@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/magic-link.js

@@ -0,0 +1,204 @@
+// src/core/auth/refresh-token.ts
+async function generateRefreshToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const raw = base64UrlEncode(bytes);
+  const hash = await hashToken(raw);
+  return { raw, hash };
+}
+async function hashToken(raw) {
+  const data = new TextEncoder().encode(raw);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return hexEncode(new Uint8Array(hashBuffer));
+}
+function base64UrlEncode(bytes) {
+  const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
+  return btoa(binString).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function hexEncode(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/magic-link/index.ts
+function magicLink(config = {}) {
+  const tokenExpirySeconds = config.tokenExpirySeconds ?? 600;
+  return {
+    name: "magic-link",
+    models: [{
+      name: "magic_link_token",
+      fields: {
+        id: { type: "number", required: true },
+        email: { type: "string", required: true },
+        token: { type: "string", required: true },
+        expiresAt: { type: "date", required: true },
+        usedAt: { type: "date" },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    methods: (ctx) => ({
+      async sendMagicLink(email) {
+        const { raw, hash } = await generateRefreshToken();
+        const expiresAt = new Date(Date.now() + tokenExpirySeconds * 1e3);
+        await ctx.db.create({
+          model: "magic_link_token",
+          data: {
+            email,
+            token: hash,
+            expiresAt,
+            usedAt: null
+          }
+        });
+        if (config.onSendMagicLink) {
+          await config.onSendMagicLink(email, raw);
+        }
+        return { sent: true };
+      },
+      async verify(rawToken, meta) {
+        const hash = await hashToken(rawToken);
+        const usedAt = /* @__PURE__ */ new Date();
+        const record = await ctx.db.transaction((tx) => tx.update({
+          model: "magic_link_token",
+          where: [
+            { field: "token", operator: "=", value: hash },
+            { field: "usedAt", operator: "isNull", value: null },
+            { field: "expiresAt", operator: "gt", value: usedAt }
+          ],
+          data: { usedAt }
+        }));
+        if (!record)
+          throw Errors.notFound("Invalid or expired magic link token");
+        let user = await ctx.db.findOne({
+          model: "user",
+          where: [{ field: "email", operator: "=", value: record.email }]
+        });
+        if (!user) {
+          user = await ctx.auth.createUser({
+            email: record.email,
+            name: record.email.split("@")[0]
+          });
+        }
+        if (!user.emailVerified) {
+          await ctx.db.update({
+            model: "user",
+            where: [{ field: "id", operator: "=", value: user.id }],
+            data: { emailVerified: true }
+          });
+        }
+        if (!ctx.auth)
+          throw Errors.badRequest("Auth service is unavailable");
+        return ctx.auth.completePluginAuth(user.id, "magic-link", meta);
+      }
+    })
+  };
+}
+export {
+  magicLink
+};