@devmoods/express-extras 0.44.1 → 0.45.0

package/dist/auth/emailAndPassword.d.ts

@@ -0,0 +1,18 @@
+import { type AnyUser, type AuthProvider } from './types.js';
+export interface EmailAndPasswordOptions<UserModel = AnyUser> {
+    getUserById: (id: string) => Promise<UserModel>;
+    login: (email: string, verifyPassword: (realPassword: string) => Promise<boolean>) => Promise<UserModel>;
+    onPasswordResetRequest?(user: UserModel, temporaryToken: string): void | Promise<void>;
+    onPasswordChanged?(user: UserModel, newPassword: string): Promise<void>;
+    onEmailVerificationRequest?(user: UserModel, temporaryToken: string): Promise<void>;
+    onEmailVerified?(user: UserModel): Promise<void>;
+}
+export declare function EmailAndPasswordAuthProvider<UserModel extends AnyUser>(options: EmailAndPasswordOptions<UserModel>): AuthProvider<UserModel>;
+/**
+ * Compare two password hashes using bcrypt.
+ */
+export declare function checkIfPasswordsMatch(realPassword: string, attemptedPassword: string): Promise<boolean>;
+/**
+ * Returns a hash of a password suitable for storage.
+ */
+export declare function hashPassword(password: string): Promise<string>;

package/dist/auth/emailAndPassword.js

@@ -0,0 +1,120 @@
+import bcrypt from 'bcrypt';
+import { tokenSchema } from './token.js';
+import {} from './types.js';
+import { Unauthorized } from '../errors.js';
+import { getLogger } from '../logger.js';
+import { route } from '../middleware.js';
+import { validateBody } from '../validate.js';
+const passwordSchema = { type: 'string', minLength: 4 };
+const emailSchema = { type: 'string', minLength: 4 };
+const logger = getLogger('auth');
+export function EmailAndPasswordAuthProvider(options) {
+    const skipPasswordCheck = async () => true;
+    return {
+        setupRoutes(router, context) {
+            router.post('/login', validateBody({
+                type: 'object',
+                properties: {
+                    email: emailSchema,
+                    password: passwordSchema,
+                },
+                required: ['email', 'password'],
+            }), route(async ({ body: { email, password } }, res) => {
+                try {
+                    const user = await options.login(email, (realPassword) => checkIfPasswordsMatch(realPassword, password));
+                    const { token } = await context.login(res, user);
+                    logger.info('access token created');
+                    return [201, { token }];
+                }
+                catch (error) {
+                    logger.error(error);
+                    throw Unauthorized(error.message);
+                }
+            }));
+            router.post('/change-password', validateBody({
+                type: 'object',
+                properties: { token: tokenSchema, password: passwordSchema },
+                required: ['token', 'password'],
+            }), route(async (req) => {
+                const { password, token } = req.body;
+                const decoded = context.decodeTemporaryToken(token);
+                const user = await options.getUserById(decoded.payload.uid);
+                try {
+                    await context.verifyTemporaryToken(token, user);
+                }
+                catch {
+                    throw Unauthorized('Invalid token');
+                }
+                context.setCurrentUser(user);
+                await options.onPasswordChanged?.(user, await hashPassword(password));
+                logger.info('user changed password');
+                return 200;
+            }));
+            router.post('/verify-email-request', validateBody({
+                type: 'object',
+                properties: { email: emailSchema },
+                required: ['email'],
+            }), route(async (req) => {
+                const { email } = req.body;
+                const user = await options.login(email, skipPasswordCheck);
+                const temporaryToken = await context.createTemporaryToken(user);
+                await options.onEmailVerificationRequest?.(user, temporaryToken);
+                return 202;
+            }));
+            router.post('/verify-email', validateBody({
+                type: 'object',
+                properties: { token: tokenSchema, email: emailSchema },
+                required: ['token', 'email'],
+            }), route(async (req) => {
+                const { token, email } = req.body;
+                const user = await options.login(email, skipPasswordCheck);
+                try {
+                    await context.verifyTemporaryToken(token, user);
+                }
+                catch {
+                    throw Unauthorized('Invalid token');
+                }
+                context.setCurrentUser(user);
+                await options.onEmailVerified?.(user);
+                logger.info('user verified');
+                return 200;
+            }));
+            router.post('/reset', context.middleware(false), validateBody({
+                type: 'object',
+                properties: { email: emailSchema },
+                required: ['email'],
+            }), route(async (req) => {
+                const { email } = req.body;
+                try {
+                    const user = await options.login(email, skipPasswordCheck);
+                    const temporaryToken = await context.createTemporaryToken(user);
+                    await options.onPasswordResetRequest?.(user, temporaryToken);
+                    logger.info('password reset request', { email });
+                }
+                catch (error) {
+                    logger.error(error, 'auth reset failed');
+                }
+                return 202;
+            }));
+        },
+    };
+}
+/**
+ * Compare two password hashes using bcrypt.
+ */
+export async function checkIfPasswordsMatch(realPassword, attemptedPassword) {
+    if (!realPassword) {
+        throw new Error('User has no defined password');
+    }
+    const validPassword = await bcrypt.compare(attemptedPassword, realPassword);
+    if (!validPassword) {
+        throw new Error(`Passwords do not match`);
+    }
+    return true;
+}
+/**
+ * Returns a hash of a password suitable for storage.
+ */
+export function hashPassword(password) {
+    return bcrypt.hash(password, 10);
+}

package/dist/auth/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class InvalidToken extends Error {
+    constructor(message: string);
+}
+export declare class PermissionDenied extends Error {
+    constructor(message: string);
+}

package/dist/auth/errors.js

@@ -0,0 +1,12 @@
+export class InvalidToken extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'Invalid Token';
+    }
+}
+export class PermissionDenied extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'Permission Denied';
+    }
+}

package/dist/auth/passwordless.d.ts

@@ -0,0 +1,8 @@
+import { type AnyUser, type AuthProvider } from './types.js';
+export interface PasswordlessAuthProviderOptions<UserModel = AnyUser> {
+    getUserByEmail(email: string): Promise<UserModel>;
+    onLoginRequest(user: UserModel, temporaryToken: string): Promise<void>;
+}
+export declare function PasswordlessAuthProvider<UserModel extends AnyUser & {
+    email: string;
+}>(options: PasswordlessAuthProviderOptions<UserModel>): AuthProvider<UserModel>;

package/dist/auth/passwordless.js

@@ -0,0 +1,52 @@
+import {} from './types.js';
+import { Unauthorized } from '../errors.js';
+import { getLogger } from '../logger.js';
+import { route } from '../middleware.js';
+import { validateBody, validateQuery } from '../validate.js';
+const logger = getLogger('auth');
+export function PasswordlessAuthProvider(options) {
+    return {
+        setupRoutes(router, context) {
+            router.use('/passwordless/login/:token', validateQuery({
+                type: 'object',
+                properties: {
+                    email: { type: 'string', minLength: 3 },
+                },
+                required: ['email'],
+            }), route(async (req, res) => {
+                const { token: temporaryToken } = req.params;
+                const { email } = req.query;
+                const user = await options.getUserByEmail(email);
+                try {
+                    await context.verifyTemporaryToken(temporaryToken, user);
+                }
+                catch {
+                    throw Unauthorized('Invalid token');
+                }
+                const { token } = await context.login(res, user);
+                logger.info('passwordless login');
+                if (req.accepts('html')) {
+                    return res.redirect('/');
+                }
+                return { token };
+            }));
+            /**
+             * Request a one-time password for login.
+             */
+            router.post('/passwordless/request-token', validateBody({
+                type: 'object',
+                properties: {
+                    email: { type: 'string' },
+                },
+                required: ['email'],
+            }), route(async (req) => {
+                const { email } = req.body;
+                const user = await options.getUserByEmail(email);
+                const token = await context.createTemporaryToken(user);
+                await options.onLoginRequest(user, token);
+                logger.info('passwordless login requested', { email });
+                return 202;
+            }));
+        },
+    };
+}

package/dist/auth/token.d.ts

@@ -0,0 +1,40 @@
+import { type Response, type Request } from 'express';
+import { type ValidationSchema } from '../validate.js';
+export declare const tokenSchema: ValidationSchema;
+/**
+ * Returns a signed JWT token.
+ */
+export declare function createAuthToken(payload: any, secret?: string): string;
+/**
+ * Decode the given JWT token.
+ */
+export declare function decodeAuthToken(token: string, secret?: string): {
+    [x: string]: any;
+    iss?: string | undefined;
+    sub?: string | undefined;
+    aud?: string | string[] | undefined;
+    exp?: number | undefined;
+    nbf?: number | undefined;
+    iat?: number | undefined;
+    jti?: string | undefined;
+};
+/**
+ * Extract a Bearer token from the HTTP Authorization header
+ * of `req`.
+ */
+export declare function parseAuthorizationHeader(req: Request): string | null;
+/**
+ * Extract an access token from the `Request`-object.
+ *
+ * Checks multiple places and uses the first match. Priority:
+ *   1. Request header `Authorization: `
+ *   2. Cookie named `access_token`
+ *
+ */
+export declare function extractAccessTokenFromRequest<T extends Request>(req: T): string | null;
+/**
+ * Set or expire the access token cookie.
+ *
+ * If the provided token is `null` the cookie will be cleared.
+ */
+export declare function setAccessTokenCookie(res: Response, token: string | null): void;

package/dist/auth/token.js

@@ -0,0 +1,98 @@
+import {} from 'express';
+import jwt from 'jsonwebtoken';
+import { v4 } from 'uuid';
+import { InvalidToken } from './errors.js';
+import { config } from '../config.js';
+import {} from '../validate.js';
+export const tokenSchema = {
+    type: 'string',
+    minLength: 6,
+    maxLength: 256,
+};
+/**
+ * Returns a signed JWT token.
+ */
+export function createAuthToken(payload, secret = config.value.AUTH_SECRET) {
+    return jwt.sign(payload, secret, {
+        expiresIn: config.value.AUTH_TOKEN_EXPIRES_IN,
+    });
+}
+/**
+ * Decode the given JWT token.
+ */
+export function decodeAuthToken(token, secret = config.value.AUTH_SECRET) {
+    try {
+        const decoded = jwt.verify(token.trim(), secret);
+        /* c8 ignore next 3 */
+        if (typeof decoded === 'string') {
+            throw new Error('decoded value not an object');
+        }
+        return { ...decoded };
+    }
+    catch (error) {
+        throw new InvalidToken(`Failed to decode auth token: ${error.message}`);
+    }
+}
+/**
+ * Extract a Bearer token from the HTTP Authorization header
+ * of `req`.
+ */
+export function parseAuthorizationHeader(req) {
+    if (!req.headers.authorization) {
+        return null;
+    }
+    const [type, token] = req.headers.authorization
+        .split(' ')
+        .map((s) => s.trim());
+    if (token && type !== 'Bearer') {
+        throw new InvalidToken('Only Bearer type supported in jwt()');
+    }
+    // No token given, this is not necessarilly an error case
+    if (!token) {
+        if (type) {
+            return type;
+            /* c8 ignore next 3 */
+        }
+        return null;
+    }
+    return token;
+}
+/**
+ * Extract an access token from the `Request`-object.
+ *
+ * Checks multiple places and uses the first match. Priority:
+ *   1. Request header `Authorization: `
+ *   2. Cookie named `access_token`
+ *
+ */
+export function extractAccessTokenFromRequest(req) {
+    const authorizationHeader = parseAuthorizationHeader(req);
+    if (authorizationHeader) {
+        return authorizationHeader;
+    }
+    if (req.cookies && 'access_token' in req.cookies) {
+        return req.cookies['access_token'];
+    }
+    return null;
+}
+/**
+ * Set or expire the access token cookie.
+ *
+ * If the provided token is `null` the cookie will be cleared.
+ */
+export function setAccessTokenCookie(res, token) {
+    if (token == null) {
+        res.cookie('access_token', v4(), {
+            expires: new Date(1970, 0, 1),
+            sameSite: 'strict',
+            secure: process.env.NODE_ENV === 'production',
+        });
+    }
+    else {
+        res.cookie('access_token', token, {
+            httpOnly: true,
+            sameSite: 'strict',
+            secure: process.env.NODE_ENV === 'production',
+        });
+    }
+}

package/dist/auth/types.d.ts

@@ -0,0 +1,36 @@
+import { type RequestHandler, type Router, type Response } from 'express';
+import { type RedisClient } from '../redis.js';
+export interface AnyUser {
+    id: string | number;
+    [key: string]: any;
+}
+export interface AuthOptions<UserModel extends AnyUser> {
+    getUserByToken(token: Record<string, any>): Promise<UserModel>;
+    providers: AuthProvider<UserModel>[];
+    redis: RedisClient;
+    filterUser(user: UserModel): Partial<UserModel>;
+    loginUrl?: string;
+}
+export interface AuthProviderContext<UserModel extends AnyUser> {
+    filterUser: AuthOptions<UserModel>['filterUser'];
+    redis: AuthOptions<UserModel>['redis'];
+    setCurrentUser: (user: UserModel) => void;
+    createTemporaryToken(user: UserModel): Promise<string>;
+    verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
+    decodeTemporaryToken(token: string): {
+        payload: {
+            uid: string;
+        };
+        signature: string;
+    };
+    middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
+    login: (res: Response, user: UserModel) => Promise<{
+        token: string;
+    }>;
+}
+export interface AuthProvider<UserModel extends AnyUser> {
+    setupRoutes(router: Router, context: AuthProviderContext<UserModel>): void;
+}
+export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {
+    isAuthorized?: (user: UserModel) => Promise<boolean> | boolean;
+};

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+import {} from 'express';
+import {} from '../redis.js';

package/dist/auth.d.ts

@@ -1,86 +1,20 @@
-import { type Request, type RequestHandler, type Response, Router } from 'express';
-import { type RedisClient } from './redis.js';
-/**
- * Returns a signed JWT token.
- */
-export declare function createAuthToken(payload: any, secret?: string): string;
-/**
- * Decode the given JWT token.
- */
-export declare function decodeAuthToken(token: string, secret?: string): {
-    [x: string]: any;
-    iss?: string | undefined;
-    sub?: string | undefined;
-    aud?: string | string[] | undefined;
-    exp?: number | undefined;
-    nbf?: number | undefined;
-    iat?: number | undefined;
-    jti?: string | undefined;
-};
-export interface EmailAndPasswordOptions<UserModel = AnyUser> {
-    login: (email: string, verifyPassword: (realPassword: string) => Promise<boolean>) => Promise<UserModel>;
-    onPasswordResetRequest?(user: UserModel, temporaryToken: string): void | Promise<void>;
-    onPasswordChanged?(user: UserModel, newPassword: string): Promise<void>;
-    onEmailVerificationRequest?(user: UserModel, temporaryToken: string): Promise<void>;
-    onEmailVerified?(user: UserModel): Promise<void>;
-}
-export declare function EmailAndPasswordAuthProvider<UserModel extends AnyUser>(options: EmailAndPasswordOptions<UserModel>): AuthProvider<UserModel>;
-export interface AuthProviderContext<UserModel extends AnyUser> {
-    filterUser: AuthOptions<UserModel>['filterUser'];
-    redis: AuthOptions<UserModel>['redis'];
-    setCurrentUser: (user: UserModel) => void;
-    createTemporaryToken(user: UserModel): Promise<string>;
-    middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
-    login: (res: Response, user: UserModel) => Promise<{
-        token: string;
-    }>;
-}
-export type AnyUser = Record<string, any>;
-export interface AuthProvider<UserModel extends AnyUser> {
-    setupRoutes(router: Router, context: AuthProviderContext<UserModel>): void;
-}
-export interface AuthOptions<UserModel extends AnyUser> {
-    getUserByToken(token: Record<string, any>): Promise<UserModel>;
-    providers: AuthProvider<UserModel>[];
-    redis: RedisClient;
-    filterUser(user: UserModel): Partial<UserModel>;
-    loginUrl?: string;
-}
+import { type RequestHandler, Router } from 'express';
+import { type AnyUser, type AuthMiddlewareOptions, type AuthOptions } from './auth/types.js';
+export * from './auth/types.js';
+export * from './auth/emailAndPassword.js';
+export * from './auth/passwordless.js';
+export * from './auth/token.js';
 export interface CreateAuth<UserModel extends AnyUser> {
     createRouter: () => Router;
     useCurrentUser: () => UserModel | undefined;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
+    verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
+    decodeTemporaryToken(token: string): {
+        payload: {
+            uid: string;
+        };
+        signature: string;
+    };
 }
-export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {
-    isAuthorized?: (user: UserModel) => Promise<boolean> | boolean;
-};
 export declare function createAuth<UserModel extends AnyUser>({ getUserByToken, filterUser, redis, providers, loginUrl, }: AuthOptions<UserModel>): CreateAuth<UserModel>;
-/**
- * Extract a Bearer token from the HTTP Authorization header
- * of `req`.
- */
-export declare function parseAuthorizationHeader(req: Request): string | null;
-/**
- * Extract an access token from the `Request`-object.
- *
- * Checks multiple places and uses the first match. Priority:
- *   1. Request header `Authorization: `
- *   2. Cookie named `access_token`
- *
- */
-export declare function extractAccessTokenFromRequest(req: Request): string | null;
-/**
- * Set or expire the access token cookie.
- *
- * If the provided token is `null` the cookie will be cleared.
- */
-export declare function setAccessTokenCookie(res: Response, token: string | null): void;
-/**
- * Compare two password hashes using bcrypt.
- */
-export declare function checkIfPasswordsMatch(realPassword: string, attemptedPassword: string): Promise<boolean>;
-/**
- * Returns a hash of a password suitable for storage.
- */
-export declare function hashPassword(password: string): Promise<string>;

package/dist/auth.js

@@ -1,160 +1,39 @@
 import * as crypto from 'node:crypto';
-import bcrypt from 'bcrypt';
-import { Router, } from 'express';
-import jwt from 'jsonwebtoken';
-import { v4 } from 'uuid';
+import { Router } from 'express';
+import { InvalidToken, PermissionDenied } from './auth/errors.js';
+import { createAuthToken, decodeAuthToken, extractAccessTokenFromRequest, setAccessTokenCookie, tokenSchema, } from './auth/token.js';
+import {} from './auth/types.js';
 import { config } from './config.js';
 import { setContext, useContext } from './context.js';
-import { BadRequest, Forbidden, NotFound, Unauthorized } from './errors.js';
+import { Forbidden, NotFound, Unauthorized } from './errors.js';
 import { getLogger } from './logger.js';
 import { route } from './middleware.js';
-import {} from './redis.js';
-import { validateBody, validateParams, } from './validate.js';
+import { validateParams } from './validate.js';
 const logger = getLogger('auth');
-const TOKEN_EXPIRES_IN = config.value.AUTH_TOKEN_EXPIRES_IN;
-const TEMP_TOKEN_EXIRES_IN = config.value.AUTH_TEMP_TOKEN_EXPIRES_IN;
-const AUTH_SECRET = config.value.AUTH_SECRET;
-const tokenSchema = {
-    type: 'string',
-    minLength: 50,
-    maxLength: 256,
-};
-const passwordSchema = { type: 'string', minLength: 8 };
-const emailSchema = { type: 'string', minLength: 4 };
-/**
- * Returns a signed JWT token.
- */
-export function createAuthToken(payload, secret = AUTH_SECRET) {
-    return jwt.sign(payload, secret, { expiresIn: TOKEN_EXPIRES_IN });
-}
-/**
- * Decode the given JWT token.
- */
-export function decodeAuthToken(token, secret = AUTH_SECRET) {
-    try {
-        const decoded = jwt.verify(token.trim(), secret);
-        /* c8 ignore next 3 */
-        if (typeof decoded === 'string') {
-            throw new Error('decoded value not an object');
-        }
-        return { ...decoded };
-    }
-    catch (error) {
-        throw new InvalidToken(`Failed to decode auth token: ${error.message}`);
-    }
-}
-export function EmailAndPasswordAuthProvider(options) {
-    const skipPasswordCheck = async () => true;
-    return {
-        setupRoutes(router, context) {
-            router.post('/login', validateBody({
-                type: 'object',
-                properties: {
-                    email: { type: 'string' },
-                    password: { type: 'string' },
-                },
-                required: ['email', 'password'],
-            }), route(async ({ body: { email, password } }, res) => {
-                try {
-                    const user = await options.login(email, (realPassword) => checkIfPasswordsMatch(realPassword, password));
-                    const { token } = await context.login(res, user);
-                    logger.info('access token created');
-                    return [201, { token }];
-                }
-                catch (error) {
-                    logger.error(error);
-                    throw Unauthorized(error.message);
-                }
-            }));
-            router.post('/change-password', validateBody({
-                type: 'object',
-                properties: { token: tokenSchema, password: passwordSchema },
-                required: ['token', 'password'],
-            }), route(async (req) => {
-                const { password, token } = req.body;
-                const email = await context.redis.get(token);
-                if (!email) {
-                    logger.info('invalid reset token', { token });
-                    throw BadRequest('invalid reset token');
-                }
-                const user = await options.login(email, skipPasswordCheck);
-                context.setCurrentUser(user);
-                await options.onPasswordChanged?.(user, await hashPassword(password));
-                await context.redis.del(token);
-                logger.info('user changed password');
-                return 200;
-            }));
-            router.post('/verify-email-request', validateBody({
-                type: 'object',
-                properties: { email: emailSchema },
-                required: ['email'],
-            }), route(async (req) => {
-                const { email } = req.body;
-                const user = await options.login(email, skipPasswordCheck);
-                const temporaryToken = await context.createTemporaryToken(user);
-                await options.onEmailVerificationRequest?.(user, temporaryToken);
-                return 202;
-            }));
-            router.post('/verify-email', validateBody({
-                type: 'object',
-                properties: { token: tokenSchema, email: emailSchema },
-                required: ['token', 'email'],
-            }), route(async (req) => {
-                const { token, email } = req.body;
-                const storedEmail = await context.redis.get(token);
-                if (!storedEmail) {
-                    logger.info('invalid verification token', { token });
-                    throw BadRequest('invalid verification token');
-                }
-                if (storedEmail !== email) {
-                    logger.info('email verification mismatch', {
-                        expected: storedEmail,
-                        actual: email,
-                    });
-                    throw BadRequest('invalid verification token');
-                }
-                const user = await options.login(storedEmail, skipPasswordCheck);
-                context.setCurrentUser(user);
-                await options.onEmailVerified?.(user);
-                await context.redis.del(token);
-                logger.info('user verified');
-                return 200;
-            }));
-            router.post('/reset', context.middleware(false), validateBody({
-                type: 'object',
-                properties: { email: emailSchema },
-                required: ['email'],
-            }), route(async (req) => {
-                const { email } = req.body;
-                try {
-                    const user = await options.login(email, skipPasswordCheck);
-                    const temporaryToken = await context.createTemporaryToken(user);
-                    await options.onPasswordResetRequest?.(user, temporaryToken);
-                    logger.info('password reset request', { email });
-                }
-                catch (error) {
-                    logger.error(error, 'auth reset failed');
-                }
-                return 202;
-            }));
-        },
-    };
-}
+export * from './auth/types.js';
+export * from './auth/emailAndPassword.js';
+export * from './auth/passwordless.js';
+export * from './auth/token.js';
 export function createAuth({ getUserByToken, filterUser, redis, providers, loginUrl = '/', }) {
     const useCurrentUser = () => useContext('currentUser');
     const setCurrentUser = (user) => setContext('currentUser', user);
     const login = async (res, user) => {
         const token = createAuthToken(filterUser(user));
-        await redis.set(token, '1', { EX: TOKEN_EXPIRES_IN });
+        await redis.set(token, '1', { EX: config.value.AUTH_TOKEN_EXPIRES_IN });
         setAccessTokenCookie(res, token);
         setCurrentUser(user);
         return { token };
     };
+    /**
+     * API for auth providers to use
+     */
     const providerContext = {
         filterUser,
         redis,
         setCurrentUser,
         createTemporaryToken,
+        verifyTemporaryToken,
+        decodeTemporaryToken,
         middleware,
         login,
     };
@@ -194,10 +73,7 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
                 setAccessTokenCookie(res, null);
                 throw Unauthorized();
             }
-            const { exp, iat, ...rest } = user;
-            const token = createAuthToken(rest);
-            await redis.set(token, '1', { EX: TOKEN_EXPIRES_IN });
-            setAccessTokenCookie(res, token);
+            const { token } = await providerContext.login(res, user);
             logger.info('refreshed token');
             return { token, user: filterUser(user) };
         }));
@@ -267,9 +143,16 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
      */
     async function createTemporaryToken(user) {
         try {
-            const temporaryToken = crypto.randomBytes(32).toString('hex');
-            await redis.set(temporaryToken, user.email, {
-                EX: TEMP_TOKEN_EXIRES_IN,
+            const randomBytes = crypto.randomBytes(8).toString('hex');
+            const payload = { uid: user.id, r: randomBytes };
+            const signature = crypto
+                .createHmac('sha256', config.value.AUTH_SECRET)
+                .update(JSON.stringify(payload))
+                .digest('base64')
+                .slice(0, 12);
+            const temporaryToken = Buffer.from(JSON.stringify({ payload, signature })).toString('base64url');
+            await redis.set(temporaryToken, user.id, {
+                EX: config.value.AUTH_TEMP_TOKEN_EXPIRES_IN,
             });
             return temporaryToken;
         }
@@ -278,104 +161,34 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, login
             throw error;
         }
     }
+    function decodeTemporaryToken(token) {
+        return JSON.parse(Buffer.from(token, 'base64url').toString('utf-8'));
+    }
+    async function verifyTemporaryToken(token, user) {
+        const decoded = decodeTemporaryToken(token);
+        const expectedSignature = crypto
+            .createHmac('sha256', config.value.AUTH_SECRET)
+            .update(JSON.stringify(decoded.payload))
+            .digest('base64')
+            .slice(0, 12);
+        if (expectedSignature !== decoded.signature) {
+            throw new InvalidToken('Invalid signature');
+        }
+        if (decoded.payload.uid !== user.id) {
+            throw new InvalidToken('Invalid user');
+        }
+        const storedUid = await redis.get(token);
+        if (storedUid !== user.id) {
+            throw new InvalidToken('Invalid user');
+        }
+        await redis.del(token);
+    }
     return {
         createRouter,
         useCurrentUser,
         middleware,
         createTemporaryToken,
+        verifyTemporaryToken,
+        decodeTemporaryToken,
     };
 }
-/**
- * Extract a Bearer token from the HTTP Authorization header
- * of `req`.
- */
-export function parseAuthorizationHeader(req) {
-    if (!req.headers.authorization) {
-        return null;
-    }
-    const [type, token] = req.headers.authorization
-        .split(' ')
-        .map((s) => s.trim());
-    if (token && type !== 'Bearer') {
-        throw new InvalidToken('Only Bearer type supported in jwt()');
-    }
-    // No token given, this is not necessarilly an error case
-    if (!token) {
-        if (type) {
-            return type;
-            /* c8 ignore next 3 */
-        }
-        return null;
-    }
-    return token;
-}
-/**
- * Extract an access token from the `Request`-object.
- *
- * Checks multiple places and uses the first match. Priority:
- *   1. Request header `Authorization: `
- *   2. Cookie named `access_token`
- *
- */
-export function extractAccessTokenFromRequest(req) {
-    const authorizationHeader = parseAuthorizationHeader(req);
-    if (authorizationHeader) {
-        return authorizationHeader;
-    }
-    if (req.cookies && 'access_token' in req.cookies) {
-        return req.cookies['access_token'];
-    }
-    return null;
-}
-/**
- * Set or expire the access token cookie.
- *
- * If the provided token is `null` the cookie will be cleared.
- */
-export function setAccessTokenCookie(res, token) {
-    if (token == null) {
-        res.cookie('access_token', v4(), {
-            expires: new Date(1970, 0, 1),
-            sameSite: 'strict',
-            secure: process.env.NODE_ENV === 'production',
-        });
-    }
-    else {
-        res.cookie('access_token', token, {
-            httpOnly: true,
-            sameSite: 'strict',
-            secure: process.env.NODE_ENV === 'production',
-        });
-    }
-}
-class InvalidToken extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'Invalid Token';
-    }
-}
-class PermissionDenied extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'Permission Denied';
-    }
-}
-/**
- * Compare two password hashes using bcrypt.
- */
-export async function checkIfPasswordsMatch(realPassword, attemptedPassword) {
-    if (!realPassword) {
-        throw new Error('User has no defined password');
-    }
-    const validPassword = await bcrypt.compare(attemptedPassword, realPassword);
-    if (!validPassword) {
-        throw new Error(`Passwords do not match`);
-    }
-    return true;
-}
-/**
- * Returns a hash of a password suitable for storage.
- */
-export function hashPassword(password) {
-    return bcrypt.hash(password, 10);
-}

package/dist/cache.js

@@ -78,7 +78,6 @@ export function createCache(adapter) {
             const expiresMs = typeof options === 'number' || options == null
                 ? options
                 : options.expiresMs;
-            console.log({ expiresMs });
             const result = await fn(...args);
             await adapter.set(cacheKey, result, expiresMs);
             return result;

package/dist/config.js

@@ -1,12 +1,13 @@
 import { readEnv } from './utils.js';
 function lazy(fn) {
-    return {
-        get value() {
-            const value = fn();
-            Object.defineProperty(this, 'value', { value });
-            return value;
-        },
-    };
+    return { value: fn() };
+    // return {
+    //   get value() {
+    //     const value = fn();
+    //     Object.defineProperty(this, 'value', { value });
+    //     return value;
+    //   },
+    // };
 }
 export const config = lazy(() => ({
     CI: readEnv.boolean('CI', false),

package/dist/context.d.ts

@@ -14,4 +14,7 @@ export declare function useContext<T>(key: string): T | undefined;
  * Set a value on the request context
  */
 export declare function setContext<T>(key: string, value: T): void;
+/**
+ * Obtain the requestId from the current async request context.
+ */
 export declare function useRequestId(): string | undefined;

package/dist/context.js

@@ -36,6 +36,9 @@ export function setContext(key, value) {
         store.set(key, value);
     }
 }
+/**
+ * Obtain the requestId from the current async request context.
+ */
 export function useRequestId() {
     return useContext(REQUEST_ID);
 }

package/dist/errors.d.ts

@@ -1,6 +1,7 @@
+type AnyPayload = Record<string, unknown>;
 export declare class ApiError extends Error {
     status: number | null | undefined;
-    payload: unknown;
+    payload: AnyPayload | undefined;
 }
 export declare const BadRequest: (reason: any) => ApiError;
 export declare const Forbidden: (detail?: string) => ApiError;
@@ -10,7 +11,7 @@ export declare const Conflict: (detail?: string) => ApiError;
 /**
  * Create a new ApiError instance
  */
-export declare function makeError(status: number, detail?: string, payload?: any): ApiError;
+export declare function makeError(status: number, detail?: string, payload?: AnyPayload): ApiError;
 /**
  * Problem Details for HTTP APIs
  *
@@ -37,3 +38,4 @@ export interface ErrorHandlerOptions {
  * Composed together with the Sentry error handler.
  */
 export declare function errorHandler({ onError }?: ErrorHandlerOptions): import("compose-middleware").ErrorHandler<unknown, unknown, void>;
+export {};

package/dist/listen.js

@@ -6,7 +6,7 @@ import {} from 'express';
 import { config } from './config.js';
 import { getLogger } from './logger.js';
 import { before, route } from './middleware.js';
-import { envPort } from './utils.js';
+import { envPort, startTimer } from './utils.js';
 import { validateQuery } from './validate.js';
 const logger = getLogger('http');
 const READINESS_PERIOD = config.value.READINESS_PERIOD_MS;
@@ -81,16 +81,19 @@ export function createExpressServer(app, options = {}) {
             return;
         }
         stopping = true;
+        const timer = startTimer();
         try {
             logger.info(`app shutting down due to ${signal}`);
             await delay(READINESS_PERIOD + 1000);
             await server.stop();
             await options.onShutdown?.();
-            logger.info('app shut down');
+            logger.info('app shut down', { duration: timer.getDuration() });
             process.exit(0);
         }
         catch (error) {
-            logger.error(error, 'error during shutdown');
+            logger.error(error, 'error during shutdown', {
+                duration: timer.getDuration(),
+            });
             process.exit(1);
         }
     }

package/dist/middleware.d.ts

@@ -1,3 +1,4 @@
+import { type ServerResponse, type IncomingMessage } from 'node:http';
 import bodyParser from 'body-parser';
 import { type NextFunction, type RequestHandler, type Request, type Response } from 'express';
 import { type CsrfMiddlewareOptions } from './csrf.js';
@@ -6,11 +7,12 @@ type JsonParser = typeof bodyParser.json;
 export declare const urlencodedParser: UrlencodedParser;
 export declare const jsonParser: JsonParser;
 export { asyncMiddleware as route };
+type ContentSecurityPolicyDirectiveValue = string | ((req: IncomingMessage, res: ServerResponse) => string);
 export interface BeforeMiddlewareCSPDirectives {
-    'script-src': string[];
-    'style-src': string[];
-    'connect-src': string[];
-    [key: string]: string[];
+    'script-src': ContentSecurityPolicyDirectiveValue[];
+    'style-src': ContentSecurityPolicyDirectiveValue[];
+    'connect-src': ContentSecurityPolicyDirectiveValue[];
+    [key: string]: ContentSecurityPolicyDirectiveValue[];
 }
 export interface BeforeMiddlewareOptions {
     cookies?: boolean;
@@ -20,6 +22,7 @@ export interface BeforeMiddlewareOptions {
     allowUnsafeInlineScripts?: boolean;
     cspDirectives?: (defaults: BeforeMiddlewareCSPDirectives) => BeforeMiddlewareCSPDirectives;
 }
+export declare function useCspNonce(): string;
 /**
  * Register middleware that must come before the app routes.
  */
@@ -42,4 +45,4 @@ type ResponseWrapper<TResponseBody extends AnyResponseBody> = TResponseBody | TR
 /**
  * Alias of `route()`
  */
-export declare function asyncMiddleware<RequestBody, RequestQuery = object, ResponseBody extends AnyResponseBody = object>(fn: (req: Request<Record<string, string>, ResponseBody, RequestBody, RequestQuery, object>, res: Response<ResponseBody, object>, next: NextFunction) => ResponseWrapper<ResponseBody> | Promise<ResponseWrapper<ResponseBody>>): RequestHandler<Record<string, string>, ResponseBody, RequestBody, RequestQuery>;
+export declare function asyncMiddleware<RequestBody, RequestQuery extends Record<string, any> = Record<string, any>, ResponseBody extends AnyResponseBody = Record<string, any>>(fn: (req: Request<Record<string, string>, ResponseBody, RequestBody, RequestQuery, Record<string, any>>, res: Response<ResponseBody, object>, next: NextFunction) => ResponseWrapper<ResponseBody> | Promise<ResponseWrapper<ResponseBody>>): RequestHandler<Record<string, string>, ResponseBody, RequestBody, RequestQuery>;

package/dist/middleware.js

@@ -1,9 +1,11 @@
+import * as crypto from 'node:crypto';
+import {} from 'node:http';
 import bodyParser from 'body-parser';
 import { compose } from 'compose-middleware';
 import cookieParser from 'cookie-parser';
 import {} from 'express';
 import helmet from 'helmet';
-import { withRequestContext } from './context.js';
+import { setContext, useContext, withRequestContext } from './context.js';
 import { csrf, doubleCsrfProtection, } from './csrf.js';
 import { NotFound } from './errors.js';
 import { getLogger } from './logger.js';
@@ -12,6 +14,10 @@ export const urlencodedParser = bodyParser.urlencoded;
 export const jsonParser = bodyParser.json;
 const logger = getLogger('http');
 export { asyncMiddleware as route };
+const CSP_NONCE_KEY = 'csp-nonce';
+export function useCspNonce() {
+    return useContext(CSP_NONCE_KEY) ?? 'fuck';
+}
 /**
  * Register middleware that must come before the app routes.
  */
@@ -24,6 +30,10 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
                 ? csrf()
                 : undefined,
         logRequestDuration(),
+        ((req, res, next) => {
+            setContext(CSP_NONCE_KEY, crypto.randomBytes(16).toString('base64'));
+            next();
+        }),
         useHelmet &&
             helmet({
                 contentSecurityPolicy: {
@@ -44,6 +54,7 @@ export function before({ cookies = false, helmet: useHelmet = true, json: useJso
                         'object-src': ["'none'"],
                         'script-src': [
                             "'self'",
+                            () => `'nonce-${useCspNonce()}'`,
                             ...(allowUnsafeInlineScripts ? ["'unsafe-inline'"] : []),
                             '*.cdn-apple.com',
                         ],

package/dist/migrate.js

@@ -3,7 +3,7 @@ import * as path from 'node:path';
 import chalk from 'chalk';
 import {} from 'commander';
 import {} from './cli.js';
-import { createPostgres } from './postgres.js';
+import { createPostgres, formatSql, sql } from './postgres.js';
 export const asCli = (command, cli) => {
     command.command('up').action(cli.wrap(async () => {
         const migrator = new Migrator();
@@ -54,7 +54,7 @@ export const asCli = (command, cli) => {
     }));
 };
 export class Migrator {
-    constructor({ postgres = createPostgres(), pathToMigrations = path.resolve(process.cwd(), 'db', 'migrations'), migrationTableName = 'migrations', verbose = true, } = {}) {
+    constructor({ postgres = createPostgres({ onLogStatement: () => { } }), pathToMigrations = path.resolve(process.cwd(), 'db', 'migrations'), migrationTableName = 'migrations', verbose = true, } = {}) {
         this.filenameRegExp = /(\d+)_(.*)\.(js|ts|mjs|mts|sql)/;
         this.postgres = postgres;
         this.pathToMigrations = pathToMigrations;
@@ -69,18 +69,18 @@ export class Migrator {
             return false;
         }
         await fs.mkdir(this.pathToMigrations, { recursive: true });
-        await this.postgres.query(`
-      CREATE TABLE IF NOT EXISTS ${this.migrationTableName} (
-        id serial PRIMARY KEY,
+        await this.postgres.query(sql `
+      CREATE TABLE IF NOT EXISTS ${sql.identifier(this.migrationTableName)} (
+        id bigserial PRIMARY KEY,
         version int NOT NULL,
-        run_at timestamp NOT NULL
+        run_at timestamp with time zone NOT NULL
       );
     `);
         return true;
     }
     async isInstalled() {
         try {
-            await this.postgres.query(`SELECT * FROM ${this.migrationTableName}`);
+            await this.postgres.query(sql `SELECT * FROM ${sql.identifier(this.migrationTableName)}`);
             await fs.stat(this.pathToMigrations);
             return true;
         }
@@ -199,9 +199,9 @@ export class Migrator {
     }
     async migrate(connection, migrator, direction) {
         try {
-            const queryWithLog = (sql) => {
-                this.log(chalk.yellow(sql.toString()));
-                return connection.query(sql);
+            const queryWithLog = (statement) => {
+                this.log(chalk.yellow(formatSql(statement)));
+                return connection.query(statement);
             };
             const returnValue = await migrator[direction](queryWithLog.bind(connection));
             if (typeof returnValue === 'string') {

package/dist/postgres.d.ts

@@ -1,6 +1,9 @@
 import pg, { type PoolClient, type PoolConfig, type QueryResult, type QueryResultRow } from 'pg';
 export declare const escapePostgresIdentifier: typeof pg.escapeIdentifier;
 export declare const escapePostgresLiteral: typeof pg.escapeLiteral;
+/**
+ * Returns a pretty-printed SQL statement.
+ */
 export declare const formatSql: (statement: SqlStatement | string) => string;
 export interface PostgresOptions extends PoolConfig, ConnectionOptions {
     onError?: (error: Error, client: any) => void;

package/dist/postgres.js

@@ -4,6 +4,9 @@ import { config } from './config.js';
 import { startTimer } from './utils.js';
 export const escapePostgresIdentifier = pg.escapeIdentifier;
 export const escapePostgresLiteral = pg.escapeLiteral;
+/**
+ * Returns a pretty-printed SQL statement.
+ */
 export const formatSql = (statement) => {
     const value = statement instanceof SqlStatement ? statement.text : statement;
     return format(value, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.44.1",
+  "version": "0.45.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",