@appweaver/core 1.0.0

package/security/auth-routes.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authRoutes = authRoutes;
+const auth_schema_1 = require("./auth-schema");
+const common_1 = require("@appweaver/common");
+const auth_service_1 = require("./auth-service");
+const helper_1 = require("./helper");
+const context_1 = require("../context");
+function authRoutes(server) {
+    const { authenticate, currentUser } = server;
+    const authService = (0, context_1.inject)(auth_service_1.AuthService);
+    server.post('/login', {
+        schema: auth_schema_1.loginSchema,
+        config: {
+            rateLimit: {
+                max: 12
+            }
+        }
+    }, async (request, reply) => {
+        const { username, password } = request.body;
+        const authResponse = await authService.login(username, password);
+        return reply.send(authResponse);
+    });
+    server.post('/logout', {
+        schema: auth_schema_1.logoutSchema,
+        onRequest: authenticate([common_1.AuthType.Jwt])
+    }, async (_, reply) => {
+        const authUser = currentUser();
+        const success = await authService.logout(authUser.id);
+        return reply.send({ success });
+    });
+    server.post('/refresh', {
+        schema: auth_schema_1.refreshSchema,
+        onRequest: authenticate([common_1.AuthType.Jwt]),
+        config: {
+            rateLimit: {
+                max: 12
+            }
+        }
+    }, async (_, reply) => {
+        const authUser = currentUser();
+        const authResponse = await authService.generateAuthTokens(authUser, common_1.AuthScope.Auth, (0, helper_1.currentAuthSource)() ?? common_1.AuthSource.Password);
+        return reply.send(authResponse);
+    });
+    server.post('/change-password', {
+        schema: auth_schema_1.changePasswordSchema,
+        onRequest: authenticate(),
+        config: {
+            rateLimit: {
+                max: 12
+            }
+        }
+    }, async (request, reply) => {
+        const authUser = currentUser();
+        const authResponse = await authService.changePassword(authUser, request.body.currentPassword, request.body.newPassword);
+        return reply.send(authResponse);
+    });
+    server.post('/exchange-token', {
+        schema: auth_schema_1.exchangeTokenSchema,
+        config: {
+            rateLimit: {
+                max: 12
+            }
+        }
+    }, async (request, reply) => {
+        const { token } = request.body;
+        const authResponse = await authService.exchangeToken(token);
+        return reply.send(authResponse);
+    });
+    const authUserModel = (0, helper_1.resourceAuthModel)();
+    if (authUserModel) {
+        server.get('/me', {
+            schema: (0, auth_schema_1.createCurrentAuthUserSchema)(authUserModel.readOneModel),
+            onRequest: authenticate()
+        }, async (_, reply) => {
+            const authUser = currentUser();
+            return reply.send(authUser);
+        });
+    }
+}

package/security/auth-schema.d.ts

@@ -0,0 +1,215 @@
+import { TObject, TSchema } from '@sinclair/typebox';
+import { AuthType, RecaptchaConfig, RouteSchema } from '@appweaver/common';
+export declare const LoginRequest: TObject<{
+    username: import("@sinclair/typebox").TString;
+    password: import("@sinclair/typebox").TString;
+}>;
+export declare const AuthenticationResponse: TObject<{
+    accessToken: import("@sinclair/typebox").TString;
+    refreshToken: import("@sinclair/typebox").TString;
+    expiresIn: import("@sinclair/typebox").TNumber;
+    refreshExpiresIn: import("@sinclair/typebox").TNumber;
+}>;
+export declare const ChangePasswordRequest: TObject<{
+    currentPassword: import("@sinclair/typebox").TString;
+    newPassword: import("@sinclair/typebox").TString;
+}>;
+export declare const LogoutResponse: TObject<{
+    success: import("@sinclair/typebox").TBoolean;
+}>;
+export declare const ExchangeTokenRequest: TObject<{
+    token: import("@sinclair/typebox").TString;
+}>;
+export declare const loginSchema: {
+    tags: string[];
+    summary: string;
+    description: string;
+    response: {
+        '4xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        '5xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        200: TObject<{
+            accessToken: import("@sinclair/typebox").TString;
+            refreshToken: import("@sinclair/typebox").TString;
+            expiresIn: import("@sinclair/typebox").TNumber;
+            refreshExpiresIn: import("@sinclair/typebox").TNumber;
+        }>;
+    };
+    body: TObject<{
+        username: import("@sinclair/typebox").TString;
+        password: import("@sinclair/typebox").TString;
+    }>;
+};
+export declare const refreshSchema: {
+    tags: string[];
+    security: {
+        bearer: never[];
+    }[];
+    summary: string;
+    description: string;
+    response: {
+        '4xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        '5xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        200: TObject<{
+            accessToken: import("@sinclair/typebox").TString;
+            refreshToken: import("@sinclair/typebox").TString;
+            expiresIn: import("@sinclair/typebox").TNumber;
+            refreshExpiresIn: import("@sinclair/typebox").TNumber;
+        }>;
+    };
+};
+export declare const logoutSchema: {
+    tags: string[];
+    security: {
+        bearer: never[];
+    }[];
+    summary: string;
+    description: string;
+    response: {
+        '4xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        '5xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        200: TObject<{
+            success: import("@sinclair/typebox").TBoolean;
+        }>;
+    };
+};
+export declare const changePasswordSchema: {
+    tags: string[];
+    security: any[];
+    summary: string;
+    description: string;
+    response: {
+        '4xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        '5xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        200: TObject<{
+            accessToken: import("@sinclair/typebox").TString;
+            refreshToken: import("@sinclair/typebox").TString;
+            expiresIn: import("@sinclair/typebox").TNumber;
+            refreshExpiresIn: import("@sinclair/typebox").TNumber;
+        }>;
+    };
+    body: TObject<{
+        currentPassword: import("@sinclair/typebox").TString;
+        newPassword: import("@sinclair/typebox").TString;
+    }>;
+};
+export declare const exchangeTokenSchema: {
+    tags: string[];
+    summary: string;
+    description: string;
+    response: {
+        '4xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        '5xx': {
+            description: string;
+            content: {
+                'application/json': {
+                    schema: TObject<{
+                        errorCode: import("@sinclair/typebox").TInteger;
+                        message: import("@sinclair/typebox").TString;
+                    }>;
+                };
+            };
+        };
+        200: TObject<{
+            accessToken: import("@sinclair/typebox").TString;
+            refreshToken: import("@sinclair/typebox").TString;
+            expiresIn: import("@sinclair/typebox").TNumber;
+            refreshExpiresIn: import("@sinclair/typebox").TNumber;
+        }>;
+    };
+    body: TObject<{
+        token: import("@sinclair/typebox").TString;
+    }>;
+};
+export declare function authSchema(authTypes?: AuthType[]): any[];
+export declare function recaptchaHeaderSchema(recaptchaConfig: RecaptchaConfig): TObject;
+export declare function createCurrentAuthUserSchema(modelSchema: TSchema): RouteSchema;

package/security/auth-schema.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeTokenSchema = exports.changePasswordSchema = exports.logoutSchema = exports.refreshSchema = exports.loginSchema = exports.ExchangeTokenRequest = exports.LogoutResponse = exports.ChangePasswordRequest = exports.AuthenticationResponse = exports.LoginRequest = void 0;
+exports.authSchema = authSchema;
+exports.recaptchaHeaderSchema = recaptchaHeaderSchema;
+exports.createCurrentAuthUserSchema = createCurrentAuthUserSchema;
+const typebox_1 = require("@sinclair/typebox");
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../errors");
+const utils_1 = require("../utils");
+exports.LoginRequest = typebox_1.Type.Object({
+    username: typebox_1.Type.String({ example: 'john.doe@example.com' }),
+    password: typebox_1.Type.String({ example: 'yourPassword123!' })
+}, { $id: 'LoginRequest' });
+exports.AuthenticationResponse = typebox_1.Type.Object({
+    accessToken: typebox_1.Type.String({
+        example: 'eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJuYk92'
+    }),
+    refreshToken: typebox_1.Type.String({
+        example: 'eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJkNTBl'
+    }),
+    expiresIn: typebox_1.Type.Number({ example: 2592000 }),
+    refreshExpiresIn: typebox_1.Type.Number({ example: 5184000 })
+}, { $id: 'AuthenticationResponse' });
+exports.ChangePasswordRequest = typebox_1.Type.Object({
+    currentPassword: typebox_1.Type.String({ example: 'oldPassword123!' }),
+    newPassword: typebox_1.Type.String({ example: 'newPassword321!' })
+}, { $id: 'ChangePasswordRequest' });
+exports.LogoutResponse = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean({ example: true })
+}, { $id: 'LogoutResponse' });
+exports.ExchangeTokenRequest = typebox_1.Type.Object({
+    token: typebox_1.Type.String({ example: 'aBcDeFgHijkLMnO123456789' })
+}, { $id: 'ExchangeTokenRequest' });
+exports.loginSchema = {
+    tags: ['Auth'],
+    summary: 'Login identity',
+    description: 'Login identity',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AuthenticationResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.LoginRequest)
+};
+exports.refreshSchema = {
+    tags: ['Auth'],
+    security: [{ bearer: [] }],
+    summary: 'Refresh identity token',
+    description: 'Refresh identity token',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AuthenticationResponse),
+        ...errors_1.AllErrorResponses
+    }
+};
+exports.logoutSchema = {
+    tags: ['Auth'],
+    security: [{ bearer: [] }],
+    summary: 'Logout identity',
+    description: 'Logout identity',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.LogoutResponse),
+        ...errors_1.AllErrorResponses
+    }
+};
+exports.changePasswordSchema = {
+    tags: ['Auth'],
+    security: authSchema(),
+    summary: 'Change identity password',
+    description: 'Change identity password',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AuthenticationResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.ChangePasswordRequest)
+};
+exports.exchangeTokenSchema = {
+    tags: ['Auth'],
+    summary: 'Exchange one time token for access token',
+    description: 'Exchange one time token for access token',
+    response: {
+        200: (0, utils_1.createSchemaModel)(exports.AuthenticationResponse),
+        ...errors_1.AllErrorResponses
+    },
+    body: (0, utils_1.createSchemaModel)(exports.ExchangeTokenRequest)
+};
+function authSchema(authTypes) {
+    const authSchemas = [];
+    for (const authType of authTypes ?? Object.values(common_1.AuthType)) {
+        switch (authType) {
+            case common_1.AuthType.Basic:
+                if (common_1.config.SECURITY_BASIC_ENABLED) {
+                    authSchemas.push({ basicAuth: [] });
+                }
+                break;
+            case common_1.AuthType.ApiKey:
+                if (common_1.config.SECURITY_API_KEY_ENABLED) {
+                    authSchemas.push({ apiKeyAuth: [] });
+                }
+                break;
+            case common_1.AuthType.Jwt:
+                authSchemas.push({ bearer: [] });
+                break;
+        }
+    }
+    return authSchemas;
+}
+function recaptchaHeaderSchema(recaptchaConfig) {
+    return typebox_1.Type.Object(common_1.config.SECURITY_RECAPTCHA_ENABLED &&
+        (recaptchaConfig.recaptcha || recaptchaConfig.recaptchaAction)
+        ? {
+            [common_1.config.SECURITY_RECAPTCHA_HEADER_NAME.toLowerCase()]: typebox_1.Type.String({
+                minLength: 1,
+                description: `reCAPTCHA token for ${recaptchaConfig.recaptchaAction ?? 'any'} action`
+            })
+        }
+        : {}, { additionalProperties: true });
+}
+function createCurrentAuthUserSchema(modelSchema) {
+    return {
+        tags: ['Auth'],
+        security: authSchema(),
+        summary: 'Return currently authorized identity',
+        description: 'Return currently authorized identity',
+        response: {
+            200: modelSchema,
+            ...errors_1.AllErrorResponses
+        }
+    };
+}

package/security/auth-service.d.ts

@@ -0,0 +1,117 @@
+import { AuthScope, AuthSource, AuthUser, RouteConfig } from '@appweaver/common';
+import { AuthTokens, JwtPayload, UserAdditionalData } from '../types';
+export declare class AuthService {
+    /**
+     * Finds an authenticated user by their unique identifier.
+     *
+     * @param {number} id - The unique identifier of the authenticated user to find.
+     * @return {Promise<AuthUser | null>} A promise that resolves to the authenticated user object if found, otherwise
+     * null.
+     */
+    findById(id: number): Promise<AuthUser | null>;
+    /**
+     * Retrieves a user by their username.
+     *
+     * @param {string} username - The username to search for.
+     * @return {Promise<AuthUser | null>} A promise that resolves to the user object if found, or null if not found.
+     */
+    findByUsername(username: string): Promise<AuthUser | null>;
+    /**
+     * Updates an authenticated user's information in the system.
+     *
+     * @param {number} id - The unique identifier of the authenticated user to be updated.
+     * @param {Partial<AuthUser> & { password?: string }} data - The partial user data to update, optionally including a
+     * password.
+     * @return {Promise<AuthUser>} A promise that resolves to the updated authenticated user object.
+     */
+    updateAuthUser(id: number, data: Partial<AuthUser> & {
+        password?: string;
+    }): Promise<AuthUser>;
+    /**
+     * Registers a new authenticated user based on the provided authentication source, email, and optional password and
+     * additional data.
+     *
+     * @param {AuthSource} source - The authentication source to register the user, e.g., password, google, custom.
+     * @param {string} email - The email address of the user to be registered.
+     * @param {string} [password] - The optional password for the user, used when the authentication type requires it.
+     * @param {Partial<UserAdditionalData>} [data] - Optional additional data related to the user to be stored during
+     * registration.
+     * @return {Promise<AuthUser>} A promise resolving to the registered authentication user object.
+     * @throws {HttpError} Throws an error if the registration process fails.
+     */
+    registerAuthUser(source: AuthSource, email: string, password?: string, data?: Partial<UserAdditionalData>): Promise<AuthUser>;
+    /**
+     * Changes the password for the authenticated user.
+     *
+     * @param {AuthUser} authUser - The authenticated user object containing user details.
+     * @param {string} currentPassword - The current password of the authenticated user.
+     * @param {string} newPassword - The new password to be set for the authenticated user.
+     * @return {Promise<AuthTokens>} A promise that resolves to the new authentication tokens after the password is
+     * successfully changed.
+     * @throws {HttpError} If the current password does not match the stored password hash.
+     */
+    changePassword(authUser: AuthUser, currentPassword: string, newPassword: string): Promise<AuthTokens>;
+    /**
+     * Authenticates a user by verifying their username and password.
+     *
+     * @param {string} username - The username of the user attempting to authenticate.
+     * @param {string} password - The password of the user attempting to authenticate.
+     * @return {Promise<AuthUser>} A promise that resolves to an authenticated user object if the credentials are valid.
+     * @throws {HttpError} If the user does not exist, is disabled, or if the provided credentials are invalid.
+     */
+    authenticate(username: string, password: string): Promise<AuthUser>;
+    /**
+     * Authorizes a user based on provided authentication details, route configuration, and JWT payload
+     * (if JWT auth type is used).
+     *
+     * @param {AuthUser | null} authUser - The authenticated user object. Can be null if no user is authenticated.
+     * @param {string} url - The URL of the resource being accessed.
+     * @param {RouteConfig} [routeConfig={}] - The route configuration object specifying required roles and permissions.
+     * @param {JwtPayload} [jwtPayload] - The JWT payload containing additional authentication information.
+     * @throws {HttpError} If the user is not authorized to access url based on route config and JWT payload.
+     */
+    authorize(authUser: AuthUser | null, url: string, routeConfig?: RouteConfig, jwtPayload?: JwtPayload): void;
+    /**
+     * Authenticates a user based on the provided username and password and generate access tokens.
+     * If 2FA is forced at configuration level or auth user has enabled 2FA, then generate JWT with 2FA scope,
+     * otherwise return regular JWT with authentication scope.
+     *
+     * @param {string} username - The username of the user attempting to log in.
+     * @param {string} password - The password of the user attempting to log in.
+     * @return {Promise<AuthTokens>} A promise that resolves to an object containing authentication tokens if login is
+     * successful.
+     * @throws {HttpError} If the user does not exist, is disabled, or provides invalid credentials.
+     */
+    login(username: string, password: string): Promise<AuthTokens>;
+    /**
+     * Exchanges an existing token for new authentication tokens.
+     *
+     * @param {string} token - The token to be exchanged for new authentication tokens.
+     * @return {Promise<AuthTokens>} A promise that resolves to a set of new authentication tokens.
+     * @throws {HttpError} If the token is invalid, expired, or associated with a non-existent or disabled user.
+     */
+    exchangeToken(token: string): Promise<AuthTokens>;
+    /**
+     * Generates authentication tokens (access and refresh tokens) for a given authenticated user.
+     *
+     * @param {AuthUser} authUser - The authenticated user for whom the tokens are to be generated.
+     *                              Contains user identification and authentication details.
+     * @param {AuthScope} [scope=AuthScope.Auth] - The scope for which the tokens are generated.
+     * @param {AuthSource} [source=AuthSource.Password] - The authentication source used to generate access tokens.
+     * @return {Promise<AuthTokens>} A promise that resolves to an object containing the generated authentication tokens:
+     *                                - `accessToken` (string): The access token for API access.
+     *                                - `refreshToken` (string): The refresh token for acquiring new access tokens.
+     *                                - `expiresIn` (number): The expiration time (in seconds) of the access token.
+     *                                - `refreshExpiresIn` (number): The expiration time (in seconds) of the refresh token.
+     * @throws {HttpError} If the server instance is not initialized.
+     */
+    generateAuthTokens(authUser: AuthUser, scope?: AuthScope, source?: AuthSource): Promise<AuthTokens>;
+    /**
+     * Logs out a user by updating their authentication information with a logout timestamp.
+     *
+     * @param {number} id - The unique identifier of the user to be logged out.
+     * @return {Promise<boolean>} A promise that resolves to a boolean indicating whether the logout operation was
+     * successful.
+     */
+    logout(id: number): Promise<boolean>;
+}