@futdevpro/nts-dynamo 1.15.74 → 1.15.78

package/src/_modules/oauth2/_services/oauth2.auth-service.ts

@@ -1,232 +1,232 @@
-import { Request, Response } from 'express';
-import { DyFM_Error, DyFM_Log } from '@futdevpro/fsm-dynamo';
-import { DyNTS_AuthService } from '../../../_services/core/auth.service';
-import { DyNTS_global_settings } from '../../../_collections/global-settings.const';
-import { DyNTS_OAuth2_ControlService } from './oauth2.control-service';
-
-/**
- * OAuth2 Authentication Service implementation
- * 
- * This service handles OAuth2 specific authentication flows and token management
- * 
- * @example
- * const authService = DyNTS_OAuth2_AuthService.getInstance();
- * await authService.authenticate_token(req, res);
- */
-export class DyNTS_OAuth2_AuthService extends DyNTS_AuthService {
-  static getInstance(): DyNTS_OAuth2_AuthService {
-    return DyNTS_OAuth2_AuthService.getSingletonInstance();
-  }
-
-  private readonly controlService: DyNTS_OAuth2_ControlService = DyNTS_OAuth2_ControlService.getInstance();
-
-  readonly authenticate_token = async (req: Request, res: Response): Promise<void> => {
-    try {
-      const token = this.getTokenFromRequest(req);
-      
-      // Validate token format
-      if (!token?.startsWith('Bearer ')) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT1`,
-          addECToUserMsg: true,
-          message: 'Invalid token format',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      
-      // Validate token against stored tokens
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      if (!tokenData || tokenData.expiresAt < Date.now()) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT2`,
-          addECToUserMsg: true,
-          message: 'Invalid or expired token',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Set token in response header
-      res.setHeader('authorization', `Bearer ${accessToken}`);
-    } catch (error) {
-      DyFM_Log.error('OAuth2 token authentication failed', error);
-      throw new DyFM_Error({
-        status: 401,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT0`,
-        addECToUserMsg: true,
-        message: 'OAuth2 token authentication failed',
-        userMessage: this.defaultErrorUserMsg,
-        issuerService: this.serviceName,
-        error
-      });
-    }
-  };
-
-  readonly authenticate_tokenSelf = async (req: Request, res: Response): Promise<void> => {
-    try {
-      const token = this.getTokenFromRequest(req);
-      
-      // Validate token format
-      if (!token || !token.startsWith('Bearer ')) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS1`,
-          addECToUserMsg: true,
-          message: 'Invalid token format',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      
-      // Validate token against stored tokens
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      if (!tokenData || tokenData.expiresAt < Date.now()) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS2`,
-          addECToUserMsg: true,
-          message: 'Invalid or expired token',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // For self-token validation, ensure the token is associated with the requesting user
-      const issuer = this.getIssuerFromRequest(req);
-      if (!issuer || issuer !== tokenData.clientId) {
-        throw new DyFM_Error({
-          status: 403,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS3`,
-          addECToUserMsg: true,
-          message: 'Token not associated with requesting user',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Set token in response header
-      res.setHeader('authorization', `Bearer ${accessToken}`);
-    } catch (error) {
-      DyFM_Log.error('OAuth2 self-token authentication failed', error);
-      throw new DyFM_Error({
-        status: 401,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS0`,
-        addECToUserMsg: true,
-        message: 'OAuth2 self-token authentication failed',
-        userMessage: this.defaultErrorUserMsg,
-        issuerService: this.serviceName,
-        error
-      });
-    }
-  };
-
-  readonly authenticate_tokenPerm_accUsageData = async (req: Request, res: Response): Promise<void> => {
-    try {
-      const token = this.getTokenFromRequest(req);
-      
-      // Validate token format
-      if (!token || !token.startsWith('Bearer ')) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU1`,
-          addECToUserMsg: true,
-          message: 'Invalid token format',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      
-      // Validate token against stored tokens
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      if (!tokenData || tokenData.expiresAt < Date.now()) {
-        throw new DyFM_Error({
-          status: 401,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU2`,
-          addECToUserMsg: true,
-          message: 'Invalid or expired token',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Check if token has usage data permission
-      if (!tokenData.scope.includes('usage_data')) {
-        throw new DyFM_Error({
-          status: 403,
-          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU3`,
-          addECToUserMsg: true,
-          message: 'Token does not have usage data permission',
-          userMessage: this.defaultErrorUserMsg,
-          issuerService: this.serviceName,
-        });
-      }
-
-      // Set token in response header
-      res.setHeader('authorization', `Bearer ${accessToken}`);
-    } catch (error) {
-      DyFM_Log.error('OAuth2 usage data permission check failed', error);
-      throw new DyFM_Error({
-        status: 401,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU0`,
-        addECToUserMsg: true,
-        message: 'OAuth2 usage data permission check failed',
-        userMessage: this.defaultErrorUserMsg,
-        issuerService: this.serviceName,
-        error
-      });
-    }
-  };
-
-  /**
-   * Gets the issuer (user ID) from the OAuth2 token in the request
-   * @param req Express Request object
-   * @returns The issuer ID from the token
-   */
-  getIssuerFromRequest(req: Request): string {
-    try {
-      const token = this.getTokenFromRequest(req);
-      if (!token || !token.startsWith('Bearer ')) {
-        return undefined;
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      
-      return tokenData?.clientId;
-    } catch {
-      return undefined;
-    }
-  }
-
-  /**
-   * Gets the username from the OAuth2 token in the request
-   * @param req Express Request object
-   * @returns The username from the token
-   */
-  getUsernameFromRequest(req: Request): string {
-    try {
-      const token = this.getTokenFromRequest(req);
-      if (!token || !token.startsWith('Bearer ')) {
-        return undefined;
-      }
-
-      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
-      const tokenData = this.controlService.getAccessTokenData(accessToken);
-      
-      // TODO: Implement user information retrieval from database/storage
-      // For now, return the client ID as username
-      return tokenData?.clientId;
-    } catch {
-      return undefined;
-    }
-  }
-}
+import { Request, Response } from 'express';
+import { DyFM_Error, DyFM_Log } from '@futdevpro/fsm-dynamo';
+import { DyNTS_AuthService } from '../../../_services/core/auth.service';
+import { DyNTS_global_settings } from '../../../_collections/global-settings.const';
+import { DyNTS_OAuth2_ControlService } from './oauth2.control-service';
+
+/**
+ * OAuth2 Authentication Service implementation
+ * 
+ * This service handles OAuth2 specific authentication flows and token management
+ * 
+ * @example
+ * const authService = DyNTS_OAuth2_AuthService.getInstance();
+ * await authService.authenticate_token(req, res);
+ */
+export class DyNTS_OAuth2_AuthService extends DyNTS_AuthService {
+  static getInstance(): DyNTS_OAuth2_AuthService {
+    return DyNTS_OAuth2_AuthService.getSingletonInstance();
+  }
+
+  private readonly controlService: DyNTS_OAuth2_ControlService = DyNTS_OAuth2_ControlService.getInstance();
+
+  readonly authenticate_token = async (req: Request, res: Response): Promise<void> => {
+    try {
+      const token = this.getTokenFromRequest(req);
+      
+      // Validate token format
+      if (!token?.startsWith('Bearer ')) {
+        throw new DyFM_Error({
+          status: 401,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT1`,
+          addECToUserMsg: true,
+          message: 'Invalid token format',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
+      
+      // Validate token against stored tokens
+      const tokenData = this.controlService.getAccessTokenData(accessToken);
+      if (!tokenData || tokenData.expiresAt < Date.now()) {
+        throw new DyFM_Error({
+          status: 401,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT2`,
+          addECToUserMsg: true,
+          message: 'Invalid or expired token',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      // Set token in response header
+      res.setHeader('authorization', `Bearer ${accessToken}`);
+    } catch (error) {
+      DyFM_Log.error('OAuth2 token authentication failed', error);
+      throw new DyFM_Error({
+        status: 401,
+        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-AT0`,
+        addECToUserMsg: true,
+        message: 'OAuth2 token authentication failed',
+        userMessage: this.defaultErrorUserMsg,
+        issuerService: this.serviceName,
+        error
+      });
+    }
+  };
+
+  readonly authenticate_tokenSelf = async (req: Request, res: Response): Promise<void> => {
+    try {
+      const token = this.getTokenFromRequest(req);
+      
+      // Validate token format
+      if (!token || !token.startsWith('Bearer ')) {
+        throw new DyFM_Error({
+          status: 401,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS1`,
+          addECToUserMsg: true,
+          message: 'Invalid token format',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
+      
+      // Validate token against stored tokens
+      const tokenData = this.controlService.getAccessTokenData(accessToken);
+      if (!tokenData || tokenData.expiresAt < Date.now()) {
+        throw new DyFM_Error({
+          status: 401,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS2`,
+          addECToUserMsg: true,
+          message: 'Invalid or expired token',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      // For self-token validation, ensure the token is associated with the requesting user
+      const issuer = this.getIssuerFromRequest(req);
+      if (!issuer || issuer !== tokenData.clientId) {
+        throw new DyFM_Error({
+          status: 403,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS3`,
+          addECToUserMsg: true,
+          message: 'Token not associated with requesting user',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      // Set token in response header
+      res.setHeader('authorization', `Bearer ${accessToken}`);
+    } catch (error) {
+      DyFM_Log.error('OAuth2 self-token authentication failed', error);
+      throw new DyFM_Error({
+        status: 401,
+        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATS0`,
+        addECToUserMsg: true,
+        message: 'OAuth2 self-token authentication failed',
+        userMessage: this.defaultErrorUserMsg,
+        issuerService: this.serviceName,
+        error
+      });
+    }
+  };
+
+  readonly authenticate_tokenPerm_accUsageData = async (req: Request, res: Response): Promise<void> => {
+    try {
+      const token = this.getTokenFromRequest(req);
+      
+      // Validate token format
+      if (!token || !token.startsWith('Bearer ')) {
+        throw new DyFM_Error({
+          status: 401,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU1`,
+          addECToUserMsg: true,
+          message: 'Invalid token format',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
+      
+      // Validate token against stored tokens
+      const tokenData = this.controlService.getAccessTokenData(accessToken);
+      if (!tokenData || tokenData.expiresAt < Date.now()) {
+        throw new DyFM_Error({
+          status: 401,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU2`,
+          addECToUserMsg: true,
+          message: 'Invalid or expired token',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      // Check if token has usage data permission
+      if (!tokenData.scope.includes('usage_data')) {
+        throw new DyFM_Error({
+          status: 403,
+          errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU3`,
+          addECToUserMsg: true,
+          message: 'Token does not have usage data permission',
+          userMessage: this.defaultErrorUserMsg,
+          issuerService: this.serviceName,
+        });
+      }
+
+      // Set token in response header
+      res.setHeader('authorization', `Bearer ${accessToken}`);
+    } catch (error) {
+      DyFM_Log.error('OAuth2 usage data permission check failed', error);
+      throw new DyFM_Error({
+        status: 401,
+        errorCode: `${DyNTS_global_settings.systemShortCodeName}|DyNTS-OA2-ATU0`,
+        addECToUserMsg: true,
+        message: 'OAuth2 usage data permission check failed',
+        userMessage: this.defaultErrorUserMsg,
+        issuerService: this.serviceName,
+        error
+      });
+    }
+  };
+
+  /**
+   * Gets the issuer (user ID) from the OAuth2 token in the request
+   * @param req Express Request object
+   * @returns The issuer ID from the token
+   */
+  getIssuerFromRequest(req: Request): string {
+    try {
+      const token = this.getTokenFromRequest(req);
+      if (!token || !token.startsWith('Bearer ')) {
+        return undefined;
+      }
+
+      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
+      const tokenData = this.controlService.getAccessTokenData(accessToken);
+      
+      return tokenData?.clientId;
+    } catch {
+      return undefined;
+    }
+  }
+
+  /**
+   * Gets the username from the OAuth2 token in the request
+   * @param req Express Request object
+   * @returns The username from the token
+   */
+  getUsernameFromRequest(req: Request): string {
+    try {
+      const token = this.getTokenFromRequest(req);
+      if (!token || !token.startsWith('Bearer ')) {
+        return undefined;
+      }
+
+      const accessToken = token.substring(7); // Remove 'Bearer ' prefix
+      const tokenData = this.controlService.getAccessTokenData(accessToken);
+      
+      // TODO: Implement user information retrieval from database/storage
+      // For now, return the client ID as username
+      return tokenData?.clientId;
+    } catch {
+      return undefined;
+    }
+  }
+}