first commit

server/src/middleware/authentication.ts

@@ -0,0 +1,43 @@
+import UserList from "../Models/Users/Users";
+import { ISession } from "../Models/Session.model";
+import { NextFunction, Request, Response } from "express";
+import { ApiValidationError } from "../Models/Server.Error.model";
+
+export async function authenticateMiddleware(
+    request: Request,
+    response: Response,
+    next: NextFunction
+): Promise<void | Response | ApiValidationError> {
+    const token = request.headers.authorization;
+
+    if (token === "" || token === undefined) {
+        return response
+            .status(501)
+            .json(new ApiValidationError(501, "No autorizado"));
+    }
+
+    try {
+        const session: ISession = await UserList.loginByToken({ token });
+
+        const { sessionUser } = request.body;
+
+        if (sessionUser) {
+            if (sessionUser !== session.userId) {
+                return response
+                    .status(501)
+                    .json(
+                        new ApiValidationError(
+                            501,
+                            "Credenciales de acceso no coinciden con el usuario. No autorizado"
+                        )
+                    );
+            }
+        }
+
+        next();
+    } catch (error) {
+        return response
+            .status(501)
+            .json(new ApiValidationError(501, "Credenciales de acceso no validas. No autorizado"));
+    }
+}

server/src/middleware/ratelimiter.ts

@@ -0,0 +1,33 @@
+import { Request, Response, NextFunction } from "express";
+import { ApiValidationError } from "../Models/Server.Error.model";
+
+const ipLastRequest = new Map<string, number>();
+
+// Limpia las IPs cada hora
+setInterval(() => {
+    const now = Date.now();
+    const timeLimit = process.env.WAP_TIME_LIMIT ? parseInt(process.env.WAP_TIME_LIMIT) : 5000;
+    ipLastRequest.forEach((time, ip) => {
+        if (now - time > timeLimit) ipLastRequest.delete(ip);
+    });
+}, 3600000);
+
+export async function rateLimiter(
+    request: Request,
+    response: Response,
+    next: NextFunction
+): Promise<void | Response | ApiValidationError> {
+    const ip = request.ip;
+    const timeLimit = process.env.WAP_TIME_LIMIT ? parseInt(process.env.WAP_TIME_LIMIT) : 5000;
+    const currentTime = Date.now();
+    const lastRequestTime = ipLastRequest.get(ip) || 0;
+    if (currentTime - lastRequestTime < timeLimit) {
+        response
+            .status(429)
+            .json(new ApiValidationError(429, "Demasiadas solicitudes. Por favor espere!"));
+        return;
+    }
+
+    ipLastRequest.set(ip, currentTime);
+    next();
+}

server/src/middleware/sysadminAuth.ts

@@ -0,0 +1,50 @@
+import { NextFunction, Request, Response } from "express";
+import { ApiValidationError } from "../Models/Server.Error.model";
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+import { challenges } from "../api/SysAdminChallenges/Challenges.Controller";
+import { IPayload } from "../Models/SysAdminPayload/SysAdminPayload.interface";
+
+export async function sysAdminAuthMiddleware(
+    request: Request,
+    response: Response,
+    next: NextFunction,
+): Promise<void | Response | ApiValidationError> {
+    const publicKeyPath = path.resolve(process.cwd(), process.env.SYS_ADMIN_API_PUBLIC_KEY || "");
+    const publicKey = fs.readFileSync(publicKeyPath);
+    const payload: IPayload = request.body.payload;
+
+    if (payload === undefined) {
+        return response
+            .status(501)
+            .json(new ApiValidationError(501, "No autorizado. No tiene privilegios de administrador."));
+    }
+
+    try {
+        const { nonce, signature } = payload;
+
+        if (!challenges.has(nonce.nonce)) {
+            return response.status(401).end();
+        }
+
+        const ok = crypto.verify(
+            null,
+            Buffer.from(nonce.nonce) as unknown as Uint8Array,
+            publicKey,
+            Buffer.from(signature, "base64") as unknown as Uint8Array,
+        );
+
+        challenges.delete(nonce.nonce);
+
+        if (!ok) {
+            return response.status(403).end();
+        }
+
+        next();
+    } catch (error) {
+        return response
+            .status(501)
+            .json(new ApiValidationError(501, "Credenciales de acceso no validas. No autorizado"));
+    }
+}