mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
Release 0.15.10 (#1665)
* Update version 0.15.10 * Update project dependencies to resolve Dependabot security alerts Applies the fixes from the open Dependabot PRs (#1648, #1649, #1650) in a single pass on the release branch, regenerating the lockfile from scratch. axios 1.16.0 -> 1.18.1 was the only production exposure (10 advisories). Transitive deps moved to their fixed in-range versions (fast-uri 3.1.4, form-data, qs, tough-cookie, tar, del, globby); dev toolchain took safe bumps (nodemon 3.1.14, eslint 9.39.5, @typescript-eslint 8.65.0). Drops the unused protractor devDependency: no e2e directory, no config and no e2e target in angular.json, but 100 packages and the deprecated request stack behind it. That clears both critical advisories. npm audit: 50 (2 critical) -> 29 (0 critical); production deps 1 -> 0. Remaining findings are dev-only tooling needing an Angular 21 migration rather than a version bump. Verified: lint, 204 frontend specs, backend + frontend production builds, and 19 API checks against the docker regtest fixture covering LND, Core Lightning and Eclair (getinfo, channels, peers, invoices, payments and forwarding history). * Fill in PR number in release note (#1653) * Harden login request validation (#1654) Tightens server-side validation of authentication requests, guards the password-reset route behind an authenticated session, and wires the backend regression suite (test/backend/) into npm run test. Users with two-factor authentication enabled are encouraged to update promptly. Verified: backend specs 12/12, lint green, frontend specs 204/204, and the full authentication matrix end-to-end on the docker regtest fixture. * Reduce exposure of authentication secrets in logs and config responses (#1659) * Reduce exposure of authentication secrets in logs and config responses * Fill in PR number in release note (#1659) * Harden redaction helpers and secret restore paths * Pin deployment auth switches server-side and harden settings persistence * Contain backup file reads and harden config persistence * Pin backup containment root and preserve config file mode on save * Update Angular framework packages to 20.3.27 (#1661) * Update Angular framework packages to 20.3.27 Batches the three Dependabot PRs open against master for the Angular framework (@angular/core #1658, @angular/compiler #1657, @angular/common #1655) into one update on the release branch. The framework packages are pinned to exact versions and their peer ranges require them to move together, so all nine 20.3.26 packages go to 20.3.27: animations, common, compiler, compiler-cli, core, forms, platform-browser, platform-browser-dynamic and router. Patch-level upstream fixes only, no advisories. The update stays inside Angular 20 - @angular/build and @angular/cli (20.3.32) and @angular/cdk/@angular/material (20.2.14) are already at the top of their v20 lines - so it does not pull in the Angular 21 migration tracked by #1650. Rebuilt frontend/ for the new framework code. backend/ is unchanged, as no server/ source moved. * Fill in PR number in release note (#1661) * Bound remaining unbounded alias-resolution fan-outs in LND graph.ts and channels.ts Fixes #1630 (#1651) * Bound remaining unbounded alias-resolution fan-outs in LND graph.ts and channels.ts Fixes #1630 * Address review feedback: fix options race, error handling, release notes * Improve release notes entry to cover full PR scope * Address review feedback: per-task options copy, exclude qs from alias requests * Stop logging the eclair auth header at DEBUG level (#1664) * Stop logging the eclair auth header at DEBUG level getChannels in the eclair channels controller logged its whole request options object. Eclair authenticates with HTTP basic auth, so those options carry the configured lnApiPassword in an authorization header - raising an eclair node's logLevel to DEBUG wrote "authorization":"Basic <base64>" into the node log file, which is a recoverable form of the credential and is routinely shared when debugging. The log now carries only the request url and form, matching every other DEBUG log in the controllers. This was the only site in server/ passing a whole options object to the logger; the rest log options.form, .url, .body or .qs, none of which hold credentials. Present since 0.12.0 and only reachable by opting in to DEBUG (the default log level is ERROR), but it contradicted the logging guarantee stated for #1659. Found by scanning node logs at DEBUG while verifying the 0.15.10 branch against the regtest fixture. Regression test added in test/backend/eclair-channels.test.mjs; it fails on the previous code with "auth header key must not reach the node log". * Fill in PR number in release note (#1664) --------- Co-authored-by: Osuji <weezdomosuji@gmail.com>
This commit is contained in:
Suheb
GitHub
parent
f48a647272
commit
a005b687a7
28 changed files with 1878 additions and 1596 deletions
|
|
@ -53,7 +53,10 @@ export const getChannels = (req, res, next) => {
|
|||
options.form = req.query;
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Channels', msg: 'Channels Node Id', data: options.form });
|
||||
}
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Channels', msg: 'Options', data: options });
|
||||
// Log the call's shape only. Eclair authenticates with HTTP basic auth, so the options
|
||||
// object carries the node's lnApiPassword in its authorization header, and node logs are
|
||||
// routinely shared when debugging.
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Channels', msg: 'Options', data: { url: options.url, form: options.form } });
|
||||
if (common.read_dummy_data) {
|
||||
common.getDummyData('Channels', req.session.selectedNode.lnImplementation).then((data) => { res.status(200).json(data); });
|
||||
}
|
||||
|
|
|
|||
|
|
@ -4,10 +4,10 @@ import { Common } from '../../utils/common.js';
|
|||
let options = null;
|
||||
const logger = Logger;
|
||||
const common = Common;
|
||||
export const getAliasForChannel = (selNode, channel) => {
|
||||
export const getAliasForChannel = (selNode, channel, requestOptions) => {
|
||||
const pubkey = (channel.remote_pubkey) ? channel.remote_pubkey : (channel.remote_node_pub) ? channel.remote_node_pub : '';
|
||||
options.url = selNode.settings.lnServerUrl + '/v1/graph/node/' + pubkey;
|
||||
return request(options).then((aliasBody) => {
|
||||
requestOptions.url = selNode.settings.lnServerUrl + '/v1/graph/node/' + pubkey;
|
||||
return request(requestOptions).then((aliasBody) => {
|
||||
logger.log({ selectedNode: selNode, level: 'DEBUG', fileName: 'Channels', msg: 'Alias Received', data: aliasBody.node.alias });
|
||||
channel.remote_alias = aliasBody.node.alias && aliasBody.node.alias !== '' ? aliasBody.node.alias : aliasBody.node.pub_key.slice(0, 20);
|
||||
return channel;
|
||||
|
|
@ -30,18 +30,26 @@ export const getAllChannels = (req, res, next) => {
|
|||
request(options).then((body) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Channels', msg: 'Channels List Received', data: body });
|
||||
if (body.channels) {
|
||||
return Promise.all(body.channels?.map((channel) => {
|
||||
body.channels.forEach((channel) => {
|
||||
local = (channel.local_balance) ? +channel.local_balance : 0;
|
||||
remote = (channel.remote_balance) ? +channel.remote_balance : 0;
|
||||
total = local + remote;
|
||||
channel.balancedness = (total === 0) ? 1 : (1 - Math.abs((local - remote) / total)).toFixed(3);
|
||||
return getAliasForChannel(req.session.selectedNode, channel);
|
||||
})).then((values) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Sorted Channels List Received', data: body });
|
||||
return res.status(200).json(body);
|
||||
}).catch((errRes) => {
|
||||
const err = common.handleError(errRes, 'Channels', 'Get All Channel Aliases Error', req.session.selectedNode);
|
||||
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
||||
});
|
||||
const selNode = req.session.selectedNode;
|
||||
const { qs: _qs, ...requestOptions } = options;
|
||||
const getChannelAliasesTasks = body.channels.map((channel) => () => getAliasForChannel(selNode, channel, { ...requestOptions }));
|
||||
common.runWithConcurrencyLimit(getChannelAliasesTasks, 20, () => {
|
||||
try {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Sorted Channels List Received', data: body });
|
||||
return res.status(200).json(body);
|
||||
}
|
||||
catch (e) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Channels', msg: 'Get All Channel Aliases Error', error: e.message });
|
||||
if (!res.headersSent) {
|
||||
res.status(500).json({ message: 'Get All Channel Aliases Error', error: e.message });
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
else {
|
||||
|
|
@ -66,26 +74,32 @@ export const getPendingChannels = (req, res, next) => {
|
|||
if (!body.total_limbo_balance) {
|
||||
body.total_limbo_balance = 0;
|
||||
}
|
||||
const promises = [];
|
||||
const selNode = req.session.selectedNode;
|
||||
const { qs: _qs, ...requestOptions } = options;
|
||||
const getPendingAliasesTasks = [];
|
||||
if (body.pending_open_channels && body.pending_open_channels.length > 0) {
|
||||
body.pending_open_channels?.map((channel) => promises.push(getAliasForChannel(req.session.selectedNode, channel.channel)));
|
||||
body.pending_open_channels?.map((channel) => getPendingAliasesTasks.push(() => getAliasForChannel(selNode, channel.channel, { ...requestOptions })));
|
||||
}
|
||||
if (body.pending_force_closing_channels && body.pending_force_closing_channels.length > 0) {
|
||||
body.pending_force_closing_channels?.map((channel) => promises.push(getAliasForChannel(req.session.selectedNode, channel.channel)));
|
||||
body.pending_force_closing_channels?.map((channel) => getPendingAliasesTasks.push(() => getAliasForChannel(selNode, channel.channel, { ...requestOptions })));
|
||||
}
|
||||
if (body.pending_closing_channels && body.pending_closing_channels.length > 0) {
|
||||
body.pending_closing_channels?.map((channel) => promises.push(getAliasForChannel(req.session.selectedNode, channel.channel)));
|
||||
body.pending_closing_channels?.map((channel) => getPendingAliasesTasks.push(() => getAliasForChannel(selNode, channel.channel, { ...requestOptions })));
|
||||
}
|
||||
if (body.waiting_close_channels && body.waiting_close_channels.length > 0) {
|
||||
body.waiting_close_channels?.map((channel) => promises.push(getAliasForChannel(req.session.selectedNode, channel.channel)));
|
||||
body.waiting_close_channels?.map((channel) => getPendingAliasesTasks.push(() => getAliasForChannel(selNode, channel.channel, { ...requestOptions })));
|
||||
}
|
||||
return Promise.all(promises).then((values) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Pending Channels List Received', data: body });
|
||||
return res.status(200).json(body);
|
||||
}).
|
||||
catch((errRes) => {
|
||||
const err = common.handleError(errRes, 'Channels', 'Get Pending Channel Aliases Error', req.session.selectedNode);
|
||||
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
||||
common.runWithConcurrencyLimit(getPendingAliasesTasks, 20, () => {
|
||||
try {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Pending Channels List Received', data: body });
|
||||
return res.status(200).json(body);
|
||||
}
|
||||
catch (e) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Channels', msg: 'Get Pending Channel Aliases Error', error: e.message });
|
||||
if (!res.headersSent) {
|
||||
res.status(500).json({ message: 'Get Pending Channel Aliases Error', error: e.message });
|
||||
}
|
||||
}
|
||||
});
|
||||
}).catch((errRes) => {
|
||||
const err = common.handleError(errRes, 'Channels', 'List Pending Channels Error', req.session.selectedNode);
|
||||
|
|
@ -102,15 +116,23 @@ export const getClosedChannels = (req, res, next) => {
|
|||
options.qs = req.query;
|
||||
request(options).then((body) => {
|
||||
if (body.channels && body.channels.length > 0) {
|
||||
return Promise.all(body.channels?.map((channel) => {
|
||||
body.channels.forEach((channel) => {
|
||||
channel.close_type = (!channel.close_type) ? 'COOPERATIVE_CLOSE' : channel.close_type;
|
||||
return getAliasForChannel(req.session.selectedNode, channel);
|
||||
})).then((values) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Closed Channels List Received', data: body });
|
||||
return res.status(200).json(body);
|
||||
}).catch((errRes) => {
|
||||
const err = common.handleError(errRes, 'Channels', 'Get Closed Channel Aliases Error', req.session.selectedNode);
|
||||
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
||||
});
|
||||
const selNode = req.session.selectedNode;
|
||||
const { qs: _qs, ...requestOptions } = options;
|
||||
const getClosedAliasesTasks = body.channels.map((channel) => () => getAliasForChannel(selNode, channel, { ...requestOptions }));
|
||||
common.runWithConcurrencyLimit(getClosedAliasesTasks, 20, () => {
|
||||
try {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Channels', msg: 'Closed Channels List Received', data: body });
|
||||
return res.status(200).json(body);
|
||||
}
|
||||
catch (e) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Channels', msg: 'Get Closed Channel Aliases Error', error: e.message });
|
||||
if (!res.headersSent) {
|
||||
res.status(500).json({ message: 'Get Closed Channel Aliases Error', error: e.message });
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
else {
|
||||
|
|
|
|||
|
|
@ -4,9 +4,9 @@ import { Common } from '../../utils/common.js';
|
|||
let options = null;
|
||||
const logger = Logger;
|
||||
const common = Common;
|
||||
export const getAliasFromPubkey = (selNode, pubkey) => {
|
||||
options.url = selNode.settings.lnServerUrl + '/v1/graph/node/' + pubkey;
|
||||
return request(options).then((res) => {
|
||||
export const getAliasFromPubkey = (selNode, pubkey, requestOptions) => {
|
||||
requestOptions.url = selNode.settings.lnServerUrl + '/v1/graph/node/' + pubkey;
|
||||
return request(requestOptions).then((res) => {
|
||||
logger.log({ selectedNode: selNode, level: 'DEBUG', fileName: 'Graph', msg: 'Alias Received', data: res.node.alias });
|
||||
return res.node.alias;
|
||||
}).
|
||||
|
|
@ -83,19 +83,25 @@ export const getQueryRoutes = (req, res, next) => {
|
|||
request(options).then((body) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'Graph', msg: 'Query Routes Received', data: body });
|
||||
if (body.routes && body.routes.length && body.routes.length > 0 && body.routes[0].hops && body.routes[0].hops.length && body.routes[0].hops.length > 0) {
|
||||
return Promise.all(body.routes[0].hops?.map((hop) => getAliasFromPubkey(req.session.selectedNode, hop.pub_key))).
|
||||
then((values) => {
|
||||
body.routes[0].hops?.map((hop, i) => {
|
||||
hop.hop_sequence = i + 1;
|
||||
hop.pubkey_alias = values[i];
|
||||
return hop;
|
||||
});
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Graph', msg: 'Graph Routes with Alias Received', data: body });
|
||||
res.status(200).json(body);
|
||||
}).
|
||||
catch((errRes) => {
|
||||
const err = common.handleError(errRes, 'Graph', 'Get Query Routes Error', req.session.selectedNode);
|
||||
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
||||
const selNode = req.session.selectedNode;
|
||||
const { qs: _qs, ...requestOptions } = options;
|
||||
const getRouteAliasesTasks = body.routes[0].hops.map((hop) => () => getAliasFromPubkey(selNode, hop.pub_key, { ...requestOptions }));
|
||||
common.runWithConcurrencyLimit(getRouteAliasesTasks, 20, (values) => {
|
||||
try {
|
||||
body.routes[0].hops?.map((hop, i) => {
|
||||
hop.hop_sequence = i + 1;
|
||||
hop.pubkey_alias = typeof values[i] === 'string' ? values[i] : 'Unknown';
|
||||
return hop;
|
||||
});
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Graph', msg: 'Graph Routes with Alias Received', data: body });
|
||||
res.status(200).json(body);
|
||||
}
|
||||
catch (e) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Graph', msg: 'Get Query Routes Error', error: e.message });
|
||||
if (!res.headersSent) {
|
||||
res.status(500).json({ message: 'Get Query Routes Error', error: e.message });
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
else {
|
||||
|
|
@ -145,14 +151,21 @@ export const getAliasesForPubkeys = (req, res, next) => {
|
|||
}
|
||||
if (req.query.pubkeys) {
|
||||
const pubkeyArr = req.query.pubkeys.split(',');
|
||||
return Promise.all(pubkeyArr?.map((pubkey) => getAliasFromPubkey(req.session.selectedNode, pubkey))).
|
||||
then((values) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Graph', msg: 'Node Alias', data: values });
|
||||
res.status(200).json(values);
|
||||
}).
|
||||
catch((errRes) => {
|
||||
const err = common.handleError(errRes, 'Graph', 'Get Aliases for Pubkeys Error', req.session.selectedNode);
|
||||
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
||||
const selNode = req.session.selectedNode;
|
||||
const { qs: _qs, ...requestOptions } = options;
|
||||
const getAliasesTasks = pubkeyArr.map((pubkey) => () => getAliasFromPubkey(selNode, pubkey, { ...requestOptions }));
|
||||
common.runWithConcurrencyLimit(getAliasesTasks, 20, (values) => {
|
||||
try {
|
||||
const safeValues = values.map((v) => (typeof v === 'string' ? v : 'Unknown'));
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Graph', msg: 'Node Alias', data: safeValues });
|
||||
res.status(200).json(safeValues);
|
||||
}
|
||||
catch (e) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Graph', msg: 'Get Aliases for Pubkeys Error', error: e.message });
|
||||
if (!res.headersSent) {
|
||||
res.status(500).json({ message: 'Get Aliases for Pubkeys Error', error: e.message });
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
else {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
import jwt from 'jsonwebtoken';
|
||||
import * as fs from 'fs';
|
||||
import { sep } from 'path';
|
||||
import { resolve, sep } from 'path';
|
||||
import ini from 'ini';
|
||||
import parseHocon from 'hocon-parser';
|
||||
import request from '../../utils/request.js';
|
||||
|
|
@ -76,7 +76,23 @@ export const getCurrencyRates = (req, res, next) => {
|
|||
};
|
||||
export const getFile = (req, res, next) => {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'RTLConf', msg: 'Getting File..' });
|
||||
const file = req.query.path ? req.query.path : (req.session.selectedNode.settings.channelBackupPath + sep + 'channel-' + req.query.channel?.replace(':', '-') + '.bak');
|
||||
const channelBackupPath = req.session.selectedNode.settings.channelBackupPath;
|
||||
let file = '';
|
||||
if (req.query.path) {
|
||||
// The UI only ever requests channel backup files; contain caller paths to the node's
|
||||
// backup directory so this endpoint cannot read the config, macaroons or the SSO
|
||||
// cookie (getConfig serves the config file masked; this must not bypass that).
|
||||
const resolved = resolve(req.query.path);
|
||||
if (resolved !== resolve(channelBackupPath) && !resolved.startsWith(resolve(channelBackupPath) + sep)) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'WARN', fileName: 'RTLConf', msg: 'Blocked file read outside the channel backup directory', data: req.query.path });
|
||||
const err = common.handleError({ statusCode: 403, message: 'Reading File Error', error: 'File path is outside the channel backup directory' }, 'RTLConf', 'Reading File Error', req.session.selectedNode);
|
||||
return res.status(err.statusCode).json({ message: err.message, error: err.error });
|
||||
}
|
||||
file = resolved;
|
||||
}
|
||||
else {
|
||||
file = channelBackupPath + sep + 'channel-' + req.query.channel?.replace(':', '-') + '.bak';
|
||||
}
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'RTLConf', msg: 'Channel Point', data: req.query.channel });
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'DEBUG', fileName: 'RTLConf', msg: 'File Path', data: file });
|
||||
fs.readFile(file, 'utf8', (errRes, data) => {
|
||||
|
|
@ -89,7 +105,8 @@ export const getFile = (req, res, next) => {
|
|||
return res.status(err.statusCode).json({ message: err.error, error: err.error });
|
||||
}
|
||||
else {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'RTLConf', msg: 'File Data Received', data: data });
|
||||
// File contents can carry node credentials; never write them to the log.
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'RTLConf', msg: 'File Data Received' });
|
||||
res.status(200).json(data);
|
||||
}
|
||||
});
|
||||
|
|
@ -109,7 +126,6 @@ export const getApplicationSettings = (req, res, next) => {
|
|||
delete appConfData.SSO.rtlCookiePath;
|
||||
delete appConfData.SSO.cookieValue;
|
||||
delete appConfData.SSO.logoutRedirectLink;
|
||||
appConfData.secret2FA = '';
|
||||
appConfData.dbDirectoryPath = '';
|
||||
appConfData.nodes[selNodeIdx].authentication = new Authentication();
|
||||
delete appConfData.nodes[selNodeIdx].settings.bitcoindConfigPath;
|
||||
|
|
@ -201,7 +217,12 @@ export const updateNodeSettings = (req, res, next) => {
|
|||
const config = JSON.parse(fs.readFileSync(RTLConfFile, 'utf-8'));
|
||||
const node = config.nodes.find((node) => (node.index === req.session.selectedNode.index));
|
||||
if (node && node.settings) {
|
||||
// channelBackupPath anchors getFile's containment root and is documented as a
|
||||
// config-file-only setting; accepting it from the API would let the caller being
|
||||
// contained choose the containment base. Pin it to the server-held value.
|
||||
const serverChannelBackupPath = node.settings.channelBackupPath;
|
||||
node.settings = { ...node.settings, ...req.body.settings };
|
||||
node.settings.channelBackupPath = serverChannelBackupPath;
|
||||
if (node.authentication && req.body.authentication) {
|
||||
if (req.body.authentication.boltzMacaroonPath) {
|
||||
node.authentication.boltzMacaroonPath = req.body.authentication.boltzMacaroonPath;
|
||||
|
|
@ -220,7 +241,9 @@ export const updateNodeSettings = (req, res, next) => {
|
|||
fs.writeFileSync(RTLConfFile, JSON.stringify(config, null, 2), 'utf-8');
|
||||
const selectedNode = common.findNode(req.session.selectedNode.index);
|
||||
if (selectedNode && selectedNode.settings) {
|
||||
const serverChannelBackupPath = selectedNode.settings.channelBackupPath;
|
||||
selectedNode.settings = { ...selectedNode.settings, ...req.body.settings };
|
||||
selectedNode.settings.channelBackupPath = serverChannelBackupPath;
|
||||
if (selectedNode.authentication && req.body.authentication) {
|
||||
if (req.body.authentication.boltzMacaroonPath) {
|
||||
selectedNode.authentication.boltzMacaroonPath = req.body.authentication.boltzMacaroonPath;
|
||||
|
|
@ -281,7 +304,7 @@ export const updateApplicationSettings = (req, res, next) => {
|
|||
const newOnlyNodes = [...newNodesMap.values()].map((newNode) => JSON.parse(JSON.stringify(newNode)));
|
||||
runtimeConfig.nodes = [...updatedAndExistingNodes, ...newOnlyNodes];
|
||||
}
|
||||
common.appConfig = JSON.parse(JSON.stringify({
|
||||
const newAppConfig = JSON.parse(JSON.stringify({
|
||||
...runtimeConfig,
|
||||
selectedNodeIndex: config.selectedNodeIndex !== undefined ?
|
||||
config.selectedNodeIndex : common.appConfig.selectedNodeIndex,
|
||||
|
|
@ -292,21 +315,42 @@ export const updateApplicationSettings = (req, res, next) => {
|
|||
rtlConfFilePath: common.appConfig.rtlConfFilePath,
|
||||
rtlPass: common.appConfig.rtlPass
|
||||
}));
|
||||
const fileConfig = JSON.parse(JSON.stringify(common.appConfig));
|
||||
const fileConfig = JSON.parse(JSON.stringify(newAppConfig));
|
||||
delete fileConfig.selectedNodeIndex;
|
||||
delete fileConfig.enable2FA;
|
||||
delete fileConfig.allowPasswordUpdate;
|
||||
delete fileConfig.rtlConfFilePath;
|
||||
delete fileConfig.rtlPass;
|
||||
delete fileConfig.multiPass;
|
||||
// Runtime-only SSO bearer; must not be persisted with the config.
|
||||
if (fileConfig.SSO) {
|
||||
delete fileConfig.SSO.cookieValue;
|
||||
}
|
||||
fileConfig.nodes?.forEach((node) => {
|
||||
delete node.authentication?.options;
|
||||
delete node.authentication?.runeValue;
|
||||
});
|
||||
fs.writeFileSync(RTLConfFile, JSON.stringify(fileConfig, null, 2), 'utf-8');
|
||||
const newConfig = JSON.parse(JSON.stringify(common.appConfig));
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'RTLConf', msg: 'Application Settings Updated', data: common.maskPasswords(newConfig) });
|
||||
res.status(201).json(common.removeSecureData(newConfig));
|
||||
// Persist atomically (temp file + rename, so a mid-write failure cannot truncate the
|
||||
// config) and only then adopt the new runtime config, so a failed write leaves the
|
||||
// process on the old one. The temp file inherits the existing file's mode so a
|
||||
// hardened 0600 is not silently downgraded; a fresh file gets 0600. Symlinks and
|
||||
// single-file bind mounts cannot be renamed over — fall back to an in-place write,
|
||||
// which preserves inode and mode.
|
||||
const tempConfigFile = RTLConfFile + '.tmp';
|
||||
try {
|
||||
fs.writeFileSync(tempConfigFile, JSON.stringify(fileConfig, null, 2), 'utf-8');
|
||||
fs.chmodSync(tempConfigFile, fs.existsSync(RTLConfFile) ? (fs.statSync(RTLConfFile).mode & 0o777) : 0o600);
|
||||
fs.renameSync(tempConfigFile, RTLConfFile);
|
||||
}
|
||||
catch {
|
||||
fs.rmSync(tempConfigFile, { force: true, recursive: true });
|
||||
fs.writeFileSync(RTLConfFile, JSON.stringify(fileConfig, null, 2), 'utf-8');
|
||||
}
|
||||
common.appConfig = newAppConfig;
|
||||
// removeSecureData clones, so the runtime config is untouched; it strips rtlPass,
|
||||
// the TOTP seed, the SSO cookie and all per-node credentials symmetrically.
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'RTLConf', msg: 'Application Settings Updated', data: common.removeSecureData(newAppConfig) });
|
||||
res.status(201).json(common.removeSecureData(newAppConfig));
|
||||
}
|
||||
catch (errRes) {
|
||||
const errMsg = 'Update Default Node Error';
|
||||
|
|
|
|||
|
|
@ -19,6 +19,9 @@ const loginInterval = setInterval(() => {
|
|||
}
|
||||
}
|
||||
}, LOCKING_PERIOD);
|
||||
// The sweeper must not hold the event loop open on its own (it would keep
|
||||
// `node --test` or a CLI invocation alive for the full 30-minute period).
|
||||
loginInterval.unref();
|
||||
export const getFailedInfo = (reqIP, currentTime) => {
|
||||
let failed = { count: 0, lastTried: currentTime };
|
||||
if ((!failedLoginAttempts[reqIP]) || (currentTime > (failed.lastTried + LOCKING_PERIOD))) {
|
||||
|
|
@ -45,6 +48,21 @@ const handleMultipleFailedAttemptsError = (failed, currentTime, errMsg) => {
|
|||
}
|
||||
};
|
||||
export const verifyToken = (twoFAToken) => !!(common.appConfig.secret2FA && common.appConfig.secret2FA !== '' && otplib.authenticator.check(twoFAToken, common.appConfig.secret2FA));
|
||||
// Mirrors isAuthenticated: a request carrying a valid session JWT has already
|
||||
// completed 2FA at login, since tokens are only minted after verification when
|
||||
// 2FA is enabled. Used to exempt in-app re-authorization (e.g. the password
|
||||
// prompt before on-chain sends) from the TOTP requirement without opening a
|
||||
// password-only path.
|
||||
const hasValidAuthToken = (req) => {
|
||||
try {
|
||||
const token = req.headers.authorization.split(' ')[1];
|
||||
jwt.verify(token, common.secret_key);
|
||||
return true;
|
||||
}
|
||||
catch (error) {
|
||||
return false;
|
||||
}
|
||||
};
|
||||
export const authenticateUser = (req, res, next) => {
|
||||
const { authenticateWith, authenticationValue, twoFAToken } = req.body;
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'Authenticating User..' });
|
||||
|
|
@ -84,8 +102,15 @@ export const authenticateUser = (req, res, next) => {
|
|||
const failed = getFailedInfo(reqIP, currentTime);
|
||||
const password = authenticationValue;
|
||||
if (common.appConfig.rtlPass === password && failed.count < ALLOWED_LOGIN_ATTEMPTS) {
|
||||
if (twoFAToken && twoFAToken !== '') {
|
||||
if (!verifyToken(twoFAToken)) {
|
||||
// Gate on the server-side 2FA configuration, not on the request: when 2FA is
|
||||
// enabled a token is mandatory, so a request omitting twoFAToken is rejected
|
||||
// instead of silently skipping verification. The login UI keys its token prompt
|
||||
// on enable2FA, so both fields are consulted — a stale secret with 2FA disabled
|
||||
// must not lock the operator out of a UI that never prompts for a token.
|
||||
// Requests with a valid session token (in-app re-authorization, e.g. the
|
||||
// password prompt before on-chain sends) are exempt from the TOTP requirement.
|
||||
if (common.appConfig.enable2FA && common.appConfig.secret2FA && common.appConfig.secret2FA !== '' && !hasValidAuthToken(req)) {
|
||||
if (typeof twoFAToken !== 'string' || twoFAToken === '' || !verifyToken(twoFAToken)) {
|
||||
logger.log({ selectedNode: req.session.selectedNode, level: 'ERROR', fileName: 'Authenticate', msg: 'Invalid Token! Failed IP ' + reqIP, error: { error: 'Invalid token.' } });
|
||||
failed.count = failed.count + 1;
|
||||
failed.lastTried = currentTime;
|
||||
|
|
|
|||
|
|
@ -1,9 +1,12 @@
|
|||
import exprs from 'express';
|
||||
const { Router } = exprs;
|
||||
import { authenticateUser, verifyToken, resetPassword, logoutUser } from '../../controllers/shared/authenticate.js';
|
||||
import { isAuthenticated } from '../../utils/authCheck.js';
|
||||
const router = Router();
|
||||
router.post('/', authenticateUser);
|
||||
router.post('/token', verifyToken);
|
||||
router.post('/reset', resetPassword);
|
||||
// Password changes mint a fresh session token, so the route requires an existing
|
||||
// authenticated session; the frontend interceptor attaches it for the settings UI.
|
||||
router.post('/reset', isAuthenticated, resetPassword);
|
||||
router.get('/logout', logoutUser);
|
||||
export default router;
|
||||
|
|
|
|||
|
|
@ -22,22 +22,37 @@ export class CommonService {
|
|||
{ name: 'JUL', days: 31 }, { name: 'AUG', days: 31 }, { name: 'SEP', days: 30 }, { name: 'OCT', days: 31 }, { name: 'NOV', days: 30 }, { name: 'DEC', days: 31 }
|
||||
];
|
||||
this.maskPasswords = (obj) => {
|
||||
const keys = Object.keys(obj);
|
||||
const length = keys.length;
|
||||
if (length !== 0) {
|
||||
for (let i = 0; i < length; i++) {
|
||||
if (typeof obj[keys[i]] === 'object') {
|
||||
keys[keys[i]] = this.maskPasswords(obj[keys[i]]);
|
||||
}
|
||||
if (typeof keys[i] === 'string' &&
|
||||
((keys[i].toLowerCase().includes('password') && keys[i] !== 'allowPasswordUpdate') || keys[i].toLowerCase().includes('multipass') ||
|
||||
keys[i].toLowerCase().includes('rpcpass') || keys[i].toLowerCase().includes('rpcpassword') ||
|
||||
keys[i].toLowerCase().includes('rpcuser'))) {
|
||||
obj[keys[i]] = '*'.repeat(20);
|
||||
// Clone up front: masking a live config object must not blank the credentials LN
|
||||
// requests authenticate with (mirrors removeSecureData).
|
||||
const masked = JSON.parse(JSON.stringify(obj));
|
||||
const maskRecursive = (current) => {
|
||||
const keys = Object.keys(current);
|
||||
const length = keys.length;
|
||||
if (length !== 0) {
|
||||
for (let i = 0; i < length; i++) {
|
||||
// Header maps always carry credentials in this codebase (macaroon, rune, basic
|
||||
// auth). Key-substring matching cannot catch them without also hiding the *Path
|
||||
// fields the settings UI legitimately shows, so mask the whole map.
|
||||
if (keys[i] === 'headers' && current[keys[i]] && typeof current[keys[i]] === 'object') {
|
||||
Object.keys(current[keys[i]]).forEach((headerKey) => { current[keys[i]][headerKey] = '*'.repeat(20); });
|
||||
}
|
||||
else if (current[keys[i]] && typeof current[keys[i]] === 'object') {
|
||||
// Truthiness guard: null is 'object' too and must not reach Object.keys.
|
||||
maskRecursive(current[keys[i]]);
|
||||
}
|
||||
if (typeof keys[i] === 'string' &&
|
||||
((keys[i].toLowerCase().includes('password') && keys[i] !== 'allowPasswordUpdate') || keys[i].toLowerCase().includes('multipass') ||
|
||||
keys[i].toLowerCase().includes('rpcpass') || keys[i].toLowerCase().includes('rpcpassword') ||
|
||||
keys[i].toLowerCase().includes('rpcuser') || keys[i].toLowerCase().includes('rpcauth') ||
|
||||
keys[i].toLowerCase().includes('secret2fa') || keys[i].toLowerCase().includes('cookievalue') ||
|
||||
keys[i].toLowerCase().includes('rtlpass') || keys[i].toLowerCase().includes('runevalue'))) {
|
||||
current[keys[i]] = '*'.repeat(20);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return obj;
|
||||
return current;
|
||||
};
|
||||
return maskRecursive(masked);
|
||||
};
|
||||
this.removeAuthSecureData = (node) => {
|
||||
if (node.authentication) {
|
||||
|
|
@ -50,25 +65,55 @@ export class CommonService {
|
|||
return node;
|
||||
};
|
||||
this.removeSecureData = (config) => {
|
||||
delete config.rtlConfFilePath;
|
||||
delete config.rtlPass;
|
||||
delete config.multiPass;
|
||||
delete config.multiPassHashed;
|
||||
delete config.secret2FA;
|
||||
config.nodes?.forEach((node) => this.removeAuthSecureData(node));
|
||||
return config;
|
||||
// Clone before deleting: cookieValue is runtime-only, so mutating a caller's live
|
||||
// appConfig would destroy SSO state with no way to restore it.
|
||||
const sanitized = JSON.parse(JSON.stringify(config));
|
||||
delete sanitized.rtlConfFilePath;
|
||||
delete sanitized.rtlPass;
|
||||
delete sanitized.multiPass;
|
||||
delete sanitized.multiPassHashed;
|
||||
delete sanitized.secret2FA;
|
||||
// The SSO cookie is a live bearer credential; it must never leave the server.
|
||||
if (sanitized.SSO) {
|
||||
delete sanitized.SSO.cookieValue;
|
||||
}
|
||||
sanitized.nodes?.forEach((node) => this.removeAuthSecureData(node));
|
||||
return sanitized;
|
||||
};
|
||||
this.addSecureData = (config) => {
|
||||
config.rtlConfFilePath = this.appConfig.rtlConfFilePath;
|
||||
config.rtlPass = this.appConfig.rtlPass;
|
||||
config.multiPassHashed = this.appConfig.multiPassHashed;
|
||||
config.SSO.rtlCookiePath = this.appConfig.SSO.rtlCookiePath;
|
||||
// Pin the hash only when the server holds one: on a default install's first boot the
|
||||
// file already has multiPassHashed but the in-memory config does not, and pinning
|
||||
// undefined would erase the only password from the file on save, bricking the boot.
|
||||
if (this.appConfig.multiPassHashed) {
|
||||
config.multiPassHashed = this.appConfig.multiPassHashed;
|
||||
}
|
||||
else {
|
||||
delete config.multiPassHashed;
|
||||
}
|
||||
// Deployment-level switches are pinned to server-held values: the settings API must
|
||||
// not flip the authentication mode (disableAuth, SSO) or move SSO fields, the
|
||||
// password policy, or the database location; no UI flow writes them. Pinning the
|
||||
// whole SSO object also means a trimmed or missing SSO object can never wipe server
|
||||
// state.
|
||||
config.disableAuth = this.appConfig.disableAuth;
|
||||
config.allowPasswordUpdate = this.appConfig.allowPasswordUpdate;
|
||||
config.dbDirectoryPath = this.appConfig.dbDirectoryPath;
|
||||
config.SSO = JSON.parse(JSON.stringify(this.appConfig.SSO || {}));
|
||||
if (this.appConfig.multiPass) {
|
||||
config.multiPass = this.appConfig.multiPass;
|
||||
}
|
||||
if (config.secret2FA === this.appConfig.secret2FA) {
|
||||
// Restore the TOTP seed when the client omits it — and when it sends an empty seed
|
||||
// while still claiming 2FA is on (an inconsistent pair no honest flow produces).
|
||||
// The settings UI's enable flow sends a non-empty seed; its disable flow sends an
|
||||
// empty seed with enable2FA false. Both are honored.
|
||||
if (config.secret2FA === undefined || (config.secret2FA === '' && config.enable2FA)) {
|
||||
config.secret2FA = this.appConfig.secret2FA;
|
||||
}
|
||||
// enable2FA derives from the seed, matching the boot-time derivation in config.ts,
|
||||
// so the two fields can never diverge after a save.
|
||||
config.enable2FA = !!config.secret2FA;
|
||||
const appConfigNodes = new Map(this.appConfig.nodes?.map((node) => [node.index, node]) || []);
|
||||
config.nodes?.forEach((node) => {
|
||||
const appConfigNode = appConfigNodes.get(node.index);
|
||||
|
|
@ -103,7 +148,7 @@ export class CommonService {
|
|||
this.logger.log({ selectedNode: this.selectedNode, level: 'ERROR', fileName: 'Common', msg: 'Loop macaroon Error', error: err });
|
||||
}
|
||||
}
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Swap Options', data: swapOptions });
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Swap Options Set' });
|
||||
return swapOptions;
|
||||
};
|
||||
this.getBoltzServerOptions = (req) => {
|
||||
|
|
@ -121,7 +166,7 @@ export class CommonService {
|
|||
this.logger.log({ selectedNode: this.selectedNode, level: 'ERROR', fileName: 'Common', msg: 'Boltz macaroon Error', error: err });
|
||||
}
|
||||
}
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Boltz Options', data: boltzOptions });
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Boltz Options Set' });
|
||||
return boltzOptions;
|
||||
};
|
||||
this.getOptions = (req) => {
|
||||
|
|
@ -167,7 +212,7 @@ export class CommonService {
|
|||
}
|
||||
}
|
||||
if (req.session.selectedNode) {
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Updated Node Options for ' + req.session.selectedNode.lnNode, data: req.session.selectedNode.authentication.options });
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Updated Node Options for ' + req.session.selectedNode.lnNode });
|
||||
}
|
||||
return { status: 200, message: 'Updated Successfully' };
|
||||
}
|
||||
|
|
@ -237,7 +282,7 @@ export class CommonService {
|
|||
form: ''
|
||||
};
|
||||
}
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Set Node Options for ' + node.lnNode, data: node.authentication.options });
|
||||
this.logger.log({ selectedNode: this.selectedNode, level: 'INFO', fileName: 'Common', msg: 'Set Node Options for ' + node.lnNode });
|
||||
});
|
||||
this.updateSelectedNodeOptions(req);
|
||||
}
|
||||
|
|
@ -345,10 +390,11 @@ export class CommonService {
|
|||
this.logger.log({ selectedNode: selectedNode, level: 'ERROR', fileName: fileName, msg: errMsg, error: (typeof err === 'object' ? JSON.stringify(err) : err) });
|
||||
let newErrorObj = { statusCode: 500, message: '', error: '' };
|
||||
if (err.code && err.code === 'ENOENT') {
|
||||
// The absolute path stays in the server log above but is not echoed to clients.
|
||||
newErrorObj = {
|
||||
statusCode: 500,
|
||||
message: 'No such file or directory ' + (err.path ? err.path : ''),
|
||||
error: 'No such file or directory ' + (err.path ? err.path : '')
|
||||
message: 'No such file or directory',
|
||||
error: 'No such file or directory'
|
||||
};
|
||||
}
|
||||
else {
|
||||
|
|
|
|||
|
|
@ -302,7 +302,9 @@ export class ConfigService {
|
|||
this.logger.log({ selectedNode: this.common.selectedNode, level: 'ERROR', fileName: 'Config', msg: 'Something went wrong while creating the backup directory: \n' + err });
|
||||
}
|
||||
this.common.nodes[idx].settings.logFile = config.rtlConfFilePath + '/logs/RTL-Node-' + node.index + '.log';
|
||||
this.logger.log({ selectedNode: this.common.selectedNode, level: 'INFO', fileName: 'Config', msg: 'Node Config: ' + JSON.stringify(this.common.nodes[idx]) });
|
||||
// maskPasswords keeps paths visible for debugging while redacting credential
|
||||
// fields such as lnApiPassword before they reach the log file.
|
||||
this.logger.log({ selectedNode: this.common.selectedNode, level: 'INFO', fileName: 'Config', msg: 'Node Config: ' + JSON.stringify(this.common.maskPasswords(this.common.nodes[idx])) });
|
||||
const log_file = this.common.nodes[idx].settings.logFile;
|
||||
if (fs.existsSync(log_file || '')) {
|
||||
fs.writeFile((log_file || ''), '', () => { });
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue