@goscribe/server 1.3.4 → 1.6.0

package/dist/services/auth/auth.service.js

@@ -0,0 +1,368 @@
+import { TRPCError } from '@trpc/server';
+import bcrypt from 'bcryptjs';
+import crypto from 'node:crypto';
+import { BaseService } from '../base.service.js';
+import { supabaseClient } from '../../lib/storage.js';
+import { sendVerificationEmail, sendAccountDeletionScheduledEmail, sendAccountRestoredEmail, sendPasswordResetEmail, } from '../../lib/email.js';
+import { createStripeCustomer } from '../../lib/stripe.js';
+import { notifyAdminsAccountDeletionScheduled, notifyAdminsOnSignup, } from '../notifications/notification.service.js';
+export function hashPasswordResetToken(rawToken) {
+    return crypto.createHash('sha256').update(rawToken, 'utf8').digest('hex');
+}
+export function createCustomAuthToken(userId) {
+    const secret = process.env.AUTH_SECRET;
+    if (!secret) {
+        throw new TRPCError({ code: 'INTERNAL_SERVER_ERROR', message: 'AUTH_SECRET is not set' });
+    }
+    const base64UserId = Buffer.from(userId, 'utf8').toString('base64url');
+    const hmac = crypto.createHmac('sha256', secret);
+    hmac.update(base64UserId);
+    const signature = hmac.digest('hex');
+    return `${base64UserId}.${signature}`;
+}
+function passwordResetDb(db) {
+    return db.passwordResetToken;
+}
+export class AuthService extends BaseService {
+    constructor(db) {
+        super(db);
+    }
+    async updateProfile(userId, input) {
+        await this.db.user.update({
+            where: { id: userId },
+            data: { name: input.name },
+        });
+        return { success: true, message: 'Profile updated successfully' };
+    }
+    async changePassword(userId, input) {
+        const user = await this.db.user.findUnique({
+            where: { id: userId },
+            select: { id: true, passwordHash: true },
+        });
+        if (!user) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        if (!user.passwordHash) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'Password change is unavailable for this account.',
+            });
+        }
+        const validCurrentPassword = await bcrypt.compare(input.currentPassword, user.passwordHash);
+        if (!validCurrentPassword) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Current password is incorrect' });
+        }
+        const isSamePassword = await bcrypt.compare(input.newPassword, user.passwordHash);
+        if (isSamePassword) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'New password must be different from current password',
+            });
+        }
+        const newHash = await bcrypt.hash(input.newPassword, 10);
+        await this.db.user.update({
+            where: { id: user.id },
+            data: { passwordHash: newHash },
+        });
+        return { success: true, message: 'Password changed successfully' };
+    }
+    async uploadProfilePicture(userId) {
+        this.logger.info(`Generating upload URL for user ${userId}`, 'AUTH');
+        const objectKey = `profile_picture_${userId}`;
+        const { data: signedUrlData, error: signedUrlError } = await supabaseClient.storage
+            .from('media')
+            .createSignedUploadUrl(objectKey, { upsert: true });
+        if (signedUrlError) {
+            this.logger.error(`Failed to generate upload URL: ${signedUrlError.message}`, 'AUTH');
+            throw new TRPCError({
+                code: 'INTERNAL_SERVER_ERROR',
+                message: `Failed to generate upload URL: ${signedUrlError.message}`,
+            });
+        }
+        const fileAsset = await this.db.fileAsset.create({
+            data: {
+                userId,
+                name: 'Profile Picture',
+                mimeType: 'image/jpeg',
+                size: 0,
+                bucket: 'media',
+                objectKey,
+            },
+        });
+        await this.db.user.update({
+            where: { id: userId },
+            data: { fileAssetId: fileAsset.id },
+        });
+        this.logger.info(`Profile picture asset created and linked for user ${userId}`, 'AUTH');
+        return {
+            success: true,
+            message: 'Profile picture uploaded successfully',
+            signedUrl: signedUrlData.signedUrl,
+        };
+    }
+    /**
+     * Signup creates a user + sends verification email + kicks off Stripe customer
+     * creation. The caller (router) does NOT need to set any cookies here.
+     */
+    async signup(input) {
+        const existing = await this.db.user.findUnique({
+            where: { email: input.email },
+        });
+        if (existing) {
+            throw new TRPCError({ code: 'CONFLICT', message: 'Email already registered' });
+        }
+        const hash = await bcrypt.hash(input.password, 10);
+        const userRole = await this.db.role.findUnique({
+            where: { name: 'User' },
+        });
+        const user = await this.db.user.create({
+            data: {
+                name: input.name,
+                email: input.email,
+                passwordHash: hash,
+                roleId: userRole?.id,
+            },
+        });
+        await notifyAdminsOnSignup(this.db, {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+        });
+        const token = crypto.randomUUID();
+        await this.db.verificationToken.create({
+            data: {
+                identifier: input.email,
+                token,
+                expires: new Date(Date.now() + 24 * 60 * 60 * 1000),
+            },
+        });
+        sendVerificationEmail(input.email, token, input.name).catch(() => { });
+        createStripeCustomer(input.email, input.name).then(async (stripeCustomerId) => {
+            if (stripeCustomerId) {
+                await this.db.user
+                    .update({
+                    where: { id: user.id },
+                    data: { stripe_customer_id: stripeCustomerId },
+                })
+                    .catch((err) => this.logger.error(`Failed to update user with stripe_customer_id: ${err.message}`, 'AUTH'));
+            }
+        });
+        return { id: user.id, email: user.email, name: user.name };
+    }
+    async verifyEmail(token) {
+        const record = await this.db.verificationToken.findUnique({
+            where: { token },
+        });
+        if (!record) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Invalid or expired verification link',
+            });
+        }
+        if (record.expires < new Date()) {
+            await this.db.verificationToken.deleteMany({ where: { token } });
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'Verification link has expired. Please request a new one.',
+            });
+        }
+        await this.db.user.update({
+            where: { email: record.identifier },
+            data: { emailVerified: new Date() },
+        });
+        await this.db.verificationToken.deleteMany({ where: { token } });
+        return { success: true, message: 'Email verified successfully' };
+    }
+    async resendVerification(sessionUserId) {
+        if (!sessionUserId) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Not logged in' });
+        }
+        const user = await this.db.user.findUnique({ where: { id: sessionUserId } });
+        if (!user || !user.email) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        if (user.emailVerified) {
+            return { success: true, message: 'Email is already verified' };
+        }
+        await this.db.verificationToken.deleteMany({
+            where: { identifier: user.email },
+        });
+        const token = crypto.randomUUID();
+        await this.db.verificationToken.create({
+            data: {
+                identifier: user.email,
+                token,
+                expires: new Date(Date.now() + 24 * 60 * 60 * 1000),
+            },
+        });
+        const sent = await sendVerificationEmail(user.email, token, user.name);
+        if (!sent) {
+            throw new TRPCError({
+                code: 'INTERNAL_SERVER_ERROR',
+                message: 'Failed to send email. Please try again.',
+            });
+        }
+        return { success: true, message: 'Verification email sent' };
+    }
+    /**
+     * Verifies credentials and returns the user + an auth token. The router
+     * is responsible for setting the cookie (Express `res` is not available
+     * here — we keep services HTTP-free).
+     */
+    async login(input) {
+        const user = await this.db.user.findUnique({ where: { email: input.email } });
+        if (!user) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Invalid credentials' });
+        }
+        if (user.deletedAt) {
+            throw new TRPCError({
+                code: 'UNAUTHORIZED',
+                message: 'Account scheduled for deletion. Please check your email for a restore link.',
+            });
+        }
+        const valid = await bcrypt.compare(input.password, user.passwordHash);
+        if (!valid) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Invalid credentials' });
+        }
+        const authToken = createCustomAuthToken(user.id);
+        return {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            token: authToken,
+        };
+    }
+    async requestPasswordReset(input) {
+        const email = input.email.trim().toLowerCase();
+        const generic = {
+            success: true,
+            message: 'If an account exists for this email, we sent password reset instructions.',
+        };
+        const user = await this.db.user.findUnique({
+            where: { email },
+            select: {
+                id: true,
+                email: true,
+                name: true,
+                passwordHash: true,
+                deletedAt: true,
+            },
+        });
+        if (!user?.passwordHash || user.deletedAt || !user.email) {
+            return generic;
+        }
+        await passwordResetDb(this.db).deleteMany({
+            where: { userId: user.id, usedAt: null },
+        });
+        const rawToken = crypto.randomBytes(32).toString('hex');
+        const tokenHash = hashPasswordResetToken(rawToken);
+        const expiresAt = new Date(Date.now() + 60 * 60 * 1000);
+        await passwordResetDb(this.db).create({
+            data: { userId: user.id, tokenHash, expiresAt },
+        });
+        sendPasswordResetEmail(user.email, rawToken, user.name).catch(() => { });
+        return generic;
+    }
+    async resetPassword(input) {
+        const tokenHash = hashPasswordResetToken(input.token);
+        const record = await passwordResetDb(this.db).findUnique({
+            where: { tokenHash },
+        });
+        if (!record || record.usedAt || record.expiresAt < new Date()) {
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: 'Invalid or expired reset link. Please request a new one.',
+            });
+        }
+        const newHash = await bcrypt.hash(input.newPassword, 10);
+        await this.db.user.update({
+            where: { id: record.userId },
+            data: { passwordHash: newHash },
+        });
+        await passwordResetDb(this.db).update({
+            where: { id: record.id },
+            data: { usedAt: new Date() },
+        });
+        await passwordResetDb(this.db).deleteMany({
+            where: { userId: record.userId, id: { not: record.id } },
+        });
+        return { success: true, message: 'Password updated. You can sign in now.' };
+    }
+    async getSession(sessionUserId) {
+        if (!sessionUserId) {
+            throw new TRPCError({ code: 'UNAUTHORIZED', message: 'No session found' });
+        }
+        const user = await this.db.user.findUnique({
+            where: { id: sessionUserId },
+            include: { profilePicture: true, role: true },
+        });
+        if (!user) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        const profilePictureUrl = user.profilePicture?.objectKey
+            ? `/profile-picture/${user.profilePicture.objectKey}?t=${new Date(user.updatedAt).getTime()}`
+            : null;
+        this.logger.info(`Session fetched for user ${sessionUserId}, profilePicture: ${profilePictureUrl}`, 'AUTH');
+        return {
+            user: {
+                id: user.id,
+                email: user.email,
+                name: user.name,
+                emailVerified: !!user.emailVerified,
+                profilePicture: profilePictureUrl,
+                role: user.role,
+            },
+        };
+    }
+    async requestAccountDeletion(userId) {
+        const user = await this.db.user.findUnique({ where: { id: userId } });
+        if (!user) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'User not found' });
+        }
+        await this.db.user.update({
+            where: { id: user.id },
+            data: { deletedAt: new Date() },
+        });
+        await notifyAdminsAccountDeletionScheduled(this.db, {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+        }).catch(() => { });
+        await this.db.verificationToken.deleteMany({
+            where: { identifier: `restore-${user.email}` },
+        });
+        const token = crypto.randomUUID();
+        await this.db.verificationToken.create({
+            data: {
+                identifier: `restore-${user.email}`,
+                token,
+                expires: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+            },
+        });
+        if (user.email) {
+            sendAccountDeletionScheduledEmail(user.email, token).catch(() => { });
+        }
+        return { success: true, message: 'Account scheduled for deletion' };
+    }
+    async restoreAccount(token) {
+        const record = await this.db.verificationToken.findUnique({ where: { token } });
+        if (!record || !record.identifier.startsWith('restore-')) {
+            throw new TRPCError({
+                code: 'NOT_FOUND',
+                message: 'Invalid or expired restore link',
+            });
+        }
+        if (record.expires < new Date()) {
+            await this.db.verificationToken.deleteMany({ where: { token } });
+            throw new TRPCError({ code: 'BAD_REQUEST', message: 'Restore link has expired.' });
+        }
+        const email = record.identifier.replace('restore-', '');
+        await this.db.user.update({
+            where: { email },
+            data: { deletedAt: null },
+        });
+        await this.db.verificationToken.deleteMany({ where: { token } });
+        sendAccountRestoredEmail(email).catch(() => { });
+        return { success: true, message: 'Account restored successfully' };
+    }
+}

package/dist/services/auth.service.d.ts

@@ -0,0 +1,94 @@
+import type { PrismaClient } from '@prisma/client';
+import { BaseService } from './base.service.js';
+export declare function hashPasswordResetToken(rawToken: string): string;
+export declare function createCustomAuthToken(userId: string): string;
+export declare class AuthService extends BaseService {
+    constructor(db: PrismaClient);
+    updateProfile(userId: string, input: {
+        name: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    changePassword(userId: string, input: {
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    uploadProfilePicture(userId: string): Promise<{
+        success: boolean;
+        message: string;
+        signedUrl: string;
+    }>;
+    /**
+     * Signup creates a user + sends verification email + kicks off Stripe customer
+     * creation. The caller (router) does NOT need to set any cookies here.
+     */
+    signup(input: {
+        name: string;
+        email: string;
+        password: string;
+    }): Promise<{
+        id: string;
+        email: string | null;
+        name: string | null;
+    }>;
+    verifyEmail(token: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    resendVerification(sessionUserId: string | undefined): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    /**
+     * Verifies credentials and returns the user + an auth token. The router
+     * is responsible for setting the cookie (Express `res` is not available
+     * here — we keep services HTTP-free).
+     */
+    login(input: {
+        email: string;
+        password: string;
+    }): Promise<{
+        id: string;
+        email: string | null;
+        name: string | null;
+        token: string;
+    }>;
+    requestPasswordReset(input: {
+        email: string;
+    }): Promise<{
+        success: true;
+        message: string;
+    }>;
+    resetPassword(input: {
+        token: string;
+        newPassword: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    getSession(sessionUserId: string | undefined): Promise<{
+        user: {
+            id: string;
+            email: string | null;
+            name: string | null;
+            emailVerified: boolean;
+            profilePicture: string | null;
+            role: {
+                name: string;
+                id: string;
+            } | null;
+        };
+    }>;
+    requestAccountDeletion(userId: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    restoreAccount(token: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+}