fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

api/pkg/authtoken/authtoken.go

@@ -2,6 +2,7 @@ package authtoken
 
 import (
 	"crypto/hmac"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
@@ -26,8 +27,14 @@ var (
 	ErrInvalid     = errors.New("token is invalid")
 	ErrExpired     = errors.New("token is expired")
 	ErrNotYetValid = errors.New("token is not yet valid")
+	ErrRevoked     = errors.New("token is revoked")
 )
 
+type RevocationStore interface {
+	Revoke(id string, expiresAt time.Time) error
+	IsRevoked(id string) (bool, error)
+}
+
 type Claims map[string]any
 
 type header struct {
@@ -36,8 +43,9 @@ type header struct {
 }
 
 type Auth struct {
-	secret []byte
-	clock  func() time.Time
+	secret      []byte
+	clock       func() time.Time
+	revocations RevocationStore
 }
 
 type Option func(*Auth)
@@ -46,6 +54,10 @@ func WithClock(clock func() time.Time) Option {
 	return func(a *Auth) { a.clock = clock }
 }
 
+func WithRevocationStore(store RevocationStore) Option {
+	return func(a *Auth) { a.revocations = store }
+}
+
 func New(secret []byte, options ...Option) *Auth {
 	auth := &Auth{secret: secret, clock: time.Now}
 	for _, option := range options {
@@ -66,6 +78,9 @@ func (a *Auth) Encode(claims map[string]any) (string, error) {
 	if _, ok := payload["exp"]; !ok {
 		payload["exp"] = now.Add(SessionLifetime).Unix()
 	}
+	if _, ok := payload["jti"]; !ok {
+		payload["jti"] = rand.Text()
+	}
 
 	headerSegment, err := encodeSegment(header{Algorithm: algorithmHS256, Type: tokenType})
 	if err != nil {
@@ -111,9 +126,46 @@ func (a *Auth) Decode(token string) (Claims, error) {
 	if err := a.validateTimes(claims); err != nil {
 		return nil, err
 	}
+	if err := a.checkRevocation(claims); err != nil {
+		return nil, err
+	}
 	return claims, nil
 }
 
+func (a *Auth) Revoke(claims Claims) error {
+	id, ok := claims["jti"].(string)
+	if !ok || a.revocations == nil {
+		return nil
+	}
+	expiry, present, err := numericDate(claims, "exp")
+	if err != nil || !present {
+		return ErrInvalid
+	}
+	return a.revocations.Revoke(id, expiry)
+}
+
+func (a *Auth) checkRevocation(claims Claims) error {
+	raw, present := claims["jti"]
+	if !present {
+		return nil
+	}
+	id, ok := raw.(string)
+	if !ok {
+		return ErrInvalid
+	}
+	if a.revocations == nil {
+		return nil
+	}
+	revoked, err := a.revocations.IsRevoked(id)
+	if err != nil {
+		return errors.Join(ErrInvalid, err)
+	}
+	if revoked {
+		return ErrRevoked
+	}
+	return nil
+}
+
 func (a *Auth) validateTimes(claims Claims) error {
 	now := a.clock()
 
@@ -121,7 +173,10 @@ func (a *Auth) validateTimes(claims Claims) error {
 	if err != nil {
 		return err
 	}
-	if present && !now.Before(expiry) {
+	if !present {
+		return ErrInvalid
+	}
+	if !now.Before(expiry) {
 		return ErrExpired
 	}