@drax/identity-back 0.39.0 → 0.40.0

package/dist/controllers/UserController.js

@@ -19,6 +19,38 @@ class UserController extends AbstractFastifyController {
         this.tenantFilter = true;
         this.entityName = 'User';
     }
+    async onUserLoggedIn(request, user, session) {
+        const eventData = {
+            action: 'loggedIn',
+            entity: this.entityName,
+            resourceId: user._id.toString(),
+            postItem: null,
+            preItem: null,
+            detail: `User ${user.username} logged in.`,
+            timestamp: new Date(),
+            ip: request.ip,
+            userAgent: request.headers['user-agent'],
+            requestId: request.id,
+            user: {
+                id: user._id.toString(),
+                username: user.username,
+                role: {
+                    id: user?.role?._id.toString(),
+                    name: user?.role?.name,
+                },
+                tenant: {
+                    id: user?.tenant?._id.toString(),
+                    name: user?.tenant?.name,
+                },
+                apiKey: {
+                    id: null,
+                    name: null,
+                },
+                session: session,
+            }
+        };
+        this.eventEmitter.emitCrudEvent(eventData);
+    }
     async auth(request, reply) {
         try {
             const username = request.body.username;
@@ -26,7 +58,9 @@ class UserController extends AbstractFastifyController {
             const userAgent = request.headers['user-agent'];
             const ip = request.ip;
             const userService = UserServiceFactory();
-            return await userService.auth(username, password, { userAgent, ip });
+            const { user, accessToken, session } = await userService.auth(username, password, { userAgent, ip });
+            this.onUserLoggedIn(request, user, session);
+            return { accessToken };
         }
         catch (e) {
             console.error('/api/auth error', e);
@@ -92,7 +126,8 @@ class UserController extends AbstractFastifyController {
                 const tenantName = tenant?.name;
                 const userService = UserServiceFactory();
                 let { accessToken } = await userService.switchTenant(request.token, tenantId, tenantName);
-                const detail = `Switched to tenant "${tenantName}" (ID: ${tenantId})`;
+                const username = request.rbac.username;
+                const detail = `User ${username} switched to tenant "${tenantName}" (ID: ${tenantId})`;
                 this.onUserEvent(request, 'switchTenant', request.rbac.userId, detail);
                 return { accessToken };
             }

package/dist/rbac/Rbac.js

@@ -21,31 +21,31 @@ class Rbac {
         };
     }
     get username() {
-        return this.authUser.username;
+        return this?.authUser?.username;
     }
     get userId() {
-        return this.authUser?.id.toString();
+        return this?.authUser?.id.toString();
     }
     get session() {
-        return this.authUser?.session;
+        return this?.authUser?.session;
     }
     get apiKeyId() {
-        return this.authUser?.apiKeyId?.toString();
+        return this?.authUser?.apiKeyId?.toString();
     }
     get apiKeyName() {
-        return this.authUser?.apiKeyName;
+        return this?.authUser?.apiKeyName;
     }
     get roleId() {
-        return this.authUser?.roleId?.toString();
+        return this?.authUser?.roleId?.toString();
     }
     get roleName() {
-        return this.authUser?.roleName;
+        return this?.authUser?.roleName;
     }
     get tenantId() {
-        return this.authUser?.tenantId?.toString();
+        return this?.authUser?.tenantId?.toString();
     }
     get tenantName() {
-        return this.authUser?.tenantName ?? undefined;
+        return this?.authUser?.tenantName ?? undefined;
     }
     assertAuthenticated() {
         if (!this.authUser) {

package/dist/services/UserService.js

@@ -28,7 +28,8 @@ class UserService extends AbstractService {
                 session: sessionUUID
             };
             const accessToken = AuthUtils.generateToken(tokenPayload);
-            return { accessToken: accessToken };
+            delete user.password;
+            return { accessToken: accessToken, user: user, session: sessionUUID };
         }
         else {
             const userLoginFailService = UserLoginFailServiceFactory();

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "Identity module for user management, authentication and authorization.",
   "main": "dist/index.js",
   "types": "types/index.d.ts",
@@ -28,11 +28,11 @@
   "author": "Cristian Incarnato & Drax Team",
   "license": "ISC",
   "dependencies": {
-    "@drax/common-back": "^0.39.0",
-    "@drax/crud-back": "^0.39.0",
-    "@drax/crud-share": "^0.39.0",
-    "@drax/email-back": "^0.39.0",
-    "@drax/identity-share": "^0.39.0",
+    "@drax/common-back": "^0.40.0",
+    "@drax/crud-back": "^0.40.0",
+    "@drax/crud-share": "^0.40.0",
+    "@drax/email-back": "^0.40.0",
+    "@drax/identity-share": "^0.40.0",
     "bcryptjs": "^2.4.3",
     "graphql": "^16.8.2",
     "jsonwebtoken": "^9.0.2"
@@ -63,5 +63,5 @@
       "debug": "0"
     }
   },
-  "gitHead": "b019c40f954cf60e4ff61c53e27d5bafaea6f16c"
+  "gitHead": "269ec7921d83364dfba091cd74bd3f45a8135c26"
 }

package/src/controllers/UserController.ts

@@ -37,6 +37,39 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
         this.entityName = 'User'
     }
 
+    async onUserLoggedIn(request: CustomRequest, user: IUser, session: string) {
+        const eventData: IDraxCrudEvent = {
+            action: 'loggedIn',
+            entity: this.entityName,
+            resourceId: user._id.toString(),
+            postItem: null,
+            preItem: null,
+            detail: `User ${user.username} logged in.`,
+            timestamp: new Date(),
+            ip: request.ip,
+            userAgent: request.headers['user-agent'],
+            requestId: request.id,
+            user: {
+                id: user._id.toString(),
+                username: user.username,
+                role:{
+                    id: user?.role?._id.toString(),
+                    name: user?.role?.name,
+                },
+                tenant: {
+                    id: user?.tenant?._id.toString(),
+                    name: user?.tenant?.name,
+                },
+                apiKey: {
+                    id: null,
+                    name: null,
+                },
+                session: session,
+            }
+        }
+        this.eventEmitter.emitCrudEvent(eventData)
+    }
+
     async auth(request, reply) {
         try {
             const username = request.body.username
@@ -44,8 +77,9 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userAgent = request.headers['user-agent'];
             const ip = request.ip;
             const userService = UserServiceFactory()
-
-            return await userService.auth(username, password,{userAgent, ip})
+            const {user, accessToken, session} = await userService.auth(username, password, {userAgent, ip})
+            this.onUserLoggedIn(request, user, session)
+            return {accessToken}
         } catch (e) {
             console.error('/api/auth error', e)
             if (e instanceof BadCredentialsError) {
@@ -66,10 +100,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 delete user.password
 
                 //handle SwitchTenant setted in accessToken
-                if(request.authUser.tenantId != user?.tenant?._id){
+                if (request.authUser.tenantId != user?.tenant?._id) {
                     const tenantService = TenantServiceFactory()
                     const tenant = await tenantService.findById(request.authUser.tenantId)
-                    if(tenant){
+                    if (tenant) {
                         user.tenant = tenant
                     }
                 }
@@ -81,13 +115,13 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
     async onUserEvent(request: CustomRequest, action: string, resourceId: string = null, detail: string = null) {
         const requestData = this.extractRequestData(request)
-        const eventData : IDraxCrudEvent = {
+        const eventData: IDraxCrudEvent = {
             action: action,
             entity: this.entityName,
             resourceId: resourceId.toString(),
@@ -107,13 +141,13 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
             if (request.authUser && request.token) {
                 const tenantId = request.body.tenantId
-                if(!tenantId){
+                if (!tenantId) {
                     throw new BadRequestError('Missing tenantId')
                 }
 
                 const tenant = await TenantServiceFactory().findById(tenantId);
 
-                if(!tenant){
+                if (!tenant) {
                     throw new BadRequestError('Invalid tenantId')
                 }
 
@@ -121,15 +155,16 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 const userService = UserServiceFactory()
                 let {accessToken} = await userService.switchTenant(request.token, tenantId, tenantName)
 
-                const detail = `Switched to tenant "${tenantName}" (ID: ${tenantId})`;
-                this.onUserEvent(request,'switchTenant',request.rbac.userId, detail)
+                const username = request.rbac.username
+                const detail = `User ${username} switched to tenant "${tenantName}" (ID: ${tenantId})`;
+                this.onUserEvent(request, 'switchTenant', request.rbac.userId, detail)
 
                 return {accessToken}
             } else {
                 throw new UnauthorizedError()
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -153,7 +188,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             }
             return paginateResult
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -169,7 +204,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             let item = await this.service.search(search, 1000, filters)
             return item
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -202,9 +237,9 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userService = UserServiceFactory()
             let user = await userService.register(payload)
 
-            if(user){
+            if (user) {
                 const detail = `User ${user?.username} registered successfully.`;
-                this.onUserEvent(request,'register',user?._id, detail)
+                this.onUserEvent(request, 'register', user?._id, detail)
 
                 //SEND EMAIL FOR EMAIL VERIFICATION
                 await UserEmailService.emailVerifyCode(user.emailCode, user.email)
@@ -217,7 +252,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
 
 
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -226,12 +261,12 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const emailCode = request.params.code
             const userService = UserServiceFactory()
             const r = await userService.verifyEmail(emailCode)
-            if(r){
+            if (r) {
                 const html = RegistrationCompleteHtml
                 reply.header('Content-Type', 'text/html; charset=utf-8').send(html)
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -241,7 +276,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userService = UserServiceFactory()
             return await userService.verifyPhone(phoneCode)
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -261,7 +296,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             this.onCreated(request, user)
             return user
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -281,7 +316,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             this.onUpdated(request, preUser, user)
             return user
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -309,7 +344,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 })
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -321,7 +356,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
             const email = request.body.email
 
-            if(!email || !emailRegex.test(email)){
+            if (!email || !emailRegex.test(email)) {
                 throw new ValidationError([{field: 'email', reason: 'validation.email.invalid'}])
             }
 
@@ -336,16 +371,16 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             }
 
             const detail = `User ${user?.username} request a password recovery .`;
-            this.onUserEvent(request,'passwordRecoveryRequest',user?._id, detail)
+            this.onUserEvent(request, 'passwordRecoveryRequest', user?._id, detail)
 
             reply.send({message})
 
         } catch (e) {
             console.error("ERROR RECOVERY", e)
-            if(e instanceof SecuritySensitiveError){
+            if (e instanceof SecuritySensitiveError) {
                 reply.send({message})
-            }else{
-                this.handleError(e,reply)
+            } else {
+                this.handleError(e, reply)
             }
         }
     }
@@ -356,27 +391,27 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const recoveryCode = request.body.recoveryCode
             const newPassword = request.body.newPassword
 
-            if(!recoveryCode){
-                throw new ValidationError([{field:'recoveryCode', reason: 'validation.required'}])
+            if (!recoveryCode) {
+                throw new ValidationError([{field: 'recoveryCode', reason: 'validation.required'}])
             }
 
-            if(!newPassword){
-                throw new ValidationError([{field:'newPassword', reason: 'validation.required'}])
+            if (!newPassword) {
+                throw new ValidationError([{field: 'newPassword', reason: 'validation.required'}])
             }
 
             const userService = UserServiceFactory()
             const user: IUser = await userService.changeUserPasswordByCode(recoveryCode, newPassword)
-            if(user){
+            if (user) {
                 const detail = `User ${user?.username} complete a password recovery .`;
-                this.onUserEvent(request,'passwordRecoveryCompleted',user?._id, detail)
+                this.onUserEvent(request, 'passwordRecoveryCompleted', user?._id, detail)
                 reply.send({message: 'action.success'})
-            }else{
+            } else {
                 reply.statusCode = 400
                 reply.send({message: 'action.failure'})
             }
 
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -392,10 +427,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userService = UserServiceFactory()
             const user = await userService.changeOwnPassword(userId, currentPassword, newPassword)
             const detail = `User ${user?.username} changed his password.`;
-            this.onUserEvent(request,'changeMyPassword',user?._id, detail)
+            this.onUserEvent(request, 'changeMyPassword', user?._id, detail)
             return {message: 'Password updated successfully'}
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -410,10 +445,10 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const userService = UserServiceFactory()
             const user = await userService.changeUserPassword(userId, newPassword)
             const detail = `User ${request.rbac.username} changed password for user ${user.username}.`;
-            this.onUserEvent(request,'changePassword',user?._id, detail)
+            this.onUserEvent(request, 'changePassword', user?._id, detail)
             return {message: 'Password updated successfully'}
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
     }
 
@@ -440,7 +475,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             const user = await userService.changeAvatar(userId, urlFile)
 
             const detail = `User ${request.rbac.username} changed avatar.`
-            this.onUserEvent(request,'changeAvatar',user?._id, detail)
+            this.onUserEvent(request, 'changeAvatar', user?._id, detail)
 
             return {
                 filename: storedFile.filename,
@@ -449,7 +484,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
                 url: urlFile,
             }
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
 
     }
@@ -462,7 +497,7 @@ class UserController extends AbstractFastifyController<IUser, IUserCreate, IUser
             //console.log("FILE_DIR: ",fileDir, " FILENAME:", filename)
             return reply.sendFile(filename, fileDir)
         } catch (e) {
-            this.handleError(e,reply)
+            this.handleError(e, reply)
         }
 
     }

package/src/rbac/Rbac.ts

@@ -29,39 +29,39 @@ class Rbac implements IRbac{
     }
 
     get username(): string{
-        return this.authUser.username
+        return this?.authUser?.username
     }
 
     get userId(): string  {
-        return this.authUser?.id.toString()
+        return this?.authUser?.id.toString()
     }
 
     get session(): string  {
-        return this.authUser?.session
+        return this?.authUser?.session
     }
 
     get apiKeyId(): string  {
-        return this.authUser?.apiKeyId?.toString()
+        return this?.authUser?.apiKeyId?.toString()
     }
 
     get apiKeyName(): string  {
-        return this.authUser?.apiKeyName
+        return this?.authUser?.apiKeyName
     }
 
     get roleId(): string  {
-        return this.authUser?.roleId?.toString()
+        return this?.authUser?.roleId?.toString()
     }
 
     get roleName(): string  {
-        return this.authUser?.roleName
+        return this?.authUser?.roleName
     }
 
     get tenantId(): string | undefined  {
-        return this.authUser?.tenantId?.toString();
+        return this?.authUser?.tenantId?.toString();
     }
 
     get tenantName(): string | undefined  {
-        return this.authUser?.tenantName  ?? undefined;
+        return this?.authUser?.tenantName  ?? undefined;
     }
 
     assertAuthenticated() {

package/src/services/UserService.ts

@@ -40,7 +40,8 @@ class UserService extends AbstractService<IUser, IUserCreate, IUserUpdate> {
             }
 
             const accessToken = AuthUtils.generateToken(tokenPayload)
-            return {accessToken: accessToken}
+            delete user.password
+            return {accessToken: accessToken, user: user, session: sessionUUID}
         } else {
             const userLoginFailService = UserLoginFailServiceFactory()
             await userLoginFailService.create({