refactor: auth + sessions

.oxfmtrc.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "$schema": "./backend/node_modules/oxfmt/configuration_schema.json",
   "semi": false,
   "singleQuote": true,
   "trailingComma": "none",

.vscode/settings.json

@@ -1,14 +1,14 @@
 {
   "eslint.enable": false,
-  "editor.formatOnSave": false,
   "editor.tabSize": 2,
-  "i18n-ally.localesPaths": [
+  "i18n-ally.localesPaths": ["backend/locales"],
-    "backend/locales",
-  ],
   "i18n-ally.pathMatcher": "{locale}.json",
   "i18n-ally.keystyle": "flat",
   "i18n-ally.sortKeys": true,
-  "i18n-ally.enabledFrameworks": [
+  "i18n-ally.enabledFrameworks": ["vue"],
-    "vue"
+  "[javascript]": {
-  ]
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true,
+    "editor.formatOnSaveMode": "file"
+  }
 }

backend/api/authentication.mjs

@@ -1,100 +1,204 @@
-
 /**
  * Authentication API Routes
  */
-async function routes (app, options) {
+async function routes(app, options) {
   /**
    * GET SITE AUTHENTICATION STRATEGIES
    */
-  app.get('/sites/:siteId/auth/strategies', {
+  app.get(
-    schema: {
+    '/sites/:siteId/auth/strategies',
-      summary: 'List all site authentication strategies',
+    {
-      tags: ['Authentication'],
+      schema: {
-      params: {
+        summary: 'List all site authentication strategies',
-        type: 'object',
+        tags: ['Authentication'],
-        properties: {
+        params: {
-          siteId: {
+          type: 'object',
-            type: 'string',
+          properties: {
-            format: 'uuid'
+            siteId: {
+              type: 'string',
+              format: 'uuid'
+            }
           }
-        }
+        },
-      },
+        querystring: {
-      querystring: {
+          type: 'object',
-        type: 'object',
+          properties: {
-        properties: {
+            visibleOnly: {
-          visibleOnly: {
+              type: 'boolean',
-            type: 'boolean',
+              default: false
-            default: false
+            }
           }
         }
       }
-    }
+    },
-  }, async (req, reply) => {
+    async (req, reply) => {
-    const site = await WIKI.models.sites.getSiteById({ id: req.params.siteId })
+      const site = await WIKI.models.sites.getSiteById({ id: req.params.siteId })
-    const activeStrategies = await WIKI.models.authentication.getStrategies({ enabledOnly: true })
+      if (!site) {
-    const siteStrategies = activeStrategies.map(str => {
+        return reply.badRequest('Invalid Site ID')
-      const authModule = WIKI.data.authentication.find(m => m.key === str.module)
-      const siteStr = site.config.authStrategies.find(s => s.id === str.id) || {}
-      return {
-        id: str.id,
-        displayName: str.displayName,
-        useForm: authModule.useForm,
-        usernameType: authModule.usernameType,
-        color: authModule.color,
-        icon: authModule.icon,
-        order: siteStr.order ?? 0,
-        isVisible: siteStr.isVisible ?? false
       }
-    }).sort((a,b) => a.order - b.order)
+      const activeStrategies = await WIKI.models.authentication.getStrategies({ enabledOnly: true })
-    return req.query.visibleOnly ? siteStrategies.filter(s => s.isVisible) : siteStrategies
+      const siteStrategies = activeStrategies
-  })
+        .map((str) => {
+          const authModule = WIKI.data.authentication.find((m) => m.key === str.module)
+          const siteStr = site.config.authStrategies.find((s) => s.id === str.id) || {}
+          return {
+            id: str.id,
+            displayName: str.displayName,
+            useForm: authModule.useForm,
+            usernameType: authModule.usernameType,
+            color: authModule.color,
+            icon: authModule.icon,
+            order: siteStr.order ?? 0,
+            isVisible: siteStr.isVisible ?? false
+          }
+        })
+        .sort((a, b) => a.order - b.order)
+      return req.query.visibleOnly ? siteStrategies.filter((s) => s.isVisible) : siteStrategies
+    }
+  )
 
   /**
    * LOGIN USING USER/PASS
    */
-  app.post('/sites/:siteId/auth/login', {
+  app.put(
-    schema: {
+    '/sites/:siteId/auth/login',
-      summary: 'Login',
+    {
-      tags: ['Authentication'],
+      schema: {
-      params: {
+        summary: 'Login',
-        type: 'object',
+        tags: ['Authentication'],
-        properties: {
+        params: {
-          siteId: {
+          type: 'object',
-            type: 'string',
+          properties: {
-            format: 'uuid'
+            siteId: {
+              type: 'string',
+              format: 'uuid'
+            }
+          }
+        },
+        body: {
+          type: 'object',
+          required: ['strategyId'],
+          properties: {
+            strategyId: {
+              type: 'string',
+              format: 'uuid'
+            },
+            username: {
+              type: 'string',
+              minLength: 1,
+              maxLength: 255
+            },
+            password: {
+              type: 'string',
+              minLength: 1,
+              maxLength: 255
+            }
           }
         }
-      },
+      }
-      body: {
+    },
-        type: 'object',
+    async (req, reply) => {
-        required: ['strategyId', 'username', 'password'],
+      try {
-        properties: {
+        const result = await WIKI.models.users.login(
-          strategyId: {
+          {
-            type: 'string',
+            siteId: req.params.siteId,
-            format: 'uuid'
+            strategyId: req.body.strategyId,
-          },
+            username: req.body.username,
-          username: {
+            password: req.body.password,
-            type: 'string',
+            ip: req.ip
-            minLength: 1,
-            maxLength: 255
           },
-          password: {
+          req
-            type: 'string',
+        )
-            minLength: 1,
+        if (!result) {
-            maxLength: 255
+          throw new Error('Unexpected empty login response.')
+        }
+        return {
+          ok: true,
+          ...result
+        }
+      } catch (err) {
+        if (err.message.startsWith('ERR_')) {
+          return reply.badRequest(err.message)
+        } else {
+          WIKI.logger.info(err) // TODO: change to debug once stable
+          return reply.badRequest('ERR_LOGIN_FAILED')
+        }
+      }
+    }
+  )
+
+  /**
+   * CHANGE PASSWORD
+   */
+  app.put(
+    '/sites/:siteId/auth/changePassword',
+    {
+      schema: {
+        summary: 'Change Password From Login',
+        tags: ['Authentication'],
+        params: {
+          type: 'object',
+          properties: {
+            siteId: {
+              type: 'string',
+              format: 'uuid'
+            }
+          }
+        },
+        body: {
+          type: 'object',
+          required: ['strategyId', 'continuationToken', 'newPassword'],
+          properties: {
+            strategyId: {
+              type: 'string',
+              format: 'uuid'
+            },
+            continuationToken: {
+              type: 'string',
+              minLength: 1,
+              maxLength: 255
+            },
+            newPassword: {
+              type: 'string',
+              minLength: 1,
+              maxLength: 255
+            }
           }
         }
       }
+    },
+    async (req, reply) => {
+      try {
+        const result = await WIKI.models.users.loginChangePassword(
+          {
+            siteId: req.params.siteId,
+            strategyId: req.body.strategyId,
+            continuationToken: req.body.continuationToken,
+            newPassword: req.body.newPassword,
+            ip: req.ip
+          },
+          req
+        )
+        if (!result) {
+          throw new Error('Unexpected empty change password response.')
+        }
+        if (result?.authenticated) {
+          req.session.authenticated = true
+        }
+        return {
+          ok: true,
+          ...result
+        }
+      } catch (err) {
+        if (err.message.startsWith('ERR_')) {
+          return reply.badRequest(err.message)
+        } else {
+          WIKI.logger.debug(err)
+          return reply.badRequest('ERR_CHANGE_PASSWORD_FAILED')
+        }
+      }
     }
-  }, async (req, reply) => {
+  )
-    return WIKI.models.users.login({
-      siteId: req.params.siteId,
-      strategyId: req.body.strategyId,
-      username: req.body.username,
-      password: req.body.password,
-      ip: req.ip
-    })
-  })
 }
 
 export default routes

backend/api/pages.mjs

@@ -1,92 +1,101 @@
 /**
  * Pages API Routes
  */
-async function routes (app, options) {
+async function routes(app, options) {
-  app.get('/sites/:siteId/pages', {
+  app.get(
-    schema: {
+    '/sites/:siteId/pages',
-      summary: 'List all pages',
+    {
-      tags: ['Pages'],
+      schema: {
-      params: {
+        summary: 'List all pages',
-        type: 'object',
+        tags: ['Pages'],
-        properties: {
+        params: {
-          siteId: {
+          type: 'object',
-            type: 'string',
+          properties: {
-            format: 'uuid'
+            siteId: {
+              type: 'string',
+              format: 'uuid'
+            }
           }
         }
       }
+    },
+    async (req, reply) => {
+      return []
     }
-  }, async (req, reply) => {
+  )
-    return []
-  })
 
-  app.get('/sites/:siteId/pages/:pageIdOrHash', {
+  app.get(
-    schema: {
+    '/sites/:siteId/pages/:pageIdOrHash',
-      summary: 'List all pages',
+    {
-      tags: ['Pages'],
+      schema: {
-      params: {
+        summary: 'List all pages',
-        type: 'object',
+        tags: ['Pages'],
-        properties: {
+        params: {
-          siteId: {
+          type: 'object',
-            type: 'string',
+          properties: {
-            format: 'uuid'
+            siteId: {
-          },
+              type: 'string',
-          pageIdOrHash: {
+              format: 'uuid'
-            type: 'string',
+            },
-            oneOf: [
+            pageIdOrHash: {
-              { format: 'uuid' },
+              type: 'string',
-              { pattern: '^[a-f0-9]+$' }
+              oneOf: [{ format: 'uuid' }, { pattern: '^[a-f0-9]+$' }]
-            ]
+            }
           }
-        }
+        },
-      },
+        querystring: {
-      querystring: {
+          type: 'object',
-        type: 'object',
+          properties: {
-        properties: {
+            withContent: {
-          withContent: {
+              type: 'boolean',
-            type: 'boolean',
+              default: false
-            default: false
+            }
           }
         }
       }
+    },
+    async (req, reply) => {
+      return []
     }
-  }, async (req, reply) => {
+  )
-    return []
-  })
 
-  app.post('/sites/:siteId/pages/userPermissions', {
+  app.post(
-    schema: {
+    '/sites/:siteId/pages/userPermissions',
-      summary: 'Get page user permissions',
+    {
-      tags: ['Pages'],
+      schema: {
-      params: {
+        summary: 'Get page user permissions',
-        type: 'object',
+        tags: ['Pages'],
-        properties: {
+        params: {
-          siteId: {
+          type: 'object',
-            type: 'string',
+          properties: {
-            format: 'uuid'
+            siteId: {
-          }
+              type: 'string',
-        }
+              format: 'uuid'
-      },
+            }
-      body: {
-        type: 'object',
-        required: ['path'],
-        properties: {
-          path: {
-            type: 'string',
-            minLength: 1,
-            maxLength: 255
           }
         },
-        examples: [
+        body: {
-          {
+          type: 'object',
-            path: 'foo/bar'
+          required: ['path'],
-          }
+          properties: {
-        ]
+            path: {
+              type: 'string',
+              minLength: 1,
+              maxLength: 255
+            }
+          },
+          examples: [
+            {
+              path: 'foo/bar'
+            }
+          ]
+        }
       }
+    },
+    async (req, reply) => {
+      return []
     }
-  }, async (req, reply) => {
+  )
-    return []
-  })
 }
 
 export default routes

backend/api/sites.mjs

@@ -3,166 +3,194 @@ import { validate as uuidValidate } from 'uuid'
 /**
  * Sites API Routes
  */
-async function routes (app, options) {
+async function routes(app, options) {
-  app.get('/', {
+  app.get(
-    schema: {
+    '/',
-      summary: 'List all sites',
+    {
-      tags: ['Sites']
+      config: {
+        permissions: ['read:sites', 'read:dashboard']
+      },
+      schema: {
+        summary: 'List all sites',
+        tags: ['Sites']
+      }
+    },
+    async (req, reply) => {
+      const sites = await WIKI.models.sites.getAllSites()
+      return sites.map((s) => ({
+        ...s.config,
+        id: s.id,
+        hostname: s.hostname,
+        isEnabled: s.isEnabled,
+        pageExtensions: s.config.pageExtensions.join(', ')
+      }))
     }
-  }, async (req, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
-  app.get('/:siteIdorHostname', {
+  app.get(
-    schema: {
+    '/:siteIdorHostname',
-      summary: 'Get site info',
+    {
-      tags: ['Sites'],
+      schema: {
-      params: {
+        summary: 'Get site info',
-        type: 'object',
+        tags: ['Sites'],
-        properties: {
+        params: {
-          siteId: {
+          type: 'object',
-            type: 'string',
+          properties: {
-            description: 'Either a site ID, hostname or "current" to use the request hostname.',
+            siteId: {
-            oneOf: [
+              type: 'string',
-              { format: 'uuid' },
+              description: 'Either a site ID, hostname or "current" to use the request hostname.',
-              { enum: ['current'] },
+              oneOf: [{ format: 'uuid' }, { enum: ['current'] }, { pattern: '^[a-f0-9]+$' }]
-              { pattern: '^[a-f0-9]+$' }
+            }
-            ]
+          },
+          required: ['siteIdorHostname']
+        }
+      }
+    },
+    async (req, reply) => {
+      let site
+      if (req.params.siteId === 'current' && req.hostname) {
+        site = await WIKI.models.sites.getSiteByHostname({ hostname: req.hostname })
+      } else if (uuidValidate(req.params.siteId)) {
+        site = await WIKI.models.sites.getSiteById({ id: req.params.siteId })
+      } else {
+        site = await WIKI.models.sites.getSiteByHostname({ hostname: req.params.siteId })
+      }
+      return site
+        ? {
+            ...site.config,
+            id: site.id,
+            hostname: site.hostname,
+            isEnabled: site.isEnabled
           }
-        },
+        : null
-        required: ['siteIdorHostname']
-      },
     }
-  }, async (req, reply) => {
+  )
-    let site
-    if (req.params.siteId === 'current' && req.hostname) {
-      site = await WIKI.models.sites.getSiteByHostname({ hostname: req.hostname })
-    } else if (uuidValidate(req.params.siteId)) {
-      site = await WIKI.models.sites.getSiteById({ id: req.params.siteId })
-    } else {
-      site = await WIKI.models.sites.getSiteByHostname({ hostname: req.params.siteId })
-    }
-    return site
-      ? {
-          ...site.config,
-          id: site.id,
-          hostname: site.hostname,
-          isEnabled: site.isEnabled
-        }
-      : null
-  })
 
   /**
    * CREATE SITE
    */
-  app.post('/', {
+  app.post(
-    config: {
+    '/',
-      // permissions: ['create:sites', 'manage:sites']
+    {
-    },
+      config: {
-    schema: {
+        // permissions: ['create:sites', 'manage:sites']
-      summary: 'Create a new site',
-      tags: ['Sites'],
-      body: {
-        type: 'object',
-        required: ['hostname', 'title'],
-        properties: {
-          hostname: {
-            type: 'string',
-            minLength: 1,
-            maxLength: 255,
-            pattern: '^(\\*|[a-z0-9.-]+)$'
-          },
-          title: {
-            type: 'string',
-            minLength: 1,
-            maxLength: 255
-          }
-        },
-        examples: [
-          {
-            hostname: 'wiki.example.org',
-            title: 'My Wiki Site'
-          }
-        ]
       },
-      response: {
+      schema: {
-        200: {
+        summary: 'Create a new site',
-          description: 'Site created successfully',
+        tags: ['Sites'],
+        body: {
           type: 'object',
+          required: ['hostname', 'title'],
           properties: {
-            message: {
+            hostname: {
-              type: 'string'
+              type: 'string',
+              minLength: 1,
+              maxLength: 255,
+              pattern: '^(\\*|[a-z0-9.-]+)$'
             },
-            id: {
+            title: {
               type: 'string',
-              format: 'uuid'
+              minLength: 1,
+              maxLength: 255
+            }
+          },
+          examples: [
+            {
+              hostname: 'wiki.example.org',
+              title: 'My Wiki Site'
+            }
+          ]
+        },
+        response: {
+          200: {
+            description: 'Site created successfully',
+            type: 'object',
+            properties: {
+              message: {
+                type: 'string'
+              },
+              id: {
+                type: 'string',
+                format: 'uuid'
+              }
             }
           }
         }
       }
+    },
+    async (req, reply) => {
+      const result = await WIKI.models.sites.createSite(req.body.hostname, {
+        title: req.body.title
+      })
+      return {
+        message: 'Site created successfully.',
+        id: result.id
+      }
     }
-  }, async (req, reply) => {
+  )
-    const result = await WIKI.models.sites.createSite(req.body.hostname, { title: req.body.title })
-    return {
-      message: 'Site created successfully.',
-      id: result.id
-    }
-  })
 
   /**
    * UPDATE SITE
    */
-  app.put('/:siteId', {
+  app.put(
-    config: {
+    '/:siteId',
-      permissions: ['manage:sites']
+    {
+      config: {
+        permissions: ['manage:sites']
+      },
+      schema: {
+        summary: 'Update a site',
+        tags: ['Sites']
+      }
     },
-    schema: {
+    async (req, reply) => {
-      summary: 'Update a site',
+      return { hello: 'world' }
-      tags: ['Sites']
     }
-  }, async (req, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
   /**
    * DELETE SITE
    */
-  app.delete('/:siteId', {
+  app.delete(
-    config: {
+    '/:siteId',
-      permissions: ['manage:sites']
+    {
-    },
+      config: {
-    schema: {
+        permissions: ['manage:sites']
-      summary: 'Delete a site',
-      tags: ['Sites'],
-      params: {
-        type: 'object',
-        properties: {
-          siteId: {
-            type: 'string',
-            format: 'uuid'
-          }
-        },
-        required: ['siteId']
       },
-      response: {
+      schema: {
-        204: {
+        summary: 'Delete a site',
-          description: 'Site deleted successfully'
+        tags: ['Sites'],
+        params: {
+          type: 'object',
+          properties: {
+            siteId: {
+              type: 'string',
+              format: 'uuid'
+            }
+          },
+          required: ['siteId']
+        },
+        response: {
+          204: {
+            description: 'Site deleted successfully'
+          }
         }
       }
-    }
+    },
-  }, async (req, reply) => {
+    async (req, reply) => {
-    try {
+      try {
-      if (await WIKI.models.sites.countSites() <= 1) {
+        if ((await WIKI.models.sites.countSites()) <= 1) {
-        reply.conflict('Cannot delete the last site. At least 1 site must exist at all times.')
+          reply.conflict('Cannot delete the last site. At least 1 site must exist at all times.')
-      } else if (await WIKI.models.sites.deleteSite(req.params.siteId)) {
+        } else if (await WIKI.models.sites.deleteSite(req.params.siteId)) {
-        reply.code(204)
+          reply.code(204)
-      } else {
+        } else {
-        reply.badRequest('Site does not exist.')
+          reply.badRequest('Site does not exist.')
+        }
+      } catch (err) {
+        reply.send(err)
       }
-    } catch (err) {
-      reply.send(err)
     }
-  })
+  )
 }
 
 export default routes

backend/api/system.mjs

@@ -1,24 +1,74 @@
+import path from 'node:path'
+import os from 'node:os'
+import { DateTime } from 'luxon'
+import { filesize } from 'filesize'
+import { isNil } from 'es-toolkit/predicate'
+import { gte, sql } from 'drizzle-orm'
+import {
+  groups as groupsTable,
+  pages as pagesTable,
+  tags as tagsTable,
+  users as usersTable
+} from '../db/schema.mjs'
+
 /**
  * System API Routes
  */
-async function routes (app, options) {
+async function routes(app, options) {
-  app.get('/info', {
+  app.get(
-    schema: {
+    '/info',
-      summary: 'System Info',
+    {
-      tags: ['System']
+      config: {
+        permissions: ['read:dashboard', 'manage:sites']
+      },
+      schema: {
+        summary: 'System Info',
+        tags: ['System']
+      }
+    },
+    async (request, reply) => {
+      return {
+        configFile: path.join(process.cwd(), 'config.yml'),
+        cpuCores: os.cpus().length,
+        currentVersion: WIKI.version,
+        dbHost: WIKI.config.db.host,
+        dbVersion: WIKI.dbManager.VERSION,
+        groupsTotal: await WIKI.db.$count(groupsTable),
+        hostname: os.hostname(),
+        httpPort: 0,
+        isMailConfigured: WIKI.config?.mail?.host?.length > 2,
+        isSchedulerHealthy: true,
+        latestVersion: WIKI.config.update.version,
+        latestVersionReleaseDate: DateTime.fromISO(WIKI.config.update.versionDate).toJSDate(),
+        loginsPastDay: await WIKI.db.$count(
+          usersTable,
+          gte(usersTable.lastLoginAt, sql`NOW() - INTERVAL '1 DAY'`)
+        ),
+        nodeVersion: process.version.substring(1),
+        operatingSystem: `${os.type()} (${os.platform()}) ${os.release()} ${os.arch()}`,
+        pagesTotal: await WIKI.db.$count(pagesTable),
+        platform: os.platform(),
+        ramTotal: filesize(os.totalmem()),
+        tagsTotal: await WIKI.db.$count(tagsTable),
+        upgradeCapable: !isNil(process.env.UPGRADE_COMPANION),
+        usersTotal: await WIKI.db.$count(usersTable),
+        workingDirectory: process.cwd()
+      }
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
-  app.get('/flags', {
+  app.get(
-    schema: {
+    '/flags',
-      summary: 'System Flags',
+    {
-      tags: ['System']
+      schema: {
+        summary: 'System Flags',
+        tags: ['System']
+      }
+    },
+    async (request, reply) => {
+      return WIKI.config.flags
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
-  })
 }
 
 export default routes

backend/api/users.mjs

@@ -1,51 +1,95 @@
 /**
  * Users API Routes
  */
-async function routes (app, options) {
+async function routes(app, options) {
-  app.get('/', {
+  app.get(
-    schema: {
+    '/',
-      summary: 'List all users',
+    {
-      tags: ['Users']
+      schema: {
+        summary: 'List all users',
+        tags: ['Users']
+      }
+    },
+    async (request, reply) => {
+      return { hello: 'world' }
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
-  app.get('/:userId', {
+  app.get(
-    schema: {
+    '/whoami',
-      summary: 'Get user info',
+    {
-      tags: ['Users']
+      schema: {
+        summary: 'Get currently logged in user info',
+        tags: ['Users']
+      }
+    },
+    async (req, reply) => {
+      reply.preventCache()
+      if (req.session?.authenticated) {
+        return {
+          authenticated: true,
+          ...req.session.user,
+          permissions: ['manage:system']
+        }
+      } else {
+        return {
+          authenticated: false
+        }
+      }
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
-  app.post('/', {
+  app.get(
-    schema: {
+    '/:userId',
-      summary: 'Create a new user',
+    {
-      tags: ['Users']
+      schema: {
+        summary: 'Get user info',
+        tags: ['Users']
+      }
+    },
+    async (request, reply) => {
+      return { hello: 'world' }
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
-  app.put('/:userId', {
+  app.post(
-    schema: {
+    '/',
-      summary: 'Update a user',
+    {
-      tags: ['Users']
+      schema: {
+        summary: 'Create a new user',
+        tags: ['Users']
+      }
+    },
+    async (request, reply) => {
+      return { hello: 'world' }
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
-  })
 
-  app.delete('/:userId', {
+  app.put(
-    schema: {
+    '/:userId',
-      summary: 'Delete a user',
+    {
-      tags: ['Users']
+      schema: {
+        summary: 'Update a user',
+        tags: ['Users']
+      }
+    },
+    async (request, reply) => {
+      return { hello: 'world' }
     }
-  }, async (request, reply) => {
+  )
-    return { hello: 'world' }
+
-  })
+  app.delete(
+    '/:userId',
+    {
+      schema: {
+        summary: 'Delete a user',
+        tags: ['Users']
+      }
+    },
+    async (request, reply) => {
+      return { hello: 'world' }
+    }
+  )
 }
 
 export default routes

backend/core/db.mjs

@@ -27,12 +27,12 @@ export default {
   /**
    * Initialize DB
    */
-  async init (workerMode = false) {
+  async init(workerMode = false) {
     WIKI.logger.info('Checking DB configuration...')
 
     // Fetch DB Config
 
-    this.config = (process.env.DATABASE_URL)
+    this.config = process.env.DATABASE_URL
       ? {
           connectionString: process.env.DATABASE_URL
         }
@@ -46,7 +46,11 @@ export default {
 
     // Handle SSL Options
 
-    let dbUseSSL = (WIKI.config.db.ssl === true || WIKI.config.db.ssl === 'true' || WIKI.config.db.ssl === 1 || WIKI.config.db.ssl === '1')
+    let dbUseSSL =
+      WIKI.config.db.ssl === true ||
+      WIKI.config.db.ssl === 'true' ||
+      WIKI.config.db.ssl === 1 ||
+      WIKI.config.db.ssl === '1'
     let sslOptions = null
     if (dbUseSSL && isPlainObject(this.config) && WIKI.config.db?.sslOptions?.auto === false) {
       sslOptions = WIKI.config.db.sslOptions
@@ -82,7 +86,7 @@ export default {
     }
 
     if (dbUseSSL && isPlainObject(this.config)) {
-      this.config.ssl = (sslOptions === true) ? { rejectUnauthorized: true } : sslOptions
+      this.config.ssl = sslOptions === true ? { rejectUnauthorized: true } : sslOptions
     }
 
     // Initialize Postgres Pool
@@ -90,11 +94,15 @@ export default {
     this.pool = new Pool({
       application_name: 'Wiki.js',
       ...this.config,
-      ...workerMode ? { min: 0, max: 1 } : WIKI.config.pool,
+      ...(workerMode ? { min: 0, max: 1 } : WIKI.config.pool),
       options: `-c search_path=${WIKI.config.db.schema}`
     })
 
-    const db = drizzle({ client: this.pool, relations })
+    const db = drizzle({
+      client: this.pool,
+      relations,
+      ...(WIKI.config.dev?.logQueries && { logger: true })
+    })
 
     // Connect
     await this.connect(db)
@@ -104,7 +112,9 @@ export default {
     const dbVersion = semver.coerce(resVersion.rows[0].server_version, { loose: true })
     this.VERSION = dbVersion.version
     if (dbVersion.major < 16) {
-      WIKI.logger.error(`Your PostgreSQL database version (${dbVersion.major}) is too old and unsupported by Wiki.js. Requires >= 16. Exiting...`)
+      WIKI.logger.error(
+        `Your PostgreSQL database version (${dbVersion.major}) is too old and unsupported by Wiki.js. Requires >= 16. Exiting...`
+      )
       process.exit(1)
     }
     WIKI.logger.info(`Using PostgreSQL v${dbVersion.version} [ OK ]`)
@@ -125,7 +135,7 @@ export default {
   /**
    * Subscribe to database LISTEN / NOTIFY for multi-instances events
    */
-  async subscribeToNotifications () {
+  async subscribeToNotifications() {
     let connSettings = this.knex.client.connectionSettings
     if (typeof connSettings === 'string') {
       const encodedName = encodeURIComponent(`Wiki.js - ${WIKI.INSTANCE_ID}:PSUB`)
@@ -138,15 +148,15 @@ export default {
       connSettings.application_name = `Wiki.js - ${WIKI.INSTANCE_ID}:PSUB`
     }
     this.listener = new PGPubSub(connSettings, {
-      log (ev) {
+      log(ev) {
         WIKI.logger.debug(ev)
       }
     })
 
     // -> Outbound events handling
 
-    this.listener.addChannel('wiki', payload => {
+    this.listener.addChannel('wiki', (payload) => {
-      if (('event' in payload) && payload.source !== WIKI.INSTANCE_ID) {
+      if ('event' in payload && payload.source !== WIKI.INSTANCE_ID) {
         WIKI.logger.info(`Received event ${payload.event} from instance ${payload.source}: [ OK ]`)
         WIKI.events.inbound.emit(payload.event, payload.value)
       }
@@ -164,7 +174,7 @@ export default {
   /**
    * Unsubscribe from database LISTEN / NOTIFY
    */
-  async unsubscribeToNotifications () {
+  async unsubscribeToNotifications() {
     if (this.listener) {
       WIKI.events.outbound.offAny(this.notifyViaDB)
       WIKI.events.inbound.removeAllListeners()
@@ -177,7 +187,7 @@ export default {
    * @param {string} event Event fired
    * @param {object} value Payload of the event
    */
-  notifyViaDB (event, value) {
+  notifyViaDB(event, value) {
     WIKI.db.listener.publish('wiki', {
       source: WIKI.INSTANCE_ID,
       event,
@@ -187,7 +197,7 @@ export default {
   /**
    * Attempt initial connection
    */
-  async connect (db) {
+  async connect(db) {
     try {
       WIKI.logger.info('Connecting to database...')
       await db.execute('SELECT 1 + 1;')
@@ -211,7 +221,7 @@ export default {
   /**
    * Migrate DB Schemas
    */
-  async syncSchemas (db) {
+  async syncSchemas(db) {
     WIKI.logger.info('Ensuring DB schema exists...')
     await db.execute(`CREATE SCHEMA IF NOT EXISTS ${WIKI.config.db.schema}`)
     WIKI.logger.info('Ensuring DB migrations have been applied...')

backend/db/relations.mjs

@@ -1,16 +1,20 @@
 import { defineRelations } from 'drizzle-orm'
 import * as schema from './schema.mjs'
 
-export const relations = defineRelations(schema,
+export const relations = defineRelations(schema, (r) => ({
-  r => ({
+  users: {
-    users: {
+    groups: r.many.groups({
-      groups: r.many.groups({
+      from: r.users.id.through(r.userGroups.userId),
-        from: r.users.id.through(r.userGroups.userId),
+      to: r.groups.id.through(r.userGroups.groupId)
-        to: r.groups.id.through(r.userGroups.groupId)
+    })
-      })
+  },
-    },
+  groups: {
-    groups: {
+    members: r.many.users()
-      members: r.many.users()
+  },
-    }
+  userKeys: {
-  })
+    user: r.one.users({
-)
+      from: r.userKeys.userId,
+      to: r.users.id
+    })
+  }
+}))

backend/index.mjs

@@ -49,6 +49,10 @@ const WIKI = {
   ROOTPATH: process.cwd(),
   INSTANCE_ID: nanoid(10),
   SERVERPATH: path.join(process.cwd(), 'backend'),
+  auth: {
+    groups: {},
+    strategies: {}
+  },
   configSvc,
   sites: {},
   sitesMappings: {},
@@ -88,7 +92,7 @@ WIKI.logger.info(`Running node.js ${process.version} [ OK ]`)
 // Pre-Boot Sequence
 // ----------------------------------------
 
-async function preBoot () {
+async function preBoot() {
   WIKI.dbManager = (await import('./core/db.mjs')).default
   WIKI.db = await dbManager.init()
   WIKI.models = (await import('./models/index.mjs')).default
@@ -119,11 +123,12 @@ async function preBoot () {
 // Post-Boot Sequence
 // ----------------------------------------
 
-async function postBoot () {
+async function postBoot() {
   await WIKI.models.locales.refreshFromDisk()
 
   await WIKI.models.authentication.refreshStrategiesFromDisk()
 
+  await WIKI.models.authentication.activateStrategies()
   await WIKI.models.locales.reloadCache()
   await WIKI.models.sites.reloadCache()
 }
@@ -132,7 +137,7 @@ async function postBoot () {
 // Init HTTP Server
 // ----------------------------------------
 
-async function initHTTPServer () {
+async function initHTTPServer() {
   // ----------------------------------------
   // Load core modules
   // ----------------------------------------
@@ -147,9 +152,7 @@ async function initHTTPServer () {
 
   const app = fastify({
     ajv: {
-      plugins: [
+      plugins: [[ajvFormats, {}]]
-        [ajvFormats, {}]
-      ]
     },
     bodyLimit: WIKI.config.bodyParserLimit || 5242880, // 5mb
     logger: {
@@ -232,7 +235,7 @@ async function initHTTPServer () {
   })
 
   // ----------------------------------------
-  // Passport Authentication
+  // Sessions
   // ----------------------------------------
 
   app.register(fastifyCookie, {
@@ -244,18 +247,31 @@ async function initHTTPServer () {
     cookieName: 'wikiSession',
     cookie: {
       httpOnly: true,
+      maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
       secure: 'auto'
     },
     saveUninitialized: false,
     store: {
-      get (sessionId, clb) {
+      async get(sessionId, clb) {
-
+        try {
+          clb(null, await WIKI.models.sessions.get(sessionId))
+        } catch (err) {
+          clb(err, null)
+        }
       },
-      set (sessionId, sessionData, clb) {
+      async set(sessionId, sessionData, clb) {
-
+        try {
+          clb(null, await WIKI.models.sessions.set(sessionId, sessionData))
+        } catch (err) {
+          clb(err, null)
+        }
       },
-      destroy (sessionId, clb) {
+      async destroy(sessionId, clb) {
-
+        try {
+          clb(null, await WIKI.models.sessions.destroy(sessionId))
+        } catch (err) {
+          clb(err, null)
+        }
       }
     }
   })
@@ -292,10 +308,7 @@ async function initHTTPServer () {
           }
         }
       },
-      security: [
+      security: [{ apiKeyAuth: [] }, { bearerAuth: [] }]
-        { apiKeyAuth: [] },
-        { bearerAuth: [] }
-      ]
     }
   })
   app.register(fastifySwaggerUi, {
@@ -309,18 +322,18 @@ async function initHTTPServer () {
   app.addHook('preHandler', (req, reply, done) => {
     if (req.routeOptions.config?.permissions?.length > 0) {
       // Unauthenticated / No Permissions
-      if (!req.user?.isAuthenticated || !(req.user.permissions?.length > 0)) {
+      if (!req.session?.authenticated || !(req.session?.permissions?.length > 0)) {
         return reply.unauthorized()
       }
       // Is Root Admin?
-      if (!req.user.permissions.includes('manage:system')) {
+      if (!req.session.permissions.includes('manage:system')) {
         // Check for at least 1 permission
-        const isAllowed = req.routeOptions.config.permissions.some(perms => {
+        const isAllowed = req.routeOptions.config.permissions.some((perms) => {
           // Check for all permissions
           if (Array.isArray(perms)) {
-            return perms.every(perm => req.user.permissions?.some(p => p === perm))
+            return perms.every((perm) => req.session.permissions?.some((p) => p === perm))
           } else {
-            return req.user.permissions?.some(p => p === perms)
+            return req.session.permissions?.some((p) => p === perms)
           }
         })
         // Forbidden

backend/models/authentication.mjs

@@ -9,37 +9,88 @@ import { authentication as authenticationTable } from '../db/schema.mjs'
  * Authentication model
  */
 class Authentication {
-  async getStrategy (module) {
+  async getStrategy(module) {
     return WIKI.db.select().from(authenticationTable).where(eq(authenticationTable.module, module))
   }
 
-  async getStrategies ({ enabledOnly = false } = {}) {
+  async getStrategies({ enabledOnly = false } = {}) {
-    return WIKI.db.select().from(authenticationTable).where(enabledOnly ? eq(authenticationTable.isEnabled, true) : undefined)
+    return WIKI.db
+      .select()
+      .from(authenticationTable)
+      .where(enabledOnly ? eq(authenticationTable.isEnabled, true) : undefined)
   }
 
-  async refreshStrategiesFromDisk () {
+  async refreshStrategiesFromDisk() {
     try {
       // -> Fetch definitions from disk
-      const authenticationDirs = await fs.readdir(path.join(WIKI.SERVERPATH, 'modules/authentication'))
+      const authenticationDirs = await fs.readdir(
+        path.join(WIKI.SERVERPATH, 'modules/authentication')
+      )
       WIKI.data.authentication = []
       for (const dir of authenticationDirs) {
-        const def = await fs.readFile(path.join(WIKI.SERVERPATH, 'modules/authentication', dir, 'definition.yml'), 'utf8')
+        const def = await fs.readFile(
+          path.join(WIKI.SERVERPATH, 'modules/authentication', dir, 'definition.yml'),
+          'utf8'
+        )
         const defParsed = yaml.load(def)
-        if (!defParsed.isAvailable) { continue }
+        if (!defParsed.isAvailable) {
+          continue
+        }
         defParsed.key = dir
         defParsed.props = parseModuleProps(defParsed.props)
         WIKI.data.authentication.push(defParsed)
         WIKI.logger.debug(`Loaded authentication module definition ${dir} [ OK ]`)
       }
 
-      WIKI.logger.info(`Loaded ${WIKI.data.authentication.length} authentication module definitions [ OK ]`)
+      WIKI.logger.info(
+        `Loaded ${WIKI.data.authentication.length} authentication module definitions [ OK ]`
+      )
     } catch (err) {
-      WIKI.logger.error('Failed to scan or load authentication providers [ FAILED ]')
+      WIKI.logger.error('Failed to scan or load authentication module definitions [ FAILED ]')
       WIKI.logger.error(err)
     }
   }
 
-  async init (ids) {
+  async activateStrategies() {
+    WIKI.logger.info('Activating authentication strategies...')
+
+    // Unload any active strategies
+    try {
+      for (strKey in WIKI.auth.strategies) {
+        if (typeof WIKI.auth.strategies[strKey].destroy === 'function') {
+          await WIKI.auth.strategies[strKey].destroy()
+        }
+      }
+    } catch (err) {
+      WIKI.logger.warn(`Failed to unload active strategies [ FAILED ]`)
+      WIKI.logger.warn(err)
+    }
+    WIKI.auth.strategies = {}
+
+    // Load enabled strategies
+    const enabledStrategies = await this.getStrategies({ enabledOnly: true })
+    for (const stg of enabledStrategies) {
+      try {
+        const StrategyModule = (
+          await import(`../modules/authentication/${stg.module}/authentication.mjs`)
+        ).default
+        WIKI.auth.strategies[stg.id] = new StrategyModule(stg.id, stg.config)
+        WIKI.auth.strategies[stg.id].module = stg.module
+        if (typeof WIKI.auth.strategies[stg.id].init === 'function') {
+          await WIKI.auth.strategies[stg.id].init()
+        }
+
+        WIKI.logger.info(`Enabled authentication strategy ${stg.displayName} [ OK ]`)
+      } catch (err) {
+        WIKI.logger.error(
+          `Failed to enable authentication strategy ${stg.displayName} (${stg.id}) [ FAILED ]`
+        )
+        WIKI.logger.error(err)
+      }
+    }
+  }
+
+  async init(ids) {
     await WIKI.db.insert(authenticationTable).values({
       id: ids.authModuleId,
       module: 'local',

backend/models/index.mjs

@@ -1,6 +1,7 @@
 import { authentication } from './authentication.mjs'
 import { groups } from './groups.mjs'
 import { locales } from './locales.mjs'
+import { sessions } from './sessions.mjs'
 import { settings } from './settings.mjs'
 import { sites } from './sites.mjs'
 import { users } from './users.mjs'
@@ -9,6 +10,7 @@ export default {
   authentication,
   groups,
   locales,
+  sessions,
   settings,
   sites,
   users

backend/models/sessions.mjs

@@ -0,0 +1,85 @@
+import { eq, sql } from 'drizzle-orm'
+import { sessions as sessionsTable } from '../db/schema.mjs'
+
+/**
+ * Sessions model
+ */
+class Sessions {
+  /**
+   * Fetch all sessions from a single user
+   *
+   * @param {String} userId User ID
+   * @returns Promise<Array> User Sessions
+   */
+  async getByUser(userId) {
+    return WIKI.db.select().from(sessionsTable).where(eq(sessionsTable.userId, userId))
+  }
+
+  /**
+   * Fetch a single session by id
+   *
+   * @param {String} id Session ID
+   * @returns Promise<Object> Session data
+   */
+  async get(id) {
+    const res = await WIKI.db.select().from(sessionsTable).where(eq(sessionsTable.id, id))
+    return res?.[0]?.data ?? null
+  }
+
+  /**
+   * Set / Update a session
+   *
+   * @param {String} id Session ID
+   * @param {Object} data Session Data
+   */
+  async set(id, data) {
+    await WIKI.db
+      .insert(sessionsTable)
+      .values([
+        {
+          id,
+          userId: data?.user?.id ?? null,
+          data
+        }
+      ])
+      .onConflictDoUpdate({
+        target: sessionsTable.id,
+        set: {
+          data,
+          userId: data?.user?.id ?? null,
+          updatedAt: sql`now()`
+        }
+      })
+  }
+
+  /**
+   * Delete a session
+   *
+   * @param {String} id Session ID
+   * @returns Promise<void>
+   */
+  async destroy(id) {
+    return WIKI.db.delete(sessionsTable).where(eq(sessionsTable.id, id))
+  }
+
+  /**
+   * Delete all sessions from all users
+   *
+   * @returns Promise<void>
+   */
+  async clearAllSessions() {
+    return WIKI.db.delete(sessionsTable)
+  }
+
+  /**
+   * Delete all sessions from a single user
+   *
+   * @param {String} userId User ID
+   * @returns Promise<void>
+   */
+  async clearSessionsFromUser(userId) {
+    return WIKI.db.delete(sessionsTable).where(eq(sessionsTable.userId, userId))
+  }
+}
+
+export const sessions = new Sessions()

backend/models/sites.mjs

@@ -7,14 +7,14 @@ import { eq } from 'drizzle-orm'
  * Sites model
  */
 class Sites {
-  async getSiteById ({ id, forceReload = false }) {
+  async getSiteById({ id, forceReload = false }) {
     if (forceReload) {
       await WIKI.models.sites.reloadCache()
     }
     return WIKI.sites[id]
   }
 
-  async getSiteByHostname ({ hostname, forceReload = false }) {
+  async getSiteByHostname({ hostname, forceReload = false }) {
     if (forceReload) {
       await WIKI.models.sites.reloadCache()
     }
@@ -25,10 +25,14 @@ class Sites {
     return null
   }
 
-  async reloadCache () {
+  async getAllSites() {
+    return WIKI.db.select().from(sitesTable).orderBy(sitesTable.hostname)
+  }
+
+  async reloadCache() {
     WIKI.logger.info('Reloading site configurations...')
     const sites = await WIKI.db.select().from(sitesTable).orderBy(sitesTable.id)
-    WIKI.sites = keyBy(sites, s => s.id)
+    WIKI.sites = keyBy(sites, (s) => s.id)
     WIKI.sitesMappings = {}
     for (const site of sites) {
       WIKI.sitesMappings[site.hostname] = site.id
@@ -36,105 +40,111 @@ class Sites {
     WIKI.logger.info(`Loaded ${sites.length} site configurations [ OK ]`)
   }
 
-  async createSite (hostname, config) {
+  async createSite(hostname, config) {
-    const result = await WIKI.db.insert(sitesTable).values({
+    const result = await WIKI.db
-      hostname,
+      .insert(sitesTable)
-      isEnabled: true,
+      .values({
-      config: toMerged({
+        hostname,
-        title: 'My Wiki Site',
+        isEnabled: true,
-        description: '',
+        config: toMerged(
-        company: '',
+          {
-        contentLicense: '',
+            title: 'My Wiki Site',
-        footerExtra: '',
+            description: '',
-        pageExtensions: ['md', 'html', 'txt'],
+            company: '',
-        pageCasing: true,
+            contentLicense: '',
-        discoverable: false,
+            footerExtra: '',
-        defaults: {
+            pageExtensions: ['md', 'html', 'txt'],
-          tocDepth: {
+            pageCasing: true,
-            min: 1,
+            discoverable: false,
-            max: 2
+            defaults: {
-          }
+              tocDepth: {
-        },
+                min: 1,
-        features: {
+                max: 2
-          browse: true,
+              }
-          ratings: false,
+            },
-          ratingsMode: 'off',
+            features: {
-          comments: false,
+              browse: true,
-          contributions: false,
+              ratings: false,
-          profile: true,
+              ratingsMode: 'off',
-          search: true
+              comments: false,
-        },
+              contributions: false,
-        logoUrl: '',
+              profile: true,
-        logoText: true,
+              search: true
-        sitemap: true,
+            },
-        robots: {
+            logoUrl: '',
-          index: true,
+            logoText: true,
-          follow: true
+            sitemap: true,
-        },
+            robots: {
-        locales: {
+              index: true,
-          primary: 'en',
+              follow: true
-          active: ['en']
+            },
-        },
+            locales: {
-        assets: {
+              primary: 'en',
-          logo: false,
+              active: ['en']
-          logoExt: 'svg',
+            },
-          favicon: false,
+            assets: {
-          faviconExt: 'svg',
+              logo: false,
-          loginBg: false
+              logoExt: 'svg',
-        },
+              favicon: false,
-        theme: {
+              faviconExt: 'svg',
-          dark: false,
+              loginBg: false
-          codeBlocksTheme: 'github-dark',
+            },
-          colorPrimary: '#1976D2',
+            theme: {
-          colorSecondary: '#02C39A',
+              dark: false,
-          colorAccent: '#FF9800',
+              codeBlocksTheme: 'github-dark',
-          colorHeader: '#000000',
+              colorPrimary: '#1976D2',
-          colorSidebar: '#1976D2',
+              colorSecondary: '#02C39A',
-          injectCSS: '',
+              colorAccent: '#FF9800',
-          injectHead: '',
+              colorHeader: '#000000',
-          injectBody: '',
+              colorSidebar: '#1976D2',
-          contentWidth: 'full',
+              injectCSS: '',
-          sidebarPosition: 'left',
+              injectHead: '',
-          tocPosition: 'right',
+              injectBody: '',
-          showSharingMenu: true,
+              contentWidth: 'full',
-          showPrintBtn: true,
+              sidebarPosition: 'left',
-          baseFont: 'roboto',
+              tocPosition: 'right',
-          contentFont: 'roboto'
+              showSharingMenu: true,
-        },
+              showPrintBtn: true,
-        editors: {
+              baseFont: 'roboto',
-          asciidoc: {
+              contentFont: 'roboto'
-            isActive: true,
+            },
-            config: {}
+            editors: {
-          },
+              asciidoc: {
-          markdown: {
+                isActive: true,
-            isActive: true,
+                config: {}
-            config: {
+              },
-              allowHTML: true,
+              markdown: {
-              kroki: false,
+                isActive: true,
-              krokiServerUrl: 'https://kroki.io',
+                config: {
-              latexEngine: 'katex',
+                  allowHTML: true,
-              lineBreaks: true,
+                  kroki: false,
-              linkify: true,
+                  krokiServerUrl: 'https://kroki.io',
-              multimdTable: true,
+                  latexEngine: 'katex',
-              plantuml: false,
+                  lineBreaks: true,
-              plantumlServerUrl: 'https://www.plantuml.com/plantuml/',
+                  linkify: true,
-              quotes: 'english',
+                  multimdTable: true,
-              tabWidth: 2,
+                  plantuml: false,
-              typographer: false,
+                  plantumlServerUrl: 'https://www.plantuml.com/plantuml/',
-              underline: true
+                  quotes: 'english',
+                  tabWidth: 2,
+                  typographer: false,
+                  underline: true
+                }
+              },
+              wysiwyg: {
+                isActive: true,
+                config: {}
+              }
+            },
+            uploads: {
+              conflictBehavior: 'overwrite',
+              normalizeFilename: true
             }
           },
-          wysiwyg: {
+          config
-            isActive: true,
+        )
-            config: {}
+      })
-          }
+      .returning({ id: sitesTable.id })
-        },
-        uploads: {
-          conflictBehavior: 'overwrite',
-          normalizeFilename: true
-        }
-      }, config)
-    }).returning({ id: sitesTable.id })
 
     const newSite = result[0]
 
@@ -168,21 +178,21 @@ class Sites {
     return newSite
   }
 
-  async updateSite (id, patch) {
+  async updateSite(id, patch) {
     return WIKI.db.sites.query().findById(id).patch(patch)
   }
 
-  async deleteSite (id) {
+  async deleteSite(id) {
     // await WIKI.db.storage.query().delete().where('siteId', id)
     const deletedResult = await WIKI.db.delete(sitesTable).where(eq(sitesTable.id, id))
     return Boolean(deletedResult.rowCount > 0)
   }
 
-  async countSites () {
+  async countSites() {
     return WIKI.db.$count(sitesTable)
   }
 
-  async init (ids) {
+  async init(ids) {
     WIKI.logger.info('Inserting default site...')
 
     await WIKI.db.insert(sitesTable).values({

backend/models/users.mjs

@@ -1,13 +1,19 @@
-/* global WIKI */
-
 import bcrypt from 'bcryptjs'
-import { userGroups as userGroupsTable, users as usersTable } from '../db/schema.mjs'
+import { userGroups, users as usersTable, userKeys } from '../db/schema.mjs'
+import { eq } from 'drizzle-orm'
+import { nanoid } from 'nanoid'
+import { DateTime } from 'luxon'
+import { flatten, uniq } from 'es-toolkit/array'
 
 /**
  * Users model
  */
 class Users {
-  async init (ids) {
+  async getByEmail(email) {
+    const res = await WIKI.db.select().from(usersTable).where(eq(usersTable.email, email)).limit(1)
+    return res?.[0] ?? null
+  }
+  async init(ids) {
     WIKI.logger.info('Inserting default users...')
 
     await WIKI.db.insert(usersTable).values([
@@ -60,7 +66,7 @@ class Users {
       }
     ])
 
-    await WIKI.db.insert(userGroupsTable).values([
+    await WIKI.db.insert(userGroups).values([
       {
         userId: ids.userAdminId,
         groupId: ids.groupAdminId
@@ -72,47 +78,246 @@ class Users {
     ])
   }
 
-  async login ({ siteId, strategyId, username, password, ip }) {
+  async login({ siteId, strategyId, username, password, ip }, req) {
     if (strategyId in WIKI.auth.strategies) {
-      const selStrategy = WIKI.auth.strategies[strategyId]
+      const str = WIKI.auth.strategies[strategyId]
-      if (!selStrategy.isEnabled) {
+      const strInfo = WIKI.data.authentication.find((a) => a.key === str.module)
-        throw new Error('Inactive Strategy ID')
+      const context = {
+        ip,
+        siteId,
+        ...(strInfo.useForm && {
+          username,
+          password
+        })
       }
 
-      const strInfo = WIKI.data.authentication.find(a => a.key === selStrategy.module)
+      // Authenticate
+      const user = await str.authenticate(context)
 
-      // Inject form user/pass
+      // Perform post-login checks
-      if (strInfo.useForm) {
+      return this.afterLoginChecks(
-        set(context.req, 'body.email', username)
+        user,
-        set(context.req, 'body.password', password)
+        strategyId,
-        set(context.req.params, 'strategy', strategyId)
+        context,
-      }
+        {
+          skipTFA: !strInfo.useForm,
+          skipChangePwd: !strInfo.useForm
+        },
+        req
+      )
+    } else {
+      throw new Error('Invalid Strategy ID')
+    }
+  }
 
-      // Authenticate
+  async afterLoginChecks(
-      return new Promise((resolve, reject) => {
+    user,
-        WIKI.auth.passport.authenticate(selStrategy.id, {
+    strategyId,
-          session: !strInfo.useForm,
+    context,
-          scope: strInfo.scopes ? strInfo.scopes : null
+    { skipTFA, skipChangePwd } = { skipTFA: false, skipChangePwd: false },
-        }, async (err, user, info) => {
+    req
-          if (err) { return reject(err) }
+  ) {
-          if (!user) { return reject(new WIKI.Error.AuthLoginFailed()) }
+    const str = WIKI.auth.strategies[strategyId]
-
+    if (!str) {
-          try {
+      throw new Error('ERR_INVALID_STRATEGY')
-            const resp = await WIKI.db.users.afterLoginChecks(user, selStrategy.id, context, {
+    }
-              siteId,
+
-              skipTFA: !strInfo.useForm,
+    // Get user groups
-              skipChangePwd: !strInfo.useForm
+    user.groups = await WIKI.db.query.users
-            })
+      .findFirst({
-            resolve(resp)
+        columns: {},
-          } catch (err) {
+        where: {
-            reject(err)
+          id: user.id
+        },
+        with: {
+          groups: {
+            columns: {
+              id: true,
+              permissions: true,
+              redirectOnLogin: true
+            }
           }
-        })(context.req, context.res, () => {})
+        }
       })
+      .then((r) => r?.groups || [])
+
+    // Get redirect target
+    let redirect = '/'
+    if (user.groups && user.groups.length > 0) {
+      for (const grp of user.groups) {
+        if (grp.redirectOnLogin && grp.redirectOnLogin !== '/') {
+          redirect = grp.redirectOnLogin
+          break
+        }
+      }
+    }
+
+    // Get auth strategy flags
+    const authStr = user.auth[strategyId] || {}
+
+    // Is 2FA required?
+    if (!skipTFA) {
+      if (authStr.tfaIsActive && authStr.tfaSecret) {
+        try {
+          const tfaToken = await WIKI.db.userKeys.generateToken({
+            kind: 'tfa',
+            userId: user.id,
+            meta: {
+              strategyId
+            }
+          })
+          return {
+            nextAction: 'provideTfa',
+            continuationToken: tfaToken,
+            redirect
+          }
+        } catch (errc) {
+          WIKI.logger.warn(errc)
+          throw new WIKI.Error.AuthGenericError()
+        }
+      } else if (str.config?.enforceTfa || authStr.tfaRequired) {
+        try {
+          const tfaQRImage = await user.generateTFA(strategyId, context.siteId)
+          const tfaToken = await WIKI.db.userKeys.generateToken({
+            kind: 'tfaSetup',
+            userId: user.id,
+            meta: {
+              strategyId
+            }
+          })
+          return {
+            nextAction: 'setupTfa',
+            continuationToken: tfaToken,
+            tfaQRImage,
+            redirect
+          }
+        } catch (errc) {
+          WIKI.logger.warn(errc)
+          throw new WIKI.Error.AuthGenericError()
+        }
+      }
+    }
+
+    // Must Change Password?
+    if (!skipChangePwd && authStr.mustChangePwd) {
+      try {
+        const pwdChangeToken = await this.generateToken({
+          kind: 'changePwd',
+          userId: user.id,
+          meta: {
+            strategyId
+          }
+        })
+
+        return {
+          nextAction: 'changePassword',
+          continuationToken: pwdChangeToken,
+          redirect
+        }
+      } catch (errc) {
+        WIKI.logger.warn(errc)
+        throw new WIKI.Error.AuthGenericError()
+      }
+    }
+
+    // Set Session Data
+    this.updateSession(user, req)
+
+    return {
+      authenticated: true,
+      nextAction: 'redirect',
+      redirect
+    }
+  }
+
+  async loginChangePassword({ strategyId, siteId, continuationToken, newPassword, ip }, req) {
+    if (!newPassword || newPassword.length < 8) {
+      throw new Error('ERR_PASSWORD_TOO_SHORT')
+    }
+    const { user, strategyId: expectedStrategyId } = await this.validateToken({
+      kind: 'changePwd',
+      token: continuationToken
+    })
+
+    if (strategyId !== expectedStrategyId) {
+      throw new Error('ERR_INVALID_STRATEGY')
+    }
+
+    if (user) {
+      user.auth[strategyId].password = await bcrypt.hash(newPassword, 12)
+      user.auth[strategyId].mustChangePwd = false
+      await WIKI.db.update(usersTable).set({ auth: user.auth }).where(eq(usersTable.id, user.id))
+
+      return this.afterLoginChecks(
+        user,
+        strategyId,
+        { ip, siteId },
+        { skipChangePwd: true, skipTFA: true },
+        req
+      )
     } else {
-      throw new Error('Invalid Strategy ID')
+      throw new Error('ERR_INVALID_USER')
     }
   }
+
+  updateSession(user, req) {
+    req.session.authenticated = true
+    req.session.user = {
+      id: user.id,
+      email: user.email,
+      name: user.name,
+      hasAvatar: user.hasAvatar,
+      timezone: user.prefs?.timezone,
+      dateFormat: user.prefs?.dateFormat,
+      timeFormat: user.prefs?.timeFormat,
+      appearance: user.prefs?.appearance,
+      cvd: user.prefs?.cvd
+    }
+    req.session.permissions = uniq(flatten(user.groups?.map((g) => g.permissions)))
+  }
+
+  async generateToken({ userId, kind, meta = {} }) {
+    WIKI.logger.debug(`Generating ${kind} token for user ${userId}...`)
+    const token = await nanoid()
+    await WIKI.db.insert(userKeys).values({
+      kind,
+      token,
+      meta,
+      validUntil: DateTime.utc().plus({ days: 1 }).toISO(),
+      userId
+    })
+    return token
+  }
+
+  async validateToken({ kind, token, skipDelete }) {
+    const res = await WIKI.db.query.userKeys.findFirst({
+      where: {
+        kind,
+        token
+      },
+      with: {
+        user: true
+      }
+    })
+    if (res) {
+      if (skipDelete !== true) {
+        await WIKI.db.delete(userKeys).where(eq(userKeys.id, res.id))
+      }
+      if (DateTime.utc() > DateTime.fromISO(res.validUntil)) {
+        throw new Error('ERR_EXPIRED_VALIDATION_TOKEN')
+      }
+      return {
+        ...res.meta,
+        user: res.user
+      }
+    } else {
+      throw new Error('ERR_INVALID_VALIDATION_TOKEN')
+    }
+  }
+
+  async destroyToken({ token }) {
+    return WIKI.db.delete(userKeys).where(eq(userKeys.token, token))
+  }
 }
 
 export const users = new Users()

backend/modules/authentication/local/authentication.mjs

@@ -4,42 +4,31 @@ import bcrypt from 'bcryptjs'
 // ------------------------------------
 // Local Account
 // ------------------------------------
+export default class LocalAuthentication {
+  constructor(strategyId, conf) {
+    this.strategyId = strategyId
+    this.conf = conf
+  }
 
-import { Strategy } from 'passport-local'
+  async authenticate({ username, password }) {
-
+    const user = await WIKI.models.users.getByEmail(username.toLowerCase())
-export default {
+    if (user) {
-  init (passport, strategyId, conf) {
+      const authStrategyData = user.auth[this.strategyId]
-    passport.use(strategyId,
+      if (!authStrategyData) {
-      new Strategy({
+        throw new Error('ERR_INVALID_STRATEGY')
-        usernameField: 'email',
+      } else if ((await bcrypt.compare(password, authStrategyData.password)) !== true) {
-        passwordField: 'password'
+        throw new Error('ERR_LOGIN_FAILED')
-      }, async (uEmail, uPassword, done) => {
+      } else if (!user.isActive) {
-        try {
+        throw new Error('ERR_INACTIVE_USER')
-          const user = await WIKI.db.users.query().findOne({
+      } else if (authStrategyData.restrictLogin) {
-            email: uEmail.toLowerCase()
+        throw new Error('ERR_LOGIN_RESTRICTED')
-          })
+      } else if (!user.isVerified) {
-          if (user) {
+        throw new Error('ERR_USER_NOT_VERIFIED')
-            const authStrategyData = user.auth[strategyId]
+      } else {
-            if (!authStrategyData) {
+        return user
-              throw new Error('ERR_INVALID_STRATEGY')
+      }
-            } else if (await bcrypt.compare(uPassword, authStrategyData.password) !== true) {
+    } else {
-              throw new Error('ERR_LOGIN_FAILED')
+      throw new Error('ERR_LOGIN_FAILED')
-            } else if (!user.isActive) {
+    }
-              throw new Error('ERR_INACTIVE_USER')
-            } else if (authStrategyData.restrictLogin) {
-              throw new Error('ERR_LOGIN_RESTRICTED')
-            } else if (!user.isVerified) {
-              throw new Error('ERR_USER_NOT_VERIFIED')
-            } else {
-              done(null, user)
-            }
-          } else {
-            throw new Error('ERR_LOGIN_FAILED')
-          }
-        } catch (err) {
-          done(err, null)
-        }
-      })
-    )
   }
 }

backend/package-lock.json

@@ -29,6 +29,7 @@
         "es-toolkit": "1.45.1",
         "fastify": "5.7.1",
         "fastify-favicon": "5.0.0",
+        "filesize": "11.0.13",
         "js-yaml": "4.1.1",
         "luxon": "3.7.2",
         "mime": "4.1.0",
@@ -3124,6 +3125,15 @@
         "reusify": "^1.0.4"
       }
     },
+    "node_modules/filesize": {
+      "version": "11.0.13",
+      "resolved": "https://registry.npmjs.org/filesize/-/filesize-11.0.13.tgz",
+      "integrity": "sha512-mYJ/qXKvREuO0uH8LTQJ6v7GsUvVOguqxg2VTwQUkyTPXXRRWPdjuUPVqdBrJQhvci48OHlNGRnux+Slr2Rnvw==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">= 10.8.0"
+      }
+    },
     "node_modules/fill-range": {
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",

backend/package.json

@@ -58,6 +58,7 @@
     "es-toolkit": "1.45.1",
     "fastify": "5.7.1",
     "fastify-favicon": "5.0.0",
+    "filesize": "11.0.13",
     "js-yaml": "4.1.1",
     "luxon": "3.7.2",
     "mime": "4.1.0",

config.sample.yml

@@ -105,5 +105,7 @@ scheduler:
 # Settings when running in dev mode only
 
 dev:
+  dropSchema: false
+  logQueries: false
   port: 3001
   hmrClientPort: 3001

frontend/.oxfmtrc.json

@@ -1,9 +0,0 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "semi": false,
-  "singleQuote": true,
-  "trailingComma": "none",
-  "bracketSameLine": true,
-  "endOfLine": "lf",
-  "insertFinalNewline": true
-}

frontend/src/App.vue

@@ -124,9 +124,9 @@ router.beforeEach(async (to, from) => {
   commonStore.routerLoading = true
 
   // -> Init Auth Token
-  if (userStore.token && !userStore.authenticated) {
+  // if (userStore.token && !userStore.authenticated) {
-    userStore.loadToken()
+  //   userStore.loadToken()
-  }
+  // }
 
   // -> System Flags
   if (!flagsStore.loaded) {
@@ -147,8 +147,8 @@ router.beforeEach(async (to, from) => {
   applyLocale(commonStore.desiredLocale)
 
   // -> User Profile
-  if (userStore.authenticated && !userStore.profileLoaded) {
+  if (!userStore.profileLoaded) {
-    console.info(`Refreshing user ${userStore.id} profile...`)
+    console.info(`Refreshing user profile...`)
     await userStore.refreshProfile()
   }
 

frontend/src/boot/api.js

@@ -2,7 +2,7 @@ import ky from 'ky'
 
 import { useUserStore } from '@/stores/user'
 
-export function initializeApi (store) {
+export function initializeApi(store) {
   const userStore = useUserStore(store)
 
   let refreshPromise = null
@@ -10,7 +10,7 @@ export function initializeApi (store) {
 
   const client = ky.create({
     prefixUrl: '/_api',
-    credentials: 'omit',
+    credentials: 'same-origin',
     hooks: {
       beforeRequest: [
         async (request) => {
@@ -24,7 +24,7 @@ export function initializeApi (store) {
           if (!userStore.isTokenValid({ minutes: 1 })) {
             if (!fetching) {
               refreshPromise = new Promise((resolve, reject) => {
-                (async () => {
+                ;(async () => {
                   fetching = true
                   try {
                     await userStore.refreshToken()

frontend/src/components/AuthLoginPanel.vue

@@ -556,7 +556,6 @@ async function handleLoginResponse (resp) {
       $q.loading.show({
         message: t('auth.loginSuccess')
       })
-      Cookies.set('jwt', resp.jwt, { expires: 365, path: '/', sameSite: 'Lax' })
       setTimeout(() => {
         const loginRedirect = Cookies.get('loginRedirect')
         if (loginRedirect === '/' && resp.redirect) {
@@ -595,20 +594,22 @@ async function login () {
     if (!isFormValid) {
       throw new Error(t('auth.errors.login'))
     }
-    const resp = await API_CLIENT.post(`sites/${siteStore.id}/auth/login`, {
+    const resp = await API_CLIENT.put(`sites/${siteStore.id}/auth/login`, {
       json: {
         strategyId: state.selectedStrategyId,
         username: state.username,
         password: state.password
-      }
+      },
+      throwHttpErrors: (statusNumber) => statusNumber > 400 // Don't throw for 400
     }).json()
-    if (resp.operation?.succeeded) {
+    if (resp.ok) {
       state.password = ''
       handleLoginResponse(resp)
     } else {
-      throw new Error(resp.operation?.message || t('auth.errors.loginError'))
+      throw new Error(resp.message || t('auth.errors.loginError'))
     }
   } catch (err) {
+    console.warn(err)
     $q.loading.hide()
     $q.notify({
       type: 'negative',
@@ -778,48 +779,23 @@ async function changePwd () {
     if (!isFormValid) {
       throw new Error(t('auth.errors.register'))
     }
-    const resp = await APOLLO_CLIENT.mutate({
+    const resp = await API_CLIENT.put(`sites/${siteStore.id}/auth/changePassword`, {
-      mutation: `
+      json: {
-        mutation (
-          $continuationToken: String
-          $newPassword: String!
-          $strategyId: UUID!
-          $siteId: UUID!
-        ) {
-          changePassword (
-            continuationToken: $continuationToken
-            newPassword: $newPassword
-            strategyId: $strategyId
-            siteId: $siteId
-          ) {
-            operation {
-              succeeded
-              message
-            }
-            jwt
-            nextAction
-            continuationToken
-            redirect
-            tfaQRImage
-          }
-        }
-      `,
-      variables: {
-        continuationToken: state.continuationToken,
-        newPassword: state.newPassword,
         strategyId: state.selectedStrategyId,
-        siteId: siteStore.id
+        continuationToken: state.continuationToken,
-      }
+        newPassword: state.newPassword
-    })
+      },
-    if (resp.data?.changePassword?.operation?.succeeded) {
+      throwHttpErrors: (statusNumber) => statusNumber > 400 // Don't throw for 400
+    }).json()
+    if (resp.ok) {
       state.password = ''
       $q.notify({
         type: 'positive',
         message: t('auth.changePwd.success')
       })
-      await handleLoginResponse(resp.data.changePassword)
+      await handleLoginResponse(resp)
     } else {
-      throw new Error(resp.data?.changePassword?.operation?.message || t('auth.errors.loginError'))
+      throw new Error(resp.message || t('auth.errors.loginError'))
     }
   } catch (err) {
     $q.notify({

frontend/src/pages/AdminSystem.vue

@@ -260,7 +260,7 @@ const platformLogo = computed(() => {
     case 'darwin':
       return 'apple-logo'
     case 'linux':
-      if (this.info.operatingSystem.indexOf('Ubuntu') >= 0) {
+      if (state.info.operatingSystem.indexOf('Ubuntu') >= 0) {
         return 'ubuntu'
       } else {
         return 'linux'
@@ -292,30 +292,7 @@ const clientViewport = computed(() => {
 async function load () {
   state.loading++
   $q.loading.show()
-  const resp = await APOLLO_CLIENT.query({
+  state.info = await API_CLIENT.get('system/info').json()
-    query: `
-      query getSystemInfo {
-        systemInfo {
-          configFile
-          cpuCores
-          currentVersion
-          dbHost
-          dbVersion
-          hostname
-          latestVersion
-          latestVersionReleaseDate
-          nodeVersion
-          operatingSystem
-          platform
-          ramTotal
-          upgradeCapable
-          workingDirectory
-        }
-      }
-    `,
-    fetchPolicy: 'network-only'
-  })
-  state.info = cloneDeep(resp?.data?.systemInfo)
   $q.loading.hide()
   state.loading--
 }

frontend/src/stores/admin.js

@@ -3,8 +3,6 @@ import { defineStore } from 'pinia'
 import { clone, cloneDeep, sortBy } from 'lodash-es'
 import semverGte from 'semver/functions/gte'
 
-/* global APOLLO_CLIENT */
-
 export const useAdminStore = defineStore('admin', {
   state: () => ({
     currentSiteId: null,
@@ -23,80 +21,41 @@ export const useAdminStore = defineStore('admin', {
     overlay: null,
     overlayOpts: {},
     sites: [],
-    locales: [
+    locales: [{ code: 'en', name: 'English' }]
-      { code: 'en', name: 'English' }
-    ]
   }),
   getters: {
     isVersionLatest: (state) => {
-      if (!state.info.currentVersion || !state.info.latestVersion || state.info.currentVersion === 'n/a' || state.info.latestVersion === 'n/a') {
+      if (
+        !state.info.currentVersion ||
+        !state.info.latestVersion ||
+        state.info.currentVersion === 'n/a' ||
+        state.info.latestVersion === 'n/a'
+      ) {
         return false
       }
       return semverGte(state.info.currentVersion, state.info.latestVersion)
     }
   },
   actions: {
-    async fetchLocales () {
+    async fetchLocales() {
-      const resp = await APOLLO_CLIENT.query({
+      const resp = await API_CLIENT.get('locales').json()
-        query: `
+      this.locales = sortBy(cloneDeep(resp ?? []), ['nativeName', 'name'])
-          query getAdminLocales {
-            locales {
-              code
-              language
-              name
-              nativeName
-            }
-          }
-        `
-      })
-      this.locales = sortBy(cloneDeep(resp?.data?.locales ?? []), ['nativeName', 'name'])
     },
-    async fetchInfo () {
+    async fetchInfo() {
-      const resp = await APOLLO_CLIENT.query({
+      const resp = await API_CLIENT.get('system/info').json()
-        query: `
+      this.info.groupsTotal = clone(resp?.groupsTotal ?? 0)
-          query getAdminInfo {
+      this.info.tagsTotal = clone(resp?.tagsTotal ?? 0)
-            apiState
+      this.info.usersTotal = clone(resp?.usersTotal ?? 0)
-            metricsState
+      this.info.loginsPastDay = clone(resp?.loginsPastDay ?? 0)
-            systemInfo {
+      this.info.currentVersion = clone(resp?.currentVersion ?? 'n/a')
-              groupsTotal
+      this.info.latestVersion = clone(resp?.latestVersion ?? 'n/a')
-              tagsTotal
+      this.info.isApiEnabled = clone(resp?.apiState ?? false)
-              usersTotal
+      this.info.isMetricsEnabled = clone(resp?.metricsState ?? false)
-              loginsPastDay
+      this.info.isMailConfigured = clone(resp?.isMailConfigured ?? false)
-              currentVersion
+      this.info.isSchedulerHealthy = clone(resp?.isSchedulerHealthy ?? false)
-              latestVersion
-              isMailConfigured
-              isSchedulerHealthy
-            }
-          }
-        `,
-        fetchPolicy: 'network-only'
-      })
-      this.info.groupsTotal = clone(resp?.data?.systemInfo?.groupsTotal ?? 0)
-      this.info.tagsTotal = clone(resp?.data?.systemInfo?.tagsTotal ?? 0)
-      this.info.usersTotal = clone(resp?.data?.systemInfo?.usersTotal ?? 0)
-      this.info.loginsPastDay = clone(resp?.data?.systemInfo?.loginsPastDay ?? 0)
-      this.info.currentVersion = clone(resp?.data?.systemInfo?.currentVersion ?? 'n/a')
-      this.info.latestVersion = clone(resp?.data?.systemInfo?.latestVersion ?? 'n/a')
-      this.info.isApiEnabled = clone(resp?.data?.apiState ?? false)
-      this.info.isMetricsEnabled = clone(resp?.data?.metricsState ?? false)
-      this.info.isMailConfigured = clone(resp?.data?.systemInfo?.isMailConfigured ?? false)
-      this.info.isSchedulerHealthy = clone(resp?.data?.systemInfo?.isSchedulerHealthy ?? false)
     },
-    async fetchSites () {
+    async fetchSites() {
-      const resp = await APOLLO_CLIENT.query({
+      this.sites = (await API_CLIENT.get('sites').json()) ?? []
-        query: `
-          query getSites {
-            sites {
-              id
-              hostname
-              isEnabled
-              title
-            }
-          }
-        `,
-        fetchPolicy: 'network-only'
-      })
-      this.sites = cloneDeep(resp?.data?.sites ?? [])
       if (!this.currentSiteId) {
         this.currentSiteId = this.sites[0].id
       }

frontend/src/stores/user.js

@@ -21,10 +21,7 @@ export const useUserStore = defineStore('user', {
     cvd: 'none',
     permissions: [],
     pagePermissions: [],
-    iat: 0,
-    exp: null,
     authenticated: false,
-    token: Cookies.get('jwt'),
     profileLoaded: false
   }),
   getters: {
@@ -40,162 +37,93 @@ export const useUserStore = defineStore('user', {
     }
   },
   actions: {
-    isTokenValid (offset) {
+    async refreshProfile() {
-      return this.exp && this.exp > (offset ? DateTime.now().plus(offset) : DateTime.now())
-    },
-    loadToken () {
-      if (!this.token) { return }
       try {
-        const jwtData = jwtDecode(this.token)
+        const resp = await API_CLIENT.get('users/whoami', {
-        this.id = jwtData.id
+          cache: 'no-store'
-        this.email = jwtData.email
+        }).json()
-        this.iat = jwtData.iat
+        if (!resp || !resp.authenticated) {
-        this.exp = DateTime.fromSeconds(jwtData.exp, { zone: 'utc' })
+          this.setToGuest()
-        if (this.exp > DateTime.utc()) {
-          this.authenticated = true
         } else {
-          console.info('Token has expired and will be refreshed on next query.')
+          this.$patch({
-        }
+            name: resp.name || 'Unknown User',
-      } catch (err) {
+            email: resp.email,
-        console.warn('Failed to parse JWT. Invalid or malformed.')
+            hasAvatar: resp.hasAvatar ?? false,
-      }
+            location: resp.location || '',
-    },
+            jobTitle: resp.jobTitle || '',
-    async refreshToken () {
+            pronouns: resp.pronouns || '',
-      try {
+            timezone: resp.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone || '',
-        const respRaw = await APOLLO_CLIENT.mutate({
+            dateFormat: resp.dateFormat || '',
-          context: {
+            timeFormat: resp.timeFormat || '12h',
-            skipAuth: true
+            appearance: resp.appearance || 'site',
-          },
+            cvd: resp.cvd || 'none',
-          mutation: `
+            permissions: resp.permissions || [],
-            mutation refreshToken (
+            authenticated: true,
-              $token: String!
+            profileLoaded: true
-            ) {
+          })
-              refreshToken(token: $token) {
-                operation {
-                  succeeded
-                  message
-                }
-                jwt
-              }
-            }
-          `,
-          variables: {
-            token: this.token
-          }
-        })
-        const resp = respRaw?.data?.refreshToken ?? {}
-        if (!resp.operation?.succeeded) {
-          throw new Error(resp.operation?.message || 'Failed to refresh token.')
         }
-        Cookies.set('jwt', resp.jwt, { expires: 365, path: '/', sameSite: 'Lax' })
-        this.token = resp.jwt
-        this.loadToken()
-        return true
       } catch (err) {
         console.warn(err)
-        return false
       }
     },
-    async refreshProfile () {
+    async logout() {
-      if (!this.authenticated || !this.id) {
+      const siteStore = useSiteStore()
-        return
+      await API_CLIENT.get(`sites/${siteStore.id}/auth/logout`).json()
-      }
+      this.setToGuest()
-      try {
+      EVENT_BUS.emit('logout')
-        const respRaw = await APOLLO_CLIENT.query({
-          query: `
-            query refreshProfile (
-              $id: UUID!
-            ) {
-              userById(id: $id) {
-                id
-                name
-                email
-                hasAvatar
-                meta
-                prefs
-                lastLoginAt
-                groups {
-                  id
-                  name
-                }
-              }
-              userPermissions
-            }
-          `,
-          variables: {
-            id: this.id
-          }
-        })
-        const resp = respRaw?.data?.userById
-        if (!resp || resp.id !== this.id) {
-          throw new Error('Failed to fetch user profile!')
-        }
-        this.name = resp.name || 'Unknown User'
-        this.email = resp.email
-        this.hasAvatar = resp.hasAvatar ?? false
-        this.location = resp.meta.location || ''
-        this.jobTitle = resp.meta.jobTitle || ''
-        this.pronouns = resp.meta.pronouns || ''
-        this.timezone = resp.prefs.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone || ''
-        this.dateFormat = resp.prefs.dateFormat || ''
-        this.timeFormat = resp.prefs.timeFormat || '12h'
-        this.appearance = resp.prefs.appearance || 'site'
-        this.cvd = resp.prefs.cvd || 'none'
-        this.permissions = respRaw.data.userPermissions || []
-        this.profileLoaded = true
-      } catch (err) {
-        console.warn(err)
-      }
     },
-    logout () {
+    setToGuest() {
-      Cookies.remove('jwt', { path: '/' })
       this.$patch({
         id: '10000000-0000-4000-8000-000000000001',
         email: '',
         name: '',
         hasAvatar: false,
-        localeCode: '',
         timezone: '',
         dateFormat: 'YYYY-MM-DD',
         timeFormat: '12h',
         appearance: 'site',
         cvd: 'none',
         permissions: [],
-        iat: 0,
-        exp: null,
         authenticated: false,
-        token: '',
         profileLoaded: false
       })
-      EVENT_BUS.emit('logout')
     },
-    getAccessibleColor (base, hexBase) {
+    getAccessibleColor(base, hexBase) {
       return getAccessibleColor(base, hexBase, this.cvd)
     },
-    can (permission) {
+    can(permission) {
-      if (this.permissions.includes('manage:system') || this.permissions.includes(permission) || this.pagePermissions.includes(permission)) {
+      if (
+        this.permissions.includes('manage:system') ||
+        this.permissions.includes(permission) ||
+        this.pagePermissions.includes(permission)
+      ) {
         return true
       }
       return false
     },
-    async fetchPagePermissions (path) {
+    async fetchPagePermissions(path) {
       if (path.startsWith('/_')) {
         this.pagePermissions = []
         return
       }
       const siteStore = useSiteStore()
       try {
-        this.pagePermissions = await API_CLIENT.post(`sites/${siteStore.id}/pages/userPermissions`, {
+        this.pagePermissions = await API_CLIENT.post(
-          json: {
+          `sites/${siteStore.id}/pages/userPermissions`,
-            path
+          {
+            json: {
+              path
+            }
           }
-        }).json()
+        ).json()
       } catch (err) {
         console.warn(`Failed to fetch page permissions at path ${path}!`)
       }
     },
-    formatDateTime (t, date) {
+    formatDateTime(t, date) {
-      return (typeof date === 'string' ? DateTime.fromISO(date) : date).toFormat(t('common.datetime', { date: this.preferredDateFormat, time: this.preferredTimeFormat }))
+      return (typeof date === 'string' ? DateTime.fromISO(date) : date).toFormat(
+        t('common.datetime', { date: this.preferredDateFormat, time: this.preferredTimeFormat })
+      )
     }
   }
 })