mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
Phase B + C review pass: critical security and correctness fixes. Security - S1: plugin admin endpoints now require admin.RequireAdminAuth in addition to AdminIPRestrict. Previously a LAN attacker on the allowed CIDR could list/enable/disable/uninstall plugins without a session. - S2: rewrite plugin HTTPDo allowlist with proper net/url parsing. Empty entries are ignored, suffix matches require a dot boundary, and a custom Dialer rejects loopback / RFC1918 / link-local addresses to close the DNS-rebinding TOCTOU window. Redirects re-validated. - S3 + #9: manifest Name pinned to ^[a-z0-9][a-z0-9_-]{0,63}$, Entrypoint and UI tab assets validated against absolute / "..", NUL byte, backslash and non-canonical paths. Asset handler hardened with filepath.Rel check for symlink and prefix-without-separator escapes. - S5: pluginBridge postMessage handler ignores the pluginId in the message body and uses an e.source -> contentWindow lookup instead, defeating spoofed messages from same-origin scripts. - S8: HTTPDo body capped at 5 MiB via io.LimitReader, redirects bounded to 5 hops. Correctness - Critical seq alignment: PersistEvent now takes the hub-assigned seq as a required parameter so the events table row seq always matches the wrapped payload seq. Hub seeds its in-memory atomic counter from MAX(events.seq) on startup. Drops in the persister queue no longer mis-align row vs payload seq. - #1: live plugin.Registry constructed in main.go BEFORE NewRouter and threaded through; admin handler is no longer wired with nil. - #3: EventPersister.Stop is now safe to call without a prior Start by tracking a started flag — previously deadlocked waiting on done. Wiring - NewRouter signature gains *plugin.Registry; two test callers updated. - admin.RequireAdminAuth exported as a thin wrapper over the existing package-private adminAuthMiddleware. - sqlc query templates updated for the new PersistEvent + GetMaxEventSeq contracts (sqlite + postgres). https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk
303 lines
9.3 KiB
Go
303 lines
9.3 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/owncord/server/db"
|
|
)
|
|
|
|
// ── EventStore (Phase B Step 7) ─────────────────────────────────────────────
|
|
|
|
// PersistEvent appends a single event to the events table with the
|
|
// caller-supplied seq. The hub assigns seq before this is called so the row
|
|
// seq always matches the wrapped-payload seq, even if the persister drops
|
|
// some events under load.
|
|
func (s *SQLiteStore) PersistEvent(ctx context.Context, seq int64, eventType string, channelID int64, payload []byte) error {
|
|
_, err := s.db.SQLDb().ExecContext(ctx,
|
|
`INSERT INTO events (seq, event_type, channel_id, payload) VALUES (?, ?, ?, ?)`,
|
|
seq, eventType, channelID, payload,
|
|
)
|
|
if err != nil {
|
|
return fmt.Errorf("PersistEvent: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// GetEventsSince returns events with seq > afterSeq up to limit, ordered ASC.
|
|
func (s *SQLiteStore) GetEventsSince(ctx context.Context, afterSeq int64, limit int) ([]db.PersistedEvent, error) {
|
|
rows, err := s.db.SQLDb().QueryContext(ctx,
|
|
`SELECT seq, event_type, channel_id, payload, created_at
|
|
FROM events
|
|
WHERE seq > ?
|
|
ORDER BY seq ASC
|
|
LIMIT ?`,
|
|
afterSeq, limit,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("GetEventsSince: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
return scanEventRows(rows)
|
|
}
|
|
|
|
// GetEventsSinceForChannels filters events to those whose channel_id is 0
|
|
// (global broadcast) or in channelIDs.
|
|
func (s *SQLiteStore) GetEventsSinceForChannels(ctx context.Context, afterSeq int64, channelIDs []int64, limit int) ([]db.PersistedEvent, error) {
|
|
// Build IN clause manually since database/sql does not expand slices.
|
|
if len(channelIDs) == 0 {
|
|
// Only global broadcasts.
|
|
rows, err := s.db.SQLDb().QueryContext(ctx,
|
|
`SELECT seq, event_type, channel_id, payload, created_at
|
|
FROM events
|
|
WHERE seq > ? AND channel_id = 0
|
|
ORDER BY seq ASC
|
|
LIMIT ?`,
|
|
afterSeq, limit,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("GetEventsSinceForChannels (global only): %w", err)
|
|
}
|
|
defer rows.Close()
|
|
return scanEventRows(rows)
|
|
}
|
|
|
|
placeholders := make([]string, len(channelIDs))
|
|
args := make([]any, 0, len(channelIDs)+2)
|
|
args = append(args, afterSeq)
|
|
for i, cid := range channelIDs {
|
|
placeholders[i] = "?"
|
|
args = append(args, cid)
|
|
}
|
|
args = append(args, limit)
|
|
|
|
query := fmt.Sprintf(
|
|
`SELECT seq, event_type, channel_id, payload, created_at
|
|
FROM events
|
|
WHERE seq > ?
|
|
AND (channel_id = 0 OR channel_id IN (%s))
|
|
ORDER BY seq ASC
|
|
LIMIT ?`,
|
|
strings.Join(placeholders, ","),
|
|
)
|
|
rows, err := s.db.SQLDb().QueryContext(ctx, query, args...)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("GetEventsSinceForChannels: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
return scanEventRows(rows)
|
|
}
|
|
|
|
// GetMaxEventSeq returns the largest seq in the events table, or 0 if empty.
|
|
func (s *SQLiteStore) GetMaxEventSeq(ctx context.Context) (int64, error) {
|
|
var maxSeq sql.NullInt64
|
|
err := s.db.SQLDb().QueryRowContext(ctx, `SELECT MAX(seq) FROM events`).Scan(&maxSeq)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("GetMaxEventSeq: %w", err)
|
|
}
|
|
if !maxSeq.Valid {
|
|
return 0, nil
|
|
}
|
|
return maxSeq.Int64, nil
|
|
}
|
|
|
|
// PruneEventsOlderThan deletes events older than cutoff. Returns rows deleted.
|
|
func (s *SQLiteStore) PruneEventsOlderThan(ctx context.Context, cutoff time.Time) (int64, error) {
|
|
res, err := s.db.SQLDb().ExecContext(ctx,
|
|
`DELETE FROM events WHERE created_at < ?`,
|
|
cutoff.UTC().Format("2006-01-02 15:04:05"),
|
|
)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("PruneEventsOlderThan: %w", err)
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return 0, fmt.Errorf("PruneEventsOlderThan RowsAffected: %w", err)
|
|
}
|
|
return n, nil
|
|
}
|
|
|
|
// ── PluginStore (Phase C Step 9) ────────────────────────────────────────────
|
|
|
|
func (s *SQLiteStore) InstallPlugin(ctx context.Context, name, version, manifestJSON string) (int64, error) {
|
|
res, err := s.db.SQLDb().ExecContext(ctx,
|
|
`INSERT INTO plugins (name, version, enabled, manifest_json) VALUES (?, ?, 0, ?)
|
|
ON CONFLICT(name) DO UPDATE SET version = excluded.version, manifest_json = excluded.manifest_json`,
|
|
name, version, manifestJSON,
|
|
)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("InstallPlugin: %w", err)
|
|
}
|
|
id, err := res.LastInsertId()
|
|
if err != nil || id == 0 {
|
|
// On conflict path LastInsertId may be 0; look up by name.
|
|
row := s.db.SQLDb().QueryRowContext(ctx, `SELECT id FROM plugins WHERE name = ?`, name)
|
|
if scanErr := row.Scan(&id); scanErr != nil {
|
|
return 0, fmt.Errorf("InstallPlugin lookup: %w", scanErr)
|
|
}
|
|
}
|
|
return id, nil
|
|
}
|
|
|
|
func (s *SQLiteStore) EnablePlugin(ctx context.Context, id int64) error {
|
|
_, err := s.db.SQLDb().ExecContext(ctx, `UPDATE plugins SET enabled = 1 WHERE id = ?`, id)
|
|
return err
|
|
}
|
|
|
|
func (s *SQLiteStore) DisablePlugin(ctx context.Context, id int64) error {
|
|
_, err := s.db.SQLDb().ExecContext(ctx, `UPDATE plugins SET enabled = 0 WHERE id = ?`, id)
|
|
return err
|
|
}
|
|
|
|
func (s *SQLiteStore) UninstallPlugin(ctx context.Context, id int64) error {
|
|
_, err := s.db.SQLDb().ExecContext(ctx, `DELETE FROM plugins WHERE id = ?`, id)
|
|
return err
|
|
}
|
|
|
|
func (s *SQLiteStore) GetPlugin(ctx context.Context, id int64) (*db.PluginRow, error) {
|
|
row := s.db.SQLDb().QueryRowContext(ctx,
|
|
`SELECT id, name, version, enabled, manifest_json, installed_at FROM plugins WHERE id = ?`,
|
|
id,
|
|
)
|
|
return scanPluginRow(row)
|
|
}
|
|
|
|
func (s *SQLiteStore) GetPluginByName(ctx context.Context, name string) (*db.PluginRow, error) {
|
|
row := s.db.SQLDb().QueryRowContext(ctx,
|
|
`SELECT id, name, version, enabled, manifest_json, installed_at FROM plugins WHERE name = ?`,
|
|
name,
|
|
)
|
|
return scanPluginRow(row)
|
|
}
|
|
|
|
func (s *SQLiteStore) ListPlugins(ctx context.Context) ([]db.PluginRow, error) {
|
|
rows, err := s.db.SQLDb().QueryContext(ctx,
|
|
`SELECT id, name, version, enabled, manifest_json, installed_at FROM plugins ORDER BY name`,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("ListPlugins: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
var out []db.PluginRow
|
|
for rows.Next() {
|
|
var p db.PluginRow
|
|
var enabledInt int64
|
|
var installedAt string
|
|
if err := rows.Scan(&p.ID, &p.Name, &p.Version, &enabledInt, &p.ManifestJSON, &installedAt); err != nil {
|
|
return nil, fmt.Errorf("ListPlugins scan: %w", err)
|
|
}
|
|
p.Enabled = enabledInt != 0
|
|
p.InstalledAt = parseSQLiteTime(installedAt)
|
|
out = append(out, p)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
func (s *SQLiteStore) PluginKVGet(ctx context.Context, pluginID int64, key string) ([]byte, error) {
|
|
row := s.db.SQLDb().QueryRowContext(ctx,
|
|
`SELECT value FROM plugin_kv WHERE plugin_id = ? AND key = ?`,
|
|
pluginID, key,
|
|
)
|
|
var v []byte
|
|
if err := row.Scan(&v); err != nil {
|
|
return nil, err
|
|
}
|
|
return v, nil
|
|
}
|
|
|
|
func (s *SQLiteStore) PluginKVSet(ctx context.Context, pluginID int64, key string, value []byte) error {
|
|
_, err := s.db.SQLDb().ExecContext(ctx,
|
|
`INSERT INTO plugin_kv (plugin_id, key, value) VALUES (?, ?, ?)
|
|
ON CONFLICT(plugin_id, key) DO UPDATE SET value = excluded.value`,
|
|
pluginID, key, value,
|
|
)
|
|
return err
|
|
}
|
|
|
|
func (s *SQLiteStore) PluginKVDelete(ctx context.Context, pluginID int64, key string) error {
|
|
_, err := s.db.SQLDb().ExecContext(ctx,
|
|
`DELETE FROM plugin_kv WHERE plugin_id = ? AND key = ?`,
|
|
pluginID, key,
|
|
)
|
|
return err
|
|
}
|
|
|
|
func (s *SQLiteStore) PluginKVScan(ctx context.Context, pluginID int64, prefix string, limit int) (map[string][]byte, error) {
|
|
rows, err := s.db.SQLDb().QueryContext(ctx,
|
|
`SELECT key, value FROM plugin_kv WHERE plugin_id = ? AND key LIKE ? ORDER BY key LIMIT ?`,
|
|
pluginID, prefix+"%", limit,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("PluginKVScan: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
out := make(map[string][]byte)
|
|
for rows.Next() {
|
|
var k string
|
|
var v []byte
|
|
if err := rows.Scan(&k, &v); err != nil {
|
|
return nil, err
|
|
}
|
|
out[k] = v
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// ── helpers ─────────────────────────────────────────────────────────────────
|
|
|
|
type rowScanner interface {
|
|
Scan(dest ...any) error
|
|
}
|
|
|
|
func scanPluginRow(row rowScanner) (*db.PluginRow, error) {
|
|
var p db.PluginRow
|
|
var enabledInt int64
|
|
var installedAt string
|
|
if err := row.Scan(&p.ID, &p.Name, &p.Version, &enabledInt, &p.ManifestJSON, &installedAt); err != nil {
|
|
return nil, err
|
|
}
|
|
p.Enabled = enabledInt != 0
|
|
p.InstalledAt = parseSQLiteTime(installedAt)
|
|
return &p, nil
|
|
}
|
|
|
|
type rowsScanner interface {
|
|
Next() bool
|
|
Scan(dest ...any) error
|
|
Err() error
|
|
}
|
|
|
|
func scanEventRows(rows rowsScanner) ([]db.PersistedEvent, error) {
|
|
var out []db.PersistedEvent
|
|
for rows.Next() {
|
|
var e db.PersistedEvent
|
|
var createdAt string
|
|
if err := rows.Scan(&e.Seq, &e.EventType, &e.ChannelID, &e.Payload, &createdAt); err != nil {
|
|
return nil, fmt.Errorf("scanEventRows: %w", err)
|
|
}
|
|
e.CreatedAt = parseSQLiteTime(createdAt)
|
|
out = append(out, e)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return nil, err
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func parseSQLiteTime(s string) time.Time {
|
|
// SQLite CURRENT_TIMESTAMP returns "YYYY-MM-DD HH:MM:SS" in UTC.
|
|
for _, layout := range []string{
|
|
"2006-01-02 15:04:05",
|
|
time.RFC3339,
|
|
time.RFC3339Nano,
|
|
} {
|
|
if t, err := time.Parse(layout, s); err == nil {
|
|
return t.UTC()
|
|
}
|
|
}
|
|
return time.Time{}
|
|
}
|