docker: use named volumes instead of creating folders in $HOME

* Update self-hosting TO-DO

* Add starting version and update note

.env

@@ -49,21 +49,28 @@ TWILIO_AUTH_TOKEN=
 # Example: VAaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 TWILIO_SERVICE_SID=
 
-# Description: This is the public domain for the Authentication server. It can also be the IP address if you don't own a domain name. The domain/IP must be accessible from wherever you are running the Notesnook clients. Used for generating email confirmation & password reset URLs.
-# Required: yes
-# Example: auth.streetwriters.co
-IDENTITY_SERVER_DOMAIN=localhost:8264
-
 # Description: Add the origins for which you want to allow CORS. Leave it empty to allow all origins to access your server. If you want to allow multiple origins, seperate each origin with a comma.
 # Required: no
 # Example: https://app.notesnook.com,http://localhost:3000
 NOTESNOOK_CORS_ORIGINS=
 
-# Description: This is the URL for the web app, and is used by the backend for creating redirect URLs (e.g. after email confirmation etc). 
+# Description: This is the public URL for the web app, and is used by the backend for creating redirect URLs (e.g. after email confirmation etc). 
 # Note: the URL has no slashes at the end
 # Required: yes
 # Example: https://app.notesnook.com
-NOTESNOOK_APP_HOST=https://app.notesnook.com
+NOTESNOOK_APP_PUBLIC_URL=https://app.notesnook.com
+# Description: This is the public URL for the monograph frontend.
+# Required: yes
+# Example: https://monogr.ph
+MONOGRAPH_PUBLIC_URL=http://localhost:6264
+# Description: This is the public URL for the Authentication server. Used for generating email confirmation & password reset URLs.
+# Required: yes
+# Example: https://auth.streetwriters.co
+AUTH_SERVER_PUBLIC_URL=http://localhost:8264
+# Description: This is the public URL for the S3 attachments server (minio). It'll be used by the Notesnook clients for uploading/downloading attachments.
+# Required: yes
+# Example: https://attachments.notesnook.com
+ATTACHMENTS_SERVER_PUBLIC_URL=http://localhost:9000
 
 # Description: Custom username for the root Minio account. Minio is used for storing your attachments. This must be greater than 3 characters in length.
 # Required: no
@@ -71,7 +78,3 @@ MINIO_ROOT_USER=
 # Description: Custom password for the root Minio account. Minio is used for storing your attachments. This must be greater than 8 characters in length.
 # Required: no
 MINIO_ROOT_PASSWORD=
-# Description: The URL must be accessible from wherever you are running the Notesnook clients. It'll be used by the Notesnook clients for uploading/downloading attachments.
-# Required: no
-# Example: https://attachments.notesnook.com
-S3_SERVICE_URL=

Notesnook.API/Controllers/MonographsController.cs

@@ -36,6 +36,7 @@ namespace Notesnook.API.Controllers
     [Authorize("Sync")]
     public class MonographsController : ControllerBase
     {
+        const string SVG_PIXEL = "<svg xmlns='http://www.w3.org/2000/svg' width='1' height='1'><circle r='9'/></svg>";
         private Repository<Monograph> Monographs { get; set; }
         private readonly IUnitOfWork unit;
         private const int MAX_DOC_SIZE = 15 * 1024 * 1024;
@@ -127,24 +128,17 @@ namespace Notesnook.API.Controllers
             return Ok(monograph);
         }
 
-        [HttpGet("{id}/destruct")]
+        [HttpGet("{id}/view")]
         [AllowAnonymous]
-        public async Task<IActionResult> DestructMonographAsync([FromRoute] string id)
+        public async Task<IActionResult> TrackView([FromRoute] string id)
         {
             var monograph = await Monographs.GetAsync(id);
-            if (monograph == null)
-            {
-                return NotFound(new
-                {
-                    error = "invalid_id",
-                    error_description = $"No such monograph found."
-                });
-            }
+            if (monograph == null) return Content(SVG_PIXEL, "image/svg+xml");
 
             if (monograph.SelfDestruct)
                 await Monographs.DeleteByIdAsync(monograph.Id);
 
-            return Ok();
+            return Content(SVG_PIXEL, "image/svg+xml");
         }
 
         [HttpDelete("{id}")]

Notesnook.API/Services/S3Service.cs

@@ -220,6 +220,7 @@ namespace Notesnook.API.Services
             var objectName = GetFullObjectName(userId, name);
             if (userId == null || objectName == null) return null;
 
+            var client = GetS3Client(mode);
             var request = new GetPreSignedUrlRequest
             {
                 BucketName = GetBucketName(mode),
@@ -229,16 +230,17 @@ namespace Notesnook.API.Services
 #if DEBUG
                 Protocol = Protocol.HTTP,
 #else
-                Protocol = Constants.IS_SELF_HOSTED ? Protocol.HTTP : Protocol.HTTPS,
+                Protocol = client.Config.ServiceURL.StartsWith("http://") ? Protocol.HTTP : Protocol.HTTPS,
 #endif
             };
-            return GetS3Client(mode).GetPreSignedURL(request);
+            return client.GetPreSignedURL(request);
         }
 
         private string GetPresignedURLForUploadPart(string objectName, string uploadId, int partNumber)
         {
 
-            return GetS3Client(S3ClientMode.INTERNAL).GetPreSignedURL(new GetPreSignedUrlRequest
+            var client = GetS3Client(S3ClientMode.INTERNAL);
+            return client.GetPreSignedURL(new GetPreSignedUrlRequest
             {
                 BucketName = GetBucketName(S3ClientMode.INTERNAL),
                 Expires = System.DateTime.Now.AddHours(1),
@@ -249,7 +251,7 @@ namespace Notesnook.API.Services
 #if DEBUG
                 Protocol = Protocol.HTTP,
 #else
-                Protocol = Constants.IS_SELF_HOSTED ? Protocol.HTTP : Protocol.HTTPS,
+                Protocol = client.Config.ServiceURL.StartsWith("http://") ? Protocol.HTTP : Protocol.HTTPS,
 #endif
             });
         }

README.md

@@ -69,7 +69,7 @@ This takes care of setting up everything including MongoDB, Minio etc.
 
 ## TODO Self-hosting
 
-**Note: Self-hosting the Notesnook Sync Server is not yet possible. We are working to enable full on-premise self hosting so stay tuned!**
+**Note: Self-hosting the Notesnook Sync Server is now possible, but without support. Documentation will be provided at a later date. We are working to enable full on-premise self-hosting, so stay tuned!**
 
 - [x] Open source the Sync server
 - [x] Open source the Identity server
@@ -77,8 +77,8 @@ This takes care of setting up everything including MongoDB, Minio etc.
 - [x] Fully Dockerize all services
 - [x] Use self-hosted Minio for S3 storage
 - [x] Publish on DockerHub
+- [x] Add settings to change server URLs in Notesnook client apps (starting from v3.0.18)
 - [ ] Write self hosting docs
-- [ ] Add settings to change server URLs in Notesnook client apps
 
 ## License
 

Streetwriters.Common/Constants.cs

@@ -1,81 +1,81 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System;
-
-namespace Streetwriters.Common
-{
-    public class Constants
-    {
-        public static int COMPATIBILITY_VERSION = 1;
-        public static bool IS_SELF_HOSTED => Environment.GetEnvironmentVariable("SELF_HOSTED") == "1";
-        public static bool DISABLE_ACCOUNT_CREATION => Environment.GetEnvironmentVariable("DISABLE_ACCOUNT_CREATION") == "1";
-        public static string INSTANCE_NAME => Environment.GetEnvironmentVariable("INSTANCE_NAME") ?? "default";
-
-        // S3 related
-        public static string S3_ACCESS_KEY => Environment.GetEnvironmentVariable("S3_ACCESS_KEY");
-        public static string S3_ACCESS_KEY_ID => Environment.GetEnvironmentVariable("S3_ACCESS_KEY_ID");
-        public static string S3_SERVICE_URL => Environment.GetEnvironmentVariable("S3_SERVICE_URL");
-        public static string S3_REGION => Environment.GetEnvironmentVariable("S3_REGION");
-        public static string S3_BUCKET_NAME => Environment.GetEnvironmentVariable("S3_BUCKET_NAME");
-        public static string S3_INTERNAL_BUCKET_NAME => Environment.GetEnvironmentVariable("S3_INTERNAL_BUCKET_NAME");
-        public static string S3_INTERNAL_SERVICE_URL => Environment.GetEnvironmentVariable("S3_INTERNAL_SERVICE_URL");
-
-        // SMTP settings
-        public static string SMTP_USERNAME => Environment.GetEnvironmentVariable("SMTP_USERNAME");
-        public static string SMTP_PASSWORD => Environment.GetEnvironmentVariable("SMTP_PASSWORD");
-        public static string SMTP_HOST => Environment.GetEnvironmentVariable("SMTP_HOST");
-        public static string SMTP_PORT => Environment.GetEnvironmentVariable("SMTP_PORT");
-        public static string SMTP_REPLYTO_EMAIL => Environment.GetEnvironmentVariable("SMTP_REPLYTO_EMAIL");
-        public static string NOTESNOOK_SENDER_EMAIL => Environment.GetEnvironmentVariable("NOTESNOOK_SENDER_EMAIL") ?? Environment.GetEnvironmentVariable("SMTP_USERNAME");
-
-        public static string NOTESNOOK_APP_HOST => Environment.GetEnvironmentVariable("NOTESNOOK_APP_HOST");
-        public static string NOTESNOOK_API_SECRET => Environment.GetEnvironmentVariable("NOTESNOOK_API_SECRET");
-
-        // MessageBird is used for SMS sending
-        public static string TWILIO_ACCOUNT_SID => Environment.GetEnvironmentVariable("TWILIO_ACCOUNT_SID");
-        public static string TWILIO_AUTH_TOKEN => Environment.GetEnvironmentVariable("TWILIO_AUTH_TOKEN");
-        public static string TWILIO_SERVICE_SID => Environment.GetEnvironmentVariable("TWILIO_SERVICE_SID");
-        // Server discovery
-        public static int NOTESNOOK_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("NOTESNOOK_SERVER_PORT") ?? "80");
-        public static string NOTESNOOK_SERVER_HOST => Environment.GetEnvironmentVariable("NOTESNOOK_SERVER_HOST");
-        public static string NOTESNOOK_CERT_PATH => Environment.GetEnvironmentVariable("NOTESNOOK_CERT_PATH");
-        public static string NOTESNOOK_CERT_KEY_PATH => Environment.GetEnvironmentVariable("NOTESNOOK_CERT_KEY_PATH");
-
-        public static int IDENTITY_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("IDENTITY_SERVER_PORT") ?? "80");
-        public static string IDENTITY_SERVER_HOST => Environment.GetEnvironmentVariable("IDENTITY_SERVER_HOST");
-        public static string IDENTITY_SERVER_DOMAIN => Environment.GetEnvironmentVariable("IDENTITY_SERVER_DOMAIN");
-        public static string IDENTITY_CERT_PATH => Environment.GetEnvironmentVariable("IDENTITY_CERT_PATH");
-        public static string IDENTITY_CERT_KEY_PATH => Environment.GetEnvironmentVariable("IDENTITY_CERT_KEY_PATH");
-
-        public static int SSE_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("SSE_SERVER_PORT") ?? "80");
-        public static string SSE_SERVER_HOST => Environment.GetEnvironmentVariable("SSE_SERVER_HOST");
-        public static string SSE_CERT_PATH => Environment.GetEnvironmentVariable("SSE_CERT_PATH");
-        public static string SSE_CERT_KEY_PATH => Environment.GetEnvironmentVariable("SSE_CERT_KEY_PATH");
-
-        // internal
-        public static string MONGODB_CONNECTION_STRING => Environment.GetEnvironmentVariable("MONGODB_CONNECTION_STRING");
-        public static string MONGODB_DATABASE_NAME => Environment.GetEnvironmentVariable("MONGODB_DATABASE_NAME");
-        public static int SUBSCRIPTIONS_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("SUBSCRIPTIONS_SERVER_PORT") ?? "80");
-        public static string SUBSCRIPTIONS_SERVER_HOST => Environment.GetEnvironmentVariable("SUBSCRIPTIONS_SERVER_HOST");
-        public static string SUBSCRIPTIONS_CERT_PATH => Environment.GetEnvironmentVariable("SUBSCRIPTIONS_CERT_PATH");
-        public static string SUBSCRIPTIONS_CERT_KEY_PATH => Environment.GetEnvironmentVariable("SUBSCRIPTIONS_CERT_KEY_PATH");
-        public static string[] NOTESNOOK_CORS_ORIGINS => Environment.GetEnvironmentVariable("NOTESNOOK_CORS")?.Split(",") ?? new string[] { };
-    }
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+
+namespace Streetwriters.Common
+{
+    public class Constants
+    {
+        public static int COMPATIBILITY_VERSION = 1;
+        public static bool IS_SELF_HOSTED => Environment.GetEnvironmentVariable("SELF_HOSTED") == "1";
+        public static bool DISABLE_ACCOUNT_CREATION => Environment.GetEnvironmentVariable("DISABLE_ACCOUNT_CREATION") == "1";
+        public static string INSTANCE_NAME => Environment.GetEnvironmentVariable("INSTANCE_NAME") ?? "default";
+
+        // S3 related
+        public static string S3_ACCESS_KEY => Environment.GetEnvironmentVariable("S3_ACCESS_KEY");
+        public static string S3_ACCESS_KEY_ID => Environment.GetEnvironmentVariable("S3_ACCESS_KEY_ID");
+        public static string S3_SERVICE_URL => Environment.GetEnvironmentVariable("S3_SERVICE_URL");
+        public static string S3_REGION => Environment.GetEnvironmentVariable("S3_REGION");
+        public static string S3_BUCKET_NAME => Environment.GetEnvironmentVariable("S3_BUCKET_NAME");
+        public static string S3_INTERNAL_BUCKET_NAME => Environment.GetEnvironmentVariable("S3_INTERNAL_BUCKET_NAME");
+        public static string S3_INTERNAL_SERVICE_URL => Environment.GetEnvironmentVariable("S3_INTERNAL_SERVICE_URL");
+
+        // SMTP settings
+        public static string SMTP_USERNAME => Environment.GetEnvironmentVariable("SMTP_USERNAME");
+        public static string SMTP_PASSWORD => Environment.GetEnvironmentVariable("SMTP_PASSWORD");
+        public static string SMTP_HOST => Environment.GetEnvironmentVariable("SMTP_HOST");
+        public static string SMTP_PORT => Environment.GetEnvironmentVariable("SMTP_PORT");
+        public static string SMTP_REPLYTO_EMAIL => Environment.GetEnvironmentVariable("SMTP_REPLYTO_EMAIL");
+        public static string NOTESNOOK_SENDER_EMAIL => Environment.GetEnvironmentVariable("NOTESNOOK_SENDER_EMAIL") ?? Environment.GetEnvironmentVariable("SMTP_USERNAME");
+
+        public static string NOTESNOOK_APP_HOST => Environment.GetEnvironmentVariable("NOTESNOOK_APP_HOST");
+        public static string NOTESNOOK_API_SECRET => Environment.GetEnvironmentVariable("NOTESNOOK_API_SECRET");
+
+        // MessageBird is used for SMS sending
+        public static string TWILIO_ACCOUNT_SID => Environment.GetEnvironmentVariable("TWILIO_ACCOUNT_SID");
+        public static string TWILIO_AUTH_TOKEN => Environment.GetEnvironmentVariable("TWILIO_AUTH_TOKEN");
+        public static string TWILIO_SERVICE_SID => Environment.GetEnvironmentVariable("TWILIO_SERVICE_SID");
+        // Server discovery
+        public static int NOTESNOOK_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("NOTESNOOK_SERVER_PORT") ?? "80");
+        public static string NOTESNOOK_SERVER_HOST => Environment.GetEnvironmentVariable("NOTESNOOK_SERVER_HOST");
+        public static string NOTESNOOK_CERT_PATH => Environment.GetEnvironmentVariable("NOTESNOOK_CERT_PATH");
+        public static string NOTESNOOK_CERT_KEY_PATH => Environment.GetEnvironmentVariable("NOTESNOOK_CERT_KEY_PATH");
+
+        public static int IDENTITY_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("IDENTITY_SERVER_PORT") ?? "80");
+        public static string IDENTITY_SERVER_HOST => Environment.GetEnvironmentVariable("IDENTITY_SERVER_HOST");
+        public static Uri IDENTITY_SERVER_URL => new(Environment.GetEnvironmentVariable("IDENTITY_SERVER_URL"));
+        public static string IDENTITY_CERT_PATH => Environment.GetEnvironmentVariable("IDENTITY_CERT_PATH");
+        public static string IDENTITY_CERT_KEY_PATH => Environment.GetEnvironmentVariable("IDENTITY_CERT_KEY_PATH");
+
+        public static int SSE_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("SSE_SERVER_PORT") ?? "80");
+        public static string SSE_SERVER_HOST => Environment.GetEnvironmentVariable("SSE_SERVER_HOST");
+        public static string SSE_CERT_PATH => Environment.GetEnvironmentVariable("SSE_CERT_PATH");
+        public static string SSE_CERT_KEY_PATH => Environment.GetEnvironmentVariable("SSE_CERT_KEY_PATH");
+
+        // internal
+        public static string MONGODB_CONNECTION_STRING => Environment.GetEnvironmentVariable("MONGODB_CONNECTION_STRING");
+        public static string MONGODB_DATABASE_NAME => Environment.GetEnvironmentVariable("MONGODB_DATABASE_NAME");
+        public static int SUBSCRIPTIONS_SERVER_PORT => int.Parse(Environment.GetEnvironmentVariable("SUBSCRIPTIONS_SERVER_PORT") ?? "80");
+        public static string SUBSCRIPTIONS_SERVER_HOST => Environment.GetEnvironmentVariable("SUBSCRIPTIONS_SERVER_HOST");
+        public static string SUBSCRIPTIONS_CERT_PATH => Environment.GetEnvironmentVariable("SUBSCRIPTIONS_CERT_PATH");
+        public static string SUBSCRIPTIONS_CERT_KEY_PATH => Environment.GetEnvironmentVariable("SUBSCRIPTIONS_CERT_KEY_PATH");
+        public static string[] NOTESNOOK_CORS_ORIGINS => Environment.GetEnvironmentVariable("NOTESNOOK_CORS")?.Split(",") ?? new string[] { };
+    }
 }

Streetwriters.Common/Servers.cs

@@ -1,122 +1,122 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System.Net.NetworkInformation;
-using System.Net.Sockets;
-using System.Security.Cryptography.X509Certificates;
-#if !DEBUG
-using System;
-using System.Security.Cryptography.X509Certificates;
-#endif
-
-namespace Streetwriters.Common
-{
-    public class Server
-    {
-        public Server(string originCertPath = null, string originCertKeyPath = null)
-        {
-            if (!string.IsNullOrEmpty(originCertPath) && !string.IsNullOrEmpty(originCertKeyPath))
-                this.SSLCertificate = X509Certificate2.CreateFromPemFile(originCertPath, originCertKeyPath);
-        }
-        public string Id { get; set; }
-        public int Port { get; set; }
-        public string Hostname { get; set; }
-        public string Domain { get; set; }
-        public X509Certificate2 SSLCertificate { get; }
-        public bool IsSecure { get => this.SSLCertificate != null; }
-
-        public override string ToString()
-        {
-            var url = "";
-            url += "http";
-            url += $"://{Hostname}";
-            url += Port == 80 || Port == 443 ? "" : $":{Port}";
-            return url;
-        }
-
-        public string WS()
-        {
-            var url = "";
-            url += IsSecure ? "ws" : "ws";
-            url += $"://{Hostname}";
-            url += Port == 80 ? "" : $":{Port}";
-            return url;
-        }
-    }
-
-    public class Servers
-    {
-#if DEBUG
-        public static string GetLocalIPv4()
-        {
-            var interfaces = NetworkInterface.GetAllNetworkInterfaces();
-            string output = "";
-            foreach (NetworkInterface item in interfaces)
-            {
-                if ((item.NetworkInterfaceType == NetworkInterfaceType.Ethernet || item.NetworkInterfaceType == NetworkInterfaceType.Wireless80211) && item.OperationalStatus == OperationalStatus.Up)
-                {
-                    foreach (UnicastIPAddressInformation ip in item.GetIPProperties().UnicastAddresses)
-                    {
-                        if (ip.Address.AddressFamily == AddressFamily.InterNetwork)
-                        {
-                            output = ip.Address.ToString();
-                        }
-                    }
-                }
-            }
-            return output;
-        }
-        public readonly static string HOST = GetLocalIPv4();
-        public static Server S3Server { get; } = new()
-        {
-            Port = 4568,
-            Hostname = HOST,
-            Domain = HOST
-        };
-#endif
-        public static Server NotesnookAPI { get; } = new(Constants.NOTESNOOK_CERT_PATH, Constants.NOTESNOOK_CERT_KEY_PATH)
-        {
-            Port = Constants.NOTESNOOK_SERVER_PORT,
-            Hostname = Constants.NOTESNOOK_SERVER_HOST,
-            Id = "notesnook-sync"
-        };
-
-        public static Server MessengerServer { get; } = new(Constants.SSE_CERT_PATH, Constants.SSE_CERT_KEY_PATH)
-        {
-            Port = Constants.SSE_SERVER_PORT,
-            Hostname = Constants.SSE_SERVER_HOST,
-            Id = "sse"
-        };
-
-        public static Server IdentityServer { get; } = new(Constants.IDENTITY_CERT_PATH, Constants.IDENTITY_CERT_KEY_PATH)
-        {
-            Domain = Constants.IDENTITY_SERVER_DOMAIN,
-            Port = Constants.IDENTITY_SERVER_PORT,
-            Hostname = Constants.IDENTITY_SERVER_HOST,
-            Id = "auth"
-        };
-
-        public static Server SubscriptionServer { get; } = new(Constants.SUBSCRIPTIONS_CERT_PATH, Constants.SUBSCRIPTIONS_CERT_KEY_PATH)
-        {
-            Port = Constants.SUBSCRIPTIONS_SERVER_PORT,
-            Hostname = Constants.SUBSCRIPTIONS_SERVER_HOST,
-            Id = "subscription"
-        };
-    }
-}
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+using System.Net.NetworkInformation;
+using System.Net.Sockets;
+using System.Security.Cryptography.X509Certificates;
+#if !DEBUG
+using System;
+using System.Security.Cryptography.X509Certificates;
+#endif
+
+namespace Streetwriters.Common
+{
+    public class Server
+    {
+        public Server(string originCertPath = null, string originCertKeyPath = null)
+        {
+            if (!string.IsNullOrEmpty(originCertPath) && !string.IsNullOrEmpty(originCertKeyPath))
+                this.SSLCertificate = X509Certificate2.CreateFromPemFile(originCertPath, originCertKeyPath);
+        }
+        public string Id { get; set; }
+        public int Port { get; set; }
+        public string Hostname { get; set; }
+        public Uri PublicURL { get; set; }
+        public X509Certificate2 SSLCertificate { get; }
+        public bool IsSecure { get => this.SSLCertificate != null; }
+
+        public override string ToString()
+        {
+            var url = "";
+            url += "http";
+            url += $"://{Hostname}";
+            url += Port == 80 || Port == 443 ? "" : $":{Port}";
+            return url;
+        }
+
+        public string WS()
+        {
+            var url = "";
+            url += IsSecure ? "ws" : "ws";
+            url += $"://{Hostname}";
+            url += Port == 80 ? "" : $":{Port}";
+            return url;
+        }
+    }
+
+    public class Servers
+    {
+#if DEBUG
+        public static string GetLocalIPv4()
+        {
+            var interfaces = NetworkInterface.GetAllNetworkInterfaces();
+            string output = "";
+            foreach (NetworkInterface item in interfaces)
+            {
+                if ((item.NetworkInterfaceType == NetworkInterfaceType.Ethernet || item.NetworkInterfaceType == NetworkInterfaceType.Wireless80211) && item.OperationalStatus == OperationalStatus.Up)
+                {
+                    foreach (UnicastIPAddressInformation ip in item.GetIPProperties().UnicastAddresses)
+                    {
+                        if (ip.Address.AddressFamily == AddressFamily.InterNetwork)
+                        {
+                            output = ip.Address.ToString();
+                        }
+                    }
+                }
+            }
+            return output;
+        }
+        public readonly static string HOST = GetLocalIPv4();
+        public static Server S3Server { get; } = new()
+        {
+            Port = 4568,
+            Hostname = HOST
+        };
+#endif
+        public static Server NotesnookAPI { get; } = new(Constants.NOTESNOOK_CERT_PATH, Constants.NOTESNOOK_CERT_KEY_PATH)
+        {
+            Port = Constants.NOTESNOOK_SERVER_PORT,
+            Hostname = Constants.NOTESNOOK_SERVER_HOST,
+            Id = "notesnook-sync"
+        };
+
+        public static Server MessengerServer { get; } = new(Constants.SSE_CERT_PATH, Constants.SSE_CERT_KEY_PATH)
+        {
+            Port = Constants.SSE_SERVER_PORT,
+            Hostname = Constants.SSE_SERVER_HOST,
+            Id = "sse"
+        };
+
+        public static Server IdentityServer { get; } = new(Constants.IDENTITY_CERT_PATH, Constants.IDENTITY_CERT_KEY_PATH)
+        {
+            PublicURL = Constants.IDENTITY_SERVER_URL,
+            Port = Constants.IDENTITY_SERVER_PORT,
+            Hostname = Constants.IDENTITY_SERVER_HOST,
+            Id = "auth"
+        };
+
+        public static Server SubscriptionServer { get; } = new(Constants.SUBSCRIPTIONS_CERT_PATH, Constants.SUBSCRIPTIONS_CERT_KEY_PATH)
+        {
+            Port = Constants.SUBSCRIPTIONS_SERVER_PORT,
+            Hostname = Constants.SUBSCRIPTIONS_SERVER_HOST,
+            Id = "subscription"
+        };
+    }
+}

Streetwriters.Identity/Controllers/AccountController.cs

@@ -1,344 +1,344 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System.Collections.Generic;
-using System.ComponentModel;
-using System.Linq;
-using System.Security.Claims;
-using System.Text.Json;
-using System.Threading.Tasks;
-using AspNetCore.Identity.Mongo.Model;
-using IdentityServer4;
-using IdentityServer4.Configuration;
-using IdentityServer4.Models;
-using IdentityServer4.Stores;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Identity;
-using Microsoft.AspNetCore.Mvc;
-using Streetwriters.Common;
-using Streetwriters.Common.Enums;
-using Streetwriters.Common.Interfaces;
-using Streetwriters.Common.Messages;
-using Streetwriters.Common.Models;
-using Streetwriters.Identity.Enums;
-using Streetwriters.Identity.Interfaces;
-using Streetwriters.Identity.Models;
-using Streetwriters.Identity.Services;
-using static IdentityServer4.IdentityServerConstants;
-
-namespace Streetwriters.Identity.Controllers
-{
-    [ApiController]
-    [DisplayName("Account")]
-    [Route("account")]
-    [Authorize(LocalApi.PolicyName)]
-    public class AccountController : IdentityControllerBase
-    {
-        private IPersistedGrantStore PersistedGrantStore { get; set; }
-        private ITokenGenerationService TokenGenerationService { get; set; }
-        private IUserClaimsPrincipalFactory<User> PrincipalFactory { get; set; }
-        private IdentityServerOptions ISOptions { get; set; }
-        private IUserAccountService UserAccountService { get; set; }
-        public AccountController(UserManager<User> _userManager, IEmailSender _emailSender,
-        SignInManager<User> _signInManager, RoleManager<MongoRole> _roleManager, IPersistedGrantStore store,
-        ITokenGenerationService tokenGenerationService, IMFAService _mfaService, IUserAccountService userAccountService) : base(_userManager, _emailSender, _signInManager, _roleManager, _mfaService)
-        {
-            PersistedGrantStore = store;
-            TokenGenerationService = tokenGenerationService;
-            UserAccountService = userAccountService;
-        }
-
-        [HttpGet("confirm")]
-        [AllowAnonymous]
-        [ResponseCache(NoStore = true)]
-        public async Task<IActionResult> ConfirmToken(string userId, string code, string clientId, TokenType type)
-        {
-            var client = Clients.FindClientById(clientId);
-            if (client == null) return BadRequest("Invalid client_id.");
-
-            var user = await UserManager.FindByIdAsync(userId);
-            if (!await UserService.IsUserValidAsync(UserManager, user, clientId)) return BadRequest($"Unable to find user with ID '{userId}'.");
-
-            switch (type)
-            {
-                case TokenType.CONFRIM_EMAIL:
-                    {
-                        if (await UserManager.IsEmailConfirmedAsync(user)) return Ok("Email already verified.");
-
-                        var result = await UserManager.ConfirmEmailAsync(user, code);
-                        if (!result.Succeeded) return BadRequest(result.Errors.ToErrors());
-
-                        if (await UserManager.IsInRoleAsync(user, client.Id))
-                        {
-                            await client.OnEmailConfirmed(userId);
-                        }
-
-                        if (!await UserManager.GetTwoFactorEnabledAsync(user))
-                        {
-                            await MFAService.EnableMFAAsync(user, MFAMethods.Email);
-                            user = await UserManager.GetUserAsync(User);
-                        }
-
-                        var redirectUrl = $"{client.EmailConfirmedRedirectURL}?userId={userId}";
-                        return RedirectPermanent(redirectUrl);
-                    }
-                case TokenType.RESET_PASSWORD:
-                    {
-                        if (!await UserManager.VerifyUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword", code))
-                            return BadRequest("Invalid token.");
-
-                        var authorizationCode = await UserManager.GenerateUserTokenAsync(user, TokenOptions.DefaultProvider, "PasswordResetAuthorizationCode");
-                        var redirectUrl = $"{client.AccountRecoveryRedirectURL}?userId={userId}&code={authorizationCode}";
-                        return RedirectPermanent(redirectUrl);
-                    }
-                default:
-                    return BadRequest("Invalid type.");
-            }
-
-        }
-
-        [HttpPost("verify")]
-        public async Task<IActionResult> SendVerificationEmail([FromForm] string newEmail)
-        {
-            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
-            if (client == null) return BadRequest("Invalid client_id.");
-
-            var user = await UserManager.GetUserAsync(User);
-            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id)) return BadRequest($"Unable to find user with ID '{UserManager.GetUserId(User)}'.");
-
-            if (string.IsNullOrEmpty(newEmail))
-            {
-                var code = await UserManager.GenerateEmailConfirmationTokenAsync(user);
-                var callbackUrl = Url.TokenLink(user.Id.ToString(), code, client.Id, TokenType.CONFRIM_EMAIL, Request.Scheme);
-                await EmailSender.SendConfirmationEmailAsync(user.Email, callbackUrl, client);
-            }
-            else
-            {
-                var code = await UserManager.GenerateChangeEmailTokenAsync(user, newEmail);
-                await EmailSender.SendChangeEmailConfirmationAsync(newEmail, code, client);
-            }
-            return Ok();
-        }
-
-        [HttpGet]
-        public async Task<IActionResult> GetUserAccount()
-        {
-            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
-            if (client == null) return BadRequest("Invalid client_id.");
-            var user = await UserManager.GetUserAsync(User);
-            return Ok(UserAccountService.GetUserAsync(client.Id, user.Id.ToString()));
-        }
-
-        [HttpPost("recover")]
-        [AllowAnonymous]
-        public async Task<IActionResult> ResetUserPassword([FromForm] ResetPasswordForm form)
-        {
-            var client = Clients.FindClientById(form.ClientId);
-            if (client == null) return BadRequest("Invalid client_id.");
-
-            var user = await UserManager.FindByEmailAsync(form.Email);
-            if (!await UserService.IsUserValidAsync(UserManager, user, form.ClientId)) return Ok();
-
-            var code = await UserManager.GenerateUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword");
-            var callbackUrl = Url.TokenLink(user.Id.ToString(), code, client.Id, TokenType.RESET_PASSWORD, Request.Scheme);
-#if DEBUG
-            return Ok(callbackUrl);
-#else
-            await Slogger<AccountController>.Info("ResetUserPassword", user.Email, callbackUrl);
-            await EmailSender.SendPasswordResetEmailAsync(user.Email, callbackUrl, client);
-            return Ok();
-#endif
-        }
-
-        [HttpPost("logout")]
-        public async Task<IActionResult> Logout()
-        {
-            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
-            if (client == null) return BadRequest("Invalid client_id.");
-
-            var user = await UserManager.GetUserAsync(User);
-            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id)) return BadRequest($"Unable to find user with ID '{UserManager.GetUserId(User)}'.");
-
-            var subjectId = User.FindFirstValue("sub");
-            var jti = User.FindFirstValue("jti");
-
-            var grants = await PersistedGrantStore.GetAllAsync(new PersistedGrantFilter
-            {
-                ClientId = client.Id,
-                SubjectId = subjectId
-            });
-            grants = grants.Where((grant) => grant.Data.Contains(jti));
-            if (grants.Any())
-            {
-                foreach (var grant in grants)
-                {
-                    await PersistedGrantStore.RemoveAsync(grant.Key);
-                }
-            }
-            return Ok();
-        }
-
-        [HttpPost("token")]
-        [AllowAnonymous]
-        public async Task<IActionResult> GetAccessTokenFromCode([FromForm] GetAccessTokenForm form)
-        {
-            if (!Clients.IsValidClient(form.ClientId)) return BadRequest("Invalid clientId.");
-            var user = await UserManager.FindByIdAsync(form.UserId);
-            if (!await UserService.IsUserValidAsync(UserManager, user, form.ClientId))
-                return BadRequest($"Unable to find user with ID '{form.UserId}'.");
-
-            if (!await UserManager.VerifyUserTokenAsync(user, TokenOptions.DefaultProvider, "PasswordResetAuthorizationCode", form.Code))
-                return BadRequest("Invalid authorization_code.");
-            var token = await TokenGenerationService.CreateAccessTokenAsync(user, form.ClientId);
-            return Ok(new
-            {
-                access_token = token,
-                scope = string.Join(' ', Config.ApiScopes.Select(s => s.Name)),
-                expires_in = 18000
-            });
-        }
-
-        [HttpPatch]
-        public async Task<IActionResult> UpdateAccount([FromForm] UpdateUserForm form)
-        {
-            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
-            if (client == null) return BadRequest("Invalid client_id.");
-
-            var user = await UserManager.GetUserAsync(User);
-            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id))
-                return BadRequest($"Unable to find user with ID '{UserManager.GetUserId(User)}'.");
-
-            switch (form.Type)
-            {
-                case "change_email":
-                    {
-                        var result = await UserManager.ChangeEmailAsync(user, form.NewEmail, form.VerificationCode);
-                        if (result.Succeeded)
-                        {
-                            result = await UserManager.RemovePasswordAsync(user);
-                            if (result.Succeeded)
-                            {
-                                result = await UserManager.AddPasswordAsync(user, form.Password);
-                                if (result.Succeeded)
-                                {
-                                    await UserManager.SetUserNameAsync(user, form.NewEmail);
-                                    await SendLogoutMessageAsync(user.Id.ToString(), "Email changed.");
-                                    return Ok();
-                                }
-                            }
-                        }
-                        return BadRequest(result.Errors.ToErrors());
-                    }
-                case "change_password":
-                    {
-                        var result = await UserManager.ChangePasswordAsync(user, form.OldPassword, form.NewPassword);
-                        if (result.Succeeded)
-                        {
-                            await SendLogoutMessageAsync(user.Id.ToString(), "Password changed.");
-                            return Ok();
-                        }
-                        return BadRequest(result.Errors.ToErrors());
-                    }
-                case "reset_password":
-                    {
-                        var result = await UserManager.RemovePasswordAsync(user);
-                        if (result.Succeeded)
-                        {
-                            await MFAService.ResetMFAAsync(user);
-                            result = await UserManager.AddPasswordAsync(user, form.NewPassword);
-                            if (result.Succeeded)
-                            {
-                                await SendLogoutMessageAsync(user.Id.ToString(), "Password reset.");
-                                return Ok();
-                            }
-                        }
-                        return BadRequest(result.Errors.ToErrors());
-                    }
-                case "change_marketing_consent":
-                    {
-                        var claimType = $"{client.Id}:marketing_consent";
-                        var claims = await UserManager.GetClaimsAsync(user);
-                        var marketingConsentClaim = claims.FirstOrDefault((claim) => claim.Type == claimType);
-                        if (marketingConsentClaim != null) await UserManager.RemoveClaimAsync(user, marketingConsentClaim);
-                        if (!form.Enabled)
-                            await UserManager.AddClaimAsync(user, new Claim(claimType, "false"));
-                        return Ok();
-                    }
-
-            }
-            return BadRequest("Invalid type.");
-        }
-
-        [HttpPost("sessions/clear")]
-        public async Task<IActionResult> ClearUserSessions([FromQuery] bool all, [FromForm] string refresh_token)
-        {
-            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
-            if (client == null) return BadRequest("Invalid client_id.");
-
-            var user = await UserManager.GetUserAsync(User);
-            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id)) return BadRequest($"Unable to find user with ID '{user.Id}'.");
-
-            var jti = User.FindFirstValue("jti");
-
-            var grants = await PersistedGrantStore.GetAllAsync(new PersistedGrantFilter
-            {
-                ClientId = client.Id,
-                SubjectId = user.Id.ToString()
-            });
-            var refreshTokenKey = GetHashedKey(refresh_token, PersistedGrantTypes.RefreshToken);
-            var removedKeys = new List<string>();
-            foreach (var grant in grants)
-            {
-                if (!all && (grant.Data.Contains(jti) || grant.Key == refreshTokenKey)) continue;
-                await PersistedGrantStore.RemoveAsync(grant.Key);
-                removedKeys.Add(grant.Key);
-            }
-
-            await WampServers.NotesnookServer.PublishMessageAsync(IdentityServerTopics.ClearCacheTopic, new ClearCacheMessage(removedKeys));
-            await WampServers.MessengerServer.PublishMessageAsync(IdentityServerTopics.ClearCacheTopic, new ClearCacheMessage(removedKeys));
-            await WampServers.SubscriptionServer.PublishMessageAsync(IdentityServerTopics.ClearCacheTopic, new ClearCacheMessage(removedKeys));
-            await SendLogoutMessageAsync(user.Id.ToString(), "Session revoked.");
-            return Ok();
-        }
-
-        private static string GetHashedKey(string value, string grantType)
-        {
-            return (value + ":" + grantType).Sha256();
-        }
-
-        private async Task SendLogoutMessageAsync(string userId, string reason)
-        {
-            await SendMessageAsync(userId, new Message
-            {
-                Type = "logout",
-                Data = JsonSerializer.Serialize(new { reason })
-            });
-        }
-
-        private async Task SendMessageAsync(string userId, Message message)
-        {
-            await WampServers.MessengerServer.PublishMessageAsync(MessengerServerTopics.SendSSETopic, new SendSSEMessage
-            {
-                UserId = userId,
-                OriginTokenId = User.FindFirstValue("jti"),
-                Message = message
-            });
-        }
-    }
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.Linq;
+using System.Security.Claims;
+using System.Text.Json;
+using System.Threading.Tasks;
+using AspNetCore.Identity.Mongo.Model;
+using IdentityServer4;
+using IdentityServer4.Configuration;
+using IdentityServer4.Models;
+using IdentityServer4.Stores;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Streetwriters.Common;
+using Streetwriters.Common.Enums;
+using Streetwriters.Common.Interfaces;
+using Streetwriters.Common.Messages;
+using Streetwriters.Common.Models;
+using Streetwriters.Identity.Enums;
+using Streetwriters.Identity.Interfaces;
+using Streetwriters.Identity.Models;
+using Streetwriters.Identity.Services;
+using static IdentityServer4.IdentityServerConstants;
+
+namespace Streetwriters.Identity.Controllers
+{
+    [ApiController]
+    [DisplayName("Account")]
+    [Route("account")]
+    [Authorize(LocalApi.PolicyName)]
+    public class AccountController : IdentityControllerBase
+    {
+        private IPersistedGrantStore PersistedGrantStore { get; set; }
+        private ITokenGenerationService TokenGenerationService { get; set; }
+        private IUserClaimsPrincipalFactory<User> PrincipalFactory { get; set; }
+        private IdentityServerOptions ISOptions { get; set; }
+        private IUserAccountService UserAccountService { get; set; }
+        public AccountController(UserManager<User> _userManager, IEmailSender _emailSender,
+        SignInManager<User> _signInManager, RoleManager<MongoRole> _roleManager, IPersistedGrantStore store,
+        ITokenGenerationService tokenGenerationService, IMFAService _mfaService, IUserAccountService userAccountService) : base(_userManager, _emailSender, _signInManager, _roleManager, _mfaService)
+        {
+            PersistedGrantStore = store;
+            TokenGenerationService = tokenGenerationService;
+            UserAccountService = userAccountService;
+        }
+
+        [HttpGet("confirm")]
+        [AllowAnonymous]
+        [ResponseCache(NoStore = true)]
+        public async Task<IActionResult> ConfirmToken(string userId, string code, string clientId, TokenType type)
+        {
+            var client = Clients.FindClientById(clientId);
+            if (client == null) return BadRequest("Invalid client_id.");
+
+            var user = await UserManager.FindByIdAsync(userId);
+            if (!await UserService.IsUserValidAsync(UserManager, user, clientId)) return BadRequest($"Unable to find user with ID '{userId}'.");
+
+            switch (type)
+            {
+                case TokenType.CONFRIM_EMAIL:
+                    {
+                        if (await UserManager.IsEmailConfirmedAsync(user)) return Ok("Email already verified.");
+
+                        var result = await UserManager.ConfirmEmailAsync(user, code);
+                        if (!result.Succeeded) return BadRequest(result.Errors.ToErrors());
+
+                        if (await UserManager.IsInRoleAsync(user, client.Id))
+                        {
+                            await client.OnEmailConfirmed(userId);
+                        }
+
+                        if (!await UserManager.GetTwoFactorEnabledAsync(user))
+                        {
+                            await MFAService.EnableMFAAsync(user, MFAMethods.Email);
+                            user = await UserManager.GetUserAsync(User);
+                        }
+
+                        var redirectUrl = $"{client.EmailConfirmedRedirectURL}?userId={userId}";
+                        return RedirectPermanent(redirectUrl);
+                    }
+                case TokenType.RESET_PASSWORD:
+                    {
+                        if (!await UserManager.VerifyUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword", code))
+                            return BadRequest("Invalid token.");
+
+                        var authorizationCode = await UserManager.GenerateUserTokenAsync(user, TokenOptions.DefaultProvider, "PasswordResetAuthorizationCode");
+                        var redirectUrl = $"{client.AccountRecoveryRedirectURL}?userId={userId}&code={authorizationCode}";
+                        return RedirectPermanent(redirectUrl);
+                    }
+                default:
+                    return BadRequest("Invalid type.");
+            }
+
+        }
+
+        [HttpPost("verify")]
+        public async Task<IActionResult> SendVerificationEmail([FromForm] string newEmail)
+        {
+            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
+            if (client == null) return BadRequest("Invalid client_id.");
+
+            var user = await UserManager.GetUserAsync(User);
+            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id)) return BadRequest($"Unable to find user with ID '{UserManager.GetUserId(User)}'.");
+
+            if (string.IsNullOrEmpty(newEmail))
+            {
+                var code = await UserManager.GenerateEmailConfirmationTokenAsync(user);
+                var callbackUrl = Url.TokenLink(user.Id.ToString(), code, client.Id, TokenType.CONFRIM_EMAIL);
+                await EmailSender.SendConfirmationEmailAsync(user.Email, callbackUrl, client);
+            }
+            else
+            {
+                var code = await UserManager.GenerateChangeEmailTokenAsync(user, newEmail);
+                await EmailSender.SendChangeEmailConfirmationAsync(newEmail, code, client);
+            }
+            return Ok();
+        }
+
+        [HttpGet]
+        public async Task<IActionResult> GetUserAccount()
+        {
+            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
+            if (client == null) return BadRequest("Invalid client_id.");
+            var user = await UserManager.GetUserAsync(User);
+            return Ok(UserAccountService.GetUserAsync(client.Id, user.Id.ToString()));
+        }
+
+        [HttpPost("recover")]
+        [AllowAnonymous]
+        public async Task<IActionResult> ResetUserPassword([FromForm] ResetPasswordForm form)
+        {
+            var client = Clients.FindClientById(form.ClientId);
+            if (client == null) return BadRequest("Invalid client_id.");
+
+            var user = await UserManager.FindByEmailAsync(form.Email);
+            if (!await UserService.IsUserValidAsync(UserManager, user, form.ClientId)) return Ok();
+
+            var code = await UserManager.GenerateUserTokenAsync(user, TokenOptions.DefaultProvider, "ResetPassword");
+            var callbackUrl = Url.TokenLink(user.Id.ToString(), code, client.Id, TokenType.RESET_PASSWORD);
+#if DEBUG
+            return Ok(callbackUrl);
+#else
+            await Slogger<AccountController>.Info("ResetUserPassword", user.Email, callbackUrl);
+            await EmailSender.SendPasswordResetEmailAsync(user.Email, callbackUrl, client);
+            return Ok();
+#endif
+        }
+
+        [HttpPost("logout")]
+        public async Task<IActionResult> Logout()
+        {
+            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
+            if (client == null) return BadRequest("Invalid client_id.");
+
+            var user = await UserManager.GetUserAsync(User);
+            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id)) return BadRequest($"Unable to find user with ID '{UserManager.GetUserId(User)}'.");
+
+            var subjectId = User.FindFirstValue("sub");
+            var jti = User.FindFirstValue("jti");
+
+            var grants = await PersistedGrantStore.GetAllAsync(new PersistedGrantFilter
+            {
+                ClientId = client.Id,
+                SubjectId = subjectId
+            });
+            grants = grants.Where((grant) => grant.Data.Contains(jti));
+            if (grants.Any())
+            {
+                foreach (var grant in grants)
+                {
+                    await PersistedGrantStore.RemoveAsync(grant.Key);
+                }
+            }
+            return Ok();
+        }
+
+        [HttpPost("token")]
+        [AllowAnonymous]
+        public async Task<IActionResult> GetAccessTokenFromCode([FromForm] GetAccessTokenForm form)
+        {
+            if (!Clients.IsValidClient(form.ClientId)) return BadRequest("Invalid clientId.");
+            var user = await UserManager.FindByIdAsync(form.UserId);
+            if (!await UserService.IsUserValidAsync(UserManager, user, form.ClientId))
+                return BadRequest($"Unable to find user with ID '{form.UserId}'.");
+
+            if (!await UserManager.VerifyUserTokenAsync(user, TokenOptions.DefaultProvider, "PasswordResetAuthorizationCode", form.Code))
+                return BadRequest("Invalid authorization_code.");
+            var token = await TokenGenerationService.CreateAccessTokenAsync(user, form.ClientId);
+            return Ok(new
+            {
+                access_token = token,
+                scope = string.Join(' ', Config.ApiScopes.Select(s => s.Name)),
+                expires_in = 18000
+            });
+        }
+
+        [HttpPatch]
+        public async Task<IActionResult> UpdateAccount([FromForm] UpdateUserForm form)
+        {
+            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
+            if (client == null) return BadRequest("Invalid client_id.");
+
+            var user = await UserManager.GetUserAsync(User);
+            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id))
+                return BadRequest($"Unable to find user with ID '{UserManager.GetUserId(User)}'.");
+
+            switch (form.Type)
+            {
+                case "change_email":
+                    {
+                        var result = await UserManager.ChangeEmailAsync(user, form.NewEmail, form.VerificationCode);
+                        if (result.Succeeded)
+                        {
+                            result = await UserManager.RemovePasswordAsync(user);
+                            if (result.Succeeded)
+                            {
+                                result = await UserManager.AddPasswordAsync(user, form.Password);
+                                if (result.Succeeded)
+                                {
+                                    await UserManager.SetUserNameAsync(user, form.NewEmail);
+                                    await SendLogoutMessageAsync(user.Id.ToString(), "Email changed.");
+                                    return Ok();
+                                }
+                            }
+                        }
+                        return BadRequest(result.Errors.ToErrors());
+                    }
+                case "change_password":
+                    {
+                        var result = await UserManager.ChangePasswordAsync(user, form.OldPassword, form.NewPassword);
+                        if (result.Succeeded)
+                        {
+                            await SendLogoutMessageAsync(user.Id.ToString(), "Password changed.");
+                            return Ok();
+                        }
+                        return BadRequest(result.Errors.ToErrors());
+                    }
+                case "reset_password":
+                    {
+                        var result = await UserManager.RemovePasswordAsync(user);
+                        if (result.Succeeded)
+                        {
+                            await MFAService.ResetMFAAsync(user);
+                            result = await UserManager.AddPasswordAsync(user, form.NewPassword);
+                            if (result.Succeeded)
+                            {
+                                await SendLogoutMessageAsync(user.Id.ToString(), "Password reset.");
+                                return Ok();
+                            }
+                        }
+                        return BadRequest(result.Errors.ToErrors());
+                    }
+                case "change_marketing_consent":
+                    {
+                        var claimType = $"{client.Id}:marketing_consent";
+                        var claims = await UserManager.GetClaimsAsync(user);
+                        var marketingConsentClaim = claims.FirstOrDefault((claim) => claim.Type == claimType);
+                        if (marketingConsentClaim != null) await UserManager.RemoveClaimAsync(user, marketingConsentClaim);
+                        if (!form.Enabled)
+                            await UserManager.AddClaimAsync(user, new Claim(claimType, "false"));
+                        return Ok();
+                    }
+
+            }
+            return BadRequest("Invalid type.");
+        }
+
+        [HttpPost("sessions/clear")]
+        public async Task<IActionResult> ClearUserSessions([FromQuery] bool all, [FromForm] string refresh_token)
+        {
+            var client = Clients.FindClientById(User.FindFirstValue("client_id"));
+            if (client == null) return BadRequest("Invalid client_id.");
+
+            var user = await UserManager.GetUserAsync(User);
+            if (!await UserService.IsUserValidAsync(UserManager, user, client.Id)) return BadRequest($"Unable to find user with ID '{user.Id}'.");
+
+            var jti = User.FindFirstValue("jti");
+
+            var grants = await PersistedGrantStore.GetAllAsync(new PersistedGrantFilter
+            {
+                ClientId = client.Id,
+                SubjectId = user.Id.ToString()
+            });
+            var refreshTokenKey = GetHashedKey(refresh_token, PersistedGrantTypes.RefreshToken);
+            var removedKeys = new List<string>();
+            foreach (var grant in grants)
+            {
+                if (!all && (grant.Data.Contains(jti) || grant.Key == refreshTokenKey)) continue;
+                await PersistedGrantStore.RemoveAsync(grant.Key);
+                removedKeys.Add(grant.Key);
+            }
+
+            await WampServers.NotesnookServer.PublishMessageAsync(IdentityServerTopics.ClearCacheTopic, new ClearCacheMessage(removedKeys));
+            await WampServers.MessengerServer.PublishMessageAsync(IdentityServerTopics.ClearCacheTopic, new ClearCacheMessage(removedKeys));
+            await WampServers.SubscriptionServer.PublishMessageAsync(IdentityServerTopics.ClearCacheTopic, new ClearCacheMessage(removedKeys));
+            await SendLogoutMessageAsync(user.Id.ToString(), "Session revoked.");
+            return Ok();
+        }
+
+        private static string GetHashedKey(string value, string grantType)
+        {
+            return (value + ":" + grantType).Sha256();
+        }
+
+        private async Task SendLogoutMessageAsync(string userId, string reason)
+        {
+            await SendMessageAsync(userId, new Message
+            {
+                Type = "logout",
+                Data = JsonSerializer.Serialize(new { reason })
+            });
+        }
+
+        private async Task SendMessageAsync(string userId, Message message)
+        {
+            await WampServers.MessengerServer.PublishMessageAsync(MessengerServerTopics.SendSSETopic, new SendSSEMessage
+            {
+                UserId = userId,
+                OriginTokenId = User.FindFirstValue("jti"),
+                Message = message
+            });
+        }
+    }
 }

Streetwriters.Identity/Controllers/SignupController.cs

@@ -1,139 +1,139 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System.Collections.Generic;
-using System.Linq;
-using System.Security.Claims;
-using System.Threading.Tasks;
-using AspNetCore.Identity.Mongo.Model;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Identity;
-using Microsoft.AspNetCore.Mvc;
-using Streetwriters.Common;
-using Streetwriters.Common.Enums;
-using Streetwriters.Common.Models;
-using Streetwriters.Identity.Enums;
-using Streetwriters.Identity.Interfaces;
-using Streetwriters.Identity.Models;
-using Streetwriters.Identity.Services;
-
-namespace Streetwriters.Identity.Controllers
-{
-    [ApiController]
-    [Route("signup")]
-    public class SignupController : IdentityControllerBase
-    {
-        public SignupController(UserManager<User> _userManager, IEmailSender _emailSender,
-        SignInManager<User> _signInManager, RoleManager<MongoRole> _roleManager, IMFAService _mfaService) : base(_userManager, _emailSender, _signInManager, _roleManager, _mfaService)
-        { }
-
-        private async Task AddClientRoleAsync(string clientId)
-        {
-            if (await RoleManager.FindByNameAsync(clientId) == null)
-                await RoleManager.CreateAsync(new MongoRole(clientId));
-        }
-
-        [HttpPost]
-        [AllowAnonymous]
-        public async Task<IActionResult> Signup([FromForm] SignupForm form)
-        {
-            if (Constants.DISABLE_ACCOUNT_CREATION)
-                return BadRequest(new string[] { "Creating new accounts is not allowed." });
-            try
-            {
-                var client = Clients.FindClientById(form.ClientId);
-                if (client == null) return BadRequest(new string[] { "Invalid client id." });
-
-                await AddClientRoleAsync(client.Id);
-
-                // email addresses must be case-insensitive
-                form.Email = form.Email.ToLowerInvariant();
-                form.Username = form.Username?.ToLowerInvariant();
-
-                if (!await EmailAddressValidator.IsEmailAddressValidAsync(form.Email)) return BadRequest(new string[] { "Invalid email address." });
-
-                var result = await UserManager.CreateAsync(new User
-                {
-                    Email = form.Email,
-                    EmailConfirmed = Constants.IS_SELF_HOSTED,
-                    UserName = form.Username ?? form.Email,
-                }, form.Password);
-
-                if (result.Errors.Any((e) => e.Code == "DuplicateEmail"))
-                {
-                    var user = await UserManager.FindByEmailAsync(form.Email);
-
-                    if (!await UserManager.IsInRoleAsync(user, client.Id))
-                    {
-                        if (!await UserManager.CheckPasswordAsync(user, form.Password))
-                        {
-                            // TODO
-                            await UserManager.RemovePasswordAsync(user);
-                            await UserManager.AddPasswordAsync(user, form.Password);
-                        }
-                        await MFAService.DisableMFAAsync(user);
-                        await UserManager.AddToRoleAsync(user, client.Id);
-                    }
-                    else
-                    {
-                        return BadRequest(new string[] { "Invalid email address.." });
-                    }
-
-                    return Ok(new
-                    {
-                        userId = user.Id.ToString()
-                    });
-                }
-
-                if (result.Succeeded)
-                {
-                    var user = await UserManager.FindByEmailAsync(form.Email);
-                    await UserManager.AddToRoleAsync(user, client.Id);
-                    if (Constants.IS_SELF_HOSTED)
-                    {
-                        await UserManager.AddClaimAsync(user, UserService.SubscriptionTypeToClaim(client.Id, Common.Enums.SubscriptionType.PREMIUM));
-                    }
-                    else
-                    {
-                        await UserManager.AddClaimAsync(user, new Claim("platform", PlatformFromUserAgent(base.HttpContext.Request.Headers.UserAgent)));
-                        var code = await UserManager.GenerateEmailConfirmationTokenAsync(user);
-                        var callbackUrl = Url.TokenLink(user.Id.ToString(), code, client.Id, TokenType.CONFRIM_EMAIL, Request.Scheme);
-                        await EmailSender.SendConfirmationEmailAsync(user.Email, callbackUrl, client);
-                    }
-                    return Ok(new
-                    {
-                        userId = user.Id.ToString()
-                    });
-                }
-
-                return BadRequest(result.Errors.ToErrors());
-            }
-            catch (System.Exception ex)
-            {
-                await Slogger<SignupController>.Error("Signup", ex.ToString());
-                return BadRequest("Failed to create an account.");
-            }
-        }
-
-        string PlatformFromUserAgent(string userAgent)
-        {
-            return userAgent.Contains("okhttp/") ? "android" : userAgent.Contains("Darwin/") || userAgent.Contains("CFNetwork/") ? "ios" : "web";
-        }
-    }
-}
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using AspNetCore.Identity.Mongo.Model;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Streetwriters.Common;
+using Streetwriters.Common.Enums;
+using Streetwriters.Common.Models;
+using Streetwriters.Identity.Enums;
+using Streetwriters.Identity.Interfaces;
+using Streetwriters.Identity.Models;
+using Streetwriters.Identity.Services;
+
+namespace Streetwriters.Identity.Controllers
+{
+    [ApiController]
+    [Route("signup")]
+    public class SignupController : IdentityControllerBase
+    {
+        public SignupController(UserManager<User> _userManager, IEmailSender _emailSender,
+        SignInManager<User> _signInManager, RoleManager<MongoRole> _roleManager, IMFAService _mfaService) : base(_userManager, _emailSender, _signInManager, _roleManager, _mfaService)
+        { }
+
+        private async Task AddClientRoleAsync(string clientId)
+        {
+            if (await RoleManager.FindByNameAsync(clientId) == null)
+                await RoleManager.CreateAsync(new MongoRole(clientId));
+        }
+
+        [HttpPost]
+        [AllowAnonymous]
+        public async Task<IActionResult> Signup([FromForm] SignupForm form)
+        {
+            if (Constants.DISABLE_ACCOUNT_CREATION)
+                return BadRequest(new string[] { "Creating new accounts is not allowed." });
+            try
+            {
+                var client = Clients.FindClientById(form.ClientId);
+                if (client == null) return BadRequest(new string[] { "Invalid client id." });
+
+                await AddClientRoleAsync(client.Id);
+
+                // email addresses must be case-insensitive
+                form.Email = form.Email.ToLowerInvariant();
+                form.Username = form.Username?.ToLowerInvariant();
+
+                if (!await EmailAddressValidator.IsEmailAddressValidAsync(form.Email)) return BadRequest(new string[] { "Invalid email address." });
+
+                var result = await UserManager.CreateAsync(new User
+                {
+                    Email = form.Email,
+                    EmailConfirmed = Constants.IS_SELF_HOSTED,
+                    UserName = form.Username ?? form.Email,
+                }, form.Password);
+
+                if (result.Errors.Any((e) => e.Code == "DuplicateEmail"))
+                {
+                    var user = await UserManager.FindByEmailAsync(form.Email);
+
+                    if (!await UserManager.IsInRoleAsync(user, client.Id))
+                    {
+                        if (!await UserManager.CheckPasswordAsync(user, form.Password))
+                        {
+                            // TODO
+                            await UserManager.RemovePasswordAsync(user);
+                            await UserManager.AddPasswordAsync(user, form.Password);
+                        }
+                        await MFAService.DisableMFAAsync(user);
+                        await UserManager.AddToRoleAsync(user, client.Id);
+                    }
+                    else
+                    {
+                        return BadRequest(new string[] { "Invalid email address.." });
+                    }
+
+                    return Ok(new
+                    {
+                        userId = user.Id.ToString()
+                    });
+                }
+
+                if (result.Succeeded)
+                {
+                    var user = await UserManager.FindByEmailAsync(form.Email);
+                    await UserManager.AddToRoleAsync(user, client.Id);
+                    if (Constants.IS_SELF_HOSTED)
+                    {
+                        await UserManager.AddClaimAsync(user, UserService.SubscriptionTypeToClaim(client.Id, Common.Enums.SubscriptionType.PREMIUM));
+                    }
+                    else
+                    {
+                        await UserManager.AddClaimAsync(user, new Claim("platform", PlatformFromUserAgent(base.HttpContext.Request.Headers.UserAgent)));
+                        var code = await UserManager.GenerateEmailConfirmationTokenAsync(user);
+                        var callbackUrl = Url.TokenLink(user.Id.ToString(), code, client.Id, TokenType.CONFRIM_EMAIL);
+                        await EmailSender.SendConfirmationEmailAsync(user.Email, callbackUrl, client);
+                    }
+                    return Ok(new
+                    {
+                        userId = user.Id.ToString()
+                    });
+                }
+
+                return BadRequest(result.Errors.ToErrors());
+            }
+            catch (System.Exception ex)
+            {
+                await Slogger<SignupController>.Error("Signup", ex.ToString());
+                return BadRequest("Failed to create an account.");
+            }
+        }
+
+        string PlatformFromUserAgent(string userAgent)
+        {
+            return userAgent.Contains("okhttp/") ? "android" : userAgent.Contains("Darwin/") || userAgent.Contains("CFNetwork/") ? "ios" : "web";
+        }
+    }
+}

Streetwriters.Identity/Extensions/UrlExtensions.cs

@@ -1,48 +1,49 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Threading.Tasks;
-using Streetwriters.Common;
-using Streetwriters.Identity.Controllers;
-using Streetwriters.Identity.Enums;
-
-namespace Microsoft.AspNetCore.Mvc
-{
-    public static class UrlHelperExtensions
-    {
-        public static string TokenLink(this IUrlHelper urlHelper, string userId, string code, string clientId, TokenType type, string scheme)
-        {
-
-            return urlHelper.ActionLink(
-#if DEBUG
-            host: $"{Servers.IdentityServer.Hostname}:{Servers.IdentityServer.Port}",
-#else
-            host: Servers.IdentityServer.Domain,  
-#endif
-            action: nameof(AccountController.ConfirmToken),
-            controller: "Account",
-            values: new { userId, code, clientId, type },
-            protocol: scheme);
-
-        }
-    }
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Streetwriters.Common;
+using Streetwriters.Identity.Controllers;
+using Streetwriters.Identity.Enums;
+
+namespace Microsoft.AspNetCore.Mvc
+{
+    public static class UrlHelperExtensions
+    {
+        public static string TokenLink(this IUrlHelper urlHelper, string userId, string code, string clientId, TokenType type)
+        {
+
+            return urlHelper.ActionLink(
+#if DEBUG
+            host: $"{Servers.IdentityServer.Hostname}:{Servers.IdentityServer.Port}",
+            protocol: "http",
+#else
+            host: Servers.IdentityServer.PublicURL.Host,
+            protocol: Servers.IdentityServer.PublicURL.Scheme,
+#endif
+            action: nameof(AccountController.ConfirmToken),
+            controller: "Account",
+            values: new { userId, code, clientId, type });
+
+        }
+    }
 }

Streetwriters.Identity/Helpers/PasswordHelper.cs

@@ -1,38 +1,40 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System;
-using System.Text;
-using Sodium;
-
-namespace Streetwriters.Identity.Helpers
-{
-    internal class PasswordHelper
-    {
-        public static bool VerifyPassword(string password, string hash)
-        {
-            return PasswordHash.ArgonHashStringVerify(hash, password);
-        }
-
-        public static string CreatePasswordHash(string password)
-        {
-            return PasswordHash.ArgonHashString(password, 3, 65536);
-        }
-    }
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+using System.Text;
+using Geralt;
+
+namespace Streetwriters.Identity.Helpers
+{
+    internal class PasswordHelper
+    {
+        public static bool VerifyPassword(string password, string hash)
+        {
+            return Argon2id.VerifyHash(Encoding.UTF8.GetBytes(hash), Encoding.UTF8.GetBytes(password));
+        }
+
+        public static string CreatePasswordHash(string password)
+        {
+            Span<byte> hash = new(new byte[128]);
+            Argon2id.ComputeHash(hash, Encoding.UTF8.GetBytes(password), 3, 65536);
+            return Encoding.UTF8.GetString(hash);
+        }
+    }
 }

Streetwriters.Identity/Services/PasswordHasher.cs

@@ -1,47 +1,43 @@
-/*
-This file is part of the Notesnook Sync Server project (https://notesnook.com/)
-
-Copyright (C) 2023 Streetwriters (Private) Limited
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the Affero GNU General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-Affero GNU General Public License for more details.
-
-You should have received a copy of the Affero GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-using System;
-using Microsoft.AspNetCore.Identity;
-using Streetwriters.Common.Models;
-using Streetwriters.Identity.Helpers;
-
-namespace Streetwriters.Identity.Services
-{
-    public class Argon2PasswordHasher<TUser> : IPasswordHasher<TUser> where TUser : User
-    {
-        public string HashPassword(TUser user, string password)
-        {
-            if (password == null)
-                throw new ArgumentNullException(nameof(password));
-
-            return PasswordHelper.CreatePasswordHash(password);
-        }
-
-        public PasswordVerificationResult VerifyHashedPassword(TUser user, string hashedPassword, string providedPassword)
-        {
-            if (hashedPassword == null)
-                throw new ArgumentNullException(nameof(hashedPassword));
-            if (providedPassword == null)
-                throw new ArgumentNullException(nameof(providedPassword));
-
-            return PasswordHelper.VerifyPassword(providedPassword, hashedPassword) ? PasswordVerificationResult.Success : PasswordVerificationResult.Failed;
-        }
-    }
+/*
+This file is part of the Notesnook Sync Server project (https://notesnook.com/)
+
+Copyright (C) 2023 Streetwriters (Private) Limited
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the Affero GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+Affero GNU General Public License for more details.
+
+You should have received a copy of the Affero GNU General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+using Microsoft.AspNetCore.Identity;
+using Streetwriters.Common.Models;
+using Streetwriters.Identity.Helpers;
+
+namespace Streetwriters.Identity.Services
+{
+    public class Argon2PasswordHasher<TUser> : IPasswordHasher<TUser> where TUser : User
+    {
+        public string HashPassword(TUser user, string password)
+        {
+            ArgumentNullException.ThrowIfNullOrEmpty(password, nameof(password));
+            return PasswordHelper.CreatePasswordHash(password);
+        }
+
+        public PasswordVerificationResult VerifyHashedPassword(TUser user, string hashedPassword, string providedPassword)
+        {
+            ArgumentNullException.ThrowIfNullOrEmpty(hashedPassword, nameof(hashedPassword));
+            ArgumentNullException.ThrowIfNullOrEmpty(providedPassword, nameof(providedPassword));
+
+            return PasswordHelper.VerifyPassword(providedPassword, hashedPassword) ? PasswordVerificationResult.Success : PasswordVerificationResult.Failed;
+        }
+    }
 }

Streetwriters.Identity/Streetwriters.Identity.csproj

@@ -1,43 +1,43 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-
-  <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
-    <StartupObject>Streetwriters.Identity.Program</StartupObject>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="DotNetEnv" Version="2.3.0" />
-    <PackageReference Include="IdentityServer4" Version="4.1.2" />
-    <PackageReference Include="MailKit" Version="3.4.3" />
-    <PackageReference Include="MessageBird" Version="3.2.0" />
-    <PackageReference Include="Ng.UserAgentService" Version="1.1.2" />
-    <PackageReference Include="Quartz" Version="3.5.0" />
-    <PackageReference Include="Quartz.AspNetCore" Version="3.5.0" />
-    <PackageReference Include="Scriban" Version="5.5.1" />
-    <PackageReference Include="SendGrid" Version="9.24.4" />
-    <PackageReference Include="Serilog.AspNetCore" Version="3.4.0" />
-    <PackageReference Include="Sodium.Core" Version="1.2.3" />
-    <PackageReference Include="IdentityServer4.Contrib.MongoDB" Version="4.0.0-rc.2" />
-    <PackageReference Include="IdentityServer4.AspNetIdentity" Version="4.1.2" />
-    <PackageReference Include="IdentityServer4.EntityFramework" Version="4.1.2" />
-    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.0" />
-    <PackageReference Include="Streetwriters.IdentityServer4.KeyRack" Version="0.2.0" />
-    <PackageReference Include="Streetwriters.IdentityServer4.KeyRack.DataProtection" Version="0.1.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.0" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="7.0.4" />
-    <PackageReference Include="AspNetCore.Identity.Mongo" Version="8.3.3" />
-    <PackageReference Include="Twilio" Version="6.13.0" />
-    <PackageReference Include="WebMarkupMin.Core" Version="2.13.0" />
-    <PackageReference Include="WebMarkupMin.NUglify" Version="2.12.0" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <Content Include="Templates\**">
-      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
-    </Content>
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\Streetwriters.Common\Streetwriters.Common.csproj" />
-  </ItemGroup>
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <StartupObject>Streetwriters.Identity.Program</StartupObject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="DotNetEnv" Version="2.3.0" />
+    <PackageReference Include="IdentityServer4" Version="4.1.2" />
+    <PackageReference Include="MailKit" Version="3.4.3" />
+    <PackageReference Include="MessageBird" Version="3.2.0" />
+    <PackageReference Include="Ng.UserAgentService" Version="1.1.2" />
+    <PackageReference Include="Quartz" Version="3.5.0" />
+    <PackageReference Include="Quartz.AspNetCore" Version="3.5.0" />
+    <PackageReference Include="Scriban" Version="5.5.1" />
+    <PackageReference Include="SendGrid" Version="9.24.4" />
+    <PackageReference Include="Serilog.AspNetCore" Version="3.4.0" />
+    <PackageReference Include="Geralt" Version="3.1.0" />
+    <PackageReference Include="IdentityServer4.Contrib.MongoDB" Version="4.0.0-rc.2" />
+    <PackageReference Include="IdentityServer4.AspNetIdentity" Version="4.1.2" />
+    <PackageReference Include="IdentityServer4.EntityFramework" Version="4.1.2" />
+    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.0" />
+    <PackageReference Include="Streetwriters.IdentityServer4.KeyRack" Version="0.2.0" />
+    <PackageReference Include="Streetwriters.IdentityServer4.KeyRack.DataProtection" Version="0.1.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.0" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="7.0.4" />
+    <PackageReference Include="AspNetCore.Identity.Mongo" Version="8.3.3" />
+    <PackageReference Include="Twilio" Version="6.13.0" />
+    <PackageReference Include="WebMarkupMin.Core" Version="2.13.0" />
+    <PackageReference Include="WebMarkupMin.NUglify" Version="2.12.0" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Include="Templates\**">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Streetwriters.Common\Streetwriters.Common.csproj" />
+  </ItemGroup>
 </Project>

docker-compose.yml

@@ -1,190 +1,234 @@
-x-server-discovery: &server-discovery
-  NOTESNOOK_SERVER_PORT: 5264
-  NOTESNOOK_SERVER_HOST: notesnook-server
-  IDENTITY_SERVER_PORT: 8264
-  IDENTITY_SERVER_HOST: identity-server
-  SSE_SERVER_PORT: 7264
-  SSE_SERVER_HOST: sse-server
-  SELF_HOSTED: 1
-
-x-env-files: &env-files
-  - .env
-
-services:
-  validate:
-    image: vandot/alpine-bash
-    entrypoint: /bin/bash
-    env_file: *env-files
-    command:
-      - -c
-      - |
-        # List of required environment variables
-        required_vars=(
-          "INSTANCE_NAME"
-          "NOTESNOOK_API_SECRET"
-          "DISABLE_ACCOUNT_CREATION"
-          "SMTP_USERNAME"
-          "SMTP_PASSWORD"
-          "SMTP_HOST"
-          "SMTP_PORT"
-          "IDENTITY_SERVER_DOMAIN"
-          "NOTESNOOK_APP_HOST"
-        )
-
-        # Check each required environment variable
-        for var in "$${required_vars[@]}"; do
-          if [ -z "$${!var}" ]; then
-            echo "Error: Required environment variable $$var is not set."
-            exit 1
-          fi
-        done
-
-        echo "All required environment variables are set."
-    # Ensure the validate service runs first
-    restart: "no"
-
-  notesnook-db:
-    image: mongo:7.0.12
-    networks:
-      - notesnook
-    command: --replSet rs0 --bind_ip_all
-    depends_on:
-      validate:
-        condition: service_completed_successfully
-  # the notesnook sync server requires transactions which only work
-  # with a MongoDB replica set.
-  # This job just runs `rs.initiate()` on our mongodb instance
-  # upgrading it to a replica set. This is only required once but we running
-  # it multiple times is no issue.
-  initiate-rs0:
-    image: mongo:7.0.12
-    networks:
-      - notesnook
-    depends_on:
-      - notesnook-db
-    entrypoint: /bin/sh
-    command:
-      - -c
-      - |
-        mongosh mongodb://notesnook-db:27017 <<EOF
-          rs.initiate();
-          rs.status();
-        EOF
-
-  notesnook-s3:
-    image: minio/minio:RELEASE.2024-07-29T22-14-52Z
-    ports:
-      - 9000:9000
-    networks:
-      - notesnook
-    volumes:
-      - ${HOME}/.notesnook/s3:/data/s3
-    environment:
-      MINIO_BROWSER: "on"
-    depends_on:
-      validate:
-        condition: service_completed_successfully
-    env_file: *env-files
-    command: server /data/s3 --console-address :9090
-
-  # There's no way to specify a default bucket in Minio so we have to
-  # set it up ourselves.
-  setup-s3:
-    image: minio/mc:RELEASE.2024-07-26T13-08-44Z
-    depends_on:
-      - notesnook-s3
-    networks:
-      - notesnook
-    entrypoint: /bin/bash
-    env_file: *env-files
-    command:
-      - -c
-      - |
-        until mc alias set minio http://notesnook-s3:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-minioadmin}; do
-          sleep 1;
-        done;
-        mc mb minio/attachments -p
-
-  identity-server:
-    image: streetwriters/identity:latest
-    ports:
-      - 8264:8264
-    networks:
-      - notesnook
-    env_file: *env-files
-    depends_on:
-      - notesnook-db
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:8264/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      <<: *server-discovery
-      MONGODB_CONNECTION_STRING: mongodb://notesnook-db:27017/identity?replSet=rs0
-      MONGODB_DATABASE_NAME: identity
-
-  notesnook-server:
-    image: streetwriters/notesnook-sync:latest
-    ports:
-      - 5264:5264
-    networks:
-      - notesnook
-    env_file: *env-files
-    depends_on:
-      - notesnook-s3
-      - setup-s3
-      - identity-server
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:5264/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      <<: *server-discovery
-      MONGODB_CONNECTION_STRING: mongodb://notesnook-db:27017/?replSet=rs0
-      MONGODB_DATABASE_NAME: notesnook
-      S3_INTERNAL_SERVICE_URL: "${S3_SERVICE_URL:-http://notesnook-s3:9000}"
-      S3_INTERNAL_BUCKET_NAME: "attachments"
-      S3_ACCESS_KEY_ID: "${MINIO_ROOT_USER:-minioadmin}"
-      S3_ACCESS_KEY: "${MINIO_ROOT_PASSWORD:-minioadmin}"
-      S3_SERVICE_URL: "${S3_SERVICE_URL:-http://localhost:9000}"
-      S3_REGION: "us-east-1"
-      S3_BUCKET_NAME: "attachments"
-
-  sse-server:
-    image: streetwriters/sse:latest
-    ports:
-      - 7264:7264
-    env_file: *env-files
-    depends_on:
-      - identity-server
-      - notesnook-server
-    networks:
-      - notesnook
-    healthcheck:
-      test: wget --tries=1 -nv -q  http://localhost:7264/health -O- || exit 1
-      interval: 40s
-      timeout: 30s
-      retries: 3
-      start_period: 60s
-    environment:
-      <<: *server-discovery
-
-  autoheal:
-    image: willfarrell/autoheal:latest
-    tty: true
-    restart: always
-    environment:
-      - AUTOHEAL_INTERVAL=60
-      - AUTOHEAL_START_PERIOD=300
-      - AUTOHEAL_DEFAULT_STOP_TIMEOUT=10
-    depends_on:
-      validate:
-        condition: service_completed_successfully
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-networks:
-  notesnook:
+x-server-discovery: &server-discovery
+  NOTESNOOK_SERVER_PORT: 5264
+  NOTESNOOK_SERVER_HOST: notesnook-server
+  IDENTITY_SERVER_PORT: 8264
+  IDENTITY_SERVER_HOST: identity-server
+  SSE_SERVER_PORT: 7264
+  SSE_SERVER_HOST: sse-server
+  SELF_HOSTED: 1
+  IDENTITY_SERVER_URL: ${AUTH_SERVER_PUBLIC_URL}
+  NOTESNOOK_APP_HOST: ${NOTESNOOK_APP_PUBLIC_URL}
+
+x-env-files: &env-files
+  - .env
+
+services:
+  validate:
+    image: vandot/alpine-bash
+    entrypoint: /bin/bash
+    env_file: *env-files
+    command:
+      - -c
+      - |
+        # List of required environment variables
+        required_vars=(
+          "INSTANCE_NAME"
+          "NOTESNOOK_API_SECRET"
+          "DISABLE_ACCOUNT_CREATION"
+          "SMTP_USERNAME"
+          "SMTP_PASSWORD"
+          "SMTP_HOST"
+          "SMTP_PORT"
+          "AUTH_SERVER_PUBLIC_URL"
+          "NOTESNOOK_APP_PUBLIC_URL"
+          "MONOGRAPH_PUBLIC_URL"
+          "ATTACHMENTS_SERVER_PUBLIC_URL"
+        )
+
+        # Check each required environment variable
+        for var in "$${required_vars[@]}"; do
+          if [ -z "$${!var}" ]; then
+            echo "Error: Required environment variable $$var is not set."
+            exit 1
+          fi
+        done
+
+        echo "All required environment variables are set."
+    # Ensure the validate service runs first
+    restart: "no"
+
+  notesnook-db:
+    image: mongo:7.0.12
+    hostname: notesnook-db
+    volumes:
+      - dbdata:/data/db
+      - dbdata:/data/configdb
+    networks:
+      - notesnook
+    command: --replSet rs0 --bind_ip_all
+    depends_on:
+      validate:
+        condition: service_completed_successfully
+    healthcheck:
+      test: echo 'db.runCommand("ping").ok' | mongosh mongodb://localhost:27017 --quiet
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+  # the notesnook sync server requires transactions which only work
+  # with a MongoDB replica set.
+  # This job just runs `rs.initiate()` on our mongodb instance
+  # upgrading it to a replica set. This is only required once but we running
+  # it multiple times is no issue.
+  initiate-rs0:
+    image: mongo:7.0.12
+    networks:
+      - notesnook
+    depends_on:
+      - notesnook-db
+    entrypoint: /bin/sh
+    command:
+      - -c
+      - |
+        mongosh mongodb://notesnook-db:27017 <<EOF
+          rs.initiate();
+          rs.status();
+        EOF
+
+  notesnook-s3:
+    image: minio/minio:RELEASE.2024-07-29T22-14-52Z
+    ports:
+      - 9000:9000
+    networks:
+      - notesnook
+    volumes:
+      - s3data:/data/s3
+    environment:
+      MINIO_BROWSER: "on"
+    depends_on:
+      validate:
+        condition: service_completed_successfully
+    env_file: *env-files
+    command: server /data/s3 --console-address :9090
+    healthcheck:
+      test: timeout 5s bash -c ':> /dev/tcp/127.0.0.1/9000' || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+
+  # There's no way to specify a default bucket in Minio so we have to
+  # set it up ourselves.
+  setup-s3:
+    image: minio/mc:RELEASE.2024-07-26T13-08-44Z
+    depends_on:
+      - notesnook-s3
+    networks:
+      - notesnook
+    entrypoint: /bin/bash
+    env_file: *env-files
+    command:
+      - -c
+      - |
+        until mc alias set minio http://notesnook-s3:9000 ${MINIO_ROOT_USER:-minioadmin} ${MINIO_ROOT_PASSWORD:-minioadmin}; do
+          sleep 1;
+        done;
+        mc mb minio/attachments -p
+
+  identity-server:
+    image: streetwriters/identity:latest
+    ports:
+      - 8264:8264
+    networks:
+      - notesnook
+    env_file: *env-files
+    depends_on:
+      - notesnook-db
+    healthcheck:
+      test: wget --tries=1 -nv -q  http://localhost:8264/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      <<: *server-discovery
+      MONGODB_CONNECTION_STRING: mongodb://notesnook-db:27017/identity?replSet=rs0
+      MONGODB_DATABASE_NAME: identity
+
+  notesnook-server:
+    image: streetwriters/notesnook-sync:latest
+    ports:
+      - 5264:5264
+    networks:
+      - notesnook
+    env_file: *env-files
+    depends_on:
+      - notesnook-s3
+      - setup-s3
+      - identity-server
+    healthcheck:
+      test: wget --tries=1 -nv -q  http://localhost:5264/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      <<: *server-discovery
+      MONGODB_CONNECTION_STRING: mongodb://notesnook-db:27017/?replSet=rs0
+      MONGODB_DATABASE_NAME: notesnook
+      S3_INTERNAL_SERVICE_URL: "http://notesnook-s3:9000"
+      S3_INTERNAL_BUCKET_NAME: "attachments"
+      S3_ACCESS_KEY_ID: "${MINIO_ROOT_USER:-minioadmin}"
+      S3_ACCESS_KEY: "${MINIO_ROOT_PASSWORD:-minioadmin}"
+      S3_SERVICE_URL: "${ATTACHMENTS_SERVER_PUBLIC_URL}"
+      S3_REGION: "us-east-1"
+      S3_BUCKET_NAME: "attachments"
+
+  sse-server:
+    image: streetwriters/sse:latest
+    ports:
+      - 7264:7264
+    env_file: *env-files
+    depends_on:
+      - identity-server
+      - notesnook-server
+    networks:
+      - notesnook
+    healthcheck:
+      test: wget --tries=1 -nv -q  http://localhost:7264/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      <<: *server-discovery
+
+  monograph-server:
+    image: streetwriters/monograph:latest
+    ports:
+      - 6264:3000
+    env_file: *env-files
+    depends_on:
+      - notesnook-server
+    networks:
+      - notesnook
+    healthcheck:
+      test: wget --tries=1 -nv -q  http://localhost:3000/api/health -O- || exit 1
+      interval: 40s
+      timeout: 30s
+      retries: 3
+      start_period: 60s
+    environment:
+      <<: *server-discovery
+      API_HOST: http://notesnook-server:5264
+      PUBLIC_URL: ${MONOGRAPH_PUBLIC_URL}
+
+  autoheal:
+    image: willfarrell/autoheal:latest
+    tty: true
+    restart: always
+    environment:
+      - AUTOHEAL_INTERVAL=60
+      - AUTOHEAL_START_PERIOD=300
+      - AUTOHEAL_DEFAULT_STOP_TIMEOUT=10
+    depends_on:
+      validate:
+        condition: service_completed_successfully
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+networks:
+  notesnook:
+
+volumes:
+  dbdata:
+  s3data: