maro
82c4261a81
- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API - Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock - Reset email verification when a customer changes their email address - Fix ICS calendar injection via unescaped carriage returns in event descriptions - Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin - Move the meeting signaling token out of the WebSocket query string into the first message - Prevent duplicate signaling connections from leaking when the same participant reconnects - Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy) - Use constant-time comparison for the cron endpoint's bearer token - Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway) - Add baseline security headers and a CSP to next.config.ts - Fix CI/CD script injection via unsanitized git ref names in release.yml
83 lines
2.9 KiB
TypeScript
83 lines
2.9 KiB
TypeScript
import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
|
|
|
|
export type MeetingRole = "host" | "participant";
|
|
|
|
export type MeetingTokenPayload = {
|
|
eventSlug: string;
|
|
participantId: string;
|
|
// Self-declared, persisted client-side (localStorage, not sessionStorage)
|
|
// identity for participants — participantId is fresh per /join call, so
|
|
// without this a kick could always be undone by simply rejoining. Only
|
|
// used to make a kick stick across a rejoin (see rooms.ts kickedClientIds);
|
|
// never used to key live room membership, so a client choosing an
|
|
// arbitrary/colliding value can only affect their own future kick status,
|
|
// never another participant's connection. Still bypassable by clearing
|
|
// localStorage or joining from a different browser — there's no real
|
|
// identity to anchor to for an unauthenticated participant.
|
|
clientId?: string;
|
|
name: string;
|
|
role: MeetingRole;
|
|
exp: number; // unix ms
|
|
};
|
|
|
|
function secret(): string {
|
|
const value = process.env.MEETING_SESSION_SECRET;
|
|
if (!value) throw new Error("MEETING_SESSION_SECRET is not set");
|
|
return value;
|
|
}
|
|
|
|
function base64url(input: Buffer | string): string {
|
|
return Buffer.from(input).toString("base64url");
|
|
}
|
|
|
|
function sign(data: string): string {
|
|
return createHmac("sha256", secret()).update(data).digest("base64url");
|
|
}
|
|
|
|
/** Issues a short-lived, self-contained, signed token for one meeting session. */
|
|
export function createMeetingToken(args: {
|
|
eventSlug: string;
|
|
name: string;
|
|
role: MeetingRole;
|
|
clientId?: string;
|
|
ttlMs?: number;
|
|
}): { token: string; participantId: string } {
|
|
const participantId = randomUUID();
|
|
const clientId =
|
|
typeof args.clientId === "string" && args.clientId.length > 0 && args.clientId.length <= 100
|
|
? args.clientId
|
|
: undefined;
|
|
const payload: MeetingTokenPayload = {
|
|
eventSlug: args.eventSlug,
|
|
participantId,
|
|
clientId,
|
|
name: args.name,
|
|
role: args.role,
|
|
exp: Date.now() + (args.ttlMs ?? 6 * 60 * 60 * 1000), // 6h default
|
|
};
|
|
const body = base64url(JSON.stringify(payload));
|
|
const signature = sign(body);
|
|
return { token: `${body}.${signature}`, participantId };
|
|
}
|
|
|
|
/** Verifies signature + expiry. Returns null if invalid/expired/tampered. */
|
|
export function verifyMeetingToken(token: string): MeetingTokenPayload | null {
|
|
const parts = token.split(".");
|
|
if (parts.length !== 2) return null;
|
|
const [body, signature] = parts;
|
|
|
|
const expected = sign(body);
|
|
const a = Buffer.from(signature);
|
|
const b = Buffer.from(expected);
|
|
if (a.length !== b.length || !timingSafeEqual(a, b)) return null;
|
|
|
|
try {
|
|
const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8")) as MeetingTokenPayload;
|
|
if (typeof payload.exp !== "number" || payload.exp < Date.now()) return null;
|
|
if (!payload.eventSlug || !payload.participantId || !payload.name || !payload.role) return null;
|
|
return payload;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|