@gasboost/auth 0.1.0

package/dist/api/AppsScriptAuthSession.d.ts

@@ -0,0 +1,10 @@
+import { SessionId } from "../domain/Session";
+import { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
+export declare class AppsScriptAuthSession {
+    private sessionStorage;
+    constructor({ sessionStorage, }: {
+        sessionStorage: AppsScriptSessionStorage;
+    });
+    get(sessionId: SessionId): Promise<import("../domain/Session").Session | null>;
+    cleanup(): Promise<void>;
+}

package/dist/api/AppsScriptAuthSession.js

@@ -0,0 +1,17 @@
+export class AppsScriptAuthSession {
+    sessionStorage;
+    constructor({ sessionStorage, }) {
+        this.sessionStorage = sessionStorage;
+    }
+    async get(sessionId) {
+        const session = await this.sessionStorage.get(sessionId);
+        if (session && session.isExpired(new Date())) {
+            await this.sessionStorage.delete(session.id);
+            return null;
+        }
+        return session;
+    }
+    async cleanup() {
+        await this.sessionStorage.cleanupExpired();
+    }
+}

package/dist/api/AppsScriptAuthSignIn.d.ts

@@ -0,0 +1,20 @@
+import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
+import { type AppsScriptCredential } from "../authentication/AppsScriptAuthentication";
+import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
+import { type EmailPasswordCredential } from "../authentication/EmailPasswordAuthentication";
+import { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
+import { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
+import { SignIn } from "./SignIn";
+export declare class AppsScriptAuthSignIn {
+    email: SignIn<EmailPasswordCredential>["execute"];
+    appsScript: SignIn<AppsScriptCredential>["execute"];
+    constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, session, utilities, }: {
+        sessionStorage: AppsScriptSessionStorage;
+        repository: AppsScriptAuthRepository;
+        emailPassword?: EmailPasswordAuthConfig;
+        appsScript?: AppsScriptAuthenticationConfig;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        session: GoogleAppsScript.Base.Session;
+        expiresIn: number;
+    });
+}

package/dist/api/AppsScriptAuthSignIn.js

@@ -0,0 +1,34 @@
+import { AppsScriptAuthentication, } from "../authentication/AppsScriptAuthentication";
+import { EmailPasswordAuthentication, } from "../authentication/EmailPasswordAuthentication";
+import { SignIn } from "./SignIn";
+export class AppsScriptAuthSignIn {
+    email;
+    appsScript;
+    constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, session, utilities, }) {
+        this.email = async (credential) => {
+            if (!emailPassword) {
+                throw new Error("Email and password authentication is disabled");
+            }
+            emailPassword.ensureSignInEnabled();
+            const emailSignIn = new SignIn({
+                sessionStorage,
+                authentication: new EmailPasswordAuthentication(repository, utilities, emailPassword),
+                utilities,
+                expiresIn,
+            });
+            return emailSignIn.execute(credential);
+        };
+        this.appsScript = async (credential) => {
+            if (!appsScript) {
+                throw new Error("Apps Script authentication is disabled");
+            }
+            appsScript.ensureSignInEnabled();
+            return new SignIn({
+                sessionStorage,
+                authentication: new AppsScriptAuthentication(repository, session),
+                utilities,
+                expiresIn,
+            }).execute(credential);
+        };
+    }
+}

package/dist/api/AppsScriptAuthSignOut.d.ts

@@ -0,0 +1,7 @@
+import type { SessionId } from "../domain/Session";
+import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
+export declare class AppsScriptAuthSignOut {
+    private readonly sessionStorage;
+    constructor(sessionStorage: AppsScriptSessionStorage);
+    execute(sessionId: SessionId): Promise<void>;
+}

package/dist/api/AppsScriptAuthSignOut.js

@@ -0,0 +1,9 @@
+export class AppsScriptAuthSignOut {
+    sessionStorage;
+    constructor(sessionStorage) {
+        this.sessionStorage = sessionStorage;
+    }
+    async execute(sessionId) {
+        await this.sessionStorage.delete(sessionId);
+    }
+}

package/dist/api/AppsScriptAuthSignUp.d.ts

@@ -0,0 +1,20 @@
+import type { AppsScriptAuthenticationConfig } from "../authentication/AppsScriptAuthentication";
+import type { EmailPasswordAuthConfig } from "../authentication/EmailPasswordAuthentication";
+import { type AppsScriptRegistrationInput } from "../registration/AppsScriptRegistration";
+import { type EmailPasswordRegistrationInput } from "../registration/EmailPasswordRegistration";
+import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
+import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
+import { SignUp } from "./SignUp";
+export declare class AppsScriptAuthSignUp {
+    email: SignUp<EmailPasswordRegistrationInput>["execute"];
+    appsScript: SignUp<AppsScriptRegistrationInput>["execute"];
+    constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, utilities, session, }: {
+        sessionStorage: AppsScriptSessionStorage;
+        expiresIn: number;
+        repository: AppsScriptAuthRepository;
+        emailPassword?: EmailPasswordAuthConfig;
+        appsScript?: AppsScriptAuthenticationConfig;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        session: GoogleAppsScript.Base.Session;
+    });
+}

package/dist/api/AppsScriptAuthSignUp.js

@@ -0,0 +1,35 @@
+import { AppsScriptRegistration, } from "../registration/AppsScriptRegistration";
+import { EmailPasswordRegistration, } from "../registration/EmailPasswordRegistration";
+import { SignUp } from "./SignUp";
+export class AppsScriptAuthSignUp {
+    email;
+    appsScript;
+    constructor({ sessionStorage, expiresIn, repository, emailPassword, appsScript, utilities, session, }) {
+        this.email = async (input) => {
+            if (!emailPassword) {
+                throw new Error("Email and password authentication is disabled");
+            }
+            emailPassword.ensureSignUpEnabled();
+            const emailSignUp = new SignUp({
+                sessionStorage,
+                expiresIn,
+                registration: new EmailPasswordRegistration(repository, utilities, emailPassword),
+                utilities,
+            });
+            return emailSignUp.execute(input);
+        };
+        this.appsScript = async (input) => {
+            if (!appsScript) {
+                throw new Error("Apps Script authentication is disabled");
+            }
+            appsScript.ensureSignUpEnabled();
+            const appsScriptSignUp = new SignUp({
+                sessionStorage,
+                expiresIn,
+                registration: new AppsScriptRegistration(utilities, session, repository),
+                utilities,
+            });
+            return appsScriptSignUp.execute(input);
+        };
+    }
+}

package/dist/api/SignIn.d.ts

@@ -0,0 +1,19 @@
+import { Authentication } from "../authentication/Authentication";
+import { Session } from "../domain/Session";
+import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
+export declare class SignIn<T> {
+    private readonly sessionStorage;
+    private readonly expiresIn;
+    private readonly utilities;
+    private readonly authentication;
+    constructor({ sessionStorage, authentication, utilities, expiresIn, }: {
+        sessionStorage: AppsScriptSessionStorage;
+        authentication: Authentication<T>;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        expiresIn: number;
+    });
+    execute(credential: T): Promise<{
+        user: import("..").User;
+        session: Session;
+    }>;
+}

package/dist/api/SignIn.js

@@ -0,0 +1,26 @@
+import { Session } from "../domain/Session";
+export class SignIn {
+    sessionStorage;
+    expiresIn;
+    utilities;
+    authentication;
+    constructor({ sessionStorage, authentication, utilities, expiresIn, }) {
+        // Initialize SignIn with db, schema, and session
+        this.sessionStorage = sessionStorage;
+        this.authentication = authentication;
+        this.utilities = utilities;
+        this.expiresIn = expiresIn;
+    }
+    async execute(credential) {
+        // Implement the sign-in logic using the provided authentication method
+        const user = await this.authentication.verify(credential);
+        const session = new Session({
+            id: this.utilities.getUuid(),
+            userId: user.id,
+            createdAt: new Date(),
+            expiresAt: new Date(Date.now() + this.expiresIn),
+        });
+        await this.sessionStorage.save(session);
+        return { user, session };
+    }
+}

package/dist/api/SignUp.d.ts

@@ -0,0 +1,20 @@
+import { Session } from "../domain/Session";
+import { User } from "../domain/User";
+import type { Registration } from "../registration/Registration";
+import type { AppsScriptSessionStorage } from "../storage/AppsScriptSessionStorage";
+export declare class SignUp<T> {
+    private readonly sessionStorage;
+    private readonly registration;
+    private readonly utilities;
+    private readonly expiresIn;
+    constructor({ sessionStorage, registration, utilities, expiresIn, }: {
+        sessionStorage: AppsScriptSessionStorage;
+        registration: Registration<T>;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        expiresIn: number;
+    });
+    execute(input: T): Promise<{
+        user: User;
+        session: Session;
+    }>;
+}

package/dist/api/SignUp.js

@@ -0,0 +1,25 @@
+import { Session } from "../domain/Session";
+export class SignUp {
+    sessionStorage;
+    registration;
+    utilities;
+    expiresIn;
+    constructor({ sessionStorage, registration, utilities, expiresIn, }) {
+        this.sessionStorage = sessionStorage;
+        this.registration = registration;
+        this.utilities = utilities;
+        this.expiresIn = expiresIn;
+    }
+    async execute(input) {
+        const user = await this.registration.register(input);
+        const now = new Date();
+        const session = new Session({
+            id: this.utilities.getUuid(),
+            userId: user.id,
+            createdAt: now,
+            expiresAt: new Date(now.getTime() + this.expiresIn),
+        });
+        await this.sessionStorage.save(session);
+        return { user, session };
+    }
+}

package/dist/authentication/AppsScriptAuthentication.d.ts

@@ -0,0 +1,24 @@
+import { User } from "../domain/User";
+import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
+import type { Authentication } from "./Authentication";
+export type AppsScriptAuthenticationOptions = {
+    enabled?: boolean;
+    isSignupEnabled?: boolean;
+};
+export declare class AppsScriptAuthenticationConfig {
+    readonly enabled: boolean;
+    readonly isSignupEnabled: boolean;
+    constructor({ enabled, isSignupEnabled, }: {
+        enabled?: boolean;
+        isSignupEnabled?: boolean;
+    });
+    ensureSignInEnabled(): void;
+    ensureSignUpEnabled(): void;
+}
+export type AppsScriptCredential = Record<string, never>;
+export declare class AppsScriptAuthentication implements Authentication<AppsScriptCredential> {
+    private readonly repository;
+    private readonly session;
+    constructor(repository: AppsScriptAuthRepository, session: GoogleAppsScript.Base.Session);
+    verify(__credential: AppsScriptCredential): Promise<User>;
+}

package/dist/authentication/AppsScriptAuthentication.js

@@ -0,0 +1,47 @@
+import { authPattern } from "../AuthPattern";
+import { AppsScriptIdentity } from "../identity/AppsScriptIdentity";
+export class AppsScriptAuthenticationConfig {
+    enabled;
+    isSignupEnabled;
+    constructor({ enabled = false, isSignupEnabled = true, }) {
+        this.enabled = enabled;
+        this.isSignupEnabled = isSignupEnabled;
+    }
+    ensureSignInEnabled() {
+        if (!this.enabled) {
+            throw new Error("Apps Script authentication is disabled");
+        }
+    }
+    ensureSignUpEnabled() {
+        this.ensureSignInEnabled();
+        if (!this.isSignupEnabled) {
+            throw new Error("Apps Script signup is disabled");
+        }
+    }
+}
+export class AppsScriptAuthentication {
+    repository;
+    session;
+    constructor(repository, session) {
+        this.repository = repository;
+        this.session = session;
+    }
+    async verify(__credential) {
+        const email = this.session.getActiveUser().getEmail();
+        if (!email) {
+            throw new Error("No active user found");
+        }
+        const account = await this.repository.account.findByIdentity(authPattern.appsScript, email);
+        if (!account) {
+            throw new Error("Account not found");
+        }
+        if (!(account.identity instanceof AppsScriptIdentity)) {
+            throw new Error("Invalid identity");
+        }
+        const user = await this.repository.user.find(account.userId);
+        if (!user) {
+            throw new Error("User not found");
+        }
+        return user;
+    }
+}

package/dist/authentication/Authentication.d.ts

@@ -0,0 +1,4 @@
+import { User } from "../domain/User";
+export interface Authentication<T> {
+    verify(credential: T): Promise<User>;
+}

package/dist/authentication/Authentication.js

@@ -0,0 +1 @@
+export {};

package/dist/authentication/EmailPasswordAuthentication.d.ts

@@ -0,0 +1,42 @@
+import type { PasswordResetDelivery } from "../api/AppsScriptAuthPassword";
+import type { User } from "../domain/User";
+import type { AppsScriptAuthRepository } from "../storage/AppsScriptAuthRepository";
+import type { Authentication } from "./Authentication";
+export type EmailPasswordAuthOptions = {
+    enabled?: boolean;
+    isSignupEnabled?: boolean;
+    pepper: string;
+    iterations?: number;
+    passwordReset?: {
+        delivery: PasswordResetDelivery;
+        expiresIn?: number;
+    };
+};
+export declare class EmailPasswordAuthConfig {
+    static readonly DEFAULT_ITERATIONS = 300;
+    static readonly MAX_ITERATIONS = 1000;
+    readonly enabled: boolean;
+    readonly isSignupEnabled: boolean;
+    readonly pepper: string;
+    readonly iterations: number;
+    readonly passwordReset?: {
+        delivery: PasswordResetDelivery;
+        expiresIn?: number;
+    };
+    constructor({ enabled, isSignupEnabled, pepper, iterations, passwordReset, }: EmailPasswordAuthOptions);
+    ensureSignInEnabled(): void;
+    ensureSignUpEnabled(): void;
+    ensureIterationsWithinLimit(iterations: number): void;
+    ensurePasswordResetEnabled(): void;
+}
+export interface EmailPasswordCredential {
+    readonly email: string;
+    readonly password: string;
+}
+export declare class EmailPasswordAuthentication implements Authentication<EmailPasswordCredential> {
+    private readonly repository;
+    private readonly utilities;
+    private readonly config;
+    constructor(repository: AppsScriptAuthRepository, utilities: GoogleAppsScript.Utilities.Utilities, config: EmailPasswordAuthConfig);
+    verify(credential: EmailPasswordCredential): Promise<User>;
+}

package/dist/authentication/EmailPasswordAuthentication.js

@@ -0,0 +1,75 @@
+import { authPattern } from "../AuthPattern";
+import { Password } from "../domain/Password";
+import { EmailPasswordIdentity } from "../identity/EmailPasswordIdentity";
+export class EmailPasswordAuthConfig {
+    static DEFAULT_ITERATIONS = 300;
+    static MAX_ITERATIONS = 1000;
+    enabled;
+    isSignupEnabled;
+    pepper;
+    iterations;
+    passwordReset;
+    constructor({ enabled = false, isSignupEnabled = true, pepper, iterations = EmailPasswordAuthConfig.DEFAULT_ITERATIONS, passwordReset, }) {
+        if (enabled && !pepper.trim()) {
+            throw new Error("Pepper is required when email and password authentication is enabled");
+        }
+        this.ensureIterationsWithinLimit(iterations);
+        this.enabled = enabled;
+        this.isSignupEnabled = isSignupEnabled;
+        this.pepper = pepper;
+        this.iterations = iterations;
+        this.passwordReset = passwordReset;
+    }
+    ensureSignInEnabled() {
+        if (!this.enabled) {
+            throw new Error("Email and password authentication is disabled");
+        }
+    }
+    ensureSignUpEnabled() {
+        this.ensureSignInEnabled();
+        if (!this.isSignupEnabled) {
+            throw new Error("Email and password signup is disabled");
+        }
+    }
+    ensureIterationsWithinLimit(iterations) {
+        if (!Number.isInteger(iterations) || iterations < 1) {
+            throw new Error("Password hash iterations must be a positive integer");
+        }
+        if (iterations > EmailPasswordAuthConfig.MAX_ITERATIONS) {
+            throw new Error(`Password hash iterations must not exceed ${EmailPasswordAuthConfig.MAX_ITERATIONS}`);
+        }
+    }
+    ensurePasswordResetEnabled() {
+        if (!this.passwordReset) {
+            throw new Error("Password reset is not enabled");
+        }
+    }
+}
+export class EmailPasswordAuthentication {
+    repository;
+    utilities;
+    config;
+    constructor(repository, utilities, config) {
+        this.repository = repository;
+        this.utilities = utilities;
+        this.config = config;
+    }
+    async verify(credential) {
+        const account = await this.repository.account.findByIdentity(authPattern.emailPassword, credential.email);
+        if (!account) {
+            throw new Error("Account not found");
+        }
+        if (!(account.identity instanceof EmailPasswordIdentity)) {
+            throw new Error("Invalid identity");
+        }
+        const password = new Password(credential.password, this.utilities, this.config.pepper, this.config.iterations);
+        if (!(await account.identity.verify(password, account.id))) {
+            throw new Error("Invalid password");
+        }
+        const user = await this.repository.user.find(account.userId);
+        if (!user) {
+            throw new Error("User not found");
+        }
+        return user;
+    }
+}

package/dist/domain/Account.d.ts

@@ -0,0 +1,11 @@
+import type { ProviderIdentity } from "../identity/ProviderIdentity";
+export declare class Account {
+    readonly id: string;
+    readonly userId: string;
+    readonly identity: ProviderIdentity;
+    constructor({ id, userId, identity, }: {
+        id: string;
+        userId: string;
+        identity: ProviderIdentity;
+    });
+}

package/dist/domain/Account.js

@@ -0,0 +1,10 @@
+export class Account {
+    id;
+    userId;
+    identity;
+    constructor({ id, userId, identity, }) {
+        this.id = id;
+        this.userId = userId;
+        this.identity = identity;
+    }
+}

package/dist/domain/Errors.d.ts

@@ -0,0 +1,3 @@
+export declare class InvalidPasswordResetError extends Error {
+    constructor();
+}

package/dist/domain/Errors.js

@@ -0,0 +1,5 @@
+export class InvalidPasswordResetError extends Error {
+    constructor() {
+        super("Invalid password reset token");
+    }
+}

package/dist/domain/Password.d.ts

@@ -0,0 +1,15 @@
+export declare class Password {
+    readonly value: string;
+    private readonly utilities;
+    private readonly pepper;
+    private readonly iterations;
+    constructor(value: string, utilities: GoogleAppsScript.Utilities.Utilities, pepper: string, iterations: number);
+    hash(salt: string): Promise<HashedPassword>;
+}
+export declare class HashedPassword {
+    readonly value: string;
+    constructor({ value }: {
+        value: string;
+    });
+    verify(password: Password, salt: string): Promise<boolean>;
+}

package/dist/domain/Password.js

@@ -0,0 +1,54 @@
+export class Password {
+    value;
+    utilities;
+    pepper;
+    iterations;
+    constructor(value, utilities, pepper, iterations) {
+        this.value = value;
+        this.utilities = utilities;
+        this.pepper = pepper;
+        this.iterations = iterations;
+    }
+    async hash(salt) {
+        const passwordBytes = Array.from(this.utilities.newBlob(this.value + this.pepper).getBytes());
+        const saltBytes = [
+            ...Array.from(this.utilities.newBlob(salt).getBytes()),
+            0,
+            0,
+            0,
+            1,
+        ];
+        let previous = this.utilities.computeHmacSha256Signature(saltBytes, passwordBytes);
+        const result = [...previous];
+        for (let i = 1; i < this.iterations; i++) {
+            previous = this.utilities.computeHmacSha256Signature(previous, passwordBytes);
+            for (let j = 0; j < result.length; j++) {
+                result[j] = result[j] ^ previous[j];
+            }
+        }
+        const hash = result
+            .map((byte) => (byte < 0 ? byte + 256 : byte))
+            .map((byte) => byte.toString(16).padStart(2, "0"))
+            .join("");
+        return new HashedPassword({
+            value: hash,
+        });
+    }
+}
+export class HashedPassword {
+    value;
+    constructor({ value }) {
+        this.value = value;
+    }
+    async verify(password, salt) {
+        const hashed = await password.hash(salt);
+        if (this.value.length !== hashed.value.length) {
+            return false;
+        }
+        let difference = 0;
+        for (let i = 0; i < this.value.length; i++) {
+            difference |= this.value.charCodeAt(i) ^ hashed.value.charCodeAt(i);
+        }
+        return difference === 0;
+    }
+}

package/dist/domain/PasswordCredential.d.ts

@@ -0,0 +1,25 @@
+import { Account } from "./Account";
+import type { HashedPassword } from "./Password";
+import { PasswordReset } from "./PasswordReset";
+export declare class PasswordCredential {
+    readonly account: Account;
+    readonly reset: PasswordReset | null;
+    constructor({ account, reset, }: {
+        account: Account;
+        reset: PasswordReset | null;
+    });
+    static generate({ account, utilities, expiresAt, }: {
+        account: Account;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        expiresAt: Date;
+    }): {
+        credential: PasswordCredential;
+        token: string;
+    };
+    resetPassword({ token, newPassword, utilities, now, }: {
+        token: string;
+        newPassword: HashedPassword;
+        utilities: GoogleAppsScript.Utilities.Utilities;
+        now: Date;
+    }): PasswordCredential;
+}

package/dist/domain/PasswordCredential.js

@@ -0,0 +1,57 @@
+import { EmailPasswordIdentity } from "../identity/EmailPasswordIdentity";
+import { Account } from "./Account";
+import { InvalidPasswordResetError } from "./Errors";
+import { PasswordReset } from "./PasswordReset";
+export class PasswordCredential {
+    account;
+    reset;
+    constructor({ account, reset, }) {
+        this.account = account;
+        this.reset = reset;
+    }
+    static generate({ account, utilities, expiresAt, }) {
+        if (!(account.identity instanceof EmailPasswordIdentity)) {
+            throw new Error("Invalid account identity");
+        }
+        const { reset, token } = PasswordReset.create({
+            accountId: account.id,
+            utilities,
+            expiresAt,
+        });
+        return {
+            credential: new PasswordCredential({
+                account,
+                reset,
+            }),
+            token,
+        };
+    }
+    resetPassword({ token, newPassword, utilities, now, }) {
+        if (this.reset === null) {
+            throw new InvalidPasswordResetError();
+        }
+        if (this.reset.accountId !== this.account.id) {
+            throw new InvalidPasswordResetError();
+        }
+        if (this.reset.enabled === false) {
+            throw new InvalidPasswordResetError();
+        }
+        if (this.reset.isExpired(now)) {
+            throw new InvalidPasswordResetError();
+        }
+        if (this.reset.verify(token, utilities) === false) {
+            throw new InvalidPasswordResetError();
+        }
+        if (!(this.account.identity instanceof EmailPasswordIdentity)) {
+            throw new Error("Invalid account identity");
+        }
+        return new PasswordCredential({
+            account: new Account({
+                id: this.account.id,
+                userId: this.account.userId,
+                identity: this.account.identity.changePassword(newPassword),
+            }),
+            reset: this.reset.disable(),
+        });
+    }
+}