@1auth/authn 0.0.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 will Farrell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/index.js

@@ -0,0 +1,166 @@
+import { setTimeout } from 'node:timers/promises'
+import { randomId, makeSymetricKey } from '@1auth/crypto'
+
+export const options = {
+  store: undefined,
+  notify: undefined,
+  table: 'credentials',
+  authenticationDuration: 500, // min duration authentication should take (ms)
+  usernameExists: [] // hooks to allow what to be used as a username
+}
+export default (params) => {
+  Object.assign(options, params)
+}
+
+export const create = async (
+  credentialType,
+  { id, sub, value, ...rest },
+  parentOptions
+) => {
+  const now = nowInSeconds()
+  id ??= await randomId.create()
+  const type = parentOptions.id + '-' + parentOptions[credentialType].type
+  const otp = parentOptions[credentialType].otp
+  const expire = parentOptions[credentialType].expire
+    ? now + parentOptions[credentialType].expire
+    : null
+  const { encryptedKey } = makeSymetricKey(sub)
+
+  const encryptedData = await parentOptions[credentialType].encode(
+    value,
+    encryptedKey,
+    sub
+  )
+  return parentOptions.store.insert(options.table, {
+    expire,
+    ...rest,
+    id,
+    sub,
+    type,
+    otp,
+    encryptionKey: encryptedKey,
+    value: encryptedData,
+    create: now,
+    update: now
+  })
+}
+
+export const update = async (
+  credentialType,
+  { id, sub, encryptionKey, value, ...rest },
+  parentOptions
+) => {
+  const now = nowInSeconds()
+  const encryptedData = await parentOptions[credentialType].encode(
+    value,
+    encryptionKey,
+    sub
+  )
+  return parentOptions.store.update(
+    options.table,
+    { id, sub },
+    {
+      ...rest,
+      value: encryptedData,
+      update: now
+    }
+  )
+}
+
+export const subject = async (username) => {
+  return Promise.all(
+    options.usernameExists.map((exists) => exists(username))
+  ).then((identities) => {
+    return identities.filter((lookup) => lookup)?.[0]
+  })
+}
+
+export const authenticate = async (username, secret, parentOptions) => {
+  const timeout = setTimeout(() => {}, options.authenticationDuration)
+  const type = parentOptions.id + '-' + parentOptions.secret.type
+
+  const sub = await subject(username)
+
+  const credentials = await parentOptions.store.selectList(options.table, {
+    sub,
+    type
+  }) // TODO and verify is not null
+  let valid, id, encryptionKey
+  for (const credential of credentials) {
+    let { value, encryptionKey: encryptedKey, ...rest } = credential
+    value = await parentOptions.secret.decode(value, encryptedKey, sub)
+    valid = await parentOptions.secret.verify(secret, value, rest)
+    if (valid) {
+      id ??= credential.id
+      encryptionKey ??= encryptedKey
+      break
+    }
+  }
+
+  if (valid && parentOptions.secret.otp) {
+    await parentOptions.store.remove(options.table, { id, sub })
+  }
+  await timeout
+  if (!valid) throw new Error('401 Unauthorized')
+  return { sub, id, encryptionKey, ...valid }
+}
+
+export const verifySecret = async (sub, id, parentOptions) => {
+  // const type = parentOptions.id + '-' + parentOptions.secret.type
+  await parentOptions.store.update(
+    options.table,
+    { id, sub },
+    { verify: nowInSeconds() }
+  )
+}
+
+export const verify = async (credentialType, sub, token, parentOptions) => {
+  const timeout = setTimeout(() => {}, options.authenticationDuration)
+  const type = parentOptions.id + '-' + parentOptions[credentialType].type
+  let id
+  const credentials = await parentOptions.store.selectList(options.table, {
+    sub,
+    type
+  })
+  // TODO re-confirm when needed
+  // .then((rows) => {
+  //   if (rows.length) {
+  //     return rows
+  //   }
+  //
+  //   return parentOptions.store.select(options.table, { id: sub, type })
+  // })
+
+  let valid
+  for (const credential of credentials) {
+    let { value, encryptionKey, ...rest } = credential
+    value = await parentOptions[credentialType].decode(
+      value,
+      encryptionKey,
+      sub
+    )
+    valid = await parentOptions[credentialType].verify(token, value, rest)
+    if (valid) {
+      id = credential.id
+      break
+    }
+  }
+  if (valid && parentOptions[credentialType].otp) {
+    await parentOptions.store.remove(options.table, { id, sub })
+  }
+  if (!valid) throw new Error('401 Unauthorized')
+  await timeout
+  return { sub, id, ...valid }
+}
+
+export const expire = async (sub, id, parentOptions = options) => {
+  await parentOptions.store.remove(options.table, { id, sub })
+}
+
+// TODO manage onboard state
+
+// TODO save notification settings
+
+// TODO authorize management?
+
+const nowInSeconds = () => Math.floor(Date.now() / 1000)

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@1auth/authn",
+  "version": "0.0.0-alpha.0",
+  "description": "",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "engineStrict": true,
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./index.js",
+  "module": "./index.js",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./index.d.ts",
+        "default": "./index.js"
+      }
+    }
+  },
+  "types": "index.d.ts",
+  "files": [
+    "index.js",
+    "index.d.ts"
+  ],
+  "scripts": {
+    "test": "npm run test:unit",
+    "test:unit": "ava"
+  },
+  "license": "MIT",
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/willfarrell"
+  },
+  "keywords": [],
+  "author": {
+    "name": "1auth contributors",
+    "url": "https://github.com/willfarrell/1auth/graphs/contributors"
+  },
+  "repository": {
+    "type": "git",
+    "url": "github:willfarrell/1auth",
+    "directory": "packages/authn"
+  },
+  "bugs": {
+    "url": "https://github.com/willfarrell/1auth/issues"
+  },
+  "homepage": "https://github.com/willfarrell/1auth",
+  "gitHead": "dcd3cb3dcacdebbe21625f092187e7cf02473f68",
+  "dependencies": {
+    "@1auth/crypto": "0.0.0-alpha.0"
+  }
+}