@baseplate-dev/plugin-auth 1.0.6 → 1.0.8

package/dist/auth/core/generators/auth-module/templates/module/schema/user-session.mutations.ts

@@ -1,22 +0,0 @@
-// @ts-nocheck
-
-import { userSessionService } from '$userSessionService';
-import { builder } from '%pothosImports';
-
-builder.mutationField('logOut', (t) =>
-  t.fieldWithInputPayload({
-    authorize: ['public'],
-    payload: {
-      success: t.payload.boolean({
-        description: 'Whether the logout was successful.',
-      }),
-    },
-    resolve: async (parent, args, context) => {
-      if (context.auth.session && context.auth.session.type === 'user') {
-        await userSessionService.clearSession(context.auth.session, context);
-      }
-
-      return { success: true };
-    },
-  }),
-);

package/dist/auth/core/generators/auth-module/templates/module/schema/user-session.queries.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-session.queries.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts"],"names":[],"mappings":""}

package/dist/auth/core/generators/auth-module/templates/module/schema/user-session.queries.js

@@ -1,19 +0,0 @@
-// @ts-nocheck
-import { userSessionPayload } from '$schemaUserSessionPayloadObjectType';
-import { builder } from '%pothosImports';
-builder.queryField('currentUserSession', (t) => t.field({
-    type: userSessionPayload,
-    description: 'Get the current user session',
-    nullable: true,
-    authorize: ['public'],
-    resolve: (root, args, { auth }) => {
-        if (!auth.session || auth.session.type !== 'user') {
-            return undefined;
-        }
-        return {
-            expiresAt: auth.session.expiresAt?.toISOString(),
-            userId: auth.session.userId,
-        };
-    },
-}));
-//# sourceMappingURL=user-session.queries.js.map

package/dist/auth/core/generators/auth-module/templates/module/schema/user-session.queries.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-session.queries.js","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC,CAAC,KAAK,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,8BAA8B;IAC3C,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC;CACF,CAAC,CACH,CAAC"}

package/dist/auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts

@@ -1,23 +0,0 @@
-// @ts-nocheck
-
-import { userSessionPayload } from '$schemaUserSessionPayloadObjectType';
-import { builder } from '%pothosImports';
-
-builder.queryField('currentUserSession', (t) =>
-  t.field({
-    type: userSessionPayload,
-    description: 'Get the current user session',
-    nullable: true,
-    authorize: ['public'],
-    resolve: (root, args, { auth }) => {
-      if (!auth.session || auth.session.type !== 'user') {
-        return undefined;
-      }
-
-      return {
-        expiresAt: auth.session.expiresAt?.toISOString(),
-        userId: auth.session.userId,
-      };
-    },
-  }),
-);

package/dist/auth/core/generators/auth-module/templates/module/services/user-session.service.d.ts

@@ -1,43 +0,0 @@
-import type { AuthUserSessionInfo } from '%authContextImports';
-import type { RequestServiceContext } from '%requestServiceContextImports';
-import type { UserSessionPayload, UserSessionService } from '%userSessionTypesImports';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-export declare class CookieUserSessionService implements UserSessionService {
-    /**
-     * Creates a user session cookie and sets it in the response.
-     *
-     * @param userId The ID of the user for whom the session is being created.
-     * @param context The request service context
-     * @param currentDate The current date and time. Defaults to the current date and time.
-     * @returns The session payload
-     */
-    createSession(userId: string, context: RequestServiceContext, currentDate?: Date): Promise<UserSessionPayload>;
-    /**
-     * Ends the user session by clearing the session cookie and deleting the session from the database.
-     *
-     * @param sessionInfo The session info
-     * @param context The request service context
-     */
-    clearSession(sessionInfo: AuthUserSessionInfo, context: RequestServiceContext): Promise<void>;
-    /**
-     * Retrieves the user session information from the request.
-     *
-     * @param req - The Fastify request object containing the cookies.
-     * @param reply - The Fastify reply object used to set or clear cookies.
-     * @param currentDate - The current date used for session validation. Defaults to the current date and time.
-     * @returns A promise that resolves to the authenticated user session information or null if the session is invalid.
-     * @throws {InvalidSessionError} If the session is invalid or expired.
-     */
-    getSessionInfoFromRequest(req: FastifyRequest, reply?: FastifyReply): Promise<AuthUserSessionInfo | undefined>;
-    /**
-     * Retrieves the user session information from the authentication token
-     *
-     * Note: Since we use cookies, we ignore the authToken parameter
-     *
-     * @param req The request object
-     * @returns The session info or undefined if no session is found
-     */
-    getSessionInfoFromToken(req: FastifyRequest): Promise<AuthUserSessionInfo | undefined>;
-}
-export declare const userSessionService: CookieUserSessionService;
-//# sourceMappingURL=user-session.service.d.ts.map

package/dist/auth/core/generators/auth-module/templates/module/services/user-session.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-session.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/services/user-session.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAiF5D,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE;;;;;;;OAOG;IACG,aAAa,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,EAC9B,WAAW,GAAE,IAAiB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAsB9B;;;;;OAKG;IACG,YAAY,CAChB,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAShB;;;;;;;;OAQG;IACG,yBAAyB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,YAAY,GACnB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8E3C;;;;;;;OAOG;IACG,uBAAuB,CAC3B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;CAG5C;AAED,eAAO,MAAM,kBAAkB,0BAAiC,CAAC"}

package/dist/auth/core/generators/auth-module/templates/module/services/user-session.service.js

@@ -1,180 +0,0 @@
-// @ts-nocheck
-import { signObject, unsignObject } from '$cookieSigner';
-import { getUserSessionCookieName } from '$sessionCookie';
-import { USER_SESSION_DURATION_SEC, USER_SESSION_MAX_LIFETIME_SEC, USER_SESSION_RENEWAL_THRESHOLD_SEC, } from '$userSessionConstants';
-import { verifyRequestOrigin } from '$verifyRequestOrigin';
-import { InvalidSessionError } from '%authContextImports';
-import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { config } from '%configServiceImports';
-import { ForbiddenError } from '%errorHandlerServiceImports';
-import { randomBytes } from 'node:crypto';
-const COOKIE_OPTIONS = {
-    httpOnly: true,
-    sameSite: 'lax',
-    secure: config.APP_ENVIRONMENT !== 'dev',
-    maxAge: USER_SESSION_DURATION_SEC,
-    path: '/',
-};
-/**
- * Validates the expiry of a user session and determines if it needs to be renewed.
- *
- * @param currentDate The current date and time.
- * @param userSession The session details.
- * @param userSession.expiresAt The date and time when the session expires.
- * @param userSession.createdAt The date and time when the session was created.
- * @param userSession.renewedAt The date and time when the session was last renewed.
- * @returns The validity of the session and the new expiry date if applicable.
- */
-function validateSessionExpiry(currentDate, userSession) {
-    // check if session is expired
-    if (userSession.expiresAt < currentDate) {
-        return { valid: false, newExpiry: null };
-    }
-    // check if session needs renewal
-    const shouldRenewBy = userSession.renewedAt.getTime() + USER_SESSION_RENEWAL_THRESHOLD_SEC * 1000;
-    if (shouldRenewBy < currentDate.getTime()) {
-        const newExpiry = currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000;
-        const maxExpiry = USER_SESSION_MAX_LIFETIME_SEC === 0
-            ? undefined
-            : userSession.createdAt.getTime() +
-                USER_SESSION_MAX_LIFETIME_SEC * 1000;
-        return {
-            valid: true,
-            newExpiry: new Date(Math.min(newExpiry, maxExpiry ?? newExpiry)),
-        };
-    }
-    return { valid: true, newExpiry: null };
-}
-/**
- * Generates a session token
- *
- * @returns The session token
- */
-function generateSessionToken() {
-    return randomBytes(16).toString('base64url');
-}
-export class CookieUserSessionService {
-    /**
-     * Creates a user session cookie and sets it in the response.
-     *
-     * @param userId The ID of the user for whom the session is being created.
-     * @param context The request service context
-     * @param currentDate The current date and time. Defaults to the current date and time.
-     * @returns The session payload
-     */
-    async createSession(userId, context, currentDate = new Date()) {
-        const token = generateSessionToken();
-        const expiresAt = new Date(currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000);
-        await TPL_PRISMA_USER_SESSION.create({
-            data: {
-                user: { connect: { id: userId } },
-                token,
-                expiresAt,
-            },
-        });
-        const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        const cookieValue = signObject({ token }, config.AUTH_SECRET);
-        context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
-        return { userId, expiresAt };
-    }
-    /**
-     * Ends the user session by clearing the session cookie and deleting the session from the database.
-     *
-     * @param sessionInfo The session info
-     * @param context The request service context
-     */
-    async clearSession(sessionInfo, context) {
-        await TPL_PRISMA_USER_SESSION.delete({
-            where: { id: sessionInfo.id },
-        });
-        const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        context.cookieStore.clear(cookieName);
-    }
-    /**
-     * Retrieves the user session information from the request.
-     *
-     * @param req - The Fastify request object containing the cookies.
-     * @param reply - The Fastify reply object used to set or clear cookies.
-     * @param currentDate - The current date used for session validation. Defaults to the current date and time.
-     * @returns A promise that resolves to the authenticated user session information or null if the session is invalid.
-     * @throws {InvalidSessionError} If the session is invalid or expired.
-     */
-    async getSessionInfoFromRequest(req, reply) {
-        const currentDate = new Date();
-        // Check Origin header for non-GET/HEAD requests to prevent CSRF attacks
-        if ((req.method !== 'GET' ||
-            req.headers.upgrade?.toLowerCase() === 'websocket') &&
-            req.method !== 'HEAD' &&
-            !verifyRequestOrigin(req, [req.host])) {
-            throw new ForbiddenError('Invalid Origin header');
-        }
-        const cookieName = getUserSessionCookieName(req.headers);
-        try {
-            // Check if the session cookie is present
-            const sessionCookieValue = req.cookies[cookieName];
-            if (!sessionCookieValue)
-                return undefined;
-            // Unsign the session cookie
-            const sessionCookieResult = unsignObject(sessionCookieValue, config.AUTH_SECRET);
-            if (!sessionCookieResult)
-                throw new InvalidSessionError();
-            const { token } = sessionCookieResult;
-            if (typeof token !== 'string')
-                throw new InvalidSessionError();
-            // Fetch and validate user session
-            const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
-                where: { token },
-                include: { user: { select: { id: true, roles: true } } },
-            });
-            if (!userSession)
-                throw new InvalidSessionError();
-            const sessionExpiryResult = validateSessionExpiry(currentDate, userSession);
-            if (!sessionExpiryResult.valid)
-                throw new InvalidSessionError('Session expired');
-            // renew the session if needed
-            if (sessionExpiryResult.newExpiry && reply) {
-                await TPL_PRISMA_USER_SESSION.update({
-                    where: { id: userSession.id },
-                    data: {
-                        renewedAt: currentDate,
-                        expiresAt: sessionExpiryResult.newExpiry,
-                    },
-                });
-                const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
-                reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
-            }
-            const { user } = userSession;
-            const expiresAt = sessionExpiryResult.newExpiry ?? userSession.expiresAt;
-            return {
-                id: userSession.id,
-                type: 'user',
-                roles: [
-                    ...DEFAULT_USER_ROLES,
-                    ...user.roles.map((role) => role.role),
-                ],
-                userId: user.id,
-                expiresAt,
-            };
-        }
-        catch (err) {
-            // clear the cookie if it's invalid
-            if (err instanceof InvalidSessionError && reply) {
-                reply.clearCookie(cookieName);
-            }
-            throw err;
-        }
-    }
-    /**
-     * Retrieves the user session information from the authentication token
-     *
-     * Note: Since we use cookies, we ignore the authToken parameter
-     *
-     * @param req The request object
-     * @returns The session info or undefined if no session is found
-     */
-    async getSessionInfoFromToken(req) {
-        return this.getSessionInfoFromRequest(req, undefined);
-    }
-}
-export const userSessionService = new CookieUserSessionService();
-//# sourceMappingURL=user-session.service.js.map

package/dist/auth/core/generators/auth-module/templates/module/services/user-session.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user-session.service.js","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/services/user-session.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAYd,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,MAAM,CAAC,eAAe,KAAK,KAAK;IACxC,MAAM,EAAE,yBAAyB;IACjC,IAAI,EAAE,GAAG;CACV,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,WAAiB,EACjB,WAIC;IAED,8BAA8B;IAC9B,IAAI,WAAW,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,iCAAiC;IACjC,MAAM,aAAa,GACjB,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,kCAAkC,GAAG,IAAI,CAAC;IAE9E,IAAI,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,yBAAyB,GAAG,IAAI,CAAC;QAC3E,MAAM,SAAS,GACb,6BAA6B,KAAK,CAAC;YACjC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE;gBAC/B,6BAA6B,GAAG,IAAI,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,IAAI,SAAS,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,wBAAwB;IACnC;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,OAA8B,EAC9B,cAAoB,IAAI,IAAI,EAAE;QAE9B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,WAAW,CAAC,OAAO,EAAE,GAAG,yBAAyB,GAAG,IAAI,CACzD,CAAC;QAEF,MAAM,uBAAuB,CAAC,MAAM,CAAC;YACnC,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE;gBACjC,KAAK;gBACL,SAAS;aACV;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAE9D,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QAEjE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,WAAgC,EAChC,OAA8B;QAE9B,MAAM,uBAAuB,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,yBAAyB,CAC7B,GAAmB,EACnB,KAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAE/B,wEAAwE;QACxE,IACE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;YACnB,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC;YACrD,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,cAAc,CAAC,uBAAuB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,kBAAkB;gBAAE,OAAO,SAAS,CAAC;YAE1C,4BAA4B;YAC5B,MAAM,mBAAmB,GAAG,YAAY,CACtC,kBAAkB,EAClB,MAAM,CAAC,WAAW,CACe,CAAC;YACpC,IAAI,CAAC,mBAAmB;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAE1D,MAAM,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAE/D,kCAAkC;YAClC,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC;gBAC3D,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;aACzD,CAAC,CAAC;YACH,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAElD,MAAM,mBAAmB,GAAG,qBAAqB,CAC/C,WAAW,EACX,WAAW,CACZ,CAAC;YACF,IAAI,CAAC,mBAAmB,CAAC,KAAK;gBAC5B,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YAEnD,8BAA8B;YAC9B,IAAI,mBAAmB,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,uBAAuB,CAAC,MAAM,CAAC;oBACnC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;oBAC7B,IAAI,EAAE;wBACJ,SAAS,EAAE,WAAW;wBACtB,SAAS,EAAE,mBAAmB,CAAC,SAAS;qBACzC;iBACF,CAAC,CAAC;gBACH,MAAM,eAAe,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;gBAClE,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;YAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;YAEzE,OAAO;gBACL,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE;oBACL,GAAG,kBAAkB;oBACrB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAgB,CAAC;iBACnD;gBACD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mCAAmC;YACnC,IAAI,GAAG,YAAY,mBAAmB,IAAI,KAAK,EAAE,CAAC;gBAChD,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,uBAAuB,CAC3B,GAAmB;QAEnB,OAAO,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,wBAAwB,EAAE,CAAC"}

package/dist/auth/core/generators/auth-module/templates/module/services/user-session.service.ts

@@ -1,250 +0,0 @@
-// @ts-nocheck
-
-import type { AuthUserSessionInfo } from '%authContextImports';
-import type { AuthRole } from '%authRolesImports';
-import type { RequestServiceContext } from '%requestServiceContextImports';
-import type {
-  UserSessionPayload,
-  UserSessionService,
-} from '%userSessionTypesImports';
-import type { CookieSerializeOptions } from '@fastify/cookie';
-import type { FastifyReply, FastifyRequest } from 'fastify';
-
-import { signObject, unsignObject } from '$cookieSigner';
-import { getUserSessionCookieName } from '$sessionCookie';
-import {
-  USER_SESSION_DURATION_SEC,
-  USER_SESSION_MAX_LIFETIME_SEC,
-  USER_SESSION_RENEWAL_THRESHOLD_SEC,
-} from '$userSessionConstants';
-import { verifyRequestOrigin } from '$verifyRequestOrigin';
-import { InvalidSessionError } from '%authContextImports';
-import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { config } from '%configServiceImports';
-import { ForbiddenError } from '%errorHandlerServiceImports';
-import { randomBytes } from 'node:crypto';
-
-interface SessionCookieValue {
-  // Session token
-  token: string;
-}
-
-const COOKIE_OPTIONS: CookieSerializeOptions = {
-  httpOnly: true,
-  sameSite: 'lax',
-  secure: config.APP_ENVIRONMENT !== 'dev',
-  maxAge: USER_SESSION_DURATION_SEC,
-  path: '/',
-};
-
-/**
- * Validates the expiry of a user session and determines if it needs to be renewed.
- *
- * @param currentDate The current date and time.
- * @param userSession The session details.
- * @param userSession.expiresAt The date and time when the session expires.
- * @param userSession.createdAt The date and time when the session was created.
- * @param userSession.renewedAt The date and time when the session was last renewed.
- * @returns The validity of the session and the new expiry date if applicable.
- */
-function validateSessionExpiry(
-  currentDate: Date,
-  userSession: {
-    expiresAt: Date;
-    createdAt: Date;
-    renewedAt: Date;
-  },
-): { valid: boolean; newExpiry: Date | null } {
-  // check if session is expired
-  if (userSession.expiresAt < currentDate) {
-    return { valid: false, newExpiry: null };
-  }
-
-  // check if session needs renewal
-  const shouldRenewBy =
-    userSession.renewedAt.getTime() + USER_SESSION_RENEWAL_THRESHOLD_SEC * 1000;
-
-  if (shouldRenewBy < currentDate.getTime()) {
-    const newExpiry = currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000;
-    const maxExpiry =
-      USER_SESSION_MAX_LIFETIME_SEC === 0
-        ? undefined
-        : userSession.createdAt.getTime() +
-          USER_SESSION_MAX_LIFETIME_SEC * 1000;
-    return {
-      valid: true,
-      newExpiry: new Date(Math.min(newExpiry, maxExpiry ?? newExpiry)),
-    };
-  }
-
-  return { valid: true, newExpiry: null };
-}
-
-/**
- * Generates a session token
- *
- * @returns The session token
- */
-function generateSessionToken(): string {
-  return randomBytes(16).toString('base64url');
-}
-
-export class CookieUserSessionService implements UserSessionService {
-  /**
-   * Creates a user session cookie and sets it in the response.
-   *
-   * @param userId The ID of the user for whom the session is being created.
-   * @param context The request service context
-   * @param currentDate The current date and time. Defaults to the current date and time.
-   * @returns The session payload
-   */
-  async createSession(
-    userId: string,
-    context: RequestServiceContext,
-    currentDate: Date = new Date(),
-  ): Promise<UserSessionPayload> {
-    const token = generateSessionToken();
-    const expiresAt = new Date(
-      currentDate.getTime() + USER_SESSION_DURATION_SEC * 1000,
-    );
-
-    await TPL_PRISMA_USER_SESSION.create({
-      data: {
-        user: { connect: { id: userId } },
-        token,
-        expiresAt,
-      },
-    });
-
-    const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-    const cookieValue = signObject({ token }, config.AUTH_SECRET);
-
-    context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
-
-    return { userId, expiresAt };
-  }
-
-  /**
-   * Ends the user session by clearing the session cookie and deleting the session from the database.
-   *
-   * @param sessionInfo The session info
-   * @param context The request service context
-   */
-  async clearSession(
-    sessionInfo: AuthUserSessionInfo,
-    context: RequestServiceContext,
-  ): Promise<void> {
-    await TPL_PRISMA_USER_SESSION.delete({
-      where: { id: sessionInfo.id },
-    });
-
-    const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-    context.cookieStore.clear(cookieName);
-  }
-
-  /**
-   * Retrieves the user session information from the request.
-   *
-   * @param req - The Fastify request object containing the cookies.
-   * @param reply - The Fastify reply object used to set or clear cookies.
-   * @param currentDate - The current date used for session validation. Defaults to the current date and time.
-   * @returns A promise that resolves to the authenticated user session information or null if the session is invalid.
-   * @throws {InvalidSessionError} If the session is invalid or expired.
-   */
-  async getSessionInfoFromRequest(
-    req: FastifyRequest,
-    reply?: FastifyReply,
-  ): Promise<AuthUserSessionInfo | undefined> {
-    const currentDate = new Date();
-
-    // Check Origin header for non-GET/HEAD requests to prevent CSRF attacks
-    if (
-      (req.method !== 'GET' ||
-        req.headers.upgrade?.toLowerCase() === 'websocket') &&
-      req.method !== 'HEAD' &&
-      !verifyRequestOrigin(req, [req.host])
-    ) {
-      throw new ForbiddenError('Invalid Origin header');
-    }
-
-    const cookieName = getUserSessionCookieName(req.headers);
-    try {
-      // Check if the session cookie is present
-      const sessionCookieValue = req.cookies[cookieName];
-      if (!sessionCookieValue) return undefined;
-
-      // Unsign the session cookie
-      const sessionCookieResult = unsignObject(
-        sessionCookieValue,
-        config.AUTH_SECRET,
-      ) as SessionCookieValue | undefined;
-      if (!sessionCookieResult) throw new InvalidSessionError();
-
-      const { token } = sessionCookieResult;
-      if (typeof token !== 'string') throw new InvalidSessionError();
-
-      // Fetch and validate user session
-      const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
-        where: { token },
-        include: { user: { select: { id: true, roles: true } } },
-      });
-      if (!userSession) throw new InvalidSessionError();
-
-      const sessionExpiryResult = validateSessionExpiry(
-        currentDate,
-        userSession,
-      );
-      if (!sessionExpiryResult.valid)
-        throw new InvalidSessionError('Session expired');
-
-      // renew the session if needed
-      if (sessionExpiryResult.newExpiry && reply) {
-        await TPL_PRISMA_USER_SESSION.update({
-          where: { id: userSession.id },
-          data: {
-            renewedAt: currentDate,
-            expiresAt: sessionExpiryResult.newExpiry,
-          },
-        });
-        const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
-        reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
-      }
-
-      const { user } = userSession;
-      const expiresAt = sessionExpiryResult.newExpiry ?? userSession.expiresAt;
-
-      return {
-        id: userSession.id,
-        type: 'user',
-        roles: [
-          ...DEFAULT_USER_ROLES,
-          ...user.roles.map((role) => role.role as AuthRole),
-        ],
-        userId: user.id,
-        expiresAt,
-      };
-    } catch (err) {
-      // clear the cookie if it's invalid
-      if (err instanceof InvalidSessionError && reply) {
-        reply.clearCookie(cookieName);
-      }
-      throw err;
-    }
-  }
-
-  /**
-   * Retrieves the user session information from the authentication token
-   *
-   * Note: Since we use cookies, we ignore the authToken parameter
-   *
-   * @param req The request object
-   * @returns The session info or undefined if no session is found
-   */
-  async getSessionInfoFromToken(
-    req: FastifyRequest,
-  ): Promise<AuthUserSessionInfo | undefined> {
-    return this.getSessionInfoFromRequest(req, undefined);
-  }
-}
-
-export const userSessionService = new CookieUserSessionService();

package/dist/auth/core/generators/auth-module/templates/module/utils/cookie-signer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-signer.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/utils/cookie-signer.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AAEH;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYxE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUnE"}

package/dist/auth/core/generators/auth-module/templates/module/utils/cookie-signer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-signer.js","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/utils/cookie-signer.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,MAAc;IAC9C,OAAO,GAAG,GAAG,IAAI,MAAM;SACpB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,CAAC,QAAQ,CAAC;QACjB,mEAAmE;SAClE,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,MAAc;IAClD,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,IACE,cAAc,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QAC5C,CAAC,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,EACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAc;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/auth/core/generators/auth-module/templates/module/utils/session-cookie.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-cookie.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/utils/session-cookie.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAM9C;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,GACjC,MAAM,CAuBR"}

package/dist/auth/core/generators/auth-module/templates/module/utils/session-cookie.js

@@ -1,38 +0,0 @@
-// @ts-nocheck
-import { config } from '%configServiceImports';
-const COOKIE_NAME = 'user-session';
-/**
- * Retrieves the name of the session cookie based on the provided request.
- * If the application environment is not 'dev', the cookie name will be prefixed with '__Host-'.
- * In development, the cookie name will be suffixed with the port number.
- *
- * @param req - The FastifyRequest object representing the incoming request.
- * @returns The name of the Iron session cookie.
- */
-export function getUserSessionCookieName(headers) {
-    if (config.APP_ENVIRONMENT !== 'dev') {
-        return `__Host-${COOKIE_NAME}`;
-    }
-    // in development, localhost does not support the __Host prefix and should be scoped to port
-    // use origin/referer header to determine hostname because dev reverse proxies use origin/referer to signal the original host
-    const { origin, referer } = headers;
-    const originalHost = origin ?? referer;
-    let port;
-    try {
-        if (!originalHost) {
-            port = config.SERVER_PORT;
-        }
-        else {
-            const url = new URL(originalHost);
-            const parsedPort = Number.parseInt(url.port, 10);
-            // Validate port is in valid range (1-65535)
-            port =
-                parsedPort > 0 && parsedPort < 65536 ? parsedPort : config.SERVER_PORT;
-        }
-    }
-    catch {
-        port = config.SERVER_PORT;
-    }
-    return `${COOKIE_NAME}-${port}`;
-}
-//# sourceMappingURL=session-cookie.js.map

package/dist/auth/core/generators/auth-module/templates/module/utils/session-cookie.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-cookie.js","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/utils/session-cookie.ts"],"names":[],"mappings":"AAAA,cAAc;AAId,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,IAAI,MAAM,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,UAAU,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,4FAA4F;IAC5F,6HAA6H;IAC7H,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpC,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAC;IACvC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAClC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjD,4CAA4C;YAC5C,IAAI;gBACF,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,KAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC"}

package/dist/auth/core/generators/auth-module/templates/module/utils/session-cookie.ts

@@ -1,42 +0,0 @@
-// @ts-nocheck
-
-import type { FastifyRequest } from 'fastify';
-
-import { config } from '%configServiceImports';
-
-const COOKIE_NAME = 'user-session';
-
-/**
- * Retrieves the name of the session cookie based on the provided request.
- * If the application environment is not 'dev', the cookie name will be prefixed with '__Host-'.
- * In development, the cookie name will be suffixed with the port number.
- *
- * @param req - The FastifyRequest object representing the incoming request.
- * @returns The name of the Iron session cookie.
- */
-export function getUserSessionCookieName(
-  headers: FastifyRequest['headers'],
-): string {
-  if (config.APP_ENVIRONMENT !== 'dev') {
-    return `__Host-${COOKIE_NAME}`;
-  }
-  // in development, localhost does not support the __Host prefix and should be scoped to port
-  // use origin/referer header to determine hostname because dev reverse proxies use origin/referer to signal the original host
-  const { origin, referer } = headers;
-  const originalHost = origin ?? referer;
-  let port;
-  try {
-    if (!originalHost) {
-      port = config.SERVER_PORT;
-    } else {
-      const url = new URL(originalHost);
-      const parsedPort = Number.parseInt(url.port, 10);
-      // Validate port is in valid range (1-65535)
-      port =
-        parsedPort > 0 && parsedPort < 65_536 ? parsedPort : config.SERVER_PORT;
-    }
-  } catch {
-    port = config.SERVER_PORT;
-  }
-  return `${COOKIE_NAME}-${port}`;
-}

package/dist/auth/core/generators/auth-module/templates/module/utils/verify-request-origin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify-request-origin.d.ts","sourceRoot":"","sources":["../../../../../../../../src/auth/core/generators/auth-module/templates/module/utils/verify-request-origin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAiB9C;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,cAAc,EACnB,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAeT"}