@cocreate/authenticate 1.6.0 → 1.8.0

package/CHANGELOG.md

@@ -1,3 +1,27 @@
+# [1.8.0](https://github.com/CoCreate-app/CoCreate-authenticate/compare/v1.7.0...v1.8.0) (2023-12-05)
+
+
+### Bug Fixes
+
+* removed "@cocreate/utlis" ([3726368](https://github.com/CoCreate-app/CoCreate-authenticate/commit/372636836f00c830c31baa6e85e138075ec510af))
+
+
+### Features
+
+* manage sessions using crud ([81a3d9b](https://github.com/CoCreate-app/CoCreate-authenticate/commit/81a3d9b15402b305f61ad23d6699e30277f1a0bd))
+
+# [1.7.0](https://github.com/CoCreate-app/CoCreate-authenticate/compare/v1.6.0...v1.7.0) (2023-11-25)
+
+
+### Bug Fixes
+
+* update licensing details ([3fa12ff](https://github.com/CoCreate-app/CoCreate-authenticate/commit/3fa12ffeafaf22ae1121c567d0ff735cc4b735a3))
+
+
+### Features
+
+* upgrade dependencies for latest features and fixes ([850fdc1](https://github.com/CoCreate-app/CoCreate-authenticate/commit/850fdc199c7288e2c95eadae5bda6a23d09fe192))
+
 # [1.6.0](https://github.com/CoCreate-app/CoCreate-authenticate/compare/v1.5.0...v1.6.0) (2023-11-25)
 
 

package/README.md

@@ -72,21 +72,12 @@ We appreciate your continued support, thank you!
 
 <a name="license"></a>
 
-# Dual License
+# License
 
-## Open Source
+This software is dual-licensed under the GNU Affero General Public License version 3 (AGPLv3) and a commercial license.
 
-[Server Side Public License (SSPL)](https://github.com/CoCreate-app/CoCreate-authenticate/blob/master/LICENSE)
+-   **Open Source Use**: For open-source projects and non-commercial use, this software is available under the AGPLv3. The AGPLv3 allows you to freely use, modify, and distribute this software, provided that all modifications and derivative works are also licensed under the AGPLv3. For the full license text, see the [LICENSE file](https://github.com/CoCreate-app/CoCreate-authenticate/blob/master/LICENSE).
 
-## Commercial
+-   **Commercial Use**: For-profit companies and individuals intending to use this software for commercial purposes must obtain a commercial license. The commercial license is available when you sign up for an API key on our [website](https://cocreate.app). This license permits proprietary use and modification of the software without the copyleft requirements of the AGPLv3. It is ideal for integrating this software into proprietary commercial products and applications.
 
-For-profit companies and individuals intending to use CoCreate-authenticate for
-commercial use must purchase a commercial license. This license allows
-source code modifications, but does not permit redistribution of
-modifications.
-
-The commercial license is designed for you to use CoCreate-authenticate in commercial
-products and applications, without the provisions of the SSPL. With the
-commercial license, your code is kept propietary, to yourself. If you
-want to use CoCreate-authenticate to develop commercial sites, themes, projects, and
-applications, the commercial license is the appropriate license.
+If you have not purchased a commercial license and intend to use this software for commercial purposes, you are required to sign up for an API key on our website.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocreate/authenticate",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "A simple authenticate component in vanilla javascript. Easily configured using HTML5 data-attributes and/or JavaScript API.",
   "keywords": [
     "authenticate",
@@ -33,14 +33,13 @@
     "type": "git",
     "url": "git+https://github.com/CoCreate-app/CoCreate-authenticate.git"
   },
-  "authenticateor": "CoCreate LLC",
+  "author": "CoCreate LLC",
   "bugs": {
     "url": "https://github.com/CoCreate-app/CoCreate-authenticate/issues"
   },
   "main": "./src/index.js",
   "homepage": "https://cocreate.app/docs/authenticate",
   "dependencies": {
-    "@cocreate/utils": "^1.28.0",
     "jsonwebtoken": "^9.0.0"
   }
 }

package/src/index.js

@@ -1,6 +1,5 @@
 const crypto = require('crypto');
 const jwt = require('jsonwebtoken');
-const { ObjectId } = require('@cocreate/utils');
 
 // Configuration
 const tokenExpiration = 60; // Token expiration in minutes
@@ -8,124 +7,139 @@ const tokenExpiration = 60; // Token expiration in minutes
 // Array to store key pairs
 const keyPairs = new Map();
 
-// Map to store authenticated user
-const users = new Map();
-
-// TODO: user can have multiple sessions
-const activeSessions = new Map();
-
-// crud.listen('object.create', function (data) {
-//     if (data.object && data.object[0] && data.object[0].type === 'keyPair')
-//         keyPairs.set(data.object[0]._id, data.object[0]);
-// });
-
-// crud.listen('object.delete', function (data) {
-//     if (data.object && data.object[0] && data.object[0].type === 'keyPair')
-//         keyPairs.delete(data.object[0]._id);
-// });
-
-// Create new RSA key pair
-function createKeyPair() {
-    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
-        modulusLength: 2048,
-    });
-
-    let created = new Date(new Date().toISOString()).getTime()
-    const keyPair = {
-        _id: ObjectId().toString(),
-        privateKey,
-        publicKey,
-        created,
-        expires: created + tokenExpiration * 60 * 1000, // Convert minutes to milliseconds
-    };
-
-    keyPairs.set(keyPair._id, keyPair);
-
-    // crud.send({
-    //     method: 'object.create',
-    //     array: 'keys',
-    //     object: {
-    //         ...keyPair,
-    //     },
-    //     organization_id: process.env.organization_id,
-    // });
-
-    return keyPair;
-}
+// Map to store authenticated user payload and tokens
+const sessions = new Map();
 
-// Function to retrieve keys from the database (example using CRUD operations)
-function readKeyPairs() {
-    const keys = crud.send({
-        method: 'object.read',
-        array: 'keys',
-        object: {
-            $filter: {
-                query: [
-                    { key: 'type', value: 'keyPair' },
-                ],
-            }
-        },
-        organization_id: process.env.organization_id,
-    });
-
-    // Add retrieved key pairs to the keyPairs array
-    if (keys.object && keys.object.length) {
-        keys.object.forEach((keyPair) => {
-            keyPairs.set(keyPair._id, keyPair);
+class CoCreateAuthenticate {
+    constructor(crud) {
+        this.wsManager = crud.wsManager
+        this.crud = crud
+    }
+
+    // Create new RSA key pair
+    createKeyPair() {
+        const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
+            modulusLength: 2048,
         });
+
+        let created = new Date(new Date().toISOString()).getTime()
+        const keyPair = {
+            privateKey,
+            publicKey,
+            created,
+            expires: created + tokenExpiration * 60 * 1000, // Convert minutes to milliseconds
+        };
+
+        keyPairs.set(keyPair._id, keyPair);
+
+        // crud.send({
+        //     method: 'object.create',
+        //     array: 'keys',
+        //     object: {
+        //         ...keyPair,
+        //     },
+        //     organization_id: process.env.organization_id,
+        // });
+
+        return keyPair;
     }
-}
 
-// Delete new RSA key pair
-function deleteKeyPair(keyPair) {
-    keyPairs.delete(keyPair._id)
-    // crud.send({
-    //     method: 'object.delete',
-    //     array: 'keys',
-    //     object: {
-    //         _id: keyPair._id,
-    //         type: 'keyPair'
-    //     },
-    //     organization_id: process.env.organization_id,
-    // });
-}
+    // Delete new RSA key pair
+    deleteKeyPair(keyPair) {
+        keyPairs.delete(keyPair._id)
+        // crud.send({
+        //     method: 'object.delete',
+        //     array: 'keys',
+        //     object: {
+        //         _id: keyPair._id,
+        //         type: 'RSA'
+        //     },
+        //     organization_id: process.env.organization_id,
+        // });
+    }
 
-// Function to sign a new token using the newest keyPair
-function encodeToken(payload) {
-    let keyPair = null
-    const currentTime = new Date(new Date().toISOString()).getTime();
-    for (let [key, value] of keyPairs) {
-        if (currentTime > value.expires) {
-            deleteKeyPair(value);
-        } else {
-            keyPair = value
+    // Function to sign a new token using the newest keyPair
+    encodeToken(organization_id, user_id, clientId) {
+        let keyPair = null
+        const currentTime = new Date(new Date().toISOString()).getTime();
+        for (let [key, value] of keyPairs) {
+            if (currentTime > value.expires) {
+                this.deleteKeyPair(value);
+            } else {
+                keyPair = value
+            }
         }
-    }
 
-    if (!keyPair) {
-        keyPair = createKeyPair();
+        if (!keyPair) {
+            keyPair = this.createKeyPair();
+        }
+
+        const token = jwt.sign({ user_id, clientId }, keyPair.privateKey, { algorithm: 'RS256', expiresIn: tokenExpiration * 60 });
+
+        // TODO: session could have previous user ip and device information which we could use to comapre to current ip and device information 
+        const session = { user_id, clientId, token, expires: currentTime + tokenExpiration * 60 * 1000 }
+        sessions.set(clientId, session)
+
+        this.crud.send({
+            method: 'object.update',
+            array: 'clients',
+            object: {
+                _id: clientId,
+                session,
+            },
+            upsert: true,
+            organization_id
+        });
+
+        return token;
     }
 
-    // TODO: payload could have previous user ip and device information which we could use to comapre to current ip and device information 
+    // Verify and decode a token using the available keys
+    async decodeToken(token, organization_id, clientId) {
+        if (!token)
+            return {}
+        const currentTime = new Date().getTime();
+
+        let session = sessions.get(clientId)
+        if (!session || session.token !== token)
+            session = await this.read(organization_id, clientId)
+
+        // TODO: request must be made from same clientId and user_id that created the token
+        if (session && currentTime < session.expires && session.token === token)
+            return { user_id: session.user_id, expires: session.expires };
+
+        sessions.delete(clientId)
+        this.crud.send({
+            method: 'object.update',
+            array: 'clients',
+            object: {
+                _id: clientId,
+                session: undefined
+            },
+            organization_id,
+        });
 
-    const token = jwt.sign(payload, keyPair.privateKey, { algorithm: 'RS256', expiresIn: tokenExpiration * 60 });
-    users.set(token, { _id: payload.user_id, expires: currentTime + tokenExpiration * 60 * 1000 })
-    return token;
-}
+        return {}
 
-// Verify and decode a token using the available keys
-function decodeToken(token) {
-    const currentTime = new Date().getTime();
+    }
 
-    let user = users.get(token)
-    if (user && currentTime < user.expires)
-        return { user_id: user._id, expires: user.expires };
+    async read(organization_id, clientId) {
+        const client = await this.crud.send({
+            method: 'object.read',
+            array: 'clients',
+            object: {
+                _id: clientId
+            },
+            organization_id,
+        });
 
-    users.delete(token)
-    return {}
+        if (client.object && client.object.length) {
+            sessions.set(clientId, client.object[0].session)
+        }
 
-}
+        return client.object[0].session
+    }
 
-// readKeyPairs();
+}
 
-module.exports = { encodeToken, decodeToken };
+module.exports = CoCreateAuthenticate;