@eaccess/auth 0.1.20 → 1.0.0

package/dist/index.cjs

@@ -67,6 +67,7 @@ __export(index_exports, {
   addRoleForUserBy: () => addRoleForUserBy,
   addRoleToUser: () => addRoleToUser,
   authFunctions: () => auth_functions_exports,
+  authenticateRequest: () => authenticateRequest,
   changePasswordForUserBy: () => changePasswordForUserBy,
   cleanupExpiredTokens: () => cleanupExpiredTokens,
   confirmResetPassword: () => confirmResetPassword,
@@ -74,6 +75,7 @@ __export(index_exports, {
   createAuthMiddleware: () => createAuthMiddleware,
   createAuthTables: () => createAuthTables,
   createUser: () => createUser,
+  defineRoles: () => defineRoles,
   deleteUserBy: () => deleteUserBy,
   dropAuthTables: () => dropAuthTables,
   forceLogoutForUserBy: () => forceLogoutForUserBy,
@@ -94,7 +96,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/auth-manager.ts
-var import_hash4 = require("@prsm/hash");
+var import_hash4 = __toESM(require("@prsm/hash"), 1);
 var import_ms3 = __toESM(require("@prsm/ms"), 1);
 
 // src/types.ts
@@ -810,7 +812,7 @@ var GitHubProvider = class extends BaseOAuthProvider {
       client_id: this.config.clientId,
       redirect_uri: this.config.redirectUri,
       scope: scopes?.join(" ") || "user:email",
-      state: state || Math.random().toString(36).substring(2),
+      state: state || crypto.randomUUID(),
       response_type: "code"
     });
     return `https://github.com/login/oauth/authorize?${params}`;
@@ -859,7 +861,7 @@ var GoogleProvider = class extends BaseOAuthProvider {
       client_id: this.config.clientId,
       redirect_uri: this.config.redirectUri,
       scope: scopes?.join(" ") || "openid profile email",
-      state: state || Math.random().toString(36).substring(2),
+      state: state || crypto.randomUUID(),
       response_type: "code",
       access_type: "offline",
       prompt: "consent"
@@ -901,7 +903,7 @@ var AzureProvider = class extends BaseOAuthProvider {
       client_id: azureConfig.clientId,
       redirect_uri: azureConfig.redirectUri,
       scope: scopes?.join(" ") || "openid profile email User.Read",
-      state: state || Math.random().toString(36).substring(2),
+      state: state || crypto.randomUUID(),
       response_type: "code",
       response_mode: "query"
     });
@@ -960,7 +962,7 @@ var AzureProvider = class extends BaseOAuthProvider {
 
 // src/two-factor/totp-provider.ts
 var import_totp = __toESM(require("@eaccess/totp"), 1);
-var import_hash = require("@prsm/hash");
+var import_hash = __toESM(require("@prsm/hash"), 1);
 var TotpProvider = class {
   constructor(config) {
     this.config = config;
@@ -977,23 +979,20 @@ var TotpProvider = class {
     return import_totp.default.verifyTotp(secret, code, window);
   }
   generateBackupCodes(count = 10) {
+    const chars = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
     const codes = [];
     for (let i = 0; i < count; i++) {
-      const chars = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
-      let code = "";
-      for (let j = 0; j < 8; j++) {
-        code += chars.charAt(Math.floor(Math.random() * chars.length));
-      }
-      codes.push(code);
+      const bytes = crypto.getRandomValues(new Uint8Array(8));
+      codes.push(Array.from(bytes, (b) => chars[b % chars.length]).join(""));
     }
     return codes;
   }
-  hashBackupCodes(codes) {
-    return codes.map((code) => import_hash.hash.encode(code));
+  async hashBackupCodes(codes) {
+    return await Promise.all(codes.map((code) => import_hash.default.encode(code)));
   }
-  verifyBackupCode(hashedCodes, inputCode) {
+  async verifyBackupCode(hashedCodes, inputCode) {
     for (let i = 0; i < hashedCodes.length; i++) {
-      if (import_hash.hash.verify(hashedCodes[i], inputCode.toUpperCase())) {
+      if (await import_hash.default.verify(hashedCodes[i], inputCode.toUpperCase())) {
         return { isValid: true, index: i };
       }
     }
@@ -1010,7 +1009,7 @@ var TotpProvider = class {
 
 // src/two-factor/otp-provider.ts
 var import_ms = __toESM(require("@prsm/ms"), 1);
-var import_hash2 = require("@prsm/hash");
+var import_hash2 = __toESM(require("@prsm/hash"), 1);
 var OtpProvider = class {
   constructor(config) {
     this.config = config;
@@ -1018,24 +1017,16 @@ var OtpProvider = class {
   }
   generateOTP() {
     const length = this.config.twoFactor?.codeLength || 6;
-    let otp = "";
-    for (let i = 0; i < length; i++) {
-      otp += Math.floor(Math.random() * 10).toString();
-    }
-    return otp;
+    const bytes = crypto.getRandomValues(new Uint8Array(length));
+    return Array.from(bytes, (b) => (b % 10).toString()).join("");
   }
   generateSelector() {
-    const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-    let selector = "";
-    for (let i = 0; i < 32; i++) {
-      selector += chars.charAt(Math.floor(Math.random() * chars.length));
-    }
-    return selector;
+    return crypto.randomUUID().replace(/-/g, "");
   }
   async createAndStoreOTP(accountId, mechanism) {
     const otp = this.generateOTP();
     const selector = this.generateSelector();
-    const tokenHash = import_hash2.hash.encode(otp);
+    const tokenHash = await import_hash2.default.encode(otp);
     const expiryDuration = this.config.twoFactor?.tokenExpiry || "5m";
     const expiresAt = new Date(Date.now() + (0, import_ms.default)(expiryDuration));
     await this.queries.deleteTwoFactorTokensByAccountAndMechanism(accountId, mechanism);
@@ -1057,7 +1048,7 @@ var OtpProvider = class {
       await this.queries.deleteTwoFactorToken(token.id);
       return { isValid: false };
     }
-    const isValid = import_hash2.hash.verify(token.token_hash, inputCode);
+    const isValid = await import_hash2.default.verify(token.token_hash, inputCode);
     if (isValid) {
       await this.queries.deleteTwoFactorToken(token.id);
       return { isValid: true, token };
@@ -1104,7 +1095,7 @@ var TwoFactorManager = class {
           const backupCodesCount = this.config.twoFactor?.backupCodesCount || 10;
           backupCodes = this.totpProvider.generateBackupCodes(backupCodesCount);
         }
-        const hashedBackupCodes = backupCodes ? this.totpProvider.hashBackupCodes(backupCodes) : void 0;
+        const hashedBackupCodes = backupCodes ? await this.totpProvider.hashBackupCodes(backupCodes) : void 0;
         const verified = !requireVerification;
         if (existingMethod) {
           await this.queries.updateTwoFactorMethod(existingMethod.id, {
@@ -1202,7 +1193,7 @@ var TwoFactorManager = class {
         }
         const backupCodesCount = this.config.twoFactor?.backupCodesCount || 10;
         const backupCodes = this.totpProvider.generateBackupCodes(backupCodesCount);
-        const hashedBackupCodes = this.totpProvider.hashBackupCodes(backupCodes);
+        const hashedBackupCodes = await this.totpProvider.hashBackupCodes(backupCodes);
         await this.queries.updateTwoFactorMethod(method.id, {
           verified: true,
           backup_codes: hashedBackupCodes,
@@ -1254,7 +1245,7 @@ var TwoFactorManager = class {
         if (!method || !method.verified || !method.backup_codes) {
           throw new TwoFactorNotSetupError();
         }
-        const { isValid, index } = this.totpProvider.verifyBackupCode(method.backup_codes, code);
+        const { isValid, index } = await this.totpProvider.verifyBackupCode(method.backup_codes, code);
         if (!isValid) {
           await this.activityLogger.logActivity(twoFactorState.accountId, AuthActivityAction.TwoFactorFailed, this.req, false, { mechanism: "backup_code", reason: "invalid_code" });
           throw new InvalidBackupCodeError();
@@ -1403,7 +1394,7 @@ var TwoFactorManager = class {
     }
     const backupCodesCount = this.config.twoFactor?.backupCodesCount || 10;
     const backupCodes = this.totpProvider.generateBackupCodes(backupCodesCount);
-    const hashedBackupCodes = this.totpProvider.hashBackupCodes(backupCodes);
+    const hashedBackupCodes = await this.totpProvider.hashBackupCodes(backupCodes);
     await this.queries.updateTwoFactorMethod(method.id, {
       backup_codes: hashedBackupCodes
     });
@@ -1471,6 +1462,7 @@ var TwoFactorManager = class {
 var auth_functions_exports = {};
 __export(auth_functions_exports, {
   addRoleForUserBy: () => addRoleForUserBy,
+  authenticateRequest: () => authenticateRequest,
   changePasswordForUserBy: () => changePasswordForUserBy,
   confirmResetPassword: () => confirmResetPassword,
   createUser: () => createUser,
@@ -1484,8 +1476,50 @@ __export(auth_functions_exports, {
   setStatusForUserBy: () => setStatusForUserBy,
   userExistsByEmail: () => userExistsByEmail
 });
-var import_hash3 = require("@prsm/hash");
+var import_hash3 = __toESM(require("@prsm/hash"), 1);
 var import_ms2 = __toESM(require("@prsm/ms"), 1);
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  for (const pair of cookieHeader.split(";")) {
+    const idx = pair.indexOf("=");
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const value = pair.slice(idx + 1).trim();
+    if (key) cookies[key] = decodeURIComponent(value);
+  }
+  return cookies;
+}
+async function authenticateRequest(config, req, sessionMiddleware) {
+  const queries = new AuthQueries(config);
+  if (sessionMiddleware) {
+    await new Promise((resolve) => {
+      sessionMiddleware(req, {}, resolve);
+    });
+  }
+  const session = req.session;
+  if (session?.auth?.loggedIn && session.auth.accountId) {
+    const account2 = await queries.findAccountById(session.auth.accountId);
+    if (account2 && account2.status === AuthStatus.Normal) {
+      return { account: account2, source: "session" };
+    }
+  }
+  const cookies = parseCookies(req.headers.cookie || "");
+  const cookieName = config.rememberCookieName || "remember_token";
+  const token = cookies[cookieName];
+  if (!token) {
+    return { account: null, source: null };
+  }
+  const remember = await queries.findRememberToken(token);
+  if (!remember || /* @__PURE__ */ new Date() > remember.expires) {
+    return { account: null, source: null };
+  }
+  const account = await queries.findAccountById(remember.account_id);
+  if (!account || account.status !== AuthStatus.Normal) {
+    return { account: null, source: null };
+  }
+  return { account, source: "remember" };
+}
 function validatePassword(password, config) {
   const minLength = config.minPasswordLength || 8;
   const maxLength = config.maxPasswordLength || 64;
@@ -1513,7 +1547,7 @@ async function findAccountByIdentifier(queries, identifier) {
   return null;
 }
 async function createConfirmationToken(queries, account, email, callback) {
-  const token = import_hash3.hash.encode(email);
+  const token = await import_hash3.default.encode(email);
   const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
   await queries.createConfirmation({
     accountId: account.id,
@@ -1534,7 +1568,7 @@ async function createUser(config, credentials, userId, callback) {
     throw new EmailTakenError();
   }
   const finalUserId = userId || generateAutoUserId();
-  const hashedPassword = import_hash3.hash.encode(credentials.password);
+  const hashedPassword = await import_hash3.default.encode(credentials.password);
   const verified = typeof callback !== "function";
   const account = await queries.createAccount({
     userId: finalUserId,
@@ -1558,7 +1592,7 @@ async function register(config, email, password, userId, callback) {
     throw new EmailTakenError();
   }
   const finalUserId = userId || generateAutoUserId();
-  const hashedPassword = import_hash3.hash.encode(password);
+  const hashedPassword = await import_hash3.default.encode(password);
   const verified = typeof callback !== "function";
   const account = await queries.createAccount({
     userId: finalUserId,
@@ -1615,7 +1649,7 @@ async function changePasswordForUserBy(config, identifier, password) {
     throw new UserNotFoundError();
   }
   await queries.updateAccount(account.id, {
-    password: import_hash3.hash.encode(password)
+    password: await import_hash3.default.encode(password)
   });
 }
 async function setStatusForUserBy(config, identifier, status) {
@@ -1636,7 +1670,7 @@ async function initiatePasswordResetForUserBy(config, identifier, expiresAfter =
     throw new EmailNotVerifiedError();
   }
   const expiry = !expiresAfter ? (0, import_ms2.default)("6h") : (0, import_ms2.default)(expiresAfter);
-  const token = import_hash3.hash.encode(account.email);
+  const token = await import_hash3.default.encode(account.email);
   const expires = new Date(Date.now() + expiry);
   await queries.createResetToken({
     accountId: account.id,
@@ -1663,7 +1697,7 @@ async function resetPassword(config, email, expiresAfter = null, maxOpenRequests
   if (openRequests >= maxRequests) {
     throw new TooManyResetsError();
   }
-  const token = import_hash3.hash.encode(email);
+  const token = await import_hash3.default.encode(email);
   const expires = new Date(Date.now() + expiry);
   await queries.createResetToken({
     accountId: account.id,
@@ -1691,11 +1725,11 @@ async function confirmResetPassword(config, token, password) {
     throw new ResetDisabledError();
   }
   validatePassword(password, config);
-  if (!import_hash3.hash.verify(token, account.email)) {
+  if (!await import_hash3.default.verify(token, account.email)) {
     throw new InvalidTokenError();
   }
   await queries.updateAccount(account.id, {
-    password: import_hash3.hash.encode(password)
+    password: await import_hash3.default.encode(password)
   });
   await queries.deleteResetToken(token);
   return { accountId: account.id, email: account.email };
@@ -1765,7 +1799,7 @@ var AuthManager = class {
     }
   }
   getRoleMap() {
-    return createMapFromEnum(AuthRole);
+    return createMapFromEnum(this.config.roles || AuthRole);
   }
   getStatusMap() {
     return createMapFromEnum(AuthStatus);
@@ -1916,7 +1950,7 @@ var AuthManager = class {
     });
   }
   async createRememberDirective(account) {
-    const token = import_hash4.hash.encode(account.email);
+    const token = await import_hash4.default.encode(account.email);
     const duration = this.config.rememberDuration || "30d";
     const expires = new Date(Date.now() + (0, import_ms3.default)(duration));
     await this.queries.createRememberToken({
@@ -1954,7 +1988,7 @@ var AuthManager = class {
         await this.activityLogger.logActivity(null, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "account_not_found" });
         throw new UserNotFoundError();
       }
-      if (!account.password || !import_hash4.hash.verify(account.password, password)) {
+      if (!account.password || !await import_hash4.default.verify(account.password, password)) {
         await this.activityLogger.logActivity(account.id, AuthActivityAction.FailedLogin, this.req, false, { email, reason: "invalid_password" });
         throw new InvalidPasswordError();
       }
@@ -2067,7 +2101,7 @@ var AuthManager = class {
       throw new EmailTakenError();
     }
     const finalUserId = userId || this.generateAutoUserId();
-    const hashedPassword = import_hash4.hash.encode(password);
+    const hashedPassword = await import_hash4.default.encode(password);
     const verified = typeof callback !== "function";
     const account = await this.queries.createAccount({
       userId: finalUserId,
@@ -2084,7 +2118,7 @@ var AuthManager = class {
     return account;
   }
   async createConfirmationToken(account, email, callback) {
-    const token = import_hash4.hash.encode(email);
+    const token = await import_hash4.default.encode(email);
     const expires = new Date(Date.now() + 1e3 * 60 * 60 * 24 * 7);
     await this.queries.createConfirmation({
       accountId: account.id,
@@ -2226,7 +2260,7 @@ var AuthManager = class {
     if (new Date(confirmation.expires) < /* @__PURE__ */ new Date()) {
       throw new ConfirmationExpiredError();
     }
-    if (!import_hash4.hash.verify(token, confirmation.email)) {
+    if (!await import_hash4.default.verify(token, confirmation.email)) {
       throw new InvalidTokenError();
     }
     await this.queries.updateAccount(confirmation.account_id, {
@@ -2324,7 +2358,7 @@ var AuthManager = class {
     if (openRequests >= maxRequests) {
       throw new TooManyResetsError();
     }
-    const token = import_hash4.hash.encode(email);
+    const token = await import_hash4.default.encode(email);
     const expires = new Date(Date.now() + expiry);
     await this.queries.createResetToken({
       accountId: account.id,
@@ -2366,11 +2400,11 @@ var AuthManager = class {
       throw new ResetDisabledError();
     }
     this.validatePassword(password);
-    if (!import_hash4.hash.verify(token, account.email)) {
+    if (!await import_hash4.default.verify(token, account.email)) {
       throw new InvalidTokenError();
     }
     await this.queries.updateAccount(account.id, {
-      password: import_hash4.hash.encode(password)
+      password: await import_hash4.default.encode(password)
     });
     if (logout) {
       await this.forceLogoutForAccountById(account.id);
@@ -2398,7 +2432,7 @@ var AuthManager = class {
     if (!account.password) {
       return false;
     }
-    return import_hash4.hash.verify(account.password, password);
+    return await import_hash4.default.verify(account.password, password);
   }
   async forceLogoutForAccountById(accountId) {
     await this.queries.deleteRememberTokensForAccount(accountId);
@@ -2730,6 +2764,26 @@ function createAuthContext(config) {
 }
 
 // src/user-roles.ts
+var MAX_ROLES = 31;
+function defineRoles(...names) {
+  if (names.length > MAX_ROLES) {
+    throw new Error(`Cannot define more than ${MAX_ROLES} roles (postgres INTEGER is 32-bit signed)`);
+  }
+  if (names.length === 0) {
+    throw new Error("At least one role name is required");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const roles = {};
+  for (let i = 0; i < names.length; i++) {
+    const name = names[i];
+    if (seen.has(name)) {
+      throw new Error(`Duplicate role name: ${name}`);
+    }
+    seen.add(name);
+    roles[name] = 1 << i;
+  }
+  return Object.freeze(roles);
+}
 async function findAccountByIdentifier2(queries, identifier) {
   let account = null;
   if (identifier.accountId !== void 0) {
@@ -2805,6 +2859,7 @@ async function getUserRoles(config, identifier) {
   addRoleForUserBy,
   addRoleToUser,
   authFunctions,
+  authenticateRequest,
   changePasswordForUserBy,
   cleanupExpiredTokens,
   confirmResetPassword,
@@ -2812,6 +2867,7 @@ async function getUserRoles(config, identifier) {
   createAuthMiddleware,
   createAuthTables,
   createUser,
+  defineRoles,
   deleteUserBy,
   dropAuthTables,
   forceLogoutForUserBy,