
|
this.username = '';
|
|
this.properties = {}; // name:value
|
|
this.groups = []; // group membership(s)
|
|
this.authFactor = User.AuthFactors.None;
|
|
}
|
|
|
|
// static property accessors
|
|
static get RootUserID() {
|
|
return 1;
|
|
}
|
|
|
|
static get AuthFactors() {
|
|
return {
|
|
None : 0, // Not yet authenticated in any way
|
|
Factor1 : 1, // username + password/pubkey/etc. checked out
|
|
Factor2 : 2, // validated with 2FA of some sort such as OTP
|
|
};
|
|
}
|
|
|
|
static get PBKDF2() {
|
|
return {
|
|
iterations : 1000,
|
|
keyLen : 128,
|
|
saltLen : 32,
|
|
};
|
|
}
|
|
|
|
static get StandardPropertyGroups() {
|
|
return {
|
|
auth : [
|
|
UserProps.PassPbkdf2Salt, UserProps.PassPbkdf2Dk,
|
|
UserProps.AuthPubKey,
|
|
],
|
|
};
|
|
}
|
|
|
|
static get AccountStatus() {
|
|
return {
|
|
disabled : 0, // +op disabled
|
|
inactive : 1, // inactive, aka requires +op approval/activation
|
|
active : 2, // standard, active
|
|
locked : 3, // locked out (too many bad login attempts, etc.)
|
|
};
|
|
}
|
|
|
|
isAuthenticated() {
|
|
return true === this.authenticated;
|
|
}
|
|
|
|
isValid() {
|
|
if(this.userId <= 0 || this.username.length < Config().users.usernameMin) {
|
|
return false;
|
|
}
|
|
|
|
return this.hasValidPasswordProperties();
|
|
}
|
|
|
|
hasValidPasswordProperties() {
|
|
const salt = this.getProperty(UserProps.PassPbkdf2Salt);
|
|
const dk = this.getProperty(UserProps.PassPbkdf2Dk);
|
|
|
|
if(!salt || !dk ||
|
|
(salt.length !== User.PBKDF2.saltLen * 2) ||
|
|
(dk.length !== User.PBKDF2.keyLen * 2))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
isRoot() {
|
|
return User.isRootUserId(this.userId);
|
|
}
|
|
|
|
isSysOp() { // alias to isRoot()
|
|
return this.isRoot();
|
|
}
|
|
|
|
isGroupMember(groupNames) {
|
|
if(_.isString(groupNames)) {
|
|
groupNames = [ groupNames ];
|
|
}
|
|
|
|
const isMember = groupNames.some(gn => (-1 !== this.groups.indexOf(gn)));
|
|
return isMember;
|
|
}
|
|
|
|
getSanitizedName(type='username') {
|
|
const name = 'real' === type ? this.getProperty(UserProps.RealName) : this.username;
|
|
return sanatizeFilename(name) || `user${this.userId.toString()}`;
|
|
}
|
|
|
|
getLegacySecurityLevel() {
|
|
if(this.isRoot() || this.isGroupMember('sysops')) {
|
|
return 100;
|
|
}
|
|
|
|
if(this.isGroupMember('users')) {
|
|
return 30;
|
|
}
|
|
|
|
return 10; // :TODO: Is this what we want?
|
|
}
|
|
|
|
processFailedLogin(userId, cb) {
|
|
async.waterfall(
|
|
[
|
|
(callback) => {
|
|
return User.getUser(userId, callback);
|
|
},
|
|
(tempUser, callback) => {
|
|
return StatLog.incrementUserStat(
|
|
tempUser,
|
|
UserProps.FailedLoginAttempts,
|
|
1,
|
|
(err, failedAttempts) => {
|
|
return callback(null, tempUser, failedAttempts);
|
|
}
|
|
);
|
|
},
|
|
(tempUser, failedAttempts, callback) => {
|
|
const lockAccount = _.get(Config(), 'users.failedLogin.lockAccount');
|
|
if(lockAccount > 0 && failedAttempts >= lockAccount) {
|
|
const props = {
|
|
[ UserProps.AccountStatus ] : User.AccountStatus.locked,
|
|
[ UserProps.AccountLockedTs ] : StatLog.now,
|
|
};
|
|
if(!_.has(tempUser.properties, UserProps.AccountLockedPrevStatus)) {
|
|
props[UserProps.AccountLockedPrevStatus] = tempUser.getProperty(UserProps.AccountStatus);
|
|
}
|
|
Log.info( { userId, failedAttempts }, '(Re)setting account to locked due to failed logins');
|
|
return tempUser.persistProperties(props, callback);
|
|
}
|
|
|
|
return cb(null);
|
|
}
|
|
],
|
|
err => {
|
|
return cb(err);
|
|
}
|
|
);
|
|
}
|
|
|
|
unlockAccount(cb) {
|
|
const prevStatus = this.getProperty(UserProps.AccountLockedPrevStatus);
|
|
if(!prevStatus) {
|
|
return cb(null); // nothing to do
|
|
}
|
|
|
|
this.persistProperty(UserProps.AccountStatus, prevStatus, err => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
return this.removeProperties( [ UserProps.AccountLockedPrevStatus, UserProps.AccountLockedTs ], cb);
|
|
});
|
|
}
|
|
|
|
static get AuthFactor1Types() {
|
|
return {
|
|
SSHPubKey : 'sshPubKey',
|
|
Password : 'password',
|
|
TLSClient : 'tlsClientAuth',
|
|
};
|
|
}
|
|
|
|
authenticateFactor1(authInfo, cb) {
|
|
const username = authInfo.username;
|
|
const self = this;
|
|
const tempAuthInfo = {};
|
|
|
|
const validatePassword = (props, callback) => {
|
|
User.generatePasswordDerivedKey(authInfo.password, props[UserProps.PassPbkdf2Salt], (err, dk) => {
|
|
if(err) {
|
|
return callback(err);
|
|
}
|
|
|
|
//
|
|
// Use constant time comparison here for security feel-goods
|
|
//
|
|
const passDkBuf = Buffer.from(dk, 'hex');
|
|
const propsDkBuf = Buffer.from(props[UserProps.PassPbkdf2Dk], 'hex');
|
|
|
|
return callback(crypto.timingSafeEqual(passDkBuf, propsDkBuf) ?
|
|
null :
|
|
Errors.AccessDenied('Invalid password')
|
|
);
|
|
});
|
|
};
|
|
|
|
const validatePubKey = (props, callback) => {
|
|
const pubKeyActual = ssh2.utils.parseKey(props[UserProps.AuthPubKey]);
|
|
if(!pubKeyActual) {
|
|
return callback(Errors.AccessDenied('Invalid public key'));
|
|
}
|
|
|
|
if(authInfo.pubKey.key.algo != pubKeyActual.type ||
|
|
!crypto.timingSafeEqual(authInfo.pubKey.key.data, pubKeyActual.getPublicSSH()))
|
|
{
|
|
return callback(Errors.AccessDenied('Invalid public key'));
|
|
}
|
|
|
|
return callback(null);
|
|
};
|
|
|
|
async.waterfall(
|
|
[
|
|
function fetchUserId(callback) {
|
|
// get user ID
|
|
User.getUserIdAndName(username, (err, uid, un) => {
|
|
tempAuthInfo.userId = uid;
|
|
tempAuthInfo.username = un;
|
|
|
|
return callback(err);
|
|
});
|
|
},
|
|
function getRequiredAuthProperties(callback) {
|
|
// fetch properties required for authentication
|
|
User.loadProperties(tempAuthInfo.userId, { names : User.StandardPropertyGroups.auth }, (err, props) => {
|
|
return callback(err, props);
|
|
});
|
|
},
|
|
function validatePassOrPubKey(props, callback) {
|
|
if(User.AuthFactor1Types.SSHPubKey === authInfo.type) {
|
|
return validatePubKey(props, callback);
|
|
}
|
|
return validatePassword(props, callback);
|
|
},
|
|
function initProps(callback) {
|
|
User.loadProperties(tempAuthInfo.userId, (err, allProps) => {
|
|
if(!err) {
|
|
tempAuthInfo.properties = allProps;
|
|
}
|
|
|
|
return callback(err);
|
|
});
|
|
},
|
|
function checkAccountStatus(callback) {
|
|
const accountStatus = parseInt(tempAuthInfo.properties[UserProps.AccountStatus], 10);
|
|
if(User.AccountStatus.disabled === accountStatus) {
|
|
return callback(Errors.AccessDenied('Account disabled', ErrorReasons.Disabled));
|
|
}
|
|
if(User.AccountStatus.inactive === accountStatus) {
|
|
return callback(Errors.AccessDenied('Account inactive', ErrorReasons.Inactive));
|
|
}
|
|
|
|
if(User.AccountStatus.locked === accountStatus) {
|
|
const autoUnlockMinutes = _.get(Config(), 'users.failedLogin.autoUnlockMinutes');
|
|
const lockedTs = moment(tempAuthInfo.properties[UserProps.AccountLockedTs]);
|
|
if(autoUnlockMinutes && lockedTs.isValid()) {
|
|
const minutesSinceLocked = moment().diff(lockedTs, 'minutes');
|
|
if(minutesSinceLocked >= autoUnlockMinutes) {
|
|
// allow the login - we will clear any lock there
|
|
Log.info(
|
|
{ username, userId : tempAuthInfo.userId, lockedAt : lockedTs.format() },
|
|
'Locked account will now be unlocked due to auto-unlock minutes policy'
|
|
);
|
|
return callback(null);
|
|
}
|
|
}
|
|
return callback(Errors.AccessDenied('Account is locked', ErrorReasons.Locked));
|
|
}
|
|
|
|
// anything else besides active is still not allowed
|
|
if(User.AccountStatus.active !== accountStatus) {
|
|
return callback(Errors.AccessDenied('Account is not active'));
|
|
}
|
|
|
|
return callback(null);
|
|
},
|
|
function initGroups(callback) {
|
|
userGroup.getGroupsForUser(tempAuthInfo.userId, (err, groups) => {
|
|
if(!err) {
|
|
tempAuthInfo.groups = groups;
|
|
}
|
|
|
|
return callback(err);
|
|
});
|
|
}
|
|
],
|
|
err => {
|
|
if(err) {
|
|
//
|
|
// If we failed login due to something besides an inactive or disabled account,
|
|
// we need to update failure status and possibly lock the account.
|
|
//
|
|
// If locked already, update the lock timestamp -- ie, extend the lockout period.
|
|
//
|
|
if(![ErrorReasons.Disabled, ErrorReasons.Inactive].includes(err.reasonCode) && tempAuthInfo.userId) {
|
|
self.processFailedLogin(tempAuthInfo.userId, persistErr => {
|
|
if(persistErr) {
|
|
Log.warn( { error : persistErr.message }, 'Failed to persist failed login information');
|
|
}
|
|
return cb(err); // pass along original error
|
|
});
|
|
} else {
|
|
return cb(err);
|
|
}
|
|
} else {
|
|
// everything checks out - load up info
|
|
self.userId = tempAuthInfo.userId;
|
|
self.username = tempAuthInfo.username;
|
|
self.properties = tempAuthInfo.properties;
|
|
self.groups = tempAuthInfo.groups;
|
|
self.authFactor = User.AuthFactors.Factor1;
|
|
|
|
//
|
|
// If 2FA/OTP is required, this user is not quite authenticated yet.
|
|
//
|
|
self.authenticated = !(self.getProperty(UserProps.AuthFactor2OTP) ? true : false);
|
|
|
|
self.removeProperty(UserProps.FailedLoginAttempts);
|
|
|
|
//
|
|
// We need to *revert* any locked status back to
|
|
// the user's previous status & clean up props.
|
|
//
|
|
self.unlockAccount(unlockErr => {
|
|
if(unlockErr) {
|
|
Log.warn( { error : unlockErr.message }, 'Failed to unlock account');
|
|
}
|
|
return cb(null);
|
|
});
|
|
}
|
|
}
|
|
);
|
|
}
|
|
|
|
create(createUserInfo , cb) {
|
|
assert(0 === this.userId);
|
|
const config = Config();
|
|
|
|
if(this.username.length < config.users.usernameMin || this.username.length > config.users.usernameMax) {
|
|
return cb(Errors.Invalid('Invalid username length'));
|
|
}
|
|
|
|
const self = this;
|
|
|
|
// :TODO: set various defaults, e.g. default activation status, etc.
|
|
self.properties[UserProps.AccountStatus] = config.users.requireActivation ? User.AccountStatus.inactive : User.AccountStatus.active;
|
|
|
|
async.waterfall(
|
|
[
|
|
function beginTransaction(callback) {
|
|
return userDb.beginTransaction(callback);
|
|
},
|
|
function createUserRec(trans, callback) {
|
|
trans.run(
|
|
`INSERT INTO user (user_name)
|
|
VALUES (?);`,
|
|
[ self.username ],
|
|
function inserted(err) { // use classic function for |this|
|
|
if(err) {
|
|
return callback(err);
|
|
}
|
|
|
|
self.userId = this.lastID;
|
|
|
|
// Do not require activation for userId 1 (root/admin)
|
|
if(User.RootUserID === self.userId) {
|
|
self.properties[UserProps.AccountStatus] = User.AccountStatus.active;
|
|
}
|
|
|
|
return callback(null, trans);
|
|
}
|
|
);
|
|
},
|
|
function genAuthCredentials(trans, callback) {
|
|
User.generatePasswordDerivedKeyAndSalt(createUserInfo.password, (err, info) => {
|
|
if(err) {
|
|
return callback(err);
|
|
}
|
|
|
|
self.properties[UserProps.PassPbkdf2Salt] = info.salt;
|
|
self.properties[UserProps.PassPbkdf2Dk] = info.dk;
|
|
return callback(null, trans);
|
|
});
|
|
},
|
|
function setInitialGroupMembership(trans, callback) {
|
|
// Assign initial groups. Must perform a clone: #235 - All users are sysops (and I can't un-sysop them)
|
|
self.groups = [...config.users.defaultGroups];
|
|
|
|
if(User.RootUserID === self.userId) { // root/SysOp?
|
|
self.groups.push('sysops');
|
|
}
|
|
|
|
return callback(null, trans);
|
|
},
|
|
function saveAll(trans, callback) {
|
|
self.persistWithTransaction(trans, err => {
|
|
return callback(err, trans);
|
|
});
|
|
},
|
|
function sendEvent(trans, callback) {
|
|
Events.emit(
|
|
Events.getSystemEvents().NewUser,
|
|
{
|
|
user : Object.assign({}, self, { sessionId : createUserInfo.sessionId } )
|
|
}
|
|
);
|
|
return callback(null, trans);
|
|
}
|
|
],
|
|
(err, trans) => {
|
|
if(trans) {
|
|
trans[err ? 'rollback' : 'commit'](transErr => {
|
|
return cb(err ? err : transErr);
|
|
});
|
|
} else {
|
|
return cb(err);
|
|
}
|
|
}
|
|
);
|
|
}
|
|
|
|
persistWithTransaction(trans, cb) {
|
|
assert(this.userId > 0);
|
|
|
|
const self = this;
|
|
|
|
async.series(
|
|
[
|
|
function saveProps(callback) {
|
|
self.persistProperties(self.properties, trans, err => {
|
|
return callback(err);
|
|
});
|
|
},
|
|
function saveGroups(callback) {
|
|
userGroup.addUserToGroups(self.userId, self.groups, trans, err => {
|
|
return callback(err);
|
|
});
|
|
}
|
|
],
|
|
err => {
|
|
return cb(err);
|
|
}
|
|
);
|
|
}
|
|
|
|
static persistPropertyByUserId(userId, propName, propValue, cb) {
|
|
userDb.run(
|
|
`REPLACE INTO user_property (user_id, prop_name, prop_value)
|
|
VALUES (?, ?, ?);`,
|
|
[ userId, propName, propValue ],
|
|
err => {
|
|
if(cb) {
|
|
return cb(err, propValue);
|
|
}
|
|
}
|
|
);
|
|
}
|
|
|
|
setProperty(propName, propValue) {
|
|
this.properties[propName] = propValue;
|
|
}
|
|
|
|
incrementProperty(propName, incrementBy) {
|
|
incrementBy = incrementBy || 1;
|
|
let newValue = parseInt(this.getProperty(propName));
|
|
if(newValue) {
|
|
newValue += incrementBy;
|
|
} else {
|
|
newValue = incrementBy;
|
|
}
|
|
this.setProperty(propName, newValue);
|
|
return newValue;
|
|
}
|
|
|
|
getProperty(propName) {
|
|
return this.properties[propName];
|
|
}
|
|
|
|
getPropertyAsNumber(propName) {
|
|
return parseInt(this.getProperty(propName), 10);
|
|
}
|
|
|
|
persistProperty(propName, propValue, cb) {
|
|
// update live props
|
|
this.properties[propName] = propValue;
|
|
|
|
return User.persistPropertyByUserId(this.userId, propName, propValue, cb);
|
|
}
|
|
|
|
removeProperty(propName, cb) {
|
|
// update live
|
|
delete this.properties[propName];
|
|
|
|
userDb.run(
|
|
`DELETE FROM user_property
|
|
WHERE user_id = ? AND prop_name = ?;`,
|
|
[ this.userId, propName ],
|
|
err => {
|
|
if(cb) {
|
|
return cb(err);
|
|
}
|
|
}
|
|
);
|
|
}
|
|
|
|
removeProperties(propNames, cb) {
|
|
async.each(propNames, (name, next) => {
|
|
return this.removeProperty(name, next);
|
|
},
|
|
err => {
|
|
if(cb) {
|
|
return cb(err);
|
|
}
|
|
});
|
|
}
|
|
|
|
persistProperties(properties, transOrDb, cb) {
|
|
if(!_.isFunction(cb) && _.isFunction(transOrDb)) {
|
|
cb = transOrDb;
|
|
transOrDb = userDb;
|
|
}
|
|
|
|
const self = this;
|
|
|
|
// update live props
|
|
_.merge(this.properties, properties);
|
|
|
|
const stmt = transOrDb.prepare(
|
|
`REPLACE INTO user_property (user_id, prop_name, prop_value)
|
|
VALUES (?, ?, ?);`
|
|
);
|
|
|
|
async.each(Object.keys(properties), (propName, nextProp) => {
|
|
stmt.run(self.userId, propName, properties[propName], err => {
|
|
return nextProp(err);
|
|
});
|
|
},
|
|
err => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
stmt.finalize( () => {
|
|
return cb(null);
|
|
});
|
|
});
|
|
}
|
|
|
|
setNewAuthCredentials(password, cb) {
|
|
User.generatePasswordDerivedKeyAndSalt(password, (err, info) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
const newProperties = {
|
|
[ UserProps.PassPbkdf2Salt ] : info.salt,
|
|
[ UserProps.PassPbkdf2Dk ] : info.dk,
|
|
};
|
|
|
|
this.persistProperties(newProperties, err => {
|
|
return cb(err);
|
|
});
|
|
});
|
|
}
|
|
|
|
getAge() {
|
|
const birthdate = this.getProperty(UserProps.Birthdate);
|
|
if(birthdate) {
|
|
return moment().diff(birthdate, 'years');
|
|
}
|
|
}
|
|
|
|
static getUser(userId, cb) {
|
|
async.waterfall(
|
|
[
|
|
function fetchUserId(callback) {
|
|
User.getUserName(userId, (err, userName) => {
|
|
return callback(null, userName);
|
|
});
|
|
},
|
|
function initProps(userName, callback) {
|
|
User.loadProperties(userId, (err, properties) => {
|
|
return callback(err, userName, properties);
|
|
});
|
|
},
|
|
function initGroups(userName, properties, callback) {
|
|
userGroup.getGroupsForUser(userId, (err, groups) => {
|
|
return callback(null, userName, properties, groups);
|
|
});
|
|
}
|
|
],
|
|
(err, userName, properties, groups) => {
|
|
const user = new User();
|
|
user.userId = userId;
|
|
user.username = userName;
|
|
user.properties = properties;
|
|
user.groups = groups;
|
|
|
|
// explicitly NOT an authenticated user!
|
|
user.authenticated = false;
|
|
user.authFactor = User.AuthFactors.None;
|
|
|
|
return cb(err, user);
|
|
}
|
|
);
|
|
}
|
|
|
|
static isRootUserId(userId) {
|
|
return (User.RootUserID === userId);
|
|
}
|
|
|
|
static getUserIdAndName(username, cb) {
|
|
userDb.get(
|
|
`SELECT id, user_name
|
|
FROM user
|
|
WHERE user_name LIKE ?;`,
|
|
[ username ],
|
|
(err, row) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
if(row) {
|
|
return cb(null, row.id, row.user_name);
|
|
}
|
|
|
|
return cb(Errors.DoesNotExist('No matching username'));
|
|
}
|
|
);
|
|
}
|
|
|
|
static getUserIdAndNameByRealName(realName, cb) {
|
|
userDb.get(
|
|
`SELECT id, user_name
|
|
FROM user
|
|
WHERE id = (
|
|
SELECT user_id
|
|
FROM user_property
|
|
WHERE prop_name='${UserProps.RealName}' AND prop_value LIKE ?
|
|
);`,
|
|
[ realName ],
|
|
(err, row) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
if(row) {
|
|
return cb(null, row.id, row.user_name);
|
|
}
|
|
|
|
return cb(Errors.DoesNotExist('No matching real name'));
|
|
}
|
|
);
|
|
}
|
|
|
|
static getUserIdAndNameByLookup(lookup, cb) {
|
|
User.getUserIdAndName(lookup, (err, userId, userName) => {
|
|
if(err) {
|
|
User.getUserIdAndNameByRealName(lookup, (err, userId, userName) => {
|
|
return cb(err, userId, userName);
|
|
});
|
|
} else {
|
|
return cb(null, userId, userName);
|
|
}
|
|
});
|
|
}
|
|
|
|
static getUserName(userId, cb) {
|
|
userDb.get(
|
|
`SELECT user_name
|
|
FROM user
|
|
WHERE id = ?;`,
|
|
[ userId ],
|
|
(err, row) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
if(row) {
|
|
return cb(null, row.user_name);
|
|
}
|
|
|
|
return cb(Errors.DoesNotExist('No matching user ID'));
|
|
}
|
|
);
|
|
}
|
|
|
|
static loadProperties(userId, options, cb) {
|
|
if(!cb && _.isFunction(options)) {
|
|
cb = options;
|
|
options = {};
|
|
}
|
|
|
|
let sql =
|
|
`SELECT prop_name, prop_value
|
|
FROM user_property
|
|
WHERE user_id = ?`;
|
|
|
|
if(options.names) {
|
|
sql += ` AND prop_name IN("${options.names.join('","')}");`;
|
|
} else {
|
|
sql += ';';
|
|
}
|
|
|
|
let properties = {};
|
|
userDb.each(sql, [ userId ], (err, row) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
properties[row.prop_name] = row.prop_value;
|
|
}, (err) => {
|
|
return cb(err, err ? null : properties);
|
|
});
|
|
}
|
|
|
|
// :TODO: make this much more flexible - propValue should allow for case-insensitive compare, etc.
|
|
static getUserIdsWithProperty(propName, propValue, cb) {
|
|
let userIds = [];
|
|
|
|
userDb.each(
|
|
`SELECT user_id
|
|
FROM user_property
|
|
WHERE prop_name = ? AND prop_value = ?;`,
|
|
[ propName, propValue ],
|
|
(err, row) => {
|
|
if(row) {
|
|
userIds.push(row.user_id);
|
|
}
|
|
},
|
|
() => {
|
|
return cb(null, userIds);
|
|
}
|
|
);
|
|
}
|
|
|
|
static getUserList(options, cb) {
|
|
const userList = [];
|
|
|
|
options.properties = options.properties || [ UserProps.RealName ];
|
|
|
|
const asList = [];
|
|
const joinList = [];
|
|
for (let i = 0; i < options.properties.length; ++i) {
|
|
const dbProp = options.properties[i];
|
|
const propName = options.propsCamelCase ? _.camelCase(dbProp) : dbProp;
|
|
asList.push(`p${i}.prop_value AS ${propName}`);
|
|
joinList.push(`LEFT OUTER JOIN user_property p${i} ON p${i}.user_id = u.id AND p${i}.prop_name = '${dbProp}'`);
|
|
}
|
|
|
|
userDb.each(
|
|
`SELECT u.id as userId, u.user_name as userName, ${asList.join(', ')}
|
|
FROM user u ${joinList.join(' ')}
|
|
ORDER BY u.user_name;`,
|
|
(err, row) => {
|
|
if (err) {
|
|
return cb(err);
|
|
}
|
|
userList.push(row);
|
|
},
|
|
err => {
|
|
return cb(err, userList);
|
|
}
|
|
);
|
|
}
|
|
|
|
static generatePasswordDerivedKeyAndSalt(password, cb) {
|
|
async.waterfall(
|
|
[
|
|
function getSalt(callback) {
|
|
User.generatePasswordDerivedKeySalt( (err, salt) => {
|
|
return callback(err, salt);
|
|
});
|
|
},
|
|
function getDk(salt, callback) {
|
|
User.generatePasswordDerivedKey(password, salt, (err, dk) => {
|
|
return callback(err, salt, dk);
|
|
});
|
|
}
|
|
],
|
|
(err, salt, dk) => {
|
|
return cb(err, { salt : salt, dk : dk } );
|
|
}
|
|
);
|
|
}
|
|
|
|
static generatePasswordDerivedKeySalt(cb) {
|
|
crypto.randomBytes(User.PBKDF2.saltLen, (err, salt) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
return cb(null, salt.toString('hex'));
|
|
});
|
|
}
|
|
|
|
static generatePasswordDerivedKey(password, salt, cb) {
|
|
password = Buffer.from(password).toString('hex');
|
|
|
|
crypto.pbkdf2(password, salt, User.PBKDF2.iterations, User.PBKDF2.keyLen, 'sha1', (err, dk) => {
|
|
if(err) {
|
|
return cb(err);
|
|
}
|
|
|
|
return cb(null, dk.toString('hex'));
|
|
});
|
|
}
|
|
};
|