@eaccess/auth 0.1.19 → 0.1.21

package/dist/index.d.cts

@@ -1,5 +1,6 @@
 import { Request, Response, NextFunction } from 'express';
 import { Pool } from 'pg';
+import { IncomingMessage } from 'http';
 
 interface OAuthProviderConfig {
     clientId: string;
@@ -55,6 +56,7 @@ interface AuthConfig {
         google?: GoogleProviderConfig;
         azure?: AzureProviderConfig;
     };
+    githubUserAgent?: string;
     twoFactor?: {
         enabled?: boolean;
         requireForOAuth?: boolean;
@@ -118,6 +120,10 @@ interface AuthRemember {
     token: string;
     expires: Date;
 }
+interface AuthenticateRequestResult {
+    account: AuthAccount | null;
+    source: "session" | "remember" | null;
+}
 interface AuthReset {
     id: number;
     account_id: number;
@@ -598,6 +604,7 @@ interface AuthContext {
 }
 declare function createAuthContext(config: AuthConfig): AuthContext;
 
+declare function authenticateRequest(config: AuthConfig, req: IncomingMessage, sessionMiddleware?: (req: any, res: any, next: () => void) => void): Promise<AuthenticateRequestResult>;
 declare function createUser(config: AuthConfig, credentials: {
     email: string;
     password: string;
@@ -653,6 +660,7 @@ declare function forceLogoutForUserBy(config: AuthConfig, identifier: {
 }>;
 
 declare const authFunctions_addRoleForUserBy: typeof addRoleForUserBy;
+declare const authFunctions_authenticateRequest: typeof authenticateRequest;
 declare const authFunctions_changePasswordForUserBy: typeof changePasswordForUserBy;
 declare const authFunctions_confirmResetPassword: typeof confirmResetPassword;
 declare const authFunctions_createUser: typeof createUser;
@@ -666,7 +674,7 @@ declare const authFunctions_resetPassword: typeof resetPassword;
 declare const authFunctions_setStatusForUserBy: typeof setStatusForUserBy;
 declare const authFunctions_userExistsByEmail: typeof userExistsByEmail;
 declare namespace authFunctions {
-  export { authFunctions_addRoleForUserBy as addRoleForUserBy, authFunctions_changePasswordForUserBy as changePasswordForUserBy, authFunctions_confirmResetPassword as confirmResetPassword, authFunctions_createUser as createUser, authFunctions_deleteUserBy as deleteUserBy, authFunctions_forceLogoutForUserBy as forceLogoutForUserBy, authFunctions_hasRoleForUserBy as hasRoleForUserBy, authFunctions_initiatePasswordResetForUserBy as initiatePasswordResetForUserBy, authFunctions_register as register, authFunctions_removeRoleForUserBy as removeRoleForUserBy, authFunctions_resetPassword as resetPassword, authFunctions_setStatusForUserBy as setStatusForUserBy, authFunctions_userExistsByEmail as userExistsByEmail };
+  export { authFunctions_addRoleForUserBy as addRoleForUserBy, authFunctions_authenticateRequest as authenticateRequest, authFunctions_changePasswordForUserBy as changePasswordForUserBy, authFunctions_confirmResetPassword as confirmResetPassword, authFunctions_createUser as createUser, authFunctions_deleteUserBy as deleteUserBy, authFunctions_forceLogoutForUserBy as forceLogoutForUserBy, authFunctions_hasRoleForUserBy as hasRoleForUserBy, authFunctions_initiatePasswordResetForUserBy as initiatePasswordResetForUserBy, authFunctions_register as register, authFunctions_removeRoleForUserBy as removeRoleForUserBy, authFunctions_resetPassword as resetPassword, authFunctions_setStatusForUserBy as setStatusForUserBy, authFunctions_userExistsByEmail as userExistsByEmail };
 }
 
 type UserIdentifier = {
@@ -1167,7 +1175,7 @@ declare abstract class BaseOAuthProvider implements OAuthProvider {
     protected processOAuthLogin(userData: OAuthUserData, req: Request): Promise<OAuthCallbackResult>;
     protected abstract getProviderName(): string;
     protected exchangeCodeForToken(code: string, tokenUrl: string): Promise<string>;
-    protected fetchUserFromAPI(accessToken: string, apiUrl: string): Promise<any>;
+    protected fetchUserFromAPI(accessToken: string, apiUrl: string, headers?: Record<string, string>): Promise<any>;
 }
 
 declare class GitHubProvider extends BaseOAuthProvider {
@@ -1192,4 +1200,4 @@ declare class AzureProvider extends BaseOAuthProvider {
     protected exchangeCodeForToken(code: string, tokenUrl: string): Promise<string>;
 }
 
-export { ActivityLogger, type AuthAccount, type AuthActivity, AuthActivityAction, type AuthActivityActionType, type AuthConfig, type AuthConfirmation, type AuthContext, AuthError, type AuthManager$1 as AuthManager, type AuthProvider, type AuthRemember, type AuthReset, AuthRole, type AuthSession, AuthStatus, AzureProvider, type AzureProviderConfig, BaseOAuthProvider, ConfirmationExpiredError, ConfirmationNotFoundError, EmailNotVerifiedError, EmailTakenError, GitHubProvider, type GitHubProviderConfig, GoogleProvider, type GoogleProviderConfig, InvalidBackupCodeError, InvalidEmailError, InvalidPasswordError, InvalidTokenError, InvalidTwoFactorCodeError, type OAuthCallbackResult, type OAuthProvider, type OAuthProviderConfig, type OAuthUserData, OtpProvider, ResetDisabledError, ResetExpiredError, ResetNotFoundError, SecondFactorRequiredError, type TokenCallback, TooManyResetsError, TotpProvider, TwoFactorAlreadyEnabledError, type TwoFactorChallenge, TwoFactorExpiredError, TwoFactorManager, TwoFactorMechanism, type TwoFactorMethod, TwoFactorNotSetupError, TwoFactorSetupIncompleteError, type TwoFactorSetupResult, type TwoFactorToken, type UserIdentifier, UserInactiveError, UserNotFoundError, UserNotLoggedInError, addRoleForUserBy, addRoleToUser, authFunctions, changePasswordForUserBy, cleanupExpiredTokens, confirmResetPassword, createAuthContext, createAuthMiddleware, createAuthTables, createUser, deleteUserBy, dropAuthTables, forceLogoutForUserBy, getAuthTableStats, getUserRoles, hasRoleForUserBy, initiatePasswordResetForUserBy, isValidEmail, register, removeRoleForUserBy, removeRoleFromUser, resetPassword, setStatusForUserBy, setUserRoles, userExistsByEmail, validateEmail };
+export { ActivityLogger, type AuthAccount, type AuthActivity, AuthActivityAction, type AuthActivityActionType, type AuthConfig, type AuthConfirmation, type AuthContext, AuthError, type AuthManager$1 as AuthManager, type AuthProvider, type AuthRemember, type AuthReset, AuthRole, type AuthSession, AuthStatus, type AuthenticateRequestResult, AzureProvider, type AzureProviderConfig, BaseOAuthProvider, ConfirmationExpiredError, ConfirmationNotFoundError, EmailNotVerifiedError, EmailTakenError, GitHubProvider, type GitHubProviderConfig, GoogleProvider, type GoogleProviderConfig, InvalidBackupCodeError, InvalidEmailError, InvalidPasswordError, InvalidTokenError, InvalidTwoFactorCodeError, type OAuthCallbackResult, type OAuthProvider, type OAuthProviderConfig, type OAuthUserData, OtpProvider, ResetDisabledError, ResetExpiredError, ResetNotFoundError, SecondFactorRequiredError, type TokenCallback, TooManyResetsError, TotpProvider, TwoFactorAlreadyEnabledError, type TwoFactorChallenge, TwoFactorExpiredError, TwoFactorManager, TwoFactorMechanism, type TwoFactorMethod, TwoFactorNotSetupError, TwoFactorSetupIncompleteError, type TwoFactorSetupResult, type TwoFactorToken, type UserIdentifier, UserInactiveError, UserNotFoundError, UserNotLoggedInError, addRoleForUserBy, addRoleToUser, authFunctions, authenticateRequest, changePasswordForUserBy, cleanupExpiredTokens, confirmResetPassword, createAuthContext, createAuthMiddleware, createAuthTables, createUser, deleteUserBy, dropAuthTables, forceLogoutForUserBy, getAuthTableStats, getUserRoles, hasRoleForUserBy, initiatePasswordResetForUserBy, isValidEmail, register, removeRoleForUserBy, removeRoleFromUser, resetPassword, setStatusForUserBy, setUserRoles, userExistsByEmail, validateEmail };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 import { Request, Response, NextFunction } from 'express';
 import { Pool } from 'pg';
+import { IncomingMessage } from 'http';
 
 interface OAuthProviderConfig {
     clientId: string;
@@ -55,6 +56,7 @@ interface AuthConfig {
         google?: GoogleProviderConfig;
         azure?: AzureProviderConfig;
     };
+    githubUserAgent?: string;
     twoFactor?: {
         enabled?: boolean;
         requireForOAuth?: boolean;
@@ -118,6 +120,10 @@ interface AuthRemember {
     token: string;
     expires: Date;
 }
+interface AuthenticateRequestResult {
+    account: AuthAccount | null;
+    source: "session" | "remember" | null;
+}
 interface AuthReset {
     id: number;
     account_id: number;
@@ -598,6 +604,7 @@ interface AuthContext {
 }
 declare function createAuthContext(config: AuthConfig): AuthContext;
 
+declare function authenticateRequest(config: AuthConfig, req: IncomingMessage, sessionMiddleware?: (req: any, res: any, next: () => void) => void): Promise<AuthenticateRequestResult>;
 declare function createUser(config: AuthConfig, credentials: {
     email: string;
     password: string;
@@ -653,6 +660,7 @@ declare function forceLogoutForUserBy(config: AuthConfig, identifier: {
 }>;
 
 declare const authFunctions_addRoleForUserBy: typeof addRoleForUserBy;
+declare const authFunctions_authenticateRequest: typeof authenticateRequest;
 declare const authFunctions_changePasswordForUserBy: typeof changePasswordForUserBy;
 declare const authFunctions_confirmResetPassword: typeof confirmResetPassword;
 declare const authFunctions_createUser: typeof createUser;
@@ -666,7 +674,7 @@ declare const authFunctions_resetPassword: typeof resetPassword;
 declare const authFunctions_setStatusForUserBy: typeof setStatusForUserBy;
 declare const authFunctions_userExistsByEmail: typeof userExistsByEmail;
 declare namespace authFunctions {
-  export { authFunctions_addRoleForUserBy as addRoleForUserBy, authFunctions_changePasswordForUserBy as changePasswordForUserBy, authFunctions_confirmResetPassword as confirmResetPassword, authFunctions_createUser as createUser, authFunctions_deleteUserBy as deleteUserBy, authFunctions_forceLogoutForUserBy as forceLogoutForUserBy, authFunctions_hasRoleForUserBy as hasRoleForUserBy, authFunctions_initiatePasswordResetForUserBy as initiatePasswordResetForUserBy, authFunctions_register as register, authFunctions_removeRoleForUserBy as removeRoleForUserBy, authFunctions_resetPassword as resetPassword, authFunctions_setStatusForUserBy as setStatusForUserBy, authFunctions_userExistsByEmail as userExistsByEmail };
+  export { authFunctions_addRoleForUserBy as addRoleForUserBy, authFunctions_authenticateRequest as authenticateRequest, authFunctions_changePasswordForUserBy as changePasswordForUserBy, authFunctions_confirmResetPassword as confirmResetPassword, authFunctions_createUser as createUser, authFunctions_deleteUserBy as deleteUserBy, authFunctions_forceLogoutForUserBy as forceLogoutForUserBy, authFunctions_hasRoleForUserBy as hasRoleForUserBy, authFunctions_initiatePasswordResetForUserBy as initiatePasswordResetForUserBy, authFunctions_register as register, authFunctions_removeRoleForUserBy as removeRoleForUserBy, authFunctions_resetPassword as resetPassword, authFunctions_setStatusForUserBy as setStatusForUserBy, authFunctions_userExistsByEmail as userExistsByEmail };
 }
 
 type UserIdentifier = {
@@ -1167,7 +1175,7 @@ declare abstract class BaseOAuthProvider implements OAuthProvider {
     protected processOAuthLogin(userData: OAuthUserData, req: Request): Promise<OAuthCallbackResult>;
     protected abstract getProviderName(): string;
     protected exchangeCodeForToken(code: string, tokenUrl: string): Promise<string>;
-    protected fetchUserFromAPI(accessToken: string, apiUrl: string): Promise<any>;
+    protected fetchUserFromAPI(accessToken: string, apiUrl: string, headers?: Record<string, string>): Promise<any>;
 }
 
 declare class GitHubProvider extends BaseOAuthProvider {
@@ -1192,4 +1200,4 @@ declare class AzureProvider extends BaseOAuthProvider {
     protected exchangeCodeForToken(code: string, tokenUrl: string): Promise<string>;
 }
 
-export { ActivityLogger, type AuthAccount, type AuthActivity, AuthActivityAction, type AuthActivityActionType, type AuthConfig, type AuthConfirmation, type AuthContext, AuthError, type AuthManager$1 as AuthManager, type AuthProvider, type AuthRemember, type AuthReset, AuthRole, type AuthSession, AuthStatus, AzureProvider, type AzureProviderConfig, BaseOAuthProvider, ConfirmationExpiredError, ConfirmationNotFoundError, EmailNotVerifiedError, EmailTakenError, GitHubProvider, type GitHubProviderConfig, GoogleProvider, type GoogleProviderConfig, InvalidBackupCodeError, InvalidEmailError, InvalidPasswordError, InvalidTokenError, InvalidTwoFactorCodeError, type OAuthCallbackResult, type OAuthProvider, type OAuthProviderConfig, type OAuthUserData, OtpProvider, ResetDisabledError, ResetExpiredError, ResetNotFoundError, SecondFactorRequiredError, type TokenCallback, TooManyResetsError, TotpProvider, TwoFactorAlreadyEnabledError, type TwoFactorChallenge, TwoFactorExpiredError, TwoFactorManager, TwoFactorMechanism, type TwoFactorMethod, TwoFactorNotSetupError, TwoFactorSetupIncompleteError, type TwoFactorSetupResult, type TwoFactorToken, type UserIdentifier, UserInactiveError, UserNotFoundError, UserNotLoggedInError, addRoleForUserBy, addRoleToUser, authFunctions, changePasswordForUserBy, cleanupExpiredTokens, confirmResetPassword, createAuthContext, createAuthMiddleware, createAuthTables, createUser, deleteUserBy, dropAuthTables, forceLogoutForUserBy, getAuthTableStats, getUserRoles, hasRoleForUserBy, initiatePasswordResetForUserBy, isValidEmail, register, removeRoleForUserBy, removeRoleFromUser, resetPassword, setStatusForUserBy, setUserRoles, userExistsByEmail, validateEmail };
+export { ActivityLogger, type AuthAccount, type AuthActivity, AuthActivityAction, type AuthActivityActionType, type AuthConfig, type AuthConfirmation, type AuthContext, AuthError, type AuthManager$1 as AuthManager, type AuthProvider, type AuthRemember, type AuthReset, AuthRole, type AuthSession, AuthStatus, type AuthenticateRequestResult, AzureProvider, type AzureProviderConfig, BaseOAuthProvider, ConfirmationExpiredError, ConfirmationNotFoundError, EmailNotVerifiedError, EmailTakenError, GitHubProvider, type GitHubProviderConfig, GoogleProvider, type GoogleProviderConfig, InvalidBackupCodeError, InvalidEmailError, InvalidPasswordError, InvalidTokenError, InvalidTwoFactorCodeError, type OAuthCallbackResult, type OAuthProvider, type OAuthProviderConfig, type OAuthUserData, OtpProvider, ResetDisabledError, ResetExpiredError, ResetNotFoundError, SecondFactorRequiredError, type TokenCallback, TooManyResetsError, TotpProvider, TwoFactorAlreadyEnabledError, type TwoFactorChallenge, TwoFactorExpiredError, TwoFactorManager, TwoFactorMechanism, type TwoFactorMethod, TwoFactorNotSetupError, TwoFactorSetupIncompleteError, type TwoFactorSetupResult, type TwoFactorToken, type UserIdentifier, UserInactiveError, UserNotFoundError, UserNotLoggedInError, addRoleForUserBy, addRoleToUser, authFunctions, authenticateRequest, changePasswordForUserBy, cleanupExpiredTokens, confirmResetPassword, createAuthContext, createAuthMiddleware, createAuthTables, createUser, deleteUserBy, dropAuthTables, forceLogoutForUserBy, getAuthTableStats, getUserRoles, hasRoleForUserBy, initiatePasswordResetForUserBy, isValidEmail, register, removeRoleForUserBy, removeRoleFromUser, resetPassword, setStatusForUserBy, setUserRoles, userExistsByEmail, validateEmail };

package/dist/index.js

@@ -696,11 +696,12 @@ var BaseOAuthProvider = class {
     }
     return data.access_token;
   }
-  async fetchUserFromAPI(accessToken, apiUrl) {
+  async fetchUserFromAPI(accessToken, apiUrl, headers = {}) {
     const response = await fetch(apiUrl, {
       headers: {
         Authorization: `Bearer ${accessToken}`,
-        Accept: "application/json"
+        Accept: "application/json",
+        ...headers
       }
     });
     if (!response.ok) {
@@ -731,14 +732,24 @@ var GitHubProvider = class extends BaseOAuthProvider {
       throw new Error("No authorization code provided");
     }
     const accessToken = await this.exchangeCodeForToken(code, "https://github.com/login/oauth/access_token");
-    const [user, emails] = await Promise.all([this.fetchUserFromAPI(accessToken, "https://api.github.com/user"), this.fetchUserFromAPI(accessToken, "https://api.github.com/user/emails")]);
-    const primaryEmail = Array.isArray(emails) ? emails.find((email) => email.primary)?.email : null;
-    if (!primaryEmail) {
-      throw new Error("No primary email found in GitHub account");
+    const apiHeaders = {
+      Accept: "application/vnd.github+json",
+      "User-Agent": this.authConfig.githubUserAgent || "EasyAccess",
+      "X-GitHub-Api-Version": "2022-11-28"
+    };
+    const [user, emails] = await Promise.all([
+      this.fetchUserFromAPI(accessToken, "https://api.github.com/user", apiHeaders),
+      this.fetchUserFromAPI(accessToken, "https://api.github.com/user/emails", apiHeaders)
+    ]);
+    const verifiedEmails = Array.isArray(emails) ? emails.filter((email) => email.verified) : [];
+    const primaryEmail = verifiedEmails.find((email) => email.primary)?.email;
+    const fallbackEmail = primaryEmail || verifiedEmails[0]?.email;
+    if (!fallbackEmail) {
+      throw new Error("No verified email found in GitHub account");
     }
     return {
       id: user.id.toString(),
-      email: primaryEmail,
+      email: fallbackEmail,
       username: user.login,
       name: user.name || user.login,
       avatar: user.avatar_url
@@ -1371,6 +1382,7 @@ var TwoFactorManager = class {
 var auth_functions_exports = {};
 __export(auth_functions_exports, {
   addRoleForUserBy: () => addRoleForUserBy,
+  authenticateRequest: () => authenticateRequest,
   changePasswordForUserBy: () => changePasswordForUserBy,
   confirmResetPassword: () => confirmResetPassword,
   createUser: () => createUser,
@@ -1386,6 +1398,48 @@ __export(auth_functions_exports, {
 });
 import { hash as hash3 } from "@prsm/hash";
 import ms2 from "@prsm/ms";
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  for (const pair of cookieHeader.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) cookies[key] = decodeURIComponent(value);
+  }
+  return cookies;
+}
+async function authenticateRequest(config, req, sessionMiddleware) {
+  const queries = new AuthQueries(config);
+  if (sessionMiddleware) {
+    await new Promise((resolve) => {
+      sessionMiddleware(req, {}, resolve);
+    });
+  }
+  const session = req.session;
+  if (session?.auth?.loggedIn && session.auth.accountId) {
+    const account2 = await queries.findAccountById(session.auth.accountId);
+    if (account2 && account2.status === AuthStatus.Normal) {
+      return { account: account2, source: "session" };
+    }
+  }
+  const cookies = parseCookies(req.headers.cookie || "");
+  const cookieName = config.rememberCookieName || "remember_token";
+  const token = cookies[cookieName];
+  if (!token) {
+    return { account: null, source: null };
+  }
+  const remember = await queries.findRememberToken(token);
+  if (!remember || /* @__PURE__ */ new Date() > remember.expires) {
+    return { account: null, source: null };
+  }
+  const account = await queries.findAccountById(remember.account_id);
+  if (!account || account.status !== AuthStatus.Normal) {
+    return { account: null, source: null };
+  }
+  return { account, source: "remember" };
+}
 function validatePassword(password, config) {
   const minLength = config.minPasswordLength || 8;
   const maxLength = config.maxPasswordLength || 64;
@@ -2704,6 +2758,7 @@ export {
   addRoleForUserBy,
   addRoleToUser,
   auth_functions_exports as authFunctions,
+  authenticateRequest,
   changePasswordForUserBy,
   cleanupExpiredTokens,
   confirmResetPassword,