social-reporting-tool/v2/server/auth/password-fallback.ts

// Emergency password login. OFF in prod by default. Lifted from V1 dashboard/server.ts:351-386
// but adapted to V2: still upserts a user row keyed on a deterministic synthetic oid so the
// same DASH_USER lands in the users table consistently.
import type { IncomingMessage, ServerResponse } from 'node:http';
import { envBool, envStr } from '../lib/env.js';
import { parseJSONBody, sendJSON, clientIp } from '../lib/http.js';
import { issueSession, setSessionCookie } from './session.js';
import { landSsoUser } from './upsert-user.js';

const RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
const RATE_LIMIT_MAX = 5;
const attempts = new Map<string, { count: number; firstAt: number }>();

function isRateLimited(ip: string): boolean {
  const r = attempts.get(ip);
  if (!r) return false;
  if (Date.now() - r.firstAt > RATE_LIMIT_WINDOW_MS) { attempts.delete(ip); return false; }
  return r.count >= RATE_LIMIT_MAX;
}

function recordAttempt(ip: string): void {
  const now = Date.now();
  const r = attempts.get(ip);
  if (!r || now - r.firstAt > RATE_LIMIT_WINDOW_MS) {
    attempts.set(ip, { count: 1, firstAt: now });
  } else {
    r.count++;
  }
}

export async function handlePasswordLogin(req: IncomingMessage, res: ServerResponse): Promise<void> {
  if (!envBool('ALLOW_PASSWORD_FALLBACK', false)) {
    sendJSON(res, 404, { ok: false, error: 'Password login not enabled' });
    return;
  }
  const ip = clientIp(req);
  if (isRateLimited(ip)) {
    sendJSON(res, 429, { ok: false, error: 'Too many attempts. Try again in 15 minutes.' });
    return;
  }
  const DASH_USER = envStr('DASH_USER');
  const DASH_PASS = envStr('DASH_PASS');
  if (!DASH_USER || !DASH_PASS) {
    sendJSON(res, 503, { ok: false, error: 'Password login misconfigured' });
    return;
  }

  let username = '', password = '';
  try {
    const body = await parseJSONBody<{ username?: string; password?: string }>(req);
    username = body.username ?? '';
    password = body.password ?? '';
  } catch { sendJSON(res, 400, { ok: false, error: 'Invalid body' }); return; }

  if (username !== DASH_USER || password !== DASH_PASS) {
    recordAttempt(ip);
    sendJSON(res, 401, { ok: false, error: 'Invalid username or password' });
    return;
  }
  attempts.delete(ip);

  // Land the password user the same way SSO users land — deterministic synthetic oid.
  const oid = `pw:${DASH_USER}`;
  const email = `${DASH_USER}@local.password-fallback`;
  const landed = await landSsoUser({ oid, email, display_name: DASH_USER });
  const token = issueSession({
    user_id: landed.user.id,
    email: landed.user.email,
    active_team_id: landed.active_team_id,
    auth_method: 'password',
  });
  setSessionCookie(res, token);
  sendJSON(res, 200, { ok: true, user: { id: landed.user.id, email: landed.user.email, name: landed.user.display_name } });
}