@drax/identity-back 0.38.1 → 0.40.0

package/src/controllers/UserController.ts

@@ -6,7 +6,7 @@ import {
     DraxConfig,
     StoreManager,
     ValidationError,
-    UnauthorizedError, SecuritySensitiveError,
+    UnauthorizedError, SecuritySensitiveError, BadRequestError,
 } from "@drax/common-back";
 
 import UserServiceFactory from "../factory/UserServiceFactory.js";
@@ -17,8 +17,9 @@ import BadCredentialsError from "../errors/BadCredentialsError.js";
 import {join} from "path";
 import {IdentityConfig} from "../config/IdentityConfig.js";
 import UserEmailService from "../services/UserEmailService.js";
-import {IDraxFieldFilter} from "@drax/crud-share";
+import {IDraxCrudEvent, IDraxFieldFilter} from "@drax/crud-share";
 import TenantServiceFactory from "../factory/TenantServiceFactory.js";
+import {CustomRequest} from "@drax/crud-back/dist";
 
 const BASE_FILE_DIR = DraxConfig.getOrLoad(CommonConfig.FileDir) || 'files';
 const AVATAR_DIR = DraxConfig.getOrLoad(IdentityConfig.AvatarDir) || 'avatar';
@@ -33,6 +34,40 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
         super(UserServiceFactory(), UserPermissions)
         this.tenantField = "tenant";
         this.tenantFilter = true;
+        this.entityName = 'User'
+    }
+
+    async onUserLoggedIn(request: CustomRequest, user: IUser, session: string) {
+        const eventData: IDraxCrudEvent = {
+            action: 'loggedIn',
+            entity: this.entityName,
+            resourceId: user._id.toString(),
+            postItem: null,
+            preItem: null,
+            detail: `User ${user.username} logged in.`,
+            timestamp: new Date(),
+            ip: request.ip,
+            userAgent: request.headers['user-agent'],
+            requestId: request.id,
+            user: {
+                id: user._id.toString(),
+                username: user.username,
+                role:{
+                    id: user?.role?._id.toString(),
+                    name: user?.role?.name,
+                },
+                tenant: {
+                    id: user?.tenant?._id.toString(),
+                    name: user?.tenant?.name,
+                },
+                apiKey: {
+                    id: null,
+                    name: null,
+                },
+                session: session,
+            }
+        }
+        this.eventEmitter.emitCrudEvent(eventData)
     }
 
     async auth(request, reply) {
@@ -42,8 +77,9 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userAgent = request.headers['user-agent'];
             const ip = request.ip;
             const userService = UserServiceFactory()
-
-            return await userService.auth(username, password,{userAgent, ip})
+            const {user, accessToken, session} = await userService.auth(username, password, {userAgent, ip})
+            this.onUserLoggedIn(request, user, session)
+            return {accessToken}
         } catch (e) {
             console.error('/api/auth error', e)
             if (e instanceof BadCredentialsError) {
@@ -64,10 +100,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 delete user.password
 
                 //handle SwitchTenant setted in accessToken
-                if(request.authUser.tenantId != user?.tenant?._id){
+                if (request.authUser.tenantId != user?.tenant?._id) {
                     const tenantService = TenantServiceFactory()
                     const tenant = await tenantService.findById(request.authUser.tenantId)
-                    if(tenant){
+                    if (tenant) {
                         user.tenant = tenant
                     }
                 }
@@ -79,23 +115,56 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
+        }
+    }
+
+    async onUserEvent(request: CustomRequest, action: string, resourceId: string = null, detail: string = null) {
+        const requestData = this.extractRequestData(request)
+        const eventData: IDraxCrudEvent = {
+            action: action,
+            entity: this.entityName,
+            resourceId: resourceId.toString(),
+            postItem: null,
+            preItem: null,
+            detail: detail,
+            timestamp: new Date(),
+            ...requestData
         }
+        this.eventEmitter.emitCrudEvent(eventData)
     }
 
     async switchTenant(request, reply) {
         try {
+
             request.rbac.assertPermission(UserPermissions.SwitchTenant)
+
             if (request.authUser && request.token) {
                 const tenantId = request.body.tenantId
+                if (!tenantId) {
+                    throw new BadRequestError('Missing tenantId')
+                }
+
+                const tenant = await TenantServiceFactory().findById(tenantId);
+
+                if (!tenant) {
+                    throw new BadRequestError('Invalid tenantId')
+                }
+
+                const tenantName = tenant?.name;
                 const userService = UserServiceFactory()
-                let {accessToken} = await userService.switchTenant(request.token, tenantId)
+                let {accessToken} = await userService.switchTenant(request.token, tenantId, tenantName)
+
+                const username = request.rbac.username
+                const detail = `User ${username} switched to tenant "${tenantName}" (ID: ${tenantId})`;
+                this.onUserEvent(request, 'switchTenant', request.rbac.userId, detail)
+
                 return {accessToken}
             } else {
                 throw new UnauthorizedError()
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -119,7 +188,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             }
             return paginateResult
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -135,7 +204,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             let item = await this.service.search(search, 1000, filters)
             return item
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -168,7 +237,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userService = UserServiceFactory()
             let user = await userService.register(payload)
 
-            if(user){
+            if (user) {
+                const detail = `User ${user?.username} registered successfully.`;
+                this.onUserEvent(request, 'register', user?._id, detail)
+
                 //SEND EMAIL FOR EMAIL VERIFICATION
                 await UserEmailService.emailVerifyCode(user.emailCode, user.email)
 
@@ -180,7 +252,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
 
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -189,12 +261,12 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const emailCode = request.params.code
             const userService = UserServiceFactory()
             const r = await userService.verifyEmail(emailCode)
-            if(r){
+            if (r) {
                 const html = RegistrationCompleteHtml
                 reply.header('Content-Type', 'text/html; charset=utf-8').send(html)
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -204,7 +276,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userService = UserServiceFactory()
             return await userService.verifyPhone(phoneCode)
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -221,9 +293,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
             const userService = UserServiceFactory()
             let user = await userService.create(payload)
+            this.onCreated(request, user)
             return user
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -238,10 +311,12 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             }
 
             const userService = UserServiceFactory()
+            let preUser = await userService.findById(id)
             let user = await userService.update(id, payload)
+            this.onUpdated(request, preUser, user)
             return user
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -250,8 +325,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             request.rbac.assertPermission(UserPermissions.Delete)
             const id = request.params.id
             const userService = UserServiceFactory()
+            let preUser = await userService.findById(id)
             let r: boolean = await userService.delete(id)
             if (r) {
+                this.onDeleted(request, preUser)
                 reply.send({
                     id: id,
                     message: 'Item deleted successfully',
@@ -267,7 +344,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 })
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -279,11 +356,12 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
             const email = request.body.email
 
-            if(!email || !emailRegex.test(email)){
+            if (!email || !emailRegex.test(email)) {
                 throw new ValidationError([{field: 'email', reason: 'validation.email.invalid'}])
             }
 
             const userService = UserServiceFactory()
+            const user = await userService.findByEmail(email)
             const code = await userService.recoveryCode(email)
 
             console.log("CODE", code)
@@ -292,14 +370,17 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 await UserEmailService.recoveryCode(code, email)
             }
 
+            const detail = `User ${user?.username} request a password recovery .`;
+            this.onUserEvent(request, 'passwordRecoveryRequest', user?._id, detail)
+
             reply.send({message})
 
         } catch (e) {
             console.error("ERROR RECOVERY", e)
-            if(e instanceof SecuritySensitiveError){
+            if (e instanceof SecuritySensitiveError) {
                 reply.send({message})
-            }else{
-                this.handleError(e,reply)
+            } else {
+                this.handleError(e, reply)
             }
         }
     }
@@ -310,25 +391,27 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const recoveryCode = request.body.recoveryCode
             const newPassword = request.body.newPassword
 
-            if(!recoveryCode){
-                throw new ValidationError([{field:'recoveryCode', reason: 'validation.required'}])
+            if (!recoveryCode) {
+                throw new ValidationError([{field: 'recoveryCode', reason: 'validation.required'}])
             }
 
-            if(!newPassword){
-                throw new ValidationError([{field:'newPassword', reason: 'validation.required'}])
+            if (!newPassword) {
+                throw new ValidationError([{field: 'newPassword', reason: 'validation.required'}])
             }
 
             const userService = UserServiceFactory()
-            const result: boolean = await userService.changeUserPasswordByCode(recoveryCode, newPassword)
-            if(result){
+            const user: IUser = await userService.changeUserPasswordByCode(recoveryCode, newPassword)
+            if (user) {
+                const detail = `User ${user?.username} complete a password recovery .`;
+                this.onUserEvent(request, 'passwordRecoveryCompleted', user?._id, detail)
                 reply.send({message: 'action.success'})
-            }else{
+            } else {
                 reply.statusCode = 400
                 reply.send({message: 'action.failure'})
             }
 
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -342,10 +425,12 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const currentPassword = request.body.currentPassword
             const newPassword = request.body.newPassword
             const userService = UserServiceFactory()
-            await userService.changeOwnPassword(userId, currentPassword, newPassword)
+            const user = await userService.changeOwnPassword(userId, currentPassword, newPassword)
+            const detail = `User ${user?.username} changed his password.`;
+            this.onUserEvent(request, 'changeMyPassword', user?._id, detail)
             return {message: 'Password updated successfully'}
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -358,10 +443,12 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             }
             const newPassword = request.body.newPassword
             const userService = UserServiceFactory()
-            await userService.changeUserPassword(userId, newPassword)
+            const user = await userService.changeUserPassword(userId, newPassword)
+            const detail = `User ${request.rbac.username} changed password for user ${user.username}.`;
+            this.onUserEvent(request, 'changePassword', user?._id, detail)
             return {message: 'Password updated successfully'}
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -385,7 +472,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
             //Save into DB
             const userService = UserServiceFactory()
-            await userService.changeAvatar(userId, urlFile)
+            const user = await userService.changeAvatar(userId, urlFile)
+
+            const detail = `User ${request.rbac.username} changed avatar.`
+            this.onUserEvent(request, 'changeAvatar', user?._id, detail)
 
             return {
                 filename: storedFile.filename,
@@ -394,7 +484,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 url: urlFile,
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
 
     }
@@ -407,7 +497,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             //console.log("FILE_DIR: ",fileDir, " FILENAME:", filename)
             return reply.sendFile(filename, fileDir)
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
 
     }

package/src/graphql/resolvers/user.resolvers.ts

@@ -5,7 +5,7 @@ import {
     ValidationError,
     StoreManager,
     DraxConfig,
-    CommonConfig
+    CommonConfig, BadRequestError
 } from "@drax/common-back";
 import {UnauthorizedError} from "@drax/common-back";
 import BadCredentialsError from "../../errors/BadCredentialsError.js";
@@ -13,6 +13,7 @@ import {join} from "path";
 import IdentityConfig from "../../config/IdentityConfig.js";
 import {IDraxPaginateOptions} from "@drax/crud-share";
 import UserPermissions from "../../permissions/UserPermissions.js";
+import TenantServiceFactory from "../../factory/TenantServiceFactory.js";
 
 export default {
     Query: {
@@ -88,8 +89,14 @@ export default {
                 rbac.assertPermission(UserPermissions.SwitchTenant)
                 if (authUser && token) {
                     const tenantId = input.tenantId
+                    const tenant = await TenantServiceFactory().findById(tenantId);
+
+                    if(!tenant){
+                        throw new BadRequestError('Invalid tenantId')
+                    }
+                    const tenantName = tenant?.name;
                     const userService = UserServiceFactory()
-                    let {accessToken} = await userService.switchTenant(token, tenantId)
+                    let {accessToken} = await userService.switchTenant(token, tenantId, tenantName)
                     return {accessToken}
                 } else {
                     throw new UnauthorizedError()

package/src/rbac/Rbac.ts

@@ -29,39 +29,39 @@ class Rbac implements IRbac{
     }
 
     get username(): string{
-        return this.authUser.username
+        return this?.authUser?.username
     }
 
     get userId(): string  {
-        return this.authUser?.id.toString()
+        return this?.authUser?.id.toString()
     }
 
     get session(): string  {
-        return this.authUser?.session
+        return this?.authUser?.session
     }
 
     get apiKeyId(): string  {
-        return this.authUser?.apiKeyId?.toString()
+        return this?.authUser?.apiKeyId?.toString()
     }
 
     get apiKeyName(): string  {
-        return this.authUser?.apiKeyName
+        return this?.authUser?.apiKeyName
     }
 
     get roleId(): string  {
-        return this.authUser?.roleId?.toString()
+        return this?.authUser?.roleId?.toString()
     }
 
     get roleName(): string  {
-        return this.authUser?.roleName
+        return this?.authUser?.roleName
     }
 
     get tenantId(): string | undefined  {
-        return this.authUser?.tenantId?.toString();
+        return this?.authUser?.tenantId?.toString();
     }
 
     get tenantName(): string | undefined  {
-        return this.authUser?.tenantName;
+        return this?.authUser?.tenantName  ?? undefined;
     }
 
     assertAuthenticated() {

package/src/services/UserService.ts

@@ -40,7 +40,8 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
             }
 
             const accessToken = AuthUtils.generateToken(tokenPayload)
-            return {accessToken: accessToken}
+            delete user.password
+            return {accessToken: accessToken, user: user, session: sessionUUID}
         } else {
             const userLoginFailService = UserLoginFailServiceFactory()
             await userLoginFailService.create({
@@ -64,8 +65,8 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
         return sessionUUID;
     }
 
-    async switchTenant(accessToken: string, tenantId: string) {
-        const newAccessToken = AuthUtils.switchTenant(accessToken, tenantId)
+    async switchTenant(accessToken: string, tenantId: string, tenantName: string) {
+        const newAccessToken = AuthUtils.switchTenant(accessToken, tenantId, tenantName)
         return {accessToken: newAccessToken}
     }
 
@@ -102,19 +103,20 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
     }
 
 
-    async changeUserPassword(userId: string, newPassword: string) {
+    async changeUserPassword(userId: string, newPassword: string):Promise<IUser> {
         const user = await this._repository.findByIdWithPassword(userId)
         if (user) {
             newPassword = AuthUtils.hashPassword(newPassword)
             await this._repository.changePassword(userId, newPassword)
-            return true
+            delete user.password
+            return user
         } else {
             throw new ValidationError([{field: 'userId', reason: 'validation.notFound'}])
         }
     }
 
 
-    async changeOwnPassword(userId: string, currentPassword: string, newPassword: string) {
+    async changeOwnPassword(userId: string, currentPassword: string, newPassword: string): Promise<IUser> {
         const user = await this._repository.findByIdWithPassword(userId)
         if (user && user.active) {
 
@@ -125,7 +127,8 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
             if (AuthUtils.checkPassword(currentPassword, user.password)) {
                 newPassword = AuthUtils.hashPassword(newPassword)
                 await this._repository.changePassword(userId, newPassword)
-                return true
+                delete user.password
+                return user
             } else {
                 throw new ValidationError([{field: 'currentPassword', reason: 'validation.notMatch'}])
             }
@@ -135,11 +138,11 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
         }
     }
 
-    async changeAvatar(userId: string, avatar: string) {
+    async changeAvatar(userId: string, avatar: string):Promise<IUser> {
         const user = await this.findById(userId)
         if (user && user.active) {
             await this._repository.changeAvatar(userId, avatar)
-            return true
+            return user
         } else {
             throw new BadCredentialsError()
         }
@@ -161,16 +164,14 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
         }
     }
 
-    async changeUserPasswordByCode(recoveryCode: string, newPassword: string): Promise<boolean> {
+    async changeUserPasswordByCode(recoveryCode: string, newPassword: string): Promise<IUser> {
         try {
-            console.log("changeUserPasswordByCode recoveryCode", recoveryCode)
             const user = await this._repository.findByRecoveryCode(recoveryCode)
-            console.log("changeUserPasswordByCode user", user)
             if (user && user.active) {
                 newPassword = AuthUtils.hashPassword(newPassword)
                 await this._repository.changePassword(user._id, newPassword)
                 await this._repository.updatePartial(user._id, {recoveryCode: null})
-                return true
+                return user
             } else {
                 throw new ValidationError([{field:'recoveryCode', reason: 'validation.notFound'}])
             }

package/src/utils/AuthUtils.ts

@@ -6,6 +6,7 @@ import crypto from "crypto";
 import type {IAuthUser} from "@drax/identity-share";
 import {TokenPayloadSchema} from "../schemas/TokenPayloadSchema.js";
 
+
 class AuthUtils{
 
     static verifyToken(token : string): IAuthUser {
@@ -74,7 +75,7 @@ class AuthUtils{
         return hmac.digest('hex');
     }
 
-    static switchTenant(accessToken: string, newTenantId: string): string {
+     static switchTenant(accessToken: string, newTenantId: string, tenantName: string): string {
         // Verificar que el token actual sea válido
         const tokenPayload = AuthUtils.verifyToken(accessToken) as IAuthUser & { exp?: number };
 
@@ -83,19 +84,16 @@ class AuthUtils{
         }
 
         tokenPayload.tenantId = newTenantId;
+        tokenPayload.tenantName = tenantName;
+
 
         const JWT_SECRET = DraxConfig.getOrLoad(IdentityConfig.JwtSecret);
         if (!JWT_SECRET) {
             throw new Error("JWT_SECRET ENV must be provided");
         }
 
-        const JWT_ISSUER = DraxConfig.getOrLoad(IdentityConfig.JwtIssuer) || 'DRAX';
-
         const options: SignOptions = {
-            jwtid: tokenPayload.id,
-            algorithm: 'HS256',
-            audience: tokenPayload.username,
-            issuer: JWT_ISSUER
+            algorithm: 'HS256'
         };
 
         return jsonwebtoken.sign(tokenPayload, JWT_SECRET, options);