@cedarjs/auth-dbauth-setup 7.1.0-rc.34 → 7.1.1-next.468

package/dist/templates/api/functions/auth.webAuthn.oauth.ts.template

@@ -0,0 +1,382 @@
+import type { APIGatewayProxyEvent, Context } from 'aws-lambda'
+
+import { DbAuthHandler } from '@cedarjs/auth-dbauth-api'
+import type { DbAuthHandlerOptions, UserType } from '@cedarjs/auth-dbauth-api'
+import {
+  OAuthHandler,
+  googleProvider,
+  githubProvider,
+} from '@cedarjs/auth-dbauth-oauth'
+
+import { cookieName } from 'src/lib/auth'
+import { db } from 'src/lib/db'
+
+// Any request whose path falls under this prefix is routed to the OAuth
+// handler instead of the regular username/password dbAuth handler. This
+// must match the callback URLs registered with each provider below (e.g.
+// `${apiUrl}/auth/oauth/google/callback`).
+const OAUTH_BASE_PATH = '/auth/oauth'
+
+// The base URL of your deployed api side. Used to build the OAuth callback
+// URLs registered with each provider's developer console. Update the
+// production value once you know your deployed URL.
+const apiUrl =
+  process.env.NODE_ENV === 'development'
+    ? 'http://localhost:8911'
+    : 'https://server.com'
+
+const cookieAttributes = {
+  HttpOnly: true,
+  Path: '/',
+  SameSite: 'Lax' as const,
+  Secure: process.env.NODE_ENV !== 'development',
+
+  // If you need to allow other domains (besides the api side) access to
+  // the dbAuth session cookie:
+  // Domain: 'example.com',
+}
+
+export const handler = async (
+  event: APIGatewayProxyEvent,
+  context: Context
+) => {
+  if (event.path?.includes(OAUTH_BASE_PATH)) {
+    const oauthHandler = new OAuthHandler(event, context, {
+      // Provide prisma db client
+      db: db,
+
+      // The name of the property you'd call on `db` to access your user
+      // table. i.e. if your Prisma model is named `User` this value would
+      // be `user`, as in `db.user`
+      authModelAccessor: 'user',
+
+      // The name of the property you'd call on `db` to access your OAuth
+      // identity table. i.e. if your Prisma model is named `OAuth` this
+      // value would be `oAuth`, as in `db.oAuth`
+      oauthModelAccessor: 'oAuth',
+
+      // A map of what dbAuth calls a field to what your database calls it,
+      // matching the same fields used by `DbAuthHandler` below
+      authFields: {
+        id: 'id',
+        username: 'email',
+        hashedPassword: 'hashedPassword',
+      },
+
+      basePath: OAUTH_BASE_PATH,
+
+      // The configured OAuth providers, keyed by the path segment used in
+      // `/auth/oauth/{key}/...`. Get client id/secret values from each
+      // provider's developer console and set them in your `.env` file.
+      providers: {
+        // @oauth-provider:google
+        google: googleProvider({
+          clientId: process.env.GOOGLE_CLIENT_ID as string,
+          clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
+          redirectUri: `${apiUrl}/auth/oauth/google/callback`,
+        }),
+        // @oauth-provider:google:end
+        // @oauth-provider:github
+        github: githubProvider({
+          clientId: process.env.GITHUB_CLIENT_ID as string,
+          clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
+          redirectUri: `${apiUrl}/auth/oauth/github/callback`,
+        }),
+        // @oauth-provider:github:end
+      },
+
+      // Where to send the browser after each flow completes
+      redirects: {
+        afterLogin: '/',
+        error: '/login',
+      },
+
+      signup: {
+        // handler() is invoked the first time a user signs in with a
+        // configured OAuth provider and no account is linked to that
+        // provider identity yet. `profile` is the canonical profile the
+        // provider returned (`providerUserId`, `email`, `username`, etc).
+        //
+        // At a minimum you need to create and return a user row. There's no
+        // password to store here since this account only ever signs in
+        // through the provider -- if your `User` model requires
+        // `hashedPassword`/`salt`, make sure those fields are optional (or
+        // have a default) so provider-only accounts can be created.
+        handler: ({ profile }) => {
+          // Some providers (e.g. GitHub, when the account keeps its email
+          // private) don't return an email at all. Customize this handler
+          // for any such provider you configure -- ask for an email on a
+          // follow-up screen, or derive a placeholder from a field you know
+          // is always present. Throwing here surfaces to the user as a
+          // `provider_error` redirect instead of silently creating an
+          // account with a fabricated address.
+          if (!profile.email) {
+            throw new Error(
+              `OAuth signup handler needs an email, but ${profile.providerUserId} didn't return one. Customize this handler to handle providers that don't supply an email.`,
+            )
+          }
+
+          return db.user.create({
+            data: {
+              email: profile.email,
+            },
+          })
+        },
+      },
+
+      // How long a user will remain logged in, in seconds
+      sessionExpires: 60 * 60 * 24 * 365 * 10,
+
+      // Specifies attributes on the cookie that dbAuth sets in order to
+      // remember who is logged in. See
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
+      cookie: {
+        attributes: cookieAttributes,
+        name: cookieName,
+      },
+    })
+
+    return await oauthHandler.invoke()
+  }
+
+  const forgotPasswordOptions: DbAuthHandlerOptions['forgotPassword'] = {
+    // handler() is invoked after verifying that a user was found with the given
+    // username. This is where you can send the user an email with a link to
+    // reset their password. With the default dbAuth routes and field names, the
+    // URL to reset the password will be:
+    //
+    // https://example.com/reset-password?resetToken=${user.resetToken}
+    //
+    // Whatever is returned from this function will be returned from
+    // the `forgotPassword()` function that is destructured from `useAuth()`
+    // You could use this return value to, for example, show the email
+    // address in a toast message so the user will know it worked and where
+    // to look for the email.
+    handler: (user) => {
+      return user
+    },
+
+    // How long the resetToken is valid for, in seconds (default is 24 hours)
+    expires: 60 * 60 * 24,
+
+    errors: {
+      // for security reasons you may want to be vague here rather than expose
+      // the fact that the email address wasn't found (prevents fishing for
+      // valid email addresses)
+      usernameNotFound: 'Username not found',
+      // if the user somehow gets around client validation
+      usernameRequired: 'Username is required',
+    },
+  }
+
+  const loginOptions: DbAuthHandlerOptions['login'] = {
+    // handler() is called after finding the user that matches the
+    // username/password provided at login, but before actually considering them
+    // logged in. The `user` argument will be the user in the database that
+    // matched the username/password.
+    //
+    // If you want to allow this user to log in simply return the user.
+    //
+    // If you want to prevent someone logging in for another reason (maybe they
+    // didn't validate their email yet), throw an error and it will be returned
+    // by the `logIn()` function from `useAuth()` in the form of:
+    // `{ message: 'Error message' }`
+    handler: (user) => {
+      return user
+    },
+
+    errors: {
+      usernameOrPasswordMissing: 'Both username and password are required',
+      usernameNotFound: 'Username ${username} not found',
+      // For security reasons you may want to make this the same as the
+      // usernameNotFound error so that a malicious user can't use the error
+      // to narrow down if it's the username or password that's incorrect
+      incorrectPassword: 'Incorrect password for ${username}',
+    },
+
+    // How long a user will remain logged in, in seconds
+    expires: 60 * 60 * 24 * 365 * 10,
+  }
+
+  const resetPasswordOptions: DbAuthHandlerOptions['resetPassword'] = {
+    // handler() is invoked after the password has been successfully updated in
+    // the database. Returning anything truthy will automatically logs the user
+    // in. Return `false` otherwise, and in the Reset Password page redirect the
+    // user to the login page.
+    handler: (_user) => {
+      return true
+    },
+
+    // If `false` then the new password MUST be different than the current one
+    allowReusedPassword: true,
+
+    errors: {
+      // the resetToken is valid, but expired
+      resetTokenExpired: 'resetToken is expired',
+      // no user was found with the given resetToken
+      resetTokenInvalid: 'resetToken is invalid',
+      // the resetToken was not present in the URL
+      resetTokenRequired: 'resetToken is required',
+      // new password is the same as the old password (apparently they did not forget it)
+      reusedPassword: 'Must choose a new password',
+    },
+  }
+
+  const changePasswordOptions: DbAuthHandlerOptions['changePassword'] = {
+    // handler() is invoked after a logged in user has entered their current
+    // password correctly and the new password has been saved to the database.
+    // This is a good place to let the user know, by email for example, that
+    // their password was changed.
+    //
+    // Returning anything truthy keeps the user logged in. Return `false` to
+    // log them out, and in the Change Password page redirect the user to the
+    // login page.
+    handler: (_user) => {
+      // TODO: Send an email/message to the user letting them know that their
+      // password was changed. When you implement this, change `_user` to
+      // `user` in the function arguments above.
+
+      return true
+    },
+
+    // If `false` then the new password MUST be different from the current one
+    allowReusedPassword: false,
+
+    errors: {
+      // the current password was not provided
+      currentPasswordRequired: 'Current password is required',
+      // the new password was not provided
+      newPasswordRequired: 'New password is required',
+      // the current password is not correct
+      incorrectCurrentPassword: 'Current password is incorrect',
+      // the user doesn't have a password yet (they signed up with a third
+      // party login provider, for example)
+      passwordNotSet:
+        'This account does not have a password. Use "Forgot password" to set one',
+      // new password is the same as the current password
+      reusedPassword: 'Must choose a new password',
+    },
+  }
+
+  interface UserAttributes {
+    name: string
+  }
+
+  const signupOptions: DbAuthHandlerOptions<
+    UserType,
+    UserAttributes
+  >['signup'] = {
+    // Whatever you want to happen to your data on new user signup. Cedar will
+    // check for duplicate usernames before calling this handler. At a minimum
+    // you need to save the `username`, `hashedPassword` and `salt` to your
+    // user table. `userAttributes` contains any additional object members that
+    // were included in the object given to the `signUp()` function you got
+    // from `useAuth()`.
+    //
+    // If you want the user to be immediately logged in, return the user that
+    // was created.
+    //
+    // If this handler throws an error, it will be returned by the `signUp()`
+    // function in the form of: `{ error: 'Error message' }`.
+    //
+    // If this returns anything else, it will be returned by the
+    // `signUp()` function in the form of: `{ message: 'String here' }`.
+    handler: ({
+      username,
+      hashedPassword,
+      salt,
+      userAttributes: _userAttributes,
+    }) => {
+      return db.user.create({
+        data: {
+          email: username,
+          hashedPassword: hashedPassword,
+          salt: salt,
+          // name: userAttributes.name
+        },
+      })
+    },
+
+    // Include any format checks for password here. Return `true` if the
+    // password is valid, otherwise throw a `PasswordValidationError`.
+    // Import the error along with `DbAuthHandler` from `@cedarjs/api` above.
+    passwordValidation: (_password) => {
+      return true
+    },
+
+    errors: {
+      // `field` will be either "username" or "password"
+      fieldMissing: '${field} is required',
+      usernameTaken: 'Username `${username}` already in use',
+    },
+  }
+
+  const authHandler = new DbAuthHandler(event, context, {
+    // Provide prisma db client
+    db: db,
+
+    // The name of the property you'd call on `db` to access your user table.
+    // ie. if your Prisma model is named `User` this value would be `user`, as in `db.user`
+    authModelAccessor: 'user',
+
+    // The name of the property you'd call on `db` to access your user credentials table.
+    // ie. if your Prisma model is named `UserCredential` this value would be `userCredential`, as in `db.userCredential`
+    credentialModelAccessor: 'userCredential',
+
+    // A map of what dbAuth calls a field to what your database calls it.
+    // `id` is whatever column you use to uniquely identify a user (probably
+    // something like `id` or `userId` or even `email`)
+    authFields: {
+      id: 'id',
+      username: 'email',
+      hashedPassword: 'hashedPassword',
+      salt: 'salt',
+      resetToken: 'resetToken',
+      resetTokenExpiresAt: 'resetTokenExpiresAt',
+      challenge: 'webAuthnChallenge',
+    },
+
+    // Specifies attributes on the cookie that dbAuth sets in order to remember
+    // who is logged in. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
+    cookie: {
+      attributes: cookieAttributes,
+      name: cookieName,
+    },
+
+    changePassword: changePasswordOptions,
+    forgotPassword: forgotPasswordOptions,
+    login: loginOptions,
+    resetPassword: resetPasswordOptions,
+    signup: signupOptions,
+
+    // See https://cedarjs.com/docs/auth/dbauth#webauthn for options
+    webAuthn: {
+      enabled: true,
+      // How long to allow re-auth via WebAuthn in seconds (default is 10 years).
+      // The `login.expires` time denotes how many seconds before a user will be
+      // logged out, and this value is how long they'll be to continue to use a
+      // fingerprint/face scan to log in again. When this one expires they
+      // *must* re-enter username and password to authenticate (WebAuthn will
+      // then be re-enabled for this amount of time).
+      expires: 60 * 60 * 24 * 365 * 10,
+      name: 'Cedar Application',
+      domain:
+        process.env.NODE_ENV === 'development' ? 'localhost' : 'server.com',
+      origin:
+        process.env.NODE_ENV === 'development'
+          ? 'http://localhost:8910'
+          : 'https://server.com',
+      type: 'platform',
+      timeout: 60000,
+      credentialFields: {
+        id: 'id',
+        userId: 'userId',
+        publicKey: 'publicKey',
+        transports: 'transports',
+        counter: 'counter',
+      },
+    },
+  })
+
+  return await authHandler.invoke()
+}

package/dist/templates/api/functions/auth.webAuthn.ts.template

@@ -93,6 +93,42 @@ export const handler = async (
     },
   }
 
+  const changePasswordOptions: DbAuthHandlerOptions['changePassword'] = {
+    // handler() is invoked after a logged in user has entered their current
+    // password correctly and the new password has been saved to the database.
+    // This is a good place to let the user know, by email for example, that
+    // their password was changed.
+    //
+    // Returning anything truthy keeps the user logged in. Return `false` to
+    // log them out, and in the Change Password page redirect the user to the
+    // login page.
+    handler: (_user) => {
+      // TODO: Send an email/message to the user letting them know that their
+      // password was changed. When you implement this, change `_user` to
+      // `user` in the function arguments above.
+
+      return true
+    },
+
+    // If `false` then the new password MUST be different from the current one
+    allowReusedPassword: false,
+
+    errors: {
+      // the current password was not provided
+      currentPasswordRequired: 'Current password is required',
+      // the new password was not provided
+      newPasswordRequired: 'New password is required',
+      // the current password is not correct
+      incorrectCurrentPassword: 'Current password is incorrect',
+      // the user doesn't have a password yet (they signed up with a third
+      // party login provider, for example)
+      passwordNotSet:
+        'This account does not have a password. Use "Forgot password" to set one',
+      // new password is the same as the current password
+      reusedPassword: 'Must choose a new password',
+    },
+  }
+
   interface UserAttributes {
     name: string
   }
@@ -187,6 +223,7 @@ export const handler = async (
       name: cookieName,
     },
 
+    changePassword: changePasswordOptions,
     forgotPassword: forgotPasswordOptions,
     login: loginOptions,
     resetPassword: resetPasswordOptions,

package/dist/webAuthn.setupData.d.ts

@@ -1,4 +1,4 @@
-import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers';
+import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers/auth/setupHelpers';
 export { extraTask } from './setupData.js';
 export declare const webPackages: string[];
 export declare const apiPackages: string[];

package/dist/webAuthn.setupData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webAuthn.setupData.d.ts","sourceRoot":"","sources":["../src/webAuthn.setupData.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAK5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C,eAAO,MAAM,WAAW,UAAkC,CAAA;AAG1D,eAAO,MAAM,WAAW,UAAiC,CAAA;AAEzD,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CA+BnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAoEjB,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA"}
+{"version":3,"file":"webAuthn.setupData.d.ts","sourceRoot":"","sources":["../src/webAuthn.setupData.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAO9E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C,eAAO,MAAM,WAAW,UAAkC,CAAA;AAG1D,eAAO,MAAM,WAAW,UAAiC,CAAA;AAEzD,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CA+BnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAoEjB,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA"}

package/dist/webAuthn.setupData.js

@@ -1,9 +1,10 @@
 import path from "node:path";
-import { getPaths, colors } from "@cedarjs/cli-helpers";
+import { colors } from "@cedarjs/cli-helpers/colors";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
 import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
 import { extraTask } from "./setupData.js";
-const webPackages = ["@simplewebauthn/browser@^10"];
-const apiPackages = ["@simplewebauthn/server@^10"];
+const webPackages = ["@simplewebauthn/browser@^13"];
+const apiPackages = ["@simplewebauthn/server@^13"];
 const createUserModelTask = {
   title: "Creating model `User`...",
   task: async (ctx) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-setup",
-  "version": "7.1.0-rc.34",
+  "version": "7.1.1-next.468",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -23,16 +23,16 @@
     "test:watch": "yarn test --watch"
   },
   "dependencies": {
-    "@cedarjs/cli-helpers": "7.1.0-rc.34",
-    "@cedarjs/project-config": "7.1.0-rc.34",
-    "@prisma/internals": "7.8.0",
+    "@cedarjs/cli-helpers": "7.1.1-next.468",
+    "@cedarjs/project-config": "7.1.1-next.468",
+    "@prisma/internals": "7.10.0",
     "prompts": "2.4.2",
     "termi-link": "1.1.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "7.1.0-rc.34",
+    "@cedarjs/framework-tools": "7.1.1-next.468",
     "@types/yargs": "17.0.35",
-    "memfs": "4.78.1",
+    "memfs": "4.80.0",
     "nodemon": "3.1.14",
     "ts-dedent": "2.3.0",
     "typescript": "5.9.3",