thandClaude Opus 4.7
d83de30d6d
Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so existing user secrets, stored messages, and inter-tenant key keep working. Old clients and relays lose cross-version chat until both sides are upgraded. Relay - Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived per-ciphertext salts; keep CBC-V1 fallback on decrypt only. - On-bootstrap migration re-envelopes tenant secret_encrypted and the inter-tenant key to GCM-V2 (idempotent). - CORS: stop reflecting arbitrary Origin; allow own origin + optional RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials. - Generic error messages replace "no such user: <name>" enumeration. - Exception messages no longer echoed back; logged server-side. - Collab-lock max hold capped at 10min so a member can't grief-refresh forever. - Attachment filenames validated against hex.<ext> pattern. - Passwords min length 10; /api/account/password rate-limited. App / Electron client - Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read). - Chat + collab-buckets plugins delegate to the shared helpers. - Poll + push + attachments migrated to the dual-format path. - /api/relay/settings GET returns has_key boolean; secret never echoed. - Setup endpoint now CSRF-checked. - SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks favicon fetch also blocks private/loopback/link-local. - Login / password-change rate limiter moved to DB-backed IP keying. - Passwords min length 10 throughout. - Zip import enforces per-file (25MB) and total (500MB) caps, extension allowlist, no-overwrite. - Verbose relay-push debug gated behind APP_DEBUG env. Version bumped to 2.0.0 (protocol-breaking). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
77 lines
3.2 KiB
PHP
77 lines
3.2 KiB
PHP
<?php
|
|
// Account routes — every logged-in user manages their own client secret
|
|
// here. The admin never sees or sets it.
|
|
//
|
|
// GET /api/account/secret show plaintext (decrypted via master key)
|
|
// POST /api/account/secret set/replace (body: {secret} or {generate:true})
|
|
// DELETE /api/account/secret clear (disconnects all clients)
|
|
|
|
if (!defined('RELAY_BOOTSTRAPPED')) { http_response_code(404); exit; }
|
|
|
|
// $sessionTenant comes from routes/public.php earlier in the chain
|
|
|
|
if ($route === '/api/account/secret' && $method === 'GET') {
|
|
if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
|
|
if (empty($sessionTenant['secret_encrypted'])) {
|
|
jsonResponse(['has_secret' => false]);
|
|
}
|
|
$plain = masterDecrypt($sessionTenant['secret_encrypted'], $MASTER_KEY);
|
|
jsonResponse(['has_secret' => true, 'secret' => $plain]);
|
|
}
|
|
|
|
if ($route === '/api/account/secret' && $method === 'POST') {
|
|
if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
|
|
$input = json_decode(file_get_contents('php://input'), true) ?: [];
|
|
|
|
// Either accept a user-supplied secret OR generate a random one
|
|
if (!empty($input['generate'])) {
|
|
$secret = bin2hex(random_bytes(24)); // 48-char hex
|
|
} else {
|
|
$secret = (string)($input['secret'] ?? '');
|
|
if (strlen($secret) < 8) {
|
|
jsonResponse(['error' => 'secret must be at least 8 chars'], 400);
|
|
}
|
|
}
|
|
|
|
$db->prepare('UPDATE tenants SET secret_hash = :sh, secret_encrypted = :se WHERE id = :id')
|
|
->execute([
|
|
'sh' => password_hash($secret, PASSWORD_BCRYPT),
|
|
'se' => masterEncrypt($secret, $MASTER_KEY),
|
|
'id' => $sessionTenant['id'],
|
|
]);
|
|
|
|
jsonResponse(['ok' => true, 'secret' => $secret]);
|
|
}
|
|
|
|
if ($route === '/api/account/secret' && $method === 'DELETE') {
|
|
if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
|
|
$db->prepare('UPDATE tenants SET secret_hash = NULL, secret_encrypted = NULL WHERE id = :id')
|
|
->execute(['id' => $sessionTenant['id']]);
|
|
jsonResponse(['ok' => true]);
|
|
}
|
|
|
|
if ($route === '/api/account/password' && $method === 'POST') {
|
|
if (!$sessionTenant) jsonResponse(['error' => 'not logged in'], 401);
|
|
// Rate-limit password changes — a stolen session cookie could otherwise
|
|
// brute-force the `current` field server-side with no friction.
|
|
if (isRateLimited($db, 'account-password', 10)) jsonResponse(['error' => 'too many attempts'], 429);
|
|
$input = json_decode(file_get_contents('php://input'), true) ?: [];
|
|
$current = (string)($input['current'] ?? '');
|
|
$new = (string)($input['new'] ?? '');
|
|
|
|
if (strlen($new) < 10) jsonResponse(['error' => 'new password must be at least 10 chars'], 400);
|
|
if (!password_verify($current, $sessionTenant['password_hash'])) {
|
|
jsonResponse(['error' => 'current password is wrong'], 401);
|
|
}
|
|
if ($current === $new) {
|
|
jsonResponse(['error' => 'new password must differ from current'], 400);
|
|
}
|
|
|
|
$db->prepare('UPDATE tenants SET password_hash = :p, password_changed = 1 WHERE id = :id')
|
|
->execute([
|
|
'p' => password_hash($new, PASSWORD_BCRYPT),
|
|
'id' => $sessionTenant['id'],
|
|
]);
|
|
jsonResponse(['ok' => true]);
|
|
}
|