@bitblit/ratchet-warden-server 4.0.84-alpha

package/dist/es/server/provider/warden-twilio-text-message-sending-provider.js

@@ -0,0 +1,27 @@
+import { WardenContactType } from '@bitblit/ratchet-warden-common';
+import { Logger, TwilioRatchet } from '@bitblit/ratchet-common';
+export class WardenTwilioTextMessageSendingProvider {
+    constructor(optsPromise) {
+        this.optsPromise = optsPromise;
+    }
+    async formatMessage(contact, messageType, context) {
+        Logger.info('Creating text');
+        const msg = context['code'] +
+            ' is your ' +
+            context['relyingPartyName'] +
+            ' authentication code.\n@' +
+            context['relyingPartyName'] +
+            ' #' +
+            context['code'];
+        return msg;
+    }
+    handlesContactType(type) {
+        return type === WardenContactType.TextCapablePhoneNumber;
+    }
+    async sendMessage(contact, message) {
+        const opts = await this.optsPromise;
+        const rval = await TwilioRatchet.sendMessageDirect(opts.accountSID, opts.authToken, opts.outBoundNumber, [contact.value], message);
+        Logger.debug('sendMessage was : %j', rval);
+        return !!rval && rval.length > 0;
+    }
+}

package/dist/es/server/provider/warden-user-decoration-provider.js

@@ -0,0 +1 @@
+export {};

package/dist/es/server/warden-service-options.js

@@ -0,0 +1 @@
+export {};

package/dist/es/server/warden-service.js

@@ -0,0 +1,450 @@
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
+import { WardenCustomerMessageType, WardenStoreRegistrationResponseType, WardenUtils, } from '@bitblit/ratchet-warden-common';
+import { ExpiringCodeRatchet } from '@bitblit/ratchet-aws';
+import { Base64Ratchet, ErrorRatchet, ExpiredJwtHandling, Logger, RequireRatchet, StringRatchet } from '@bitblit/ratchet-common';
+import { WardenDefaultUserDecorationProvider } from './provider/warden-default-user-decoration-provider';
+import { WardenNoOpEventProcessingProvider } from './provider/warden-no-op-event-processing-provider';
+export class WardenService {
+    constructor(inOptions) {
+        this.inOptions = inOptions;
+        RequireRatchet.notNullOrUndefined(inOptions, 'options');
+        RequireRatchet.notNullOrUndefined(inOptions.relyingPartyName, 'options.relyingPartyName');
+        RequireRatchet.notNullUndefinedOrEmptyArray(inOptions.allowedOrigins, 'options.allowedOrigins');
+        RequireRatchet.notNullOrUndefined(inOptions.storageProvider, 'options.storageProvider');
+        RequireRatchet.notNullUndefinedOrEmptyArray(inOptions.messageSendingProviders, 'options.messageSendingProviders');
+        RequireRatchet.notNullOrUndefined(inOptions.expiringCodeProvider, 'options.expiringCodeProvider');
+        RequireRatchet.notNullOrUndefined(inOptions.jwtRatchet, 'options.jwtRatchet');
+        this.opts = Object.assign({ userTokenDataProvider: new WardenDefaultUserDecorationProvider(), eventProcessor: new WardenNoOpEventProcessingProvider() }, inOptions);
+        this.expiringCodeRatchet = new ExpiringCodeRatchet(this.opts.expiringCodeProvider);
+    }
+    get options() {
+        return Object.assign({}, this.opts);
+    }
+    findEntryByContact(contact) {
+        return this.opts.storageProvider.findEntryByContact(contact);
+    }
+    async processCommandStringToString(cmdString, origin, loggedInUserId) {
+        let rval = null;
+        try {
+            const cmd = JSON.parse(cmdString);
+            const resp = await this.processCommandToResponse(cmd, origin, loggedInUserId);
+            if (resp === null) {
+                Logger.warn('Response was null for %s %s %s', cmdString, origin, loggedInUserId);
+            }
+            else {
+                rval = JSON.stringify(resp);
+            }
+        }
+        catch (err) {
+            const errString = ErrorRatchet.safeStringifyErr(err);
+            Logger.error('Failed %s : %j', errString, cmdString, err);
+            rval = JSON.stringify({ error: errString });
+        }
+        return rval;
+    }
+    async processCommandToResponse(cmd, origin, loggedInUserId) {
+        let rval = null;
+        if (cmd) {
+            Logger.info('Processing command : UserID: %s  Origin: %s Command: %j', loggedInUserId, origin, cmd);
+            if (cmd.sendExpiringValidationToken) {
+                rval = { sendExpiringValidationToken: await this.sendExpiringValidationToken(cmd.sendExpiringValidationToken) };
+            }
+            else if (cmd.generateWebAuthnAuthenticationChallengeForUserId) {
+                const tmp = await this.generateWebAuthnAuthenticationChallengeForUserId(cmd.generateWebAuthnAuthenticationChallengeForUserId, origin);
+                rval = { generateWebAuthnAuthenticationChallengeForUserId: { dataAsJson: JSON.stringify(tmp) } };
+            }
+            else if (cmd.createAccount) {
+                rval = {
+                    createAccount: await this.createAccount(cmd.createAccount.contact, cmd.createAccount.sendCode, cmd.createAccount.label, cmd.createAccount.tags),
+                };
+            }
+            else if (cmd.generateWebAuthnRegistrationChallengeForLoggedInUser) {
+                if (!StringRatchet.trimToNull(loggedInUserId)) {
+                    ErrorRatchet.throwFormattedErr('This requires a logged in user');
+                }
+                const tmp = await this.generateWebAuthnRegistrationChallengeForLoggedInUser(loggedInUserId, origin);
+                rval = { generateWebAuthnRegistrationChallengeForLoggedInUser: { dataAsJson: JSON.stringify(tmp) } };
+            }
+            else if (cmd.addContactToLoggedInUser) {
+                if (!WardenUtils.validContact(cmd.addContactToLoggedInUser)) {
+                    ErrorRatchet.throwFormattedErr('Cannot add, invalid contact %j', cmd.addContactToLoggedInUser);
+                }
+                else {
+                    const out = await this.addContactMethodToUser(loggedInUserId, cmd.addContactToLoggedInUser);
+                    rval = { addContactToLoggedInUser: out };
+                }
+            }
+            else if (cmd.addWebAuthnRegistrationToLoggedInUser) {
+                if (!StringRatchet.trimToNull(loggedInUserId)) {
+                    ErrorRatchet.throwFormattedErr('This requires a logged in user');
+                }
+                const data = JSON.parse(cmd.addWebAuthnRegistrationToLoggedInUser.dataAsJson);
+                const out = await this.storeAuthnRegistration(loggedInUserId, origin, data);
+                if (out.updatedEntry) {
+                    rval = { addWebAuthnRegistrationToLoggedInUser: WardenUtils.stripWardenEntryToSummary(out.updatedEntry) };
+                }
+                else if (out.error) {
+                    rval = { error: out.error };
+                }
+                else {
+                    rval = { error: 'Cannot happen - neither user nor error set' };
+                }
+            }
+            else if (cmd.removeWebAuthnRegistration) {
+                const modified = await this.removeSingleWebAuthnRegistration(cmd.removeWebAuthnRegistration.userId, cmd.removeWebAuthnRegistration.credentialId);
+                rval = {
+                    removeWebAuthnRegistration: WardenUtils.stripWardenEntryToSummary(modified),
+                };
+            }
+            else if (cmd.removeWebAuthnRegistrationFromLoggedInUser) {
+                const modified = await this.removeSingleWebAuthnRegistration(loggedInUserId, cmd.removeWebAuthnRegistrationFromLoggedInUser);
+                rval = {
+                    removeWebAuthnRegistrationFromLoggedInUser: WardenUtils.stripWardenEntryToSummary(modified),
+                };
+            }
+            else if (cmd.removeContactFromLoggedInUser) {
+                const output = await this.removeContactMethodFromUser(loggedInUserId, cmd.removeContactFromLoggedInUser);
+                rval = {
+                    removeContactFromLoggedInUser: WardenUtils.stripWardenEntryToSummary(output),
+                };
+            }
+            else if (cmd.performLogin) {
+                const loginData = cmd.performLogin;
+                const loginOk = await this.processLogin(loginData, origin);
+                Logger.info('Performing login - login auth check was : %s', loginOk);
+                if (loginOk) {
+                    const user = StringRatchet.trimToNull(loginData.userId)
+                        ? await this.opts.storageProvider.findEntryById(loginData.userId)
+                        : await this.opts.storageProvider.findEntryByContact(loginData.contact);
+                    const decoration = await this.opts.userDecorationProvider.fetchDecoration(user);
+                    const wardenToken = {
+                        loginData: WardenUtils.stripWardenEntryToSummary(user),
+                        user: decoration.userTokenData,
+                        roles: WardenUtils.teamRolesToRoles(decoration.userTeamRoles),
+                        proxy: null,
+                    };
+                    const jwtToken = await this.opts.jwtRatchet.createTokenString(wardenToken, decoration.userTokenExpirationSeconds);
+                    const output = {
+                        request: loginData,
+                        userId: user.userId,
+                        jwtToken: jwtToken,
+                    };
+                    rval = { performLogin: output };
+                }
+                else {
+                    rval = { error: 'Login failed' };
+                }
+            }
+            else if (cmd.refreshJwtToken) {
+                const parsed = await this.opts.jwtRatchet.decodeToken(cmd.refreshJwtToken, ExpiredJwtHandling.THROW_EXCEPTION);
+                const user = await this.opts.storageProvider.findEntryById(parsed.loginData.userId);
+                const decoration = await this.opts.userDecorationProvider.fetchDecoration(user);
+                const wardenToken = {
+                    loginData: WardenUtils.stripWardenEntryToSummary(user),
+                    user: decoration.userTokenData,
+                    roles: WardenUtils.teamRolesToRoles(decoration.userTeamRoles),
+                    proxy: null,
+                };
+                const newToken = await this.opts.jwtRatchet.createTokenString(wardenToken, decoration.userTokenExpirationSeconds);
+                rval = {
+                    refreshJwtToken: newToken,
+                };
+            }
+        }
+        else {
+            rval = { error: 'No command sent' };
+        }
+        return rval;
+    }
+    async createAccount(contact, sendCode, label, tags) {
+        let rval = null;
+        if (WardenUtils.validContact(contact)) {
+            const old = await this.opts.storageProvider.findEntryByContact(contact);
+            if (!!old) {
+                ErrorRatchet.throwFormattedErr('Cannot create - account already exists for %j', contact);
+            }
+            const prov = this.senderForContact(contact);
+            if (!prov) {
+                ErrorRatchet.throwFormattedErr('Cannot create - no sending provider for type %s', contact.type);
+            }
+            const guid = StringRatchet.createType4Guid();
+            const now = Date.now();
+            const newUser = {
+                userId: guid,
+                userLabel: label || 'User ' + guid,
+                contactMethods: [contact],
+                tags: tags || [],
+                webAuthnAuthenticators: [],
+                createdEpochMS: now,
+                updatedEpochMS: now,
+            };
+            const next = await this.opts.storageProvider.saveEntry(newUser);
+            rval = next.userId;
+            if (this?.opts?.eventProcessor) {
+                await this.opts.eventProcessor.userCreated(next);
+            }
+            if (sendCode) {
+                Logger.info('New user %j created and send requested - sending', next);
+                await this.sendExpiringValidationToken(contact);
+            }
+        }
+        else {
+            ErrorRatchet.throwFormattedErr('Cannot create - invalid contact (missing or invalid fields)');
+        }
+        return rval;
+    }
+    async addContactMethodToUser(userId, contact) {
+        let rval = false;
+        if (StringRatchet.trimToNull(userId) && WardenUtils.validContact(contact)) {
+            const otherUser = await this.opts.storageProvider.findEntryByContact(contact);
+            if (otherUser && otherUser.userId !== userId) {
+                ErrorRatchet.throwFormattedErr('Cannot add contact to this user, another user already has that contact');
+            }
+            const curUser = await this.opts.storageProvider.findEntryById(userId);
+            if (!curUser) {
+                ErrorRatchet.throwFormattedErr('Cannot add contact to this user, user does not exist');
+            }
+            curUser.contactMethods.push(contact);
+            await this.opts.storageProvider.saveEntry(curUser);
+            rval = true;
+        }
+        else {
+            ErrorRatchet.throwFormattedErr('Cannot add - invalid config : %s %j', userId, contact);
+        }
+        return rval;
+    }
+    async removeContactMethodFromUser(userId, contact) {
+        let rval = null;
+        if (StringRatchet.trimToNull(userId) && WardenUtils.validContact(contact)) {
+            const curUser = await this.opts.storageProvider.findEntryById(userId);
+            if (!curUser) {
+                ErrorRatchet.throwFormattedErr('Cannot remove contact from this user, user does not exist');
+            }
+            curUser.contactMethods = (curUser.contactMethods || []).filter((s) => s.type !== contact.type || s.value !== contact.value);
+            if (curUser.contactMethods.length === 0) {
+                ErrorRatchet.throwFormattedErr('Cannot remove the last contact method from a user');
+            }
+            await this.opts.storageProvider.saveEntry(curUser);
+            rval = await this.opts.storageProvider.findEntryById(userId);
+        }
+        else {
+            ErrorRatchet.throwFormattedErr('Cannot add - invalid config : %s %j', userId, contact);
+        }
+        return rval;
+    }
+    async generateWebAuthnRegistrationChallengeForLoggedInUser(userId, origin) {
+        if (!origin || !this.opts.allowedOrigins.includes(origin)) {
+            throw new Error('Invalid origin : ' + origin);
+        }
+        const asUrl = new URL(origin);
+        const rpID = asUrl.hostname;
+        const entry = await this.opts.storageProvider.findEntryById(userId);
+        const options = generateRegistrationOptions({
+            rpName: this.opts.relyingPartyName,
+            rpID: rpID,
+            userID: entry.userId,
+            userName: entry.userLabel,
+            attestationType: 'none',
+            excludeCredentials: entry.webAuthnAuthenticators.map((authenticator) => ({
+                id: Base64Ratchet.base64StringToBuffer(authenticator.credentialPublicKeyBase64),
+                type: 'public-key',
+                transports: authenticator.transports,
+            })),
+        });
+        await this.opts.storageProvider.updateUserChallenge(entry.userId, rpID, options.challenge);
+        return options;
+    }
+    async storeAuthnRegistration(userId, origin, data) {
+        Logger.info('Store authn data : %j', data);
+        let rval = null;
+        try {
+            if (!origin || !this.opts.allowedOrigins.includes(origin)) {
+                throw new Error('Invalid origin : ' + origin);
+            }
+            const asUrl = new URL(origin);
+            const rpID = asUrl.hostname;
+            const user = await this.opts.storageProvider.findEntryById(userId);
+            const expectedChallenge = await this.opts.storageProvider.fetchCurrentUserChallenge(user.userId, rpID);
+            const vrOpts = {
+                response: data,
+                expectedChallenge: expectedChallenge,
+                expectedOrigin: origin,
+                expectedRPID: rpID,
+            };
+            Logger.info('Calling verifyRegistrationResponse: %j', vrOpts);
+            const verification = await verifyRegistrationResponse(vrOpts);
+            Logger.info('verifyRegistrationResponse Result : %j', verification);
+            rval = {
+                updatedEntry: null,
+                registrationResponseId: data.id,
+                result: verification.verified ? WardenStoreRegistrationResponseType.Verified : WardenStoreRegistrationResponseType.Failed,
+            };
+            if (rval.result === WardenStoreRegistrationResponseType.Verified) {
+                Logger.info('Storing registration');
+                const newAuth = {
+                    counter: verification.registrationInfo.counter,
+                    credentialBackedUp: verification.registrationInfo.credentialBackedUp,
+                    credentialDeviceType: verification.registrationInfo.credentialDeviceType,
+                    credentialIdBase64: data.id,
+                    credentialPublicKeyBase64: Base64Ratchet.generateBase64VersionOfBuffer(Buffer.from(verification.registrationInfo.credentialPublicKey)),
+                };
+                user.webAuthnAuthenticators = (user.webAuthnAuthenticators || []).filter((wa) => wa.credentialIdBase64 !== newAuth.credentialIdBase64);
+                user.webAuthnAuthenticators.push(newAuth);
+                const storedUser = await this.opts.storageProvider.saveEntry(user);
+                rval.updatedEntry = storedUser;
+                Logger.info('Stored auth : %j', storedUser);
+            }
+        }
+        catch (err) {
+            rval = {
+                registrationResponseId: data.id,
+                result: WardenStoreRegistrationResponseType.Error,
+                error: ErrorRatchet.safeStringifyErr(err),
+            };
+        }
+        return rval;
+    }
+    async generateWebAuthnAuthenticationChallengeForUserId(userId, origin) {
+        const user = await this.opts.storageProvider.findEntryById(userId);
+        const rval = await this.generateWebAuthnAuthenticationChallenge(user, origin);
+        return rval;
+    }
+    async generateWebAuthnAuthenticationChallenge(user, origin) {
+        const userAuthenticators = user.webAuthnAuthenticators;
+        if (!origin || !this.opts.allowedOrigins.includes(origin)) {
+            throw new Error('Invalid origin : ' + origin);
+        }
+        const asUrl = new URL(origin);
+        const rpID = asUrl.hostname;
+        const out = userAuthenticators.map((authenticator) => {
+            const next = {
+                id: Buffer.from(authenticator.credentialIdBase64, 'base64'),
+                type: 'public-key',
+                transports: authenticator.transports,
+            };
+            return next;
+        });
+        const options = generateAuthenticationOptions({
+            allowCredentials: out,
+            userVerification: 'preferred',
+        });
+        await this.opts.storageProvider.updateUserChallenge(user.userId, rpID, options.challenge);
+        return options;
+    }
+    senderForContact(contact) {
+        let rval = null;
+        if (contact?.type) {
+            rval = (this.opts.messageSendingProviders || []).find((p) => p.handlesContactType(contact.type));
+        }
+        return rval;
+    }
+    async sendExpiringValidationToken(request) {
+        let rval = false;
+        if (request?.type && StringRatchet.trimToNull(request?.value)) {
+            const prov = this.senderForContact(request);
+            if (prov) {
+                const token = await this.expiringCodeRatchet.createNewCode({
+                    context: request.value,
+                    length: 6,
+                    alphabet: '0123456789',
+                    timeToLiveSeconds: 300,
+                    tags: ['Login'],
+                });
+                const msg = await prov.formatMessage(request, WardenCustomerMessageType.ExpiringCode, {
+                    code: token.code,
+                    relyingPartyName: this.opts.relyingPartyName,
+                });
+                rval = await prov.sendMessage(request, msg);
+            }
+            else {
+                ErrorRatchet.throwFormattedErr('No provider found for contact type %s', request.type);
+            }
+        }
+        else {
+            ErrorRatchet.throwFormattedErr('Cannot send - invalid request %j', request);
+        }
+        return rval;
+    }
+    async processLogin(request, origin) {
+        Logger.info('Processing login : %s : %j', origin, request);
+        let rval = false;
+        RequireRatchet.notNullOrUndefined(request, 'request');
+        RequireRatchet.true(!!StringRatchet.trimToNull(request?.userId) || WardenUtils.validContact(request?.contact), 'Invalid contact and no userId');
+        RequireRatchet.true(!!request?.webAuthn || !!StringRatchet.trimToNull(request?.expiringToken), 'You must provide one of webAuthn or expiringToken');
+        RequireRatchet.true(!request?.webAuthn || !StringRatchet.trimToNull(request?.expiringToken), 'WebAuthn and ExpiringToken may not BOTH be set');
+        const user = StringRatchet.trimToNull(request?.userId)
+            ? await this.opts.storageProvider.findEntryById(request?.userId)
+            : await this.opts.storageProvider.findEntryByContact(request.contact);
+        if (!user) {
+            ErrorRatchet.throwFormattedErr('No user found for %j / %s', request?.contact, request?.userId);
+        }
+        if (request.webAuthn) {
+            rval = await this.loginWithWebAuthnRequest(user, origin, request.webAuthn);
+        }
+        else if (StringRatchet.trimToNull(request.expiringToken)) {
+            const lookup = await this.expiringCodeRatchet.checkCode(StringRatchet.trimToEmpty(request.expiringToken), StringRatchet.trimToEmpty(request.contact.value), true);
+            if (lookup) {
+                rval = true;
+            }
+            else {
+                ErrorRatchet.throwFormattedErr('Cannot login - token is invalid for this user');
+            }
+        }
+        return rval;
+    }
+    async loginWithWebAuthnRequest(user, origin, data) {
+        let rval = false;
+        const asUrl = new URL(origin);
+        const rpID = asUrl.hostname;
+        const expectedChallenge = await this.opts.storageProvider.fetchCurrentUserChallenge(user.userId, rpID);
+        const auth = (user.webAuthnAuthenticators || []).find((s) => s.credentialIdBase64 === data.id);
+        if (!auth) {
+            throw new Error(`Could not find authenticator ${data.id} for user ${user.userId}`);
+        }
+        const authenticator = {
+            counter: auth.counter,
+            credentialID: Base64Ratchet.base64StringToBuffer(auth.credentialIdBase64),
+            credentialPublicKey: Base64Ratchet.base64StringToBuffer(auth.credentialPublicKeyBase64),
+        };
+        const vrOpts = {
+            response: data,
+            expectedChallenge,
+            expectedOrigin: origin,
+            expectedRPID: rpID,
+            authenticator,
+        };
+        const verification = await verifyAuthenticationResponse(vrOpts);
+        if (verification.verified) {
+            rval = true;
+        }
+        return rval;
+    }
+    async removeSingleWebAuthnRegistration(userId, key) {
+        let ent = await this.opts.storageProvider.findEntryById(userId);
+        if (ent) {
+            ent.webAuthnAuthenticators = (ent.webAuthnAuthenticators || []).filter((s) => s.credentialIdBase64 !== key);
+            ent = await this.opts.storageProvider.saveEntry(ent);
+        }
+        else {
+            Logger.info('Not removing - no such user as %s', userId);
+        }
+        return ent;
+    }
+    async removeUser(userId) {
+        let rval = false;
+        if (StringRatchet.trimToNull(userId)) {
+            const oldUser = await this.opts.storageProvider.findEntryById(userId);
+            if (oldUser) {
+                await this.opts.storageProvider.removeEntry(userId);
+                if (this?.opts?.eventProcessor) {
+                    await this.opts.eventProcessor.userRemoved(oldUser);
+                }
+                rval = true;
+            }
+            else {
+                Logger.warn('Cannot remove non-existent user : %s', userId);
+            }
+        }
+        return rval;
+    }
+}