Changeset 9e27d64 in Klonkt for src/routes/account.js

Timestamp:

06/14/2026 07:31:23 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

6351545

Parents:

32cc601

Message:

auth: password admin + per-instance Google for listeners (no broker)

Robin's choice: every self-hoster has their own password admin account,
and can optionally let listeners log in to comment using their OWN Google
client. No central broker (that would tie every customer site to Robin's
Google Cloud -> systemic risk on abuse).

• Admin = username/password (bcrypt). First-time setup via /auth/register (only when there are 0 users); closed afterwards. No public registration.
• Forgot password: /auth/reset-request -> email (if SMTP configured) with reset link; CLI break-glass npm run reset-admin always works (no email needed).
• Change password (logged in) restored in /account.
• Google = per-instance own credentials, OPTIONAL, listeners only -> always role member, never admin (god/admin email is rejected; google_sub mismatch too).
• config/google.js back to direct Google OAuth; config/mailer.js new (nodemailer).
• jose removed from deps; nodemailer added.

Security review (workflow) incorporated:

• Reset token no longer in production logs (dev only).
• Reset link from PUBLIC_BASE_URL instead of X-Forwarded-Host (host poisoning).
• Reset tokens stored SHA-256-hashed in the DB.
• Same-origin check on all state-modifying POSTs (CSRF layer on top of sameSite-lax).
• Login always runs one bcrypt comparison (no timing enumeration).

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/account.js (modified) (4 diffs)

src/routes/account.js

@@ -17 +17 @@
 import fs from 'fs';
 import { fileURLToPath } from 'url';
+import bcrypt from 'bcryptjs';
 import multer from 'multer';
 import { v4 as uuid } from 'uuid';
@@ -56 +57 @@
 router.get('/', requireAuth, (req, res) => {
   const account = db.prepare(`
-    SELECT id, username, email, role, bio, avatar_url, created_at
+    SELECT id, username, email, role, bio, avatar_url, created_at, password_hash
     FROM users WHERE id = ?
   `).get(req.session.user.id);
+  const hasPassword = !!(account && account.password_hash && account.password_hash !== '!google-oauth');
+  if (account) delete account.password_hash; // niet naar de view lekken
 
   renderPage(req, res, 'pages/account', {
@@ -64 +67 @@
     bodyClass: 'on-special',
     account,
+    hasPassword,
     success: req.query.success || null,
     error: req.query.error || null,
@@ -83 +87 @@
 // longer read or written.
 
-// Wachtwoord-wijzigen is verwijderd: inloggen gaat sinds de Google-OAuth-migratie
-// volledig via Google, er is geen wachtwoord meer om te wijzigen.
+// ==================== CHANGE PASSWORD ====================
+router.post('/password', requireAuth, (req, res) => {
+  const { current, new_password, confirm } = req.body;
+  if (!current || !new_password || !confirm) {
+    return res.redirect('/account?error=' + encodeURIComponent('Alle wachtwoordvelden zijn verplicht'));
+  }
+  if (new_password.length < 8) {
+    return res.redirect('/account?error=' + encodeURIComponent('Nieuw wachtwoord moet minstens 8 tekens zijn'));
+  }
+  if (new_password !== confirm) {
+    return res.redirect('/account?error=' + encodeURIComponent('Nieuwe wachtwoorden komen niet overeen'));
+  }
+
+  const row = db.prepare('SELECT password_hash FROM users WHERE id = ?').get(req.session.user.id);
+  // Google-only accounts (luisteraars) hebben geen echt wachtwoord.
+  if (!row || !row.password_hash || row.password_hash === '!google-oauth') {
+    return res.redirect('/account?error=' + encodeURIComponent('Dit account heeft geen wachtwoord (Google-login)'));
+  }
+  if (!bcrypt.compareSync(current, row.password_hash)) {
+    return res.redirect('/account?error=' + encodeURIComponent('Huidig wachtwoord is onjuist'));
+  }
+
+  const newHash = bcrypt.hashSync(new_password, 10);
+  db.prepare('UPDATE users SET password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?')
+    .run(newHash, req.session.user.id);
+
+  res.redirect('/account?success=' + encodeURIComponent('Wachtwoord gewijzigd'));
+});
 
 // ==================== UPLOAD AVATAR ====================