@breadstone/archipel-platform-authentication 0.0.13 → 0.0.14

package/src/services/VerificationService.js

@@ -3,9 +3,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VerificationService = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
+const node_crypto_1 = require("node:crypto");
 const VerificationSubjectPort_1 = require("../contracts/VerificationSubjectPort");
 const env_1 = require("../env");
 // #endregion
@@ -65,6 +67,9 @@ let VerificationService = class VerificationService {
     async verifyToken(token) {
         if (this._jwtService.verify(token)) {
             const jwt = this._jwtService.decode(token);
+            if (!jwt) {
+                throw new common_1.BadRequestException('Invalid or expired token');
+            }
             // check if the token is expired
             if (jwt.exp && Number(jwt.exp) < Math.floor(Date.now() / 1000)) {
                 throw new common_1.BadRequestException('Invalid or expired token');
@@ -87,19 +92,19 @@ let VerificationService = class VerificationService {
         }
         if (user.verificationToken) {
             const jwt = await this.redeemToken(user.verificationToken);
-            if (jwt['email'] !== user.email) {
-                throw new common_1.BadRequestException('Invalid verification token');
-            }
-            if (jwt['pin'] !== pin) {
+            const jwtEmail = String(jwt['email'] ?? '');
+            const jwtPin = String(jwt['pin'] ?? '');
+            const userEmail = String(user.email ?? '');
+            const emailMatch = this.safeEqual(jwtEmail, userEmail);
+            const pinMatch = this.safeEqual(jwtPin, pin);
+            if (!emailMatch || !pinMatch) {
                 throw new common_1.BadRequestException('Invalid verification token');
             }
             if (jwt['exp'] && Number(jwt['exp']) < Math.floor(Date.now() / 1000)) {
                 throw new common_1.BadRequestException('Expired verification token');
             }
-            if (jwt['pin'] === pin && jwt['email'] === user.email) {
-                await this._verificationSubject.markVerified(user.id);
-                return true;
-            }
+            await this._verificationSubject.markVerified(user.id);
+            return true;
         }
         return false;
     }
@@ -113,6 +118,23 @@ let VerificationService = class VerificationService {
     buildVerificationLink(token) {
         return `${this._hostService.host}/api/auth/verify-token?token=${token}`; // get this dynamically or from config
     }
+    /**
+     * Performs a constant-time string comparison to prevent timing attacks.
+     *
+     * @param a - First string.
+     * @param b - Second string.
+     * @returns Whether the strings are equal.
+     */
+    safeEqual(a, b) {
+        const bufA = Buffer.from(a, 'utf8');
+        const bufB = Buffer.from(b, 'utf8');
+        if (bufA.length !== bufB.length) {
+            // Perform a dummy comparison to keep constant time even on length mismatch
+            (0, node_crypto_1.timingSafeEqual)(bufA, bufA);
+            return false;
+        }
+        return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
+    }
 };
 exports.VerificationService = VerificationService;
 exports.VerificationService = VerificationService = tslib_1.__decorate([
@@ -120,6 +142,6 @@ exports.VerificationService = VerificationService = tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [jwt_1.JwtService,
         archipel_platform_core_1.HostService,
         VerificationSubjectPort_1.VerificationSubjectPort,
-        archipel_platform_core_1.ConfigService])
+        archipel_platform_configuration_1.ConfigService])
 ], VerificationService);
 //# sourceMappingURL=VerificationService.js.map

package/src/strategies/AnonymousStrategy.d.ts

@@ -1,32 +0,0 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
-import { Strategy } from 'passport-custom';
-import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
-import type { IAuthSubject } from '../contracts/IAuthSubject';
-declare const AnonymousStrategy_base: new () => Strategy & {
-    validate(...args: any[]): unknown;
-};
-/**
- * Anonymous strategy for temporary user login.
- *
- * @public
- */
-export declare class AnonymousStrategy extends AnonymousStrategy_base {
-    private readonly _authSubject;
-    private readonly _configService;
-    /**
-     * Constructs a new instance of the `AnonymousStrategy` class.
-     *
-     * @public
-     * @param authSubject Auth subject port instance.
-     * @param configService Configuration service instance.
-     */
-    constructor(authSubject: AuthSubjectPort, configService: ConfigService);
-    /**
-     * Validates the authentication credentials.
-     *
-     * @public
-     * @returns The authenticated user and this is also later available in the request.user object
-     */
-    validate(): Promise<IAuthSubject>;
-}
-export {};

package/src/strategies/AnonymousStrategy.js

@@ -1,54 +0,0 @@
-"use strict";
-// #region Imports
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AnonymousStrategy = void 0;
-const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
-const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
-const passport_custom_1 = require("passport-custom");
-const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
-const env_1 = require("../env");
-// #endregion
-/**
- * Anonymous strategy for temporary user login.
- *
- * @public
- */
-let AnonymousStrategy = class AnonymousStrategy extends (0, passport_1.PassportStrategy)(passport_custom_1.Strategy, 'anonymous') {
-    // #endregion
-    // #region Ctor
-    /**
-     * Constructs a new instance of the `AnonymousStrategy` class.
-     *
-     * @public
-     * @param authSubject Auth subject port instance.
-     * @param configService Configuration service instance.
-     */
-    constructor(authSubject, configService) {
-        super();
-        this._authSubject = authSubject;
-        this._configService = configService;
-    }
-    // #endregion
-    // #region Methods
-    /**
-     * Validates the authentication credentials.
-     *
-     * @public
-     * @returns The authenticated user and this is also later available in the request.user object
-     */
-    async validate() {
-        const user = await this._authSubject.findAnonymous(this._configService.get(env_1.SEED_ANONYMOUS_USERNAME.key));
-        if (!user) {
-            throw new common_1.NotFoundException('User not found');
-        }
-        return user;
-    }
-};
-exports.AnonymousStrategy = AnonymousStrategy;
-exports.AnonymousStrategy = AnonymousStrategy = tslib_1.__decorate([
-    (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.ConfigService])
-], AnonymousStrategy);
-//# sourceMappingURL=AnonymousStrategy.js.map