@furystack/rest-service 11.0.7 → 12.1.0

package/src/helpers.spec.ts

@@ -1,21 +1,61 @@
+import { InMemoryStore, User, addStore } from '@furystack/core'
 import { getPort } from '@furystack/core/port-generator'
 import { Injector } from '@furystack/inject'
+import { getRepository } from '@furystack/repository'
+import { PasswordCredential, PasswordResetToken, usePasswordPolicy } from '@furystack/security'
 import { usingAsync } from '@furystack/utils'
 import { describe, expect, it } from 'vitest'
 import { ApiManager } from './api-manager.js'
 import { useHttpAuthentication, useProxy, useRestService, useStaticFiles } from './helpers.js'
 import { HttpAuthenticationSettings } from './http-authentication-settings.js'
+import { DefaultSession } from './models/default-session.js'
 import { ProxyManager } from './proxy-manager.js'
 import { StaticServerManager } from './static-server-manager.js'
 
+const setupAuthStores = (i: Injector) => {
+  addStore(i, new InMemoryStore({ model: User, primaryKey: 'username' }))
+    .addStore(new InMemoryStore({ model: DefaultSession, primaryKey: 'sessionId' }))
+    .addStore(new InMemoryStore({ model: PasswordCredential, primaryKey: 'userName' }))
+    .addStore(new InMemoryStore({ model: PasswordResetToken, primaryKey: 'token' }))
+  const repo = getRepository(i)
+  repo.createDataSet(User, 'username')
+  repo.createDataSet(DefaultSession, 'sessionId')
+  repo.createDataSet(PasswordCredential, 'userName')
+  repo.createDataSet(PasswordResetToken, 'token')
+  usePasswordPolicy(i)
+}
+
 describe('Injector extensions', () => {
   describe('useHttpAuthentication', () => {
     it('Should set up HTTP Authentication', async () => {
       await usingAsync(new Injector(), async (i) => {
+        setupAuthStores(i)
         useHttpAuthentication(i)
         expect(i.cachedSingletons.get(HttpAuthenticationSettings)).toBeDefined()
       })
     })
+
+    it('Should register basic-auth and cookie-auth providers by default', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        setupAuthStores(i)
+        useHttpAuthentication(i)
+        const settings = i.getInstance(HttpAuthenticationSettings)
+        const providerNames = settings.authenticationProviders.map((p) => p.name)
+        expect(providerNames).toContain('basic-auth')
+        expect(providerNames).toContain('cookie-auth')
+      })
+    })
+
+    it('Should not register basic-auth provider when disabled', async () => {
+      await usingAsync(new Injector(), async (i) => {
+        setupAuthStores(i)
+        useHttpAuthentication(i, { enableBasicAuth: false })
+        const settings = i.getInstance(HttpAuthenticationSettings)
+        const providerNames = settings.authenticationProviders.map((p) => p.name)
+        expect(providerNames).not.toContain('basic-auth')
+        expect(providerNames).toContain('cookie-auth')
+      })
+    })
   })
 
   describe('useRestService()', () => {

package/src/helpers.ts

@@ -1,8 +1,16 @@
 import type { User } from '@furystack/core'
+import { useSystemIdentityContext } from '@furystack/core'
 import type { Injector } from '@furystack/inject'
 import type { RestApi } from '@furystack/rest'
+import type { DataSet } from '@furystack/repository'
+import { PasswordAuthenticator } from '@furystack/security'
+
 import type { ImplementApiOptions } from './api-manager.js'
 import { ApiManager } from './api-manager.js'
+import type { AuthenticationProvider } from './authentication-providers/authentication-provider.js'
+import { createBasicAuthProvider } from './authentication-providers/basic-auth-provider.js'
+import { createCookieAuthProvider } from './authentication-providers/cookie-auth-provider.js'
+import { authenticateUserWithDataSet, findSessionById, findUserByName } from './authentication-providers/helpers.js'
 import { HttpAuthenticationSettings } from './http-authentication-settings.js'
 import type { DefaultSession } from './models/default-session.js'
 import type { ProxyOptions } from './proxy-manager.js'
@@ -19,15 +27,52 @@ export const useRestService = async <T extends RestApi>(api: ImplementApiOptions
   await api.injector.getInstance(ApiManager).addApi({ ...api })
 
 /**
- * Sets up the HTTP Authentication
+ * Sets up the HTTP Authentication with pluggable providers.
+ *
+ * Registers Basic Auth (if enabled) and Cookie Auth as built-in providers,
+ * then appends any custom providers passed via settings.
+ *
  * @param injector  The Injector instance
  * @param settings Settings for HTTP Authentication
- * @returns void
  */
 export const useHttpAuthentication = <TUser extends User, TSession extends DefaultSession>(
   injector: Injector,
   settings?: Partial<HttpAuthenticationSettings<TUser, TSession>>,
-) => injector.setExplicitInstance(Object.assign(new HttpAuthenticationSettings(), settings), HttpAuthenticationSettings)
+) => {
+  const mergedSettings = Object.assign(new HttpAuthenticationSettings<TUser, TSession>(), settings)
+  const systemInjector = useSystemIdentityContext({ injector, username: 'useHttpAuthentication' })
+  const passwordAuthenticator = injector.getInstance(PasswordAuthenticator)
+  const userDataSet = mergedSettings.getUserDataSet(systemInjector)
+  // Narrow from DataSet<TSession, keyof TSession> to DataSet<DefaultSession, 'sessionId'>
+  // because the built-in providers operate on DefaultSession with the concrete 'sessionId' key
+  const sessionDataSet = mergedSettings.getSessionDataSet(systemInjector) as unknown as DataSet<
+    DefaultSession,
+    'sessionId'
+  >
+
+  const providers: AuthenticationProvider[] = []
+
+  if (mergedSettings.enableBasicAuth) {
+    providers.push(
+      createBasicAuthProvider((username, password) =>
+        authenticateUserWithDataSet(passwordAuthenticator, userDataSet, systemInjector, username, password),
+      ),
+    )
+  }
+
+  providers.push(
+    createCookieAuthProvider(
+      mergedSettings.cookieName,
+      (sessionId) => findSessionById(sessionDataSet, systemInjector, sessionId),
+      (username) => findUserByName(userDataSet, systemInjector, username),
+    ),
+  )
+
+  providers.push(...(settings?.authenticationProviders ?? []))
+  mergedSettings.authenticationProviders = providers
+
+  injector.setExplicitInstance(mergedSettings, HttpAuthenticationSettings)
+}
 
 /**
  * Sets up a static file server

package/src/http-authentication-settings.ts

@@ -1,21 +1,30 @@
-import type { PhysicalStore, StoreManager } from '@furystack/core'
-import { User } from '@furystack/core'
-import type { Constructable } from '@furystack/inject'
-import { Injectable } from '@furystack/inject'
-import { DefaultSession } from './models/default-session.js'
-
-/**
- * Authentication settings object for FuryStack HTTP Api
- */
-@Injectable({ lifetime: 'singleton' })
-export class HttpAuthenticationSettings<TUser extends User, TSession extends DefaultSession> {
-  public model: Constructable<TUser> = User as Constructable<TUser>
-
-  public getUserStore = (sm: StoreManager) => sm.getStoreFor(User, 'username')
-
-  public getSessionStore: (storeManager: StoreManager) => PhysicalStore<TSession, keyof TSession> = (sm) =>
-    sm.getStoreFor(DefaultSession, 'sessionId') as unknown as PhysicalStore<TSession, keyof TSession>
-
-  public cookieName = 'fss'
-  public enableBasicAuth = true
-}
+import { User } from '@furystack/core'
+import type { Constructable, Injector } from '@furystack/inject'
+import { Injectable } from '@furystack/inject'
+import type { DataSet } from '@furystack/repository'
+import { getDataSetFor } from '@furystack/repository'
+import type { AuthenticationProvider } from './authentication-providers/authentication-provider.js'
+import { DefaultSession } from './models/default-session.js'
+
+/**
+ * Authentication settings object for FuryStack HTTP Api
+ */
+@Injectable({ lifetime: 'singleton' })
+export class HttpAuthenticationSettings<TUser extends User, TSession extends DefaultSession> {
+  public model: Constructable<TUser> = User as Constructable<TUser>
+
+  public getUserDataSet = (injector: Injector) => getDataSetFor(injector, User, 'username')
+
+  public getSessionDataSet: (injector: Injector) => DataSet<TSession, keyof TSession> = (injector) =>
+    getDataSetFor(injector, DefaultSession, 'sessionId') as unknown as DataSet<TSession, keyof TSession>
+
+  public cookieName = 'fss'
+  public enableBasicAuth = true
+
+  /**
+   * Ordered list of authentication providers. Populated by {@link useHttpAuthentication}
+   * and extended by `useJwtAuthentication()` or other auth plugins.
+   * Safe to mutate only during setup, before the first request is served.
+   */
+  public authenticationProviders: AuthenticationProvider[] = []
+}