Merge pull request #1479 from Favouratambi/fix/db-backed-confirmation-tokens

fix: back confirmation tokens with database instead of process-local Map

Author: 1nonlypiece

db/migrations/20260701000000_create_confirmation_tokens.cjs

@@ -0,0 +1,30 @@
+/**
+ * Migration: confirmation_tokens
+ *
+ * Stores dual-control confirmation tokens for destructive admin actions.
+ * Previously stored in a process-local Map, which broke multi-instance deployments.
+ * See issue #1033.
+ */
+exports.up = async function up(knex) {
+  await knex.schema.createTable('confirmation_tokens', (table) => {
+    table.uuid('id').primary().defaultTo(knex.raw('gen_random_uuid()'))
+    table.string('token_id', 36).notNullable().unique()
+    table.string('user_id', 255).notNullable()
+    table.string('action', 255).notNullable()
+    table.string('scope', 255).nullable()
+    table.timestamp('expires_at', { useTz: true }).notNullable()
+    table.boolean('used').notNullable().defaultTo(false)
+    table.boolean('dual_control_required').notNullable().defaultTo(false)
+    table.string('approved_by', 255).nullable()
+    table.timestamp('approved_at', { useTz: true }).nullable()
+    table.timestamp('created_at', { useTz: true }).notNullable().defaultTo(knex.fn.now())
+
+    table.index(['token_id'], 'idx_confirmation_tokens_token_id')
+    table.index(['user_id'], 'idx_confirmation_tokens_user_id')
+    table.index(['expires_at'], 'idx_confirmation_tokens_expires_at')
+  })
+}
+
+exports.down = async function down(knex) {
+  await knex.schema.dropTableIfExists('confirmation_tokens')
+}

src/middleware/confirmationToken.ts

@@ -1,5 +1,6 @@
 import { NextFunction, Request, Response } from 'express'
 import { randomUUID } from 'node:crypto'
+import db from '../db/index.js'
 
 // Configurable via env: comma-separated list of actions requiring a second-admin approval
 export const DUAL_CONTROL_ACTIONS = new Set(
@@ -33,71 +34,108 @@ export interface ConfirmationTokenEntry {
   createdAt: number
 }
 
-// In-memory store — same pattern as STEP_UP_NONCES in auth.service.ts
-const CONFIRMATION_TOKENS = new Map<string, ConfirmationTokenEntry>()
+function rowToEntry(row: any): ConfirmationTokenEntry {
+  return {
+    tokenId: row.token_id,
+    userId: row.user_id,
+    action: row.action,
+    scope: row.scope ?? undefined,
+    expiresAt: new Date(row.expires_at).getTime(),
+    used: row.used,
+    dualControlRequired: row.dual_control_required,
+    approvedBy: row.approved_by ?? undefined,
+    approvedAt: row.approved_at ? new Date(row.approved_at).getTime() : undefined,
+    createdAt: new Date(row.created_at).getTime(),
+  }
+}
 
-// Test helper — mirrors clearProcessedOverrides from admin.ts
-export const clearConfirmationTokens = (): void => {
-  CONFIRMATION_TOKENS.clear()
+export const clearConfirmationTokens = async (): Promise<void> => {
+  await db('confirmation_tokens').delete()
 }
 
 export const isDualControlRequired = (action: string): boolean =>
   DUAL_CONTROL_ACTIONS.has(action)
 
-export const issueConfirmationToken = (
+export const issueConfirmationToken = async (
   userId: string,
   action: string,
   scope?: string,
-): ConfirmationTokenEntry => {
+): Promise<ConfirmationTokenEntry> => {
   const dualControlRequired = isDualControlRequired(action)
   const ttlMs = dualControlRequired ? DUAL_CONTROL_TTL_MS : SINGLE_CONTROL_TTL_MS
-  const entry: ConfirmationTokenEntry = {
-    tokenId: randomUUID(),
+  const tokenId = randomUUID()
+  const expiresAt = new Date(Date.now() + ttlMs)
+
+  await db('confirmation_tokens').insert({
+    token_id: tokenId,
+    user_id: userId,
+    action,
+    scope: scope ?? null,
+    expires_at: expiresAt.toISOString(),
+    used: false,
+    dual_control_required: dualControlRequired,
+  })
+
+  return {
+    tokenId,
     userId,
     action,
     scope,
-    expiresAt: Date.now() + ttlMs,
+    expiresAt: expiresAt.getTime(),
     used: false,
     dualControlRequired,
     createdAt: Date.now(),
   }
-  CONFIRMATION_TOKENS.set(entry.tokenId, entry)
-  return entry
 }
 
 export type ApproveResult =
   | { ok: true; entry: ConfirmationTokenEntry }
   | { ok: false; reason: string }
 
-export const approveConfirmationToken = (tokenId: string, approverId: string): ApproveResult => {
-  const entry = CONFIRMATION_TOKENS.get(tokenId)
-  if (!entry) return { ok: false, reason: 'token_not_found' }
+export const approveConfirmationToken = async (tokenId: string, approverId: string): Promise<ApproveResult> => {
+  const row = await db('confirmation_tokens').where({ token_id: tokenId }).first()
+  if (!row) return { ok: false, reason: 'token_not_found' }
+
+  const entry = rowToEntry(row)
   if (entry.used) return { ok: false, reason: 'token_already_used' }
   if (entry.expiresAt < Date.now()) return { ok: false, reason: 'token_expired' }
   if (!entry.dualControlRequired) return { ok: false, reason: 'action_does_not_require_approval' }
   if (entry.approvedBy) return { ok: false, reason: 'already_approved' }
-  // Self-approval is prohibited — the approver must be a different admin
   if (entry.userId === approverId) return { ok: false, reason: 'self_approval_not_allowed' }
+
+  const now = new Date()
+  await db('confirmation_tokens')
+    .where({ token_id: tokenId })
+    .update({
+      approved_by: approverId,
+      approved_at: now.toISOString(),
+    })
+
   entry.approvedBy = approverId
-  entry.approvedAt = Date.now()
+  entry.approvedAt = now.getTime()
   return { ok: true, entry }
 }
 
-export const validateConfirmationToken = (
+export const validateConfirmationToken = async (
   tokenId: string,
   userId: string,
   action: string,
-): ConfirmationTokenEntry | null => {
-  const entry = CONFIRMATION_TOKENS.get(tokenId)
-  if (!entry) return null
+): Promise<ConfirmationTokenEntry | null> => {
+  const row = await db('confirmation_tokens').where({ token_id: tokenId }).first()
+  if (!row) return null
+
+  const entry = rowToEntry(row)
   if (entry.used) return null
   if (entry.expiresAt < Date.now()) return null
   if (entry.userId !== userId) return null
   if (entry.action !== action) return null
-  // Dual-control tokens must be approved before use
   if (entry.dualControlRequired && !entry.approvedBy) return null
+
+  await db('confirmation_tokens')
+    .where({ token_id: tokenId })
+    .update({ used: true })
+
   entry.used = true
-  CONFIRMATION_TOKENS.delete(tokenId)
   return entry
 }
 
@@ -121,17 +159,24 @@ export const requireConfirmationToken =
       return
     }
 
-    const entry = validateConfirmationToken(tokenId, userId, action)
-    if (!entry) {
-      res.status(403).json({
-        error: 'Invalid, expired, wrong-scope, or already-used confirmation token',
-        confirmationRequired: true,
-        action,
-        prepareUrl: '/api/admin/confirm/prepare',
-      })
-      return
-    }
+    // Await is handled by wrapping the middleware
+    validateConfirmationToken(tokenId, userId, action)
+      .then((entry) => {
+        if (!entry) {
+          res.status(403).json({
+            error: 'Invalid, expired, wrong-scope, or already-used confirmation token',
+            confirmationRequired: true,
+            action,
+            prepareUrl: '/api/admin/confirm/prepare',
+          })
+          return
+        }
 
-    ;(req as any).confirmationTokenEntry = entry
-    next()
+        ;(req as any).confirmationTokenEntry = entry
+        next()
+      })
+      .catch((err) => {
+        console.error('Confirmation token validation error:', err)
+        res.status(500).json({ error: 'Internal server error during token validation' })
+      })
   }

src/routes/admin.ts

@@ -174,7 +174,7 @@ adminRouter.post('/confirm/prepare', async (req: Request, res: Response) => {
     return
   }
 
-  const entry = issueConfirmationToken(req.user!.userId, action, scope ?? undefined)
+  const entry = await issueConfirmationToken(req.user!.userId, action, scope ?? undefined)
 
   await createAuditLog({
     actor_user_id: req.user!.userId,
@@ -208,7 +208,7 @@ adminRouter.post('/confirm/prepare', async (req: Request, res: Response) => {
  */
 adminRouter.post('/confirm/approve/:tokenId', async (req: Request, res: Response) => {
   const { tokenId } = req.params
-  const result = approveConfirmationToken(tokenId, req.user!.userId)
+  const result = await approveConfirmationToken(tokenId, req.user!.userId)
 
   if (!result.ok) {
     const status = result.reason === 'token_not_found' ? 404 : 409