Patch 3.13.1

.github/workflows/automated_tests.yml

@@ -32,6 +32,7 @@ jobs:
       JWT_RESET_SECRET: ${{secrets.JWT_RESET_SECRET}}
       JWT_SCHEDULER_SECRET: ${{secrets.JWT_SCHEDULER_SECRET}}
       JWT_SECRET: ${{secrets.JWT_SECRET}}
+      JWT_DASHBOARD_SECRET: Dashboard_tickets_get_their_own_secret
       TEST_USER: ${{secrets.TEST_USER}}
       TEST_USER_ID: ${{secrets.TEST_USER_ID}}
     steps:

packages/api/.env.default

@@ -22,6 +22,11 @@ JWT_INVITE_SECRET=Any_arbitrary_string_will_do
 JWT_RESET_SECRET=Production_is_secured_with_a_long_random_string
 JWT_FARM_SECRET=Here_we_can_use_friendly_explanations
 JWT_SCHEDULER_SECRET=Another_token_was_needed_for_the_scheduler
+JWT_DASHBOARD_SECRET=Dashboard_tickets_get_their_own_secret
+
+# Comma-separated exact addresses an Analytics Dashboard ticket may be returned to.
+# Contact the Analytics Dashboard team for the value for your environment.
+DASHBOARD_ALLOWED_RETURN_TO=?
 
 # Create your own (free in most cases) Google API key at https://console.cloud.google.com/apis/dashboard
 # (Optional) We use google-maps-services-js package so API services on this key can be restricted to APIs listed here: 

packages/api/db/migration/20260806000000_add_dashboard_ticket_use.js

@@ -0,0 +1,33 @@
+/*
+ *  Copyright 2026 LiteFarm.org
+ *  This file is part of LiteFarm.
+ *
+ *  LiteFarm is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  LiteFarm is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+export const up = async function (knex) {
+  await knex.schema.createTable('dashboard_ticket_use', (table) => {
+    table.text('jti').primary();
+    table.timestamp('used_at').notNullable().defaultTo(knex.fn.now());
+  });
+};
+
+/**
+ * @param { import("knex").Knex } knex
+ * @returns { Promise<void> }
+ */
+export const down = async function (knex) {
+  await knex.schema.dropTable('dashboard_ticket_use');
+};

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litefarm-api",
-  "version": "3.13.0",
+  "version": "3.13.1",
   "description": "LiteFarm API server",
   "main": "./api/src/server.js",
   "type": "module",

packages/api/src/controllers/loginController.js

@@ -24,6 +24,9 @@ import parser from 'ua-parser-js';
 import UserLogModel from '../models/userLogModel.js';
 import EmailModel from '../models/emailTokenModel.js';
 import { createToken } from '../util/jwt.js';
+import { randomUUID } from 'crypto';
+import jwt from 'jsonwebtoken';
+import knex from '../util/knex.js';
 
 const loginController = {
   authenticateUser() {
@@ -39,14 +42,7 @@ const loginController = {
       const ua = parser(req.headers['user-agent']);
       const languages = req.acceptsLanguages();
       let userID;
-
-      let ip = req.headers['x-forwarded-for'];
-      if (ip) {
-        const list = ip.split(',');
-        ip = list[list.length - 1];
-      } else {
-        ip = req.connection.remoteAddress;
-      }
+      const { ip } = req;
 
       try {
         const userData = await UserModel.query().select('*').where('email', email).first();
@@ -242,6 +238,120 @@ const loginController = {
       }
     };
   },
+
+  dashboardIssueTicket() {
+    return async (req, res) => {
+      try {
+        const { user_id } = req.auth;
+        const { return_to, farm_id } = req.body;
+
+        const allowedReturnAddresses = (process.env.DASHBOARD_ALLOWED_RETURN_TO ?? '')
+          .split(',')
+          .map((address) => address.trim())
+          // Without this, an unset variable produces [''] and return_to: '' is allowed
+          .filter(Boolean);
+
+        // Exact string match: a prefix, suffix or substring of an allowed address is not a match.
+        if (!allowedReturnAddresses.includes(return_to)) {
+          return res.status(400).send({ message: 'return_to is not an allowed address.' });
+        }
+
+        if (farm_id) {
+          const userFarm = await UserFarmModel.query()
+            .where({ user_id, farm_id, status: 'Active' })
+            .first();
+          if (!userFarm) {
+            return res.sendStatus(403);
+          }
+        }
+
+        const ticket = await createToken('dashboard', {
+          user_id,
+          farm_id: farm_id ?? null,
+          jti: randomUUID(),
+        });
+
+        return res.status(200).send({ ticket, return_to });
+      } catch (error) {
+        console.error(error);
+        return res.status(500).json({ error });
+      }
+    };
+  },
+
+  dashboardExchange() {
+    return async (req, res) => {
+      try {
+        const { ticket } = req.body;
+
+        if (!ticket) {
+          return res.status(400).send({ message: 'ticket is required.' });
+        }
+
+        let payload;
+        try {
+          payload = jwt.verify(ticket, process.env.JWT_DASHBOARD_SECRET, {
+            algorithms: ['HS256'],
+          });
+        } catch (_verificationError) {
+          return res.sendStatus(401);
+        }
+
+        const { jti, user_id, farm_id } = payload;
+        if (!jti || !user_id) {
+          return res.sendStatus(401);
+        }
+
+        const claimSucceeded = await knex.transaction(async (trx) => {
+          await trx('dashboard_ticket_use')
+            .whereRaw("used_at < now() - interval '5 minutes'")
+            .del();
+
+          const inserted = await trx('dashboard_ticket_use')
+            .insert({ jti })
+            .onConflict('jti')
+            .ignore()
+            .returning('jti');
+
+          // False when this ticket has already been exchanged
+          return inserted.length > 0;
+        });
+
+        if (!claimSucceeded) {
+          return res.sendStatus(401);
+        }
+
+        const user = await UserModel.query()
+          .select('user_id', 'email', 'first_name')
+          .findById(user_id);
+        if (!user) {
+          return res.sendStatus(401);
+        }
+
+        const farms = await UserFarmModel.query()
+          .select('userFarm.farm_id', 'farm.farm_name', 'userFarm.role_id')
+          .join('farm', 'userFarm.farm_id', 'farm.farm_id')
+          .where('userFarm.user_id', user_id)
+          .andWhere('userFarm.status', 'Active')
+          .andWhere('farm.deleted', false);
+
+        if (farm_id && !farms.some((farm) => farm.farm_id === farm_id)) {
+          return res.sendStatus(401);
+        }
+
+        return res.status(200).send({
+          user_id: user.user_id,
+          email: user.email,
+          first_name: user.first_name,
+          farm_id: farm_id ?? null,
+          farms,
+        });
+      } catch (error) {
+        console.error(error);
+        return res.status(500).json({ error });
+      }
+    };
+  },
 };
 
 async function sendMissingInvitations(user) {

packages/api/src/controllers/userLogController.js

@@ -23,7 +23,7 @@ const userLogController = {
       const { user_id } = req.auth;
       const { screen_width, screen_height, farm_id } = req.body;
       try {
-        const ip = req.headers['x-forwarded-for']?.split(',').shift() || req.socket?.remoteAddress;
+        const { ip } = req;
         const ua = parser(req.headers['user-agent']);
         const languages = req.acceptsLanguages();
         await UserLogModel.query().insert({

packages/api/src/routes/loginRoute.js

@@ -2,9 +2,14 @@ import express from 'express';
 const router = express.Router();
 import loginController from '../controllers/loginController.js';
 import checkGoogleJwt from '../middleware/acl/checkGoogleJwt.js';
+import checkJwt from '../middleware/acl/checkJwt.js';
 
 router.post('/google', checkGoogleJwt, loginController.loginWithGoogle());
 router.post('/', loginController.authenticateUser());
 router.get('/user/:email', loginController.getUserNameByUserEmail());
+// This router is mounted before the global checkJwt in server.ts,
+// so the middleware is attached here to make the endpoint require a login token
+router.post('/dashboard/ticket', checkJwt, loginController.dashboardIssueTicket());
+router.post('/dashboard/exchange', loginController.dashboardExchange());
 
 export default router;

packages/api/src/routes/userFarmRoute.js

@@ -25,8 +25,7 @@ import checkInvitationTokenContent from '../middleware/acl/checkInviteTokenConte
 import checkUserFarmStatus from '../middleware/acl/checkUserFarmStatus.js';
 
 // Get all userFarms for a specified user
-// no permission limits
-router.get('/user/:user_id', userFarmController.getUserFarmByUserID());
+router.get('/user/:user_id', isSelf, userFarmController.getUserFarmByUserID());
 
 // Get info on all users (userFarm) at a farm
 router.get(

packages/api/src/server.ts

@@ -31,7 +31,7 @@ if (process.env.SENTRY_DSN && environment !== 'development') {
       // Automatically instrument Node.js libraries and frameworks
       ...Sentry.autoDiscoverNodePerformanceMonitoringIntegrations(),
     ],
-    release: '3.13.0',
+    release: '3.13.1',
     // Set tracesSampleRate to 1.0 to capture 100%
     // of transactions for performance monitoring.
     // We recommend adjusting this value in production
@@ -275,6 +275,10 @@ app
   .use(express.urlencoded({ extended: true }))
   .disable('x-powered-by')
 
+  // https://expressjs.com/en/guide/behind-proxies/
+  // 1: trust exactly one hop (nginx) so a client-supplied X-Forwarded-For entry can't spoof req.ip
+  .set('trust proxy', 1)
+
   // prevent CORS errors
   .use(cors())
   .use((req, res, next) => {

packages/api/src/util/jwt.js

@@ -3,20 +3,23 @@ import jwt from 'jsonwebtoken';
 const ACCESS_TOKEN_EXPIRES_IN = '7d';
 const RESET_PASSWORD_TOKEN_EXPIRES_IN = '1d';
 const SCHEDULER_TOKEN_EXPIRES_IN = '1d';
+const DASHBOARD_TICKET_EXPIRES_IN = '30s';
 
 const tokenType = {
   access: process.env.JWT_SECRET,
   invite: process.env.JWT_INVITE_SECRET,
   passwordReset: process.env.JWT_RESET_SECRET,
   farm: process.env.JWT_FARM_SECRET,
   scheduler: process.env.JWT_SCHEDULER_SECRET,
+  dashboard: process.env.JWT_DASHBOARD_SECRET,
 };
 const expireTime = {
   access: ACCESS_TOKEN_EXPIRES_IN,
   invite: ACCESS_TOKEN_EXPIRES_IN,
   passwordReset: RESET_PASSWORD_TOKEN_EXPIRES_IN,
   farm: ACCESS_TOKEN_EXPIRES_IN,
   scheduler: SCHEDULER_TOKEN_EXPIRES_IN,
+  dashboard: DASHBOARD_TICKET_EXPIRES_IN,
 };
 
 function createToken(type, payload) {