path: root/src/util/Signing.ts

/*
	Spacebar: A FOSS re-implementation and extension of the Discord.com backend.
	Copyright (C) 2023 Spacebar and Spacebar Contributors
	
	This program is free software: you can redistribute it and/or modify
	it under the terms of the GNU Affero General Public License as published
	by the Free Software Foundation, either version 3 of the License, or
	(at your option) any later version.
	
	This program is distributed in the hope that it will be useful,
	but WITHOUT ANY WARRANTY; without even the implied warranty of
	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
	GNU Affero General Public License for more details.
	
	You should have received a copy of the GNU Affero General Public License
	along with this program.  If not, see <https://www.gnu.org/licenses/>.
*/

import { Config } from "@spacebar/util";
import { createHmac, timingSafeEqual } from "crypto";
import ms, { StringValue } from "ms";
import * as console from "node:console";

export class NewUrlUserSignatureData {
    ip?: string;
    userAgent?: string;

    constructor(data: NewUrlUserSignatureData) {
        this.ip = data.ip;
        this.userAgent = data.userAgent;
    }
}

export class NewUrlSignatureData extends NewUrlUserSignatureData {
    path?: string;
    url?: string;

    constructor(data: NewUrlSignatureData) {
        super(data);
        this.path = data.path;
        this.url = data.url;
        if (!this.path && !this.url) {
            throw new Error("Either path or url must be provided for URL signing");
        }
        if (this.path && this.url) {
            if (process.env["LOG_CDN_SIGNATURES"]) console.warn("[Signing] Both path and url are provided, using path for signing", this, new Error().stack);
        }
        if (this.url) {
            try {
                const parsedUrl = new URL(this.url);
                this.path = parsedUrl.pathname;
            } catch (e) {
                throw new Error("Invalid URL provided for signing: " + this.url);
            }
        }
    }
}

export class UrlSignatureData extends NewUrlSignatureData {
    issuedAt: string;
    expiresAt: string;

    constructor(data: UrlSignatureData) {
        super(data);
        this.issuedAt = data.issuedAt;
        this.expiresAt = data.expiresAt;
    }
}

export class UrlSignResult {
    path: string;
    hash: string;
    issuedAt: string;
    expiresAt: string;

    constructor(data: Partial<UrlSignResult>) {
        for (const key in data) {
            // @ts-expect-error TS7053 - We dont care about string indexing a class
            this[key] = data[key];
        }
    }

    applyToUrl(url: URL | string): URL {
        if (typeof url === "string") {
            url = new URL(url);
        }
        url.searchParams.set("ex", this.expiresAt);
        url.searchParams.set("is", this.issuedAt);
        url.searchParams.set("hm", this.hash);
        return url;
    }

    static fromUrl(url: URL | string): UrlSignResult {
        if (typeof url === "string") {
            if (process.env["LOG_CDN_SIGNATURES"]) console.debug("[Signing] Parsing URL from string:", url);
            url = new URL(url);
        }
        if (process.env["LOG_CDN_SIGNATURES"]) console.debug("[Signing] Parsing URL from URL object:", url.toString());
        const ex = url.searchParams.get("ex");
        const is = url.searchParams.get("is");
        const hm = url.searchParams.get("hm");

        if (!ex || !is || !hm) {
            throw new Error("Invalid URL signature parameters");
        }

        return new UrlSignResult({
            path: url.pathname,
            issuedAt: is,
            expiresAt: ex,
            hash: hm,
        });
    }
}

export const getUrlSignature = (data: NewUrlSignatureData): UrlSignResult => {
    const { cdnSignatureKey, cdnSignatureDuration } = Config.get().security;

    // calculate the expiration time
    const now = Date.now();
    const issuedAt = now.toString(16);
    const expiresAt = (now + ms(cdnSignatureDuration as StringValue)).toString(16);

    // hash the url with the cdnSignatureKey
    return calculateHash(
        new UrlSignatureData({
            ...data,
            issuedAt,
            expiresAt,
        }),
    );
};

function calculateHash(request: UrlSignatureData): UrlSignResult {
    const { cdnSignatureKey } = Config.get().security;
    const data = createHmac("sha256", cdnSignatureKey as string)
        .update(request.path!)
        .update(request.issuedAt)
        .update(request.expiresAt);

    if (Config.get().security.cdnSignatureIncludeIp) {
        if (!request.ip)
            console.log(
                "[Signing] CDN Signature IP is enabled but we couldn't find the IP field in the request. This may cause issues with signature validation. Please report this to the Spacebar team!",
            );
        else {
            if (process.env["LOG_CDN_SIGNATURES"]) console.log("[Signing] CDN Signature IP is enabled, adding IP to hash:", request.ip);
            data.update(request.ip!);
        }
    }

    if (Config.get().security.cdnSignatureIncludeUserAgent) {
        if (!request.userAgent)
            console.log(
                "[Signing] CDN Signature User-Agent is enabled but we couldn't find the user-agent header in the request. This may cause issues with signature validation. Please report this to the Spacebar team!",
            );
        else {
            if (process.env["LOG_CDN_SIGNATURES"]) console.log("[Signing] CDN Signature User-Agent is enabled, adding User-Agent to hash:", request.userAgent);
            data.update(request.userAgent!);
        }
    }

    const hash = data.digest("hex");
    const result = new UrlSignResult({
        path: request.path,
        issuedAt: request.issuedAt,
        expiresAt: request.expiresAt,
        hash,
    });
    if (process.env["LOG_CDN_SIGNATURES"])
        console.log(
            "[Signing]",
            {
                path: request.path,
                validity: request.issuedAt + " .. " + request.expiresAt,
                ua: Config.get().security.cdnSignatureIncludeUserAgent ? request.userAgent : "[disabled]",
                ip: Config.get().security.cdnSignatureIncludeIp ? request.ip : "[disabled]",
            },
            "->",
            result,
        );
    return result;
}

export const isExpired = (data: UrlSignResult | UrlSignatureData) => {
    // convert issued at
    const issuedAt = parseInt(data.issuedAt, 16);
    const expiresAt = parseInt(data.expiresAt, 16);

    if (Number.isNaN(issuedAt) || Number.isNaN(expiresAt)) {
        if (process.env["LOG_CDN_SIGNATURES"]) console.debug("[Signing] Invalid timestamps in query");
        return true;
    }

    const currentTime = Date.now();

    const isExpired = expiresAt < currentTime;
    if (isExpired) {
        if (process.env["LOG_CDN_SIGNATURES"]) console.debug("[Signing] Signature expired");
        return true;
    }

    const isValidIssuedAt = issuedAt < currentTime;
    if (!isValidIssuedAt) {
        if (process.env["LOG_CDN_SIGNATURES"]) console.debug("[Signing] Signature issued in the future");
        return true;
    }

    return false;
};

export const hasValidSignature = (req: NewUrlUserSignatureData, sig: UrlSignResult) => {
    // if the required query parameters are not present, return false
    if (!sig.expiresAt || !sig.issuedAt || !sig.hash) {
        if (process.env["LOG_CDN_SIGNATURES"]) console.warn("[Signing] Missing required query parameters for signature validation");
        return false;
    }

    // check if the signature is expired
    if (isExpired(sig)) {
        if (process.env["LOG_CDN_SIGNATURES"]) console.warn("[Signing] Signature is expired");
        return false;
    }

    const calcResult = calculateHash(
        new UrlSignatureData({
            path: sig.path,
            issuedAt: sig.issuedAt,
            expiresAt: sig.expiresAt,
            ip: req.ip,
            userAgent: req.userAgent,
        }),
    );
    const calcd = calcResult.hash;
    const calculated = Buffer.from(calcd);
    const received = Buffer.from(sig.hash as string);

    console.assert(sig.issuedAt == calcResult.issuedAt, "[Signing] Mismatched issuedAt", {
        is: sig.issuedAt,
        calculated: calcResult.issuedAt,
    });

    console.assert(sig.expiresAt == calcResult.expiresAt, "[Signing] Mismatched expiresAt", {
        ex: sig.expiresAt,
        calculated: calcResult.expiresAt,
    });

    console.assert(calculated.length === received.length, "[Signing] Mismatched hash length", {
        calculated: calculated.length,
        received: received.length,
    });

    const isHashValid = calculated.length === received.length && timingSafeEqual(calculated, received);

    if (!isHashValid)
        if (process.env["LOG_CDN_SIGNATURES"])
            console.warn(`Signature validation for ${sig.path} (is=${sig.issuedAt}, ex=${sig.expiresAt}) failed: calculated: ${calcd}, received: ${sig.hash}`);

    return isHashValid;
};