@forjio/engine-auth 0.1.0

package/dist/session.js

@@ -0,0 +1,61 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSessionStore = createSessionStore;
+const ioredis_1 = __importDefault(require("ioredis"));
+const uuid_1 = require("uuid");
+const KEY_PREFIX = 'engine:session:';
+const USER_SESSIONS_PREFIX = 'engine:user-sessions:';
+const DEFAULT_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
+function createSessionStore(redisUrl) {
+    const redis = new ioredis_1.default(redisUrl);
+    return {
+        async create(sessionData) {
+            const sessionId = (0, uuid_1.v4)();
+            const key = `${KEY_PREFIX}${sessionId}`;
+            const serialized = JSON.stringify(sessionData);
+            await redis.setex(key, DEFAULT_TTL_SECONDS, serialized);
+            // Track session IDs per user for bulk destruction
+            const userKey = `${USER_SESSIONS_PREFIX}${sessionData.userId}`;
+            await redis.sadd(userKey, sessionId);
+            await redis.expire(userKey, DEFAULT_TTL_SECONDS);
+            return sessionId;
+        },
+        async get(sessionId) {
+            const key = `${KEY_PREFIX}${sessionId}`;
+            const data = await redis.get(key);
+            if (!data)
+                return null;
+            const session = JSON.parse(data);
+            // Check logical expiry
+            if (session.expiresAt < Date.now()) {
+                await redis.del(key);
+                return null;
+            }
+            return session;
+        },
+        async destroy(sessionId) {
+            const key = `${KEY_PREFIX}${sessionId}`;
+            // Get session to find userId before deleting
+            const data = await redis.get(key);
+            if (data) {
+                const session = JSON.parse(data);
+                const userKey = `${USER_SESSIONS_PREFIX}${session.userId}`;
+                await redis.srem(userKey, sessionId);
+            }
+            await redis.del(key);
+        },
+        async destroyAllForUser(userId) {
+            const userKey = `${USER_SESSIONS_PREFIX}${userId}`;
+            const sessionIds = await redis.smembers(userKey);
+            if (sessionIds.length > 0) {
+                const keys = sessionIds.map((id) => `${KEY_PREFIX}${id}`);
+                await redis.del(...keys);
+            }
+            await redis.del(userKey);
+        },
+    };
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":";;;;;AAeA,gDA8DC;AA7ED,sDAA4B;AAC5B,+BAAoC;AAGpC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AACrC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AASvD,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,IAAI,iBAAK,CAAC,QAAQ,CAAC,CAAC;IAElC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,WAAwB;YACnC,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAE/C,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;YAExD,kDAAkD;YAClD,MAAM,OAAO,GAAG,GAAG,oBAAoB,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAEjD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAiB;YACzB,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;YAEhD,uBAAuB;YACvB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;YAExC,6CAA6C;YAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;gBAChD,MAAM,OAAO,GAAG,GAAG,oBAAoB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;YACpC,MAAM,OAAO,GAAG,GAAG,oBAAoB,GAAG,MAAM,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,CAAC;YAED,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,50 @@
+export interface EngineUser {
+    id: string;
+    email: string;
+    name: string | null;
+    role: 'user' | 'admin';
+    subscriptionTier: string | null;
+    midtransCustomerId: string | null;
+    emailVerified: boolean;
+}
+export interface ApiKey {
+    id: string;
+    key: string;
+    userId: string;
+    productSlug: string;
+    scopes: string[];
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+    createdAt: Date;
+}
+export interface SessionData {
+    userId: string;
+    email: string;
+    role: string;
+    productSlug: string;
+    expiresAt: number;
+}
+export interface JwtPayload {
+    userId: string;
+    email: string;
+    role: string;
+    subscriptionTier: string | null;
+}
+export interface AuthConfig {
+    jwtSecret: string;
+    jwtRefreshSecret: string;
+    jwtExpiresIn?: string;
+    jwtRefreshExpiresIn?: string;
+    redisUrl?: string;
+    google?: {
+        clientId: string;
+        clientSecret: string;
+        callbackUrl: string;
+    };
+    github?: {
+        clientId: string;
+        clientSecret: string;
+        callbackUrl: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@forjio/engine-auth",
+  "version": "0.1.0",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "jsonwebtoken": "^9.0.2",
+    "bcryptjs": "^2.4.3",
+    "passport": "^0.7.0",
+    "passport-google-oauth20": "^2.0.0",
+    "passport-github2": "^0.1.12",
+    "ioredis": "^5.3.2",
+    "express": "^4.18.2",
+    "uuid": "^9.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.2.0",
+    "@types/jsonwebtoken": "^9.0.5",
+    "@types/bcryptjs": "^2.4.6",
+    "@types/passport": "^1.0.16",
+    "@types/passport-google-oauth20": "^2.0.14",
+    "@types/passport-github2": "^1.2.9",
+    "@types/express": "^4.17.21",
+    "@types/uuid": "^9.0.7",
+    "vitest": "^2.1.8"
+  }
+}

package/src/__tests__/api-keys.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect } from 'vitest';
+import {
+  generateApiKey,
+  hashApiKey,
+  validateApiKeyFormat,
+  createApiKeyPair,
+} from '../api-keys';
+
+describe('api-keys', () => {
+  describe('generateApiKey', () => {
+    it('should generate key with ek_ prefix', () => {
+      const key = generateApiKey();
+      expect(key.startsWith('ek_')).toBe(true);
+    });
+
+    it('should generate unique keys', () => {
+      const key1 = generateApiKey();
+      const key2 = generateApiKey();
+      expect(key1).not.toBe(key2);
+    });
+
+    it('should generate key of expected length', () => {
+      const key = generateApiKey();
+      // ek_ prefix (3) + 32 bytes hex encoded (64) = 67 chars
+      expect(key.length).toBe(67);
+    });
+
+    it('should accept a custom prefix', () => {
+      const key = generateApiKey('custom_');
+      expect(key.startsWith('custom_')).toBe(true);
+    });
+  });
+
+  describe('hashApiKey', () => {
+    it('should return consistent hash for same key', () => {
+      const key = 'ek_abc123';
+      const hash1 = hashApiKey(key);
+      const hash2 = hashApiKey(key);
+      expect(hash1).toBe(hash2);
+    });
+
+    it('should return different hash for different key', () => {
+      const hash1 = hashApiKey('ek_key1');
+      const hash2 = hashApiKey('ek_key2');
+      expect(hash1).not.toBe(hash2);
+    });
+
+    it('should not be reversible (hash !== key)', () => {
+      const key = generateApiKey();
+      const hash = hashApiKey(key);
+      expect(hash).not.toBe(key);
+      expect(hash).not.toContain('ek_');
+    });
+  });
+
+  describe('validateApiKeyFormat', () => {
+    it('should accept valid ek_ prefixed key', () => {
+      const key = generateApiKey();
+      expect(validateApiKeyFormat(key)).toBe(true);
+    });
+
+    it('should reject key without prefix', () => {
+      const hex = 'a'.repeat(64);
+      expect(validateApiKeyFormat(hex)).toBe(false);
+    });
+
+    it('should reject empty string', () => {
+      expect(validateApiKeyFormat('')).toBe(false);
+    });
+
+    it('should reject key with wrong length', () => {
+      expect(validateApiKeyFormat('ek_tooshort')).toBe(false);
+    });
+
+    it('should reject key with non-hex characters', () => {
+      const badKey = 'ek_' + 'z'.repeat(64);
+      expect(validateApiKeyFormat(badKey)).toBe(false);
+    });
+  });
+
+  describe('createApiKeyPair', () => {
+    it('should return both plain key and hash', () => {
+      const pair = createApiKeyPair();
+      expect(pair.plainKey).toBeDefined();
+      expect(pair.hashedKey).toBeDefined();
+      expect(pair.plainKey).not.toBe(pair.hashedKey);
+    });
+
+    it('should return hash that matches hashing the plain key', () => {
+      const pair = createApiKeyPair();
+      expect(hashApiKey(pair.plainKey)).toBe(pair.hashedKey);
+    });
+  });
+});

package/src/__tests__/helpers/express-mock.ts

@@ -0,0 +1,47 @@
+import { vi } from 'vitest';
+
+/**
+ * Creates a mock Express Request object.
+ */
+export function createMockReq(overrides: Record<string, unknown> = {}) {
+  return {
+    headers: {},
+    authUser: undefined,
+    apiKey: undefined,
+    ...overrides,
+  } as any;
+}
+
+/**
+ * Creates a mock Express Response object with chainable methods.
+ */
+export function createMockRes() {
+  const res: any = {
+    statusCode: 200,
+    _json: null as unknown,
+  };
+
+  res.status = vi.fn((code: number) => {
+    res.statusCode = code;
+    return res;
+  });
+
+  res.json = vi.fn((data: unknown) => {
+    res._json = data;
+    return res;
+  });
+
+  res.send = vi.fn((data: unknown) => {
+    res._json = data;
+    return res;
+  });
+
+  return res;
+}
+
+/**
+ * Creates a mock Express next function.
+ */
+export function createMockNext() {
+  return vi.fn();
+}

package/src/__tests__/helpers/redis-mock.ts

@@ -0,0 +1,65 @@
+/**
+ * In-memory Redis mock for testing session store.
+ * Implements the subset of ioredis methods used by session.ts.
+ */
+export class RedisMock {
+  private store = new Map<string, string>();
+  private sets = new Map<string, Set<string>>();
+  private ttls = new Map<string, number>();
+
+  async get(key: string): Promise<string | null> {
+    return this.store.get(key) ?? null;
+  }
+
+  async setex(key: string, ttl: number, value: string): Promise<'OK'> {
+    this.store.set(key, value);
+    this.ttls.set(key, ttl);
+    return 'OK';
+  }
+
+  async del(...keys: string[]): Promise<number> {
+    let count = 0;
+    for (const key of keys) {
+      if (this.store.delete(key)) count++;
+      this.sets.delete(key);
+      this.ttls.delete(key);
+    }
+    return count;
+  }
+
+  async sadd(key: string, ...members: string[]): Promise<number> {
+    if (!this.sets.has(key)) this.sets.set(key, new Set());
+    const set = this.sets.get(key)!;
+    let added = 0;
+    for (const m of members) {
+      if (!set.has(m)) { set.add(m); added++; }
+    }
+    return added;
+  }
+
+  async srem(key: string, ...members: string[]): Promise<number> {
+    const set = this.sets.get(key);
+    if (!set) return 0;
+    let removed = 0;
+    for (const m of members) {
+      if (set.delete(m)) removed++;
+    }
+    return removed;
+  }
+
+  async smembers(key: string): Promise<string[]> {
+    const set = this.sets.get(key);
+    return set ? Array.from(set) : [];
+  }
+
+  async expire(_key: string, _seconds: number): Promise<number> {
+    return 1;
+  }
+
+  /** Helper: clear all data between tests */
+  clear(): void {
+    this.store.clear();
+    this.sets.clear();
+    this.ttls.clear();
+  }
+}

package/src/__tests__/jwt.test.ts

@@ -0,0 +1,122 @@
+import { describe, it, expect } from 'vitest';
+import jwt from 'jsonwebtoken';
+import {
+  signAccessToken,
+  verifyAccessToken,
+  signRefreshToken,
+  verifyRefreshToken,
+  signRememberMeToken,
+} from '../jwt';
+import { AuthConfig, JwtPayload } from '../types';
+
+const TEST_CONFIG: AuthConfig = {
+  jwtSecret: 'test-access-secret-key-for-testing',
+  jwtRefreshSecret: 'test-refresh-secret-key-for-testing',
+};
+
+const TEST_PAYLOAD: JwtPayload = {
+  userId: 'user-123',
+  email: 'test@example.com',
+  role: 'user',
+  subscriptionTier: 'pro',
+};
+
+describe('jwt', () => {
+  describe('signAccessToken', () => {
+    it('should sign a valid JWT with correct expiry', () => {
+      const token = signAccessToken(TEST_PAYLOAD, TEST_CONFIG);
+
+      expect(token).toBeDefined();
+      expect(typeof token).toBe('string');
+
+      const decoded = jwt.decode(token) as jwt.JwtPayload;
+      expect(decoded.exp).toBeDefined();
+      // Default expiry is 15 minutes (900s)
+      const expectedExpiry = decoded.iat! + 900;
+      expect(decoded.exp).toBe(expectedExpiry);
+    });
+
+    it('should include userId, email, role in payload', () => {
+      const token = signAccessToken(TEST_PAYLOAD, TEST_CONFIG);
+      const decoded = jwt.decode(token) as jwt.JwtPayload;
+
+      expect(decoded.userId).toBe('user-123');
+      expect(decoded.email).toBe('test@example.com');
+      expect(decoded.role).toBe('user');
+      expect(decoded.subscriptionTier).toBe('pro');
+    });
+
+    it('should use custom expiry when configured', () => {
+      const config: AuthConfig = {
+        ...TEST_CONFIG,
+        jwtExpiresIn: '1h',
+      };
+
+      const token = signAccessToken(TEST_PAYLOAD, config);
+      const decoded = jwt.decode(token) as jwt.JwtPayload;
+
+      // 1 hour = 3600 seconds
+      const expectedExpiry = decoded.iat! + 3600;
+      expect(decoded.exp).toBe(expectedExpiry);
+    });
+  });
+
+  describe('verifyAccessToken', () => {
+    it('should verify and return payload for valid token', () => {
+      const token = signAccessToken(TEST_PAYLOAD, TEST_CONFIG);
+      const result = verifyAccessToken(token, TEST_CONFIG);
+
+      expect(result.userId).toBe('user-123');
+      expect(result.email).toBe('test@example.com');
+      expect(result.role).toBe('user');
+      expect(result.subscriptionTier).toBe('pro');
+    });
+
+    it('should throw for expired token', () => {
+      const expiredToken = jwt.sign(TEST_PAYLOAD, TEST_CONFIG.jwtSecret, {
+        expiresIn: -10, // already expired
+      });
+
+      expect(() => verifyAccessToken(expiredToken, TEST_CONFIG)).toThrow();
+    });
+
+    it('should throw for invalid signature', () => {
+      const token = jwt.sign(TEST_PAYLOAD, 'wrong-secret', {
+        expiresIn: 900,
+      });
+
+      expect(() => verifyAccessToken(token, TEST_CONFIG)).toThrow();
+    });
+
+    it('should throw for malformed token', () => {
+      expect(() => verifyAccessToken('not-a-jwt', TEST_CONFIG)).toThrow();
+    });
+  });
+
+  describe('signRefreshToken / verifyRefreshToken', () => {
+    it('should sign with refresh secret', () => {
+      const token = signRefreshToken(TEST_PAYLOAD, TEST_CONFIG);
+      const result = verifyRefreshToken(token, TEST_CONFIG);
+
+      expect(result.userId).toBe('user-123');
+      expect(result.email).toBe('test@example.com');
+    });
+
+    it('should reject access token verified with refresh secret', () => {
+      const accessToken = signAccessToken(TEST_PAYLOAD, TEST_CONFIG);
+
+      expect(() => verifyRefreshToken(accessToken, TEST_CONFIG)).toThrow();
+    });
+  });
+
+  describe('signRememberMeToken', () => {
+    it('should have 30d expiry', () => {
+      const token = signRememberMeToken(TEST_PAYLOAD, TEST_CONFIG);
+      const decoded = jwt.decode(token) as jwt.JwtPayload;
+
+      // 30 days = 2592000 seconds
+      const expectedExpiry = decoded.iat! + 30 * 24 * 60 * 60;
+      expect(decoded.exp).toBe(expectedExpiry);
+    });
+  });
+});