auth: db transaction drain into cached map lookups

UndauntedMetagame/src/controllers/apikeycache.ts

@@ -0,0 +1,74 @@
+import crypto from "crypto";
+import { logger } from "../logger";
+
+type KeyRow = { keyHash: string | null }
+type APIKeyLookup<T> = {
+    find: (apiKey: string) => Promise<T | undefined>,
+    has: (apiKey: string) => Promise<boolean>,
+    refresh: () => Promise<void>
+}
+
+export function HashAPIKey(apiKeyToHash: string){
+    return crypto.createHash("sha256").update(apiKeyToHash, "utf8").digest("hex");
+}
+
+function normalizeHash(cacheName: string, keyHash: string | null){
+    if(keyHash === null){
+        return undefined;
+    }
+
+    const hashBytes = Buffer.from(keyHash, "hex").length;
+
+    if(hashBytes !== 32){
+        logger.warn(`Ignoring invalid ${cacheName} API Key hash with ${hashBytes} bytes`);
+        return undefined;
+    }
+
+    return keyHash.toLowerCase();
+}
+
+function cached<T>(loadFresh: () => Promise<T>){
+    let cache: Promise<T> | undefined = undefined;
+
+    function load(){
+        const fresh = loadFresh().catch((error) => {
+            if(cache === fresh){
+                cache = undefined;
+            }
+
+            throw error;
+        });
+
+        return fresh;
+    }
+
+    return {
+        get: () => cache ??= load(),
+        refresh: () => cache = load()
+    };
+}
+
+export function CreateAPIKeyCache<TRow extends KeyRow, TValue = boolean>(
+    cacheName: string,
+    loadRows: () => Promise<TRow[]>,
+    select: (row: TRow) => TValue = () => true as TValue
+): APIKeyLookup<TValue> {
+    const keys = cached(async () => new Map(
+        (await loadRows()).flatMap((row): [string, TValue][] => {
+            const hash = normalizeHash(cacheName, row.keyHash);
+            return hash === undefined ? [] : [[hash, select(row)]];
+        })
+    ));
+
+    return {
+        async find(apiKey: string){
+            return (await keys.get()).get(HashAPIKey(apiKey));
+        },
+        async has(apiKey: string){
+            return (await keys.get()).has(HashAPIKey(apiKey));
+        },
+        async refresh(){
+            await keys.refresh();
+        }
+    };
+}

UndauntedMetagame/src/controllers/authgameserver.ts

@@ -0,0 +1,40 @@
+import {GetDb} from "../db"
+import { gameserverapikeys, gameserverapikeystoregister } from "../db/schema";
+import { logger } from "../logger";
+import { CreateAPIKeyCache, HashAPIKey } from "./apikeycache";
+
+const GameserverKeys = CreateAPIKeyCache("Gameserver", () =>
+    GetDb().query.gameserverapikeys.findMany({
+        columns: {
+            keyHash: true
+        }
+    })
+);
+
+export async function DrainAndRegisterAPIKeys(){
+    const RegisteredAPIKeyCount = GetDb().transaction((tx) => {
+        const KeysToRegister = tx.query.gameserverapikeystoregister.findMany({
+            columns: {
+                key: true
+            }
+        }).sync();
+
+        if(KeysToRegister.length > 0){
+            tx.insert(gameserverapikeys).values(KeysToRegister.map((APIKey) => ({
+                keyHash: HashAPIKey(APIKey.key)
+            }))).run();
+
+            tx.delete(gameserverapikeystoregister).run();
+        }
+
+        return KeysToRegister.length;
+    });
+
+    await GameserverKeys.refresh();
+
+    logger.info(`Registered ${RegisteredAPIKeyCount} new Gameserver API Key(s) on boot!`);
+}
+
+export async function IsValidGameserverAPIKey(GameserverAPIKey: string){
+    return GameserverKeys.has(GameserverAPIKey);
+}

UndauntedMetagame/src/controllers/authuser.ts

@@ -0,0 +1,69 @@
+import jwt, {JwtPayload} from "jsonwebtoken";
+import { GetDb } from "../db";
+import { userapikeys, userapikeystoregister } from "../db/schema";
+import { logger } from "../logger";
+import { CreateAPIKeyCache, HashAPIKey } from "./apikeycache";
+
+const PRIVKEY = Buffer.from(process.env.AUTH_SIGNING_PRIVKEY_B64!, "base64").toString("utf-8");
+const PUBKEY = Buffer.from(process.env.AUTH_SIGNING_PUBKEY_B64!, "base64").toString("utf-8");
+
+const UserKeys = CreateAPIKeyCache("User", () =>
+    GetDb().query.userapikeys.findMany({
+        columns: {
+            keyHash: true,
+            userId: true
+        }
+    }),
+    (Row) => Row.userId
+);
+
+export async function DrainAndRegisterUserAPIKeys(){
+    const RegisteredAPIKeyCount = GetDb().transaction((tx) => {
+        const KeysToRegister = tx.query.userapikeystoregister.findMany({
+            columns: {
+                userId: true,
+                key: true
+            }
+        }).sync();
+
+        if(KeysToRegister.length > 0){
+            tx.insert(userapikeys).values(KeysToRegister.map((APIKey) => ({
+                userId: APIKey.userId,
+                keyHash: HashAPIKey(APIKey.key)
+            }))).run();
+
+            tx.delete(userapikeystoregister).run();
+        }
+
+        return KeysToRegister.length;
+    });
+
+    await UserKeys.refresh();
+
+    logger.info(`Registered ${RegisteredAPIKeyCount} new User API Key(s) on boot!`);
+}
+
+export async function GetUserIDForAPIKey(UserAPIKey: string){
+    return UserKeys.find(UserAPIKey);
+}
+
+function SignMetagameJWTForUid(userId: string){
+    return jwt.sign({
+        userId: userId
+    }, PRIVKEY, {
+        algorithm: "RS256",
+        expiresIn: "24h",
+        issuer: "undaunted-metagame",
+        audience: "undaunted-metagame"
+    });
+}
+
+function ValidateMetagameJWTAndGetPayload(token: string){
+    return jwt.verify(token, PUBKEY, {
+        algorithms: ["RS256"],
+        issuer: "undaunted-metagame",
+        audience: "undaunted-metagame"
+    });
+}
+
+export { SignMetagameJWTForUid, ValidateMetagameJWTAndGetPayload }

UndauntedMetagame/src/middleware/HasUndauntedMetagameAuth.ts

@@ -1,7 +1,7 @@
 import { NextFunction, Request, Response } from "express";
 import { logger } from "../logger";
-import { ValidateMetagameJWTAndGetPayload } from "../controllers/auth";
-import { IsValidGameserverAPIKey } from "../controllers/apikeys";
+import { ValidateMetagameJWTAndGetPayload } from "../controllers/authuser";
+import { IsValidGameserverAPIKey } from "../controllers/authgameserver";
 import { JwtPayload } from "jsonwebtoken";
 
 export async function HasUndauntedMetagameAuth(req: Request, res: Response, next: NextFunction){

UndauntedMetagame/src/routes/eos.ts

@@ -1,6 +1,6 @@
 import { Router } from "express";
 import { logger } from "../logger";
-import { GetUserIDForAPIKey, SignMetagameJWTForUid } from "../controllers/auth";
+import { GetUserIDForAPIKey, SignMetagameJWTForUid } from "../controllers/authuser";
 import { HasUndauntedMetagameAuth } from "../middleware/HasUndauntedMetagameAuth";
 import { GetUsernameForUserId } from "../controllers/login";
 
@@ -137,4 +137,4 @@ eosRouter.get("/account/api/public/account", HasUndauntedMetagameAuth, (req: any
         "minorVerified": false,
         "minorStatus": "NOT_MINOR"
     });
-});
+});

UndauntedMetagame/src/server.ts

@@ -1,6 +1,6 @@
 import { app } from "./app";
-import { DrainAndRegisterAPIKeys } from "./controllers/apikeys";
-import { DrainAndRegisterUserAPIKeys } from "./controllers/auth";
+import { DrainAndRegisterAPIKeys } from "./controllers/authgameserver";
+import { DrainAndRegisterUserAPIKeys } from "./controllers/authuser";
 import { GetDb } from "./db";
 import { logger } from "./logger";
 
@@ -15,4 +15,4 @@ DrainAndRegisterAPIKeys().then(async () => {
     logger.info(`Undaunted Metagame on port ${PORT}`);
     logger.info(`Clear Skies, Slayer.`);
   });
-});
+});