@appconda/nextjs 1.0.86 → 1.0.88

package/dist/actions/actionClient.js

@@ -21,7 +21,7 @@ export const actionClient = createSafeActionClient({
     },
 });
 export const authenticatedActionClient = actionClient.use(async ({ next }) => {
-    const session = await getServerSession(authOptions);
+    const session = await getServerSession(authOptions());
     if (!session?.user) {
         throw new AuthenticationError("Not authenticated");
     }

package/dist/actions/auth.d.ts

@@ -1 +1 @@
-export declare const auth: () => Promise<import("next-auth").Session>;
+export declare const auth: () => Promise<unknown>;

package/dist/actions/auth.js

@@ -1,5 +1,5 @@
 import { getServerSession } from "next-auth";
 import { authOptions } from "./authOptions";
 export const auth = async () => {
-    return await getServerSession(authOptions);
+    return await getServerSession(authOptions());
 };

package/dist/actions/authOptions.d.ts

@@ -1,6 +1,5 @@
-import type { NextAuthOptions } from "next-auth";
 export declare function signIn({ userName, password }: {
     userName: string;
     password: string;
 }): Promise<import("../modules/account/types").Session>;
-export declare const authOptions: NextAuthOptions;
+export declare const authOptions: () => any;

package/dist/actions/authOptions.js

@@ -2,17 +2,17 @@ import CredentialsProvider from "next-auth/providers/credentials";
 import { cookies } from "next/headers";
 import { getAppcondaClient } from "../getAppcondaClient";
 import { Account } from "../modules/account/service";
-//import { getEnv } from "../lib/env";
+import { getEnv } from "../lib/env";
 import { getSDKForCurrentUser } from "../getSDKForCurrentUser";
 import { Query } from "../query";
-const getEnv = () => {
-    return {
-        APPCONDA_ENDPOINT: 'process.env.APPCONDA_ENDPOINT',
-        APPCONDA_CLIENT_ENDPOINT: 'process.env.APPCONDA_CLIENT_ENDPOINT',
-        _SERVICE_TOKEN: 'process.env._SERVICE_TOKEN',
-        ENTERPRISE_LICENSE_KEY: 'process.env.ENTERPRISE_LICENSE_KEY',
-    };
-};
+/* const getEnv = () => {
+  return {
+    APPCONDA_ENDPOINT: 'process.env.APPCONDA_ENDPOINT',
+    APPCONDA_CLIENT_ENDPOINT: 'process.env.APPCONDA_CLIENT_ENDPOINT',
+    _SERVICE_TOKEN: 'process.env._SERVICE_TOKEN',
+    ENTERPRISE_LICENSE_KEY: 'process.env.ENTERPRISE_LICENSE_KEY',
+  };
+}; */
 export async function signIn({ userName, password }) {
     const adminClient = await getAppcondaClient();
     const account = new Account(adminClient);
@@ -26,200 +26,208 @@ export async function signIn({ userName, password }) {
     });
     return session;
 }
-export const authOptions = {
-    providers: [
-        CredentialsProvider({
-            id: "credentials",
-            // The name to display on the sign in form (e.g. "Sign in with...")
-            name: "Credentials",
-            // The credentials is used to generate a suitable form on the sign in page.
-            // You can specify whatever fields you are expecting to be submitted.
-            // e.g. domain, username, password, 2FA token, etc.
-            // You can pass any HTML attribute to the <input> tag through the object.
-            credentials: {
-                email: {
-                    label: "Email Address",
-                    type: "email",
-                    placeholder: "Your email address",
-                },
-                password: {
-                    label: "Password",
-                    type: "password",
-                    placeholder: "Your password",
+export const authOptions = (() => {
+    let options = null;
+    return () => {
+        if (options == null) {
+            options = {
+                providers: [
+                    CredentialsProvider({
+                        id: "credentials",
+                        // The name to display on the sign in form (e.g. "Sign in with...")
+                        name: "Credentials",
+                        // The credentials is used to generate a suitable form on the sign in page.
+                        // You can specify whatever fields you are expecting to be submitted.
+                        // e.g. domain, username, password, 2FA token, etc.
+                        // You can pass any HTML attribute to the <input> tag through the object.
+                        credentials: {
+                            email: {
+                                label: "Email Address",
+                                type: "email",
+                                placeholder: "Your email address",
+                            },
+                            password: {
+                                label: "Password",
+                                type: "password",
+                                placeholder: "Your password",
+                            },
+                            totpCode: { label: "Two-factor Code", type: "input", placeholder: "Code from authenticator app" },
+                            backupCode: { label: "Backup Code", type: "input", placeholder: "Two-factor backup code" },
+                        },
+                        async authorize(credentials, _req) {
+                            let user;
+                            const appcondaSession = await signIn({ userName: credentials?.email, password: credentials?.password });
+                            console.log(credentials);
+                            /*  try {
+                               user = await prisma.user.findUnique({
+                                 where: {
+                                   email: credentials?.email,
+                                 },
+                               });
+                             } catch (e) {
+                               console.error(e);
+                               throw Error("Internal server error. Please try again later");
+                             }
+                             if (!user || !credentials) {
+                               throw new Error("Invalid credentials");
+                             }
+                             if (!user.password) {
+                               throw new Error("Invalid credentials");
+                             }
+                     
+                             const isValid = await verifyPassword(credentials.password, user.password);
+                     
+                             if (!isValid) {
+                               throw new Error("Invalid credentials");
+                             }
+                     
+                             if (user.twoFactorEnabled && credentials.backupCode) {
+                               if (!ENCRYPTION_KEY) {
+                                 console.error("Missing encryption key; cannot proceed with backup code login.");
+                                 throw new Error("Internal Server Error");
+                               }
+                     
+                               if (!user.backupCodes) throw new Error("No backup codes found");
+                     
+                               const backupCodes = JSON.parse(symmetricDecrypt(user.backupCodes, ENCRYPTION_KEY));
+                     
+                               // check if user-supplied code matches one
+                               const index = backupCodes.indexOf(credentials.backupCode.replaceAll("-", ""));
+                               if (index === -1) throw new Error("Invalid backup code");
+                     
+                               // delete verified backup code and re-encrypt remaining
+                               backupCodes[index] = null;
+                               await prisma.user.update({
+                                 where: {
+                                   id: user.id,
+                                 },
+                                 data: {
+                                   backupCodes: symmetricEncrypt(JSON.stringify(backupCodes), ENCRYPTION_KEY),
+                                 },
+                               });
+                             } else if (user.twoFactorEnabled) {
+                               if (!credentials.totpCode) {
+                                 throw new Error("second factor required");
+                               }
+                     
+                               if (!user.twoFactorSecret) {
+                                 throw new Error("Internal Server Error");
+                               }
+                     
+                               if (!ENCRYPTION_KEY) {
+                                 throw new Error("Internal Server Error");
+                               }
+                     
+                               const secret = symmetricDecrypt(user.twoFactorSecret, ENCRYPTION_KEY);
+                               if (secret.length !== 32) {
+                                 throw new Error("Internal Server Error");
+                               }
+                     
+                               const isValidToken = (await import("./totp")).totpAuthenticatorCheck(credentials.totpCode, secret);
+                               if (!isValidToken) {
+                                 throw new Error("Invalid second factor code");
+                               }
+                             } */
+                            console.log("asafdf");
+                            return {
+                                id: appcondaSession.userId,
+                                email: appcondaSession.providerUid,
+                                emailVerified: true,
+                                imageUrl: "",
+                            };
+                        },
+                    }),
+                    CredentialsProvider({
+                        id: "token",
+                        // The name to display on the sign in form (e.g. "Sign in with...")
+                        name: "Token",
+                        // The credentials is used to generate a suitable form on the sign in page.
+                        // You can specify whatever fields you are expecting to be submitted.
+                        // e.g. domain, username, password, 2FA token, etc.
+                        // You can pass any HTML attribute to the <input> tag through the object.
+                        credentials: {
+                            token: {
+                                label: "Verification Token",
+                                type: "string",
+                            },
+                        },
+                        async authorize(credentials, _req) {
+                            let user;
+                            /*  try {
+                               if (!credentials?.token) {
+                                 throw new Error("Token not found");
+                               }
+                               const { id } = await verifyToken(credentials?.token);
+                               user = await prisma.user.findUnique({
+                                 where: {
+                                   id: id,
+                                 },
+                               });
+                             } catch (e) {
+                               console.error(e);
+                               throw new Error("Either a user does not match the provided token or the token is invalid");
+                             }
+                     
+                             if (!user) {
+                               throw new Error("Either a user does not match the provided token or the token is invalid");
+                             }
+                     
+                             if (user.emailVerified) {
+                               throw new Error("Email already verified");
+                             }
+                     
+                             user = await updateUser(user.id, { emailVerified: new Date() }); */
+                            return user || null;
+                        },
+                    }),
+                    // Conditionally add enterprise SSO providers
+                    ...(getEnv().ENTERPRISE_LICENSE_KEY ? [] : []),
+                ],
+                callbacks: {
+                    async jwt({ token }) {
+                        const { users } = await getSDKForCurrentUser();
+                        const userList = await users.list([Query.equal("email", token.email)]);
+                        const user = userList.users[0] ?? {};
+                        /*  const existingUser = await getUserByEmail(token?.email!);
+                   
+                         if (!existingUser) {
+                           return token;
+                         } */
+                        return {
+                            ...token,
+                            //@ts-ignore
+                            profile: { id: user.$id, ...user },
+                        };
+                    },
+                    async session({ session, token }) {
+                        //@ts-ignore
+                        session.user.id = token?.id;
+                        //@ts-ignore
+                        session.user = token.profile;
+                        return session;
+                    },
+                    //@ts-ignore
+                    async signIn({ user, account }) {
+                        /*   if (account?.provider === "credentials" || account?.provider === "token") {
+                            // check if user's email is verified or not
+                            if (!user.emailVerified && !EMAIL_VERIFICATION_DISABLED) {
+                              throw new Error("Email Verification is Pending");
+                            }
+                            return true;
+                          }
+                          if (ENTERPRISE_LICENSE_KEY) {
+                            return handleSSOCallback({ user, account });
+                          } */
+                        return true;
+                    },
                 },
-                totpCode: { label: "Two-factor Code", type: "input", placeholder: "Code from authenticator app" },
-                backupCode: { label: "Backup Code", type: "input", placeholder: "Two-factor backup code" },
-            },
-            async authorize(credentials, _req) {
-                let user;
-                const appcondaSession = await signIn({ userName: credentials?.email, password: credentials?.password });
-                console.log(credentials);
-                /*  try {
-                   user = await prisma.user.findUnique({
-                     where: {
-                       email: credentials?.email,
-                     },
-                   });
-                 } catch (e) {
-                   console.error(e);
-                   throw Error("Internal server error. Please try again later");
-                 }
-                 if (!user || !credentials) {
-                   throw new Error("Invalid credentials");
-                 }
-                 if (!user.password) {
-                   throw new Error("Invalid credentials");
-                 }
-         
-                 const isValid = await verifyPassword(credentials.password, user.password);
-         
-                 if (!isValid) {
-                   throw new Error("Invalid credentials");
-                 }
-         
-                 if (user.twoFactorEnabled && credentials.backupCode) {
-                   if (!ENCRYPTION_KEY) {
-                     console.error("Missing encryption key; cannot proceed with backup code login.");
-                     throw new Error("Internal Server Error");
-                   }
-         
-                   if (!user.backupCodes) throw new Error("No backup codes found");
-         
-                   const backupCodes = JSON.parse(symmetricDecrypt(user.backupCodes, ENCRYPTION_KEY));
-         
-                   // check if user-supplied code matches one
-                   const index = backupCodes.indexOf(credentials.backupCode.replaceAll("-", ""));
-                   if (index === -1) throw new Error("Invalid backup code");
-         
-                   // delete verified backup code and re-encrypt remaining
-                   backupCodes[index] = null;
-                   await prisma.user.update({
-                     where: {
-                       id: user.id,
-                     },
-                     data: {
-                       backupCodes: symmetricEncrypt(JSON.stringify(backupCodes), ENCRYPTION_KEY),
-                     },
-                   });
-                 } else if (user.twoFactorEnabled) {
-                   if (!credentials.totpCode) {
-                     throw new Error("second factor required");
-                   }
-         
-                   if (!user.twoFactorSecret) {
-                     throw new Error("Internal Server Error");
-                   }
-         
-                   if (!ENCRYPTION_KEY) {
-                     throw new Error("Internal Server Error");
-                   }
-         
-                   const secret = symmetricDecrypt(user.twoFactorSecret, ENCRYPTION_KEY);
-                   if (secret.length !== 32) {
-                     throw new Error("Internal Server Error");
-                   }
-         
-                   const isValidToken = (await import("./totp")).totpAuthenticatorCheck(credentials.totpCode, secret);
-                   if (!isValidToken) {
-                     throw new Error("Invalid second factor code");
-                   }
-                 } */
-                console.log("asafdf");
-                return {
-                    id: appcondaSession.userId,
-                    email: appcondaSession.providerUid,
-                    emailVerified: true,
-                    imageUrl: "",
-                };
-            },
-        }),
-        CredentialsProvider({
-            id: "token",
-            // The name to display on the sign in form (e.g. "Sign in with...")
-            name: "Token",
-            // The credentials is used to generate a suitable form on the sign in page.
-            // You can specify whatever fields you are expecting to be submitted.
-            // e.g. domain, username, password, 2FA token, etc.
-            // You can pass any HTML attribute to the <input> tag through the object.
-            credentials: {
-                token: {
-                    label: "Verification Token",
-                    type: "string",
+                pages: {
+                    signIn: "/auth/login",
+                    signOut: "/auth/logout",
+                    error: "/auth/login", // Error code passed in query string as ?error=
                 },
-            },
-            async authorize(credentials, _req) {
-                let user;
-                /*  try {
-                   if (!credentials?.token) {
-                     throw new Error("Token not found");
-                   }
-                   const { id } = await verifyToken(credentials?.token);
-                   user = await prisma.user.findUnique({
-                     where: {
-                       id: id,
-                     },
-                   });
-                 } catch (e) {
-                   console.error(e);
-                   throw new Error("Either a user does not match the provided token or the token is invalid");
-                 }
-         
-                 if (!user) {
-                   throw new Error("Either a user does not match the provided token or the token is invalid");
-                 }
-         
-                 if (user.emailVerified) {
-                   throw new Error("Email already verified");
-                 }
-         
-                 user = await updateUser(user.id, { emailVerified: new Date() }); */
-                return user || null;
-            },
-        }),
-        // Conditionally add enterprise SSO providers
-        ...(getEnv().ENTERPRISE_LICENSE_KEY ? [] : []),
-    ],
-    callbacks: {
-        async jwt({ token }) {
-            const { users } = await getSDKForCurrentUser();
-            const userList = await users.list([Query.equal("email", token.email)]);
-            const user = userList.users[0] ?? {};
-            /*  const existingUser = await getUserByEmail(token?.email!);
-       
-             if (!existingUser) {
-               return token;
-             } */
-            return {
-                ...token,
-                //@ts-ignore
-                profile: { id: user.$id, ...user },
             };
-        },
-        async session({ session, token }) {
-            //@ts-ignore
-            session.user.id = token?.id;
-            //@ts-ignore
-            session.user = token.profile;
-            return session;
-        },
-        //@ts-ignore
-        async signIn({ user, account }) {
-            /*   if (account?.provider === "credentials" || account?.provider === "token") {
-                // check if user's email is verified or not
-                if (!user.emailVerified && !EMAIL_VERIFICATION_DISABLED) {
-                  throw new Error("Email Verification is Pending");
-                }
-                return true;
-              }
-              if (ENTERPRISE_LICENSE_KEY) {
-                return handleSSOCallback({ user, account });
-              } */
-            return true;
-        },
-    },
-    pages: {
-        signIn: "/auth/login",
-        signOut: "/auth/logout",
-        error: "/auth/login", // Error code passed in query string as ?error=
-    },
-};
+        }
+        return options;
+    };
+})();

package/dist/index.d.ts

@@ -40,3 +40,4 @@ export { getAppcondaClient } from './getAppcondaClient';
 export * from './modules';
 export type { SafeActionFn } from 'next-safe-action';
 export * from './actions';
+export * from './lib';

package/dist/index.js

@@ -37,3 +37,4 @@ export { getSDKForService } from './getSDKForService';
 export { getAppcondaClient } from './getAppcondaClient';
 export * from './modules';
 export * from './actions';
+export * from './lib';

package/dist/lib/crypto.d.ts

@@ -0,0 +1,23 @@
+/**
+ *
+ * @param text Value to be encrypted
+ * @param key Key used to encrypt value must be 32 bytes for AES256 encryption algorithm
+ *
+ * @returns Encrypted value using key
+ */
+export declare const symmetricEncrypt: (text: string, key: string) => string;
+/**
+ *
+ * @param text Value to decrypt
+ * @param key Key used to decrypt value must be 32 bytes for AES256 encryption algorithm
+ */
+export declare const symmetricDecrypt: (text: string, key: string) => string;
+export declare const getHash: (key: string) => string;
+export declare const encryptAES128: (encryptionKey: string, data: string) => string;
+export declare const decryptAES128: (encryptionKey: string, data: string) => string;
+export declare const generateLocalSignedUrl: (fileName: string, environmentId: string, fileType: string) => {
+    signature: string;
+    uuid: string;
+    timestamp: number;
+};
+export declare const validateLocalSignedUrl: (uuid: string, fileName: string, environmentId: string, fileType: string, timestamp: number, signature: string, secret: string) => boolean;

package/dist/lib/crypto.js

@@ -0,0 +1,76 @@
+import crypto from "crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
+import { getEnv } from "./env";
+const ALGORITHM = "aes256";
+const INPUT_ENCODING = "utf8";
+const OUTPUT_ENCODING = "hex";
+const BUFFER_ENCODING = getEnv().ENCRYPTION_KEY.length === 32 ? "latin1" : "hex";
+const IV_LENGTH = 16; // AES blocksize
+/**
+ *
+ * @param text Value to be encrypted
+ * @param key Key used to encrypt value must be 32 bytes for AES256 encryption algorithm
+ *
+ * @returns Encrypted value using key
+ */
+export const symmetricEncrypt = (text, key) => {
+    const _key = Buffer.from(key, BUFFER_ENCODING);
+    const iv = crypto.randomBytes(IV_LENGTH);
+    // @ts-ignore -- the package needs to be built
+    const cipher = crypto.createCipheriv(ALGORITHM, _key, iv);
+    let ciphered = cipher.update(text, INPUT_ENCODING, OUTPUT_ENCODING);
+    ciphered += cipher.final(OUTPUT_ENCODING);
+    const ciphertext = iv.toString(OUTPUT_ENCODING) + ":" + ciphered;
+    return ciphertext;
+};
+/**
+ *
+ * @param text Value to decrypt
+ * @param key Key used to decrypt value must be 32 bytes for AES256 encryption algorithm
+ */
+export const symmetricDecrypt = (text, key) => {
+    const _key = Buffer.from(key, BUFFER_ENCODING);
+    const components = text.split(":");
+    const iv_from_ciphertext = Buffer.from(components.shift() || "", OUTPUT_ENCODING);
+    // @ts-ignore -- the package needs to be built
+    const decipher = crypto.createDecipheriv(ALGORITHM, _key, iv_from_ciphertext);
+    let deciphered = decipher.update(components.join(":"), OUTPUT_ENCODING, INPUT_ENCODING);
+    deciphered += decipher.final(INPUT_ENCODING);
+    return deciphered;
+};
+export const getHash = (key) => createHash("sha256").update(key).digest("hex");
+// create an aes128 encryption function
+export const encryptAES128 = (encryptionKey, data) => {
+    // @ts-ignore -- the package needs to be built
+    const cipher = createCipheriv("aes-128-ecb", Buffer.from(encryptionKey, "base64"), "");
+    let encrypted = cipher.update(data, "utf-8", "hex");
+    encrypted += cipher.final("hex");
+    return encrypted;
+};
+// create an aes128 decryption function
+export const decryptAES128 = (encryptionKey, data) => {
+    // @ts-ignore -- the package needs to be built
+    const cipher = createDecipheriv("aes-128-ecb", Buffer.from(encryptionKey, "base64"), "");
+    let decrypted = cipher.update(data, "hex", "utf-8");
+    decrypted += cipher.final("utf-8");
+    return decrypted;
+};
+export const generateLocalSignedUrl = (fileName, environmentId, fileType) => {
+    const uuid = randomBytes(16).toString("hex");
+    const timestamp = Date.now();
+    const data = `${uuid}:${fileName}:${environmentId}:${fileType}:${timestamp}`;
+    const signature = createHmac("sha256", getEnv().ENCRYPTION_KEY).update(data).digest("hex");
+    return { signature, uuid, timestamp };
+};
+export const validateLocalSignedUrl = (uuid, fileName, environmentId, fileType, timestamp, signature, secret) => {
+    const data = `${uuid}:${fileName}:${environmentId}:${fileType}:${timestamp}`;
+    const expectedSignature = createHmac("sha256", secret).update(data).digest("hex");
+    if (expectedSignature !== signature) {
+        return false;
+    }
+    // valid for 5 minutes
+    if (Date.now() - timestamp > 1000 * 60 * 5) {
+        return false;
+    }
+    return true;
+};

package/dist/lib/env.js

@@ -14,6 +14,8 @@ export const getEnv = (() => {
                     APPCONDA_CLIENT_ENDPOINT: z.string(),
                     _SERVICE_TOKEN: z.string(),
                     ENTERPRISE_LICENSE_KEY: z.string(),
+                    NEXTAUTH_SECRET: z.string().min(1),
+                    ENCRYPTION_KEY: z.string().length(64).or(z.string().length(32)),
                     /* AI_AZURE_LLM_API_KEY: z.string().optional(),
                     AI_AZURE_EMBEDDINGS_DEPLOYMENT_ID: z.string().optional(),
                     AI_AZURE_LLM_DEPLOYMENT_ID: z.string().optional(),
@@ -33,7 +35,7 @@ export const getEnv = (() => {
                     E2E_TESTING: z.enum(["1", "0"]).optional(),
                     EMAIL_AUTH_DISABLED: z.enum(["1", "0"]).optional(),
                     EMAIL_VERIFICATION_DISABLED: z.enum(["1", "0"]).optional(),
-                    ENCRYPTION_KEY: z.string().length(64).or(z.string().length(32)),
+                   
                     ENTERPRISE_LICENSE_KEY: z.string().optional(),
                     FORMBRICKS_ENCRYPTION_KEY: z.string().length(24).or(z.string().length(0)).optional(),
                     GITHUB_ID: z.string().optional(),
@@ -55,7 +57,7 @@ export const getEnv = (() => {
                     INTERCOM_SECRET_KEY: z.string().optional(),
                     IS_FORMBRICKS_CLOUD: z.enum(["1", "0"]).optional(),
                     MAIL_FROM: z.string().email().optional(),
-                    NEXTAUTH_SECRET: z.string().min(1),
+                    
                     NOTION_OAUTH_CLIENT_ID: z.string().optional(),
                     NOTION_OAUTH_CLIENT_SECRET: z.string().optional(),
                     OIDC_CLIENT_ID: z.string().optional(),
@@ -119,6 +121,8 @@ export const getEnv = (() => {
                     APPCONDA_CLIENT_ENDPOINT: process.env.APPCONDA_CLIENT_ENDPOINT,
                     _SERVICE_TOKEN: process.env._SERVICE_TOKEN,
                     ENTERPRISE_LICENSE_KEY: process.env.ENTERPRISE_LICENSE_KEY,
+                    NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
+                    ENCRYPTION_KEY: process.env.ENCRYPTION_KEY,
                 },
             });
             console.log(env);

package/dist/lib/index.d.ts

@@ -0,0 +1 @@
+export * from "./jwt";

package/dist/lib/index.js

@@ -0,0 +1 @@
+export * from "./jwt";

package/dist/lib/jwt.d.ts

@@ -0,0 +1,12 @@
+import { JwtPayload } from "jsonwebtoken";
+export declare const createToken: (userId: string, userEmail: string, options?: {}) => string;
+export declare const createTokenForLinkSurvey: (surveyId: string, userEmail: string) => string;
+export declare const createEmailToken: (email: string) => string;
+export declare const getEmailFromEmailToken: (token: string) => string;
+export declare const createInviteToken: (inviteId: string, email: string, options?: {}) => string;
+export declare const verifyTokenForLinkSurvey: (token: string, surveyId: string) => string | null;
+export declare const verifyToken: (token: string) => Promise<JwtPayload>;
+export declare const verifyInviteToken: (token: string) => {
+    inviteId: string;
+    email: string;
+};