@better-forge/auth 0.0.0-stage → 0.1.1

package/dist/setupRoutes.js

@@ -0,0 +1,70 @@
+import bcrypt from 'bcryptjs';
+import { eq } from 'drizzle-orm';
+import { users } from './tables.js';
+/**
+ * The first-run routes: whether the application still needs setup, and the one request that creates the administrator
+ * and finishes it. Setup is refused once it is done, and only one attempt runs at a time.
+ */
+export function createSetupRoutes(options) {
+    const { db } = options;
+    let inProgress = false;
+    return async function setupRoutes(app, overrides = {}) {
+        app.get('/status', async () => ({ needsSetup: !options.isSetupComplete() }));
+        app.post('/complete', {
+            config: { rateLimit: options.rateLimit },
+        }, async (req, reply) => {
+            if (options.isSetupComplete()) {
+                return reply.code(409).send({ error: 'Setup already completed' });
+            }
+            const { email, password } = req.body ?? {};
+            if (typeof email !== 'string' || typeof password !== 'string' || !email || !password) {
+                return reply.code(400).send({ error: 'Email and password are required' });
+            }
+            if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+                return reply.code(400).send({ error: 'A valid email address is required' });
+            }
+            if (password.length < 8 || password.length > 128) {
+                return reply.code(400).send({ error: 'Password must be between 8 and 128 characters' });
+            }
+            if (inProgress) {
+                return reply.code(409).send({ error: 'Setup is already in progress' });
+            }
+            inProgress = true;
+            try {
+                // Initialize DB and run migrations now that we have a confirmed DB type
+                options.prepareDatabase();
+                const hash = await bcrypt.hash(password, 10);
+                let setupMarkerWritten = false;
+                const user = await options.withTransaction(async () => {
+                    // The marker can be missing while the data is not (a lost volume, a restore). Accounts that already
+                    // exist mean setup was done: never create or overwrite an administrator over them.
+                    if (!options.allowExistingUsers?.() && (await db.select({ id: users.id }).from(users).limit(1)).length > 0)
+                        return null;
+                    await db.insert(users).values({ email, passwordHash: hash, role: 'admin', createdAt: Date.now() });
+                    await options.onSetup?.();
+                    const admin = (await db.select().from(users).where(eq(users.email, email)))[0];
+                    // Last step: if writing the marker fails the admin insert rolls back with it.
+                    options.writeSetupComplete();
+                    setupMarkerWritten = true;
+                    return admin;
+                }).catch((error) => {
+                    // COMMIT itself failed after the marker was written — undo it so setup can be retried.
+                    if (setupMarkerWritten)
+                        options.removeSetupMarker();
+                    throw error;
+                });
+                if (!user)
+                    return reply.code(409).send({ error: 'Setup already completed' });
+                const startServices = overrides.startBackgroundServices ?? options.startBackgroundServices;
+                startServices?.();
+                const identity = await options.createSession(app, reply, user);
+                const { sessionId: _sessionId, ...safeIdentity } = identity;
+                return safeIdentity;
+            }
+            finally {
+                inProgress = false;
+            }
+        });
+    };
+}
+//# sourceMappingURL=setupRoutes.js.map

package/dist/setupRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupRoutes.js","sourceRoot":"","sources":["../src/setupRoutes.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEhC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAyBnC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAA0C,OAAqC;IAC9G,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAA;IACtB,IAAI,UAAU,GAAG,KAAK,CAAA;IAEtB,OAAO,KAAK,UAAU,WAAW,CAAC,GAAoB,EAAE,YAAsD,EAAE;QAC9G,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAA;QAE5E,GAAG,CAAC,IAAI,CAAgD,WAAW,EAAE;YACnE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SACzC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,IAAI,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;YACnE,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;YAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAA;YAC3E,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACjD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC,CAAA;YACzF,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;YACxE,CAAC;YAED,UAAU,GAAG,IAAI,CAAA;YACjB,IAAI,CAAC;gBACH,wEAAwE;gBACxE,OAAO,CAAC,eAAe,EAAE,CAAA;gBAEzB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;gBAC5C,IAAI,kBAAkB,GAAG,KAAK,CAAA;gBAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;oBACpD,oGAAoG;oBACpG,mFAAmF;oBACnF,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,IAAI,CAAA;oBAEvH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;oBAElG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA;oBAEzB,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAA;oBAC/E,8EAA8E;oBAC9E,OAAO,CAAC,kBAAkB,EAAE,CAAA;oBAC5B,kBAAkB,GAAG,IAAI,CAAA;oBACzB,OAAO,KAAK,CAAA;gBACd,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC1B,uFAAuF;oBACvF,IAAI,kBAAkB;wBAAE,OAAO,CAAC,iBAAiB,EAAE,CAAA;oBACnD,MAAM,KAAK,CAAA;gBACb,CAAC,CAAC,CAAA;gBACF,IAAI,CAAC,IAAI;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;gBAC5E,MAAM,aAAa,GAAG,SAAS,CAAC,uBAAuB,IAAI,OAAO,CAAC,uBAAuB,CAAA;gBAC1F,aAAa,EAAE,EAAE,CAAA;gBACjB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;gBAC9D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAA;gBAC3D,OAAO,YAAY,CAAA;YACrB,CAAC;oBAAS,CAAC;gBACT,UAAU,GAAG,KAAK,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/signInAudit.d.ts

@@ -0,0 +1,19 @@
+import type { AuthOptions } from './context.js';
+/** How the user tried to sign in, as recorded in `diff.method` of 'sign_in' audit entries. */
+export type SignInMethod = 'password' | 'sso';
+/** Why a password, or the authentication-code step of any sign-in, was refused. SSO refusals use the OIDC codes. */
+export type CredentialDenialCode = 'password_login_disabled' | 'no_matching_account' | 'wrong_password' | 'two_factor_expired' | 'invalid_two_factor_code';
+export interface SignInDenial {
+    code: string;
+    reason: string;
+    email?: string | undefined;
+}
+export declare function createSignInAudit(ctx: AuthOptions): {
+    auditSignIn: (user: {
+        id: number;
+        email: string;
+    }, method: SignInMethod, twoFactor: boolean) => Promise<void>;
+    auditSignInDenial: (method: SignInMethod, denial: SignInDenial, extra?: Record<string, unknown>) => Promise<void>;
+};
+export type SignInAudit = ReturnType<typeof createSignInAudit>;
+//# sourceMappingURL=signInAudit.d.ts.map

package/dist/signInAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInAudit.d.ts","sourceRoot":"","sources":["../src/signInAudit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,KAAK,CAAA;AAE7C,oHAAoH;AACpH,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,qBAAqB,GACrB,gBAAgB,GAChB,oBAAoB,GACpB,yBAAyB,CAAA;AAE7B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW;wBAIf;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,UAAU,YAAY,aAAa,OAAO,KAAG,OAAO,CAAC,IAAI,CAAC;gCAQ/E,YAAY,UAAU,YAAY,UAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAQ,OAAO,CAAC,IAAI,CAAC;EASjI;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA"}

package/dist/signInAudit.js

@@ -0,0 +1,16 @@
+export function createSignInAudit(ctx) {
+    const { audit } = ctx;
+    /** Records a successful sign-in; `twoFactor` says whether an authentication code was part of it. */
+    async function auditSignIn(user, method, twoFactor) {
+        await audit.write({ userId: user.id, userEmail: user.email }, 'allow', 'sign_in', user.id, user.email, { method, twoFactor });
+    }
+    /**
+     * Records a refused sign-in. Nobody is signed in, so the actor is user 0 with the email that was entered or that
+     * the provider asserted, when there was one. The user only ever sees a generic message; this holds the reason.
+     */
+    async function auditSignInDenial(method, denial, extra = {}) {
+        await audit.write({ userId: 0, userEmail: denial.email ?? `unknown (${method === 'sso' ? 'SSO' : 'password'})` }, 'deny', 'sign_in', null, denial.email ?? (method === 'sso' ? 'SSO sign-in' : 'Password sign-in'), { method, code: denial.code, reason: denial.reason, ...extra });
+    }
+    return { auditSignIn, auditSignInDenial };
+}
+//# sourceMappingURL=signInAudit.js.map

package/dist/signInAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signInAudit.js","sourceRoot":"","sources":["../src/signInAudit.ts"],"names":[],"mappings":"AAmBA,MAAM,UAAU,iBAAiB,CAAC,GAAgB;IAChD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IAErB,oGAAoG;IACpG,KAAK,UAAU,WAAW,CAAC,IAAmC,EAAE,MAAoB,EAAE,SAAkB;QACtG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/H,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,iBAAiB,CAAC,MAAoB,EAAE,MAAoB,EAAE,QAAiC,EAAE;QAC9G,MAAM,KAAK,CAAC,KAAK,CACf,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,EAC9F,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAChG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAC/D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAA;AAC3C,CAAC"}