@auth/dgraph-adapter 1.0.0

package/index.js

@@ -0,0 +1,499 @@
+/**
+ * <div style={{display: "flex", justifyContent: "space-between", alignItems: "center", padding: 16}}>
+ *  <p style={{fontWeight: "normal"}}>Official <a href="https://dgraph.io/docs">Dgraph</a> adapter for Auth.js / NextAuth.js.</p>
+ *  <a href="https://dgraph.io/">
+ *   <img style={{display: "block"}} src="https://authjs.dev/img/adapters/dgraph.svg" width="100"/>
+ *  </a>
+ * </div>
+ *
+ * ## Installation
+ *
+ * ```bash npm2yarn2pnpm
+ * npm install next-auth @auth/dgraph-adapter
+ * ```
+ *
+ * @module @auth/dgraph-adapter
+ */
+import { client as dgraphClient } from "./lib/client";
+import { format } from "./lib/utils";
+import * as defaultFragments from "./lib/graphql/fragments";
+export { format };
+/**
+ * ## Setup
+ *
+ * Add this adapter to your `pages/api/[...nextauth].js` next-auth configuration object:
+ *
+ * ```ts title="pages/api/auth/[...nextauth].js"
+ * import NextAuth from "next-auth"
+ * import { DgraphAdapter } from "@auth/dgraph-adapter"
+ *
+ * export default NextAuth({
+ *   providers: [],
+ *   adapter: DgraphAdapter({
+ *     endpoint: process.env.DGRAPH_GRAPHQL_ENDPOINT,
+ *     authToken: process.env.DGRAPH_GRAPHQL_KEY,
+ *     // you can omit the following properties if you are running an unsecure schema
+ *     authHeader: process.env.AUTH_HEADER, // default: "Authorization",
+ *     jwtSecret: process.env.SECRET,
+ *   }),
+ * })
+ * ```
+ *
+ * ### Unsecure schema
+ *
+ * The quickest way to use Dgraph is by applying the unsecure schema to your [local](https://dgraph.io/docs/graphql/admin/#modifying-a-schema) Dgraph instance or if using Dgraph [cloud](https://dgraph.io/docs/cloud/cloud-quick-start/#the-schema) you can paste the schema in the codebox to update.
+ *
+ * :::warning
+ * This approach is not secure or for production use, and does not require a `jwtSecret`.
+ * :::
+ *
+ * > This schema is adapted for use in Dgraph and based upon our main [schema](https://authjs.dev/reference/adapters#models)
+ *
+ * #### Example
+ *
+ *```graphql
+ *  type Account {
+ *    id: ID
+ *    type: String
+ *    provider: String @search(by: [hash])
+ *    providerAccountId: String @search(by: [hash])
+ *    refreshToken: String
+ *    expires_at: Int64
+ *    accessToken: String
+ *    token_type: String
+ *    refresh_token: String
+ *    access_token: String
+ *    scope: String
+ *    id_token: String
+ *    session_state: String
+ *    user: User @hasInverse(field: "accounts")
+ *  }
+ *  type Session {
+ *    id: ID
+ *    expires: DateTime
+ *    sessionToken: String @search(by: [hash])
+ *    user: User @hasInverse(field: "sessions")
+ *  }
+ *  type User {
+ *    id: ID
+ *    name: String
+ *    email: String @search(by: [hash])
+ *    emailVerified: DateTime
+ *    image: String
+ *    accounts: [Account] @hasInverse(field: "user")
+ *    sessions: [Session] @hasInverse(field: "user")
+ *  }
+ *
+ *  type VerificationToken {
+ *    id: ID
+ *    identifier: String @search(by: [hash])
+ *    token: String @search(by: [hash])
+ *    expires: DateTime
+ *  }
+ *```
+ *
+ * ### Secure schema
+ *
+ * For production deployments you will want to restrict the access to the types used
+ * by next-auth. The main form of access control used in Dgraph is via `@auth` directive alongside types in the schema.
+ * #### Example
+ *
+ * ```graphql
+ * type Account
+ *   @auth(
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     query: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: { rule: "{$nextAuth: { eq: true } }" }
+ *   ) {
+ *   id: ID
+ *   type: String
+ *   provider: String @search(by: [hash])
+ *   providerAccountId: String @search(by: [hash])
+ *   refreshToken: String
+ *   expires_at: Int64
+ *   accessToken: String
+ *   token_type: String
+ *   refresh_token: String
+ *   access_token: String
+ *   scope: String
+ *   id_token: String
+ *   session_state: String
+ *   user: User @hasInverse(field: "accounts")
+ * }
+ * type Session
+ *   @auth(
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     query: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: { rule: "{$nextAuth: { eq: true } }" }
+ *   ) {
+ *   id: ID
+ *   expires: DateTime
+ *   sessionToken: String @search(by: [hash])
+ *   user: User @hasInverse(field: "sessions")
+ * }
+ * type User
+ *   @auth(
+ *     query: {
+ *       or: [
+ *         {
+ *           rule: """
+ *           query ($userId: String!) {queryUser(filter: { id: { eq: $userId } } ) {id}}
+ *           """
+ *         }
+ *         { rule: "{$nextAuth: { eq: true } }" }
+ *       ]
+ *     }
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: {
+ *       or: [
+ *         {
+ *           rule: """
+ *           query ($userId: String!) {queryUser(filter: { id: { eq: $userId } } ) {id}}
+ *           """
+ *         }
+ *         { rule: "{$nextAuth: { eq: true } }" }
+ *       ]
+ *     }
+ *   ) {
+ *   id: ID
+ *   name: String
+ *   email: String @search(by: [hash])
+ *   emailVerified: DateTime
+ *   image: String
+ *   accounts: [Account] @hasInverse(field: "user")
+ *   sessions: [Session] @hasInverse(field: "user")
+ * }
+ *
+ * type VerificationToken
+ *   @auth(
+ *     delete: { rule: "{$nextAuth: { eq: true } }" }
+ *     add: { rule: "{$nextAuth: { eq: true } }" }
+ *     query: { rule: "{$nextAuth: { eq: true } }" }
+ *     update: { rule: "{$nextAuth: { eq: true } }" }
+ *   ) {
+ *   id: ID
+ *   identifier: String @search(by: [hash])
+ *   token: String @search(by: [hash])
+ *   expires: DateTime
+ * }
+ *
+ * # Dgraph.Authorization {"VerificationKey":"<YOUR JWT SECRET HERE>","Header":"<YOUR AUTH HEADER HERE>","Namespace":"<YOUR CUSTOM NAMESPACE HERE>","Algo":"HS256"}
+ * ```
+ *
+ *  ### Dgraph.Authorization
+ *
+ *  In order to secure your graphql backend define the `Dgraph.Authorization` object at the
+ *  bottom of your schema and provide `authHeader` and `jwtSecret` values to the DgraphClient.
+ *
+ *  ```js
+ *  # Dgraph.Authorization {"VerificationKey":"<YOUR JWT SECRET HERE>","Header":"<YOUR AUTH HEADER HERE>","Namespace":"YOUR CUSTOM NAMESPACE HERE","Algo":"HS256"}
+ *  ```
+ *
+ *  ### VerificationKey and jwtSecret
+ *
+ *  This is the key used to sign the JWT. Ex. `process.env.SECRET` or `process.env.APP_SECRET`.
+ *
+ *  ### Header and authHeader
+ *
+ *  The `Header` tells Dgraph where to lookup a JWT within the headers of the incoming requests made to the dgraph server.
+ *  You have to configure it at the bottom of your schema file. This header is the same as the `authHeader` property you
+ *  provide when you instantiate the `DgraphClient`.
+ *
+ *  ### The nextAuth secret
+ *
+ *  The `$nextAuth` secret is securely generated using the `jwtSecret` and injected by the DgraphAdapter in order to allow interacting with the JWT DgraphClient for anonymous user requests made within the system `ie. login, register`. This allows
+ *  secure interactions to be made with all the auth types required by next-auth. You have to specify it for each auth rule of
+ *  each type defined in your secure schema.
+ *
+ *  ```js
+ *  type VerificationRequest
+ *    @auth(
+ *      delete: { rule: "{$nextAuth: { eq: true } }" },
+ *      add: { rule: "{$nextAuth: { eq: true } }" },
+ *      query: { rule: "{$nextAuth: { eq: true } }" },
+ *      update: { rule: "{$nextAuth: { eq: true } }" }
+ *    ) {
+ *   ...
+ *  }
+ *  ```
+ *
+ *  ### JWT session and `@auth` directive
+ *
+ * Dgraph only works with HS256 or RS256 algorithms. If you want to use session jwt to securely interact with your dgraph
+ * database you must customize next-auth `encode` and `decode` functions, as the default algorithm is HS512. You can
+ * further customize the jwt with roles if you want to implement [`RBAC logic`](https://dgraph.io/docs/graphql/authorization/directive/#role-based-access-control).
+ *
+ * ```js
+ * import * as jwt from "jsonwebtoken"
+ * export default NextAuth({
+ *   session: {
+ *     strategy: "jwt",
+ *   },
+ *   jwt: {
+ *     secret: process.env.SECRET,
+ *     encode: async ({ secret, token }) => {
+ *       return jwt.sign({ ...token, userId: token.id }, secret, {
+ *         algorithm: "HS256",
+ *         expiresIn: 30 * 24 * 60 * 60, // 30 days
+ *       })
+ *     },
+ *     decode: async ({ secret, token }) => {
+ *       return jwt.verify(token, secret, { algorithms: ["HS256"] })
+ *     },
+ *   },
+ * })
+ * ```
+ *
+ * Once your `Dgraph.Authorization` is defined in your schema and the JWT settings are set, this will allow you to define
+ * [`@auth rules`](https://dgraph.io/docs/graphql/authorization/authorization-overview/) for every part of your schema.
+ **/
+export function DgraphAdapter(client, options) {
+    const c = dgraphClient(client);
+    const fragments = { ...defaultFragments, ...options?.fragments };
+    return {
+        async createUser(input) {
+            const result = await c.run(
+            /* GraphQL */ `
+          mutation ($input: [AddUserInput!]!) {
+            addUser(input: $input) {
+              user {
+                ...UserFragment
+              }
+            }
+          }
+          ${fragments.User}
+        `, { input });
+            return format.from(result?.user[0]);
+        },
+        async getUser(id) {
+            const result = await c.run(
+            /* GraphQL */ `
+          query ($id: ID!) {
+            getUser(id: $id) {
+              ...UserFragment
+            }
+          }
+          ${fragments.User}
+        `, { id });
+            return format.from(result);
+        },
+        async getUserByEmail(email) {
+            const [user] = await c.run(
+            /* GraphQL */ `
+          query ($email: String = "") {
+            queryUser(filter: { email: { eq: $email } }) {
+              ...UserFragment
+            }
+          }
+          ${fragments.User}
+        `, { email });
+            return format.from(user);
+        },
+        async getUserByAccount(provider_providerAccountId) {
+            const [account] = await c.run(
+            /* GraphQL */ `
+          query ($providerAccountId: String = "", $provider: String = "") {
+            queryAccount(
+              filter: {
+                and: {
+                  providerAccountId: { eq: $providerAccountId }
+                  provider: { eq: $provider }
+                }
+              }
+            ) {
+              user {
+                ...UserFragment
+              }
+              id
+            }
+          }
+          ${fragments.User}
+        `, provider_providerAccountId);
+            return format.from(account?.user);
+        },
+        async updateUser({ id, ...input }) {
+            const result = await c.run(
+            /* GraphQL */ `
+          mutation ($id: [ID!] = "", $input: UserPatch) {
+            updateUser(input: { filter: { id: $id }, set: $input }) {
+              user {
+                ...UserFragment
+              }
+            }
+          }
+          ${fragments.User}
+        `, { id, input });
+            return format.from(result.user[0]);
+        },
+        async deleteUser(id) {
+            const result = await c.run(
+            /* GraphQL */ `
+          mutation ($id: [ID!] = "") {
+            deleteUser(filter: { id: $id }) {
+              numUids
+              user {
+                accounts {
+                  id
+                }
+                sessions {
+                  id
+                }
+              }
+            }
+          }
+        `, { id });
+            const deletedUser = format.from(result.user[0]);
+            await c.run(
+            /* GraphQL */ `
+          mutation ($accounts: [ID!], $sessions: [ID!]) {
+            deleteAccount(filter: { id: $accounts }) {
+              numUids
+            }
+            deleteSession(filter: { id: $sessions }) {
+              numUids
+            }
+          }
+        `, {
+                sessions: deletedUser.sessions.map((x) => x.id),
+                accounts: deletedUser.accounts.map((x) => x.id),
+            });
+            return deletedUser;
+        },
+        async linkAccount(data) {
+            const { userId, ...input } = data;
+            await c.run(
+            /* GraphQL */ `
+          mutation ($input: [AddAccountInput!]!) {
+            addAccount(input: $input) {
+              account {
+                ...AccountFragment
+              }
+            }
+          }
+          ${fragments.Account}
+        `, { input: { ...input, user: { id: userId } } });
+            return data;
+        },
+        async unlinkAccount(provider_providerAccountId) {
+            await c.run(
+            /* GraphQL */ `
+          mutation ($providerAccountId: String = "", $provider: String = "") {
+            deleteAccount(
+              filter: {
+                and: {
+                  providerAccountId: { eq: $providerAccountId }
+                  provider: { eq: $provider }
+                }
+              }
+            ) {
+              numUids
+            }
+          }
+        `, provider_providerAccountId);
+        },
+        async getSessionAndUser(sessionToken) {
+            const [sessionAndUser] = await c.run(
+            /* GraphQL */ `
+          query ($sessionToken: String = "") {
+            querySession(filter: { sessionToken: { eq: $sessionToken } }) {
+              ...SessionFragment
+              user {
+                ...UserFragment
+              }
+            }
+          }
+          ${fragments.User}
+          ${fragments.Session}
+        `, { sessionToken });
+            if (!sessionAndUser)
+                return null;
+            const { user, ...session } = sessionAndUser;
+            return {
+                user: format.from(user),
+                session: { ...format.from(session), userId: user.id },
+            };
+        },
+        async createSession(data) {
+            const { userId, ...input } = data;
+            await c.run(
+            /* GraphQL */ `
+          mutation ($input: [AddSessionInput!]!) {
+            addSession(input: $input) {
+              session {
+                ...SessionFragment
+              }
+            }
+          }
+          ${fragments.Session}
+        `, { input: { ...input, user: { id: userId } } });
+            return data;
+        },
+        async updateSession({ sessionToken, ...input }) {
+            const result = await c.run(
+            /* GraphQL */ `
+          mutation ($input: SessionPatch = {}, $sessionToken: String) {
+            updateSession(
+              input: {
+                filter: { sessionToken: { eq: $sessionToken } }
+                set: $input
+              }
+            ) {
+              session {
+                ...SessionFragment
+                user {
+                  id
+                }
+              }
+            }
+          }
+          ${fragments.Session}
+        `, { sessionToken, input });
+            const session = format.from(result.session[0]);
+            if (!session?.user?.id)
+                return null;
+            return { ...session, userId: session.user.id };
+        },
+        async deleteSession(sessionToken) {
+            await c.run(
+            /* GraphQL */ `
+          mutation ($sessionToken: String = "") {
+            deleteSession(filter: { sessionToken: { eq: $sessionToken } }) {
+              numUids
+            }
+          }
+        `, { sessionToken });
+        },
+        async createVerificationToken(input) {
+            const result = await c.run(
+            /* GraphQL */ `
+          mutation ($input: [AddVerificationTokenInput!]!) {
+            addVerificationToken(input: $input) {
+              numUids
+            }
+          }
+        `, { input });
+            return format.from(result);
+        },
+        async useVerificationToken(params) {
+            const result = await c.run(
+            /* GraphQL */ `
+          mutation ($token: String = "", $identifier: String = "") {
+            deleteVerificationToken(
+              filter: {
+                and: { token: { eq: $token }, identifier: { eq: $identifier } }
+              }
+            ) {
+              verificationToken {
+                ...VerificationTokenFragment
+              }
+            }
+          }
+          ${fragments.VerificationToken}
+        `, params);
+            return format.from(result.verificationToken[0]);
+        },
+    };
+}

package/lib/client.d.ts

@@ -0,0 +1,31 @@
+export interface DgraphClientParams {
+    endpoint: string;
+    /**
+     * `X-Auth-Token` header value
+     *
+     * [Dgraph Cloud Authentication](https://dgraph.io/docs/cloud/cloud-api/overview/#dgraph-cloud-authentication)
+     */
+    authToken: string;
+    /** [Using JWT and authorization claims](https://dgraph.io/docs/graphql/authorization/authorization-overview#using-jwts-and-authorization-claims) */
+    jwtSecret?: string;
+    /**
+     * @default "RS256"
+     *
+     * [Using JWT and authorization claims](https://dgraph.io/docs/graphql/authorization/authorization-overview#using-jwts-and-authorization-claims)
+     */
+    jwtAlgorithm?: "HS256" | "RS256";
+    /**
+     * @default "Authorization"
+     *
+     * [Using JWT and authorization claims](https://dgraph.io/docs/graphql/authorization/authorization-overview#using-jwts-and-authorization-claims)
+     */
+    authHeader?: string;
+}
+export declare class DgraphClientError extends Error {
+    name: string;
+    constructor(errors: any[], query: string, variables: any);
+}
+export declare function client(params: DgraphClientParams): {
+    run<T>(query: string, variables?: Record<string, any>): Promise<T | null>;
+};
+//# sourceMappingURL=client.d.ts.map

package/lib/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/lib/client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,IAAI,SAAsB;gBACd,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG;CAIzD;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,kBAAkB;kBA4BpC,MAAM,cACD,OAAO,MAAM,EAAE,GAAG,CAAC;EAepC"}

package/lib/client.js

@@ -0,0 +1,40 @@
+import * as jwt from "jsonwebtoken";
+export class DgraphClientError extends Error {
+    constructor(errors, query, variables) {
+        super(errors.map((error) => error.message).join("\n"));
+        this.name = "DgraphClientError";
+        console.error({ query, variables });
+    }
+}
+export function client(params) {
+    if (!params.authToken) {
+        throw new Error("Dgraph client error: Please provide an api key");
+    }
+    if (!params.endpoint) {
+        throw new Error("Dgraph client error: Please provide a graphql endpoint");
+    }
+    const { endpoint, authToken, jwtSecret, jwtAlgorithm = "HS256", authHeader = "Authorization", } = params;
+    const headers = {
+        "Content-Type": "application/json",
+        "X-Auth-Token": authToken,
+    };
+    if (authHeader && jwtSecret) {
+        headers[authHeader] = jwt.sign({ nextAuth: true }, jwtSecret, {
+            algorithm: jwtAlgorithm,
+        });
+    }
+    return {
+        async run(query, variables) {
+            const response = await fetch(endpoint, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ query, variables }),
+            });
+            const { data = {}, errors } = await response.json();
+            if (errors?.length) {
+                throw new DgraphClientError(errors, query, variables);
+            }
+            return Object.values(data)[0];
+        },
+    };
+}

package/lib/graphql/fragments.d.ts

@@ -0,0 +1,5 @@
+export declare const User = "\n  fragment UserFragment on User {\n    email\n    id\n    image\n    name\n    emailVerified\n  }\n";
+export declare const Account = "\n  fragment AccountFragment on Account {\n    id\n    type\n    provider\n    providerAccountId\n    expires_at\n    token_type\n    scope\n    access_token\n    refresh_token\n    id_token\n    session_state\n  }\n";
+export declare const Session = "\n  fragment SessionFragment on Session {\n    expires\n    id\n    sessionToken\n  }\n";
+export declare const VerificationToken = "\n  fragment VerificationTokenFragment on VerificationToken {\n    identifier\n    token\n    expires\n  }\n";
+//# sourceMappingURL=fragments.d.ts.map

package/lib/graphql/fragments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragments.d.ts","sourceRoot":"","sources":["../../src/lib/graphql/fragments.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,IAAI,0GAQhB,CAAA;AAED,eAAO,MAAM,OAAO,6NAcnB,CAAA;AACD,eAAO,MAAM,OAAO,4FAMnB,CAAA;AAED,eAAO,MAAM,iBAAiB,iHAM7B,CAAA"}

package/lib/graphql/fragments.js

@@ -0,0 +1,38 @@
+export const User = /* GraphQL */ `
+  fragment UserFragment on User {
+    email
+    id
+    image
+    name
+    emailVerified
+  }
+`;
+export const Account = /* GraphQL */ `
+  fragment AccountFragment on Account {
+    id
+    type
+    provider
+    providerAccountId
+    expires_at
+    token_type
+    scope
+    access_token
+    refresh_token
+    id_token
+    session_state
+  }
+`;
+export const Session = /* GraphQL */ `
+  fragment SessionFragment on Session {
+    expires
+    id
+    sessionToken
+  }
+`;
+export const VerificationToken = /* GraphQL */ `
+  fragment VerificationTokenFragment on VerificationToken {
+    identifier
+    token
+    expires
+  }
+`;

package/lib/utils.d.ts

@@ -0,0 +1,4 @@
+export declare const format: {
+    from<T>(object?: Record<string, any>): T | null;
+};
+//# sourceMappingURL=utils.d.ts.map

package/lib/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/lib/utils.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,MAAM;qBACA,OAAO,MAAM,EAAE,GAAG,CAAC;CAcrC,CAAA"}

package/lib/utils.js

@@ -0,0 +1,22 @@
+// https://github.com/honeinc/is-iso-date/blob/master/index.js
+const isoDateRE = /(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d\.\d+([+-][0-2]\d:[0-5]\d|Z))|(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d([+-][0-2]\d:[0-5]\d|Z))|(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d([+-][0-2]\d:[0-5]\d|Z))/;
+function isDate(value) {
+    return value && isoDateRE.test(value) && !isNaN(Date.parse(value));
+}
+export const format = {
+    from(object) {
+        const newObject = {};
+        if (!object)
+            return null;
+        for (const key in object) {
+            const value = object[key];
+            if (isDate(value)) {
+                newObject[key] = new Date(value);
+            }
+            else {
+                newObject[key] = value;
+            }
+        }
+        return newObject;
+    },
+};