Add registration page for PBCTF

.env.sample

@@ -13,8 +13,17 @@ CLOUDINARY_API_SECRET=""
 FIRECRAWL_API_KEY=""
 GITHUB_TOKEN=""
 GITLAB_TOKEN=""
-SCRAPE_SECRET=
-SCRAPE_URL=
+SCRAPE_SECRET=""
+SCRAPE_URL=""
+UPSTASH_REDIS_REST_URL=""
+UPSTASH_REDIS_REST_TOKEN=""
+NEXT_PUBLIC_RECAPTCHA_SITE_KEY=""
+RECAPTCHA_SECRET_KEY=""
+RECAPTCHA_PROJECT=""
+RECAPTCHA_API_KEY=""
+PBCTF_ACCESS_SECRET=""
+PBCTF_REGISTRATION_FLAG=""
+
 
 # Hellyeah / x-ray tracker
 HELLYEAH_TRACKER_ID=""

Dockerfile

@@ -24,7 +24,6 @@ ARG NEXT_PUBLIC_DOMAIN
 ARG NEXT_PUBLIC_GTM_ID
 ENV NEXT_PUBLIC_DOMAIN=$NEXT_PUBLIC_DOMAIN
 ENV NEXT_PUBLIC_GTM_ID=$NEXT_PUBLIC_GTM_ID
-ENV CLOUDINARY_CLOUD_NAME=$CLOUDINARY_CLOUD_NAME
 
 RUN pnpm run build
 
@@ -52,4 +51,4 @@ EXPOSE 3000
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
 
-CMD ["node", "server.js"]
+CMD ["node", "server.js"]

app/api/pbctf/logout/route.ts

@@ -0,0 +1,56 @@
+import { cookies } from "next/headers";
+import { NextResponse } from "next/server";
+import crypto from "crypto";
+
+import connectDB from "@/lib/db/connection";
+import PBCTFRefreshToken from "@/lib/db/models/CTFRefreshToken";
+
+export async function POST() {
+  await connectDB();
+
+  const cookieStore = await cookies();
+
+  const refreshToken =
+    cookieStore.get("pbctf_refresh")?.value;
+
+  if (refreshToken) {
+    const tokenHash = crypto
+      .createHash("sha256")
+      .update(refreshToken)
+      .digest("hex");
+
+    await PBCTFRefreshToken.deleteOne({
+      tokenHash,
+    });
+  }
+
+  const response = NextResponse.json({
+    success: true,
+  });
+
+  response.cookies.set(
+    "pbctf_access",
+    "",
+    {
+      expires: new Date(0),
+      path: "/",
+      httpOnly: true,
+      sameSite: "strict",
+      secure: process.env.NODE_ENV === "production",
+    }
+  );
+
+  response.cookies.set(
+    "pbctf_refresh",
+    "",
+    {
+      expires: new Date(0),
+      path: "/",
+      httpOnly: true,
+      sameSite: "strict",
+      secure: process.env.NODE_ENV === "production",
+    }
+  );
+
+  return response;
+}

app/api/pbctf/refresh/route.ts

@@ -0,0 +1,207 @@
+import { cookies } from "next/headers";
+import { NextRequest, NextResponse } from "next/server";
+import crypto from "crypto";
+import connectDb from "@/lib/db/connection";
+import PBCTFRefreshToken from "@/lib/db/models/CTFRefreshToken";
+import generateAccessToken from "@/lib/pbctf/generateAccessToken";
+import generateRefreshToken from "@/lib/pbctf/generateRefreshToken";
+
+type RefreshResult =
+  | {
+      success: true;
+      accessToken: string;
+      refreshToken: string;
+    }
+  | {
+      success: false;
+      status: number;
+      error: string;
+    };
+
+const cookieOptions = {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === "production",
+  sameSite: "strict" as const,
+  path: "/",
+};
+
+function clearAuthCookies(response: NextResponse) {
+  response.cookies.set("pbctf_access", "", {
+    ...cookieOptions,
+    expires: new Date(0),
+  });
+
+  response.cookies.set("pbctf_refresh", "", {
+    ...cookieOptions,
+    expires: new Date(0),
+  });
+
+  return response;
+}
+
+function setAuthCookies(
+  response: NextResponse,
+  accessToken: string,
+  refreshToken: string
+) {
+  response.cookies.set("pbctf_access", accessToken, {
+    ...cookieOptions,
+    maxAge: 60 * 10,
+  });
+
+  response.cookies.set("pbctf_refresh", refreshToken, {
+    ...cookieOptions,
+    maxAge: 24 * 60 * 60,
+  });
+
+  return response;
+}
+
+async function rotateRefreshToken(): Promise<RefreshResult> {
+  await connectDb();
+
+  const cookieStore = await cookies();
+  const refreshToken =
+    cookieStore.get("pbctf_refresh")?.value;
+
+  if (!refreshToken) {
+    return {
+      success: false,
+      status: 401,
+      error: "Refresh token missing",
+    };
+  }
+
+  const tokenHash = crypto
+    .createHash("sha256")
+    .update(refreshToken)
+    .digest("hex");
+
+  const matchedToken =
+    await PBCTFRefreshToken.findOne({
+      tokenHash,
+    });
+
+  if (!matchedToken) {
+    return {
+      success: false,
+      status: 401,
+      error: "Invalid refresh token",
+    };
+  }
+
+  if (matchedToken.expiresAt < new Date()) {
+    await matchedToken.deleteOne();
+
+    return {
+      success: false,
+      status: 401,
+      error: "Refresh token expired",
+    };
+  }
+
+  const newAccessToken =
+    generateAccessToken(matchedToken.email);
+  const newRefreshToken =
+    generateRefreshToken();
+
+  const newRefreshHash = crypto
+    .createHash("sha256")
+    .update(newRefreshToken)
+    .digest("hex");
+
+  matchedToken.tokenHash = newRefreshHash;
+  matchedToken.expiresAt = new Date(
+    Date.now() + 24 * 60 * 60 * 1000
+  );
+
+  await matchedToken.save();
+
+  return {
+    success: true,
+    accessToken: newAccessToken,
+    refreshToken: newRefreshToken,
+  };
+}
+
+function getSafeNextUrl(request: NextRequest) {
+  const next =
+    request.nextUrl.searchParams.get("next") ||
+    "/pbctf/dashboard";
+
+  if (!next.startsWith("/") || next.startsWith("//")) {
+    return "/pbctf/dashboard";
+  }
+
+  return next;
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const result = await rotateRefreshToken();
+
+    if (!result.success) {
+      const response = NextResponse.redirect(
+        new URL("/pbctf/login", request.url)
+      );
+
+      return clearAuthCookies(response);
+    }
+
+    const response = NextResponse.redirect(
+      new URL(getSafeNextUrl(request), request.url)
+    );
+
+    return setAuthCookies(
+      response,
+      result.accessToken,
+      result.refreshToken
+    );
+  } catch (error) {
+    console.error(error);
+
+    return NextResponse.redirect(
+      new URL("/pbctf/login", request.url)
+    );
+  }
+}
+
+export async function POST() {
+  try {
+    const result = await rotateRefreshToken();
+
+    if (!result.success) {
+      const response = NextResponse.json(
+        {
+          error: result.error,
+        },
+        {
+          status: result.status,
+        }
+      );
+
+      return clearAuthCookies(response);
+    }
+
+    const response = NextResponse.json({
+      success: true,
+    });
+
+    return setAuthCookies(
+      response,
+      result.accessToken,
+      result.refreshToken
+    );
+  } catch (error) {
+    console.error(error);
+
+    return NextResponse.json(
+      {
+        error: "Internal server error",
+      },
+      {
+        status: 500,
+      }
+    );
+  }
+}