@everystack/auth 0.1.0

package/src/passwords.ts

@@ -0,0 +1,70 @@
+/**
+ * Password hashing — bcrypt, configurable cost (default 10, OWASP minimum).
+ *
+ * Why bcrypt:
+ *   - OWASP-aligned (cost ≥10 is the recommendation).
+ *   - Byte-compatible with Postgres pgcrypto `crypt(p, gen_salt('bf', N))` →
+ *     hashes are interchangeable between JS and SQL paths.
+ *   - Pure-JS implementation (`bcryptjs`), no native build, runs on Lambda + Bun
+ *     + Cloudflare Workers + browsers without polyfill.
+ *
+ * Cost is configurable per-site via BCRYPT_COST env var (default: 10).
+ * Each increment doubles the work: cost 10 ≈ 86ms, 12 ≈ 394ms, 14 ≈ 1.5s.
+ *
+ * 72-byte limit is enforced rather than silently truncated. Apps must validate
+ * input length before calling. Reject early and loud is the OWASP-correct
+ * stance — silent truncation makes "the last 30 chars of my 100-char password
+ * don't matter" a real bug.
+ */
+import bcrypt from 'bcryptjs';
+
+const DEFAULT_BCRYPT_COST = 10;
+export const BCRYPT_COST = Math.max(4, Math.min(31,
+  parseInt(process.env.BCRYPT_COST || '', 10) || DEFAULT_BCRYPT_COST
+));
+export const BCRYPT_MAX_BYTES = 72;
+
+/**
+ * Hash a password with bcrypt.
+ *
+ * Produces $2a$ hashes for pgcrypto compatibility. bcryptjs emits $2a$
+ * by default (bcrypt.genSalt uses prefix '2a'), so no normalization needed.
+ * If a future library change switches to $2b$, the replace below catches it.
+ *
+ * @throws {Error} If password is empty or longer than 72 UTF-8 bytes.
+ */
+export async function hashPassword(password: string): Promise<string> {
+  if (typeof password !== 'string' || password.length === 0) {
+    throw new Error('password must be a non-empty string');
+  }
+  const byteLen = new TextEncoder().encode(password).length;
+  if (byteLen > BCRYPT_MAX_BYTES) {
+    throw new Error(
+      `password exceeds bcrypt's 72 bytes limit (got ${byteLen} bytes)`
+    );
+  }
+  const hash = await bcrypt.hash(password, BCRYPT_COST);
+  // Normalize $2b$ → $2a$ for pgcrypto compat (algorithms are byte-identical).
+  return hash.replace(/^\$2b\$/, '$2a$');
+}
+
+/**
+ * Verify a password against a stored bcrypt hash.
+ *
+ * Returns false (never throws) for any malformed or unrecognized stored value.
+ * Accepts $2a$ (pgcrypto / older bcrypt), $2b$ (modern), $2y$ (PHP) prefixes —
+ * all are byte-identical OpenBSD bcrypt.
+ */
+export async function verifyPassword(
+  password: string,
+  stored: string
+): Promise<boolean> {
+  if (typeof password !== 'string' || password.length === 0) return false;
+  if (typeof stored !== 'string' || stored.length === 0) return false;
+  if (!/^\$2[aby]\$\d{2}\$/.test(stored)) return false;
+  try {
+    return await bcrypt.compare(password, stored);
+  } catch {
+    return false;
+  }
+}

package/src/postgres.ts

@@ -0,0 +1,504 @@
+/**
+ * PostgreSQL-backed auth handlers using pgcrypto.
+ *
+ * Password hashing: crypt() / gen_salt('bf') via auth.hash_password()
+ * JWT signing: hmac() via auth.sign_jwt()
+ * Refresh tokens: auth.generate_refresh_token() / auth.validate_refresh_token()
+ *
+ * Uses postgres.js tagged templates directly (not drizzle's sql) because
+ * drizzle expands arrays into individual params instead of PostgreSQL arrays.
+ * Drizzle db is still used for ORM operations (insert/select/update).
+ *
+ * Requires: pgcrypto extension + auth functions (see @everystack/auth/sql)
+ */
+
+import { and, eq } from 'drizzle-orm';
+import { createJwt } from './jwt';
+import { hmacNode } from './jwt/hmac-node';
+import type { AuthHandlers, AuthOptions, TokenPayload } from './index';
+import type { OAuthProvider } from './oauth';
+import { getRefreshFromCookies } from './cookies';
+import { authResponse, signoutResponse } from './response';
+
+const TOKEN_EXPIRY_SECONDS = 3600; // 1 hour
+
+export function createPostgresAuthHandlers(
+  db: any,
+  schema: { users: any; profiles: any; sessions?: any; credentials?: any; identities?: any },
+  jwtSecret: Uint8Array,
+  options?: AuthOptions,
+): AuthHandlers {
+  const pgSql = options?.sql;
+  if (!pgSql) {
+    throw new Error("mode: 'postgres' requires options.sql (postgres.js client)");
+  }
+
+  const { users, profiles } = schema;
+  const jwtSecretString = new TextDecoder().decode(jwtSecret);
+
+  /**
+   * Sign JWT via PostgreSQL pgcrypto hmac().
+   * Requires GUC app.jwt_secret — uses pgSql.begin() for transaction-local setting.
+   */
+  async function signJwtPg(payload: Record<string, unknown>): Promise<string> {
+    const now = Math.floor(Date.now() / 1000);
+    const fullPayload = {
+      ...payload,
+      iat: now,
+      exp: now + TOKEN_EXPIRY_SECONDS,
+    };
+    const payloadJson = JSON.stringify(fullPayload);
+    const rows = await pgSql.begin(async (sql: any) => {
+      await sql`SELECT set_config('app.jwt_secret', ${jwtSecretString}, true)`;
+      return sql`SELECT auth.sign_jwt(${payloadJson}::jsonb) as sign_jwt`;
+    });
+    return rows[0].sign_jwt;
+  }
+
+  /**
+   * Hash password via PostgreSQL pgcrypto crypt()/gen_salt('bf').
+   */
+  async function hashPasswordPg(password: string): Promise<string> {
+    const rows = await pgSql`SELECT auth.hash_password(${password}) as hash_password`;
+    return rows[0].hash_password;
+  }
+
+  /**
+   * Verify password via PostgreSQL pgcrypto crypt().
+   */
+  async function verifyPasswordPg(password: string, hash: string): Promise<boolean> {
+    const rows = await pgSql`SELECT auth.verify_password(${password}, ${hash}) as verify_password`;
+    return rows[0].verify_password;
+  }
+
+  /**
+   * Generate refresh token via PostgreSQL.
+   */
+  async function generateRefreshTokenPg(userId: string): Promise<string> {
+    const rows = await pgSql`SELECT auth.generate_refresh_token(${userId}::uuid) as generate_refresh_token`;
+    return rows[0].generate_refresh_token;
+  }
+
+  /**
+   * Validate and rotate refresh token via PostgreSQL.
+   * The SQL function handles its own transactional locking (FOR UPDATE).
+   * Returns { userId, token, familyId }.
+   */
+  async function validateRefreshTokenPg(token: string): Promise<{ userId: string; token: string; familyId: string }> {
+    const rows = await pgSql`SELECT auth.validate_refresh_token(${token}) as validate_refresh_token`;
+    const result = rows[0].validate_refresh_token;
+    return typeof result === 'string' ? JSON.parse(result) : result;
+  }
+
+  /**
+   * Revoke all refresh tokens for a user.
+   */
+  async function revokeRefreshTokensPg(userId: string): Promise<void> {
+    await pgSql`SELECT auth.revoke_refresh_tokens(${userId}::uuid)`;
+  }
+
+  // JS-side verifier (compatible with HS256 tokens minted by SQL or JS).
+  const verifier = createJwt({
+    secret: jwtSecret,
+    hmac: hmacNode,
+    ttlSec: TOKEN_EXPIRY_SECONDS,
+  });
+
+  return {
+    verifyToken: async (token: string): Promise<TokenPayload | null> => {
+      const claims = await verifier.verify(token);
+      return (claims as TokenPayload | null) ?? null;
+    },
+
+    signup: async (request: Request): Promise<Response> => {
+      const { email, password, username, displayName } = await request.json();
+
+      if (!email || !password || !username || !displayName) {
+        return Response.json(
+          { message: 'email, password, username, and displayName are required' },
+          { status: 400 },
+        );
+      }
+
+      const existing = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, email))
+        .limit(1);
+      if (existing.length > 0) {
+        return Response.json(
+          { message: 'Email already registered' },
+          { status: 409 },
+        );
+      }
+
+      const passwordHash = await hashPasswordPg(password);
+      const { user, profile } = await db.transaction(async (tx: any) => {
+        const [u] = await tx.insert(users).values({ email, passwordHash }).returning();
+        const [p] = await tx.insert(profiles).values({ id: u.id, username, displayName }).returning();
+        return { user: u, profile: p };
+      });
+
+      const token = await signJwtPg({
+        sub: user.id,
+        email: user.email,
+        role: user.role ?? 'authenticated',
+      });
+
+      const refreshToken = schema.sessions
+        ? await generateRefreshTokenPg(user.id)
+        : await signJwtPg({ sub: user.id });
+
+      return authResponse(
+        {
+          token,
+          refreshToken,
+          user: {
+            id: user.id,
+            email: user.email,
+            username: profile.username,
+            displayName: profile.displayName,
+            role: user.role ?? 'authenticated',
+          },
+        },
+        201,
+        options?.cookies,
+      );
+    },
+
+    signin: async (request: Request): Promise<Response> => {
+      const { email, password } = await request.json();
+
+      if (!email || !password) {
+        return Response.json(
+          { message: 'email and password are required' },
+          { status: 400 },
+        );
+      }
+
+      const [user] = await db
+        .select()
+        .from(users)
+        .where(eq(users.email, email))
+        .limit(1);
+      if (!user) {
+        return Response.json(
+          { message: 'Invalid email or password' },
+          { status: 401 },
+        );
+      }
+
+      const valid = await verifyPasswordPg(password, user.passwordHash);
+      if (!valid) {
+        return Response.json(
+          { message: 'Invalid email or password' },
+          { status: 401 },
+        );
+      }
+
+      const [profile] = await db
+        .select()
+        .from(profiles)
+        .where(eq(profiles.id, user.id))
+        .limit(1);
+
+      const token = await signJwtPg({
+        sub: user.id,
+        email: user.email,
+        role: user.role ?? 'authenticated',
+      });
+
+      const refreshToken = schema.sessions
+        ? await generateRefreshTokenPg(user.id)
+        : await signJwtPg({ sub: user.id });
+
+      return authResponse(
+        {
+          token,
+          refreshToken,
+          user: {
+            id: user.id,
+            email: user.email,
+            username: profile?.username,
+            displayName: profile?.displayName,
+            role: user.role ?? 'authenticated',
+          },
+        },
+        200,
+        options?.cookies,
+      );
+    },
+
+    refresh: async (request: Request): Promise<Response> => {
+      // Read refresh token from JSON body (mobile) or cookie (web SSR)
+      let refreshToken: string | undefined;
+      try {
+        const body = await request.clone().json();
+        refreshToken = body?.refreshToken;
+      } catch {
+        // Empty body is fine — fall through to cookie
+      }
+      if (!refreshToken) {
+        refreshToken = getRefreshFromCookies(request.headers.get('cookie')) ?? undefined;
+      }
+      if (!refreshToken) {
+        return Response.json(
+          { message: 'refreshToken is required' },
+          { status: 400 },
+        );
+      }
+
+      if (schema.sessions) {
+        // DB-backed rotation via SQL function
+        try {
+          const result = await validateRefreshTokenPg(refreshToken);
+
+          const [user] = await db
+            .select()
+            .from(users)
+            .where(eq(users.id, result.userId))
+            .limit(1);
+          if (!user) {
+            return Response.json({ message: 'User not found' }, { status: 401 });
+          }
+
+          const token = await signJwtPg({
+            sub: user.id,
+            email: user.email,
+            role: user.role ?? 'authenticated',
+          });
+
+          return authResponse(
+            { token, refreshToken: result.token },
+            200,
+            options?.cookies,
+          );
+        } catch {
+          return Response.json(
+            { message: 'Invalid or expired refresh token' },
+            { status: 401 },
+          );
+        }
+      } else {
+        // Stateless JWT-based refresh (fallback)
+        try {
+          const payload = await verifier.verify(refreshToken);
+          if (!payload) {
+            return Response.json({ message: 'Invalid refresh token' }, { status: 401 });
+          }
+          const userId = payload.sub as string;
+
+          const [user] = await db
+            .select()
+            .from(users)
+            .where(eq(users.id, userId))
+            .limit(1);
+          if (!user) {
+            return Response.json({ message: 'User not found' }, { status: 401 });
+          }
+
+          const token = await signJwtPg({
+            sub: user.id,
+            email: user.email,
+            role: user.role ?? 'authenticated',
+          });
+          const newRefreshToken = await signJwtPg({ sub: user.id });
+
+          return authResponse(
+            { token, refreshToken: newRefreshToken },
+            200,
+            options?.cookies,
+          );
+        } catch {
+          return Response.json(
+            { message: 'Invalid or expired refresh token' },
+            { status: 401 },
+          );
+        }
+      }
+    },
+
+    oauth: options?.oauth?.providers.length
+      ? async (request: Request): Promise<Response> => {
+          if (!schema.credentials || !schema.identities) {
+            return Response.json(
+              { message: 'OAuth not configured: credentials and identities tables required in schema' },
+              { status: 500 },
+            );
+          }
+
+          let body: { provider?: string; token?: string };
+          try {
+            body = await request.json();
+          } catch {
+            return Response.json(
+              { message: 'Invalid request body' },
+              { status: 400 },
+            );
+          }
+
+          const { provider: providerName, token } = body;
+          if (!providerName || !token) {
+            return Response.json(
+              { message: 'provider and token are required' },
+              { status: 400 },
+            );
+          }
+
+          const provider = options!.oauth!.providers.find(
+            (p: OAuthProvider) => p.name === providerName,
+          );
+          if (!provider) {
+            return Response.json(
+              { message: `Unsupported provider: ${providerName}` },
+              { status: 400 },
+            );
+          }
+
+          const userInfo = await provider.verify(token);
+          if (!userInfo) {
+            return Response.json(
+              { message: 'Token verification failed' },
+              { status: 401 },
+            );
+          }
+
+          // Look up existing OAuth credential by (type='oauth', credentialId=providerUid)
+          const existingResults = await db
+            .select({
+              credentialId: schema.credentials.id,
+              userId: schema.identities.userId,
+            })
+            .from(schema.credentials)
+            .innerJoin(schema.identities, eq(schema.credentials.identityId, schema.identities.id))
+            .where(and(
+              eq(schema.credentials.type, 'oauth'),
+              eq(schema.credentials.credentialId, userInfo.uid),
+            ))
+            .limit(1);
+
+          const existingAccount = existingResults[0];
+
+          if (existingAccount) {
+            const [existingUser] = await db
+              .select()
+              .from(users)
+              .where(eq(users.id, existingAccount.userId))
+              .limit(1);
+
+            const [profile] = await db
+              .select()
+              .from(profiles)
+              .where(eq(profiles.id, existingAccount.userId))
+              .limit(1);
+
+            const accessToken = await signJwtPg({
+              sub: existingUser.id,
+              email: existingUser.email,
+              role: existingUser.role ?? 'authenticated',
+            });
+            const refreshToken = schema.sessions
+              ? await generateRefreshTokenPg(existingUser.id)
+              : await signJwtPg({ sub: existingUser.id });
+
+            return authResponse(
+              {
+                token: accessToken,
+                refreshToken,
+                user: {
+                  id: existingUser.id,
+                  email: existingUser.email,
+                  username: profile?.username,
+                  displayName: profile?.displayName,
+                  avatarUrl: profile?.avatarUrl,
+                  role: existingUser.role ?? 'authenticated',
+                },
+              },
+              200,
+              options?.cookies,
+            );
+          }
+
+          // New user — create account + identity + OAuth credential
+          const displayName = [userInfo.firstName, userInfo.lastName]
+            .filter(Boolean)
+            .join(' ') || userInfo.email.split('@')[0];
+          const username = userInfo.email.split('@')[0];
+
+          const { user, profile } = await db.transaction(async (tx: any) => {
+            const [u] = await tx
+              .insert(users)
+              .values({ email: userInfo.email, passwordHash: null })
+              .returning();
+
+            const [ident] = await tx
+              .insert(schema.identities)
+              .values({
+                type: 'user',
+                userId: u.id,
+                name: userInfo.email,
+              })
+              .returning();
+
+            await tx
+              .insert(schema.credentials)
+              .values({
+                type: 'oauth',
+                identityId: ident.id,
+                credentialId: userInfo.uid,
+                name: providerName,
+                metadata: { email: userInfo.email },
+              });
+
+            const [p] = await tx
+              .insert(profiles)
+              .values({
+                id: u.id,
+                username,
+                displayName,
+                avatarUrl: userInfo.avatarUrl || null,
+              })
+              .returning();
+
+            return { user: u, profile: p };
+          });
+
+          const accessToken = await signJwtPg({
+            sub: user.id,
+            email: user.email,
+            role: user.role ?? 'authenticated',
+          });
+          const refreshToken = schema.sessions
+            ? await generateRefreshTokenPg(user.id)
+            : await signJwtPg({ sub: user.id });
+
+          return authResponse(
+            {
+              token: accessToken,
+              refreshToken,
+              user: {
+                id: user.id,
+                email: user.email,
+                username: profile.username,
+                displayName: profile.displayName,
+                avatarUrl: profile.avatarUrl,
+                role: user.role ?? 'authenticated',
+              },
+            },
+            200,
+            options?.cookies,
+          );
+        }
+      : undefined,
+
+    signout: async (_request: Request): Promise<Response> => {
+      return signoutResponse(options?.cookies);
+    },
+
+    revokeRefreshTokens: async (userId: string): Promise<void> => {
+      if (schema.sessions) {
+        await revokeRefreshTokensPg(userId);
+      }
+    },
+  };
+}