1078 lines
33 KiB
TypeScript
1078 lines
33 KiB
TypeScript
import { Environment, User, DeviceKey, VerificationToken } from './types';
|
|
|
|
// Generate a cryptographically secure random token
|
|
function generateToken(): string {
|
|
const array = new Uint8Array(32);
|
|
crypto.getRandomValues(array);
|
|
return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
|
|
}
|
|
|
|
// Generate a UUID v4
|
|
function generateUUID(): string {
|
|
return crypto.randomUUID();
|
|
}
|
|
|
|
// Send email via Resend
|
|
async function sendEmail(
|
|
env: Environment,
|
|
to: string,
|
|
subject: string,
|
|
htmlContent: string
|
|
): Promise<boolean> {
|
|
try {
|
|
if (!env.RESEND_API_KEY) {
|
|
console.error('RESEND_API_KEY not configured');
|
|
return false;
|
|
}
|
|
|
|
const response = await fetch('https://api.resend.com/emails', {
|
|
method: 'POST',
|
|
headers: {
|
|
'Authorization': `Bearer ${env.RESEND_API_KEY}`,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: JSON.stringify({
|
|
from: env.CRYPTID_EMAIL_FROM || 'CryptID <noreply@jeffemmett.com>',
|
|
to: [to],
|
|
subject,
|
|
html: htmlContent,
|
|
}),
|
|
});
|
|
|
|
if (!response.ok) {
|
|
const errorText = await response.text();
|
|
console.error('Resend error:', errorText);
|
|
return false;
|
|
}
|
|
|
|
const result = await response.json() as { id?: string };
|
|
console.log('Email sent successfully, id:', result.id);
|
|
return true;
|
|
} catch (error) {
|
|
console.error('Email send error:', error);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
// Clean up expired tokens
|
|
async function cleanupExpiredTokens(db: D1Database): Promise<void> {
|
|
try {
|
|
await db.prepare(
|
|
"DELETE FROM verification_tokens WHERE expires_at < datetime('now') OR used = 1"
|
|
).run();
|
|
} catch (error) {
|
|
console.error('Token cleanup error:', error);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Link an email to an existing CryptID account (Device A)
|
|
* POST /auth/link-email
|
|
* Body: { email, cryptidUsername, publicKey, signature, challenge }
|
|
*/
|
|
export async function handleLinkEmail(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const body = await request.json() as {
|
|
email: string;
|
|
cryptidUsername: string;
|
|
publicKey: string;
|
|
deviceName?: string;
|
|
};
|
|
|
|
const { email, cryptidUsername, publicKey, deviceName } = body;
|
|
|
|
if (!email || !cryptidUsername || !publicKey) {
|
|
return new Response(JSON.stringify({ error: 'Missing required fields' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Validate email format
|
|
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
|
if (!emailRegex.test(email)) {
|
|
return new Response(JSON.stringify({ error: 'Invalid email format' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Check if email is already linked to a different account
|
|
const existingUser = await db.prepare(
|
|
'SELECT * FROM users WHERE email = ?'
|
|
).bind(email).first<User>();
|
|
|
|
if (existingUser && existingUser.cryptid_username !== cryptidUsername) {
|
|
return new Response(JSON.stringify({
|
|
error: 'Email already linked to a different CryptID account'
|
|
}), {
|
|
status: 409,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Check if this public key is already registered
|
|
const existingKey = await db.prepare(
|
|
'SELECT * FROM device_keys WHERE public_key = ?'
|
|
).bind(publicKey).first<DeviceKey>();
|
|
|
|
if (existingKey) {
|
|
// Key already registered, just need to verify email if not done
|
|
if (existingUser && existingUser.email_verified) {
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Email already verified',
|
|
emailVerified: true
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
const userId = existingUser?.id || generateUUID();
|
|
const userAgent = request.headers.get('User-Agent') || null;
|
|
|
|
// Create or update user
|
|
if (!existingUser) {
|
|
await db.prepare(
|
|
'INSERT INTO users (id, email, cryptid_username, email_verified) VALUES (?, ?, ?, 0)'
|
|
).bind(userId, email, cryptidUsername).run();
|
|
}
|
|
|
|
// Add device key if not exists
|
|
if (!existingKey) {
|
|
await db.prepare(
|
|
'INSERT INTO device_keys (id, user_id, public_key, device_name, user_agent) VALUES (?, ?, ?, ?, ?)'
|
|
).bind(generateUUID(), userId, publicKey, deviceName || 'Primary Device', userAgent).run();
|
|
}
|
|
|
|
// If email not verified, send verification email
|
|
if (!existingUser?.email_verified) {
|
|
// Clean up old tokens
|
|
await cleanupExpiredTokens(db);
|
|
|
|
// Create verification token (24 hour expiry)
|
|
const token = generateToken();
|
|
const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
|
|
|
|
await db.prepare(
|
|
'INSERT INTO verification_tokens (id, email, token, token_type, expires_at) VALUES (?, ?, ?, ?, ?)'
|
|
).bind(generateUUID(), email, token, 'email_verify', expiresAt).run();
|
|
|
|
// Send verification email
|
|
const verifyUrl = `${env.APP_URL || 'https://jeffemmett.com'}/verify-email?token=${token}`;
|
|
const emailSent = await sendEmail(
|
|
env,
|
|
email,
|
|
'Verify your CryptID email',
|
|
`
|
|
<h2>Verify your CryptID email</h2>
|
|
<p>Click the link below to verify your email address for CryptID: <strong>${cryptidUsername}</strong></p>
|
|
<p><a href="${verifyUrl}" style="display: inline-block; padding: 12px 24px; background: #4f46e5; color: white; text-decoration: none; border-radius: 6px;">Verify Email</a></p>
|
|
<p>Or copy this link: ${verifyUrl}</p>
|
|
<p>This link expires in 24 hours.</p>
|
|
<p style="color: #666; font-size: 12px;">If you didn't request this, you can safely ignore this email.</p>
|
|
`
|
|
);
|
|
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: emailSent ? 'Verification email sent' : 'Account created but email failed to send',
|
|
emailVerified: false,
|
|
emailSent
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Email already verified',
|
|
emailVerified: true
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Link email error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Verify email via token (clicked from email)
|
|
* GET /auth/verify-email/:token
|
|
*/
|
|
export async function handleVerifyEmail(
|
|
token: string,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Find token
|
|
const tokenRecord = await db.prepare(
|
|
"SELECT * FROM verification_tokens WHERE token = ? AND token_type = 'email_verify' AND used = 0 AND expires_at > datetime('now')"
|
|
).bind(token).first<VerificationToken>();
|
|
|
|
if (!tokenRecord) {
|
|
return new Response(JSON.stringify({ error: 'Invalid or expired token' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Mark email as verified
|
|
await db.prepare(
|
|
"UPDATE users SET email_verified = 1, updated_at = datetime('now') WHERE email = ?"
|
|
).bind(tokenRecord.email).run();
|
|
|
|
// Mark token as used
|
|
await db.prepare(
|
|
'UPDATE verification_tokens SET used = 1 WHERE id = ?'
|
|
).bind(tokenRecord.id).run();
|
|
|
|
// Return success - frontend will redirect
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Email verified successfully',
|
|
email: tokenRecord.email
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Verify email error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Request to link a new device (Device B enters email)
|
|
* POST /auth/request-device-link
|
|
* Body: { email, publicKey, deviceName }
|
|
*/
|
|
export async function handleRequestDeviceLink(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const body = await request.json() as {
|
|
email: string;
|
|
publicKey: string;
|
|
deviceName?: string;
|
|
};
|
|
|
|
const { email, publicKey, deviceName } = body;
|
|
|
|
if (!email || !publicKey) {
|
|
return new Response(JSON.stringify({ error: 'Missing required fields' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Check if email exists and is verified
|
|
const user = await db.prepare(
|
|
'SELECT * FROM users WHERE email = ? AND email_verified = 1'
|
|
).bind(email).first<User>();
|
|
|
|
if (!user) {
|
|
return new Response(JSON.stringify({
|
|
error: 'No verified CryptID account found for this email'
|
|
}), {
|
|
status: 404,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Check if this public key is already registered
|
|
const existingKey = await db.prepare(
|
|
'SELECT * FROM device_keys WHERE public_key = ?'
|
|
).bind(publicKey).first<DeviceKey>();
|
|
|
|
if (existingKey) {
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Device already linked',
|
|
cryptidUsername: user.cryptid_username,
|
|
alreadyLinked: true
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const userAgent = request.headers.get('User-Agent') || null;
|
|
|
|
// Clean up old tokens
|
|
await cleanupExpiredTokens(db);
|
|
|
|
// Create device link token (1 hour expiry for security)
|
|
const token = generateToken();
|
|
const expiresAt = new Date(Date.now() + 60 * 60 * 1000).toISOString();
|
|
|
|
await db.prepare(
|
|
'INSERT INTO verification_tokens (id, email, token, token_type, public_key, device_name, user_agent, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)'
|
|
).bind(generateUUID(), email, token, 'device_link', publicKey, deviceName || 'New Device', userAgent, expiresAt).run();
|
|
|
|
// Send device link email
|
|
const linkUrl = `${env.APP_URL || 'https://jeffemmett.com'}/link-device?token=${token}`;
|
|
const emailSent = await sendEmail(
|
|
env,
|
|
email,
|
|
'Link new device to your CryptID',
|
|
`
|
|
<h2>New Device Link Request</h2>
|
|
<p>Someone is trying to link a new device to your CryptID: <strong>${user.cryptid_username}</strong></p>
|
|
<p><strong>Device:</strong> ${deviceName || 'New Device'}</p>
|
|
<p>If this was you, click the button below to approve:</p>
|
|
<p><a href="${linkUrl}" style="display: inline-block; padding: 12px 24px; background: #4f46e5; color: white; text-decoration: none; border-radius: 6px;">Approve Device</a></p>
|
|
<p>Or copy this link: ${linkUrl}</p>
|
|
<p>This link expires in 1 hour.</p>
|
|
<p style="color: #c00; font-size: 12px;"><strong>If you didn't request this, do not click the link.</strong> Someone may be trying to access your account.</p>
|
|
`
|
|
);
|
|
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: emailSent ? 'Verification email sent to your address' : 'Failed to send email',
|
|
emailSent,
|
|
cryptidUsername: user.cryptid_username
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Request device link error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Complete device link (clicked from email on Device B)
|
|
* GET /auth/link-device/:token
|
|
*/
|
|
export async function handleLinkDevice(
|
|
token: string,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Find token
|
|
const tokenRecord = await db.prepare(
|
|
"SELECT * FROM verification_tokens WHERE token = ? AND token_type = 'device_link' AND used = 0 AND expires_at > datetime('now')"
|
|
).bind(token).first<VerificationToken>();
|
|
|
|
if (!tokenRecord) {
|
|
return new Response(JSON.stringify({ error: 'Invalid or expired token' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Get user
|
|
const user = await db.prepare(
|
|
'SELECT * FROM users WHERE email = ?'
|
|
).bind(tokenRecord.email).first<User>();
|
|
|
|
if (!user) {
|
|
return new Response(JSON.stringify({ error: 'User not found' }), {
|
|
status: 404,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Add the new device key
|
|
await db.prepare(
|
|
'INSERT INTO device_keys (id, user_id, public_key, device_name, user_agent) VALUES (?, ?, ?, ?, ?)'
|
|
).bind(
|
|
generateUUID(),
|
|
user.id,
|
|
tokenRecord.public_key,
|
|
tokenRecord.device_name,
|
|
tokenRecord.user_agent
|
|
).run();
|
|
|
|
// Mark token as used
|
|
await db.prepare(
|
|
'UPDATE verification_tokens SET used = 1 WHERE id = ?'
|
|
).bind(tokenRecord.id).run();
|
|
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Device linked successfully',
|
|
cryptidUsername: user.cryptid_username,
|
|
email: user.email
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Link device error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Send a backup email to set up account on another device
|
|
* POST /api/auth/send-backup-email
|
|
* Body: { email, username }
|
|
*
|
|
* This is called during registration when the user provides an email.
|
|
* It sends an email with a link to set up their account on another device.
|
|
*/
|
|
export async function handleSendBackupEmail(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const body = await request.json() as {
|
|
email: string;
|
|
username: string;
|
|
};
|
|
|
|
const { email, username } = body;
|
|
|
|
if (!email || !username) {
|
|
return new Response(JSON.stringify({ error: 'Missing required fields' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Validate email format
|
|
const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
|
if (!emailRegex.test(email)) {
|
|
return new Response(JSON.stringify({ error: 'Invalid email format' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
// If no DB, still try to send email (graceful degradation)
|
|
console.log('No database configured, attempting to send email directly');
|
|
}
|
|
|
|
// If DB exists, create/update user record
|
|
if (db) {
|
|
// Check if user already exists
|
|
const existingUser = await db.prepare(
|
|
'SELECT * FROM users WHERE cryptid_username = ?'
|
|
).bind(username).first<User>();
|
|
|
|
if (existingUser) {
|
|
// Update email if user exists
|
|
await db.prepare(
|
|
"UPDATE users SET email = ?, updated_at = datetime('now') WHERE cryptid_username = ?"
|
|
).bind(email, username).run();
|
|
} else {
|
|
// Create new user record
|
|
const userId = crypto.randomUUID();
|
|
await db.prepare(
|
|
'INSERT INTO users (id, email, cryptid_username, email_verified) VALUES (?, ?, ?, 0)'
|
|
).bind(userId, email, username).run();
|
|
}
|
|
}
|
|
|
|
// Send the backup email
|
|
const appUrl = env.APP_URL || 'https://jeffemmett.com';
|
|
const setupUrl = `${appUrl}/setup-device?username=${encodeURIComponent(username)}`;
|
|
|
|
const emailSent = await sendEmail(
|
|
env,
|
|
email,
|
|
`Set up CryptID "${username}" on another device`,
|
|
`
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<style>
|
|
body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; max-width: 600px; margin: 0 auto; padding: 20px; }
|
|
.header { text-align: center; margin-bottom: 30px; }
|
|
.icon { font-size: 48px; margin-bottom: 10px; }
|
|
h1 { color: #8b5cf6; margin: 0 0 10px 0; }
|
|
.card { background: #f9fafb; border-radius: 12px; padding: 24px; margin: 20px 0; }
|
|
.step { display: flex; align-items: flex-start; gap: 12px; margin-bottom: 16px; }
|
|
.step-number { background: #8b5cf6; color: white; width: 24px; height: 24px; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; font-size: 14px; font-weight: 600; flex-shrink: 0; }
|
|
.button { display: inline-block; padding: 14px 28px; background: linear-gradient(135deg, #8b5cf6 0%, #6366f1 100%); color: white; text-decoration: none; border-radius: 10px; font-weight: 600; margin: 20px 0; }
|
|
.footer { color: #666; font-size: 12px; text-align: center; margin-top: 30px; padding-top: 20px; border-top: 1px solid #eee; }
|
|
.warning { background: #fef3c7; border-radius: 8px; padding: 12px 16px; margin: 20px 0; color: #92400e; font-size: 13px; }
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="header">
|
|
<div class="icon">🔐</div>
|
|
<h1>Welcome to CryptID</h1>
|
|
<p>Your passwordless account is ready!</p>
|
|
</div>
|
|
|
|
<p>Hi <strong>${username}</strong>,</p>
|
|
|
|
<p>Your CryptID account has been created on your current device. To access your account from another device (like your phone), follow these steps:</p>
|
|
|
|
<div class="card">
|
|
<div class="step">
|
|
<span class="step-number">1</span>
|
|
<div>
|
|
<strong>Open the link below on your other device</strong>
|
|
<p style="margin: 4px 0 0 0; color: #666; font-size: 14px;">Use your phone, tablet, or another computer</p>
|
|
</div>
|
|
</div>
|
|
<div class="step">
|
|
<span class="step-number">2</span>
|
|
<div>
|
|
<strong>A new cryptographic key will be generated</strong>
|
|
<p style="margin: 4px 0 0 0; color: #666; font-size: 14px;">This key is unique to that device and stored securely in the browser</p>
|
|
</div>
|
|
</div>
|
|
<div class="step">
|
|
<span class="step-number">3</span>
|
|
<div>
|
|
<strong>You're set! Both devices can now access your account</strong>
|
|
<p style="margin: 4px 0 0 0; color: #666; font-size: 14px;">No passwords to remember - your browser handles authentication</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div style="text-align: center;">
|
|
<a href="${setupUrl}" class="button">Set Up on Another Device</a>
|
|
</div>
|
|
|
|
<div class="warning">
|
|
<strong>⚠️ Security Note:</strong> Only open this link on devices you own. Each device that accesses your account stores a unique cryptographic key.
|
|
</div>
|
|
|
|
<div class="footer">
|
|
<p>This email was sent because you created a CryptID account and opted for multi-device backup.</p>
|
|
<p>If you didn't request this, you can safely ignore this email.</p>
|
|
<p style="margin-top: 16px;">CryptID by <a href="${appUrl}" style="color: #8b5cf6;">jeffemmett.com</a></p>
|
|
</div>
|
|
</body>
|
|
</html>
|
|
`
|
|
);
|
|
|
|
if (emailSent) {
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Backup email sent successfully',
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
} else {
|
|
return new Response(JSON.stringify({
|
|
error: 'Failed to send email',
|
|
message: 'Please check your email address and try again',
|
|
}), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
} catch (error) {
|
|
console.error('Send backup email error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if a public key is linked to an account
|
|
* POST /auth/lookup
|
|
* Body: { publicKey }
|
|
*/
|
|
export async function handleLookup(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const body = await request.json() as { publicKey: string };
|
|
const { publicKey } = body;
|
|
|
|
if (!publicKey) {
|
|
return new Response(JSON.stringify({ error: 'Missing publicKey' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Find device key and associated user
|
|
const result = await db.prepare(`
|
|
SELECT u.cryptid_username, u.email, u.email_verified, dk.device_name
|
|
FROM device_keys dk
|
|
JOIN users u ON dk.user_id = u.id
|
|
WHERE dk.public_key = ?
|
|
`).bind(publicKey).first<{
|
|
cryptid_username: string;
|
|
email: string;
|
|
email_verified: number;
|
|
device_name: string;
|
|
}>();
|
|
|
|
if (!result) {
|
|
return new Response(JSON.stringify({
|
|
found: false
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Update last_used timestamp
|
|
await db.prepare(
|
|
"UPDATE device_keys SET last_used = datetime('now') WHERE public_key = ?"
|
|
).bind(publicKey).run();
|
|
|
|
return new Response(JSON.stringify({
|
|
found: true,
|
|
cryptidUsername: result.cryptid_username,
|
|
email: result.email,
|
|
emailVerified: result.email_verified === 1,
|
|
deviceName: result.device_name
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Lookup error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get linked devices for an account
|
|
* POST /auth/devices
|
|
* Body: { publicKey } - authenticates via device's public key
|
|
*/
|
|
export async function handleGetDevices(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const body = await request.json() as { publicKey: string };
|
|
const { publicKey } = body;
|
|
|
|
if (!publicKey) {
|
|
return new Response(JSON.stringify({ error: 'Missing publicKey' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Find user by public key
|
|
const deviceKey = await db.prepare(`
|
|
SELECT user_id FROM device_keys WHERE public_key = ?
|
|
`).bind(publicKey).first<{ user_id: string }>();
|
|
|
|
if (!deviceKey) {
|
|
return new Response(JSON.stringify({ error: 'Device not found' }), {
|
|
status: 404,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Get all devices for this user
|
|
const devices = await db.prepare(`
|
|
SELECT id, device_name, user_agent, created_at, last_used, public_key
|
|
FROM device_keys
|
|
WHERE user_id = ?
|
|
ORDER BY created_at DESC
|
|
`).bind(deviceKey.user_id).all<DeviceKey>();
|
|
|
|
return new Response(JSON.stringify({
|
|
devices: devices.results?.map((d: DeviceKey) => ({
|
|
id: d.id,
|
|
deviceName: d.device_name,
|
|
userAgent: d.user_agent,
|
|
createdAt: d.created_at,
|
|
lastUsed: d.last_used,
|
|
isCurrentDevice: d.public_key === publicKey
|
|
})) || []
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Get devices error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Revoke a device
|
|
* DELETE /auth/devices/:deviceId
|
|
* Body: { publicKey } - authenticates via device's public key
|
|
*/
|
|
export async function handleRevokeDevice(
|
|
deviceId: string,
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const body = await request.json() as { publicKey: string };
|
|
const { publicKey } = body;
|
|
|
|
if (!publicKey) {
|
|
return new Response(JSON.stringify({ error: 'Missing publicKey' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Find user by public key
|
|
const currentDevice = await db.prepare(`
|
|
SELECT user_id FROM device_keys WHERE public_key = ?
|
|
`).bind(publicKey).first<{ user_id: string }>();
|
|
|
|
if (!currentDevice) {
|
|
return new Response(JSON.stringify({ error: 'Unauthorized' }), {
|
|
status: 401,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Verify the device to revoke belongs to the same user
|
|
const targetDevice = await db.prepare(`
|
|
SELECT user_id, public_key FROM device_keys WHERE id = ?
|
|
`).bind(deviceId).first<{ user_id: string; public_key: string }>();
|
|
|
|
if (!targetDevice || targetDevice.user_id !== currentDevice.user_id) {
|
|
return new Response(JSON.stringify({ error: 'Device not found' }), {
|
|
status: 404,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Don't allow revoking the current device
|
|
if (targetDevice.public_key === publicKey) {
|
|
return new Response(JSON.stringify({ error: 'Cannot revoke current device' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Delete the device
|
|
await db.prepare('DELETE FROM device_keys WHERE id = ?').bind(deviceId).run();
|
|
|
|
return new Response(JSON.stringify({
|
|
success: true,
|
|
message: 'Device revoked'
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Revoke device error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if a username is available
|
|
* GET /auth/check-username?username=<username>
|
|
*
|
|
* Returns whether a username is available for registration.
|
|
* Used during the CryptID registration flow.
|
|
*/
|
|
export async function handleCheckUsername(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const url = new URL(request.url);
|
|
const username = url.searchParams.get('username');
|
|
|
|
if (!username) {
|
|
return new Response(JSON.stringify({ error: 'Username is required' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Normalize username (lowercase, no special chars)
|
|
const normalizedUsername = username.toLowerCase().replace(/[^a-z0-9_-]/g, '');
|
|
|
|
if (normalizedUsername.length < 3) {
|
|
return new Response(JSON.stringify({
|
|
available: false,
|
|
error: 'Username must be at least 3 characters'
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
if (normalizedUsername.length > 20) {
|
|
return new Response(JSON.stringify({
|
|
available: false,
|
|
error: 'Username must be 20 characters or less'
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
// If no database, assume username is available (graceful degradation)
|
|
return new Response(JSON.stringify({ available: true }), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Check if username exists in database
|
|
const existingUser = await db.prepare(
|
|
'SELECT id FROM users WHERE cryptid_username = ?'
|
|
).bind(normalizedUsername).first<{ id: string }>();
|
|
|
|
return new Response(JSON.stringify({
|
|
available: !existingUser,
|
|
username: normalizedUsername,
|
|
error: existingUser ? 'Username is already taken' : null
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Check username error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Search for CryptID users by username
|
|
* GET /auth/users/search?q=<query>
|
|
*
|
|
* This endpoint allows searching for users by CryptID username.
|
|
* Used for granting permissions to users by username.
|
|
*/
|
|
export async function handleSearchUsers(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
const url = new URL(request.url);
|
|
const query = url.searchParams.get('q');
|
|
|
|
if (!query || query.length < 2) {
|
|
return new Response(JSON.stringify({ error: 'Query must be at least 2 characters' }), {
|
|
status: 400,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
// Search users by username (case-insensitive)
|
|
const users = await db.prepare(`
|
|
SELECT id, cryptid_username, email, email_verified, created_at
|
|
FROM users
|
|
WHERE cryptid_username LIKE ?
|
|
ORDER BY cryptid_username
|
|
LIMIT 20
|
|
`).bind(`%${query}%`).all<{
|
|
id: string;
|
|
cryptid_username: string;
|
|
email: string;
|
|
email_verified: number;
|
|
created_at: string;
|
|
}>();
|
|
|
|
return new Response(JSON.stringify({
|
|
users: (users.results || []).map(u => ({
|
|
id: u.id,
|
|
username: u.cryptid_username,
|
|
emailVerified: u.email_verified === 1,
|
|
createdAt: u.created_at
|
|
}))
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('Search users error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* List all CryptID users (admin endpoint)
|
|
* GET /admin/users
|
|
* Query params: ?limit=<number>&offset=<number>
|
|
*
|
|
* This endpoint requires admin authentication.
|
|
* For now, we'll require a simple admin secret header.
|
|
*/
|
|
export async function handleListAllUsers(
|
|
request: Request,
|
|
env: Environment
|
|
): Promise<Response> {
|
|
try {
|
|
// Check for admin secret (simple auth for now)
|
|
const adminSecret = request.headers.get('X-Admin-Secret');
|
|
if (!adminSecret || adminSecret !== env.ADMIN_SECRET) {
|
|
return new Response(JSON.stringify({ error: 'Unauthorized - admin access required' }), {
|
|
status: 401,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const db = env.CRYPTID_DB;
|
|
if (!db) {
|
|
return new Response(JSON.stringify({ error: 'Database not configured' }), {
|
|
status: 503,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
|
|
const url = new URL(request.url);
|
|
const limit = Math.min(parseInt(url.searchParams.get('limit') || '100'), 1000);
|
|
const offset = parseInt(url.searchParams.get('offset') || '0');
|
|
|
|
// Get total count
|
|
const countResult = await db.prepare('SELECT COUNT(*) as count FROM users').first<{ count: number }>();
|
|
const totalCount = countResult?.count || 0;
|
|
|
|
// Get users with device count
|
|
const users = await db.prepare(`
|
|
SELECT
|
|
u.id,
|
|
u.cryptid_username,
|
|
u.email,
|
|
u.email_verified,
|
|
u.created_at,
|
|
u.updated_at,
|
|
(SELECT COUNT(*) FROM device_keys dk WHERE dk.user_id = u.id) as device_count
|
|
FROM users u
|
|
ORDER BY u.created_at DESC
|
|
LIMIT ? OFFSET ?
|
|
`).bind(limit, offset).all<{
|
|
id: string;
|
|
cryptid_username: string;
|
|
email: string;
|
|
email_verified: number;
|
|
created_at: string;
|
|
updated_at: string;
|
|
device_count: number;
|
|
}>();
|
|
|
|
return new Response(JSON.stringify({
|
|
users: (users.results || []).map(u => ({
|
|
id: u.id,
|
|
username: u.cryptid_username,
|
|
email: u.email,
|
|
emailVerified: u.email_verified === 1,
|
|
deviceCount: u.device_count,
|
|
createdAt: u.created_at,
|
|
updatedAt: u.updated_at
|
|
})),
|
|
pagination: {
|
|
total: totalCount,
|
|
limit,
|
|
offset,
|
|
hasMore: offset + limit < totalCount
|
|
}
|
|
}), {
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
} catch (error) {
|
|
console.error('List all users error:', error);
|
|
return new Response(JSON.stringify({ error: 'Internal server error' }), {
|
|
status: 500,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
}
|
|
}
|