@futdevpro/nts-dynamo 1.15.157 → 1.15.163

package/src/_modules/oauth2/_routes/oauth2.controller.ts

@@ -1,99 +0,0 @@
-import { Request, Response } from 'express';
-import { DyFM_HttpCallType } from '@futdevpro/fsm-dynamo';
-import { DyNTS_Controller } from '../../../_services/route/controller.service';
-import { DyNTS_Endpoint_Params } from '../../../_models/control-models/endpoint-params.control-model';
-import { DyNTS_OAuth2_AuthService } from '../_services/oauth2.auth-service';
-import { DyNTS_OAuth2_ControlService } from '../_services/oauth2.control-service';
-
-/**
- * OAuth2 Controller implementation
- * 
- * This controller handles OAuth2 specific endpoints and authentication flows
- * 
- * @example
- * const oauth2Controller = DyNTS_OAuth2_Controller.getInstance();
- * oauth2Controller.setupEndpoints();
- */
-export class DyNTS_OAuth2_Controller extends DyNTS_Controller {
-  static getInstance(): DyNTS_OAuth2_Controller {
-    return DyNTS_OAuth2_Controller.getSingletonInstance();
-  }
-
-  private readonly authService: DyNTS_OAuth2_AuthService = DyNTS_OAuth2_AuthService.getInstance();
-  private readonly controlService: DyNTS_OAuth2_ControlService = DyNTS_OAuth2_ControlService.getInstance();
-
-  setupEndpoints(): void {
-    this.endpoints = [
-      new DyNTS_Endpoint_Params({
-        name: 'authorize',
-        type: DyFM_HttpCallType.get,
-        endpoint: '/oauth2/authorize',
-        tasks: [
-          async (req: Request, res: Response): Promise<void> => {
-            // TODO: Implement OAuth2 authorization endpoint
-            // 1. Validate client_id and redirect_uri
-            // 2. Check if user is already authenticated
-            // 3. If not authenticated, redirect to login page
-            // 4. If authenticated, show consent page
-            // 5. Handle user consent
-            // 6. Generate authorization code or access token
-            // 7. Redirect back to client with code/token
-            await this.controlService.handleAuthorizationRequest(req, res);
-          },
-        ],
-      }),
-
-      new DyNTS_Endpoint_Params({
-        name: 'token',
-        type: DyFM_HttpCallType.post,
-        endpoint: '/oauth2/token',
-        tasks: [
-          async (req: Request, res: Response): Promise<void> => {
-            // TODO: Implement OAuth2 token endpoint
-            // 1. Validate client credentials
-            // 2. Handle different grant types:
-            //    - authorization_code
-            //    - refresh_token
-            //    - client_credentials
-            //    - password
-            // 3. Generate appropriate tokens
-            // 4. Return token response
-            await this.controlService.handleTokenRequest(req, res);
-          },
-        ],
-      }),
-
-      new DyNTS_Endpoint_Params({
-        name: 'userinfo',
-        type: DyFM_HttpCallType.get,
-        endpoint: '/oauth2/userinfo',
-        preProcesses: [this.authService.authenticate_token],
-        tasks: [
-          async (req: Request, res: Response): Promise<void> => {
-            // TODO: Implement OAuth2 userinfo endpoint
-            // 1. Extract user information from token
-            // 2. Validate token scope
-            // 3. Return user information based on scope
-            await this.controlService.handleUserInfoRequest(req, res);
-          },
-        ],
-      }),
-
-      new DyNTS_Endpoint_Params({
-        name: 'revoke',
-        type: DyFM_HttpCallType.post,
-        endpoint: '/oauth2/revoke',
-        preProcesses: [this.authService.authenticate_token],
-        tasks: [
-          async (req: Request, res: Response): Promise<void> => {
-            // TODO: Implement OAuth2 token revocation endpoint
-            // 1. Validate token
-            // 2. Revoke token and any associated refresh tokens
-            // 3. Clear token from storage/cache
-            await this.controlService.handleTokenRevocation(req, res);
-          },
-        ],
-      }),
-    ];
-  }
-} 

package/src/_modules/oauth2/_services/oauth2.auth-service.spec.ts

@@ -1,254 +0,0 @@
-
-import { DyNTS_OAuth2_AuthService } from './oauth2.auth-service';
-import { DyNTS_OAuth2_ControlService } from './oauth2.control-service';
-import { Request, Response } from 'express';
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-import { DyNTS_global_settings } from '../../../_collections/global-settings.const';
-
-describe('| DyNTS_OAuth2_AuthService', () => {
-  let service: DyNTS_OAuth2_AuthService;
-  let mockControlService: jasmine.SpyObj<DyNTS_OAuth2_ControlService>;
-  let mockRequest: Partial<Request>;
-  let mockResponse: Partial<Response>;
-
-  beforeEach(() => {
-    // Reset singleton instances to prevent state leakage between tests
-    (DyNTS_OAuth2_ControlService as any).instance = undefined;
-    (DyNTS_OAuth2_AuthService as any).instance = undefined;
-
-    // Mock the ControlService.getInstance() to prevent circular dependency
-    mockControlService = jasmine.createSpyObj('DyNTS_OAuth2_ControlService', [
-      'getAccessTokenData',
-      'getRefreshTokenData',
-      'getClient',
-      'getUser',
-      'validateClientCredentials',
-      'validateUserCredentials',
-    ]);
-    spyOn(DyNTS_OAuth2_ControlService, 'getInstance').and.returnValue(mockControlService);
-
-    // Now we can safely get the AuthService instance
-    service = DyNTS_OAuth2_AuthService.getInstance();
-    
-    // Replace the controlService with our mock
-    (service as any).controlService = mockControlService;
-
-    mockRequest = {
-      headers: {},
-    };
-
-    mockResponse = {
-      setHeader: jasmine.createSpy('setHeader'),
-    };
-  });
-
-  it('| should be a singleton instance', () => {
-    const instance1 = DyNTS_OAuth2_AuthService.getInstance();
-    const instance2 = DyNTS_OAuth2_AuthService.getInstance();
-
-    expect(instance1).toBe(instance2);
-    expect(instance1).toBeInstanceOf(DyNTS_OAuth2_AuthService);
-  });
-
-  describe('| authenticate_token', () => {
-    it('| should authenticate valid token', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      spyOn(service, 'getTokenFromRequest').and.returnValue('Bearer valid-token-123');
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() + 3600000, // 1 hour from now
-      });
-
-      await service.authenticate_token(mockRequest as Request, mockResponse as Response);
-
-      expect(mockControlService.getAccessTokenData).toHaveBeenCalledWith('valid-token-123');
-      expect(mockResponse.setHeader).toHaveBeenCalledWith('authorization', 'Bearer valid-token-123');
-    });
-
-    it('| should throw error when token format is invalid', async () => {
-      mockRequest.headers = {
-        authorization: 'InvalidFormat token',
-      };
-
-      await expectAsync(
-        service.authenticate_token(mockRequest as Request, mockResponse as Response)
-      ).toBeRejected();
-    });
-
-    it('| should throw error when token is missing', async () => {
-      mockRequest.headers = {};
-
-      await expectAsync(
-        service.authenticate_token(mockRequest as Request, mockResponse as Response)
-      ).toBeRejected();
-    });
-
-    it('| should throw error when token is expired', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer expired-token',
-      };
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() - 1000, // Expired
-      });
-
-      await expectAsync(
-        service.authenticate_token(mockRequest as Request, mockResponse as Response)
-      ).toBeRejected();
-    });
-
-    it('| should throw error when token data is not found', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer invalid-token',
-      };
-      mockControlService.getAccessTokenData.and.returnValue(null);
-
-      await expectAsync(
-        service.authenticate_token(mockRequest as Request, mockResponse as Response)
-      ).toBeRejected();
-    });
-  });
-
-  describe('| authenticate_tokenSelf', () => {
-    it('| should authenticate valid token for self', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      mockRequest.params = {
-        userId: 'client-123',
-      };
-      spyOn(service, 'getTokenFromRequest').and.returnValue('Bearer valid-token-123');
-      spyOn(service, 'getIssuerFromRequest').and.returnValue('client-123');
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() + 3600000,
-      } as any);
-
-      await service.authenticate_tokenSelf(mockRequest as Request, mockResponse as Response);
-
-      expect(mockControlService.getAccessTokenData).toHaveBeenCalledWith('valid-token-123');
-      expect(mockResponse.setHeader).toHaveBeenCalledWith('authorization', 'Bearer valid-token-123');
-    });
-
-    it('| should throw error when userId does not match', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      mockRequest.params = {
-        userId: 'user-456',
-      };
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() + 3600000,
-      } as any);
-
-      await expectAsync(
-        service.authenticate_tokenSelf(mockRequest as Request, mockResponse as Response)
-      ).toBeRejected();
-    });
-  });
-
-  describe('| authenticate_tokenPerm_accUsageData', () => {
-    it('| should authenticate token with usage data permission', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      spyOn(service, 'getTokenFromRequest').and.returnValue('Bearer valid-token-123');
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'usage_data read',
-        expiresAt: Date.now() + 3600000,
-      } as any);
-
-      await service.authenticate_tokenPerm_accUsageData(mockRequest as Request, mockResponse as Response);
-
-      expect(mockResponse.setHeader).toHaveBeenCalledWith('authorization', 'Bearer valid-token-123');
-    });
-
-    it('| should throw error when permission is missing', async () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() + 3600000,
-      } as any);
-
-      await expectAsync(
-        service.authenticate_tokenPerm_accUsageData(mockRequest as Request, mockResponse as Response)
-      ).toBeRejected();
-    });
-  });
-
-  describe('| getIssuerFromRequest', () => {
-    it('| should return issuer from valid token', () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      spyOn(service, 'getTokenFromRequest').and.returnValue('Bearer valid-token-123');
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() + 3600000,
-      } as any);
-
-      const result = service.getIssuerFromRequest(mockRequest as Request);
-
-      expect(result).toBe('client-123');
-    });
-
-    it('| should return undefined when token is missing', () => {
-      mockRequest.headers = {};
-
-      const result = service.getIssuerFromRequest(mockRequest as Request);
-
-      expect(result).toBeUndefined();
-    });
-
-    it('| should return undefined when token data is not found', () => {
-      mockRequest.headers = {
-        authorization: 'Bearer invalid-token',
-      };
-      mockControlService.getAccessTokenData.and.returnValue(null);
-
-      const result = service.getIssuerFromRequest(mockRequest as Request);
-
-      expect(result).toBeUndefined();
-    });
-  });
-
-  describe('| getUsernameFromRequest', () => {
-    it('| should return username from valid token', () => {
-      mockRequest.headers = {
-        authorization: 'Bearer valid-token-123',
-      };
-      spyOn(service, 'getTokenFromRequest').and.returnValue('Bearer valid-token-123');
-      mockControlService.getAccessTokenData.and.returnValue({
-        clientId: 'client-123',
-        scope: 'read',
-        expiresAt: Date.now() + 3600000,
-      } as any);
-
-      const result = service.getUsernameFromRequest(mockRequest as Request);
-
-      // The implementation returns clientId as username (see TODO comment in code)
-      expect(result).toBe('client-123');
-    });
-
-    it('| should return undefined when token is missing', () => {
-      mockRequest.headers = {};
-
-      const result = service.getUsernameFromRequest(mockRequest as Request);
-
-      expect(result).toBeUndefined();
-    });
-  });
-});
-

package/src/_modules/oauth2/_services/oauth2.auth-service.ts

@@ -1,232 +0,0 @@
-import { Request, Response } from 'express';
-import { DyFM_Error, DyFM_Log } from '@futdevpro/fsm-dynamo';
-import { DyNTS_AuthService } from '../../../_services/core/auth.service';
-import { DyNTS_global_settings } from '../../../_collections/global-settings.const';
-import { DyNTS_OAuth2_ControlService } from './oauth2.control-service';
-
-/**
- * OAuth2 Authentication Service implementation
- * 
- * This service handles OAuth2 specific authentication flows and token management
- * 
- * @example
- * const authService = DyNTS_OAuth2_AuthService.getInstance();
- * await authService.authenticate_token(req, res);
- */
-export class DyNTS_OAuth2_AuthService extends DyNTS_AuthService {
-  static getInstance(): DyNTS_OAuth2_AuthService {
-    return DyNTS_OAuth2_AuthService.getSingletonInstance();
-  }
-
-  private readonly controlService: DyNTS_OAuth2_ControlService = DyNTS_OAuth2_ControlService.getInstance();
-
-  readonly authenticate_token = async (req: Request, res: Response): Promise<void> => {
-    try {
-      const token = this.getTokenFromRequest(req);
-      
-      // Validate token format
-      if (!token?.startsWith('Bearer ')) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT1`,
-          addECToUserMsg: true,
-          message: 'Invalid token format',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      
-      // Validate token against stored tokens
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      if (!tokenData || tokenData.expiresAt < Date.now()) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT2`,
-          addECToUserMsg: true,
-          message: 'Invalid or expired token',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Set token in response header
-      res.setHeader('authorization', `Bearer ${accessToken}`);
-    } catch (error) {
-      DyFM_Log.error('OAuth2 token authentication failed', error);
-      throw new DyFM_Error({
-        status: 401,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT0`,
-        addECToUserMsg: true,
-        message: 'OAuth2 token authentication failed',
-        userMessage: this.defaultErrorUserMsg,
-        issuerService: this.serviceName,
-        error
-      });
-    }
-  };
-
-  readonly authenticate_tokenSelf = async (req: Request, res: Response): Promise<void> => {
-    try {
-      const token = this.getTokenFromRequest(req);
-      
-      // Validate token format
-      if (!token || !token.startsWith('Bearer ')) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS1`,
-          addECToUserMsg: true,
-          message: 'Invalid token format',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      
-      // Validate token against stored tokens
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      if (!tokenData || tokenData.expiresAt < Date.now()) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS2`,
-          addECToUserMsg: true,
-          message: 'Invalid or expired token',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // For self-token validation, ensure the token is associated with the requesting user
-      const issuer = this.getIssuerFromRequest(req);
-      if (!issuer || issuer !== tokenData.clientId) {
-        throw new DyFM_Error({
-          status: 403,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS3`,
-          addECToUserMsg: true,
-          message: 'Token not associated with requesting user',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Set token in response header
-      res.setHeader('authorization', `Bearer ${accessToken}`);
-    } catch (error) {
-      DyFM_Log.error('OAuth2 self-token authentication failed', error);
-      throw new DyFM_Error({
-        status: 401,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS0`,
-        addECToUserMsg: true,
-        message: 'OAuth2 self-token authentication failed',
-        userMessage: this.defaultErrorUserMsg,
-        issuerService: this.serviceName,
-        error
-      });
-    }
-  };
-
-  readonly authenticate_tokenPerm_accUsageData = async (req: Request, res: Response): Promise<void> => {
-    try {
-      const token = this.getTokenFromRequest(req);
-      
-      // Validate token format
-      if (!token || !token.startsWith('Bearer ')) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU1`,
-          addECToUserMsg: true,
-          message: 'Invalid token format',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      
-      // Validate token against stored tokens
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      if (!tokenData || tokenData.expiresAt < Date.now()) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU2`,
-          addECToUserMsg: true,
-          message: 'Invalid or expired token',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Check if token has usage data permission
-      if (!tokenData.scope.includes('usage_data')) {
-        throw new DyFM_Error({
-          status: 403,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU3`,
-          addECToUserMsg: true,
-          message: 'Token does not have usage data permission',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Set token in response header
-      res.setHeader('authorization', `Bearer ${accessToken}`);
-    } catch (error) {
-      DyFM_Log.error('OAuth2 usage data permission check failed', error);
-      throw new DyFM_Error({
-        status: 401,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU0`,
-        addECToUserMsg: true,
-        message: 'OAuth2 usage data permission check failed',
-        userMessage: this.defaultErrorUserMsg,
-        issuerService: this.serviceName,
-        error
-      });
-    }
-  };
-
-  /**
-   * Gets the issuer (user ID) from the OAuth2 token in the request
-   * @param req Express Request object
-   * @returns The issuer ID from the token
-   */
-  getIssuerFromRequest(req: Request): string {
-    try {
-      const token = this.getTokenFromRequest(req);
-      if (!token || !token.startsWith('Bearer ')) {
-        return undefined;
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      
-      return tokenData?.clientId;
-    } catch {
-      return undefined;
-    }
-  }
-
-  /**
-   * Gets the username from the OAuth2 token in the request
-   * @param req Express Request object
-   * @returns The username from the token
-   */
-  getUsernameFromRequest(req: Request): string {
-    try {
-      const token = this.getTokenFromRequest(req);
-      if (!token || !token.startsWith('Bearer ')) {
-        return undefined;
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      
-      // TODO: Implement user information retrieval from database/storage
-      // For now, return the client ID as username
-      return tokenData?.clientId;
-    } catch {
-      return undefined;
-    }
-  }
-}