refactor: local server import/export

Signed-off-by: Kristóf Marussy <kristof@marussy.com>

19 files changed, 225 insertions, 52 deletions

diff --git a/src/@types/stores.types.ts b/src/@types/stores.types.ts
index 37b906239..eec18c11e 100644
--- a/src/@types/stores.types.ts
+++ b/src/@types/stores.types.ts
@@ -166,7 +166,8 @@ interface RecipeStore extends TypedStore {
 }
 
 interface RequestsStore extends TypedStore {
-  localServerPort: () => void;
+  localServerPort: number;
+  localServerToken: string | undefined;
   retries: number;
   retryDelay: number;
   servicesRequest: () => void;
diff --git a/src/api/apiBase.ts b/src/api/apiBase.ts
index 701919785..974d513a1 100644
--- a/src/api/apiBase.ts
+++ b/src/api/apiBase.ts
@@ -34,6 +34,23 @@ export default function apiBase(withVersion = true) {
   return fixUrl(withVersion ? `${url}/${API_VERSION}` : url);
 };
 
+export function needsToken(): boolean {
+  return (window as any).ferdium.stores.settings.all.app.server === LOCAL_SERVER;
+}
+
+export function localServerToken(): string | undefined {
+  return needsToken()
+    ? (window as any).ferdium.stores.requests.localServerToken
+    : undefined;
+}
+
+export function importExportURL() {
+  const base = apiBase(false);
+  return needsToken()
+    ? `${base}/token/${localServerToken()}`
+    : base;
+}
+
 export function serverBase() {
   const serverType = (window as any).ferdium.stores.settings.all.app.server;
   const noServer = 'You are using Ferdium without a server';
diff --git a/src/api/server/ServerApi.ts b/src/api/server/ServerApi.ts
index 77a759b3e..8b551ade2 100644
--- a/src/api/server/ServerApi.ts
+++ b/src/api/server/ServerApi.ts
@@ -25,7 +25,7 @@ import { SERVER_NOT_LOADED } from '../../config';
 import { userDataRecipesPath, userDataPath } from '../../environment-remote';
 import { asarRecipesPath } from '../../helpers/asar-helpers';
 import apiBase from '../apiBase';
-import { prepareAuthRequest, sendAuthRequest } from '../utils/auth';
+import { prepareAuthRequest, prepareLocalToken, sendAuthRequest } from '../utils/auth';
 
 import {
   getRecipeDirectory,
@@ -246,6 +246,8 @@ export default class ServerApi {
 
     delete requestData.headers['Content-Type'];
 
+    await prepareLocalToken(requestData);
+
     const request = await window.fetch(
       `${apiBase()}/service/${serviceId}`,
       // @ts-expect-error Argument of type '{ method: string; } & { mode: string; headers: any; }' is not assignable to parameter of type 'RequestInit | undefined'.
diff --git a/src/api/utils/auth.ts b/src/api/utils/auth.ts
index a7a73309d..282d00459 100644
--- a/src/api/utils/auth.ts
+++ b/src/api/utils/auth.ts
@@ -1,4 +1,6 @@
 import localStorage from 'mobx-localstorage';
+import { when } from 'mobx';
+import { localServerToken, needsToken } from '../apiBase';
 import { ferdiumLocale, ferdiumVersion } from '../../environment-remote';
 
 export const prepareAuthRequest = (
@@ -29,10 +31,23 @@ export const prepareAuthRequest = (
   return request;
 };
 
-export const sendAuthRequest = (
+export const prepareLocalToken = async (
+  requestData: { method: string; headers?: any; body?: any },
+) => {
+  await when(() => !needsToken() || !!localServerToken(), { timeout: 2000 });
+  const token = localServerToken();
+  if (token) {
+    requestData.headers['X-Ferdium-Local-Token'] = token;
+  }
+}
+
+export const sendAuthRequest = async (
   url: RequestInfo,
   options?: { method: string; headers?: any; body?: any },
   auth?: boolean,
-) =>
+) => {
+  const request = prepareAuthRequest(options, auth);
+  await prepareLocalToken(request);
   // @ts-expect-error Argument of type '{ method: string; } & { mode: string; headers: any; }' is not assignable to parameter of type 'RequestInit | undefined'.
-  window.fetch(url, prepareAuthRequest(options, auth));
+  return window.fetch(url, request);
+};
diff --git a/src/components/settings/settings/EditSettingsForm.jsx b/src/components/settings/settings/EditSettingsForm.jsx
index 4ae431adb..e77f1b25b 100644
--- a/src/components/settings/settings/EditSettingsForm.jsx
+++ b/src/components/settings/settings/EditSettingsForm.jsx
@@ -30,7 +30,7 @@ import {
   userDataPath,
   userDataRecipesPath,
 } from '../../../environment-remote';
-import { openPath } from '../../../helpers/url-helpers';
+import { openExternalUrl, openPath } from '../../../helpers/url-helpers';
 import globalMessages from '../../../i18n/globalMessages';
 import Icon from '../../ui/icon';
 import Slider from '../../ui/Slider';
@@ -197,6 +197,14 @@ const messages = defineMessages({
     id: 'settings.app.buttonOpenFerdiumServiceRecipesFolder',
     defaultMessage: 'Open Service Recipes folder',
   },
+  buttonOpenImportExport: {
+    id: 'settings.app.buttonOpenImportExport',
+    defaultMessage: 'Import / Export',
+  },
+  serverHelp: {
+    id: 'settings.app.serverHelp',
+    defaultMessage: 'Connected to server at {serverURL}',
+  },
   buttonSearchForUpdate: {
     id: 'settings.app.buttonSearchForUpdate',
     defaultMessage: 'Check for updates',
@@ -274,6 +282,7 @@ class EditSettingsForm extends Component {
     openProcessManager: PropTypes.func.isRequired,
     isSplitModeEnabled: PropTypes.bool.isRequired,
     isOnline: PropTypes.bool.isRequired,
+    serverURL: PropTypes.string.isRequired,
   };
 
   constructor(props) {
@@ -336,6 +345,7 @@ class EditSettingsForm extends Component {
       openProcessManager,
       isTodosActivated,
       isOnline,
+      serverURL,
     } = this.props;
     const { intl } = this.props;
 
@@ -939,8 +949,21 @@ class EditSettingsForm extends Component {
                         className="settings__open-settings-file-button"
                         onClick={() => openPath(recipeFolder)}
                       />
+                      <Button
+                        buttonType="secondary"
+                        label={intl.formatMessage(
+                          messages.buttonOpenImportExport,
+                        )}
+                        className="settings__open-settings-file-button"
+                        onClick={() => openExternalUrl(serverURL, true)}
+                      />
                     </div>
                   </p>
+                  <p className="settings__help">
+                    {intl.formatMessage(messages.serverHelp, {
+                      serverURL,
+                    })}
+                  </p>
                 </div>
               </div>
             )}
diff --git a/src/containers/settings/EditSettingsScreen.tsx b/src/containers/settings/EditSettingsScreen.tsx
index 8f0884737..0ab3b63cf 100644
--- a/src/containers/settings/EditSettingsScreen.tsx
+++ b/src/containers/settings/EditSettingsScreen.tsx
@@ -33,6 +33,7 @@ import EditSettingsForm from '../../components/settings/settings/EditSettingsFor
 import ErrorBoundary from '../../components/util/ErrorBoundary';
 
 import globalMessages from '../../i18n/globalMessages';
+import { importExportURL } from '../../api/apiBase';
 
 const debug = require('../../preload-safe-debug')('Ferdium:EditSettingsScreen');
 
@@ -894,6 +895,7 @@ class EditSettingsScreen extends Component<EditSettingsScreenProps> {
           }
           openProcessManager={() => this.openProcessManager()}
           isOnline={app.isOnline}
+          serverURL={importExportURL()}
         />
       </ErrorBoundary>
     );
diff --git a/src/electron/ipc-api/localServer.ts b/src/electron/ipc-api/localServer.ts
index 04ddc976a..71a3003d1 100644
--- a/src/electron/ipc-api/localServer.ts
+++ b/src/electron/ipc-api/localServer.ts
@@ -1,9 +1,12 @@
+import { randomBytes } from 'crypto';
 import { ipcMain, BrowserWindow } from 'electron';
 import { createServer } from 'net';
 import { LOCAL_HOSTNAME, LOCAL_PORT } from '../../config';
 import { userDataPath } from '../../environment-remote';
 import { server } from '../../internal-server/start';
 
+const debug = require('../../preload-safe-debug')('Ferdium:LocalServer');
+
 const portInUse = (port: number): Promise<boolean> =>
   new Promise(resolve => {
     const server = createServer(socket => {
@@ -22,26 +25,32 @@ const portInUse = (port: number): Promise<boolean> =>
   });
 
 let localServerStarted = false;
+let port = LOCAL_PORT;
+let token = '';
 
 export default (params: { mainWindow: BrowserWindow }) => {
   ipcMain.on('startLocalServer', () => {
-    if (!localServerStarted) {
-      // Find next unused port for server
-      let port = LOCAL_PORT;
-      (async () => {
+    (async () => {
+      if (!localServerStarted) {
+        // Find next unused port for server
+        port = LOCAL_PORT;
         // eslint-disable-next-line no-await-in-loop
         while ((await portInUse(port)) && port < LOCAL_PORT + 10) {
           port += 1;
         }
-        console.log('Starting local server on port', port);
-
-        server(userDataPath(), port);
+        token = randomBytes(256 / 8).toString('base64url');
+        debug('Starting local server at', `http://localhost:${port}/token/${token}`);
+        await server(userDataPath(), port, token);
+        localServerStarted = true;
+      }
 
-        params.mainWindow.webContents.send('localServerPort', {
-          port,
-        });
-      })();
-      localServerStarted = true;
-    }
+      // Send local server parameters to the renderer even if the server is already running.
+      params.mainWindow.webContents.send('localServerPort', {
+        port,
+        token,
+      });
+    })().catch((error) => {
+      console.error('Error while starting local server', error);
+    });
   });
 };
diff --git a/src/environment.ts b/src/environment.ts
index 271bc7571..b1b4cb8b8 100644
--- a/src/environment.ts
+++ b/src/environment.ts
@@ -6,8 +6,8 @@ export const isMac = process.platform === 'darwin';
 export const isWindows = process.platform === 'win32';
 export const isLinux = process.platform === 'linux';
 
-export const electronVersion: string = process.versions.electron;
-export const chromeVersion: string = process.versions.chrome;
+export const electronVersion: string = process.versions.electron ?? '';
+export const chromeVersion: string = process.versions.chrome ?? '';
 export const nodeVersion: string = process.versions.node;
 
 export const osArch: string = arch();
diff --git a/src/i18n/locales/en-US.json b/src/i18n/locales/en-US.json
index 27d825657..f25d59098 100644
--- a/src/i18n/locales/en-US.json
+++ b/src/i18n/locales/en-US.json
@@ -192,6 +192,7 @@
   "settings.app.buttonInstallUpdate": "Restart & install update",
   "settings.app.buttonOpenFerdiumProfileFolder": "Open Profile folder",
   "settings.app.buttonOpenFerdiumServiceRecipesFolder": "Open Service Recipes folder",
+  "settings.app.buttonOpenImportExport": "Import / Export",
   "settings.app.buttonSearchForUpdate": "Check for updates",
   "settings.app.cacheInfo": "Ferdium cache is currently using {size} of disk space.",
   "settings.app.cacheNotCleared": "Couldn't clear all cache",
@@ -287,6 +288,7 @@
   "settings.app.sectionServiceIconsSettings": "Service Icons Settings",
   "settings.app.sectionSidebarSettings": "Sidebar Settings",
   "settings.app.sectionUpdates": "App Updates Settings",
+  "settings.app.serverHelp": "Connected to server at {serverURL}",
   "settings.app.spellCheckerLanguageInfo": "Ferdium uses your Mac's build-in spellchecker to check for typos. If you want to change the languages the spellchecker checks for, you can do so in your Mac's System Preferences.",
   "settings.app.subheadlineCache": "Cache",
   "settings.app.subheadlineFerdiumProfile": "Ferdium Profile",
diff --git a/src/internal-server/app/Controllers/Http/ImageController.js b/src/internal-server/app/Controllers/Http/ImageController.js
index 9b11783c7..731f181e0 100644
--- a/src/internal-server/app/Controllers/Http/ImageController.js
+++ b/src/internal-server/app/Controllers/Http/ImageController.js
@@ -2,13 +2,25 @@ const Env = use('Env');
 
 const path = require('path');
 const fs = require('fs-extra');
+const sanitize = require('sanitize-filename');
 
 class ImageController {
   async icon({ params, response }) {
-    const { id } = params;
+    let { id } = params;
+
+    id = sanitize(id);
+    if (id === '') {
+      return response.status(404).send({
+        status: "Icon doesn't exist",
+      });
+    }
 
     const iconPath = path.join(Env.get('USER_PATH'), 'icons', id);
-    if (!fs.existsSync(iconPath)) {
+
+    try {
+      await fs.access(iconPath);
+    } catch {
+      // File not available.
       return response.status(404).send({
         status: "Icon doesn't exist",
       });
diff --git a/src/internal-server/config/app.js b/src/internal-server/config/app.js
index 303e1290c..e8b52af18 100644
--- a/src/internal-server/config/app.js
+++ b/src/internal-server/config/app.js
@@ -232,7 +232,7 @@ module.exports = {
   */
   cookie: {
     httpOnly: true,
-    sameSite: false,
+    sameSite: true,
     path: '/',
     maxAge: 7200,
   },
diff --git a/src/internal-server/config/session.js b/src/internal-server/config/session.js
index 3ce3cc4da..dbe007e2b 100644
--- a/src/internal-server/config/session.js
+++ b/src/internal-server/config/session.js
@@ -63,7 +63,7 @@ module.exports = {
   cookie: {
     httpOnly: true,
     path: '/',
-    sameSite: false,
+    sameSite: true,
   },
 
   /*
diff --git a/src/internal-server/config/shield.js b/src/internal-server/config/shield.js
index 4ff22c3f9..55029faa4 100644
--- a/src/internal-server/config/shield.js
+++ b/src/internal-server/config/shield.js
@@ -133,7 +133,7 @@ module.exports = {
     methods: ['POST', 'PUT', 'DELETE'],
     filterUris: [],
     cookieOptions: {
-      httpOnly: false,
+      httpOnly: true,
       sameSite: true,
       path: '/',
       maxAge: 7200,
diff --git a/src/internal-server/start.ts b/src/internal-server/start.ts
index 62311b21e..ae28e3313 100644
--- a/src/internal-server/start.ts
+++ b/src/internal-server/start.ts
@@ -16,36 +16,59 @@
 */
 
 import fold from '@adonisjs/fold';
-import { Ignitor } from '@adonisjs/ignitor';
-import { existsSync, readFile, statSync, chmodSync, writeFile } from 'fs-extra';
+import { Ignitor, hooks } from '@adonisjs/ignitor';
+import { readFile, stat, chmod, writeFile } from 'fs-extra';
 import { join } from 'path';
 import { LOCAL_HOSTNAME } from '../config';
 import { isWindows } from '../environment';
 
 process.env.ENV_PATH = join(__dirname, 'env.ini');
 
-export const server = async (userPath: string, port: number) => {
-  const dbPath = join(userPath, 'server.sqlite');
-  const dbTemplatePath = join(__dirname, 'database', 'template.sqlite');
-
-  if (!existsSync(dbPath)) {
+async function ensureDB(dbPath: string): Promise<void> {
+  try {
+    await stat(dbPath);
+  } catch {
+    // Database does not exist.
     // Manually copy file
     // We can't use copyFile here as it will cause the file to be readonly on Windows
+    const dbTemplatePath = join(__dirname, 'database', 'template.sqlite');
     const dbTemplate = await readFile(dbTemplatePath);
     await writeFile(dbPath, dbTemplate);
 
     // Change permissions to ensure to file is not read-only
     if (isWindows) {
+      const stats = await stat(dbPath);
       // eslint-disable-next-line no-bitwise
-      chmodSync(dbPath, statSync(dbPath).mode | 146);
+      await chmod(dbPath, stats.mode | 146);
     }
   }
+}
+
+export const server = async (userPath: string, port: number, token: string) => {
+  const dbPath = join(userPath, 'server.sqlite');
+  await ensureDB(dbPath);
 
   // Note: These env vars are used by adonis as env vars
   process.env.DB_PATH = dbPath;
   process.env.USER_PATH = userPath;
   process.env.HOST = LOCAL_HOSTNAME;
   process.env.PORT = port.toString();
+  process.env.FERDIUM_LOCAL_TOKEN = token;
 
-  new Ignitor(fold).appRoot(__dirname).fireHttpServer().catch(console.error);
+  return new Promise<void>((resolve, reject) => {
+    let returned = false;
+    hooks.after.httpServer(() => {
+      if (!returned) {
+        resolve();
+        returned = true;
+      }
+    });
+    new Ignitor(fold).appRoot(__dirname).fireHttpServer().catch((error) => {
+      console.error(error);
+      if (!returned) {
+        returned = true;
+        reject(error);
+      }
+    });
+  });
 };
diff --git a/src/internal-server/start/routes.js b/src/internal-server/start/routes.js
index 79c809f5f..736796bb8 100644
--- a/src/internal-server/start/routes.js
+++ b/src/internal-server/start/routes.js
@@ -5,6 +5,8 @@
 |
 */
 
+const { timingSafeEqual } = require('crypto');
+
 /** @type {typeof import('@adonisjs/framework/src/Route/Manager')} */
 const Route = use('Route');
 
@@ -14,14 +16,38 @@ const migrate = require('./migrate');
 
 migrate();
 
+async function validateToken(clientToken, response, next) {
+  const serverToken = process.env.FERDIUM_LOCAL_TOKEN;
+  const valid = serverToken &&
+    clientToken &&
+    timingSafeEqual(Buffer.from(clientToken, 'utf8'), Buffer.from(serverToken, 'utf8'));
+  if (valid) {
+    await next();
+    return true;
+  }
+  return response.forbidden();
+}
+
 const OnlyAllowFerdium = async ({ request, response }, next) => {
   const version = request.header('X-Franz-Version');
   if (!version) {
-    return response.status(403).redirect('/');
+    return response.forbidden();
   }
 
-  await next();
-  return true;
+  const clientToken = request.header('X-Ferdium-Local-Token');
+  return validateToken(clientToken, response, next);
+};
+
+const RequireTokenInQS = async ({ request, response }, next) => {
+  const clientToken = request.get().token;
+  return validateToken(clientToken, response, next);
+}
+
+const FERDIUM_LOCAL_TOKEN_COOKIE = 'ferdium-local-token';
+
+const RequireAuthenticatedBrowser = async({ request, response }, next) => {
+  const clientToken = request.cookie(FERDIUM_LOCAL_TOKEN_COOKIE);
+  return validateToken(clientToken, response, next);
 };
 
 // Health: Returning if all systems function correctly
@@ -67,16 +93,32 @@ Route.group(() => {
 
 Route.group(() => {
   Route.get('icon/:id', 'ImageController.icon');
-}).prefix(API_VERSION);
+})
+  .prefix(API_VERSION)
+  .middleware(RequireTokenInQS);
 
-// Franz account import
-Route.post('import', 'UserController.import');
-Route.get('import', ({ view }) => view.render('import'));
+Route.group(() => {
+  // Franz account import
+  Route.post('import', 'UserController.import');
+  Route.get('import', ({ view }) => view.render('import'));
+
+  // Account transfer
+  Route.get('export', 'UserController.export');
+  Route.post('transfer', 'UserController.importFerdium');
+  Route.get('transfer', ({ view }) => view.render('transfer'));
 
-// Account transfer
-Route.get('export', 'UserController.export');
-Route.post('transfer', 'UserController.importFerdium');
-Route.get('transfer', ({ view }) => view.render('transfer'));
+  // Index
+  Route.get('/', ({ view }) => view.render('index'));
+}).middleware(RequireAuthenticatedBrowser);
 
-// Index
-Route.get('/', ({ view }) => view.render('index'));
+Route.get('token/:token', ({ params: { token }, response }) => {
+  if (validateToken(token)) {
+    response.cookie(FERDIUM_LOCAL_TOKEN_COOKIE, token, {
+      httpOnly: true,
+      sameSite: true,
+      path: '/',
+    });
+    return response.redirect('/');
+  }
+  return response.forbidden();
+});
diff --git a/src/internal-server/test.ts b/src/internal-server/test.ts
index 87ed57848..5bb1f2b36 100644
--- a/src/internal-server/test.ts
+++ b/src/internal-server/test.ts
@@ -6,4 +6,4 @@ const dummyUserFolder = join(__dirname, 'user_data');
 
 ensureDirSync(dummyUserFolder);
 
-server(dummyUserFolder, 46_568);
+server(dummyUserFolder, 46_568, 'test').catch(console.log);
diff --git a/src/lib/Menu.js b/src/lib/Menu.js
index a3a8f4566..8904919f9 100644
--- a/src/lib/Menu.js
+++ b/src/lib/Menu.js
@@ -38,7 +38,7 @@ import { ferdiumVersion } from '../environment-remote';
 import { todoActions } from '../features/todos/actions';
 import workspaceActions from '../features/workspaces/actions';
 import { workspaceStore } from '../features/workspaces/index';
-import apiBase, { serverBase, serverName } from '../api/apiBase';
+import { importExportURL, serverBase, serverName } from '../api/apiBase';
 import { openExternalUrl } from '../helpers/url-helpers';
 import globalMessages from '../i18n/globalMessages';
 
@@ -588,7 +588,7 @@ const _titleBarTemplateFactory = (intl, locked) => [
       {
         label: intl.formatMessage(menuItems.importExportData),
         click() {
-          openExternalUrl(apiBase(false), true);
+          openExternalUrl(importExportURL(), true);
         },
         enabled: !locked,
       },
diff --git a/src/models/Service.ts b/src/models/Service.ts
index 92b8ee64c..21fa65f69 100644
--- a/src/models/Service.ts
+++ b/src/models/Service.ts
@@ -11,6 +11,7 @@ import UserAgent from './UserAgent';
 import { DEFAULT_SERVICE_ORDER } from '../config';
 import { ifUndefined } from '../jsUtils';
 import { IRecipe } from './Recipe';
+import { needsToken } from '../api/apiBase';
 
 const debug = require('../preload-safe-debug')('Ferdium:Service');
 
@@ -295,6 +296,21 @@ export default class Service {
 
   @computed get icon(): string {
     if (this.iconUrl) {
+      if (needsToken()) {
+        let url: URL;
+        try {
+          url = new URL(this.iconUrl);
+        } catch (error) {
+          debug('Invalid url', this.iconUrl, error);
+          return this.iconUrl;
+        }
+        const requestStore = (window as any).ferdium.stores.requests;
+        // Make sure we only pass the token to the local server.
+        if (url.origin === requestStore.localServerOrigin) {
+          url.searchParams.set('token', requestStore.localServerToken);
+          return url.toString();
+        }
+      }
       return this.iconUrl;
     }
 
diff --git a/src/stores/RequestStore.ts b/src/stores/RequestStore.ts
index a964c5d12..59982c05a 100644
--- a/src/stores/RequestStore.ts
+++ b/src/stores/RequestStore.ts
@@ -6,7 +6,7 @@ import { Actions } from '../actions/lib/actions';
 import { ApiInterface } from '../api';
 import { Stores } from '../@types/stores.types';
 import CachedRequest from './lib/CachedRequest';
-import { LOCAL_PORT } from '../config';
+import { LOCAL_HOSTNAME, LOCAL_PORT } from '../config';
 
 import TypedStore from './lib/TypedStore';
 
@@ -21,6 +21,8 @@ export default class RequestStore extends TypedStore {
 
   @observable localServerPort = LOCAL_PORT;
 
+  @observable localServerToken: string | undefined;
+
   retries: number = 0;
 
   retryDelay: number = ms('2s');
@@ -45,6 +47,9 @@ export default class RequestStore extends TypedStore {
       if (data.port) {
         this.localServerPort = data.port;
       }
+      if (data.token) {
+        this.localServerToken = data.token;
+      }
     });
   }
 
@@ -56,6 +61,10 @@ export default class RequestStore extends TypedStore {
     return this.userInfoRequest.isExecuting || this.servicesRequest.isExecuting;
   }
 
+  @computed get localServerOrigin(): string {
+    return `http://${LOCAL_HOSTNAME}:${this.localServerPort}`;
+  }
+
   @action _retryRequiredRequests(): void {
     this.userInfoRequest.reload();
     this.servicesRequest.reload();