@baseplate-dev/plugin-auth 0.1.2 → 0.6.2

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.js

@@ -0,0 +1,35 @@
+// @ts-nocheck
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { prisma } from '%prismaImports';
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export async function updateUserRoles({ userId, roles, }) {
+    // Filter out built-in roles (public, user, system)
+    const validRoles = roles.filter((role) => {
+        if (!(role in AUTH_ROLE_CONFIG)) {
+            return false;
+        }
+        const roleConfig = AUTH_ROLE_CONFIG[role];
+        return !roleConfig.builtIn;
+    });
+    await prisma.$transaction([
+        prisma.userRole.deleteMany({
+            where: { userId, role: { notIn: validRoles } },
+        }),
+        prisma.userRole.createMany({
+            data: validRoles.map((role) => ({ userId, role })),
+            skipDuplicates: true,
+        }),
+    ]);
+    return prisma.user.findUnique({
+        where: { id: userId },
+    });
+}
+//# sourceMappingURL=user-roles.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-roles.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAKd,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,KAAK,GAIN;IACC,mDAAmD;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,CAAC,IAAI,IAAI,gBAAgB,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAgB,CAAC,CAAC;QACtD,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;SAC/C,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzB,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,cAAc,EAAE,IAAI;SACrB,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;KACtB,CAAkB,CAAC;AACtB,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.ts

@@ -0,0 +1,47 @@
+// @ts-nocheck
+
+import type { AuthRole } from '%authRolesImports';
+import type { User } from '%prismaGeneratedImports';
+
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { prisma } from '%prismaImports';
+
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export async function updateUserRoles({
+  userId,
+  roles,
+}: {
+  userId: string;
+  roles: string[];
+}): Promise<User> {
+  // Filter out built-in roles (public, user, system)
+  const validRoles = roles.filter((role) => {
+    if (!(role in AUTH_ROLE_CONFIG)) {
+      return false;
+    }
+    const roleConfig = AUTH_ROLE_CONFIG[role as AuthRole];
+    return !roleConfig.builtIn;
+  });
+
+  await prisma.$transaction([
+    prisma.userRole.deleteMany({
+      where: { userId, role: { notIn: validRoles } },
+    }),
+    prisma.userRole.createMany({
+      data: validRoles.map((role) => ({ userId, role })),
+      skipDuplicates: true,
+    }),
+  ]);
+
+  return prisma.user.findUnique({
+    where: { id: userId },
+  }) as Promise<User>;
+}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.d.ts

@@ -0,0 +1,43 @@
+import type { AuthUserSessionInfo } from '%authContextImports';
+import type { RequestServiceContext } from '%requestServiceContextImports';
+import type { UserSessionPayload, UserSessionService } from '%userSessionTypesImports';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+export declare class CookieUserSessionService implements UserSessionService {
+    /**
+     * Creates a user session cookie and sets it in the response.
+     *
+     * @param userId The ID of the user for whom the session is being created.
+     * @param context The request service context
+     * @param currentDate The current date and time. Defaults to the current date and time.
+     * @returns The session payload
+     */
+    createSession(userId: string, context: RequestServiceContext, currentDate?: Date): Promise<UserSessionPayload>;
+    /**
+     * Ends the user session by clearing the session cookie and deleting the session from the database.
+     *
+     * @param sessionInfo The session info
+     * @param context The request service context
+     */
+    clearSession(sessionInfo: AuthUserSessionInfo, context: RequestServiceContext): Promise<void>;
+    /**
+     * Retrieves the user session information from the request.
+     *
+     * @param req - The Fastify request object containing the cookies.
+     * @param reply - The Fastify reply object used to set or clear cookies.
+     * @param currentDate - The current date used for session validation. Defaults to the current date and time.
+     * @returns A promise that resolves to the authenticated user session information or null if the session is invalid.
+     * @throws {InvalidSessionError} If the session is invalid or expired.
+     */
+    getSessionInfoFromRequest(req: FastifyRequest, reply?: FastifyReply): Promise<AuthUserSessionInfo | undefined>;
+    /**
+     * Retrieves the user session information from the authentication token
+     *
+     * Note: Since we use cookies, we ignore the authToken parameter
+     *
+     * @param req The request object
+     * @returns The session info or undefined if no session is found
+     */
+    getSessionInfoFromToken(req: FastifyRequest): Promise<AuthUserSessionInfo | undefined>;
+}
+export declare const userSessionService: CookieUserSessionService;
+//# sourceMappingURL=user-session.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/user-session.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAkF5D,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,EAC9B,WAAW,GAAE,IAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAiC9B;;;;;OAKG;IACG,YAAY,CAChB,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;;OAQG;IACG,yBAAyB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8E3C;;;;;;;OAOG;IACG,uBAAuB,CAC3B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;CAG5C;AAED,eAAO,MAAM,kBAAkB,0BAAiC,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.js

@@ -0,0 +1,190 @@
+// @ts-nocheck
+import { signObject, unsignObject } from '$cookieSigner';
+import { getUserSessionCookieName } from '$sessionCookie';
+import { USER_SESSION_DURATION_SEC, USER_SESSION_MAX_LIFETIME_SEC, USER_SESSION_RENEWAL_THRESHOLD_SEC, } from '$userSessionConstants';
+import { verifyRequestOrigin } from '$verifyRequestOrigin';
+import { InvalidSessionError } from '%authContextImports';
+import { DEFAULT_USER_ROLES } from '%authRolesImports';
+import { config } from '%configServiceImports';
+import { ForbiddenError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+import { randomBytes } from 'node:crypto';
+const COOKIE_OPTIONS = {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: config.APP_ENVIRONMENT !== 'dev',
+    maxAge: USER_SESSION_DURATION_SEC,
+    path: '/',
+};
+/**
+ * Validates the expiry of a user session and determines if it needs to be renewed.
+ *
+ * @param currentDate The current date and time.
+ * @param userSession The session details.
+ * @param userSession.expiresAt The date and time when the session expires.
+ * @param userSession.createdAt The date and time when the session was created.
+ * @param userSession.renewedAt The date and time when the session was last renewed.
+ * @returns The validity of the session and the new expiry date if applicable.
+ */
+function validateSessionExpiry(currentDate, userSession) {
+    // check if session is expired
+    if (userSession.expiresAt < currentDate) {
+        return { valid: false, newExpiry: null };
+    }
+    // check if session needs renewal
+    const shouldRenewBy = userSession.renewedAt.getTime() + USER_SESSION_RENEWAL_THRESHOLD_SEC * 1000;
+    if (shouldRenewBy < currentDate.getTime()) {
+        const newExpiry = currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000;
+        const maxExpiry = USER_SESSION_MAX_LIFETIME_SEC === 0
+            ? undefined
+            : userSession.createdAt.getTime() +
+                USER_SESSION_MAX_LIFETIME_SEC * 1000;
+        return {
+            valid: true,
+            newExpiry: new Date(Math.min(newExpiry, maxExpiry ?? newExpiry)),
+        };
+    }
+    return { valid: true, newExpiry: null };
+}
+/**
+ * Generates a session token
+ *
+ * @returns The session token
+ */
+function generateSessionToken() {
+    return randomBytes(16).toString('base64url');
+}
+export class CookieUserSessionService {
+    /**
+     * Creates a user session cookie and sets it in the response.
+     *
+     * @param userId The ID of the user for whom the session is being created.
+     * @param context The request service context
+     * @param currentDate The current date and time. Defaults to the current date and time.
+     * @returns The session payload
+     */
+    async createSession(userId, context, currentDate = new Date()) {
+        const token = generateSessionToken();
+        const expiresAt = new Date(currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000);
+        await TPL_PRISMA_USER_SESSION.create({
+            data: {
+                user: { connect: { id: userId } },
+                token,
+                expiresAt,
+            },
+        });
+        // Fetch user roles to include in the session payload
+        const user = await prisma.user.findUniqueOrThrow({
+            where: { id: userId },
+            select: { roles: true },
+        });
+        const roles = [
+            ...DEFAULT_USER_ROLES,
+            ...user.roles.map((role) => role.role),
+        ];
+        const cookieName = getUserSessionCookieName(context.reqInfo.headers);
+        const cookieValue = signObject({ token }, config.AUTH_SECRET);
+        context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
+        return { userId, expiresAt, roles };
+    }
+    /**
+     * Ends the user session by clearing the session cookie and deleting the session from the database.
+     *
+     * @param sessionInfo The session info
+     * @param context The request service context
+     */
+    async clearSession(sessionInfo, context) {
+        await TPL_PRISMA_USER_SESSION.delete({
+            where: { id: sessionInfo.id },
+        });
+        const cookieName = getUserSessionCookieName(context.reqInfo.headers);
+        context.cookieStore.clear(cookieName, COOKIE_OPTIONS);
+    }
+    /**
+     * Retrieves the user session information from the request.
+     *
+     * @param req - The Fastify request object containing the cookies.
+     * @param reply - The Fastify reply object used to set or clear cookies.
+     * @param currentDate - The current date used for session validation. Defaults to the current date and time.
+     * @returns A promise that resolves to the authenticated user session information or null if the session is invalid.
+     * @throws {InvalidSessionError} If the session is invalid or expired.
+     */
+    async getSessionInfoFromRequest(req, reply) {
+        const currentDate = new Date();
+        const cookieName = getUserSessionCookieName(req.headers);
+        // Check if the session cookie is present
+        const sessionCookieValue = req.cookies[cookieName];
+        if (!sessionCookieValue)
+            return undefined;
+        // Check Origin header for non-GET/HEAD requests to prevent CSRF attacks
+        if ((req.method !== 'GET' ||
+            req.headers.upgrade?.toLowerCase() === 'websocket') &&
+            req.method !== 'HEAD' &&
+            !verifyRequestOrigin(req, [req.host, ...config.ALLOWED_ORIGINS])) {
+            throw new ForbiddenError('Invalid Origin header');
+        }
+        try {
+            // Unsign the session cookie
+            const sessionCookieResult = unsignObject(sessionCookieValue, config.AUTH_SECRET);
+            if (!sessionCookieResult)
+                throw new InvalidSessionError();
+            const { token } = sessionCookieResult;
+            if (typeof token !== 'string')
+                throw new InvalidSessionError();
+            // Fetch and validate user session
+            const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
+                where: { token },
+                include: { user: { select: { id: true, roles: true } } },
+            });
+            if (!userSession)
+                throw new InvalidSessionError();
+            const sessionExpiryResult = validateSessionExpiry(currentDate, userSession);
+            if (!sessionExpiryResult.valid)
+                throw new InvalidSessionError('Session expired');
+            // renew the session if needed
+            if (sessionExpiryResult.newExpiry && reply) {
+                await TPL_PRISMA_USER_SESSION.update({
+                    where: { id: userSession.id },
+                    data: {
+                        renewedAt: currentDate,
+                        expiresAt: sessionExpiryResult.newExpiry,
+                    },
+                });
+                const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
+                reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
+            }
+            const { user } = userSession;
+            const expiresAt = sessionExpiryResult.newExpiry ?? userSession.expiresAt;
+            return {
+                id: userSession.id,
+                type: 'user',
+                roles: [
+                    ...DEFAULT_USER_ROLES,
+                    ...user.roles.map((role) => role.role),
+                ],
+                userId: user.id,
+                expiresAt,
+            };
+        }
+        catch (err) {
+            // clear the cookie if it's invalid
+            if (err instanceof InvalidSessionError && reply) {
+                reply.clearCookie(cookieName, COOKIE_OPTIONS);
+            }
+            throw err;
+        }
+    }
+    /**
+     * Retrieves the user session information from the authentication token
+     *
+     * Note: Since we use cookies, we ignore the authToken parameter
+     *
+     * @param req The request object
+     * @returns The session info or undefined if no session is found
+     */
+    async getSessionInfoFromToken(req) {
+        return this.getSessionInfoFromRequest(req, undefined);
+    }
+}
+export const userSessionService = new CookieUserSessionService();
+//# sourceMappingURL=user-session.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/user-session.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAYd,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,MAAM,CAAC,eAAe,KAAK,KAAK;IACxC,MAAM,EAAE,yBAAyB;IACjC,IAAI,EAAE,GAAG;CACV,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,WAAiB,EACjB,WAIC;IAED,8BAA8B;IAC9B,IAAI,WAAW,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GACjB,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,kCAAkC,GAAG,IAAI,CAAC;IAE9E,IAAI,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,yBAAyB,GAAG,IAAI,CAAC;QAC3E,MAAM,SAAS,GACb,6BAA6B,KAAK,CAAC;YACjC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC/B,6BAA6B,GAAG,IAAI,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,wBAAwB;IACnC;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAA8B,EAC9B,cAAoB,IAAI,IAAI,EAAE;QAE9B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,WAAW,CAAC,OAAO,EAAE,GAAG,yBAAyB,GAAG,IAAI,CACzD,CAAC;QAEF,MAAM,uBAAuB,CAAC,MAAM,CAAC;YACnC,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;gBACjC,KAAK;gBACL,SAAS;aACV;SACF,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAwB;YACjC,GAAG,kBAAkB;YACrB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAgB,CAAC;SACnD,CAAC;QAEF,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAE9D,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QAEjE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,WAAgC,EAChC,OAA8B;QAE9B,MAAM,uBAAuB,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,yBAAyB,CAC7B,GAAmB,EACnB,KAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEzD,yCAAyC;QACzC,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,kBAAkB;YAAE,OAAO,SAAS,CAAC;QAE1C,wEAAwE;QACxE,IACE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;YACnB,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC;YACrD,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,EAChE,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,uBAAuB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC;YACH,4BAA4B;YAC5B,MAAM,mBAAmB,GAAG,YAAY,CACtC,kBAAkB,EAClB,MAAM,CAAC,WAAW,CACe,CAAC;YACpC,IAAI,CAAC,mBAAmB;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAE1D,MAAM,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAE/D,kCAAkC;YAClC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC;gBAC3D,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;aACzD,CAAC,CAAC;YACH,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAElD,MAAM,mBAAmB,GAAG,qBAAqB,CAC/C,WAAW,EACX,WAAW,CACZ,CAAC;YACF,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAC5B,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YAEnD,8BAA8B;YAC9B,IAAI,mBAAmB,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,uBAAuB,CAAC,MAAM,CAAC;oBACnC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;oBAC7B,IAAI,EAAE;wBACJ,SAAS,EAAE,WAAW;wBACtB,SAAS,EAAE,mBAAmB,CAAC,SAAS;qBACzC;iBACF,CAAC,CAAC;gBACH,MAAM,eAAe,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;gBAClE,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;YAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE;oBACL,GAAG,kBAAkB;oBACrB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAgB,CAAC;iBACnD;gBACD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mCAAmC;YACnC,IAAI,GAAG,YAAY,mBAAmB,IAAI,KAAK,EAAE,CAAC;gBAChD,KAAK,CAAC,WAAW,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,uBAAuB,CAC3B,GAAmB;QAEnB,OAAO,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.ts

@@ -0,0 +1,262 @@
+// @ts-nocheck
+
+import type { AuthUserSessionInfo } from '%authContextImports';
+import type { AuthRole } from '%authRolesImports';
+import type { RequestServiceContext } from '%requestServiceContextImports';
+import type {
+  UserSessionPayload,
+  UserSessionService,
+} from '%userSessionTypesImports';
+import type { CookieSerializeOptions } from '@fastify/cookie';
+import type { FastifyReply, FastifyRequest } from 'fastify';
+
+import { signObject, unsignObject } from '$cookieSigner';
+import { getUserSessionCookieName } from '$sessionCookie';
+import {
+  USER_SESSION_DURATION_SEC,
+  USER_SESSION_MAX_LIFETIME_SEC,
+  USER_SESSION_RENEWAL_THRESHOLD_SEC,
+} from '$userSessionConstants';
+import { verifyRequestOrigin } from '$verifyRequestOrigin';
+import { InvalidSessionError } from '%authContextImports';
+import { DEFAULT_USER_ROLES } from '%authRolesImports';
+import { config } from '%configServiceImports';
+import { ForbiddenError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+import { randomBytes } from 'node:crypto';
+
+interface SessionCookieValue {
+  // Session token
+  token: string;
+}
+
+const COOKIE_OPTIONS: CookieSerializeOptions = {
+  httpOnly: true,
+  sameSite: 'lax',
+  secure: config.APP_ENVIRONMENT !== 'dev',
+  maxAge: USER_SESSION_DURATION_SEC,
+  path: '/',
+};
+
+/**
+ * Validates the expiry of a user session and determines if it needs to be renewed.
+ *
+ * @param currentDate The current date and time.
+ * @param userSession The session details.
+ * @param userSession.expiresAt The date and time when the session expires.
+ * @param userSession.createdAt The date and time when the session was created.
+ * @param userSession.renewedAt The date and time when the session was last renewed.
+ * @returns The validity of the session and the new expiry date if applicable.
+ */
+function validateSessionExpiry(
+  currentDate: Date,
+  userSession: {
+    expiresAt: Date;
+    createdAt: Date;
+    renewedAt: Date;
+  },
+): { valid: boolean; newExpiry: Date | null } {
+  // check if session is expired
+  if (userSession.expiresAt < currentDate) {
+    return { valid: false, newExpiry: null };
+  }
+
+  // check if session needs renewal
+  const shouldRenewBy =
+    userSession.renewedAt.getTime() + USER_SESSION_RENEWAL_THRESHOLD_SEC * 1000;
+
+  if (shouldRenewBy < currentDate.getTime()) {
+    const newExpiry = currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000;
+    const maxExpiry =
+      USER_SESSION_MAX_LIFETIME_SEC === 0
+        ? undefined
+        : userSession.createdAt.getTime() +
+          USER_SESSION_MAX_LIFETIME_SEC * 1000;
+    return {
+      valid: true,
+      newExpiry: new Date(Math.min(newExpiry, maxExpiry ?? newExpiry)),
+    };
+  }
+
+  return { valid: true, newExpiry: null };
+}
+
+/**
+ * Generates a session token
+ *
+ * @returns The session token
+ */
+function generateSessionToken(): string {
+  return randomBytes(16).toString('base64url');
+}
+
+export class CookieUserSessionService implements UserSessionService {
+  /**
+   * Creates a user session cookie and sets it in the response.
+   *
+   * @param userId The ID of the user for whom the session is being created.
+   * @param context The request service context
+   * @param currentDate The current date and time. Defaults to the current date and time.
+   * @returns The session payload
+   */
+  async createSession(
+    userId: string,
+    context: RequestServiceContext,
+    currentDate: Date = new Date(),
+  ): Promise<UserSessionPayload> {
+    const token = generateSessionToken();
+    const expiresAt = new Date(
+      currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000,
+    );
+
+    await TPL_PRISMA_USER_SESSION.create({
+      data: {
+        user: { connect: { id: userId } },
+        token,
+        expiresAt,
+      },
+    });
+
+    // Fetch user roles to include in the session payload
+    const user = await prisma.user.findUniqueOrThrow({
+      where: { id: userId },
+      select: { roles: true },
+    });
+
+    const roles: readonly AuthRole[] = [
+      ...DEFAULT_USER_ROLES,
+      ...user.roles.map((role) => role.role as AuthRole),
+    ];
+
+    const cookieName = getUserSessionCookieName(context.reqInfo.headers);
+    const cookieValue = signObject({ token }, config.AUTH_SECRET);
+
+    context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
+
+    return { userId, expiresAt, roles };
+  }
+
+  /**
+   * Ends the user session by clearing the session cookie and deleting the session from the database.
+   *
+   * @param sessionInfo The session info
+   * @param context The request service context
+   */
+  async clearSession(
+    sessionInfo: AuthUserSessionInfo,
+    context: RequestServiceContext,
+  ): Promise<void> {
+    await TPL_PRISMA_USER_SESSION.delete({
+      where: { id: sessionInfo.id },
+    });
+
+    const cookieName = getUserSessionCookieName(context.reqInfo.headers);
+    context.cookieStore.clear(cookieName, COOKIE_OPTIONS);
+  }
+
+  /**
+   * Retrieves the user session information from the request.
+   *
+   * @param req - The Fastify request object containing the cookies.
+   * @param reply - The Fastify reply object used to set or clear cookies.
+   * @param currentDate - The current date used for session validation. Defaults to the current date and time.
+   * @returns A promise that resolves to the authenticated user session information or null if the session is invalid.
+   * @throws {InvalidSessionError} If the session is invalid or expired.
+   */
+  async getSessionInfoFromRequest(
+    req: FastifyRequest,
+    reply?: FastifyReply,
+  ): Promise<AuthUserSessionInfo | undefined> {
+    const currentDate = new Date();
+
+    const cookieName = getUserSessionCookieName(req.headers);
+
+    // Check if the session cookie is present
+    const sessionCookieValue = req.cookies[cookieName];
+    if (!sessionCookieValue) return undefined;
+
+    // Check Origin header for non-GET/HEAD requests to prevent CSRF attacks
+    if (
+      (req.method !== 'GET' ||
+        req.headers.upgrade?.toLowerCase() === 'websocket') &&
+      req.method !== 'HEAD' &&
+      !verifyRequestOrigin(req, [req.host, ...config.ALLOWED_ORIGINS])
+    ) {
+      throw new ForbiddenError('Invalid Origin header');
+    }
+    try {
+      // Unsign the session cookie
+      const sessionCookieResult = unsignObject(
+        sessionCookieValue,
+        config.AUTH_SECRET,
+      ) as SessionCookieValue | undefined;
+      if (!sessionCookieResult) throw new InvalidSessionError();
+
+      const { token } = sessionCookieResult;
+      if (typeof token !== 'string') throw new InvalidSessionError();
+
+      // Fetch and validate user session
+      const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
+        where: { token },
+        include: { user: { select: { id: true, roles: true } } },
+      });
+      if (!userSession) throw new InvalidSessionError();
+
+      const sessionExpiryResult = validateSessionExpiry(
+        currentDate,
+        userSession,
+      );
+      if (!sessionExpiryResult.valid)
+        throw new InvalidSessionError('Session expired');
+
+      // renew the session if needed
+      if (sessionExpiryResult.newExpiry && reply) {
+        await TPL_PRISMA_USER_SESSION.update({
+          where: { id: userSession.id },
+          data: {
+            renewedAt: currentDate,
+            expiresAt: sessionExpiryResult.newExpiry,
+          },
+        });
+        const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
+        reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
+      }
+
+      const { user } = userSession;
+      const expiresAt = sessionExpiryResult.newExpiry ?? userSession.expiresAt;
+
+      return {
+        id: userSession.id,
+        type: 'user',
+        roles: [
+          ...DEFAULT_USER_ROLES,
+          ...user.roles.map((role) => role.role as AuthRole),
+        ],
+        userId: user.id,
+        expiresAt,
+      };
+    } catch (err) {
+      // clear the cookie if it's invalid
+      if (err instanceof InvalidSessionError && reply) {
+        reply.clearCookie(cookieName, COOKIE_OPTIONS);
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * Retrieves the user session information from the authentication token
+   *
+   * Note: Since we use cookies, we ignore the authToken parameter
+   *
+   * @param req The request object
+   * @returns The session info or undefined if no session is found
+   */
+  async getSessionInfoFromToken(
+    req: FastifyRequest,
+  ): Promise<AuthUserSessionInfo | undefined> {
+    return this.getSessionInfoFromRequest(req, undefined);
+  }
+}
+
+export const userSessionService = new CookieUserSessionService();

package/dist/local-auth/core/generators/auth-module/templates/module/utils/cookie-signer.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Cookie signing utilities
+ * Based on node-cookie-signature by TJ Holowaychuk
+ * Source: https://github.com/tj/node-cookie-signature
+ */
+/**
+ * Sign the given `val` with `secret` using HMAC-SHA256.
+ *
+ * @param val - The value to sign.
+ * @param secret - The secret key to use for signing.
+ * @returns The signed value.
+ */
+export declare function sign(val: string, secret: string): string;
+/**
+ * Unsign and decode the given `input` with `secret`,
+ *
+ * @param input - The signed cookie string to unsign.
+ * @param secret - The secret key used for signing.
+ * @returns The unsigned value or undefined if the signature is invalid.
+ */
+export declare function unsign(input: string, secret: string): string | undefined;
+/**
+ * Sign an object by JSON stringifying and base64 encoding it, then signing with secret.
+ *
+ * @param obj - The object to sign.
+ * @param secret - The secret key to use for signing.
+ * @returns The signed encoded object.
+ */
+export declare function signObject(obj: unknown, secret: string): string;
+/**
+ * Unsign and decode an object that was signed with signObject.
+ *
+ * @param input - The signed encoded object string to unsign.
+ * @param secret - The secret key used for signing.
+ * @returns The decoded object or undefined if the signature is invalid.
+ */
+export declare function unsignObject(input: string, secret: string): unknown;
+//# sourceMappingURL=cookie-signer.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/utils/cookie-signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-signer.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/utils/cookie-signer.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AAEH;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUnE"}