Autentifikatsiya va sessiyalar

import { scryptSync, randomBytes, timingSafeEqual } from "node:crypto";

function parolniXeshla(parol) {
    const tuz = randomBytes(16);
    const xesh = scryptSync(parol, tuz, 64);
    return `${tuz.toString("hex")}:${xesh.toString("hex")}`;
}

function parolTogrimi(parol, saqlangan) {
    const [tuzHex, xeshHex] = saqlangan.split(":");
    const tuz = Buffer.from(tuzHex, "hex");
    const saqlanganXesh = Buffer.from(xeshHex, "hex");
    const yangiXesh = scryptSync(parol, tuz, 64);
    return timingSafeEqual(saqlanganXesh, yangiXesh);
}

const saqlangan = parolniXeshla("MeningParolim123");

console.log("Uzunligi:", saqlangan.length);
console.log("Ikki qismdan iborat:", saqlangan.split(":").length === 2);
console.log("Parol ochiq ko'rinmaydi:", !saqlangan.includes("Parolim"));

console.log("To'g'ri parol:", parolTogrimi("MeningParolim123", saqlangan));
console.log("Noto'g'ri parol:", parolTogrimi("boshqaParol", saqlangan));

const ikkinchi = parolniXeshla("MeningParolim123");
console.log("Bir xil parol, boshqa xesh:", saqlangan !== ikkinchi);

import { timingSafeEqual } from "node:crypto";

const haqiqiy = Buffer.from("maxfiy-token-12345");
const togri = Buffer.from("maxfiy-token-12345");
const notogri = Buffer.from("maxfiy-token-99999");

console.log("Teng:", timingSafeEqual(haqiqiy, togri));
console.log("Teng emas:", timingSafeEqual(haqiqiy, notogri));

const boshqaUzunlik = Buffer.from("qisqa");
try {
    timingSafeEqual(haqiqiy, boshqaUzunlik);
} catch (xato) {
    console.log("Uzunlik farqi:", xato.code);
}

import express from "express";

const app = express();

function cookieOqi(sarlavha) {
    const natija = {};
    for (const bolak of (sarlavha ?? "").split(";")) {
        const [nom, ...qolgani] = bolak.trim().split("=");
        if (nom) natija[nom] = decodeURIComponent(qolgani.join("="));
    }
    return natija;
}

app.use((sorov, javob, keyingi) => {
    sorov.cookies = cookieOqi(sorov.headers.cookie);
    keyingi();
});

app.get("/qoy", (sorov, javob) => {
    javob.cookie("sessiya", "abc123", {
        httpOnly: true,
        sameSite: "lax",
        maxAge: 3600_000,
    });
    javob.json({ qoyildi: true });
});

app.get("/oqi", (sorov, javob) => {
    javob.json({ sessiya: sorov.cookies.sessiya ?? null });
});

const server = app.listen(0);
const port = server.address().port;
const asos = `http://localhost:${port}`;

const qoyildi = await fetch(asos + "/qoy");
const cookie = qoyildi.headers.getSetCookie()[0];
console.log("HttpOnly bor:", cookie.includes("HttpOnly"));
console.log("SameSite bor:", cookie.includes("SameSite=Lax"));

const oqildi = await fetch(asos + "/oqi", {
    headers: { Cookie: "sessiya=abc123" },
});
console.log(await oqildi.json());

server.close();

import express from "express";
import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";

const foydalanuvchilar = new Map();
const sessiyalar = new Map();

function royxatdanOtkaz(login, parol) {
    const tuz = randomBytes(16);
    const xesh = scryptSync(parol, tuz, 64);
    foydalanuvchilar.set(login, { login, tuz, xesh, rol: "oddiy" });
}

function tekshir(login, parol) {
    const f = foydalanuvchilar.get(login);
    if (!f) return null;
    const yangi = scryptSync(parol, f.tuz, 64);
    return timingSafeEqual(f.xesh, yangi) ? f : null;
}

royxatdanOtkaz("malika", "KuchliParol1");

const app = express();
app.use(express.json());

app.use((sorov, javob, keyingi) => {
    const xom = sorov.headers.cookie ?? "";
    const mos = xom.match(/sid=([^;]+)/);
    sorov.foydalanuvchi = mos ? sessiyalar.get(mos[1]) ?? null : null;
    keyingi();
});

app.post("/kirish", (sorov, javob) => {
    const f = tekshir(sorov.body.login, sorov.body.parol);
    if (!f) {
        javob.status(401).json({ xato: "login yoki parol noto'g'ri" });
        return;
    }
    const sid = randomBytes(32).toString("hex");
    sessiyalar.set(sid, { login: f.login, rol: f.rol });
    javob.cookie("sid", sid, { httpOnly: true, sameSite: "lax" });
    javob.json({ kirildi: true });
});

function himoya(sorov, javob, keyingi) {
    if (!sorov.foydalanuvchi) {
        javob.status(401).json({ xato: "avval kiring" });
        return;
    }
    keyingi();
}

app.get("/profil", himoya, (sorov, javob) => {
    javob.json({ profil: sorov.foydalanuvchi });
});

const server = app.listen(0);
const port = server.address().port;
const asos = `http://localhost:${port}`;

const kirish = async (login, parol) => {
    const j = await fetch(asos + "/kirish", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ login, parol }),
    });
    return [j.status, j.headers.getSetCookie()[0] ?? null];
};

const [yomonHolat] = await kirish("malika", "notogri");
console.log("Noto'g'ri parol:", yomonHolat);

const [holat, cookie] = await kirish("malika", "KuchliParol1");
console.log("To'g'ri parol:", holat);

const himoyasiz = await fetch(asos + "/profil");
console.log("Cookie siz:", himoyasiz.status);

const sid = cookie.split(";")[0];
const bilan = await fetch(asos + "/profil", { headers: { Cookie: sid } });
console.log("Cookie bilan:", bilan.status, await bilan.json());

server.close();

import express from "express";

const app = express();

const sessiyalar = new Map([
    ["oddiy-sid", { login: "malika", rol: "oddiy" }],
    ["admin-sid", { login: "husanboy", rol: "admin" }],
]);

app.use((sorov, javob, keyingi) => {
    const mos = (sorov.headers.cookie ?? "").match(/sid=([^;]+)/);
    sorov.foydalanuvchi = mos ? sessiyalar.get(mos[1]) ?? null : null;
    keyingi();
});

function rolTalab(...ruxsat) {
    return (sorov, javob, keyingi) => {
        if (!sorov.foydalanuvchi) {
            javob.status(401).json({ xato: "avval kiring" });
            return;
        }
        if (!ruxsat.includes(sorov.foydalanuvchi.rol)) {
            javob.status(403).json({ xato: "ruxsat yo'q" });
            return;
        }
        keyingi();
    };
}

app.get("/profil", rolTalab("oddiy", "admin"), (s, j) => {
    j.json({ sahifa: "profil" });
});

app.get("/admin", rolTalab("admin"), (s, j) => {
    j.json({ sahifa: "boshqaruv" });
});

const server = app.listen(0);
const port = server.address().port;
const asos = `http://localhost:${port}`;

const sora = async (yol, sid) => {
    const j = await fetch(asos + yol, {
        headers: sid ? { Cookie: `sid=${sid}` } : {},
    });
    return j.status;
};

console.log("mehmon /admin:", await sora("/admin", null));
console.log("oddiy /profil:", await sora("/profil", "oddiy-sid"));
console.log("oddiy /admin: ", await sora("/admin", "oddiy-sid"));
console.log("admin /admin: ", await sora("/admin", "admin-sid"));

server.close();