From 32f1e92df00bd50d9474f27387d866581530633e Mon Sep 17 00:00:00 2001
From: Bernd Storath <999999bst@gmail.com>
Date: Thu, 12 Sep 2024 15:49:45 +0200
Subject: [PATCH] rewrite middleware logic, support basic auth

---
 CHANGELOG.md                                |  9 +++
 README.md                                   |  5 +-
 src/app/components/ui/UserMenu.vue          |  8 +++
 src/app/pages/admin.vue                     |  4 +-
 src/app/pages/admin/features.vue            |  2 -
 src/app/pages/me.vue                        |  8 +++
 src/app/utils/api.ts                        |  2 +-
 src/server/api/{ => admin}/features.post.ts |  0
 src/server/middleware/auth.ts               | 18 +++--
 src/server/middleware/session.ts            | 79 ++++++++++++++++-----
 src/server/middleware/setup.ts              | 20 ++++--
 src/server/utils/session.ts                 |  6 +-
 src/services/database/migrations/1.ts       |  2 +-
 13 files changed, 120 insertions(+), 43 deletions(-)
 create mode 100644 src/app/pages/me.vue
 rename src/server/api/{ => admin}/features.post.ts (100%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e842e6bc..d4b50efa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,15 @@ This update is an entire rewrite to make it even easier to set up your own VPN.
 
 - Almost all Environment variables removed
 - New and Improved UI
+- API Basic Authentication
+- Added Docs
+- Incrementing Version -> Semantic Versioning
+- CIDR Support
+- IPv6 Support
+- Changed API Structure
+- Changed Database Structure
+- Deprecated Dockerless Installations
+- Added Docker Volume Mount
 
 ## Minor Changes
 
diff --git a/README.md b/README.md
index 421fdda5..f89b57b7 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,8 @@ And log in again.
 
 ### 2. Run WireGuard Easy
 
+<!-- TODO: prioritize docker compose over docker run -->
+
 To setup the IPv6 Network, simply run once:
 
 ```bash
@@ -82,6 +84,7 @@ To automatically install & run wg-easy, simply run:
   --ip6 fdcc:ad94:bacf:61a3::2a \
   --ip 10.42.42.42 \
   -v ~/.wg-easy:/etc/wireguard \
+  -v /lib/modules:/lib/modules:ro \
   -p 51820:51820/udp \
   -p 51821:51821/tcp \
   --cap-add NET_ADMIN \
@@ -97,7 +100,7 @@ To automatically install & run wg-easy, simply run:
 
 The Web UI will now be available on `http://0.0.0.0:51821`.
 
-The Prometheus metrics will now be available on `http://0.0.0.0:51821/metrics`. Grafana dashboard [21733](https://grafana.com/grafana/dashboards/21733-wireguard/)
+The Prometheus metrics will now be available on `http://0.0.0.0:51821/api/metrics`. Grafana dashboard [21733](https://grafana.com/grafana/dashboards/21733-wireguard/)
 
 > 💡 Your configuration files will be saved in `~/.wg-easy`
 
diff --git a/src/app/components/ui/UserMenu.vue b/src/app/components/ui/UserMenu.vue
index 43d79190..fff240ae 100644
--- a/src/app/components/ui/UserMenu.vue
+++ b/src/app/components/ui/UserMenu.vue
@@ -36,6 +36,14 @@
             Clients
           </NuxtLink>
         </DropdownMenuItem>
+        <DropdownMenuItem>
+          <NuxtLink
+            to="/me"
+            class="block px-4 py-2 hover:bg-gray-100 dark:hover:bg-gray-600 dark:hover:text-white"
+          >
+            Account
+          </NuxtLink>
+        </DropdownMenuItem>
         <DropdownMenuItem v-if="authStore.userData?.role === 'ADMIN'">
           <NuxtLink
             to="/admin"
diff --git a/src/app/pages/admin.vue b/src/app/pages/admin.vue
index 08178943..e9429d14 100644
--- a/src/app/pages/admin.vue
+++ b/src/app/pages/admin.vue
@@ -42,8 +42,8 @@ const route = useRoute();
 
 const menuItems = [
   { id: 'features', name: 'Features' },
-  { id: 'user', name: 'User' },
-  { id: 'server', name: 'Server' },
+  { id: 'statistics', name: 'Statistics' },
+  { id: 'metrics', name: 'Metrics' },
 ];
 
 const activeMenuItem = computed(() => {
diff --git a/src/app/pages/admin/features.vue b/src/app/pages/admin/features.vue
index f84e5f2e..1593356c 100644
--- a/src/app/pages/admin/features.vue
+++ b/src/app/pages/admin/features.vue
@@ -33,8 +33,6 @@
 </template>
 
 <script setup lang="ts">
-import type { UiToast } from '#build/components';
-
 const globalStore = useGlobalStore();
 const open = ref(false);
 
diff --git a/src/app/pages/me.vue b/src/app/pages/me.vue
new file mode 100644
index 00000000..2e41e632
--- /dev/null
+++ b/src/app/pages/me.vue
@@ -0,0 +1,8 @@
+<template>
+  <main>
+    <p>Change Username:</p>
+    <p>Change Name:</p>
+    <p>Change E-Mail:</p>
+    <p>Change Password:</p>
+  </main>
+</template>
diff --git a/src/app/utils/api.ts b/src/app/utils/api.ts
index 4994caa5..b816e0c3 100644
--- a/src/app/utils/api.ts
+++ b/src/app/utils/api.ts
@@ -147,7 +147,7 @@ class API {
   }
 
   async updateFeatures(features: Record<string, { enabled: boolean }>) {
-    return $fetch('/api/features', {
+    return $fetch('/api/admin/features', {
       method: 'post',
       body: { features },
     });
diff --git a/src/server/api/features.post.ts b/src/server/api/admin/features.post.ts
similarity index 100%
rename from src/server/api/features.post.ts
rename to src/server/api/admin/features.post.ts
diff --git a/src/server/middleware/auth.ts b/src/server/middleware/auth.ts
index 7ab156f0..5277a51e 100644
--- a/src/server/middleware/auth.ts
+++ b/src/server/middleware/auth.ts
@@ -2,22 +2,26 @@ export default defineEventHandler(async (event) => {
   const url = getRequestURL(event);
   const session = await useWGSession(event);
 
+  // Api handled by session, Setup handled with setup middleware
+  if (url.pathname.startsWith('/api/') || url.pathname.startsWith('/setup')) {
+    return;
+  }
+
   if (url.pathname === '/login') {
     if (session.data.userId) {
       return sendRedirect(event, '/', 302);
     }
+    return;
   }
 
-  if (url.pathname === '/') {
-    if (!session.data.userId) {
-      return sendRedirect(event, '/login', 302);
-    }
+  // Require auth for every page other than Login
+  // TODO: investigate /__nuxt_error (error page when unauthenticated)
+  if (!session.data.userId) {
+    console.log(url.pathname);
+    return sendRedirect(event, '/login', 302);
   }
 
   if (url.pathname.startsWith('/admin')) {
-    if (!session.data.userId) {
-      return sendRedirect(event, '/login', 302);
-    }
     const user = await Database.user.findById(session.data.userId);
     if (!user) {
       return sendRedirect(event, '/login', 302);
diff --git a/src/server/middleware/session.ts b/src/server/middleware/session.ts
index 5a8c063c..587dbb91 100644
--- a/src/server/middleware/session.ts
+++ b/src/server/middleware/session.ts
@@ -1,5 +1,9 @@
+import type { User } from '~~/services/database/repositories/user';
+
 export default defineEventHandler(async (event) => {
   const url = getRequestURL(event);
+  // If one method of a route is public, every method is public!
+  // Handle api routes
   if (
     !url.pathname.startsWith('/api/') ||
     url.pathname === '/api/account/setup' ||
@@ -13,36 +17,73 @@ export default defineEventHandler(async (event) => {
   const system = await Database.system.get();
 
   const session = await getSession<WGSession>(event, system.sessionConfig);
-  if (session.id && session.data.userId) {
-    return;
-  }
-
   const authorization = getHeader(event, 'Authorization');
-  if (url.pathname.startsWith('/api/') && authorization) {
+
+  let user: User | undefined = undefined;
+  if (session.data.userId) {
+    // Handle if authenticating using Session
+    user = await Database.user.findById(session.data.userId);
+  } else if (authorization) {
+    // Handle if authenticating using Header
+    const [method, value] = authorization.split(' ');
+    // Support Basic Authentication
+    // TODO: support personal access token or similar
+    if (method !== 'Basic' || !value) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: 'Session failed',
+      });
+    }
+
+    const basicValue = Buffer.from(value, 'base64').toString('utf-8');
+
+    // Split by first ":"
+    const index = basicValue.indexOf(':');
+    const username = basicValue.substring(0, index);
+    const password = basicValue.substring(index + 1);
+
+    if (!username || !password) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: 'Session failed',
+      });
+    }
+
     const users = await Database.user.findAll();
-    const user = users.find((user) => user.id == session.data.userId);
-    if (!user)
+    const foundUser = users.find((v) => v.username === username);
+
+    if (!foundUser) {
       throw createError({
         statusCode: 401,
         statusMessage: 'Session failed',
       });
+    }
+
+    const userHashPassword = foundUser.password;
+    const passwordValid = await isPasswordValid(password, userHashPassword);
 
-    const userHashPassword = user.password;
-    const passwordValid = await isPasswordValid(
-      authorization,
-      userHashPassword
-    );
-    if (passwordValid) {
-      return;
+    if (!passwordValid) {
+      throw createError({
+        statusCode: 401,
+        statusMessage: 'Incorrect Password',
+      });
     }
+    user = foundUser;
+  }
+
+  if (!user) {
     throw createError({
       statusCode: 401,
-      statusMessage: 'Incorrect Password',
+      statusMessage: 'Not logged in',
     });
   }
 
-  throw createError({
-    statusCode: 401,
-    statusMessage: 'Not logged in',
-  });
+  if (url.pathname.startsWith('/api/admin')) {
+    if (user.role !== 'ADMIN') {
+      throw createError({
+        statusCode: 403,
+        statusMessage: 'Missing Permissions',
+      });
+    }
+  }
 });
diff --git a/src/server/middleware/setup.ts b/src/server/middleware/setup.ts
index cb115a37..32d3278d 100644
--- a/src/server/middleware/setup.ts
+++ b/src/server/middleware/setup.ts
@@ -2,24 +2,30 @@
 export default defineEventHandler(async (event) => {
   const url = getRequestURL(event);
 
-  // TODO: redirect to login page if already set up
-
-  if (
-    url.pathname === '/setup' ||
-    url.pathname === '/api/account/setup' ||
-    url.pathname === '/api/features'
-  ) {
+  // User can't be logged in, and public routes can be accessed whenever
+  if (url.pathname.startsWith('/api/')) {
     return;
   }
 
   const users = await Database.user.findAll();
   if (users.length === 0) {
+    // If not setup
+    if (url.pathname.startsWith('/setup')) {
+      return;
+    }
     if (url.pathname.startsWith('/api/')) {
       throw createError({
         statusCode: 400,
         statusMessage: 'Invalid State',
       });
     }
+    console.log(url.pathname);
     return sendRedirect(event, '/setup', 302);
+  } else {
+    // If already set up
+    if (!url.pathname.startsWith('/setup')) {
+      return;
+    }
+    return sendRedirect(event, '/login', 302);
   }
 });
diff --git a/src/server/utils/session.ts b/src/server/utils/session.ts
index bb0ec9c8..1058f9cc 100644
--- a/src/server/utils/session.ts
+++ b/src/server/utils/session.ts
@@ -1,10 +1,10 @@
 import type { H3Event } from 'h3';
 
-export type WGSession = {
+export type WGSession = Partial<{
   userId: string;
-};
+}>;
 
 export async function useWGSession(event: H3Event) {
   const system = await Database.system.get();
-  return useSession<Partial<WGSession>>(event, system.sessionConfig);
+  return useSession<WGSession>(event, system.sessionConfig);
 }
diff --git a/src/services/database/migrations/1.ts b/src/services/database/migrations/1.ts
index 39a9c6c2..cd72fd3b 100644
--- a/src/services/database/migrations/1.ts
+++ b/src/services/database/migrations/1.ts
@@ -62,6 +62,7 @@ export async function run1(db: Low<Database>) {
         password: null,
       },
       sessionConfig: {
+        // TODO: be able to invalidate all sessions
         password: getRandomHex(256),
         name: 'wg-easy',
         cookie: {},
@@ -71,7 +72,6 @@ export async function run1(db: Low<Database>) {
     clients: {},
   };
 
-  // TODO: properly check if ipv6 support
   database.system.iptables.PostUp =
     `iptables -t nat -A POSTROUTING -s ${database.system.userConfig.address4Range} -o ${database.system.wgDevice} -j MASQUERADE;
 iptables -A INPUT -p udp -m udp --dport ${database.system.wgPort} -j ACCEPT;