@eaccess/auth 0.1.1 → 0.1.3

package/dist/index.cjs

@@ -64,82 +64,25 @@ __export(index_exports, {
   UserInactiveError: () => UserInactiveError,
   UserNotFoundError: () => UserNotFoundError,
   UserNotLoggedInError: () => UserNotLoggedInError,
+  addRoleToUser: () => addRoleToUser,
   cleanupExpiredTokens: () => cleanupExpiredTokens,
   createAuthMiddleware: () => createAuthMiddleware,
   createAuthTables: () => createAuthTables,
+  createUser: () => createUser,
   dropAuthTables: () => dropAuthTables,
   getAuthTableStats: () => getAuthTableStats,
+  getUserRoles: () => getUserRoles,
   isValidEmail: () => isValidEmail,
+  removeRoleFromUser: () => removeRoleFromUser,
+  setUserRoles: () => setUserRoles,
   validateEmail: () => validateEmail
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/auth-admin-manager.ts
-var import_hash = require("@prsm/hash");
+var import_hash2 = require("@prsm/hash");
 var import_ms = __toESM(require("@prsm/ms"), 1);
 
-// src/types.ts
-var import_express_session = require("express-session");
-var TwoFactorMechanism = /* @__PURE__ */ ((TwoFactorMechanism2) => {
-  TwoFactorMechanism2[TwoFactorMechanism2["TOTP"] = 1] = "TOTP";
-  TwoFactorMechanism2[TwoFactorMechanism2["EMAIL"] = 2] = "EMAIL";
-  TwoFactorMechanism2[TwoFactorMechanism2["SMS"] = 3] = "SMS";
-  return TwoFactorMechanism2;
-})(TwoFactorMechanism || {});
-var AuthStatus = {
-  Normal: 0,
-  Archived: 1,
-  Banned: 2,
-  Locked: 3,
-  PendingReview: 4,
-  Suspended: 5
-};
-var AuthRole = {
-  Admin: 1,
-  Author: 2,
-  Collaborator: 4,
-  Consultant: 8,
-  Consumer: 16,
-  Contributor: 32,
-  Coordinator: 64,
-  Creator: 128,
-  Developer: 256,
-  Director: 512,
-  Editor: 1024,
-  Employee: 2048,
-  Maintainer: 4096,
-  Manager: 8192,
-  Moderator: 16384,
-  Publisher: 32768,
-  Reviewer: 65536,
-  Subscriber: 131072,
-  SuperAdmin: 262144,
-  SuperEditor: 524288,
-  SuperModerator: 1048576,
-  Translator: 2097152
-};
-var AuthActivityAction = {
-  Login: "login",
-  Logout: "logout",
-  FailedLogin: "failed_login",
-  Register: "register",
-  EmailConfirmed: "email_confirmed",
-  PasswordResetRequested: "password_reset_requested",
-  PasswordResetCompleted: "password_reset_completed",
-  PasswordChanged: "password_changed",
-  EmailChanged: "email_changed",
-  RoleChanged: "role_changed",
-  StatusChanged: "status_changed",
-  ForceLogout: "force_logout",
-  OAuthConnected: "oauth_connected",
-  RememberTokenCreated: "remember_token_created",
-  TwoFactorSetup: "two_factor_setup",
-  TwoFactorVerified: "two_factor_verified",
-  TwoFactorFailed: "two_factor_failed",
-  TwoFactorDisabled: "two_factor_disabled",
-  BackupCodeUsed: "backup_code_used"
-};
-
 // src/queries.ts
 var AuthQueries = class {
   constructor(config) {
@@ -516,6 +459,9 @@ var TwoFactorSetupIncompleteError = class extends AuthError {
   }
 };
 
+// src/create-user.ts
+var import_hash = require("@prsm/hash");
+
 // src/util.ts
 var isValidEmail = (email) => {
   const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -534,6 +480,123 @@ var validateEmail = (email) => {
 };
 var createMapFromEnum = (enumObj) => Object.fromEntries(Object.entries(enumObj).map(([key, value]) => [value, key]));
 
+// src/types.ts
+var import_express_session = require("express-session");
+var TwoFactorMechanism = /* @__PURE__ */ ((TwoFactorMechanism2) => {
+  TwoFactorMechanism2[TwoFactorMechanism2["TOTP"] = 1] = "TOTP";
+  TwoFactorMechanism2[TwoFactorMechanism2["EMAIL"] = 2] = "EMAIL";
+  TwoFactorMechanism2[TwoFactorMechanism2["SMS"] = 3] = "SMS";
+  return TwoFactorMechanism2;
+})(TwoFactorMechanism || {});
+var AuthStatus = {
+  Normal: 0,
+  Archived: 1,
+  Banned: 2,
+  Locked: 3,
+  PendingReview: 4,
+  Suspended: 5
+};
+var AuthRole = {
+  Admin: 1,
+  Author: 2,
+  Collaborator: 4,
+  Consultant: 8,
+  Consumer: 16,
+  Contributor: 32,
+  Coordinator: 64,
+  Creator: 128,
+  Developer: 256,
+  Director: 512,
+  Editor: 1024,
+  Employee: 2048,
+  Maintainer: 4096,
+  Manager: 8192,
+  Moderator: 16384,
+  Publisher: 32768,
+  Reviewer: 65536,
+  Subscriber: 131072,
+  SuperAdmin: 262144,
+  SuperEditor: 524288,
+  SuperModerator: 1048576,
+  Translator: 2097152
+};
+var AuthActivityAction = {
+  Login: "login",
+  Logout: "logout",
+  FailedLogin: "failed_login",
+  Register: "register",
+  EmailConfirmed: "email_confirmed",
+  PasswordResetRequested: "password_reset_requested",
+  PasswordResetCompleted: "password_reset_completed",
+  PasswordChanged: "password_changed",
+  EmailChanged: "email_changed",
+  RoleChanged: "role_changed",
+  StatusChanged: "status_changed",
+  ForceLogout: "force_logout",
+  OAuthConnected: "oauth_connected",
+  RememberTokenCreated: "remember_token_created",
+  TwoFactorSetup: "two_factor_setup",
+  TwoFactorVerified: "two_factor_verified",
+  TwoFactorFailed: "two_factor_failed",
+  TwoFactorDisabled: "two_factor_disabled",
+  BackupCodeUsed: "backup_code_used"
+};
+
+// src/create-user.ts
+function validatePassword(password, config) {
+  const minLength = config.minPasswordLength || 8;
+  const maxLength = config.maxPasswordLength || 64;
+  if (typeof password !== "string") {
+    throw new InvalidPasswordError();
+  }
+  if (password.length < minLength) {
+    throw new InvalidPasswordError();
+  }
+  if (password.length > maxLength) {
+    throw new InvalidPasswordError();
+  }
+}
+function generateAutoUserId() {
+  return crypto.randomUUID();
+}
+async function createConfirmationToken(queries, account, email, callback) {
+  const token = import_hash.hash.encode(email);
+  const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
+  await queries.createConfirmation({
+    accountId: account.id,
+    token,
+    email,
+    expires
+  });
+  if (callback) {
+    callback(token);
+  }
+}
+async function createUser(config, credentials, userId, callback) {
+  validateEmail(credentials.email);
+  validatePassword(credentials.password, config);
+  const queries = new AuthQueries(config);
+  const existing = await queries.findAccountByEmail(credentials.email);
+  if (existing) {
+    throw new EmailTakenError();
+  }
+  const finalUserId = userId || generateAutoUserId();
+  const hashedPassword = import_hash.hash.encode(credentials.password);
+  const verified = typeof callback !== "function";
+  const account = await queries.createAccount({
+    userId: finalUserId,
+    email: credentials.email,
+    password: hashedPassword,
+    verified,
+    status: AuthStatus.Normal,
+    rolemask: 0
+  });
+  if (!verified && callback) {
+    await createConfirmationToken(queries, account, credentials.email, callback);
+  }
+  return account;
+}
+
 // src/auth-admin-manager.ts
 var AuthAdminManager = class {
   constructor(req, res, config, auth) {
@@ -556,9 +619,6 @@ var AuthAdminManager = class {
       throw new InvalidPasswordError();
     }
   }
-  generateAutoUserId() {
-    return crypto.randomUUID();
-  }
   async findAccountByIdentifier(identifier) {
     if (identifier.accountId !== void 0) {
       return await this.queries.findAccountById(identifier.accountId);
@@ -570,7 +630,7 @@ var AuthAdminManager = class {
     return null;
   }
   async createConfirmationToken(account, email, callback) {
-    const token = import_hash.hash.encode(email);
+    const token = import_hash2.hash.encode(email);
     const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
     await this.queries.createConfirmation({
       accountId: account.id,
@@ -593,27 +653,7 @@ var AuthAdminManager = class {
    * @throws {InvalidPasswordError} Password doesn't meet length requirements
    */
   async createUser(credentials, userId, callback) {
-    validateEmail(credentials.email);
-    this.validatePassword(credentials.password);
-    const existing = await this.queries.findAccountByEmail(credentials.email);
-    if (existing) {
-      throw new EmailTakenError();
-    }
-    const finalUserId = userId || this.generateAutoUserId();
-    const hashedPassword = import_hash.hash.encode(credentials.password);
-    const verified = typeof callback !== "function";
-    const account = await this.queries.createAccount({
-      userId: finalUserId,
-      email: credentials.email,
-      password: hashedPassword,
-      verified,
-      status: AuthStatus.Normal,
-      rolemask: 0
-    });
-    if (!verified && callback) {
-      await this.createConfirmationToken(account, credentials.email, callback);
-    }
-    return account;
+    return createUser(this.config, credentials, userId, callback);
   }
   /**
    * Log in as another user (admin function).
@@ -706,7 +746,7 @@ var AuthAdminManager = class {
       throw new UserNotFoundError();
     }
     await this.queries.updateAccount(account.id, {
-      password: import_hash.hash.encode(password)
+      password: import_hash2.hash.encode(password)
     });
   }
   /**
@@ -742,7 +782,7 @@ var AuthAdminManager = class {
       throw new EmailNotVerifiedError();
     }
     const expiry = !expiresAfter ? (0, import_ms.default)("6h") : (0, import_ms.default)(expiresAfter);
-    const token = import_hash.hash.encode(account.email);
+    const token = import_hash2.hash.encode(account.email);
     const expires = new Date(Date.now() + expiry);
     await this.queries.createResetToken({
       accountId: account.id,
@@ -774,7 +814,7 @@ var AuthAdminManager = class {
 };
 
 // src/auth-manager.ts
-var import_hash4 = require("@prsm/hash");
+var import_hash5 = require("@prsm/hash");
 var import_ms3 = __toESM(require("@prsm/ms"), 1);
 
 // src/activity-logger.ts
@@ -1172,7 +1212,7 @@ var AzureProvider = class extends BaseOAuthProvider {
 
 // src/two-factor/totp-provider.ts
 var import_totp = __toESM(require("@eaccess/totp"), 1);
-var import_hash2 = require("@prsm/hash");
+var import_hash3 = require("@prsm/hash");
 var TotpProvider = class {
   constructor(config) {
     this.config = config;
@@ -1201,11 +1241,11 @@ var TotpProvider = class {
     return codes;
   }
   hashBackupCodes(codes) {
-    return codes.map((code) => import_hash2.hash.encode(code));
+    return codes.map((code) => import_hash3.hash.encode(code));
   }
   verifyBackupCode(hashedCodes, inputCode) {
     for (let i = 0; i < hashedCodes.length; i++) {
-      if (import_hash2.hash.verify(hashedCodes[i], inputCode.toUpperCase())) {
+      if (import_hash3.hash.verify(hashedCodes[i], inputCode.toUpperCase())) {
         return { isValid: true, index: i };
       }
     }
@@ -1222,7 +1262,7 @@ var TotpProvider = class {
 
 // src/two-factor/otp-provider.ts
 var import_ms2 = __toESM(require("@prsm/ms"), 1);
-var import_hash3 = require("@prsm/hash");
+var import_hash4 = require("@prsm/hash");
 var OtpProvider = class {
   constructor(config) {
     this.config = config;
@@ -1247,7 +1287,7 @@ var OtpProvider = class {
   async createAndStoreOTP(accountId, mechanism) {
     const otp = this.generateOTP();
     const selector = this.generateSelector();
-    const tokenHash = import_hash3.hash.encode(otp);
+    const tokenHash = import_hash4.hash.encode(otp);
     const expiryDuration = this.config.twoFactor?.tokenExpiry || "5m";
     const expiresAt = new Date(Date.now() + (0, import_ms2.default)(expiryDuration));
     await this.queries.deleteTwoFactorTokensByAccountAndMechanism(accountId, mechanism);
@@ -1269,7 +1309,7 @@ var OtpProvider = class {
       await this.queries.deleteTwoFactorToken(token.id);
       return { isValid: false };
     }
-    const isValid = import_hash3.hash.verify(token.token_hash, inputCode);
+    const isValid = import_hash4.hash.verify(token.token_hash, inputCode);
     if (isValid) {
       await this.queries.deleteTwoFactorToken(token.id);
       return { isValid: true, token };
@@ -1858,7 +1898,7 @@ var AuthManager = class {
     });
   }
   async createRememberDirective(account) {
-    const token = import_hash4.hash.encode(account.email);
+    const token = import_hash5.hash.encode(account.email);
     const duration = this.config.rememberDuration || "30d";
     const expires = new Date(Date.now() + (0, import_ms3.default)(duration));
     await this.queries.createRememberToken({
@@ -1896,7 +1936,7 @@ var AuthManager = class {
         await this.activityLogger.logActivity(null, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "account_not_found" });
         throw new UserNotFoundError();
       }
-      if (!account.password || !import_hash4.hash.verify(account.password, password)) {
+      if (!account.password || !import_hash5.hash.verify(account.password, password)) {
         await this.activityLogger.logActivity(account.id, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "invalid_password" });
         throw new InvalidPasswordError();
       }
@@ -2008,7 +2048,7 @@ var AuthManager = class {
       throw new EmailTakenError();
     }
     const finalUserId = userId || this.generateAutoUserId();
-    const hashedPassword = import_hash4.hash.encode(password);
+    const hashedPassword = import_hash5.hash.encode(password);
     const verified = typeof callback !== "function";
     const account = await this.queries.createAccount({
       userId: finalUserId,
@@ -2025,7 +2065,7 @@ var AuthManager = class {
     return account;
   }
   async createConfirmationToken(account, email, callback) {
-    const token = import_hash4.hash.encode(email);
+    const token = import_hash5.hash.encode(email);
     const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
     await this.queries.createConfirmation({
       accountId: account.id,
@@ -2159,7 +2199,7 @@ var AuthManager = class {
     if (new Date(confirmation.expires) < /* @__PURE__ */ new Date()) {
       throw new ConfirmationExpiredError();
     }
-    if (!import_hash4.hash.verify(token, confirmation.email)) {
+    if (!import_hash5.hash.verify(token, confirmation.email)) {
       throw new InvalidTokenError();
     }
     await this.queries.updateAccount(confirmation.account_id, {
@@ -2256,7 +2296,7 @@ var AuthManager = class {
     if (openRequests >= maxRequests) {
       throw new TooManyResetsError();
     }
-    const token = import_hash4.hash.encode(email);
+    const token = import_hash5.hash.encode(email);
     const expires = new Date(Date.now() + expiry);
     await this.queries.createResetToken({
       accountId: account.id,
@@ -2298,11 +2338,11 @@ var AuthManager = class {
       throw new ResetDisabledError();
     }
     this.validatePassword(password);
-    if (!import_hash4.hash.verify(token, account.email)) {
+    if (!import_hash5.hash.verify(token, account.email)) {
       throw new InvalidTokenError();
     }
     await this.queries.updateAccount(account.id, {
-      password: import_hash4.hash.encode(password)
+      password: import_hash5.hash.encode(password)
     });
     if (logout) {
       await this.forceLogoutForAccountById(account.id);
@@ -2330,7 +2370,7 @@ var AuthManager = class {
     if (!account.password) {
       return false;
     }
-    return import_hash4.hash.verify(account.password, password);
+    return import_hash5.hash.verify(account.password, password);
   }
   async forceLogoutForAccountById(accountId) {
     await this.queries.deleteRememberTokensForAccount(accountId);
@@ -2585,6 +2625,44 @@ async function getAuthTableStats(config) {
     expiredTwoFactorTokens: parseInt(expiredTwoFactorTokensResult.rows[0]?.count || "0")
   };
 }
+
+// src/user-roles.ts
+async function findAccountByIdentifier(queries, identifier) {
+  let account = null;
+  if (identifier.accountId !== void 0) {
+    account = await queries.findAccountById(identifier.accountId);
+  } else if (identifier.email !== void 0) {
+    account = await queries.findAccountByEmail(identifier.email);
+  } else if (identifier.userId !== void 0) {
+    account = await queries.findAccountByUserId(identifier.userId);
+  }
+  if (!account) {
+    throw new UserNotFoundError();
+  }
+  return account;
+}
+async function addRoleToUser(config, identifier, role) {
+  const queries = new AuthQueries(config);
+  const account = await findAccountByIdentifier(queries, identifier);
+  const rolemask = account.rolemask | role;
+  await queries.updateAccount(account.id, { rolemask });
+}
+async function removeRoleFromUser(config, identifier, role) {
+  const queries = new AuthQueries(config);
+  const account = await findAccountByIdentifier(queries, identifier);
+  const rolemask = account.rolemask & ~role;
+  await queries.updateAccount(account.id, { rolemask });
+}
+async function setUserRoles(config, identifier, rolemask) {
+  const queries = new AuthQueries(config);
+  const account = await findAccountByIdentifier(queries, identifier);
+  await queries.updateAccount(account.id, { rolemask });
+}
+async function getUserRoles(config, identifier) {
+  const queries = new AuthQueries(config);
+  const account = await findAccountByIdentifier(queries, identifier);
+  return account.rolemask;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ActivityLogger,
@@ -2621,12 +2699,17 @@ async function getAuthTableStats(config) {
   UserInactiveError,
   UserNotFoundError,
   UserNotLoggedInError,
+  addRoleToUser,
   cleanupExpiredTokens,
   createAuthMiddleware,
   createAuthTables,
+  createUser,
   dropAuthTables,
   getAuthTableStats,
+  getUserRoles,
   isValidEmail,
+  removeRoleFromUser,
+  setUserRoles,
   validateEmail
 });
 //# sourceMappingURL=index.cjs.map