@contember/engine-tenant-api 2.1.0-alpha.2 → 2.1.0-alpha.20

package/src/model/service/SignInManager.ts

@@ -5,6 +5,7 @@ import { Providers } from '../providers'
 import { DatabaseContext } from '../utils'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { ImplementationException } from '../../exceptions'
+import { AuthLogService } from './AuthLogService'
 
 class SignInManager {
 	constructor(
@@ -14,39 +15,49 @@ class SignInManager {
 	) {}
 
 	async signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {
-		const personRow = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))
-
-		if (personRow === null) {
-			return new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`)
+		const person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))
+
+		if (person === null) {
+			return new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personInput: email,
+				}),
+			})
 		}
 
-		if (!personRow.password_hash) {
-			return new ResponseError('NO_PASSWORD_SET', `No password set`)
+		const authLogData = {
+			[AuthLogService.Key]: new AuthLogService.Bag({
+				personInput: email,
+				personId: person.id,
+			}),
+		}
+		if (!person.password_hash) {
+			return new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)
 		}
 
-		if (personRow.disabled_at !== null) {
-			return new ResponseError('PERSON_DISABLED', `Person is disabled`)
+		if (person.disabled_at !== null) {
+			return new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)
 		}
 
-		const passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash)
+		const passwordValid = await this.providers.bcryptCompare(password, person.password_hash)
 
 		if (!passwordValid) {
-			return new ResponseError('INVALID_PASSWORD', `Password does not match`)
+			return new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)
 		}
 
-		if (personRow.otp_uri && personRow.otp_activated_at) {
+		if (person.otp_uri && person.otp_activated_at) {
 			if (!otpCode) {
-				return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
+				return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)
 			}
 
-			if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {
-				return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
+			if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+				return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)
 			}
 		}
 
-		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)
+		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)
 
-		return new ResponseOk(new SignInResult(personRow, sessionToken))
+		return new ResponseOk({ person, token: sessionToken, ...authLogData })
 	}
 
 	async createSessionToken(
@@ -55,38 +66,62 @@ class SignInManager {
 		expiration?: number,
 		verifier?: (person: PersonRow) => Promise<void>,
 	): Promise<CreateSessionTokenResponse> {
-		const personRow = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))
+		const person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))
 
-		if (personRow === null) {
+		if (person === null) {
 			if (personIdentifier.type === 'email') {
-				return new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`)
+				return new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: personIdentifier.email,
+					}),
+				})
 
 			} else if (personIdentifier.type === 'id') {
-				return new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`)
+				return new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: personIdentifier.id,
+					}),
+				})
 			}
 
 			throw new ImplementationException()
 		}
 
-		if (personRow.disabled_at !== null) {
-			return new ResponseError('PERSON_DISABLED', `Person with id ${personRow.id} is disabled`)
+		const inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id
+		if (person.disabled_at !== null) {
+			return new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: person.id,
+					personInput: inputValue,
+				}),
+			})
 		}
 
-		await verifier?.(personRow)
-
-		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)
-		return new ResponseOk(new SignInResult(personRow, sessionToken))
+		await verifier?.(person)
+
+		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)
+		return new ResponseOk({
+			person,
+			token: sessionToken,
+			[AuthLogService.Key]: new AuthLogService.Bag({
+				personId: person.id,
+				personInput: inputValue,
+			}),
+		})
 	}
 }
 
-export class SignInResult {
-	constructor(
-		public readonly person: PersonRow,
-		public readonly token: string,
-	) {}
+export interface SignInResult {
+	readonly person: PersonRow
+	readonly token: string
+	[AuthLogService.Key]: AuthLogService.Bag
 }
 
-export type SignInResponse = Response<SignInResult, SignInErrorCode>
-export type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode>
+export type SignInResponse = Response<SignInResult, SignInErrorCode, {
+	[AuthLogService.Key]: AuthLogService.Bag
+}>
+export type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {
+	[AuthLogService.Key]: AuthLogService.Bag
+}>
 
 export { SignInManager }

package/src/model/service/SignUpManager.ts

@@ -1,12 +1,12 @@
 import { CreateIdentityCommand, CreatePersonCommand } from '../commands'
-import { PersonQuery, PersonRow } from '../queries'
-import { SignUpErrorCode } from '../../schema'
+import { ConfigurationQuery, PersonRow } from '../queries'
+import { SignUpErrorCode, WeakPasswordReason } from '../../schema'
 import { TenantRole } from '../authorization'
-import { getPasswordWeaknessMessage } from '../utils/password'
-import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import { Response, ResponseOk } from '../utils/Response'
 import { DatabaseContext } from '../utils'
 import { MaybePassword } from '../dtos'
 import { EmailValidator } from './EmailValidator'
+import { PasswordStrengthValidator } from './PasswordStrengthValidator'
 
 type SignUpUser = {
 	email: string
@@ -18,6 +18,7 @@ type SignUpUser = {
 export class SignUpManager {
 	constructor(
 		private readonly emailValidator: EmailValidator,
+		private readonly passwordStrengthValidator: PasswordStrengthValidator,
 	) {
 	}
 
@@ -27,10 +28,15 @@ export class SignUpManager {
 			return validationError
 		}
 		const plainPassword = password.getPlain()
-		const weakPassword = plainPassword ? getPasswordWeaknessMessage(plainPassword) : null
-		if (weakPassword) {
-			return new ResponseError('TOO_WEAK', weakPassword)
+
+		if (plainPassword) {
+			const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+			const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')
+			if (!passwordVerifyResult.ok) {
+				return passwordVerifyResult
+			}
 		}
+
 		const person = await dbContext.transaction(async db => {
 			const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))
 			return await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))
@@ -42,4 +48,6 @@ export class SignUpManager {
 export class SignUpResult {
 	constructor(public readonly person: Omit<PersonRow, 'roles'>) {}
 }
-export type SignUpResponse = Response<SignUpResult, SignUpErrorCode>
+export type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {
+	weakPasswordReasons?: WeakPasswordReason[]
+}>

package/src/model/service/apiKey/ApiKeyManager.ts

@@ -12,7 +12,10 @@ import { DatabaseContext, TokenHash } from '../../utils'
 import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'
 import assert from 'node:assert'
 import { Acl } from '@contember/schema'
-import { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow } from '../../queries'
+import { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery } from '../../queries'
+import PostgresInterval from 'postgres-interval'
+import { Config } from '../../type/Config'
+import { intervalToSeconds } from '../../utils/interval'
 
 export class ApiKeyManager {
 	constructor(
@@ -56,7 +59,10 @@ export class ApiKeyManager {
 	}
 
 	async createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string> {
-		const command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration })
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const expirationResolved = expiration ?? (intervalToSeconds(config.login.defaultTokenExpiration) / 60)
+		const expirationCapped = config.login.maxTokenExpiration ? Math.min(expirationResolved, intervalToSeconds(config.login.maxTokenExpiration) / 60) : expirationResolved
+		const command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration: expirationCapped })
 		const token = (await dbContext.commandBus.execute(command)).token
 		assert(token !== undefined)
 		return token

package/src/model/type/AuthLog.ts

@@ -0,0 +1,14 @@
+export type AuthActionType =
+	| 'login'
+	| 'create_session_token'
+	| 'idp_login'
+	| 'password_reset_init'
+	| 'password_reset'
+	| 'password_change'
+	| 'email_change'
+	| '2fa_disable'
+	| '2fa_enable'
+	| 'passwordless_login_init'
+	| 'passwordless_login_exchange'
+	| 'passwordless_login'
+	| 'person_disable'

package/src/model/type/Config.ts

@@ -0,0 +1,29 @@
+import { ConfigPolicy } from '../../schema'
+import { IPostgresInterval } from 'postgres-interval'
+import { type Config as ConfigSchema } from '../../schema'
+import { Interval } from '../../schema/types'
+export type ConfigRow = {
+	passwordless_enabled: ConfigPolicy
+	passwordless_url: string | null
+	passwordless_expiration: IPostgresInterval
+	password_min_length: number
+	password_require_uppercase: number
+	password_require_lowercase: number
+	password_require_digit: number
+	password_require_special: number
+	password_pattern: string | null
+	password_check_blacklist: boolean
+	login_base_backoff: IPostgresInterval
+	login_max_backoff: IPostgresInterval
+	login_attempt_window: IPostgresInterval
+	login_reveal_user_exits: boolean
+	login_default_token_expiration: IPostgresInterval
+	login_max_token_expiration: IPostgresInterval | null
+}
+
+
+export type Config = Omit<{
+	[K in keyof ConfigSchema]: {
+		[K2 in keyof ConfigSchema[K]]: Exclude<ConfigSchema[K][K2], Interval>
+	}
+}, '__typename'>

package/src/model/utils/Response.ts

@@ -1,4 +1,6 @@
-export type Response<Result, Error> = ResponseOk<Result> | (Error extends never ? never : ResponseError<Error>)
+export type Response<Result, Error, ErrorMetadata extends {} | undefined = undefined> =
+	| ResponseOk<Result>
+	| (Error extends never ? never : ResponseError<Error, ErrorMetadata>)
 
 export class ResponseOk<Result> {
 	public readonly ok = true
@@ -6,8 +8,13 @@ export class ResponseOk<Result> {
 	constructor(public readonly result: Result) {}
 }
 
-export class ResponseError<const Error> {
+export class ResponseError<const Error, Metadata extends {} | undefined = undefined> {
 	public readonly ok = false
 
-	constructor(public readonly error: Error, public readonly errorMessage: string) {}
+	constructor(
+		public readonly error: Error,
+		public readonly errorMessage: string,
+		public readonly metadata?: Metadata,
+	) {}
 }
+