@dotpress/auth 1.3.2 → 2.0.0-alpha.0

package/dist/lib/cookies.d.ts

@@ -1,42 +0,0 @@
-import type { Response, Request } from 'express';
-import type { CookieSettings, AuthMode } from '../types/types.js';
-type ResolvedCookieSettings = Required<Omit<CookieSettings, 'domain'>> & {
-    domain?: string;
-};
-export declare const getCookieSettings: () => ResolvedCookieSettings;
-/**
- * Set authentication cookies on the response
- */
-export declare const setAuthCookies: (res: Response, tokens: {
-    accessToken: string;
-    refreshToken: string;
-}, expiresInSeconds: number) => void;
-/**
- * Clear authentication cookies
- */
-export declare const clearAuthCookies: (res: Response) => void;
-/**
- * Detect authentication mode from request
- * Priority: cookies first, then body
- */
-export declare const detectAuthMode: (req: Request) => AuthMode | null;
-/**
- * Extract tokens from request based on detected mode
- */
-export declare const extractTokensFromRequest: (req: Request) => {
-    accessToken: string;
-    refreshToken: string;
-} | null;
-/**
- * Extract access token from request
- * Priority: Authorization header > cookie > body
- */
-export declare const extractAccessToken: (req: Request) => string | null;
-/**
- * Calculate expiration timestamp
- */
-export declare const calculateExpiration: (expiresInSeconds: number) => {
-    expiresIn: number;
-    expiresAt: string;
-};
-export {};

package/dist/lib/cookies.js

@@ -1,136 +0,0 @@
-import { getSettings } from './settings.js';
-const DEFAULT_COOKIE_SETTINGS = {
-    enabled: false,
-    httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
-    sameSite: 'lax',
-    path: '/',
-    accessTokenName: 'dotpress_access_token',
-    refreshTokenName: 'dotpress_refresh_token',
-    accessTokenInCookie: false,
-    domain: undefined,
-};
-export const getCookieSettings = () => {
-    const settings = getSettings();
-    return {
-        ...DEFAULT_COOKIE_SETTINGS,
-        ...settings.cookies,
-    };
-};
-/**
- * Set authentication cookies on the response
- */
-export const setAuthCookies = (res, tokens, expiresInSeconds) => {
-    const cookieSettings = getCookieSettings();
-    if (!cookieSettings.enabled) {
-        return;
-    }
-    const cookieOptions = {
-        httpOnly: cookieSettings.httpOnly,
-        secure: cookieSettings.secure,
-        sameSite: cookieSettings.sameSite,
-        path: cookieSettings.path,
-        domain: cookieSettings.domain,
-        maxAge: expiresInSeconds * 1000,
-    };
-    // Always set refresh token in cookie for 'cookie' mode
-    res.cookie(cookieSettings.refreshTokenName, tokens.refreshToken, cookieOptions);
-    // Optionally set access token in cookie
-    if (cookieSettings.accessTokenInCookie) {
-        res.cookie(cookieSettings.accessTokenName, tokens.accessToken, cookieOptions);
-    }
-};
-/**
- * Clear authentication cookies
- */
-export const clearAuthCookies = (res) => {
-    const cookieSettings = getCookieSettings();
-    if (!cookieSettings.enabled) {
-        return;
-    }
-    const cookieOptions = {
-        httpOnly: cookieSettings.httpOnly,
-        secure: cookieSettings.secure,
-        sameSite: cookieSettings.sameSite,
-        path: cookieSettings.path,
-        domain: cookieSettings.domain,
-    };
-    res.clearCookie(cookieSettings.refreshTokenName, cookieOptions);
-    if (cookieSettings.accessTokenInCookie) {
-        res.clearCookie(cookieSettings.accessTokenName, cookieOptions);
-    }
-};
-/**
- * Detect authentication mode from request
- * Priority: cookies first, then body
- */
-export const detectAuthMode = (req) => {
-    const cookieSettings = getCookieSettings();
-    // Check if refresh token exists in cookies
-    if (req.cookies?.[cookieSettings.refreshTokenName]) {
-        return 'cookie';
-    }
-    // Check if refresh token exists in body
-    if (req.body?.refreshToken) {
-        return 'body';
-    }
-    return null;
-};
-/**
- * Extract tokens from request based on detected mode
- */
-export const extractTokensFromRequest = (req) => {
-    const mode = detectAuthMode(req);
-    const cookieSettings = getCookieSettings();
-    if (mode === 'cookie') {
-        const refreshToken = req.cookies?.[cookieSettings.refreshTokenName];
-        const accessToken = cookieSettings.accessTokenInCookie
-            ? req.cookies?.[cookieSettings.accessTokenName]
-            : req.body?.accessToken;
-        if (!refreshToken || !accessToken) {
-            return null;
-        }
-        return { accessToken, refreshToken };
-    }
-    if (mode === 'body') {
-        const { accessToken, refreshToken } = req.body || {};
-        if (!accessToken || !refreshToken) {
-            return null;
-        }
-        return { accessToken, refreshToken };
-    }
-    return null;
-};
-/**
- * Extract access token from request
- * Priority: Authorization header > cookie > body
- */
-export const extractAccessToken = (req) => {
-    // Priority 1: Authorization header
-    const authHeader = req.headers.authorization;
-    if (authHeader?.startsWith('Bearer ')) {
-        return authHeader.replace('Bearer ', '');
-    }
-    const cookieSettings = getCookieSettings();
-    // Priority 2: Cookie (if enabled)
-    if (cookieSettings.enabled &&
-        cookieSettings.accessTokenInCookie &&
-        req.cookies?.[cookieSettings.accessTokenName]) {
-        return req.cookies[cookieSettings.accessTokenName];
-    }
-    // Priority 3: Body
-    if (req.body?.accessToken) {
-        return req.body.accessToken;
-    }
-    return null;
-};
-/**
- * Calculate expiration timestamp
- */
-export const calculateExpiration = (expiresInSeconds) => {
-    const expiresAt = new Date(Date.now() + expiresInSeconds * 1000);
-    return {
-        expiresIn: expiresInSeconds,
-        expiresAt: expiresAt.toISOString(),
-    };
-};

package/dist/lib/generators.d.ts

@@ -1 +0,0 @@
-export declare const generateUUID: () => `${string}-${string}-${string}-${string}-${string}`;

package/dist/lib/generators.js

@@ -1,4 +0,0 @@
-import { randomUUID } from 'crypto';
-export const generateUUID = () => {
-    return randomUUID();
-};

package/dist/lib/handlers.d.ts

@@ -1,2 +0,0 @@
-import type { PluginAPI } from 'dotpress';
-export declare const registerHandlers: (plugin: PluginAPI) => void;

package/dist/lib/handlers.js

@@ -1,263 +0,0 @@
-import { unauthorizedError, internalError } from 'dotpress';
-import bcrypt from 'bcryptjs';
-import { getSettings } from './settings.js';
-import { getRequestIp } from './ip.js';
-import { generateTokensForUser, generateTokensFromRefreshToken, validateAndDecodeAccessToken, } from './tokens.js';
-import { setAuthCookies, clearAuthCookies, extractTokensFromRequest, calculateExpiration, getCookieSettings, } from './cookies.js';
-export const registerHandlers = (plugin) => {
-    const authGroup = plugin.addGroup('/auth');
-    const settings = getSettings();
-    authGroup.defineRoute({
-        method: 'post',
-        path: '/login',
-        schema: (z) => ({
-            body: z.object({
-                username: z.string(),
-                password: z.string(),
-                client: z.string().optional(),
-                aud: settings.aud?.required ? z.string() : z.string().optional(),
-                mode: z.enum(['body', 'cookie']).optional(),
-            }),
-            response: z.object({
-                userId: z.string(),
-                accessToken: z.string(),
-                refreshToken: z.string(),
-                expiresIn: z.number(),
-                expiresAt: z.string(),
-            }),
-        }),
-        handler: async ({ req, res }) => {
-            const { username, password, client, aud, mode } = req.body;
-            const ipAddress = getRequestIp(req);
-            const user = await settings.dataProvider.findUserIdentifiers(username);
-            if (!user) {
-                if (settings.onLoginFailed) {
-                    await settings.onLoginFailed({
-                        username,
-                        errorType: 'invalid_username',
-                        client: client || '',
-                        ipAddress: ipAddress || '',
-                    });
-                }
-                return unauthorizedError('INVALID_LOGIN');
-            }
-            const isPasswordValid = await bcrypt.compare(password, user.passwordHash);
-            if (!isPasswordValid) {
-                if (settings.onLoginFailed) {
-                    await settings.onLoginFailed({
-                        username,
-                        errorType: 'invalid_password',
-                        client: client || '',
-                        ipAddress: ipAddress || '',
-                    });
-                }
-                return unauthorizedError('INVALID_LOGIN');
-            }
-            if (aud && typeof settings.aud?.isUserRoleAllowed === 'function') {
-                const isAllowed = settings.aud.isUserRoleAllowed(user.role || '', aud);
-                if (!isAllowed) {
-                    if (settings.onLoginFailed) {
-                        await settings.onLoginFailed({
-                            username,
-                            errorType: 'invalid_role',
-                            client: client || '',
-                            ipAddress: ipAddress || '',
-                        });
-                    }
-                    return unauthorizedError('INVALID_LOGIN');
-                }
-            }
-            const { accessToken, refreshToken } = await generateTokensForUser({
-                username,
-                userId: user.userId,
-                aud,
-            });
-            if (settings.onLoginSuccess) {
-                await settings.onLoginSuccess({
-                    userId: user.userId,
-                    username,
-                    client: client || '',
-                    ipAddress: ipAddress || '',
-                });
-            }
-            if (mode === 'cookie') {
-                setAuthCookies(res, { accessToken, refreshToken }, settings.refreshTokenTTLInDays * 24 * 60 * 60);
-            }
-            const expiration = calculateExpiration(settings.accessTokenTTL);
-            return {
-                userId: user.userId,
-                accessToken,
-                refreshToken,
-                ...expiration,
-            };
-        },
-    });
-    authGroup.defineRoute({
-        method: 'post',
-        path: '/refresh',
-        schema: (z) => ({
-            body: z
-                .object({
-                accessToken: z.string().optional(),
-                refreshToken: z.string().optional(),
-            })
-                .optional(),
-            response: z.object({
-                userId: z.string(),
-                accessToken: z.string(),
-                refreshToken: z.string(),
-                expiresIn: z.number(),
-                expiresAt: z.string(),
-            }),
-        }),
-        handler: async ({ req, res }) => {
-            // Extract tokens from cookies or body (auto-detect)
-            const extractedTokens = extractTokensFromRequest(req);
-            if (!extractedTokens) {
-                return unauthorizedError('NO_TOKENS_PROVIDED');
-            }
-            const { accessToken, refreshToken } = extractedTokens;
-            try {
-                const tokens = await generateTokensFromRefreshToken({
-                    accessToken,
-                    refreshToken,
-                });
-                // Set cookies if the request came with cookies (auto-detect mode)
-                const mode = req.cookies?.[settings.cookies?.refreshTokenName || 'dotpress_refresh_token']
-                    ? 'cookie'
-                    : 'body';
-                if (mode === 'cookie') {
-                    setAuthCookies(res, {
-                        accessToken: tokens.accessToken,
-                        refreshToken: tokens.refreshToken,
-                    }, settings.refreshTokenTTLInDays * 24 * 60 * 60);
-                }
-                const expiration = calculateExpiration(settings.accessTokenTTL);
-                return {
-                    userId: tokens.userId,
-                    accessToken: tokens.accessToken,
-                    refreshToken: tokens.refreshToken,
-                    ...expiration,
-                };
-            }
-            catch (e) {
-                const errorMessage = e.message;
-                if (errorMessage === 'Invalid_Refresh_Token') {
-                    return unauthorizedError('INVALID_REFRESH_TOKEN');
-                }
-                if (errorMessage === 'Expired_Refresh_Token') {
-                    return unauthorizedError('EXPIRED_REFRESH_TOKEN');
-                }
-                return internalError('Can not refresh tokens.');
-            }
-        },
-    });
-    authGroup.defineRoute({
-        method: 'get',
-        path: '/me',
-        handler: async ({ req }) => {
-            if (!req.user) {
-                return unauthorizedError();
-            }
-            return req.user;
-        },
-    });
-    authGroup.defineRoute({
-        method: 'post',
-        path: '/restore',
-        schema: (z) => ({
-            response: z.object({
-                userId: z.string(),
-                accessToken: z.string(),
-                refreshToken: z.string(),
-                expiresIn: z.number(),
-                expiresAt: z.string(),
-                user: z.unknown(),
-            }),
-        }),
-        handler: async ({ req, res }) => {
-            const cookieSettings = getCookieSettings();
-            // Only support cookie mode for restore
-            if (!cookieSettings.enabled) {
-                return unauthorizedError('COOKIES_NOT_ENABLED');
-            }
-            // This endpoint requires accessTokenInCookie to be enabled
-            if (!cookieSettings.accessTokenInCookie) {
-                return unauthorizedError('ACCESS_TOKEN_NOT_IN_COOKIE');
-            }
-            const refreshToken = req.cookies?.[cookieSettings.refreshTokenName];
-            const accessToken = req.cookies?.[cookieSettings.accessTokenName];
-            if (!refreshToken) {
-                return unauthorizedError('NO_REFRESH_TOKEN');
-            }
-            if (!accessToken) {
-                return unauthorizedError('NO_ACCESS_TOKEN');
-            }
-            // Try to validate access token first
-            try {
-                const { userId } = validateAndDecodeAccessToken(accessToken);
-                const user = await settings.dataProvider.findUserById(userId);
-                if (user) {
-                    const expiration = calculateExpiration(settings.accessTokenTTL);
-                    return {
-                        userId,
-                        accessToken,
-                        refreshToken,
-                        ...expiration,
-                        user,
-                    };
-                }
-            }
-            catch {
-                // Access token is invalid or expired, continue to refresh logic
-            }
-            // Access token is expired, try to refresh using refresh token
-            try {
-                const tokens = await generateTokensFromRefreshToken({
-                    accessToken,
-                    refreshToken,
-                });
-                // Set new cookies
-                setAuthCookies(res, {
-                    accessToken: tokens.accessToken,
-                    refreshToken: tokens.refreshToken,
-                }, settings.refreshTokenTTLInDays * 24 * 60 * 60);
-                const user = await settings.dataProvider.findUserById(tokens.userId);
-                if (!user) {
-                    return unauthorizedError('USER_NOT_FOUND');
-                }
-                const expiration = calculateExpiration(settings.accessTokenTTL);
-                return {
-                    userId: tokens.userId,
-                    accessToken: tokens.accessToken,
-                    refreshToken: tokens.refreshToken,
-                    ...expiration,
-                    user,
-                };
-            }
-            catch (e) {
-                const errorMessage = e.message;
-                if (errorMessage === 'Invalid_Refresh_Token') {
-                    return unauthorizedError('INVALID_REFRESH_TOKEN');
-                }
-                if (errorMessage === 'Expired_Refresh_Token') {
-                    return unauthorizedError('EXPIRED_REFRESH_TOKEN');
-                }
-                return internalError('Cannot restore session.');
-            }
-        },
-    });
-    authGroup.defineRoute({
-        method: 'post',
-        path: '/logout',
-        handler: async ({ req, res }) => {
-            const userId = req.user?.id || '';
-            if (!userId) {
-                return unauthorizedError();
-            }
-            await settings.dataProvider.revokeTokens(userId);
-            clearAuthCookies(res);
-            return { success: true };
-        },
-    });
-};

package/dist/lib/ip.d.ts

@@ -1,2 +0,0 @@
-import type { Request } from 'express';
-export declare const getRequestIp: (req: Request) => string | null;

package/dist/lib/ip.js

@@ -1,15 +0,0 @@
-import requestIp from 'request-ip';
-export const getRequestIp = (req) => {
-    const clientIp = requestIp.getClientIp(req);
-    const localIps = [
-        '127.0.0.1',
-        'localhost',
-        '::1',
-        '::ffff',
-        '::ffff:127.0.0.1',
-    ];
-    if (clientIp && localIps.includes(clientIp)) {
-        return null;
-    }
-    return clientIp;
-};

package/dist/lib/middleware.d.ts

@@ -1,2 +0,0 @@
-import type { Request, Response, NextFunction } from 'express';
-export declare const attachAuthenticatedUser: (req: Request, _res: Response, next: NextFunction) => Promise<void>;

package/dist/lib/middleware.js

@@ -1,23 +0,0 @@
-import { getSettings } from './settings.js';
-import { validateAndDecodeAccessToken } from './tokens.js';
-import { extractAccessToken } from './cookies.js';
-export const attachAuthenticatedUser = async (req, _res, next) => {
-    const accessToken = extractAccessToken(req);
-    if (!accessToken) {
-        next();
-        return;
-    }
-    try {
-        const settings = getSettings();
-        const { userId } = validateAndDecodeAccessToken(accessToken);
-        const user = await settings.dataProvider.findUserById(userId);
-        if (user) {
-            req.user = user;
-        }
-        next();
-    }
-    catch (e) {
-        console.warn(e);
-        next();
-    }
-};

package/dist/lib/settings.d.ts

@@ -1,3 +0,0 @@
-import { PluginSettings } from '../types/types.js';
-export declare const setSettings: (settings: Partial<PluginSettings>) => void;
-export declare const getSettings: () => PluginSettings;

package/dist/lib/settings.js

@@ -1,42 +0,0 @@
-let pluginSettings = {
-    accessTokenTTL: 3600,
-    refreshTokenTTLInDays: 14,
-    issuer: '',
-    keys: {
-        secretKey: '',
-        publicKey: '',
-    },
-    dataProvider: {
-        storeRefreshToken: () => {
-            throw new Error('storeRefreshToken() is not implemented.');
-        },
-        findRefreshToken: () => {
-            throw new Error('findRefreshToken() is not implemented.');
-        },
-        markRefreshTokenAsUsed: () => {
-            throw new Error('markRefreshTokenAsUsed() is not implemented.');
-        },
-        revokeTokens: () => {
-            throw new Error('revokeTokens() is not implemented.');
-        },
-        findUserById: () => {
-            throw new Error('findUserById() is not implemented.');
-        },
-        findUserIdentifiers: () => {
-            throw new Error('findUserByUsername() is not implemented.');
-        },
-    },
-    onLoginFailed: () => {
-        return Promise.resolve();
-    },
-    onLoginSuccess: () => {
-        return Promise.resolve();
-    },
-};
-export const setSettings = (settings) => {
-    pluginSettings = {
-        ...pluginSettings,
-        ...settings,
-    };
-};
-export const getSettings = () => pluginSettings;

package/dist/lib/tokens.d.ts

@@ -1,38 +0,0 @@
-import { TokenPair } from '../types/types.js';
-type CreateTokenPayload = {
-    sub: string;
-    username: string;
-    auth_time: number;
-    aud?: string;
-};
-type CreatedAccessToken = {
-    jwtId: string;
-    accessToken: string;
-};
-type CreatedRefreshToken = {
-    token: string;
-    tokenHash: string;
-};
-type UserIdentifiers = {
-    userId: string;
-    username: string;
-    aud?: string;
-};
-export declare const createAccessTokenFromPayload: (payload: CreateTokenPayload) => CreatedAccessToken;
-export declare const generateRefreshToken: () => CreatedRefreshToken;
-/**
- * Generate a pair of access and refresh tokens for a given user
- */
-export declare const generateTokensForUser: ({ userId, username, aud, }: UserIdentifiers) => Promise<TokenPair>;
-export declare const generateAccessToken: ({ userId, username, aud, }: UserIdentifiers) => CreatedAccessToken;
-/**
- * Regenerate a pair of token using a refresh token
- * Expired access token must be provided in order to validate userId and jwtId
- */
-export declare const generateTokensFromRefreshToken: ({ accessToken, refreshToken, }: TokenPair) => Promise<TokenPair & {
-    userId: string;
-}>;
-export declare const validateAndDecodeAccessToken: (accessToken: string) => {
-    userId: string;
-};
-export {};