Merge 49edf0d830 into 20820f5a5a

Co-authored-by: Frank Elsinga <frank@elsinga.de>

extra/change-username.js

@@ -0,0 +1,65 @@
+console.log("== Uptime Kuma Change Username Tool ==");
+
+const Database = require("../server/database");
+const { R } = require("redbean-node");
+const readline = require("readline");
+const { initJWTSecret } = require("../server/util-server");
+const User = require("../server/model/user");
+const args = require("args-parser")(process.argv);
+const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+});
+
+const main = async () => {
+    console.log("Connecting the database");
+    Database.init(args);
+    await Database.connect(false, false, true);
+
+    try {
+        // No need to actually reset the password for testing, just make sure no connection problem. It is ok for now.
+        if (!process.env.TEST_BACKEND) {
+            const user = await R.findOne("user");
+            if (! user) {
+                throw new Error("user not found, have you installed?");
+            }
+
+            console.log("Found user: " + user.username);
+            let newUsername = await question("New username: ");
+            await User.updateUsername(user.id, newUsername);
+
+            // Reset all sessions by reset jwt secret
+            await initJWTSecret();
+
+            console.log("Username change successfully.");
+        }
+    } catch (e) {
+        console.error("Error: " + e.message);
+    }
+
+    await Database.close();
+    rl.close();
+
+    console.log("Finished.");
+};
+
+/**
+ * Ask question of user
+ * @param {string} question Question to ask
+ * @returns {Promise<string>} Users response
+ */
+function question(question) {
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            resolve(answer);
+        });
+    });
+}
+
+if (!process.env.TEST_BACKEND) {
+    main();
+}
+
+module.exports = {
+    main,
+};

package-lock.json

@@ -1,12 +1,12 @@
 {
     "name": "uptime-kuma",
-    "version": "2.0.0-beta.0",
+    "version": "2.0.0-beta.1",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "uptime-kuma",
-            "version": "2.0.0-beta.0",
+            "version": "2.0.0-beta.1",
             "license": "MIT",
             "dependencies": {
                 "@grpc/grpc-js": "~1.8.22",
@@ -37,8 +37,8 @@
                 "html-escaper": "^3.0.3",
                 "http-cookie-agent": "~5.0.4",
                 "http-graceful-shutdown": "~3.1.7",
-                "http-proxy-agent": "~5.0.0",
+                "http-proxy-agent": "~7.0.2",
-                "https-proxy-agent": "~5.0.1",
+                "https-proxy-agent": "~7.0.6",
                 "iconv-lite": "~0.6.3",
                 "isomorphic-ws": "^5.0.0",
                 "jsesc": "~3.0.2",
@@ -60,7 +60,7 @@
                 "node-cloudflared-tunnel": "~1.0.9",
                 "node-radius-client": "~1.0.0",
                 "nodemailer": "~6.9.13",
-                "nostr-tools": "^1.13.1",
+                "nostr-tools": "^2.10.4",
                 "notp": "~2.0.3",
                 "openid-client": "^5.4.2",
                 "password-hash": "~1.2.2",
@@ -77,7 +77,7 @@
                 "semver": "~7.5.4",
                 "socket.io": "~4.8.0",
                 "socket.io-client": "~4.8.0",
-                "socks-proxy-agent": "6.1.1",
+                "socks-proxy-agent": "~8.0.5",
                 "tar": "~6.2.1",
                 "tcp-ping": "~0.1.1",
                 "thirty-two": "~1.0.2",
@@ -1052,32 +1052,6 @@
                 "node": ">=18.0.0"
             }
         },
-        "node_modules/@azure/core-rest-pipeline/node_modules/http-proxy-agent": {
-            "version": "7.0.2",
-            "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-            "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-            "license": "MIT",
-            "dependencies": {
-                "agent-base": "^7.1.0",
-                "debug": "^4.3.4"
-            },
-            "engines": {
-                "node": ">= 14"
-            }
-        },
-        "node_modules/@azure/core-rest-pipeline/node_modules/https-proxy-agent": {
-            "version": "7.0.6",
-            "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-            "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-            "license": "MIT",
-            "dependencies": {
-                "agent-base": "^7.1.2",
-                "debug": "4"
-            },
-            "engines": {
-                "node": ">= 14"
-            }
-        },
         "node_modules/@azure/core-tracing": {
             "version": "1.2.0",
             "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.2.0.tgz",
@@ -2827,6 +2801,29 @@
                 "node-pre-gyp": "bin/node-pre-gyp"
             }
         },
+        "node_modules/@mapbox/node-pre-gyp/node_modules/agent-base": {
+            "version": "6.0.2",
+            "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+            "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+            "dependencies": {
+                "debug": "4"
+            },
+            "engines": {
+                "node": ">= 6.0.0"
+            }
+        },
+        "node_modules/@mapbox/node-pre-gyp/node_modules/https-proxy-agent": {
+            "version": "5.0.1",
+            "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+            "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+            "dependencies": {
+                "agent-base": "6",
+                "debug": "4"
+            },
+            "engines": {
+                "node": ">= 6"
+            }
+        },
         "node_modules/@mongodb-js/saslprep": {
             "version": "1.1.9",
             "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.1.9.tgz",
@@ -2838,9 +2835,9 @@
             }
         },
         "node_modules/@noble/ciphers": {
-            "version": "0.2.0",
+            "version": "0.5.3",
-            "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-0.2.0.tgz",
+            "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-0.5.3.tgz",
-            "integrity": "sha512-6YBxJDAapHSdd3bLDv6x2wRPwq4QFMUaB3HvljNBUTThDd12eSm7/3F+2lnfzx2jvM+S6Nsy0jEt9QbPqSwqRw==",
+            "integrity": "sha512-B0+6IIHiqEs3BPMT0hcRmHvEj2QHOLu+uwt+tqDDeVd0oyVzh7BPrDcPjRnV1PV/5LaknXJJQvOuRGR0zQJz+w==",
             "license": "MIT",
             "funding": {
                 "url": "https://paulmillr.com/funding/"
@@ -4270,15 +4267,6 @@
                 "testcontainers": "^10.16.0"
             }
         },
-        "node_modules/@tootallnate/once": {
-            "version": "2.0.0",
-            "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.0.tgz",
-            "integrity": "sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==",
-            "license": "MIT",
-            "engines": {
-                "node": ">= 10"
-            }
-        },
         "node_modules/@types/accepts": {
             "version": "1.3.7",
             "resolved": "https://registry.npmjs.org/@types/accepts/-/accepts-1.3.7.tgz",
@@ -10117,29 +10105,15 @@
             }
         },
         "node_modules/http-proxy-agent": {
-            "version": "5.0.0",
+            "version": "7.0.2",
-            "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-5.0.0.tgz",
+            "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-            "integrity": "sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==",
+            "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-            "license": "MIT",
             "dependencies": {
-                "@tootallnate/once": "2",
+                "agent-base": "^7.1.0",
-                "agent-base": "6",
+                "debug": "^4.3.4"
-                "debug": "4"
             },
             "engines": {
-                "node": ">= 6"
+                "node": ">= 14"
-            }
-        },
-        "node_modules/http-proxy-agent/node_modules/agent-base": {
-            "version": "6.0.2",
-            "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-            "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-            "license": "MIT",
-            "dependencies": {
-                "debug": "4"
-            },
-            "engines": {
-                "node": ">= 6.0.0"
             }
         },
         "node_modules/http2-wrapper": {
@@ -10156,28 +10130,15 @@
             }
         },
         "node_modules/https-proxy-agent": {
-            "version": "5.0.1",
+            "version": "7.0.6",
-            "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+            "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-            "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+            "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-            "license": "MIT",
             "dependencies": {
-                "agent-base": "6",
+                "agent-base": "^7.1.2",
                 "debug": "4"
             },
             "engines": {
-                "node": ">= 6"
+                "node": ">= 14"
-            }
-        },
-        "node_modules/https-proxy-agent/node_modules/agent-base": {
-            "version": "6.0.2",
-            "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-            "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-            "license": "MIT",
-            "dependencies": {
-                "debug": "4"
-            },
-            "engines": {
-                "node": ">= 6.0.0"
             }
         },
         "node_modules/human-signals": {
@@ -11679,6 +11640,33 @@
                 "node": ">= 6"
             }
         },
+        "node_modules/make-fetch-happen/node_modules/https-proxy-agent": {
+            "version": "5.0.1",
+            "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+            "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+            "optional": true,
+            "dependencies": {
+                "agent-base": "6",
+                "debug": "4"
+            },
+            "engines": {
+                "node": ">= 6"
+            }
+        },
+        "node_modules/make-fetch-happen/node_modules/socks-proxy-agent": {
+            "version": "6.2.1",
+            "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-6.2.1.tgz",
+            "integrity": "sha512-a6KW9G+6B3nWZ1yB8G7pJwL3ggLy1uTzKAgCb7ttblwqdz9fMGJUuTy3uFzEP48FAs9FLILlmzDlE2JJhVQaXQ==",
+            "optional": true,
+            "dependencies": {
+                "agent-base": "^6.0.2",
+                "debug": "^4.3.3",
+                "socks": "^2.6.2"
+            },
+            "engines": {
+                "node": ">= 10"
+            }
+        },
         "node_modules/map-obj": {
             "version": "4.3.0",
             "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-4.3.0.tgz",
@@ -12582,18 +12570,21 @@
             }
         },
         "node_modules/nostr-tools": {
-            "version": "1.17.0",
+            "version": "2.10.4",
-            "resolved": "https://registry.npmjs.org/nostr-tools/-/nostr-tools-1.17.0.tgz",
+            "resolved": "https://registry.npmjs.org/nostr-tools/-/nostr-tools-2.10.4.tgz",
-            "integrity": "sha512-LZmR8GEWKZeElbFV5Xte75dOeE9EFUW/QLI1Ncn3JKn0kFddDKEfBbFN8Mu4TMs+L4HR/WTPha2l+PPuRnJcMw==",
+            "integrity": "sha512-biU7sk+jxHgVASfobg2T5ttxOGGSt69wEVBC51sHHOEaKAAdzHBLV/I2l9Rf61UzClhliZwNouYhqIso4a3HYg==",
             "license": "Unlicense",
             "dependencies": {
-                "@noble/ciphers": "0.2.0",
+                "@noble/ciphers": "^0.5.1",
-                "@noble/curves": "1.1.0",
+                "@noble/curves": "1.2.0",
                 "@noble/hashes": "1.3.1",
                 "@scure/base": "1.1.1",
                 "@scure/bip32": "1.3.1",
                 "@scure/bip39": "1.2.1"
             },
+            "optionalDependencies": {
+                "nostr-wasm": "0.1.0"
+            },
             "peerDependencies": {
                 "typescript": ">=5.0.0"
             },
@@ -12603,6 +12594,37 @@
                 }
             }
         },
+        "node_modules/nostr-tools/node_modules/@noble/curves": {
+            "version": "1.2.0",
+            "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.2.0.tgz",
+            "integrity": "sha512-oYclrNgRaM9SsBUBVbb8M6DTV7ZHRTKugureoYEncY5c65HOmRzvSiTE3y5CYaPYJA/GVkrhXEoF0M3Ya9PMnw==",
+            "license": "MIT",
+            "dependencies": {
+                "@noble/hashes": "1.3.2"
+            },
+            "funding": {
+                "url": "https://paulmillr.com/funding/"
+            }
+        },
+        "node_modules/nostr-tools/node_modules/@noble/curves/node_modules/@noble/hashes": {
+            "version": "1.3.2",
+            "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.3.2.tgz",
+            "integrity": "sha512-MVC8EAQp7MvEcm30KWENFjgR+Mkmf+D189XJTkFIlwohU5hcBbn1ZkKq7KVTi2Hme3PMGF390DaL52beVrIihQ==",
+            "license": "MIT",
+            "engines": {
+                "node": ">= 16"
+            },
+            "funding": {
+                "url": "https://paulmillr.com/funding/"
+            }
+        },
+        "node_modules/nostr-wasm": {
+            "version": "0.1.0",
+            "resolved": "https://registry.npmjs.org/nostr-wasm/-/nostr-wasm-0.1.0.tgz",
+            "integrity": "sha512-78BTryCLcLYv96ONU8Ws3Q1JzjlAt+43pWQhIl86xZmWeegYCNLPml7yQ+gG3vR6V5h4XGj+TxO+SS5dsThQIA==",
+            "license": "MIT",
+            "optional": true
+        },
         "node_modules/notp": {
             "version": "2.0.3",
             "resolved": "https://registry.npmjs.org/notp/-/notp-2.0.3.tgz",
@@ -15227,29 +15249,16 @@
             }
         },
         "node_modules/socks-proxy-agent": {
-            "version": "6.1.1",
+            "version": "8.0.5",
-            "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-6.1.1.tgz",
+            "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-            "integrity": "sha512-t8J0kG3csjA4g6FTbsMOWws+7R7vuRC8aQ/wy3/1OWmsgwA68zs/+cExQ0koSitUDXqhufF/YJr9wtNMZHw5Ew==",
+            "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
-            "license": "MIT",
             "dependencies": {
-                "agent-base": "^6.0.2",
+                "agent-base": "^7.1.2",
-                "debug": "^4.3.1",
+                "debug": "^4.3.4",
-                "socks": "^2.6.1"
+                "socks": "^2.8.3"
             },
             "engines": {
-                "node": ">= 10"
+                "node": ">= 14"
-            }
-        },
-        "node_modules/socks-proxy-agent/node_modules/agent-base": {
-            "version": "6.0.2",
-            "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-            "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-            "license": "MIT",
-            "dependencies": {
-                "debug": "4"
-            },
-            "engines": {
-                "node": ">= 6.0.0"
             }
         },
         "node_modules/sortablejs": {

package.json

@@ -44,6 +44,7 @@
         "setup": "git checkout 1.23.15 && npm ci --production && npm run download-dist",
         "download-dist": "node extra/download-dist.js",
         "mark-as-nightly": "node extra/mark-as-nightly.js",
+        "change-username": "node extra/change-username.js",
         "reset-password": "node extra/reset-password.js",
         "remove-2fa": "node extra/remove-2fa.js",
         "simple-dns-server": "node extra/simple-dns-server.js",
@@ -95,8 +96,8 @@
         "html-escaper": "^3.0.3",
         "http-cookie-agent": "~5.0.4",
         "http-graceful-shutdown": "~3.1.7",
-        "http-proxy-agent": "~5.0.0",
+        "http-proxy-agent": "~7.0.2",
-        "https-proxy-agent": "~5.0.1",
+        "https-proxy-agent": "~7.0.6",
         "iconv-lite": "~0.6.3",
         "isomorphic-ws": "^5.0.0",
         "jsesc": "~3.0.2",
@@ -118,7 +119,7 @@
         "node-cloudflared-tunnel": "~1.0.9",
         "node-radius-client": "~1.0.0",
         "nodemailer": "~6.9.13",
-        "nostr-tools": "^1.13.1",
+        "nostr-tools": "^2.10.4",
         "notp": "~2.0.3",
         "openid-client": "^5.4.2",
         "password-hash": "~1.2.2",
@@ -135,7 +136,7 @@
         "semver": "~7.5.4",
         "socket.io": "~4.8.0",
         "socket.io-client": "~4.8.0",
-        "socks-proxy-agent": "6.1.1",
+        "socks-proxy-agent": "~8.0.5",
         "tar": "~6.2.1",
         "tcp-ping": "~0.1.1",
         "thirty-two": "~1.0.2",

server/auth.js

@@ -7,6 +7,9 @@ const { loginRateLimiter, apiRateLimiter } = require("./rate-limiter");
 const { Settings } = require("./settings");
 const dayjs = require("dayjs");
 
+const remoteAuthEnabled = process.env.REMOTE_AUTH_ENABLED || false;
+const remoteAuthHeader = process.env.REMOTE_AUTH_HEADER || "Remote-User";
+
 /**
  * Login to web app
  * @param {string} username Username to login with
@@ -133,29 +136,40 @@ function userAuthorizer(username, password, callback) {
  * @returns {Promise<void>}
  */
 exports.basicAuth = async function (req, res, next) {
-    const middleware = basicAuth({
-        authorizer: userAuthorizer,
-        authorizeAsync: true,
-        challenge: true,
-    });
-
     const disabledAuth = await setting("disableAuth");
 
-    if (!disabledAuth) {
+    if (remoteAuthEnabled) {
-        middleware(req, res, next);
+        const remoteUser = req.headers[remoteAuthHeader.toLowerCase()];
-    } else {
+        if (remoteUser !== undefined) {
-        next();
+            let user = await R.findOne("user", " username = ? AND active = 1 ", [ remoteUser ]);
+            if (user) {
+                next();
+                return;
+            }
+        }
     }
+
+    if (!disabledAuth) {
+        const middleware = basicAuth({
+            authorizer: userAuthorizer,
+            authorizeAsync: true,
+            challenge: true,
+        });
+        middleware(req, res, next);
+        return;
+    }
+
+    next();
 };
 
 /**
- * Use use API Key if API keys enabled, else use basic auth
+ * Use API Key if API keys enabled, else use basic auth
  * @param {express.Request} req Express request object
  * @param {express.Response} res Express response object
  * @param {express.NextFunction} next Next handler in chain
  * @returns {Promise<void>}
  */
-exports.apiAuth = async function (req, res, next) {
+exports.authMiddleware = async function (req, res, next) {
     if (!await Settings.get("disableAuth")) {
         let usingAPIKeys = await Settings.get("apiKeysEnabled");
         let middleware;

server/model/user.js

@@ -48,6 +48,17 @@ class User extends BeanModel {
         }, jwtSecret);
     }
 
+    /**
+     * @param {number} userID ID of user to update
+     * @param {string} newUsername Users new username
+     * @returns {Promise<void>}
+     */
+    static async updateUsername(userID, newUsername) {
+        await R.exec("UPDATE `user` SET username = ? WHERE id = ? ", [
+            newUsername,
+            userID
+        ]);
+    }
 }
 
 module.exports = User;

server/notification-providers/nostr.js

@@ -1,11 +1,10 @@
 const NotificationProvider = require("./notification-provider");
 const {
-    relayInit,
+    finalizeEvent,
-    getPublicKey,
+    Relay,
-    getEventHash,
+    kinds,
-    getSignature,
     nip04,
-    nip19
+    nip19,
 } = require("nostr-tools");
 
 // polyfills for node versions
@@ -31,7 +30,6 @@ class Nostr extends NotificationProvider {
         const createdAt = Math.floor(Date.now() / 1000);
 
         const senderPrivateKey = await this.getPrivateKey(notification.sender);
-        const senderPublicKey = getPublicKey(senderPrivateKey);
         const recipientsPublicKeys = await this.getPublicKeys(notification.recipients);
 
         // Create NIP-04 encrypted direct message event for each recipient
@@ -39,34 +37,41 @@ class Nostr extends NotificationProvider {
         for (const recipientPublicKey of recipientsPublicKeys) {
             const ciphertext = await nip04.encrypt(senderPrivateKey, recipientPublicKey, msg);
             let event = {
-                kind: 4,
+                kind: kinds.EncryptedDirectMessage,
-                pubkey: senderPublicKey,
                 created_at: createdAt,
                 tags: [[ "p", recipientPublicKey ]],
                 content: ciphertext,
             };
-            event.id = getEventHash(event);
+            const signedEvent = finalizeEvent(event, senderPrivateKey);
-            event.sig = getSignature(event, senderPrivateKey);
+            events.push(signedEvent);
-            events.push(event);
         }
 
         // Publish events to each relay
         const relays = notification.relays.split("\n");
         let successfulRelays = 0;
-
-        // Connect to each relay
         for (const relayUrl of relays) {
-            const relay = relayInit(relayUrl);
+            const relay = await Relay.connect(relayUrl);
-            try {
+            let eventIndex = 0;
-                await relay.connect();
-                successfulRelays++;
 
-                // Publish events
+            // Authenticate to the relay, if required
-                for (const event of events) {
+            try {
-                    relay.publish(event);
+                await relay.publish(events[0]);
-                }
+                eventIndex = 1;
             } catch (error) {
-                continue;
+                if (relay.challenge) {
+                    await relay.auth(async (evt) => {
+                        return finalizeEvent(evt, senderPrivateKey);
+                    });
+                }
+            }
+
+            try {
+                for (let i = eventIndex; i < events.length; i++) {
+                    await relay.publish(events[i]);
+                }
+                successfulRelays++;
+            } catch (error) {
+                console.error(`Failed to publish event to ${relayUrl}:`, error);
             } finally {
                 relay.close();
             }
@@ -90,7 +95,7 @@ class Nostr extends NotificationProvider {
             const { data } = senderDecodeResult;
             return data;
         } catch (error) {
-            throw new Error(`Failed to get private key: ${error.message}`);
+            throw new Error(`Failed to decode private key for sender ${sender}: ${error.message}`);
         }
     }
 
@@ -109,10 +114,10 @@ class Nostr extends NotificationProvider {
                 if (type === "npub") {
                     publicKeys.push(data);
                 } else {
-                    throw new Error("not an npub");
+                    throw new Error(`Recipient ${recipient} is not an npub`);
                 }
             } catch (error) {
-                throw new Error(`Error decoding recipient: ${error}`);
+                throw new Error(`Error decoding recipient ${recipient}: ${error}`);
             }
         }
         return publicKeys;

server/notification-providers/pushdeer.js

@@ -11,7 +11,8 @@ class PushDeer extends NotificationProvider {
     async send(notification, msg, monitorJSON = null, heartbeatJSON = null) {
         const okMsg = "Sent Successfully.";
         const serverUrl = notification.pushdeerServer || "https://api2.pushdeer.com";
-        const url = `${serverUrl.trim().replace(/\/*$/, "")}/message/push`;
+        // capture group below is nessesary to prevent an ReDOS-attack
+        const url = `${serverUrl.trim().replace(/([^/])\/+$/, "$1")}/message/push`;
 
         let valid = msg != null && monitorJSON != null && heartbeatJSON != null;
 

server/notification-providers/whapi.js

@@ -24,7 +24,7 @@ class Whapi extends NotificationProvider {
                 "body": msg,
             };
 
-            let url = (notification.whapiApiUrl || "https://gate.whapi.cloud/").replace(/\/+$/, "") + "/messages/text";
+            let url = (notification.whapiApiUrl || "https://gate.whapi.cloud/").replace(/([^/])\/+$/, "$1") + "/messages/text";
 
             await axios.post(url, data, config);
 

server/proxy.js

@@ -1,7 +1,7 @@
 const { R } = require("redbean-node");
-const HttpProxyAgent = require("http-proxy-agent");
+const { HttpProxyAgent } = require("http-proxy-agent");
-const HttpsProxyAgent = require("https-proxy-agent");
+const { HttpsProxyAgent } = require("https-proxy-agent");
-const SocksProxyAgent = require("socks-proxy-agent");
+const { SocksProxyAgent } = require("socks-proxy-agent");
 const { debug } = require("../src/util");
 const { UptimeKumaServer } = require("./uptime-kuma-server");
 const { CookieJar } = require("tough-cookie");
@@ -100,17 +100,17 @@ class Proxy {
         let jar = new CookieJar();
 
         const proxyOptions = {
-            protocol: proxy.protocol,
-            host: proxy.host,
-            port: proxy.port,
             cookies: { jar },
         };
 
+        const proxyUrl = new URL(`${proxy.protocol}://${proxy.host}:${proxy.port}`);
+
         if (proxy.auth) {
-            proxyOptions.auth = `${proxy.username}:${proxy.password}`;
+            proxyUrl.username = proxy.username;
+            proxyUrl.password = proxy.password;
         }
 
-        debug(`Proxy Options: ${JSON.stringify(proxyOptions)}`);
+        debug(`Proxy URL: ${proxyUrl.toString()}`);
         debug(`HTTP Agent Options: ${JSON.stringify(httpAgentOptions)}`);
         debug(`HTTPS Agent Options: ${JSON.stringify(httpsAgentOptions)}`);
 
@@ -122,15 +122,15 @@ class Proxy {
                 // eslint-disable-next-line no-case-declarations
                 const HttpsCookieProxyAgent = createCookieAgent(HttpsProxyAgent);
 
-                httpAgent = new HttpCookieProxyAgent({
+                httpAgent = new HttpCookieProxyAgent(proxyUrl.toString(), {
-                    ...httpAgentOptions || {},
+                    ...(httpAgentOptions || {}),
+                    ...proxyOptions,
+                });
+                httpsAgent = new HttpsCookieProxyAgent(proxyUrl.toString(), {
+                    ...(httpsAgentOptions || {}),
                     ...proxyOptions,
                 });
 
-                httpsAgent = new HttpsCookieProxyAgent({
-                    ...httpsAgentOptions || {},
-                    ...proxyOptions,
-                });
                 break;
             case "socks":
             case "socks5":
@@ -138,10 +138,9 @@ class Proxy {
             case "socks4":
                 // eslint-disable-next-line no-case-declarations
                 const SocksCookieProxyAgent = createCookieAgent(SocksProxyAgent);
-                agent = new SocksCookieProxyAgent({
+                agent = new SocksCookieProxyAgent(proxyUrl.toString(), {
                     ...httpAgentOptions,
                     ...httpsAgentOptions,
-                    ...proxyOptions,
                     tls: {
                         rejectUnauthorized: httpsAgentOptions.rejectUnauthorized,
                     },

server/server.js

@@ -104,12 +104,14 @@ log.debug("server", "Importing Background Jobs");
 const { initBackgroundJobs, stopBackgroundJobs } = require("./jobs");
 const { loginRateLimiter, twoFaRateLimiter } = require("./rate-limiter");
 
-const { apiAuth } = require("./auth");
+const { authMiddleware } = require("./auth");
 const { login } = require("./auth");
 const passwordHash = require("./password-hash");
 
-const hostname = config.hostname;
+const remoteAuthEnabled = process.env.REMOTE_AUTH_ENABLED || false;
+const remoteAuthHeader = process.env.REMOTE_AUTH_HEADER || "Remote-User";
 
+const hostname = config.hostname;
 if (hostname) {
     log.info("server", "Custom hostname: " + hostname);
 }
@@ -292,7 +294,7 @@ let needSetup = false;
 
     // Prometheus API metrics  /metrics
     // With Basic Auth using the first user's username/password
-    app.get("/metrics", apiAuth, prometheusAPIMetrics());
+    app.get("/metrics", authMiddleware, prometheusAPIMetrics());
 
     app.use("/", expressStaticGzip("dist", {
         enableBrotli: true,
@@ -1583,10 +1585,26 @@ let needSetup = false;
         // ***************************
 
         log.debug("auth", "check auto login");
-        if (await setting("disableAuth")) {
+        if (await Settings.get("disableAuth")) {
             log.info("auth", "Disabled Auth: auto login to admin");
             await afterLogin(socket, await R.findOne("user"));
             socket.emit("autoLogin");
+        } else if (remoteAuthEnabled) {
+            log.debug("auth", socket.handshake.headers);
+            const remoteUser = socket.handshake.headers[remoteAuthHeader.toLowerCase()];
+            if (remoteUser !== undefined) {
+                const user = await R.findOne("user", " username = ? AND active = 1 ", [ remoteUser ]);
+                if (user) {
+                    log.info("auth", `Login by remote-user header. IP=${await server.getClientIP(socket)}`);
+                    log.debug("auth", `Remote user ${remoteUser} exists, found user ${user.username}`);
+                    afterLogin(socket, user);
+                    socket.emit("autoLoginRemoteHeader", user.username);
+                } else {
+                    log.debug("auth", `Remote user ${remoteUser} doesn't exist`);
+                }
+            } else {
+                log.debug("auth", "Remote user header set but not found in headers");
+            }
         } else {
             socket.emit("loginRequired");
             log.debug("auth", "need auth");

src/components/settings/Security.vue

@@ -5,66 +5,67 @@
             <template v-if="!settings.disableAuth">
                 <p>
                     {{ $t("Current User") }}: <strong>{{ $root.username }}</strong>
-                    <button v-if="! settings.disableAuth" id="logout-btn" class="btn btn-danger ms-4 me-2 mb-2" @click="$root.logout">{{ $t("Logout") }}</button>
+                    <button v-if="$root.socket.token.startsWith('autoLogin') === false" id="logout-btn" class="btn btn-danger ms-4 me-2 mb-2" @click="$root.logout">{{ $t("Logout") }}</button>
                 </p>
-
+                <template v-if="$root.socket.token.startsWith('autoLogin') === false">
-                <h5 class="my-4 settings-subheading">{{ $t("Change Password") }}</h5>
+                    <h5 class="my-4 settings-subheading">{{ $t("Change Password") }}</h5>
-                <form class="mb-3" @submit.prevent="savePassword">
+                    <form class="mb-3" @submit.prevent="savePassword">
-                    <div class="mb-3">
+                        <div class="mb-3">
-                        <label for="current-password" class="form-label">
+                            <label for="current-password" class="form-label">
-                            {{ $t("Current Password") }}
+                                {{ $t("Current Password") }}
-                        </label>
+                            </label>
-                        <input
+                            <input
-                            id="current-password"
+                                id="current-password"
-                            v-model="password.currentPassword"
+                                v-model="password.currentPassword"
-                            type="password"
+                                type="password"
-                            class="form-control"
+                                class="form-control"
-                            autocomplete="current-password"
+                                autocomplete="current-password"
-                            required
+                                required
-                        />
+                            />
-                    </div>
-
-                    <div class="mb-3">
-                        <label for="new-password" class="form-label">
-                            {{ $t("New Password") }}
-                        </label>
-                        <input
-                            id="new-password"
-                            v-model="password.newPassword"
-                            type="password"
-                            class="form-control"
-                            autocomplete="new-password"
-                            required
-                        />
-                    </div>
-
-                    <div class="mb-3">
-                        <label for="repeat-new-password" class="form-label">
-                            {{ $t("Repeat New Password") }}
-                        </label>
-                        <input
-                            id="repeat-new-password"
-                            v-model="password.repeatNewPassword"
-                            type="password"
-                            class="form-control"
-                            :class="{ 'is-invalid': invalidPassword }"
-                            autocomplete="new-password"
-                            required
-                        />
-                        <div class="invalid-feedback">
-                            {{ $t("passwordNotMatchMsg") }}
                         </div>
-                    </div>
 
-                    <div>
+                        <div class="mb-3">
-                        <button class="btn btn-primary" type="submit">
+                            <label for="new-password" class="form-label">
-                            {{ $t("Update Password") }}
+                                {{ $t("New Password") }}
-                        </button>
+                            </label>
-                    </div>
+                            <input
-                </form>
+                                id="new-password"
+                                v-model="password.newPassword"
+                                type="password"
+                                class="form-control"
+                                autocomplete="new-password"
+                                required
+                            />
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="repeat-new-password" class="form-label">
+                                {{ $t("Repeat New Password") }}
+                            </label>
+                            <input
+                                id="repeat-new-password"
+                                v-model="password.repeatNewPassword"
+                                type="password"
+                                class="form-control"
+                                :class="{ 'is-invalid': invalidPassword }"
+                                autocomplete="new-password"
+                                required
+                            />
+                            <div class="invalid-feedback">
+                                {{ $t("passwordNotMatchMsg") }}
+                            </div>
+                        </div>
+
+                        <div>
+                            <button class="btn btn-primary" type="submit">
+                                {{ $t("Update Password") }}
+                            </button>
+                        </div>
+                    </form>
+                </template>
             </template>
 
-            <div v-if="! settings.disableAuth" class="mt-5 mb-3">
+            <div v-if="$root.socket.token.startsWith('autoLogin') === false" class="mt-5 mb-3">
                 <h5 class="my-4 settings-subheading">
                     {{ $t("Two Factor Authentication") }}
                 </h5>
@@ -85,7 +86,7 @@
 
                 <div class="mb-4">
                     <button v-if="settings.disableAuth" id="enableAuth-btn" class="btn btn-outline-primary me-2 mb-2" @click="enableAuth">{{ $t("Enable Auth") }}</button>
-                    <button v-if="! settings.disableAuth" id="disableAuth-btn" class="btn btn-primary me-2 mb-2" @click="confirmDisableAuth">{{ $t("Disable Auth") }}</button>
+                    <button v-if="!settings.disableAuth" id="disableAuth-btn" class="btn btn-primary me-2 mb-2" @click="confirmDisableAuth">{{ $t("Disable Auth") }}</button>
                 </div>
             </div>
         </div>

src/layouts/Layout.vue

@@ -69,7 +69,7 @@
                                 </a>
                             </li>
 
-                            <li v-if="$root.loggedIn && $root.socket.token !== 'autoLogin'">
+                            <li v-if="$root.loggedIn && $root.socket.token.startsWith('autoLogin') === false">
                                 <button class="dropdown-item" @click="$root.logout">
                                     <font-awesome-icon icon="sign-out-alt" />
                                     {{ $t("Logout") }}

src/mixins/socket.js

@@ -119,17 +119,25 @@ export default {
                 this.info = info;
             });
 
-            socket.on("setup", (monitorID, data) => {
+            socket.on("setup", () => {
                 this.$router.push("/setup");
             });
 
-            socket.on("autoLogin", (monitorID, data) => {
+            socket.on("autoLogin", () => {
                 this.loggedIn = true;
                 this.storage().token = "autoLogin";
                 this.socket.token = "autoLogin";
                 this.allowLoginDialog = false;
             });
 
+            socket.on("autoLoginRemoteHeader", (username) => {
+                this.loggedIn = true;
+                this.username = username;
+                this.storage().token = "autoLoginRemoteHeader";
+                this.socket.token = "autoLoginRemoteHeader";
+                this.allowLoginDialog = false;
+            });
+
             socket.on("loginRequired", () => {
                 let token = this.storage().token;
                 if (token && token !== "autoLogin") {
@@ -275,6 +283,24 @@ export default {
                     this.clearData();
                 }
 
+                let token = this.storage().token;
+
+                if (token) {
+                    if (token.startsWith("autoLogin") === false) {
+                        this.loginByToken(token);
+                    } else {
+                        // Timeout if it is not actually auto login
+                        setTimeout(() => {
+                            if (! this.loggedIn) {
+                                this.allowLoginDialog = true;
+                                this.$root.storage().removeItem("token");
+                            }
+                        }, 5000);
+                    }
+                } else {
+                    this.allowLoginDialog = true;
+                }
+
                 this.socket.firstConnect = false;
             });
 
@@ -326,7 +352,7 @@ export default {
         getJWTPayload() {
             const jwtToken = this.$root.storage().token;
 
-            if (jwtToken && jwtToken !== "autoLogin") {
+            if (jwtToken && jwtToken.startsWith("autoLogin") === false) {
                 return jwtDecode(jwtToken);
             }
             return undefined;