Implement server-side session invalidation using token_invalid_before

src/client/app/redux/api/authApi.ts

@@ -15,7 +15,7 @@ export const authApi = baseApi.injectEndpoints({
 	endpoints: builder => ({
 		login: builder.mutation<LoginResponse, { username: string, password: string }>({
 			query: loginArgs => ({
-				url: 'api/login',
+				url: 'api/login/login',
 				method: 'POST',
 				body: loginArgs
 			}),
@@ -42,17 +42,24 @@ export const authApi = baseApi.injectEndpoints({
 				return { data: null };
 			}
 		}),
-		logout: builder.mutation<null, void>({
-			queryFn: (_, { dispatch }) => {
-				// Opt to use a RTK mutation instead of manually writing a thunk to take advantage mutation invalidations
-				deleteToken();
-				dispatch(currentUserSlice.actions.clearCurrentUser());
-				return { data: null };
+		logout: builder.mutation<{ success: boolean, message: string }, void>({
+			query: () => ({
+				url: 'api/login/logout',
+				method: 'POST',
+				body: { token: getToken() }
+			}),
+			async onQueryStarted(_arg, { dispatch, queryFulfilled }) {
+				try {
+					await queryFulfilled;
+				} finally {
+					deleteToken();
+					dispatch(currentUserSlice.actions.clearCurrentUser());
+				}
 			},
 			invalidatesTags: ['MeterData', 'GroupData']
 		})
 	})
 });
 
 // Poll interval in milliseconds (1 minute)
-export const authPollInterval = 60000;
+export const authPollInterval = 60000;

src/server/app.js

@@ -17,7 +17,7 @@ const users = require('./routes/users');
 const readings = require('./routes/readings');
 const meters = require('./routes/meters');
 const preferences = require('./routes/preferences');
-const login = require('./routes/login');
+const login = require('./routes/loginLogout');
 const verification = require('./routes/verification');
 const groups = require('./routes/groups');
 const version = require('./routes/version');

src/server/migrations/1.0.0-2.0.0/index.js

@@ -16,6 +16,7 @@ module.exports = {
         await db.none(sqlFile('../migrations/1.0.0-2.0.0/sql/preferences/add_graph_type.sql'));
         await db.none(sqlFile('../migrations/1.0.0-2.0.0/sql/preferences/add_preferences_help_url.sql'));
         await db.none(sqlFile('../migrations/1.0.0-2.0.0/sql/users/add_users_note.sql'));
+        await db.none(sqlFile('../migrations/1.0.0-2.0.0/sql/users/add_token_invalid_before.sql'));
         await db.none(sqlFile('../migrations/1.0.0-2.0.0/sql/users/alter_users_table.sql'));
         // It should not matter but first rename cik and then do units.
         await db.none(sqlFile('../migrations/1.0.0-2.0.0/sql/cik/alter_cik_table.sql'));

src/server/migrations/1.0.0-2.0.0/sql/users/add_token_invalid_before.sql

@@ -0,0 +1,2 @@
+ALTER TABLE users
+ADD COLUMN IF NOT EXISTS token_invalid_before TIMESTAMP NOT NULL DEFAULT TIMESTAMP 'epoch';

src/server/models/User.js

@@ -13,13 +13,35 @@ class User {
 	 * @param passwordHash The user's passwordHash
 	 * @param role The user's role
 	 * @param note The user note
+	 * @param tokenInvalidBefore Timestamp before which issued tokens are invalid
 	 */
-	constructor(id, username, passwordHash, role, note = '') {
+	constructor(id, username, passwordHash, role, note = '', tokenInvalidBefore = null) {
 		this.id = id;
 		this.username = username;
 		this.passwordHash = passwordHash;
 		this.role = role;
 		this.note = note;
+		this.tokenInvalidBefore = tokenInvalidBefore;
+	}
+
+	/**
+	 * Maps a database row to a User model.
+	 * @param row
+	 * @returns {User}
+	 */
+	static mapRow(row) {
+		if (row === null) {
+			return null;
+		}
+
+		return new User(
+			row.id,
+			row.username,
+			row.password_hash,
+			row.role,
+			row.note,
+			row.token_invalid_before
+		);
 	}
 
 	/**
@@ -41,7 +63,7 @@ class User {
 	 */
 	static async getByID(id, conn) {
 		const row = await conn.one(sqlFile('user/get_user_by_id.sql'), { id: id });
-		return new User(row.id, row.username, row.password_hash, row.role, row.note);
+		return User.mapRow(row);
 	}
 
 	/**
@@ -54,7 +76,7 @@ class User {
 	 */
 	static async getByUsername(username, conn) {
 		const row = await conn.oneOrNone(sqlFile('user/get_user_by_username.sql'), { username: username });
-		return row === null ? null : new User(row.id, row.username, row.password_hash, row.role, row.note);
+		return User.mapRow(row);
 	}
 
 	/**
@@ -73,15 +95,15 @@ class User {
 	 */
 	static async getAll(conn) {
 		const rows = await conn.any(sqlFile('user/get_all_users.sql'));
-		return rows.map(row => new User(row.id, row.username, undefined, row.role, row.note));
+		return rows.map(User.mapRow);
 	}
 
 	/**
 	 * Returns a promise to update a user's password
 	 * @param id the id of the user whose password is to be updated
 	 * @param passwordHash the new password's hash
 	 * @param conn is the connection to use.
-	 * @returns {Promise.<array.<User>>}
+	 * @returns {Promise.<void>}
 	 */
 	static async updateUserPassword(id, passwordHash, conn) {
 		return conn.none(sqlFile('user/update_user_password.sql'), { id: id, password_hash: passwordHash });
@@ -132,6 +154,16 @@ class User {
 		return conn.none(sqlFile('user/update_user.sql'), { id: id, username: username, role: role, note: note });
 	}
 
+	/**
+	 * Returns a promise to invalidate all tokens issued before now for a user.
+	 * @param id the id of the user whose tokens are to be invalidated
+	 * @param conn is the connection to use.
+	 * @returns {Promise<void>}
+	 */
+	static async invalidateTokensBeforeNow(id, conn) {
+		return conn.none(sqlFile('user/update_token_invalid_before.sql'), { id: id });
+	}
+
 	/**
 	 * Returns a promise to delete a user
 	 * @param username the username of the user
@@ -168,7 +200,7 @@ class User {
 
 /**
  * Enum of roles.
- * This enum needs to be kept in sync with the src/server/sql/create_user_types_enum.sql and the UserRoles enum in src/client/types/items.ts 
+ * This enum needs to be kept in sync with the src/server/sql/create_user_types_enum.sql and the UserRoles enum in src/client/types/items.ts
  * @enum {string}
  */
 User.role = Object.freeze({

src/server/routes/authenticator.js

@@ -16,41 +16,36 @@ const { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, TOKEN_MAX_LENGTH, USERNAME_MIN
 	= require('../util/validationConstants');
 
 /**
- * Middleware function to force a route to require authentication
- * Verifies the request's token against the server's secret token
- * It is used within this file but not by other parts of OED.
+ * Middleware function to require authentication on protected routes.
+ * Verifies the request's token, ensures the user exists, and checks that
+ * the token has not been invalidated.
+ * This middleware was created to only be used within this file.
  */
-authMiddleware = (req, res, next) => {
+const authMiddleware = (req, res, next) => {
 	const token = req.headers.token || req.body.token || req.query.token;
 	const validParams = {
 		type: 'string',
 		maxLength: TOKEN_MAX_LENGTH
 	};
+
 	if (!validate(token, validParams).valid) {
 		res.status(HTTP_CODES.FORBIDDEN).json({ success: false, message: 'No token provided or JSON was invalid.' });
 	} else if (token) {
-		jwt.verify(token, secretToken, async (err, decoded) => {
-			if (err) {
+		verifyActiveTokenAndGetUser(token)
+			.then(({ decoded }) => {
+				req.decoded = decoded;
+				next();
+			})
+			.catch(() => {
 				res.status(HTTP_CODES.UNAUTHORIZED).json({ success: false, message: 'Failed to authenticate token.' });
-			} else {
-				try {
-					const conn = getConnection();
-					// checks if user exists in the database in case it was deleted
-					await User.getByID(decoded.data, conn);
-					req.decoded = decoded;
-					next();
-				} catch (error) {
-					res.status(HTTP_CODES.UNAUTHORIZED).json({ success: false, message: 'User does not exist in database.' });
-				}
-			}
-		});
+			});
 	} else {
 		res.status(HTTP_CODES.FORBIDDEN).send({ success: false, message: 'No token provided.' });
 	}
 };
 
 /**
- * Middleware that checks the request body for the username and password parameters. If the body contains the username and password parameters, then next 
+ * Middleware that checks the request body for the username and password parameters. If the body contains the username and password parameters, then next
  * is executed. Otherwise, the server responds with a 400 error.
  */
 function credentialsRequestValidationMiddleware(req, res, next) {
@@ -82,9 +77,9 @@ function credentialsRequestValidationMiddleware(req, res, next) {
 
 /**
  * Verifies the username and password of a user.
- * @param {string} username 
- * @param {string} password 
- * @param {boolean} returnUser 
+ * @param {string} username
+ * @param {string} password
+ * @param {boolean} returnUser
  * @returns true if the user exists in the database. False otherwise. Returns the user itself if returnUser is set to true and user is verified.
  */
 async function verifyCredentials(username, password, returnUser = false) {
@@ -104,14 +99,60 @@ async function verifyCredentials(username, password, returnUser = false) {
 	}
 }
 
+/**
+ * Verifies a JWT, ensures the user exists, and rejects tokens that were invalidated.
+ * Returns the decoded token and matching user when successful.
+ * @param {string} token
+ * @returns {Promise<{decoded: object, user: User}>}
+ */
+async function verifyActiveTokenAndGetUser(token) {
+	const decoded = await new Promise((resolve, reject) => {
+		jwt.verify(token, secretToken, (err, payload) => {
+			if (err) {
+				reject(err);
+			} else {
+				resolve(payload);
+			}
+		});
+	});
+
+	// jwt.verify confirms the token signature is valid, but it does not guarantee
+	// the referenced user still exists in the database. The user may have been
+	// deleted after the token was issued, so OED must still verify the user record.
+	const conn = getConnection();
+	const user = await User.getByID(decoded.data, conn);
+
+	// Compare timestamps at millisecond precision to avoid edge cases caused by
+	// JWT iat being stored in seconds while the database timestamp is more precise.
+	const tokenIssuedAtMs = decoded.iat * 1000;
+	let invalidBeforeMs = 0;
+
+	if (user.tokenInvalidBefore) {
+		const parsedDate = new Date(user.tokenInvalidBefore);
+		if (!isNaN(parsedDate.getTime())) {
+			invalidBeforeMs = parsedDate.getTime();
+		} else {
+			log.error(`Invalid tokenInvalidBefore value for user ${user.id}`);
+		}
+	}
+
+	if (tokenIssuedAtMs <= invalidBeforeMs) {
+		const error = new Error('Token invalidated');
+		error.code = 'TOKEN_INVALIDATED';
+		throw error;
+	}
+
+	return { decoded, user };
+}
+
 /**
  * Returns middleware that verifies the requested token and only proceeds if the requestor is a particular user role or is Admin.
- * @param {string} role 
- * @param action 
+ * @param {string} role
+ * @param action
  */
 function roleTokenAuthMiddleware(role, action) {
 	return function (req, res, next) {
-		this.authMiddleware(req, res, async () => {
+		authMiddleware(req, res, async () => {
 			const token = req.headers.token || req.body.token || req.query.token;
 			if (await isTokenAuthorized(token, role)) {
 				next();
@@ -120,8 +161,8 @@ function roleTokenAuthMiddleware(role, action) {
 				res.status(HTTP_CODES.FORBIDDEN)
 					.json({ message: `Invalid credentials supplied. Only ${role.toUpperCase()} can ${action}.` });
 			}
-		})
-	}
+		});
+	};
 }
 
 /**
@@ -179,15 +220,15 @@ function obviusUsernameAndPasswordAuthMiddleware(action) {
 				}
 			}
 		});
-	}
+	};
 }
 
 /**
  * Middleware function to force a route to provide optional authentication
  * Verifies the request's token against the server's secret token
  * Sets the req field hasValidAuthToken to true or false
  */
-optionalAuthMiddleware = (req, res, next) => {
+const optionalAuthMiddleware = (req, res, next) => {
 	// Set auth token to false initially.
 	req.hasValidAuthToken = false;
 
@@ -201,26 +242,28 @@ optionalAuthMiddleware = (req, res, next) => {
 	if (!validate(token, validParams).valid) {
 		next();
 	} else if (token) {
-		jwt.verify(token, secretToken, (err, decoded) => {
-			if (err) {
-				// do nothing. Could log here if need be
-			} else {
+		verifyActiveTokenAndGetUser(token)
+			.then(({ decoded }) => {
 				req.decoded = decoded;
 				req.hasValidAuthToken = true;
-			}
-			next();
-		});
+				next();
+			})
+			.catch(() => {
+				next();
+			});
 	} else {
 		next();
 	}
 };
 
 module.exports = {
+	authMiddleware,
 	adminAuthMiddleware,
 	csvAuthMiddleware,
 	exportAuthMiddleware,
 	obviusUsernameAndPasswordAuthMiddleware,
 	optionalAuthMiddleware,
 	verifyCredentials,
+	verifyActiveTokenAndGetUser,
 	credentialsRequestValidationMiddleware
 };