gru/rustpad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security upgrade

Browse Source
This commit is contained in:
Mateusz Gruszczyński
2026-07-30 09:57:43 +02:00
parent 2274cf57c9
commit f6b8e016a8
24 changed files with 1100 additions and 272 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/js/session.js
+24 -18
View File
@@ -7,13 +7,23 @@
* See LICENSE file in repository root for details.
*/
const ACCESS_STORAGE_VERSION_KEY = "rustpad:access-storage-version";
const ACCESS_STORAGE_VERSION = "http-only-cookie-v1";
export function accessTokenKey(resourceKind, resourceSlug) { return `rustpad:access:${resourceKind}:${resourceSlug}`; }
export function getAccessToken(resourceKind, resourceSlug) {
return localStorage.getItem(accessTokenKey(resourceKind, resourceSlug)) || "";
if (localStorage.getItem(ACCESS_STORAGE_VERSION_KEY) !== ACCESS_STORAGE_VERSION) {
for (let i = localStorage.length - 1; i >= 0; i--) {
const key = localStorage.key(i);
if (key?.startsWith("rustpad:access:")) localStorage.removeItem(key);
}
localStorage.setItem(ACCESS_STORAGE_VERSION_KEY, ACCESS_STORAGE_VERSION);
}
export function setAccessToken(resourceKind, resourceSlug, token) {
export function getAccessToken(resourceKind, resourceSlug) {
return localStorage.getItem(accessTokenKey(resourceKind, resourceSlug)) ? "cookie" : "";
}
export function setAccessToken(resourceKind, resourceSlug, granted) {
const key = accessTokenKey(resourceKind, resourceSlug);
if (token) localStorage.setItem(key, token);
if (granted) localStorage.setItem(key, "1");
else localStorage.removeItem(key);
}
// Remove plaintext passwords saved by the previous frontend version.
@@ -59,28 +69,24 @@ export function getGuestId() {
return guestId;
}
const AUTH_TOKEN_KEY = "rustpad:auth-token";
// Account sessions must be shared by every tab on this origin. Keep a
// compatibility fallback for sessions created by older frontend versions.
const legacySessionToken = sessionStorage.getItem(AUTH_TOKEN_KEY);
if (legacySessionToken && !localStorage.getItem(AUTH_TOKEN_KEY)) {
localStorage.setItem(AUTH_TOKEN_KEY, legacySessionToken);
}
sessionStorage.removeItem(AUTH_TOKEN_KEY);
export function getAuthToken() { return localStorage.getItem(AUTH_TOKEN_KEY) || ""; }
const AUTH_STATE_KEY = "rustpad:auth-state";
// Remove browser-readable account tokens created by older frontend versions.
localStorage.removeItem("rustpad:auth-token");
sessionStorage.removeItem("rustpad:auth-token");
export function getAuthToken() { return localStorage.getItem(AUTH_STATE_KEY) ? "cookie" : ""; }
export function setAuthSession(session) {
localStorage.setItem(AUTH_TOKEN_KEY, session.token);
sessionStorage.removeItem(AUTH_TOKEN_KEY);
localStorage.setItem(AUTH_STATE_KEY, "1");
setNickname(session.nickname);
}
export function clearAuthSession() {
localStorage.removeItem(AUTH_TOKEN_KEY);
sessionStorage.removeItem(AUTH_TOKEN_KEY);
localStorage.removeItem(AUTH_STATE_KEY);
localStorage.removeItem("rustpad:auth-token");
sessionStorage.removeItem("rustpad:auth-token");
localStorage.removeItem(NICKNAME_KEY);
sessionStorage.removeItem(NICKNAME_KEY);
setNicknameCookie("");
}
export async function resolveIdentity(api, nickname) {
const result = await api("/api/auth/identity", { method: "POST", body: JSON.stringify({ nickname, session_token: getAuthToken() || null }) });
const result = await api("/api/auth/identity", { method: "POST", body: JSON.stringify({ nickname }) });
setNickname(result.nickname); return result;
}