Auth requirement

server.js

@@ -3,13 +3,36 @@ const fs = require('fs');
 const path = require('path');
 const { WebSocketServer, WebSocket } = require('ws');
 const { v4: uuidv4 } = require('uuid');
+const crypto = require('crypto');
+
+// ─── Auth ─────────────────────────────────────────────────────────────────────
+// Secret key from environment variable "Key"
+const SECRET = process.env.Key || '';
+if (!SECRET) console.warn('[Auth] WARNING: Environment variable "Key" is not set. Admin login will be disabled.');
+
+// HMAC-based session tokens: token = hmac(SECRET, nonce+timestamp)
+// Sessions are stored server-side; possession of token alone is not enough —
+// the server must have issued it.
+const activeSessions = new Set(); // Set<token>
+
+function createSession() {
+  const nonce = crypto.randomBytes(32).toString('hex');
+  const token = crypto.createHmac('sha256', SECRET).update(nonce).digest('hex');
+  activeSessions.add(token);
+  return token;
+}
+
+function isValidSession(token) {
+  return typeof token === 'string' && activeSessions.has(token);
+}
 
+// ─── In-Memory State ──────────────────────────────────────────────────────────
 const sounds = {};
 const notifications = {};
 const devices = {};
 
 const deviceClients = {};
-const adminClients = new Set();
+const adminClients = new Set(); // only authenticated WS connections
 
 const MIME = {
   '.html': 'text/html',
@@ -20,43 +43,46 @@ const MIME = {
   '.ico':  'image/x-icon',
 };
 
-// FIX: removed leftover `serverOptions` argument — http.createServer takes no options object
+// ─── HTTP File Server ─────────────────────────────────────────────────────────
 const httpServer = http.createServer((req, res) => {
   let urlPath = req.url.split('?')[0];
   if (urlPath === '/' || urlPath === '') urlPath = '/index.html';
   if (urlPath === '/admin' || urlPath === '/admin/') urlPath = '/admin/index.html';
 
   const filePath = path.join(__dirname, 'public', urlPath);
+
+  // Prevent path traversal
+  const publicDir = path.resolve(__dirname, 'public');
+  const resolved = path.resolve(filePath);
+  if (!resolved.startsWith(publicDir)) {
+    res.writeHead(403); res.end('Forbidden'); return;
+  }
+
   const ext = path.extname(filePath);
   const mime = MIME[ext] || 'application/octet-stream';
 
   fs.readFile(filePath, (err, data) => {
-    if (err) {
-      res.writeHead(404, { 'Content-Type': 'text/plain' });
-      res.end('Not found');
-      return;
-    }
+    if (err) { res.writeHead(404, { 'Content-Type': 'text/plain' }); res.end('Not found'); return; }
     res.writeHead(200, { 'Content-Type': mime });
     res.end(data);
   });
 });
 
+// ─── WebSocket Server ─────────────────────────────────────────────────────────
 const wss = new WebSocketServer({ server: httpServer });
 
 wss.on('connection', (ws, req) => {
   const urlPath = req.url || '/';
-  const isAdmin = urlPath.startsWith('/admin-ws');
-  if (isAdmin) {
+  if (urlPath.startsWith('/admin-ws')) {
     handleAdminConnection(ws);
   } else {
     handleDeviceConnection(ws);
   }
 });
 
+// ─── Helpers ──────────────────────────────────────────────────────────────────
 function send(ws, msg) {
-  if (ws.readyState === WebSocket.OPEN) {
-    ws.send(JSON.stringify(msg));
-  }
+  if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(msg));
 }
 
 function broadcastAdmin(msg) {
@@ -89,26 +115,83 @@ function devicePublic(d) {
     schedule: d.schedule || [],
     pendingChanges: d.pendingChanges || [],
     online: !!deviceClients[d.uuid],
+    cachedSounds: d.cachedSounds || [],
   };
 }
 
+// ─── Admin Connection Handler ─────────────────────────────────────────────────
 function handleAdminConnection(ws) {
-  adminClients.add(ws);
-  console.log(`[Admin] connected, total=${adminClients.size}`);
-  send(ws, { type: 'full_state', ...getFullState() });
+  let authenticated = false;
+
+  // Give them 10 seconds to authenticate, then close
+  const authTimeout = setTimeout(() => {
+    if (!authenticated) {
+      send(ws, { type: 'auth_timeout' });
+      ws.close();
+    }
+  }, 10000);
 
   ws.on('message', (raw) => {
     let msg;
     try { msg = JSON.parse(raw); } catch { return; }
+
+    // ── Authentication handshake ──────────────────────────────────────────────
+    if (!authenticated) {
+      if (msg.type === 'auth_resume' && isValidSession(msg.token)) {
+        // Client is resuming a valid session
+        authenticated = true;
+        clearTimeout(authTimeout);
+        adminClients.add(ws);
+        send(ws, { type: 'auth_ok', token: msg.token });
+        send(ws, { type: 'full_state', ...getFullState() });
+        console.log('[Admin] session resumed');
+        return;
+      }
+
+      if (msg.type === 'auth_login') {
+        if (!SECRET) {
+          send(ws, { type: 'auth_error', reason: 'Server has no Key configured.' });
+          return;
+        }
+        // Constant-time comparison to prevent timing attacks
+        const provided = Buffer.from(String(msg.password || ''));
+        const expected = Buffer.from(SECRET);
+        const match = provided.length === expected.length &&
+                      crypto.timingSafeEqual(provided, expected);
+        if (match) {
+          authenticated = true;
+          clearTimeout(authTimeout);
+          const token = createSession();
+          adminClients.add(ws);
+          send(ws, { type: 'auth_ok', token });
+          send(ws, { type: 'full_state', ...getFullState() });
+          console.log('[Admin] authenticated');
+        } else {
+          send(ws, { type: 'auth_error', reason: 'Invalid password.' });
+          console.warn('[Admin] failed login attempt');
+        }
+        return;
+      }
+
+      // Any other message before auth: reject silently
+      send(ws, { type: 'auth_required' });
+      return;
+    }
+
+    // ── Authenticated messages ─────────────────────────────────────────────────
     handleAdminMessage(ws, msg);
   });
 
   ws.on('close', () => {
     adminClients.delete(ws);
+    clearTimeout(authTimeout);
     console.log(`[Admin] disconnected, total=${adminClients.size}`);
   });
 
   ws.on('error', (e) => console.error('[Admin] WS error', e.message));
+
+  // Prompt client to authenticate
+  send(ws, { type: 'auth_required' });
 }
 
 function handleAdminMessage(ws, msg) {
@@ -125,19 +208,13 @@ function handleAdminMessage(ws, msg) {
     case 'create_notification': {
       const id = uuidv4();
       const notif = {
-        id,
-        name: msg.name,
-        heading: msg.heading,
-        body: msg.body,
-        hyperlink: msg.hyperlink || '',
-        displayed: false,
-        soundId: msg.soundId || null,
+        id, name: msg.name, heading: msg.heading, body: msg.body,
+        hyperlink: msg.hyperlink || '', displayed: false, soundId: msg.soundId || null,
       };
       notifications[id] = notif;
       for (const uuid of Object.keys(devices)) {
-        if (!devices[uuid].notifications.find(n => n.id === id)) {
+        if (!devices[uuid].notifications.find(n => n.id === id))
           devices[uuid].notifications.push({ ...notif });
-        }
       }
       broadcastAdmin({ type: 'notification_added', notification: notif });
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
@@ -150,32 +227,21 @@ function handleAdminMessage(ws, msg) {
       if (!device) return;
       device.schedule = device.schedule || [];
       const existing = device.schedule.find(s => s.notificationId === msg.notificationId);
-      if (existing) {
-        existing.scheduledAt = msg.scheduledAt;
-      } else {
-        device.schedule.push({ notificationId: msg.notificationId, scheduledAt: msg.scheduledAt });
-      }
+      if (existing) { existing.scheduledAt = msg.scheduledAt; }
+      else { device.schedule.push({ notificationId: msg.notificationId, scheduledAt: msg.scheduledAt }); }
       const scheduleMsg = { type: 'schedule_update', schedule: device.schedule };
-      if (deviceClients[msg.uuid]) {
-        broadcastDevice(msg.uuid, scheduleMsg);
-      } else {
-        device.pendingChanges = device.pendingChanges || [];
-        device.pendingChanges.push(scheduleMsg);
-      }
+      if (deviceClients[msg.uuid]) { broadcastDevice(msg.uuid, scheduleMsg); }
+      else { (device.pendingChanges = device.pendingChanges || []).push(scheduleMsg); }
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
       break;
     }
 
     case 'play_now': {
       const playMsg = { type: 'play_now', notificationId: msg.notificationId };
-      if (deviceClients[msg.uuid]) {
-        broadcastDevice(msg.uuid, playMsg);
-      } else {
+      if (deviceClients[msg.uuid]) { broadcastDevice(msg.uuid, playMsg); }
+      else {
         const device = devices[msg.uuid];
-        if (device) {
-          device.pendingChanges = device.pendingChanges || [];
-          device.pendingChanges.push(playMsg);
-        }
+        if (device) (device.pendingChanges = device.pendingChanges || []).push(playMsg);
       }
       break;
     }
@@ -185,12 +251,8 @@ function handleAdminMessage(ws, msg) {
       if (!device) return;
       device.name = msg.name;
       const nameMsg = { type: 'name_update', name: msg.name };
-      if (deviceClients[msg.uuid]) {
-        broadcastDevice(msg.uuid, nameMsg);
-      } else {
-        device.pendingChanges = device.pendingChanges || [];
-        device.pendingChanges.push(nameMsg);
-      }
+      if (deviceClients[msg.uuid]) { broadcastDevice(msg.uuid, nameMsg); }
+      else { (device.pendingChanges = device.pendingChanges || []).push(nameMsg); }
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
       break;
     }
@@ -200,12 +262,8 @@ function handleAdminMessage(ws, msg) {
       if (!device) return;
       device.schedule = (device.schedule || []).filter(s => s.notificationId !== msg.notificationId);
       const rmMsg = { type: 'schedule_update', schedule: device.schedule };
-      if (deviceClients[msg.uuid]) {
-        broadcastDevice(msg.uuid, rmMsg);
-      } else {
-        device.pendingChanges = device.pendingChanges || [];
-        device.pendingChanges.push(rmMsg);
-      }
+      if (deviceClients[msg.uuid]) { broadcastDevice(msg.uuid, rmMsg); }
+      else { (device.pendingChanges = device.pendingChanges || []).push(rmMsg); }
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
       break;
     }
@@ -221,9 +279,9 @@ function handleAdminMessage(ws, msg) {
   }
 }
 
+// ─── Device Connection Handler ────────────────────────────────────────────────
 function handleDeviceConnection(ws) {
   let deviceUUID = null;
-  console.log('[Device] new connection (uuid pending)');
 
   ws.on('message', (raw) => {
     let msg;
@@ -238,9 +296,7 @@ function handleDeviceConnection(ws) {
           uuid: deviceUUID,
           name: `Device ${Object.keys(devices).length + 1}`,
           notifications: Object.values(notifications).map(n => ({ ...n })),
-          lastConnection: null,
-          schedule: [],
-          pendingChanges: [],
+          lastConnection: null, schedule: [], pendingChanges: [],
         };
       }
 
@@ -254,11 +310,8 @@ function handleDeviceConnection(ws) {
       }
 
       send(ws, {
-        type: 'device_init',
-        uuid: deviceUUID,
-        notifications: device.notifications,
-        schedule: device.schedule,
-        name: device.name,
+        type: 'device_init', uuid: deviceUUID,
+        notifications: device.notifications, schedule: device.schedule, name: device.name,
       });
 
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
@@ -287,7 +340,6 @@ function handleDeviceMessage(ws, uuid, msg) {
   if (!device) return;
 
   switch (msg.type) {
-
     case 'mark_displayed': {
       const notif = device.notifications.find(n => n.id === msg.notificationId);
       if (notif) notif.displayed = true;
@@ -295,30 +347,27 @@ function handleDeviceMessage(ws, uuid, msg) {
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
       break;
     }
-
     case 'request_sound': {
       const sound = sounds[msg.soundId];
       if (sound) send(ws, { type: 'sound_data', sound });
       break;
     }
-
     case 'sync_schedule': {
       device.schedule = msg.schedule || [];
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
       break;
     }
-
     case 'cached_sounds': {
       device.cachedSounds = msg.soundIds || [];
       broadcastAdmin({ type: 'devices_updated', devices: Object.values(devices).map(devicePublic) });
       break;
     }
-
     default:
       console.warn('[Device] unknown message type:', msg.type);
   }
 }
 
+// ─── Start ────────────────────────────────────────────────────────────────────
 const PORT = process.env.PORT || 7860;
 httpServer.listen(PORT, () => {
   console.log(`Server running on http://0.0.0.0:${PORT}`);