@cedarjs/auth-dbauth-setup 7.0.1-next.466 → 7.1.0-rc.32

package/dist/templates/api/functions/auth.webAuthn.oauth.ts.template

@@ -1,382 +0,0 @@
-import type { APIGatewayProxyEvent, Context } from 'aws-lambda'
-
-import { DbAuthHandler } from '@cedarjs/auth-dbauth-api'
-import type { DbAuthHandlerOptions, UserType } from '@cedarjs/auth-dbauth-api'
-import {
-  OAuthHandler,
-  googleProvider,
-  githubProvider,
-} from '@cedarjs/auth-dbauth-oauth'
-
-import { cookieName } from 'src/lib/auth'
-import { db } from 'src/lib/db'
-
-// Any request whose path falls under this prefix is routed to the OAuth
-// handler instead of the regular username/password dbAuth handler. This
-// must match the callback URLs registered with each provider below (e.g.
-// `${apiUrl}/auth/oauth/google/callback`).
-const OAUTH_BASE_PATH = '/auth/oauth'
-
-// The base URL of your deployed api side. Used to build the OAuth callback
-// URLs registered with each provider's developer console. Update the
-// production value once you know your deployed URL.
-const apiUrl =
-  process.env.NODE_ENV === 'development'
-    ? 'http://localhost:8911'
-    : 'https://server.com'
-
-const cookieAttributes = {
-  HttpOnly: true,
-  Path: '/',
-  SameSite: 'Lax' as const,
-  Secure: process.env.NODE_ENV !== 'development',
-
-  // If you need to allow other domains (besides the api side) access to
-  // the dbAuth session cookie:
-  // Domain: 'example.com',
-}
-
-export const handler = async (
-  event: APIGatewayProxyEvent,
-  context: Context
-) => {
-  if (event.path?.includes(OAUTH_BASE_PATH)) {
-    const oauthHandler = new OAuthHandler(event, context, {
-      // Provide prisma db client
-      db: db,
-
-      // The name of the property you'd call on `db` to access your user
-      // table. i.e. if your Prisma model is named `User` this value would
-      // be `user`, as in `db.user`
-      authModelAccessor: 'user',
-
-      // The name of the property you'd call on `db` to access your OAuth
-      // identity table. i.e. if your Prisma model is named `OAuth` this
-      // value would be `oAuth`, as in `db.oAuth`
-      oauthModelAccessor: 'oAuth',
-
-      // A map of what dbAuth calls a field to what your database calls it,
-      // matching the same fields used by `DbAuthHandler` below
-      authFields: {
-        id: 'id',
-        username: 'email',
-        hashedPassword: 'hashedPassword',
-      },
-
-      basePath: OAUTH_BASE_PATH,
-
-      // The configured OAuth providers, keyed by the path segment used in
-      // `/auth/oauth/{key}/...`. Get client id/secret values from each
-      // provider's developer console and set them in your `.env` file.
-      providers: {
-        // @oauth-provider:google
-        google: googleProvider({
-          clientId: process.env.GOOGLE_CLIENT_ID as string,
-          clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
-          redirectUri: `${apiUrl}/auth/oauth/google/callback`,
-        }),
-        // @oauth-provider:google:end
-        // @oauth-provider:github
-        github: githubProvider({
-          clientId: process.env.GITHUB_CLIENT_ID as string,
-          clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
-          redirectUri: `${apiUrl}/auth/oauth/github/callback`,
-        }),
-        // @oauth-provider:github:end
-      },
-
-      // Where to send the browser after each flow completes
-      redirects: {
-        afterLogin: '/',
-        error: '/login',
-      },
-
-      signup: {
-        // handler() is invoked the first time a user signs in with a
-        // configured OAuth provider and no account is linked to that
-        // provider identity yet. `profile` is the canonical profile the
-        // provider returned (`providerUserId`, `email`, `username`, etc).
-        //
-        // At a minimum you need to create and return a user row. There's no
-        // password to store here since this account only ever signs in
-        // through the provider -- if your `User` model requires
-        // `hashedPassword`/`salt`, make sure those fields are optional (or
-        // have a default) so provider-only accounts can be created.
-        handler: ({ profile }) => {
-          // Some providers (e.g. GitHub, when the account keeps its email
-          // private) don't return an email at all. Customize this handler
-          // for any such provider you configure -- ask for an email on a
-          // follow-up screen, or derive a placeholder from a field you know
-          // is always present. Throwing here surfaces to the user as a
-          // `provider_error` redirect instead of silently creating an
-          // account with a fabricated address.
-          if (!profile.email) {
-            throw new Error(
-              `OAuth signup handler needs an email, but ${profile.providerUserId} didn't return one. Customize this handler to handle providers that don't supply an email.`,
-            )
-          }
-
-          return db.user.create({
-            data: {
-              email: profile.email,
-            },
-          })
-        },
-      },
-
-      // How long a user will remain logged in, in seconds
-      sessionExpires: 60 * 60 * 24 * 365 * 10,
-
-      // Specifies attributes on the cookie that dbAuth sets in order to
-      // remember who is logged in. See
-      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
-      cookie: {
-        attributes: cookieAttributes,
-        name: cookieName,
-      },
-    })
-
-    return await oauthHandler.invoke()
-  }
-
-  const forgotPasswordOptions: DbAuthHandlerOptions['forgotPassword'] = {
-    // handler() is invoked after verifying that a user was found with the given
-    // username. This is where you can send the user an email with a link to
-    // reset their password. With the default dbAuth routes and field names, the
-    // URL to reset the password will be:
-    //
-    // https://example.com/reset-password?resetToken=${user.resetToken}
-    //
-    // Whatever is returned from this function will be returned from
-    // the `forgotPassword()` function that is destructured from `useAuth()`
-    // You could use this return value to, for example, show the email
-    // address in a toast message so the user will know it worked and where
-    // to look for the email.
-    handler: (user) => {
-      return user
-    },
-
-    // How long the resetToken is valid for, in seconds (default is 24 hours)
-    expires: 60 * 60 * 24,
-
-    errors: {
-      // for security reasons you may want to be vague here rather than expose
-      // the fact that the email address wasn't found (prevents fishing for
-      // valid email addresses)
-      usernameNotFound: 'Username not found',
-      // if the user somehow gets around client validation
-      usernameRequired: 'Username is required',
-    },
-  }
-
-  const loginOptions: DbAuthHandlerOptions['login'] = {
-    // handler() is called after finding the user that matches the
-    // username/password provided at login, but before actually considering them
-    // logged in. The `user` argument will be the user in the database that
-    // matched the username/password.
-    //
-    // If you want to allow this user to log in simply return the user.
-    //
-    // If you want to prevent someone logging in for another reason (maybe they
-    // didn't validate their email yet), throw an error and it will be returned
-    // by the `logIn()` function from `useAuth()` in the form of:
-    // `{ message: 'Error message' }`
-    handler: (user) => {
-      return user
-    },
-
-    errors: {
-      usernameOrPasswordMissing: 'Both username and password are required',
-      usernameNotFound: 'Username ${username} not found',
-      // For security reasons you may want to make this the same as the
-      // usernameNotFound error so that a malicious user can't use the error
-      // to narrow down if it's the username or password that's incorrect
-      incorrectPassword: 'Incorrect password for ${username}',
-    },
-
-    // How long a user will remain logged in, in seconds
-    expires: 60 * 60 * 24 * 365 * 10,
-  }
-
-  const resetPasswordOptions: DbAuthHandlerOptions['resetPassword'] = {
-    // handler() is invoked after the password has been successfully updated in
-    // the database. Returning anything truthy will automatically logs the user
-    // in. Return `false` otherwise, and in the Reset Password page redirect the
-    // user to the login page.
-    handler: (_user) => {
-      return true
-    },
-
-    // If `false` then the new password MUST be different than the current one
-    allowReusedPassword: true,
-
-    errors: {
-      // the resetToken is valid, but expired
-      resetTokenExpired: 'resetToken is expired',
-      // no user was found with the given resetToken
-      resetTokenInvalid: 'resetToken is invalid',
-      // the resetToken was not present in the URL
-      resetTokenRequired: 'resetToken is required',
-      // new password is the same as the old password (apparently they did not forget it)
-      reusedPassword: 'Must choose a new password',
-    },
-  }
-
-  const changePasswordOptions: DbAuthHandlerOptions['changePassword'] = {
-    // handler() is invoked after a logged in user has entered their current
-    // password correctly and the new password has been saved to the database.
-    // This is a good place to let the user know, by email for example, that
-    // their password was changed.
-    //
-    // Returning anything truthy keeps the user logged in. Return `false` to
-    // log them out, and in the Change Password page redirect the user to the
-    // login page.
-    handler: (_user) => {
-      // TODO: Send an email/message to the user letting them know that their
-      // password was changed. When you implement this, change `_user` to
-      // `user` in the function arguments above.
-
-      return true
-    },
-
-    // If `false` then the new password MUST be different from the current one
-    allowReusedPassword: false,
-
-    errors: {
-      // the current password was not provided
-      currentPasswordRequired: 'Current password is required',
-      // the new password was not provided
-      newPasswordRequired: 'New password is required',
-      // the current password is not correct
-      incorrectCurrentPassword: 'Current password is incorrect',
-      // the user doesn't have a password yet (they signed up with a third
-      // party login provider, for example)
-      passwordNotSet:
-        'This account does not have a password. Use "Forgot password" to set one',
-      // new password is the same as the current password
-      reusedPassword: 'Must choose a new password',
-    },
-  }
-
-  interface UserAttributes {
-    name: string
-  }
-
-  const signupOptions: DbAuthHandlerOptions<
-    UserType,
-    UserAttributes
-  >['signup'] = {
-    // Whatever you want to happen to your data on new user signup. Cedar will
-    // check for duplicate usernames before calling this handler. At a minimum
-    // you need to save the `username`, `hashedPassword` and `salt` to your
-    // user table. `userAttributes` contains any additional object members that
-    // were included in the object given to the `signUp()` function you got
-    // from `useAuth()`.
-    //
-    // If you want the user to be immediately logged in, return the user that
-    // was created.
-    //
-    // If this handler throws an error, it will be returned by the `signUp()`
-    // function in the form of: `{ error: 'Error message' }`.
-    //
-    // If this returns anything else, it will be returned by the
-    // `signUp()` function in the form of: `{ message: 'String here' }`.
-    handler: ({
-      username,
-      hashedPassword,
-      salt,
-      userAttributes: _userAttributes,
-    }) => {
-      return db.user.create({
-        data: {
-          email: username,
-          hashedPassword: hashedPassword,
-          salt: salt,
-          // name: userAttributes.name
-        },
-      })
-    },
-
-    // Include any format checks for password here. Return `true` if the
-    // password is valid, otherwise throw a `PasswordValidationError`.
-    // Import the error along with `DbAuthHandler` from `@cedarjs/api` above.
-    passwordValidation: (_password) => {
-      return true
-    },
-
-    errors: {
-      // `field` will be either "username" or "password"
-      fieldMissing: '${field} is required',
-      usernameTaken: 'Username `${username}` already in use',
-    },
-  }
-
-  const authHandler = new DbAuthHandler(event, context, {
-    // Provide prisma db client
-    db: db,
-
-    // The name of the property you'd call on `db` to access your user table.
-    // ie. if your Prisma model is named `User` this value would be `user`, as in `db.user`
-    authModelAccessor: 'user',
-
-    // The name of the property you'd call on `db` to access your user credentials table.
-    // ie. if your Prisma model is named `UserCredential` this value would be `userCredential`, as in `db.userCredential`
-    credentialModelAccessor: 'userCredential',
-
-    // A map of what dbAuth calls a field to what your database calls it.
-    // `id` is whatever column you use to uniquely identify a user (probably
-    // something like `id` or `userId` or even `email`)
-    authFields: {
-      id: 'id',
-      username: 'email',
-      hashedPassword: 'hashedPassword',
-      salt: 'salt',
-      resetToken: 'resetToken',
-      resetTokenExpiresAt: 'resetTokenExpiresAt',
-      challenge: 'webAuthnChallenge',
-    },
-
-    // Specifies attributes on the cookie that dbAuth sets in order to remember
-    // who is logged in. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
-    cookie: {
-      attributes: cookieAttributes,
-      name: cookieName,
-    },
-
-    changePassword: changePasswordOptions,
-    forgotPassword: forgotPasswordOptions,
-    login: loginOptions,
-    resetPassword: resetPasswordOptions,
-    signup: signupOptions,
-
-    // See https://cedarjs.com/docs/auth/dbauth#webauthn for options
-    webAuthn: {
-      enabled: true,
-      // How long to allow re-auth via WebAuthn in seconds (default is 10 years).
-      // The `login.expires` time denotes how many seconds before a user will be
-      // logged out, and this value is how long they'll be to continue to use a
-      // fingerprint/face scan to log in again. When this one expires they
-      // *must* re-enter username and password to authenticate (WebAuthn will
-      // then be re-enabled for this amount of time).
-      expires: 60 * 60 * 24 * 365 * 10,
-      name: 'Cedar Application',
-      domain:
-        process.env.NODE_ENV === 'development' ? 'localhost' : 'server.com',
-      origin:
-        process.env.NODE_ENV === 'development'
-          ? 'http://localhost:8910'
-          : 'https://server.com',
-      type: 'platform',
-      timeout: 60000,
-      credentialFields: {
-        id: 'id',
-        userId: 'userId',
-        publicKey: 'publicKey',
-        transports: 'transports',
-        counter: 'counter',
-      },
-    },
-  })
-
-  return await authHandler.invoke()
-}