@axiom-lattice/gateway 2.1.28 → 2.1.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/gateway",
-  "version": "2.1.28",
+  "version": "2.1.30",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
@@ -36,9 +36,9 @@
     "pino-roll": "^3.1.0",
     "redis": "^5.0.1",
     "uuid": "^9.0.1",
-    "@axiom-lattice/core": "2.1.23",
-    "@axiom-lattice/protocols": "2.1.13",
-    "@axiom-lattice/queue-redis": "1.0.12"
+    "@axiom-lattice/core": "2.1.25",
+    "@axiom-lattice/protocols": "2.1.15",
+    "@axiom-lattice/queue-redis": "1.0.14"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/controllers/auth.ts

@@ -0,0 +1,443 @@
+import { FastifyInstance, FastifyRequest, FastifyReply } from "fastify";
+import { getStoreLattice } from "@axiom-lattice/core";
+import { v4 as uuidv4 } from "uuid";
+import type { CreateUserRequest, CreateTenantRequest, UserTenantRole } from "@axiom-lattice/protocols";
+
+interface RegisterRequest {
+  email: string;
+  password: string;
+  name: string;
+}
+
+interface LoginRequest {
+  email: string;
+  password: string;
+}
+
+interface SelectTenantRequest {
+  tenantId: string;
+}
+
+interface ApproveUserRequest {
+  userId: string;
+  approved: boolean;
+}
+
+interface AssignTenantRequest {
+  userId: string;
+  tenantId: string;
+  role?: UserTenantRole;
+}
+
+export interface AuthConfig {
+  autoApproveUsers: boolean;
+  allowTenantRegistration: boolean;
+  jwtSecret?: string;
+  tokenExpiration: number;
+}
+
+const defaultAuthConfig: AuthConfig = {
+  autoApproveUsers: true,
+  allowTenantRegistration: true,
+  tokenExpiration: 86400,
+};
+
+export class AuthController {
+  private userStore;
+  private tenantStore;
+  private userTenantLinkStore;
+  private config: AuthConfig;
+
+  constructor(config: Partial<AuthConfig> = {}) {
+    this.userStore = getStoreLattice("default", "user").store;
+    this.tenantStore = getStoreLattice("default", "tenant").store;
+    this.userTenantLinkStore = getStoreLattice("default", "userTenantLink").store;
+    this.config = { ...defaultAuthConfig, ...config };
+  }
+
+  async register(
+    request: FastifyRequest<{ Body: RegisterRequest }>,
+    reply: FastifyReply
+  ) {
+    const { email, password, name } = request.body;
+
+    try {
+      const existingUser = await this.userStore.getUserByEmail(email);
+      if (existingUser) {
+        return reply.status(409).send({
+          success: false,
+          error: "User with this email already exists",
+        });
+      }
+
+      const userId = uuidv4();
+      const userStatus = this.config.autoApproveUsers ? "active" : "pending";
+      
+      const userData: CreateUserRequest = {
+        email,
+        name,
+        status: userStatus,
+        metadata: {
+          passwordHash: await this.hashPassword(password),
+        },
+      };
+
+      const user = await this.userStore.createUser(userId, userData);
+
+      return reply.status(201).send({
+        success: true,
+        message: this.config.autoApproveUsers
+          ? "Registration successful"
+          : "Registration successful. Please wait for admin approval.",
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            status: user.status,
+          },
+        },
+      });
+    } catch (error) {
+      console.error("Registration error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Registration failed",
+      });
+    }
+  }
+
+  async login(
+    request: FastifyRequest<{ Body: LoginRequest }>,
+    reply: FastifyReply
+  ) {
+    const { email, password } = request.body;
+
+    try {
+      const user = await this.userStore.getUserByEmail(email);
+      if (!user) {
+        return reply.status(401).send({
+          success: false,
+          error: "Invalid credentials",
+        });
+      }
+
+      if (user.status !== "active") {
+        return reply.status(403).send({
+          success: false,
+          error: `Account is ${user.status}. Please wait for admin approval.`,
+        });
+      }
+
+      const isValidPassword = await this.verifyPassword(
+        password,
+        user.metadata?.passwordHash || ""
+      );
+
+      if (!isValidPassword) {
+        return reply.status(401).send({
+          success: false,
+          error: "Invalid credentials",
+        });
+      }
+
+      const tenantLinks = await this.userTenantLinkStore.getTenantsByUser(user.id);
+      
+      const token = await this.generateToken(user.id);
+
+      return {
+        success: true,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            status: user.status,
+          },
+          tenants: tenantLinks.map(link => ({
+            id: link.tenantId,
+            role: link.role,
+          })),
+          token,
+          requiresTenantSelection: tenantLinks.length > 1,
+          hasTenants: tenantLinks.length > 0,
+        },
+      };
+    } catch (error) {
+      console.error("Login error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Login failed",
+      });
+    }
+  }
+
+  async getUserTenants(
+    request: FastifyRequest,
+    reply: FastifyReply
+  ) {
+    const userId = (request as any).user?.id;
+    
+    if (!userId) {
+      return reply.status(401).send({
+        success: false,
+        error: "Unauthorized",
+      });
+    }
+
+    try {
+      const links = await this.userTenantLinkStore.getTenantsByUser(userId);
+      
+      const tenantsWithDetails = await Promise.all(
+        links.map(async (link) => {
+          const tenant = await this.tenantStore.getTenantById(link.tenantId);
+          return {
+            ...link,
+            tenant: tenant || null,
+          };
+        })
+      );
+
+      return {
+        success: true,
+        data: tenantsWithDetails,
+      };
+    } catch (error) {
+      console.error("Get user tenants error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Failed to get user tenants",
+      });
+    }
+  }
+
+  async selectTenant(
+    request: FastifyRequest<{ Body: SelectTenantRequest }>,
+    reply: FastifyReply
+  ) {
+    const userId = (request as any).user?.id;
+    const { tenantId } = request.body;
+
+    if (!userId) {
+      return reply.status(401).send({
+        success: false,
+        error: "Unauthorized",
+      });
+    }
+
+    try {
+      const hasLink = await this.userTenantLinkStore.hasLink(userId, tenantId);
+      
+      if (!hasLink) {
+        return reply.status(403).send({
+          success: false,
+          error: "You do not have access to this tenant",
+        });
+      }
+
+      const tenant = await this.tenantStore.getTenantById(tenantId);
+      
+      if (!tenant) {
+        return reply.status(404).send({
+          success: false,
+          error: "Tenant not found",
+        });
+      }
+
+      const token = await this.generateToken(userId, tenantId);
+
+      return {
+        success: true,
+        data: {
+          tenant: {
+            id: tenant.id,
+            name: tenant.name,
+            status: tenant.status,
+          },
+          token,
+        },
+      };
+    } catch (error) {
+      console.error("Select tenant error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Failed to select tenant",
+      });
+    }
+  }
+
+  async approveUser(
+    request: FastifyRequest<{ Body: ApproveUserRequest }>,
+    reply: FastifyReply
+  ) {
+    const { userId, approved } = request.body;
+
+    try {
+      const user = await this.userStore.getUserById(userId);
+      if (!user) {
+        return reply.status(404).send({
+          success: false,
+          error: "User not found",
+        });
+      }
+
+      if (user.status !== "pending") {
+        return reply.status(400).send({
+          success: false,
+          error: `User is already ${user.status}`,
+        });
+      }
+
+      const updatedUser = await this.userStore.updateUser(userId, {
+        status: approved ? "active" : "suspended",
+      });
+
+      return {
+        success: true,
+        data: updatedUser,
+      };
+    } catch (error) {
+      console.error("Approval error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Approval failed",
+      });
+    }
+  }
+
+  async listPendingUsers(
+    request: FastifyRequest,
+    reply: FastifyReply
+  ) {
+    try {
+      const users = await this.userStore.getAllUsers();
+      const pendingUsers = users.filter((u) => u.status === "pending");
+
+      return {
+        success: true,
+        data: pendingUsers,
+      };
+    } catch (error) {
+      console.error("List pending users error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Failed to list pending users",
+      });
+    }
+  }
+
+  async assignTenant(
+    request: FastifyRequest<{ Body: AssignTenantRequest }>,
+    reply: FastifyReply
+  ) {
+    const { userId, tenantId, role = "member" } = request.body;
+
+    try {
+      const user = await this.userStore.getUserById(userId);
+      if (!user) {
+        return reply.status(404).send({
+          success: false,
+          error: "User not found",
+        });
+      }
+
+      const tenant = await this.tenantStore.getTenantById(tenantId);
+      if (!tenant) {
+        return reply.status(404).send({
+          success: false,
+          error: "Tenant not found",
+        });
+      }
+
+      const link = await this.userTenantLinkStore.createLink({
+        userId,
+        tenantId,
+        role,
+      });
+
+      return {
+        success: true,
+        data: link,
+      };
+    } catch (error) {
+      console.error("Assign tenant error:", error);
+      return reply.status(500).send({
+        success: false,
+        error: "Failed to assign tenant",
+      });
+    }
+  }
+
+  private async hashPassword(password: string): Promise<string> {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(password + "salt");
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+
+  private async verifyPassword(password: string, hash: string): Promise<boolean> {
+    const hashedPassword = await this.hashPassword(password);
+    return hashedPassword === hash;
+  }
+
+  private async generateToken(userId: string, tenantId?: string): Promise<string> {
+    const payload: any = {
+      userId,
+      exp: Date.now() + this.config.tokenExpiration * 1000,
+    };
+    if (tenantId) {
+      payload.tenantId = tenantId;
+    }
+    return btoa(JSON.stringify(payload));
+  }
+}
+
+export function registerAuthRoutes(
+  app: FastifyInstance,
+  config?: Partial<AuthConfig>
+) {
+  const controller = new AuthController(config);
+
+  const authHook = async (request: FastifyRequest, reply: FastifyReply) => {
+    const authHeader = request.headers.authorization;
+
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      return reply.status(401).send({
+        success: false,
+        error: "Unauthorized - Missing or invalid token",
+      });
+    }
+
+    const token = authHeader.substring(7);
+
+    try {
+      const payload = JSON.parse(atob(token));
+
+      if (payload.exp && payload.exp < Date.now()) {
+        return reply.status(401).send({
+          success: false,
+          error: "Unauthorized - Token expired",
+        });
+      }
+
+      (request as any).user = {
+        id: payload.userId,
+        tenantId: payload.tenantId,
+      };
+    } catch {
+      return reply.status(401).send({
+        success: false,
+        error: "Unauthorized - Invalid token",
+      });
+    }
+  };
+
+  app.post("/api/auth/register", controller.register.bind(controller));
+  app.post("/api/auth/login", controller.login.bind(controller));
+  app.get("/api/auth/tenants", { preHandler: authHook }, (req, res) => controller.getUserTenants(req, res));
+  app.post("/api/auth/select-tenant", { preHandler: authHook }, (req, res) => controller.selectTenant(req as any, res));
+  app.post("/api/auth/approve", { preHandler: authHook }, (req, res) => controller.approveUser(req as any, res));
+  app.get("/api/auth/pending", { preHandler: authHook }, (req, res) => controller.listPendingUsers(req, res));
+  app.post("/api/auth/assign-tenant", { preHandler: authHook }, (req, res) => controller.assignTenant(req as any, res));
+}