@betterportal/auth-default 0.0.1

package/lib/userStore.d.ts

@@ -0,0 +1,52 @@
+export interface StoredUser {
+    id: string;
+    username: string;
+    passwordHash: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+    tenantId: string;
+    appRoles: Record<string, string[]>;
+    enabled: boolean;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface AuthenticatedUser {
+    id: string;
+    username: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+    tenantId: string;
+    roles: string[];
+}
+export interface CreateUserInput {
+    username: string;
+    password: string;
+    tenantId: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+    appRoles?: Record<string, string[]>;
+}
+export declare class UserStore {
+    private readonly filePath;
+    private cache;
+    constructor(filePath: string);
+    createUser(input: CreateUserInput): Promise<StoredUser>;
+    /**
+     * True when no users exist. Bootstrap flows use this to allow open registration
+     * for the first admin user only. Once any user exists, registration is closed.
+     */
+    hasNoUsers(): boolean;
+    userCount(): number;
+    authenticate(tenantId: string, appId: string, username: string, password: string): Promise<AuthenticatedUser | null>;
+    findById(id: string): StoredUser | null;
+    resolveRolesForApp(userId: string, appId: string): string[];
+    setPassword(userId: string, newPassword: string): Promise<void>;
+    setEnabled(userId: string, enabled: boolean): void;
+    setAppRoles(userId: string, appId: string, roles: string[]): void;
+    private load;
+    private save;
+}
+//# sourceMappingURL=userStore.d.ts.map

package/lib/userStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userStore.d.ts","sourceRoot":"","sources":["../src/userStore.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACrC;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,KAAK,CAA8B;gBAE/B,QAAQ,EAAE,MAAM;IAItB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IA2B7D;;;OAGG;IACH,UAAU,IAAI,OAAO;IAIrB,SAAS,IAAI,MAAM;IAIb,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA6B1H,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAKvC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAMrD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IASlD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IASjE,OAAO,CAAC,IAAI;IAeZ,OAAO,CAAC,IAAI;CAKb"}

package/lib/userStore.js

@@ -0,0 +1,132 @@
+import bcrypt from "bcrypt";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { uuidv7 } from "@betterportal/framework";
+const BCRYPT_ROUNDS = 12;
+export class UserStore {
+    filePath;
+    cache = null;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async createUser(input) {
+        const file = this.load();
+        if (file.users.some((user) => user.username === input.username && user.tenantId === input.tenantId)) {
+            throw new Error(`User ${input.username} already exists for tenant ${input.tenantId}`);
+        }
+        const now = Date.now();
+        const passwordHash = await bcrypt.hash(input.password, BCRYPT_ROUNDS);
+        const user = {
+            id: generateUserId(),
+            username: input.username,
+            passwordHash,
+            email: input.email,
+            name: input.name,
+            picture: input.picture,
+            tenantId: input.tenantId,
+            appRoles: input.appRoles ?? {},
+            enabled: true,
+            createdAt: now,
+            updatedAt: now
+        };
+        file.users.push(user);
+        this.save(file);
+        return user;
+    }
+    /**
+     * True when no users exist. Bootstrap flows use this to allow open registration
+     * for the first admin user only. Once any user exists, registration is closed.
+     */
+    hasNoUsers() {
+        return this.load().users.length === 0;
+    }
+    userCount() {
+        return this.load().users.length;
+    }
+    async authenticate(tenantId, appId, username, password) {
+        const file = this.load();
+        const user = file.users.find((entry) => entry.username === username && entry.tenantId === tenantId);
+        if (!user) {
+            await bcrypt.compare(password, "$2b$12$invalidsaltinvalidsaltinvalidsaltinvalidsaltinvalidsa");
+            return null;
+        }
+        if (!user.enabled) {
+            return null;
+        }
+        const ok = await bcrypt.compare(password, user.passwordHash);
+        if (!ok) {
+            return null;
+        }
+        const roles = user.appRoles[appId] ?? [];
+        return {
+            id: user.id,
+            username: user.username,
+            email: user.email,
+            name: user.name,
+            picture: user.picture,
+            tenantId: user.tenantId,
+            roles
+        };
+    }
+    findById(id) {
+        const file = this.load();
+        return file.users.find((user) => user.id === id) ?? null;
+    }
+    resolveRolesForApp(userId, appId) {
+        const user = this.findById(userId);
+        if (!user || !user.enabled)
+            return [];
+        return user.appRoles[appId] ?? [];
+    }
+    async setPassword(userId, newPassword) {
+        const file = this.load();
+        const user = file.users.find((entry) => entry.id === userId);
+        if (!user)
+            throw new Error(`User ${userId} not found`);
+        user.passwordHash = await bcrypt.hash(newPassword, BCRYPT_ROUNDS);
+        user.updatedAt = Date.now();
+        this.save(file);
+    }
+    setEnabled(userId, enabled) {
+        const file = this.load();
+        const user = file.users.find((entry) => entry.id === userId);
+        if (!user)
+            throw new Error(`User ${userId} not found`);
+        user.enabled = enabled;
+        user.updatedAt = Date.now();
+        this.save(file);
+    }
+    setAppRoles(userId, appId, roles) {
+        const file = this.load();
+        const user = file.users.find((entry) => entry.id === userId);
+        if (!user)
+            throw new Error(`User ${userId} not found`);
+        user.appRoles[appId] = roles;
+        user.updatedAt = Date.now();
+        this.save(file);
+    }
+    load() {
+        if (this.cache)
+            return this.cache;
+        if (!existsSync(this.filePath)) {
+            this.cache = { version: 1, users: [] };
+            return this.cache;
+        }
+        const raw = readFileSync(this.filePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== 1 || !Array.isArray(parsed.users)) {
+            throw new Error(`User store ${this.filePath} is malformed`);
+        }
+        this.cache = parsed;
+        return this.cache;
+    }
+    save(file) {
+        mkdirSync(dirname(this.filePath), { recursive: true });
+        writeFileSync(this.filePath, JSON.stringify(file, null, 2), { mode: 0o600 });
+        this.cache = file;
+    }
+}
+function generateUserId() {
+    return uuidv7();
+}
+//# sourceMappingURL=userStore.js.map

package/lib/userStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userStore.js","sourceRoot":"","sources":["../src/userStore.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,aAAa,GAAG,EAAE,CAAC;AAyCzB,MAAM,OAAO,SAAS;IACH,QAAQ,CAAS;IAC1B,KAAK,GAAyB,IAAI,CAAC;IAE3C,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,QAAQ,8BAA8B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,cAAc,EAAE;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;YAC9B,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,QAAgB,EAAE,QAAgB;QACpF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAEpG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAC;YAC/F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;SACN,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IAC3D,CAAC;IAED,kBAAkB,CAAC,MAAc,EAAE,KAAa;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,WAAmB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,KAAe;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;QAChD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,QAAQ,eAAe,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,IAAI,CAAC,IAAmB;QAC9B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;CACF;AAED,SAAS,cAAc;IACrB,OAAO,MAAM,EAAE,CAAC;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@betterportal/auth-default",
+  "version": "0.0.1",
+  "description": "BetterPortal v10 default auth service for Node.js",
+  "main": "lib/index.js",
+  "types": "src/index.ts",
+  "scripts": {
+    "bp-codegen": "bp-codegen",
+    "build": "bsb-plugin-cli build",
+    "clean": "bsb-plugin-cli clean",
+    "start": "bsb-plugin-cli start",
+    "dev": "bsb-plugin-cli dev",
+    "test": "tsx --test tests/*.test.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "betterportal",
+    "auth",
+    "jwt",
+    "jwks",
+    "platform-service"
+  ],
+  "author": "BetterCorp",
+  "license": "(AGPL-3.0-only OR Commercial)",
+  "type": "module",
+  "devDependencies": {
+    "@bsb/base": "^9.5.0",
+    "@types/bcrypt": "^5.0.2",
+    "@types/node": "^24.12.2",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3"
+  },
+  "dependencies": {
+    "@betterportal/framework": "0.0.1",
+    "@betterportal/plugin-bsb": "0.0.1",
+    "anyvali": "^1.0.6",
+    "bcrypt": "^5.1.1",
+    "jsx-htmx": "4.0.0-beta2"
+  },
+  "files": [
+    "lib/**/*",
+    "README.md",
+    "bsb-plugin.json",
+    "bsb-tests.json"
+  ],
+  "bsb": {
+    "hooks": {
+      "afterSchemas": "bp-codegen"
+    }
+  },
+  "betterportal": {
+    "routes": [
+      "src/plugins/service-betterportal-auth-default/bp-routes/"
+    ]
+  },
+  "homepage": "https://github.com/BetterCorp/BetterPortal#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BetterCorp/BetterPortal.git",
+    "directory": "services/nodejs/auth-default"
+  },
+  "bugs": {
+    "url": "https://github.com/BetterCorp/BetterPortal/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}