@datrix/api 0.1.0 → 0.1.2

package/README.md

@@ -11,7 +11,7 @@ pnpm add @datrix/api
 ## Setup
 
 ```typescript
-import { defineConfig } from "datrix-core"
+import { defineConfig } from "@datrix/core"
 import { ApiPlugin } from "@datrix/api"
 
 export default defineConfig(() => ({

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { DefaultPermission, IAuthManager, AuthUser, LoginResult, AuthContext, IUpload, BasePlugin, IApiPlugin, Datrix, QueryContext, PluginContext, SchemaDefinition, DatrixEntry, QueryObject, PermissionAction, ParsedQuery, FallbackInput, ParserError, PermissionValue, PermissionCheckResult, FieldPermissionCheckResult, RawQueryParams, ParserOptions, FallbackWhereClause, PopulateClause, DatrixRecord, DatrixError } from '@datrix/core';
+import { DatrixEntry, DefaultPermission, AuthenticatedUser, IAuthManager, AuthUser, LoginResult, AuthContext, IUpload, BasePlugin, IApiPlugin, Datrix, QueryContext, PluginContext, SchemaDefinition, QueryObject, PermissionAction, ParsedQuery, FallbackInput, ParserError, PermissionValue, PermissionCheckResult, FieldPermissionCheckResult, RawQueryParams, ParserOptions, FallbackWhereClause, PopulateClause, DatrixRecord, DatrixError } from '@datrix/core';
 export { PermissionAction } from '@datrix/core';
 
 interface PasswordHash {
@@ -52,7 +52,7 @@ interface SessionConfig {
     readonly checkPeriod?: number;
     readonly prefix?: string;
 }
-interface AuthConfig<TRole extends string = string> {
+interface AuthConfig<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry> {
     readonly roles: readonly TRole[];
     readonly defaultRole: TRole;
     readonly defaultPermission?: DefaultPermission<TRole>;
@@ -69,8 +69,14 @@ interface AuthConfig<TRole extends string = string> {
         readonly register?: string;
         readonly logout?: string;
         readonly me?: string;
+        readonly forgotPassword?: string;
+        readonly resetPassword?: string;
         readonly disableRegister?: boolean;
     };
+    readonly passwordReset?: {
+        readonly tokenExpirySeconds?: number;
+        readonly onForgotPassword?: (user: Omit<AuthenticatedUser<TRole, TUser>, "password" | "passwordSalt">, token: string) => Promise<void>;
+    };
 }
 
 declare class JwtStrategy {
@@ -122,13 +128,13 @@ declare class MemorySessionStore implements SessionStore {
     private getKey;
 }
 
-declare class AuthManager<TRole extends string = string> implements IAuthManager {
+declare class AuthManager<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry> implements IAuthManager {
     private readonly passwordManager;
     private readonly jwtStrategy;
     private readonly sessionStrategy;
     private readonly config;
-    get authConfig(): AuthConfig<TRole>;
-    constructor(config: AuthConfig<TRole>);
+    get authConfig(): AuthConfig<TRole, TUser>;
+    constructor(config: AuthConfig<TRole, TUser>);
     hashPassword(password: string): Promise<PasswordHash>;
     verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
     login(user: AuthUser, options?: {
@@ -158,7 +164,7 @@ interface ApiConfig<TRole extends string = string> extends Record<string, unknow
 declare class ApiPlugin<TRole extends string = string> extends BasePlugin<ApiConfig<TRole>> implements IApiPlugin<TRole> {
     readonly name = "api";
     readonly version = "1.0.0";
-    authManager?: AuthManager;
+    authManager?: AuthManager<TRole>;
     user: AuthUser | null;
     private datrixInstance?;
     get datrix(): Datrix;
@@ -186,7 +192,7 @@ declare class ApiPlugin<TRole extends string = string> extends BasePlugin<ApiCon
     private handleAuthRequest;
     isEnabled(): boolean;
     isAuthEnabled(): boolean;
-    getAuthManager(): AuthManager | undefined;
+    getAuthManager(): AuthManager<TRole> | undefined;
 }
 
 declare function handleRequest(datrix: Datrix, request: Request): Promise<Response>;
@@ -242,18 +248,20 @@ declare function serializeQuery<T extends DatrixEntry = DatrixEntry>(query: Pars
 
 declare function handleCrudRequest<TRole extends string = string>(request: Request, datrix: Datrix, api: IApiPlugin<TRole>, options?: ContextBuilderOptions): Promise<Response>;
 
-interface AuthHandlerConfig {
+interface AuthHandlerConfig<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry> {
     readonly datrix: Datrix;
-    readonly authManager: AuthManager;
-    readonly authConfig: AuthConfig;
+    readonly authManager: AuthManager<TRole, TUser>;
+    readonly authConfig: AuthConfig<TRole, TUser>;
 }
-declare function createAuthHandlers(config: AuthHandlerConfig): {
+declare function createAuthHandlers<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry>(config: AuthHandlerConfig<TRole, TUser>): {
     register: (request: Request) => Promise<Response>;
     login: (request: Request) => Promise<Response>;
     logout: (request: Request) => Promise<Response>;
     me: (request: Request) => Promise<Response>;
+    forgotPassword: (request: Request) => Promise<Response>;
+    resetPassword: (request: Request) => Promise<Response>;
 };
-declare function createUnifiedAuthHandler(config: AuthHandlerConfig, apiPrefix?: string): (request: Request) => Promise<Response>;
+declare function createUnifiedAuthHandler<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry>(config: AuthHandlerConfig<TRole, TUser>, apiPrefix?: string): (request: Request) => Promise<Response>;
 
 declare class DatrixApiError extends DatrixError {
     status: number;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { DefaultPermission, IAuthManager, AuthUser, LoginResult, AuthContext, IUpload, BasePlugin, IApiPlugin, Datrix, QueryContext, PluginContext, SchemaDefinition, DatrixEntry, QueryObject, PermissionAction, ParsedQuery, FallbackInput, ParserError, PermissionValue, PermissionCheckResult, FieldPermissionCheckResult, RawQueryParams, ParserOptions, FallbackWhereClause, PopulateClause, DatrixRecord, DatrixError } from '@datrix/core';
+import { DatrixEntry, DefaultPermission, AuthenticatedUser, IAuthManager, AuthUser, LoginResult, AuthContext, IUpload, BasePlugin, IApiPlugin, Datrix, QueryContext, PluginContext, SchemaDefinition, QueryObject, PermissionAction, ParsedQuery, FallbackInput, ParserError, PermissionValue, PermissionCheckResult, FieldPermissionCheckResult, RawQueryParams, ParserOptions, FallbackWhereClause, PopulateClause, DatrixRecord, DatrixError } from '@datrix/core';
 export { PermissionAction } from '@datrix/core';
 
 interface PasswordHash {
@@ -52,7 +52,7 @@ interface SessionConfig {
     readonly checkPeriod?: number;
     readonly prefix?: string;
 }
-interface AuthConfig<TRole extends string = string> {
+interface AuthConfig<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry> {
     readonly roles: readonly TRole[];
     readonly defaultRole: TRole;
     readonly defaultPermission?: DefaultPermission<TRole>;
@@ -69,8 +69,14 @@ interface AuthConfig<TRole extends string = string> {
         readonly register?: string;
         readonly logout?: string;
         readonly me?: string;
+        readonly forgotPassword?: string;
+        readonly resetPassword?: string;
         readonly disableRegister?: boolean;
     };
+    readonly passwordReset?: {
+        readonly tokenExpirySeconds?: number;
+        readonly onForgotPassword?: (user: Omit<AuthenticatedUser<TRole, TUser>, "password" | "passwordSalt">, token: string) => Promise<void>;
+    };
 }
 
 declare class JwtStrategy {
@@ -122,13 +128,13 @@ declare class MemorySessionStore implements SessionStore {
     private getKey;
 }
 
-declare class AuthManager<TRole extends string = string> implements IAuthManager {
+declare class AuthManager<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry> implements IAuthManager {
     private readonly passwordManager;
     private readonly jwtStrategy;
     private readonly sessionStrategy;
     private readonly config;
-    get authConfig(): AuthConfig<TRole>;
-    constructor(config: AuthConfig<TRole>);
+    get authConfig(): AuthConfig<TRole, TUser>;
+    constructor(config: AuthConfig<TRole, TUser>);
     hashPassword(password: string): Promise<PasswordHash>;
     verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
     login(user: AuthUser, options?: {
@@ -158,7 +164,7 @@ interface ApiConfig<TRole extends string = string> extends Record<string, unknow
 declare class ApiPlugin<TRole extends string = string> extends BasePlugin<ApiConfig<TRole>> implements IApiPlugin<TRole> {
     readonly name = "api";
     readonly version = "1.0.0";
-    authManager?: AuthManager;
+    authManager?: AuthManager<TRole>;
     user: AuthUser | null;
     private datrixInstance?;
     get datrix(): Datrix;
@@ -186,7 +192,7 @@ declare class ApiPlugin<TRole extends string = string> extends BasePlugin<ApiCon
     private handleAuthRequest;
     isEnabled(): boolean;
     isAuthEnabled(): boolean;
-    getAuthManager(): AuthManager | undefined;
+    getAuthManager(): AuthManager<TRole> | undefined;
 }
 
 declare function handleRequest(datrix: Datrix, request: Request): Promise<Response>;
@@ -242,18 +248,20 @@ declare function serializeQuery<T extends DatrixEntry = DatrixEntry>(query: Pars
 
 declare function handleCrudRequest<TRole extends string = string>(request: Request, datrix: Datrix, api: IApiPlugin<TRole>, options?: ContextBuilderOptions): Promise<Response>;
 
-interface AuthHandlerConfig {
+interface AuthHandlerConfig<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry> {
     readonly datrix: Datrix;
-    readonly authManager: AuthManager;
-    readonly authConfig: AuthConfig;
+    readonly authManager: AuthManager<TRole, TUser>;
+    readonly authConfig: AuthConfig<TRole, TUser>;
 }
-declare function createAuthHandlers(config: AuthHandlerConfig): {
+declare function createAuthHandlers<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry>(config: AuthHandlerConfig<TRole, TUser>): {
     register: (request: Request) => Promise<Response>;
     login: (request: Request) => Promise<Response>;
     logout: (request: Request) => Promise<Response>;
     me: (request: Request) => Promise<Response>;
+    forgotPassword: (request: Request) => Promise<Response>;
+    resetPassword: (request: Request) => Promise<Response>;
 };
-declare function createUnifiedAuthHandler(config: AuthHandlerConfig, apiPrefix?: string): (request: Request) => Promise<Response>;
+declare function createUnifiedAuthHandler<TRole extends string = string, TUser extends DatrixEntry = DatrixEntry>(config: AuthHandlerConfig<TRole, TUser>, apiPrefix?: string): (request: Request) => Promise<Response>;
 
 declare class DatrixApiError extends DatrixError {
     status: number;

package/dist/index.js

@@ -1263,7 +1263,91 @@ function createAuthHandlers(config) {
       );
     }
   }
-  return { register, login, logout, me };
+  async function forgotPassword(request) {
+    try {
+      const onForgotPassword = authConfig.passwordReset?.onForgotPassword;
+      if (!onForgotPassword) {
+        throw handlerError.permissionDenied("Password reset is not configured");
+      }
+      const body = await request.json();
+      const { email } = body;
+      if (!email || typeof email !== "string") {
+        throw handlerError.invalidBody("Email is required");
+      }
+      const authRecord = await datrix.raw.findOne(
+        authSchemaName,
+        { email },
+        {
+          populate: true,
+          select: ["email", "role", "resetToken", "resetTokenExpiry"]
+        }
+      );
+      if (!authRecord) {
+        return jsonResponse({ data: { success: true } });
+      }
+      const tokenBytes = new Uint8Array(32);
+      crypto.getRandomValues(tokenBytes);
+      const token = Array.from(tokenBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+      const expirySeconds = authConfig.passwordReset?.tokenExpirySeconds ?? import_core7.DEFAULT_API_AUTH_CONFIG.passwordReset.tokenExpirySeconds;
+      const expiry = new Date(Date.now() + expirySeconds * 1e3);
+      await datrix.raw.update(authSchemaName, authRecord.id, {
+        resetToken: token,
+        resetTokenExpiry: expiry
+      });
+      await onForgotPassword(authRecord, token);
+      return jsonResponse({ data: { success: true } });
+    } catch (error) {
+      if (error instanceof import_core8.DatrixError) {
+        return datrixErrorResponse(error);
+      }
+      const message = error instanceof Error ? error.message : "Internal server error";
+      return datrixErrorResponse(
+        handlerError.internalError(
+          message,
+          error instanceof Error ? error : void 0
+        )
+      );
+    }
+  }
+  async function resetPassword(request) {
+    try {
+      const body = await request.json();
+      const { token, password } = body;
+      if (!token || typeof token !== "string") {
+        throw handlerError.invalidBody("Token is required");
+      }
+      if (!password || typeof password !== "string") {
+        throw handlerError.invalidBody("Password is required");
+      }
+      const authRecord = await datrix.raw.findOne(
+        authSchemaName,
+        { resetToken: token }
+      );
+      if (!authRecord || !authRecord.resetTokenExpiry || new Date(authRecord.resetTokenExpiry) < /* @__PURE__ */ new Date()) {
+        throw handlerError.invalidBody("Invalid or expired reset token");
+      }
+      const { hash, salt } = await authManager.hashPassword(password);
+      await datrix.raw.update(authSchemaName, authRecord.id, {
+        password: hash,
+        passwordSalt: salt,
+        resetToken: null,
+        resetTokenExpiry: null
+      });
+      return jsonResponse({ data: { success: true } });
+    } catch (error) {
+      if (error instanceof import_core8.DatrixError) {
+        return datrixErrorResponse(error);
+      }
+      const message = error instanceof Error ? error.message : "Internal server error";
+      return datrixErrorResponse(
+        handlerError.internalError(
+          message,
+          error instanceof Error ? error : void 0
+        )
+      );
+    }
+  }
+  return { register, login, logout, me, forgotPassword, resetPassword };
 }
 function createUnifiedAuthHandler(config, apiPrefix = "/api") {
   const handlers = createAuthHandlers(config);
@@ -1272,7 +1356,9 @@ function createUnifiedAuthHandler(config, apiPrefix = "/api") {
     register: authConfig.endpoints?.register ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.register,
     login: authConfig.endpoints?.login ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.login,
     logout: authConfig.endpoints?.logout ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.logout,
-    me: authConfig.endpoints?.me ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.me
+    me: authConfig.endpoints?.me ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.me,
+    forgotPassword: authConfig.endpoints?.forgotPassword ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.forgotPassword,
+    resetPassword: authConfig.endpoints?.resetPassword ?? import_core7.DEFAULT_API_AUTH_CONFIG.endpoints.resetPassword
   };
   return async function authHandler(request) {
     const url = new URL(request.url);
@@ -1290,6 +1376,12 @@ function createUnifiedAuthHandler(config, apiPrefix = "/api") {
     if (path === endpoints.me && method === "GET") {
       return handlers.me(request);
     }
+    if (path === endpoints.forgotPassword && method === "POST") {
+      return handlers.forgotPassword(request);
+    }
+    if (path === endpoints.resetPassword && method === "POST") {
+      return handlers.resetPassword(request);
+    }
     return datrixErrorResponse(
       handlerError.recordNotFound("Auth Route", url.pathname)
     );