@baseplate-dev/plugin-auth 1.0.6 → 1.0.8

package/dist/local-auth/core/generators/auth-module/templates/module/schema/auth-role.enum.js

@@ -0,0 +1,16 @@
+// @ts-nocheck
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { builder } from '%pothosImports';
+/**
+ * GraphQL enum for authentication roles.
+ *
+ * This enum represents all available roles that can be assigned to users
+ * or used for authorization checks in the application.
+ */
+export const authRoleEnum = builder.enumType('AuthRole', {
+    values: Object.fromEntries(Object.entries(AUTH_ROLE_CONFIG).map(([role, config]) => [
+        role,
+        { value: role, description: config.comment },
+    ])),
+});
+//# sourceMappingURL=auth-role.enum.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/auth-role.enum.ts

@@ -0,0 +1,21 @@
+// @ts-nocheck
+
+import type { AuthRole } from '%authRolesImports';
+
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { builder } from '%pothosImports';
+
+/**
+ * GraphQL enum for authentication roles.
+ *
+ * This enum represents all available roles that can be assigned to users
+ * or used for authorization checks in the application.
+ */
+export const authRoleEnum = builder.enumType('AuthRole', {
+  values: Object.fromEntries(
+    Object.entries(AUTH_ROLE_CONFIG).map(([role, config]) => [
+      role,
+      { value: role, description: config.comment },
+    ]),
+  ) as Record<AuthRole, { value: AuthRole; description: string }>,
+});

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=user-roles.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.js

@@ -0,0 +1,23 @@
+// @ts-nocheck
+import { updateUserRoles } from '$userRolesService';
+import { builder } from '%pothosImports';
+builder.mutationField('updateUserRoles', (t) => t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+        user: t.payload.field({
+            type: TPL_USER_OBJECT_TYPE,
+        }),
+    },
+    input: {
+        userId: t.input.field({ required: true, type: 'Uuid' }),
+        roles: t.input.field({
+            required: true,
+            type: ['String'],
+        }),
+    },
+    resolve: async (root, { input }) => {
+        const user = await updateUserRoles(input);
+        return { user };
+    },
+}));
+//# sourceMappingURL=user-roles.mutations.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.ts

@@ -0,0 +1,26 @@
+// @ts-nocheck
+
+import { updateUserRoles } from '$userRolesService';
+import { builder } from '%pothosImports';
+
+builder.mutationField('updateUserRoles', (t) =>
+  t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+      user: t.payload.field({
+        type: TPL_USER_OBJECT_TYPE,
+      }),
+    },
+    input: {
+      userId: t.input.field({ required: true, type: 'Uuid' }),
+      roles: t.input.field({
+        required: true,
+        type: ['String'],
+      }),
+    },
+    resolve: async (root, { input }) => {
+      const user = await updateUserRoles(input);
+      return { user };
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.js

@@ -0,0 +1,19 @@
+// @ts-nocheck
+import { authRoleEnum } from '$authRoleEnum';
+import { builder } from '%pothosImports';
+export const userSessionPayload = builder.simpleObject('UserSessionPayload', {
+    fields: (t) => ({
+        expiresAt: t.field({ type: 'DateTime', nullable: true }),
+        userId: t.field({ type: 'Uuid' }),
+        roles: t.field({ type: [authRoleEnum] }),
+    }),
+}, (t) => ({
+    user: t.prismaField({
+        type: TPL_USER_OBJECT_TYPE,
+        resolve: async (query, root) => TPL_PRISMA_USER.findUniqueOrThrow({
+            where: { id: root.userId },
+            ...query,
+        }),
+    }),
+}));
+//# sourceMappingURL=user-session-payload.object-type.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.ts

@@ -0,0 +1,25 @@
+// @ts-nocheck
+
+import { authRoleEnum } from '$authRoleEnum';
+import { builder } from '%pothosImports';
+
+export const userSessionPayload = builder.simpleObject(
+  'UserSessionPayload',
+  {
+    fields: (t) => ({
+      expiresAt: t.field({ type: 'DateTime', nullable: true }),
+      userId: t.field({ type: 'Uuid' }),
+      roles: t.field({ type: [authRoleEnum] }),
+    }),
+  },
+  (t) => ({
+    user: t.prismaField({
+      type: TPL_USER_OBJECT_TYPE,
+      resolve: async (query, root) =>
+        TPL_PRISMA_USER.findUniqueOrThrow({
+          where: { id: root.userId },
+          ...query,
+        }),
+    }),
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.js

@@ -0,0 +1,17 @@
+// @ts-nocheck
+import { builder } from '%pothosImports';
+builder.mutationField('logOut', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.boolean({
+            description: 'Whether the logout was successful.',
+        }),
+    },
+    resolve: async (parent, args, context) => {
+        if (context.auth.session?.type === 'user') {
+            await context.services.userSession.clearSession(context.auth.session, context);
+        }
+        return { success: true };
+    },
+}));
+//# sourceMappingURL=user-session.mutations.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.ts

@@ -0,0 +1,24 @@
+// @ts-nocheck
+
+import { builder } from '%pothosImports';
+
+builder.mutationField('logOut', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.boolean({
+        description: 'Whether the logout was successful.',
+      }),
+    },
+    resolve: async (parent, args, context) => {
+      if (context.auth.session?.type === 'user') {
+        await context.services.userSession.clearSession(
+          context.auth.session,
+          context,
+        );
+      }
+
+      return { success: true };
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.js

@@ -0,0 +1,36 @@
+// @ts-nocheck
+import { userSessionPayload } from '$schemaUserSessionPayloadObjectType';
+import { builder } from '%pothosImports';
+import { prisma } from '%prismaImports';
+builder.queryField('currentUserSession', (t) => t.field({
+    type: userSessionPayload,
+    description: 'Get the current user session',
+    nullable: true,
+    authorize: ['public'],
+    resolve: (root, args, { auth }) => {
+        if (auth.session?.type !== 'user') {
+            return undefined;
+        }
+        return {
+            expiresAt: auth.session.expiresAt?.toISOString(),
+            userId: auth.session.userId,
+            roles: auth.roles,
+        };
+    },
+}));
+builder.queryField('viewer', (t) => t.prismaField({
+    type: TPL_USER_OBJECT_TYPE,
+    nullable: true,
+    description: 'The currently authenticated user',
+    authorize: ['public'],
+    resolve: async (query, root, args, { auth }) => {
+        if (auth.session?.type !== 'user') {
+            return null;
+        }
+        return prisma.user.findUnique({
+            where: { id: auth.session.userId },
+            ...query,
+        });
+    },
+}));
+//# sourceMappingURL=user-session.queries.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts

@@ -0,0 +1,43 @@
+// @ts-nocheck
+
+import { userSessionPayload } from '$schemaUserSessionPayloadObjectType';
+import { builder } from '%pothosImports';
+import { prisma } from '%prismaImports';
+
+builder.queryField('currentUserSession', (t) =>
+  t.field({
+    type: userSessionPayload,
+    description: 'Get the current user session',
+    nullable: true,
+    authorize: ['public'],
+    resolve: (root, args, { auth }) => {
+      if (auth.session?.type !== 'user') {
+        return undefined;
+      }
+
+      return {
+        expiresAt: auth.session.expiresAt?.toISOString(),
+        userId: auth.session.userId,
+        roles: auth.roles,
+      };
+    },
+  }),
+);
+
+builder.queryField('viewer', (t) =>
+  t.prismaField({
+    type: TPL_USER_OBJECT_TYPE,
+    nullable: true,
+    description: 'The currently authenticated user',
+    authorize: ['public'],
+    resolve: async (query, root, args, { auth }) => {
+      if (auth.session?.type !== 'user') {
+        return null;
+      }
+      return prisma.user.findUnique({
+        where: { id: auth.session.userId },
+        ...query,
+      });
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.d.ts

@@ -0,0 +1,40 @@
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+/**
+ * Creates a new auth verification using the split-token pattern.
+ *
+ * @param type - Verification type (e.g., "password-reset", "email-verify")
+ * @param userId - Optional user ID to associate with the token
+ * @param expiresInSec - Token lifetime in seconds
+ * @param metadata - Optional JSON metadata to store with the token
+ * @returns The combined token (`{selector}.{verifier}`) to send to the user
+ */
+export declare function createAuthVerification({ type, userId, expiresInSec, metadata, }: {
+    type: string;
+    userId?: string;
+    expiresInSec: number;
+    metadata?: Prisma.JsonValue;
+}): Promise<{
+    token: string;
+}>;
+/**
+ * Validates an auth verification token without consuming it.
+ * Returns the full record if valid so the caller can delete it
+ * as part of their own transaction.
+ *
+ * Security: If the selector matches but the verifier is wrong or expired,
+ * the token is deleted to prevent brute-force attempts.
+ *
+ * @throws BadRequestError if token is invalid, expired, or malformed
+ */
+export declare function validateAuthVerification({ type, token, }: {
+    type: string;
+    token: string;
+}): Promise<AuthVerification | null>;
+/**
+ * Cleanup job to delete expired auth verification tokens.
+ * Should be called periodically (e.g., via cron job or queue).
+ */
+export declare function cleanupExpiredAuthVerifications(): Promise<{
+    deletedCount: number;
+}>;
+//# sourceMappingURL=auth-verification.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.js

@@ -0,0 +1,106 @@
+// @ts-nocheck
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+/**
+ * Split-token pattern for secure verification flows.
+ *
+ * - selector: random identifier used for DB lookup (stored as `identifier`)
+ * - verifier: random secret, hashed before storage (stored as `value`)
+ * - token: `{selector}.{verifier}` — the value sent to the user
+ */
+function generateSplitToken() {
+    return {
+        selector: crypto.randomBytes(16).toString('base64url'),
+        verifier: crypto.randomBytes(16).toString('base64url'),
+    };
+}
+function hashVerifier(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('hex');
+}
+/**
+ * Constant-time comparison of two hex strings to prevent timing attacks.
+ */
+function safeCompare(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+}
+function encodeToken(selector, verifier) {
+    return `${selector}.${verifier}`;
+}
+function decodeToken(token) {
+    const dotIndex = token.indexOf('.');
+    if (dotIndex === -1) {
+        return null;
+    }
+    return {
+        selector: token.slice(0, dotIndex),
+        verifier: token.slice(dotIndex + 1),
+    };
+}
+/**
+ * Creates a new auth verification using the split-token pattern.
+ *
+ * @param type - Verification type (e.g., "password-reset", "email-verify")
+ * @param userId - Optional user ID to associate with the token
+ * @param expiresInSec - Token lifetime in seconds
+ * @param metadata - Optional JSON metadata to store with the token
+ * @returns The combined token (`{selector}.{verifier}`) to send to the user
+ */
+export async function createAuthVerification({ type, userId, expiresInSec, metadata, }) {
+    const { selector, verifier } = generateSplitToken();
+    const value = hashVerifier(verifier);
+    const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+    await prisma.authVerification.create({
+        data: {
+            type,
+            identifier: selector,
+            value,
+            userId,
+            metadata: metadata ?? undefined,
+            expiresAt,
+        },
+    });
+    return { token: encodeToken(selector, verifier) };
+}
+/**
+ * Validates an auth verification token without consuming it.
+ * Returns the full record if valid so the caller can delete it
+ * as part of their own transaction.
+ *
+ * Security: If the selector matches but the verifier is wrong or expired,
+ * the token is deleted to prevent brute-force attempts.
+ *
+ * @throws BadRequestError if token is invalid, expired, or malformed
+ */
+export async function validateAuthVerification({ type, token, }) {
+    const decoded = decodeToken(token);
+    if (!decoded) {
+        return null;
+    }
+    const record = await prisma.authVerification.findUnique({
+        where: { type_identifier: { type, identifier: decoded.selector } },
+    });
+    if (!record) {
+        return null;
+    }
+    if (!safeCompare(record.value, hashVerifier(decoded.verifier)) ||
+        record.expiresAt < new Date()) {
+        await prisma.authVerification.delete({ where: { id: record.id } });
+        return null;
+    }
+    return record;
+}
+/**
+ * Cleanup job to delete expired auth verification tokens.
+ * Should be called periodically (e.g., via cron job or queue).
+ */
+export async function cleanupExpiredAuthVerifications() {
+    const result = await prisma.authVerification.deleteMany({
+        where: {
+            expiresAt: { lt: new Date() },
+        },
+    });
+    return { deletedCount: result.count };
+}
+//# sourceMappingURL=auth-verification.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.ts

@@ -0,0 +1,146 @@
+// @ts-nocheck
+
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+
+/**
+ * Split-token pattern for secure verification flows.
+ *
+ * - selector: random identifier used for DB lookup (stored as `identifier`)
+ * - verifier: random secret, hashed before storage (stored as `value`)
+ * - token: `{selector}.{verifier}` — the value sent to the user
+ */
+
+function generateSplitToken(): { selector: string; verifier: string } {
+  return {
+    selector: crypto.randomBytes(16).toString('base64url'),
+    verifier: crypto.randomBytes(16).toString('base64url'),
+  };
+}
+
+function hashVerifier(verifier: string): string {
+  return crypto.createHash('sha256').update(verifier).digest('hex');
+}
+
+/**
+ * Constant-time comparison of two hex strings to prevent timing attacks.
+ */
+function safeCompare(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+}
+
+function encodeToken(selector: string, verifier: string): string {
+  return `${selector}.${verifier}`;
+}
+
+function decodeToken(
+  token: string,
+): { selector: string; verifier: string } | null {
+  const dotIndex = token.indexOf('.');
+  if (dotIndex === -1) {
+    return null;
+  }
+  return {
+    selector: token.slice(0, dotIndex),
+    verifier: token.slice(dotIndex + 1),
+  };
+}
+
+/**
+ * Creates a new auth verification using the split-token pattern.
+ *
+ * @param type - Verification type (e.g., "password-reset", "email-verify")
+ * @param userId - Optional user ID to associate with the token
+ * @param expiresInSec - Token lifetime in seconds
+ * @param metadata - Optional JSON metadata to store with the token
+ * @returns The combined token (`{selector}.{verifier}`) to send to the user
+ */
+export async function createAuthVerification({
+  type,
+  userId,
+  expiresInSec,
+  metadata,
+}: {
+  type: string;
+  userId?: string;
+  expiresInSec: number;
+  metadata?: Prisma.JsonValue;
+}): Promise<{ token: string }> {
+  const { selector, verifier } = generateSplitToken();
+  const value = hashVerifier(verifier);
+  const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+
+  await prisma.authVerification.create({
+    data: {
+      type,
+      identifier: selector,
+      value,
+      userId,
+      metadata: metadata ?? undefined,
+      expiresAt,
+    },
+  });
+
+  return { token: encodeToken(selector, verifier) };
+}
+
+/**
+ * Validates an auth verification token without consuming it.
+ * Returns the full record if valid so the caller can delete it
+ * as part of their own transaction.
+ *
+ * Security: If the selector matches but the verifier is wrong or expired,
+ * the token is deleted to prevent brute-force attempts.
+ *
+ * @throws BadRequestError if token is invalid, expired, or malformed
+ */
+export async function validateAuthVerification({
+  type,
+  token,
+}: {
+  type: string;
+  token: string;
+}): Promise<AuthVerification | null> {
+  const decoded = decodeToken(token);
+
+  if (!decoded) {
+    return null;
+  }
+
+  const record = await prisma.authVerification.findUnique({
+    where: { type_identifier: { type, identifier: decoded.selector } },
+  });
+
+  if (!record) {
+    return null;
+  }
+
+  if (
+    !safeCompare(record.value, hashVerifier(decoded.verifier)) ||
+    record.expiresAt < new Date()
+  ) {
+    await prisma.authVerification.delete({ where: { id: record.id } });
+    return null;
+  }
+
+  return record;
+}
+
+/**
+ * Cleanup job to delete expired auth verification tokens.
+ * Should be called periodically (e.g., via cron job or queue).
+ */
+export async function cleanupExpiredAuthVerifications(): Promise<{
+  deletedCount: number;
+}> {
+  const result = await prisma.authVerification.deleteMany({
+    where: {
+      expiresAt: { lt: new Date() },
+    },
+  });
+
+  return { deletedCount: result.count };
+}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.d.ts

@@ -0,0 +1,15 @@
+import type { User } from '%prismaGeneratedImports';
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export declare function updateUserRoles({ userId, roles, }: {
+    userId: string;
+    roles: string[];
+}): Promise<User>;
+//# sourceMappingURL=user-roles.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.js

@@ -0,0 +1,40 @@
+// @ts-nocheck
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { NotFoundError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export async function updateUserRoles({ userId, roles, }) {
+    // Filter out auto-assigned roles (public, user, system) that cannot be manually assigned
+    const validRoles = roles.filter((role) => {
+        if (!(role in AUTH_ROLE_CONFIG)) {
+            return false;
+        }
+        const roleConfig = AUTH_ROLE_CONFIG[role];
+        return !roleConfig.autoAssigned;
+    });
+    await prisma.$transaction([
+        prisma.userRole.deleteMany({
+            where: { userId, role: { notIn: validRoles } },
+        }),
+        prisma.userRole.createMany({
+            data: validRoles.map((role) => ({ userId, role })),
+            skipDuplicates: true,
+        }),
+    ]);
+    const updatedUser = await prisma.user.findUnique({
+        where: { id: userId },
+    });
+    if (updatedUser === null) {
+        throw new NotFoundError('User not found', 'user-not-found');
+    }
+    return updatedUser;
+}
+//# sourceMappingURL=user-roles.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.ts

@@ -0,0 +1,54 @@
+// @ts-nocheck
+
+import type { AuthRole } from '%authRolesImports';
+import type { User } from '%prismaGeneratedImports';
+
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { NotFoundError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export async function updateUserRoles({
+  userId,
+  roles,
+}: {
+  userId: string;
+  roles: string[];
+}): Promise<User> {
+  // Filter out auto-assigned roles (public, user, system) that cannot be manually assigned
+  const validRoles = roles.filter((role) => {
+    if (!(role in AUTH_ROLE_CONFIG)) {
+      return false;
+    }
+    const roleConfig = AUTH_ROLE_CONFIG[role as AuthRole];
+    return !roleConfig.autoAssigned;
+  });
+
+  await prisma.$transaction([
+    prisma.userRole.deleteMany({
+      where: { userId, role: { notIn: validRoles } },
+    }),
+    prisma.userRole.createMany({
+      data: validRoles.map((role) => ({ userId, role })),
+      skipDuplicates: true,
+    }),
+  ]);
+
+  const updatedUser = await prisma.user.findUnique({
+    where: { id: userId },
+  });
+
+  if (updatedUser === null) {
+    throw new NotFoundError('User not found', 'user-not-found');
+  }
+
+  return updatedUser;
+}