@appweaver/core 1.0.0

package/security/account/account-schema.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify2FACodeSchema = exports.send2FACodeSchema = exports.resetPasswordSchema = exports.sendResetPasswordSchema = exports.verifyEmailRedirectSchema = exports.verifyEmailSchema = exports.sendEmailVerificationSchema = exports.AccountStatusResponse = exports.AccountVerify2FAResponse = exports.AccountVerify2FARequest = exports.AccountSend2FAResponse = exports.AccountSend2FACodeRequest = exports.AccountResetPasswordRequest = exports.AccountSendResetPasswordRequest = exports.AccountEmailVerificationRequest = exports.AccountSendEmailVerificationRequest = void 0;
+const typebox_1 = require("@sinclair/typebox");
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../../errors");
+const auth_schema_1 = require("../auth-schema");
+const utils_1 = require("../../utils");
+const account_service_1 = require("./account-service");
+exports.AccountSendEmailVerificationRequest = typebox_1.Type.Object({
+    redirectToUrl: typebox_1.Type.String({
+        format: 'uri',
+        description: 'A URL to redirect to with token or status code after email verification is completed',
+        example: 'https://example.com/account'
+    }),
+    verificationType: typebox_1.Type.Optional((0, common_1.StringEnum)(account_service_1.VerificationType, {
+        description: 'auto (default) - token is verified automatically before redirecting to provided URL with a status message, ' +
+            'manual - client must manually verify received token on provided URL',
+        example: 'auto'
+    }))
+}, { $id: 'AccountSendEmailVerificationRequest' });
+exports.AccountEmailVerificationRequest = typebox_1.Type.Object({
+    token: typebox_1.Type.String({
+        description: 'Verification token sent to the user email',
+        example: 'aBcDeFgHijkLMnO123456789'
+    })
+}, { $id: 'AccountEmailVerificationRequest' });
+exports.AccountSendResetPasswordRequest = typebox_1.Type.Object({
+    redirectToUrl: typebox_1.Type.String({
+        format: 'uri',
+        description: 'A URL to redirect to where the user will perform the password reset' +
+            ' with one-time-token in the request',
+        example: 'https://example.com/reset-password'
+    }),
+    email: typebox_1.Type.String({
+        format: 'email',
+        description: 'A email address for which to perform password reset',
+        example: 'account@example.com'
+    })
+}, { $id: 'AccountSendResetPasswordRequest' });
+exports.AccountResetPasswordRequest = typebox_1.Type.Object({
+    token: typebox_1.Type.String({
+        description: 'Password reset token sent to the user email',
+        example: 'aBcDeFgHijkLMnO123456789'
+    }),
+    newPassword: typebox_1.Type.String({
+        description: 'The new password to set for this user',
+        example: 'yourNewPassword123'
+    })
+}, { $id: 'AccountResetPasswordRequest' });
+exports.AccountSend2FACodeRequest = typebox_1.Type.Object({
+    purpose: typebox_1.Type.Optional(typebox_1.Type.String({
+        description: 'A purpose for using two-factor authentication method',
+        example: 'authentication'
+    }))
+}, { $id: 'AccountSend2FACodeRequest' });
+exports.AccountSend2FAResponse = typebox_1.Type.Object({
+    challengeId: typebox_1.Type.String({
+        description: 'The ID for currently requested 2FA',
+        example: 'aBcDeFgHijkLMnO123456789'
+    }),
+    expiresIn: typebox_1.Type.Integer({
+        description: 'The expiration time in milliseconds for the 2FA challenge',
+        example: 300000
+    })
+}, { $id: 'AccountSend2FAResponse' });
+exports.AccountVerify2FARequest = typebox_1.Type.Object({
+    challengeId: typebox_1.Type.String({
+        description: 'The ID value received on sending 2FA code request',
+        example: 'aBcDeFgHijkLMnO123456789'
+    }),
+    code: typebox_1.Type.String({
+        description: 'The 2FA code to verify',
+        example: '123456'
+    })
+}, { $id: 'AccountVerify2FARequest' });
+exports.AccountVerify2FAResponse = typebox_1.Type.Object({
+    token: typebox_1.Type.String({
+        description: 'The one-time-token for requested purpose (e.g., authentication)',
+        example: 'aBcDeFgHijkLMnO123456789'
+    }),
+    expiresIn: typebox_1.Type.Integer({
+        description: 'The expiration time in milliseconds for the 2FA authentication token',
+        example: 120000
+    })
+}, { $id: 'AccountVerify2FAResponse' });
+exports.AccountStatusResponse = typebox_1.Type.Object({
+    message: typebox_1.Type.String({ example: 'Operation finished successfully' })
+}, { $id: 'AccountStatusResponse' });
+exports.sendEmailVerificationSchema = {
+    tags: ['Account'],
+    security: (0, auth_schema_1.authSchema)(),
+    summary: 'Send verification email',
+    description: 'Send verification email',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AccountStatusResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.AccountSendEmailVerificationRequest)
+};
+exports.verifyEmailSchema = {
+    tags: ['Account'],
+    summary: 'Verify email token',
+    description: 'Verify email token',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AccountStatusResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.AccountEmailVerificationRequest)
+};
+exports.verifyEmailRedirectSchema = {
+    tags: ['Account'],
+    summary: 'Verify email token and redirect to a provided URL with status message',
+    description: 'Verify email token and redirect to a provided URL with status message',
+    querystring: exports.AccountEmailVerificationRequest,
+    response: {
+        302: {
+            description: `Redirect to URL provided in the request for sending verification email`
+        },
+        ...errors_1.AllErrorResponses
+    }
+};
+exports.sendResetPasswordSchema = {
+    tags: ['Account'],
+    header: (0, auth_schema_1.recaptchaHeaderSchema)({ recaptchaAction: 'send-reset-password' }),
+    summary: 'Send password reset link to provided email address',
+    description: 'Send password reset link to provided email address',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AccountStatusResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.AccountSendResetPasswordRequest)
+};
+exports.resetPasswordSchema = {
+    tags: ['Account'],
+    header: (0, auth_schema_1.recaptchaHeaderSchema)({ recaptchaAction: 'reset-password' }),
+    summary: 'Reset the user password to a new value',
+    description: 'Reset the user password to a new value',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AccountStatusResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.AccountResetPasswordRequest)
+};
+exports.send2FACodeSchema = {
+    tags: ['Account'],
+    security: (0, auth_schema_1.authSchema)([common_1.AuthType.Jwt]),
+    summary: 'Send 2FA code for currently logged-in user',
+    description: 'Send 2FA code for currently logged-in user',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AccountSend2FAResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.AccountSend2FACodeRequest)
+};
+exports.verify2FACodeSchema = {
+    tags: ['Account'],
+    security: (0, auth_schema_1.authSchema)([common_1.AuthType.Jwt]),
+    summary: 'Verify 2FA code for currently logged-in user',
+    description: 'Verify 2FA code for currently logged-in user',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AccountVerify2FAResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.AccountVerify2FARequest)
+};

package/security/account/account-service.d.ts

@@ -0,0 +1,88 @@
+import { AuthUser } from '@appweaver/common';
+export declare enum VerificationType {
+    Auto = "auto",
+    Manual = "manual"
+}
+export declare class AccountService {
+    /**
+     * Sends an email verification link to the specified user's email address.
+     *
+     * @param {AuthUser} authUser - The user object for whom the email verification is to be sent.
+     * @param {string} redirectToUrl - The URL to which the user will be redirected after verifying their email address.
+     * @param {VerificationType} [verificationType=VerificationType.Auto] - The type of verification process to use.
+     * Defaults to auto verification.
+     * @return {Promise<string>} A promise that resolves to a confirmation message upon successful email delivery.
+     * @throws {HttpError} Throws a 501 error if email verification is not supported.
+     * @throws {HttpError} Throws a 403 error if the user's email address is already verified.
+     * @throws {HttpError} Throws a 400 error if the provided redirect URL is invalid.
+     */
+    sendEmailVerification(authUser: AuthUser, redirectToUrl: string, verificationType?: VerificationType): Promise<string>;
+    /**
+     * Verifies the email address associated with a given token and returns a success message.
+     *
+     * @param {string} token The one-time token used for email verification.
+     * @return {Promise<string>} A confirmation message indicating the email address has been verified.
+     * @throws {HttpError} If the authentication user does not exist, is disabled, or the email has already been verified.
+     */
+    verifyEmailAddress(token: string): Promise<string>;
+    /**
+     * Verify the email address associated with a one-time token and generates a redirection URL.
+     *
+     * @param {string} token - The one-time token used to verify the email address.
+     * @return {Promise<{ status: 'ok' | 'error'; message: string; redirectUrl: string }>} An object containing the
+     * verification status, a message, and the constructed redirection URL.
+     */
+    verifyEmailAddressRedirect(token: string): Promise<{
+        status: 'ok' | 'error';
+        message: string;
+        redirectUrl: string;
+    }>;
+    /**
+     * Sends a password reset email to the specified email address with a link for resetting the password.
+     *
+     * @param {string} email - The email address of the user requesting a password reset.
+     * @param {string} redirectToUrl - The URL to be appended with a token for the password reset link.
+     * @return {Promise<string>} A promise that resolves to a confirmation message upon successful email dispatch.
+     * @throws {HttpError} If the email service is not configured, the user does not exist or is disabled, the user has no
+     * password set, or the redirect URL is invalid.
+     */
+    sendResetPassword(email: string, redirectToUrl: string): Promise<string>;
+    /**
+     * Resets the password for a user using a one-time token.
+     *
+     * @param {string} token - The one-time token used for password reset.
+     * @param {string} password - The new password to be set for the user.
+     * @return {Promise<string>} A message indicating the success of the password reset operation.
+     * @throws {HttpError} If the password does not meet the required complexity, if the token is invalid,
+     *                     if the user does not exist, if the user is disabled, or if the user does not have
+     *                     an existing password to reset.
+     */
+    resetPassword(token: string, password: string): Promise<string>;
+    /**
+     * Sends a two-factor authentication (2FA) code to the specified user via email for a given purpose.
+     *
+     * @param {AuthUser} authUser - The authenticated user to whom the 2FA code will be sent.
+     * @param {string} [purpose='authentication'] - The purpose for sending the 2FA code (e.g., authentication, account
+     * recovery).
+     * @return {Promise<{ challengeId: string; expiresIn: number }>} A promise that resolves to the unique challenge ID
+     * and expiration time associated with the 2FA code.
+     * @throws {HttpError} If the email service is not available, an error with a 501 status code is thrown.
+     */
+    send2FACode(authUser: AuthUser, purpose?: string): Promise<{
+        challengeId: string;
+        expiresIn: number;
+    }>;
+    /**
+     * Verifies a two-factor authentication (2FA) code for a provided challenge ID.
+     *
+     * @param {string} challengeId The unique identifier of the 2FA challenge.
+     * @param {string} code The 2FA code entered by the user.
+     * @return {Promise<{ token: string; expiresIn: number }>} A promise that resolves to a one-time token and expiration
+     * time if the 2FA verification is successful.
+     * @throws {Error} An error if verification fails or the associated user is disabled or does not exist.
+     */
+    verify2FACode(challengeId: string, code: string): Promise<{
+        token: string;
+        expiresIn: number;
+    }>;
+}

package/security/account/account-service.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountService = exports.VerificationType = void 0;
+const common_1 = require("@appweaver/common");
+const auth_service_1 = require("../auth-service");
+const helper_1 = require("../helper");
+const context_1 = require("../../context");
+const mailer_1 = require("../../mailer");
+const errors_1 = require("../../errors");
+var VerificationType;
+(function (VerificationType) {
+    VerificationType["Auto"] = "auto";
+    VerificationType["Manual"] = "manual";
+})(VerificationType || (exports.VerificationType = VerificationType = {}));
+class AccountService {
+    /** @internal */
+    _authService = (0, context_1.inject)(auth_service_1.AuthService);
+    /** @internal */
+    _securityStore = (0, context_1.inject)(common_1.SecurityStore);
+    /** @internal */
+    _emailService = (0, context_1.inject)(mailer_1.EmailService, false);
+    /**
+     * Sends an email verification link to the specified user's email address.
+     *
+     * @param {AuthUser} authUser - The user object for whom the email verification is to be sent.
+     * @param {string} redirectToUrl - The URL to which the user will be redirected after verifying their email address.
+     * @param {VerificationType} [verificationType=VerificationType.Auto] - The type of verification process to use.
+     * Defaults to auto verification.
+     * @return {Promise<string>} A promise that resolves to a confirmation message upon successful email delivery.
+     * @throws {HttpError} Throws a 501 error if email verification is not supported.
+     * @throws {HttpError} Throws a 403 error if the user's email address is already verified.
+     * @throws {HttpError} Throws a 400 error if the provided redirect URL is invalid.
+     */
+    async sendEmailVerification(authUser, redirectToUrl, verificationType = VerificationType.Auto) {
+        if (!this._emailService) {
+            throw new errors_1.HttpError('Email verification is not supported', 501);
+        }
+        if (authUser.verifiedEmail) {
+            throw new errors_1.HttpError('Email address is already verified', 403);
+        }
+        const result = (0, helper_1.validateRedirectUrl)(redirectToUrl);
+        if (!result.valid) {
+            throw new errors_1.HttpError(result.message, 400);
+        }
+        const token = await this._securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.EmailVerification, { authUserId: authUser.id, redirectToUrl }, common_1.config.SECURITY_ACCOUNT_VERIFY_EMAIL_OTT_TTL);
+        const accountPath = common_1.config.SECURITY_ACCOUNT_ROUTE_PREFIX.replace(/\/$/, '');
+        const separator = redirectToUrl.includes('?') ? '&' : '?';
+        const verifyLink = verificationType === VerificationType.Auto
+            ? `${common_1.config.APP_HOSTNAME}${accountPath}/verify-email-redirect?token=${token}}`
+            : `${redirectToUrl}${separator}token=${token}`;
+        await this._emailService.sendEmail({
+            to: authUser.email,
+            subject: 'Verify email address',
+            text: `Please verify your email address on following link: ${verifyLink}`
+        });
+        return 'Verification email sent';
+    }
+    /**
+     * Verifies the email address associated with a given token and returns a success message.
+     *
+     * @param {string} token The one-time token used for email verification.
+     * @return {Promise<string>} A confirmation message indicating the email address has been verified.
+     * @throws {HttpError} If the authentication user does not exist, is disabled, or the email has already been verified.
+     */
+    async verifyEmailAddress(token) {
+        const { authUserId } = await this._securityStore.useOneTimeToken(token, common_1.AuthOTTPurpose.EmailVerification);
+        const authUser = await this._authService.findById(authUserId);
+        if (!authUser || !authUser.enabled) {
+            throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
+        }
+        if (authUser.verifiedEmail) {
+            throw new errors_1.HttpError('Email address is already verified', 403);
+        }
+        await this._authService.updateAuthUser(authUserId, { verifiedEmail: true });
+        return 'E-mail address verified';
+    }
+    /**
+     * Verify the email address associated with a one-time token and generates a redirection URL.
+     *
+     * @param {string} token - The one-time token used to verify the email address.
+     * @return {Promise<{ status: 'ok' | 'error'; message: string; redirectUrl: string }>} An object containing the
+     * verification status, a message, and the constructed redirection URL.
+     */
+    async verifyEmailAddressRedirect(token) {
+        const { authUserId, redirectToUrl } = await this._securityStore.useOneTimeToken(token, common_1.AuthOTTPurpose.EmailVerification);
+        const separator = redirectToUrl.includes('?') ? '&' : '?';
+        const redirectUrl = `${redirectToUrl}${separator}`;
+        const authUser = await this._authService.findById(authUserId);
+        if (!authUser || !authUser.enabled) {
+            return {
+                redirectUrl,
+                status: 'error',
+                message: 'Auth user does not exist or is disabled'
+            };
+        }
+        if (authUser.verifiedEmail) {
+            return {
+                redirectUrl,
+                status: 'error',
+                message: 'Email address is already verified'
+            };
+        }
+        await this._authService.updateAuthUser(authUserId, { verifiedEmail: true });
+        return { redirectUrl, status: 'ok', message: 'E-mail address verified' };
+    }
+    /**
+     * Sends a password reset email to the specified email address with a link for resetting the password.
+     *
+     * @param {string} email - The email address of the user requesting a password reset.
+     * @param {string} redirectToUrl - The URL to be appended with a token for the password reset link.
+     * @return {Promise<string>} A promise that resolves to a confirmation message upon successful email dispatch.
+     * @throws {HttpError} If the email service is not configured, the user does not exist or is disabled, the user has no
+     * password set, or the redirect URL is invalid.
+     */
+    async sendResetPassword(email, redirectToUrl) {
+        if (!this._emailService) {
+            throw new errors_1.HttpError('Password reset is not supported', 501);
+        }
+        const authUser = await this._authService.findByUsername(email);
+        if (!authUser || !authUser.enabled) {
+            throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
+        }
+        if (!authUser.passwordHash) {
+            throw new errors_1.HttpError('Auth user does not have already set password', 403);
+        }
+        const result = (0, helper_1.validateRedirectUrl)(redirectToUrl);
+        if (!result.valid) {
+            throw new errors_1.HttpError(result.message, 400);
+        }
+        const token = await this._securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.PasswordReset, { authUserId: authUser.id, authSource: common_1.AuthSource.Password }, common_1.config.SECURITY_ACCOUNT_RESET_PASSWORD_OTT_TTL);
+        const separator = redirectToUrl.includes('?') ? '&' : '?';
+        const changePasswordLink = `${redirectToUrl}${separator}token=${token}`;
+        await this._emailService.sendEmail({
+            to: authUser.email,
+            subject: 'Password reset request',
+            text: `Please change your password on following link: ${changePasswordLink}`
+        });
+        return 'Password reset email sent';
+    }
+    /**
+     * Resets the password for a user using a one-time token.
+     *
+     * @param {string} token - The one-time token used for password reset.
+     * @param {string} password - The new password to be set for the user.
+     * @return {Promise<string>} A message indicating the success of the password reset operation.
+     * @throws {HttpError} If the password does not meet the required complexity, if the token is invalid,
+     *                     if the user does not exist, if the user is disabled, or if the user does not have
+     *                     an existing password to reset.
+     */
+    async resetPassword(token, password) {
+        const result = (0, helper_1.validatePasswordComplexity)(password);
+        if (!result.valid) {
+            throw new errors_1.HttpError(result.message, 400);
+        }
+        const { authUserId } = await this._securityStore.useOneTimeToken(token, common_1.AuthOTTPurpose.PasswordReset);
+        const authUser = await this._authService.findById(authUserId);
+        if (!authUser || !authUser.enabled) {
+            throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
+        }
+        if (!authUser.passwordHash) {
+            throw new errors_1.HttpError('Auth user does not have already set password', 403);
+        }
+        await this._authService.updateAuthUser(authUserId, {
+            logoutAt: new Date(),
+            passwordHash: await (0, helper_1.hashPassword)(password)
+        });
+        return 'Password reset successfully';
+    }
+    /**
+     * Sends a two-factor authentication (2FA) code to the specified user via email for a given purpose.
+     *
+     * @param {AuthUser} authUser - The authenticated user to whom the 2FA code will be sent.
+     * @param {string} [purpose='authentication'] - The purpose for sending the 2FA code (e.g., authentication, account
+     * recovery).
+     * @return {Promise<{ challengeId: string; expiresIn: number }>} A promise that resolves to the unique challenge ID
+     * and expiration time associated with the 2FA code.
+     * @throws {HttpError} If the email service is not available, an error with a 501 status code is thrown.
+     */
+    async send2FACode(authUser, purpose = 'authentication') {
+        if (!this._emailService) {
+            throw new errors_1.HttpError('2FA is not supported', 501);
+        }
+        const expiresIn = common_1.config.SECURITY_ACCOUNT_2FA_OTT_TTL;
+        const code = (0, common_1.randomString)(6, { numbers: true });
+        const challengeId = await this._securityStore.generateOneTimeToken(common_1.AuthOTTPurpose.TwoFAVerification, { authUserId: authUser.id, codeHash: (0, common_1.makeHash)(code), purpose }, expiresIn);
+        await this._emailService.sendEmail({
+            to: authUser.email,
+            subject: 'Verification code',
+            text: `Please enter the following code: ${code}`
+        });
+        return { challengeId, expiresIn };
+    }
+    /**
+     * Verifies a two-factor authentication (2FA) code for a provided challenge ID.
+     *
+     * @param {string} challengeId The unique identifier of the 2FA challenge.
+     * @param {string} code The 2FA code entered by the user.
+     * @return {Promise<{ token: string; expiresIn: number }>} A promise that resolves to a one-time token and expiration
+     * time if the 2FA verification is successful.
+     * @throws {Error} An error if verification fails or the associated user is disabled or does not exist.
+     */
+    async verify2FACode(challengeId, code) {
+        const data = await this._securityStore.useOneTimeToken(challengeId, common_1.AuthOTTPurpose.TwoFAVerification, (value) => {
+            if (value.codeHash !== (0, common_1.makeHash)(code)) {
+                return { valid: false, message: 'Invalid 2FA code provided' };
+            }
+            return { valid: true, message: 'OK' };
+        });
+        const authUser = await this._authService.findById(data.authUserId);
+        if (!authUser || !authUser.enabled) {
+            throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
+        }
+        const expiresIn = common_1.config.SECURITY_AUTH_OTT_TTL;
+        const token = await this._securityStore.generateOneTimeToken(data.purpose, { authUserId: authUser.id, authSource: common_1.AuthSource.Password }, expiresIn);
+        return { token, expiresIn };
+    }
+}
+exports.AccountService = AccountService;

package/security/account/index.d.ts

@@ -0,0 +1,3 @@
+export * from './account-routes';
+export * from './account-schema';
+export * from './account-service';

package/security/account/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./account-routes"), exports);
+__exportStar(require("./account-schema"), exports);
+__exportStar(require("./account-service"), exports);

package/security/api-key/api-key-auth.d.ts

@@ -0,0 +1,4 @@
+import { FastifyRequest } from 'fastify';
+import { Server } from '../../types';
+export declare const apiKeyAuth: (server: Server) => Promise<void>;
+export declare function hasApiKey(request: FastifyRequest): boolean;

package/security/api-key/api-key-auth.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeyAuth = void 0;
+exports.hasApiKey = hasApiKey;
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const request_context_1 = require("@fastify/request-context");
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const helper_1 = require("../helper");
+const auth_service_1 = require("../auth-service");
+const errors_1 = require("../../errors");
+const cache_1 = require("../../cache");
+exports.apiKeyAuth = (0, fastify_plugin_1.default)(async (server) => {
+    const authService = (0, context_1.inject)(auth_service_1.AuthService);
+    const cacheService = (0, context_1.inject)(cache_1.CacheService);
+    const db = (0, context_1.inject)(common_1.Database);
+    server.decorate('authenticateApiKey', async (request) => {
+        const key = request.headers[common_1.config.SECURITY_API_KEY_HEADER_NAME.toLowerCase()];
+        if (!key) {
+            throw new errors_1.HttpError(`Missing API key header: ${common_1.config.SECURITY_API_KEY_HEADER_NAME}`, 401);
+        }
+        const sanitizedApiKey = String(key).trim();
+        // Use configured delimiter to split an API key and separate ID from the
+        // rest of the key value
+        const apiKeyParts = sanitizedApiKey.split(common_1.config.SECURITY_API_KEY_DELIMITER);
+        const apiKeyId = parseInt(apiKeyParts.shift() ?? '', 10);
+        const apiKeyValue = apiKeyParts.join(common_1.config.SECURITY_API_KEY_DELIMITER);
+        const cacheKey = cacheService.buildCacheKey({
+            baseKey: `apikey:${apiKeyId}`,
+            modelName: 'ApiKey'
+        });
+        let apiKey = await cacheService.getCachedValue(cacheKey);
+        if (!apiKey) {
+            try {
+                apiKey = await db
+                    .client()
+                    .apiKey.findFirst({ where: { id: apiKeyId } });
+            }
+            catch (e) {
+                throw new errors_1.HttpError(`Invalid API key format`, 401);
+            }
+            if (!apiKey ||
+                !apiKey.enabled ||
+                apiKey.keyHash !== (0, common_1.makeHash)(apiKeyValue)) {
+                throw new errors_1.HttpError(`Invalid API key`, 401);
+            }
+            await cacheService.addToCache(cacheKey, apiKey, common_1.config.SECURITY_CACHE_TTL);
+        }
+        if (apiKey.expiresAt && new Date(apiKey.expiresAt).getTime() < Date.now()) {
+            throw new errors_1.HttpError(`API key has expired`, 403);
+        }
+        const authModelField = (0, common_1.uncapitalize)((0, helper_1.resourceAuthModel)().name);
+        const authUser = await authService.findById(apiKey[`${authModelField}Id`]);
+        authService.authorize(authUser, request.url, request.routeOptions.config);
+        request_context_1.requestContext.set('apiKey', apiKey);
+        request_context_1.requestContext.set('authUser', authUser);
+        request_context_1.requestContext.set('authType', common_1.AuthType.ApiKey);
+        request_context_1.requestContext.set('authSource', common_1.AuthSource.ApiKey);
+    });
+});
+function hasApiKey(request) {
+    return !!request.headers[common_1.config.SECURITY_API_KEY_HEADER_NAME.toLowerCase()];
+}

package/security/api-key/index.d.ts

@@ -0,0 +1 @@
+export * from './api-key-auth';

package/security/api-key/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./api-key-auth"), exports);

package/security/auth-routes.d.ts

@@ -0,0 +1,2 @@
+import { Server } from '../types';
+export declare function authRoutes(server: Server): void;