Nail/ipwhitelist-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: гонки (транзакции), валидатор (суперсеть, parseInt, слэши), auth (401, DEV_MODE, export), схема (UNIQUE, CHECK, FK), client-валидация

Browse Source
This commit is contained in:
naeel
2026-05-30 08:28:21 +03:00
parent 60972169c5
commit 51f2f4ddaf
5 changed files with 164 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server.js
+26 -20
View File
@@ -6,12 +6,17 @@ const q = require('./src/queries');
const app = express();
const PORT = process.env.PORT || 3000;
const DEV = process.env.DEV_MODE === 'true';
const DEV = process.env.DEV_MODE === 'true' && process.env.NODE_ENV !== 'production';
if (DEV) console.warn('⚠ DEV_MODE активен — аутентификация отключена');
app.set('view engine', 'ejs');
app.set('views', path.join(__dirname, 'views'));
app.use(express.static(path.join(__dirname, 'public')));
app.use(express.urlencoded({ extended: true }));
app.use(express.urlencoded({ extended: true, limit: '32kb' }));
// ── Health (выше auth — k8s probe не должна требовать токен) ──
app.get('/healthz', (req, res) => res.send('OK'));
// ── Auth middleware ──
app.use((req, res, next) => {
@@ -29,12 +34,11 @@ app.use((req, res, next) => {
companyName: payload.company_name || payload.ClientID,
};
} catch { req.user = {}; }
// Без clientId — 401, анонимы не должны делить NULL-компанию
if (!req.user.clientId) return res.status(401).send('Unauthorized');
next();
});
// ── Health ──
app.get('/healthz', (req, res) => res.send('OK'));
// ── Главная ──
app.get('/', async (req, res) => {
const { clientId, companyName } = req.user;
@@ -42,9 +46,14 @@ app.get('/', async (req, res) => {
const company = await q.getOrCreateCompany(clientId, companyName);
const limit = await q.getLimit(company);
const entries = await q.listEntries(company.id);
res.render('index', { entries, limit, used: entries.length, user: req.user, error: null, message: null, wasNormalized: false });
res.render('index', {
entries, limit, used: entries.length, user: req.user,
error: req.query.error || null,
message: req.query.message || null,
wasNormalized: req.query.wasNormalized === '1',
});
} catch (e) {
res.render('index', { entries: [], limit: 15, used: 0, user: req.user, error: e.message, message: null, wasNormalized: false });
res.render('index', { entries: [], limit: 15, used: 0, user: req.user, error: 'Ошибка загрузки', message: null, wasNormalized: false });
}
});
@@ -55,18 +64,13 @@ app.post('/add', async (req, res) => {
try {
const company = await q.getOrCreateCompany(clientId, companyName);
const result = await q.createEntry(company.id, value, comment, email);
const limit = await q.getLimit(company);
const entries = await q.listEntries(company.id);
res.render('index', {
entries, limit, used: entries.length, user: req.user,
message: result.wasNormalized ? `Адрес нормализован в ${result.entry.value_cidr}` : 'Добавлено',
error: null, wasNormalized: result.wasNormalized,
});
const message = result.wasNormalized
? `Адрес нормализован в ${result.entry.value_cidr}`
: 'Добавлено';
const wasNormalized = result.wasNormalized ? '1' : '0';
res.redirect(`/?message=${encodeURIComponent(message)}&wasNormalized=${wasNormalized}`);
} catch (e) {
const company = await q.getOrCreateCompany(clientId, companyName).catch(() => null);
const entries = company ? await q.listEntries(company.id).catch(() => []) : [];
const limit = company ? await q.getLimit(company).catch(() => 15) : 15;
res.render('index', { entries, limit, used: entries.length, user: req.user, error: e.message, message: null, wasNormalized: false });
res.redirect('/?error=' + encodeURIComponent(e.message));
}
});
@@ -82,10 +86,12 @@ app.post('/delete/:id', async (req, res) => {
}
});
// ── Экспорт ──
// ── Экспорт (только для своей компании) ──
app.get('/export', async (req, res) => {
try {
const cidrs = await q.getExportCIDRs();
const { clientId, companyName } = req.user;
const company = await q.getOrCreateCompany(clientId, companyName);
const cidrs = await q.getExportCIDRs(company.id);
res.setHeader('Content-Type', 'text/plain; charset=utf-8');
res.send(cidrs.join('\n') + '\n');
} catch (e) {
sql/schema.sql
+11 -6
View File
@@ -4,15 +4,15 @@ CREATE TABLE IF NOT EXISTS companies (
id SERIAL PRIMARY KEY,
client_id VARCHAR(64) UNIQUE NOT NULL,
name VARCHAR(255),
custom_limit INTEGER DEFAULT NULL,
custom_limit INTEGER DEFAULT NULL CHECK (custom_limit IS NULL OR custom_limit >= 0),
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
CREATE TABLE IF NOT EXISTS whitelist_entries (
id SERIAL PRIMARY KEY,
company_id INTEGER NOT NULL REFERENCES companies(id),
value_cidr VARCHAR(18) NOT NULL,
company_id INTEGER NOT NULL REFERENCES companies(id) ON DELETE RESTRICT,
value_cidr VARCHAR(18) NOT NULL CHECK (value_cidr ~ '^(\d{1,3}\.){3}\d{1,3}/\d{1,2}$'),
comment VARCHAR(255),
created_by VARCHAR(255) NOT NULL,
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -22,18 +22,23 @@ CREATE TABLE IF NOT EXISTS whitelist_entries (
deleted_at TIMESTAMPTZ
);
CREATE INDEX IF NOT EXISTS idx_entries_active
-- Уникальность активного CIDR в рамках компании (защита от гонок дублей)
CREATE UNIQUE INDEX IF NOT EXISTS uq_entries_active_cidr
ON whitelist_entries(company_id, value_cidr) WHERE deleted_at IS NULL;
-- Составной для списка активных записей компании
CREATE INDEX IF NOT EXISTS idx_entries_active
ON whitelist_entries(company_id, created_at DESC) WHERE deleted_at IS NULL;
CREATE TABLE IF NOT EXISTS audit_log (
id SERIAL PRIMARY KEY,
user_email VARCHAR(255) NOT NULL,
company_id INTEGER NOT NULL,
action VARCHAR(32) NOT NULL,
action VARCHAR(32) NOT NULL CHECK (action IN ('CREATE','UPDATE','DELETE')),
old_value TEXT,
new_value TEXT,
entry_id INTEGER,
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
CREATE INDEX IF NOT EXISTS idx_audit_company ON audit_log(company_id);
CREATE INDEX IF NOT EXISTS idx_audit_company_time ON audit_log(company_id, created_at DESC);
src/queries.js
+72 -38
View File
@@ -4,11 +4,11 @@ const { validate, overlaps } = require('./validators');
// ── Companies ──
async function getOrCreateCompany(clientId, companyName) {
let res = await pool.query('SELECT * FROM companies WHERE client_id = $1', [clientId]);
if (res.rows.length > 0) return res.rows[0];
res = await pool.query(
'INSERT INTO companies (client_id, name) VALUES ($1, $2) RETURNING *',
// Атомарный upsert — исключает дубли компаний при параллельных запросах
const res = await pool.query(
`INSERT INTO companies (client_id, name) VALUES ($1, $2)
ON CONFLICT (client_id) DO UPDATE SET name = COALESCE(companies.name, EXCLUDED.name)
RETURNING *`,
[clientId, companyName || clientId]
);
return res.rows[0];
@@ -16,7 +16,8 @@ async function getOrCreateCompany(clientId, companyName) {
async function getLimit(company) {
const defaultLimit = parseInt(process.env.DEFAULT_LIMIT, 10) || 15;
return company.custom_limit || defaultLimit;
// != null: custom_limit = 0 не должен превращаться в defaultLimit
return company.custom_limit != null ? company.custom_limit : defaultLimit;
}
// ── Entries ──
@@ -30,52 +31,65 @@ async function listEntries(companyId, includeDeleted = false) {
async function createEntry(companyId, rawValue, comment, userEmail) {
const { cidr, wasNormalized } = validate(rawValue);
const client = await pool.connect();
try {
await client.query('BEGIN');
// Блокировка строки компании — сериализует параллельные вставки
const company = (await client.query(
'SELECT * FROM companies WHERE id = $1 FOR UPDATE', [companyId]
)).rows[0];
if (!company) throw new Error('Компания не найдена');
// Проверка лимита
const company = (await pool.query('SELECT * FROM companies WHERE id = $1', [companyId])).rows[0];
const limit = await getLimit(company);
const cnt = (await pool.query(
const cnt = (await client.query(
'SELECT COUNT(*)::int AS c FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
[companyId]
)).rows[0].c;
if (cnt >= limit) throw new Error(`Лимит исчерпан: ${cnt} из ${limit}`);
// Проверка дубликатов и пересечений
const existing = (await pool.query(
const existing = (await client.query(
'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL',
[companyId]
)).rows;
for (const row of existing) {
if (row.value_cidr === cidr) throw new Error('Такой адрес уже существует');
if (overlaps(cidr, row.value_cidr))
throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
}
const res = await pool.query(
const res = await client.query(
`INSERT INTO whitelist_entries (company_id, value_cidr, comment, created_by)
VALUES ($1, $2, $3, $4) RETURNING *`,
[companyId, cidr, comment || null, userEmail]
);
// Аудит
await logAudit(userEmail, companyId, 'CREATE', null, cidr, res.rows[0].id);
await logAudit(userEmail, companyId, 'CREATE', null, cidr, res.rows[0].id, client);
await client.query('COMMIT');
return { entry: res.rows[0], wasNormalized };
} catch (e) {
await client.query('ROLLBACK');
throw e;
} finally {
client.release();
}
}
async function updateEntry(entryId, companyId, rawValue, comment, userEmail) {
const old = (await pool.query(
const { cidr, wasNormalized } = validate(rawValue);
const client = await pool.connect();
try {
await client.query('BEGIN');
// Блокировка строки компании — сериализует параллельные обновления
await client.query('SELECT * FROM companies WHERE id = $1 FOR UPDATE', [companyId]);
const old = (await client.query(
'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
[entryId, companyId]
)).rows[0];
if (!old) throw new Error('Запись не найдена');
const { cidr, wasNormalized } = validate(rawValue);
// Проверка пересечений (исключая саму себя)
const existing = (await pool.query(
const existing = (await client.query(
'SELECT value_cidr FROM whitelist_entries WHERE company_id = $1 AND deleted_at IS NULL AND id <> $2',
[companyId, entryId]
)).rows;
@@ -85,45 +99,65 @@ async function updateEntry(entryId, companyId, rawValue, comment, userEmail) {
throw new Error(`Пересечение с существующей записью ${row.value_cidr}`);
}
const res = await pool.query(
const res = await client.query(
`UPDATE whitelist_entries SET value_cidr = $1, comment = $2, updated_by = $3, updated_at = NOW()
WHERE id = $4 AND company_id = $5 RETURNING *`,
[cidr, comment || old.comment, userEmail, entryId, companyId]
);
await logAudit(userEmail, companyId, 'UPDATE', old.value_cidr, cidr, entryId);
await logAudit(userEmail, companyId, 'UPDATE', old.value_cidr, cidr, entryId, client);
await client.query('COMMIT');
return { entry: res.rows[0], wasNormalized };
} catch (e) {
await client.query('ROLLBACK');
throw e;
} finally {
client.release();
}
}
async function deleteEntry(entryId, companyId, userEmail) {
const old = (await pool.query(
const client = await pool.connect();
try {
await client.query('BEGIN');
const old = (await client.query(
'SELECT * FROM whitelist_entries WHERE id = $1 AND company_id = $2 AND deleted_at IS NULL',
[entryId, companyId]
)).rows[0];
if (!old) throw new Error('Запись не найдена');
await pool.query(
'UPDATE whitelist_entries SET deleted_by = $1, deleted_at = NOW() WHERE id = $2',
[userEmail, entryId]
// company_id в WHERE — глубина защиты от случайной утечки между компаниями
await client.query(
'UPDATE whitelist_entries SET deleted_by = $1, deleted_at = NOW() WHERE id = $2 AND company_id = $3',
[userEmail, entryId, companyId]
);
await logAudit(userEmail, companyId, 'DELETE', old.value_cidr, null, entryId);
await logAudit(userEmail, companyId, 'DELETE', old.value_cidr, null, entryId, client);
await client.query('COMMIT');
} catch (e) {
await client.query('ROLLBACK');
throw e;
} finally {
client.release();
}
}
// ── Export ──
async function getExportCIDRs() {
const rows = (await pool.query(
'SELECT value_cidr FROM whitelist_entries WHERE deleted_at IS NULL ORDER BY value_cidr'
)).rows;
return rows.map(r => r.value_cidr);
async function getExportCIDRs(companyId = null) {
let sql = 'SELECT value_cidr FROM whitelist_entries WHERE deleted_at IS NULL';
const params = [];
if (companyId) {
sql += ' AND company_id = $1';
params.push(companyId);
}
sql += ' ORDER BY value_cidr';
return ((await pool.query(sql, params)).rows).map(r => r.value_cidr);
}
// ── Audit ──
async function logAudit(userEmail, companyId, action, oldValue, newValue, entryId) {
await pool.query(
async function logAudit(userEmail, companyId, action, oldValue, newValue, entryId, db = pool) {
await db.query(
`INSERT INTO audit_log (user_email, company_id, action, old_value, new_value, entry_id)
VALUES ($1, $2, $3, $4, $5, $6)`,
[userEmail, companyId, action, oldValue, newValue, entryId || null]
src/validators.js
+15 -4
View File
@@ -32,13 +32,23 @@ function validate(input) {
if (/[a-zA-Z]/.test(raw.replace(/\./g, '').replace(/\//g, '').replace(/\d/g, '')))
throw new Error('Некорректный формат');
// Отсекаем множественные слэши
if ((raw.match(/\//g) || []).length > 1) {
throw new Error('Некорректный формат');
}
// Если нет маски — добавляем /32
let cidr = raw.includes('/') ? raw : raw + '/32';
const [addr, maskStr] = cidr.split('/');
// Строгая проверка маски (parseInt глотает мусор: '24abc' → 24)
if (!/^\d{1,2}$/.test(maskStr)) {
throw new Error('Некорректная маска');
}
const mask = parseInt(maskStr, 10);
if (isNaN(mask) || mask < 22 || mask > 32) {
if (mask < 22 || mask > 32) {
throw new Error('Маска должна быть от /22 до /32');
}
@@ -58,10 +68,11 @@ function validate(input) {
const wasNormalized = addr !== networkAddr;
const normalized = networkAddr + '/' + mask;
// Проверка запрещённых диапазонов
// Проверка запрещённых диапазонов (overlaps ловит оба направления:
// и запись внутри запрещённого блока, и суперсеть над ним)
for (const blocked of BLOCKED_RANGES) {
if (isSubnetOf(normalized, blocked)) {
throw new Error(`Диапазон ${normalized} запрещён (${blocked})`);
if (overlaps(normalized, blocked)) {
throw new Error(`Диапазон ${normalized} пересекается с запрещённым (${blocked})`);
}
}
views/index.ejs
+1 -1
View File
@@ -192,7 +192,7 @@
<div class="form-grid">
<div class="field">
<label>IPv4 адрес или подсеть CIDR</label>
<input name="value" placeholder="Например: 203.0.113.10 или 203.0.113.0/24" required <%= used >= limit ? 'disabled' : '' %>>
<input name="value" placeholder="Например: 203.0.113.10 или 203.0.113.0/24" pattern="^(\d{1,3}\.){3}\d{1,3}(/\d{1,2})?$" maxlength="18" title="IPv4 адрес или CIDR /22–/32" required <%= used >= limit ? 'disabled' : '' %>>
</div>
<div class="field">
<label>Комментарий</label>