@hapiboo/module-auth 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+import { IFluxModule } from '@hapiboo/flux';
+import { securityService, IFluxRequest, IFluxTokenRequest, IFluxDataRequest } from './service/security';
+import { IAuthPerformers, IAuthSettings, IAuthEmailLink } from './service/settings';
+import { authenticationService } from './service/authentication';
+import { authorizationService } from './service/authorization';
+import { Credential, Role, UserAccess, Permission, User } from './models';
+export declare namespace auth {
+    function init(jwt_secret: string, settings: IAuthSettings, performers: IAuthPerformers): void;
+    namespace services {
+        const authentication: typeof authenticationService;
+        const authorization: typeof authorizationService;
+        const security: typeof securityService;
+    }
+    const routes: import("@hapiboo/server").IRoutingItem[];
+    const module: IFluxModule;
+}
+export { Credential, Role, UserAccess, Permission, User };
+export { IAuthSettings, IAuthPerformers, IAuthEmailLink };
+export { IFluxRequest, IFluxTokenRequest, IFluxDataRequest };

package/dist/index.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.User = exports.Permission = exports.UserAccess = exports.Role = exports.Credential = exports.auth = void 0;
+const security_1 = require("./service/security");
+const settings_1 = require("./service/settings");
+const authentication_1 = require("./service/authentication");
+const authorization_1 = require("./service/authorization");
+const models_1 = require("./models");
+Object.defineProperty(exports, "Credential", { enumerable: true, get: function () { return models_1.Credential; } });
+Object.defineProperty(exports, "Role", { enumerable: true, get: function () { return models_1.Role; } });
+Object.defineProperty(exports, "UserAccess", { enumerable: true, get: function () { return models_1.UserAccess; } });
+Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return models_1.Permission; } });
+Object.defineProperty(exports, "User", { enumerable: true, get: function () { return models_1.User; } });
+const router_1 = require("./router");
+var auth;
+(function (auth) {
+    function init(jwt_secret, settings, performers) {
+        settings_1.authSettings.init(settings, performers);
+        security_1.securityService.initialize(jwt_secret);
+    }
+    auth.init = init;
+    let services;
+    (function (services) {
+        services.authentication = authentication_1.authenticationService;
+        services.authorization = authorization_1.authorizationService;
+        services.security = security_1.securityService;
+    })(services = auth.services || (auth.services = {}));
+    auth.routes = [router_1.router];
+    auth.module = {
+        name: 'hAPIboo Authorization Module',
+        models: [models_1.User, models_1.Credential, models_1.Role, models_1.Permission, models_1.UserAccess]
+    };
+})(auth || (exports.auth = auth = {}));
+//// TODO ////
+// add flag to reset permissions on permission change (in case we have more than single instance running)

package/dist/models/credential.d.ts

@@ -0,0 +1,43 @@
+export type CredentialType = 'password' | 'sso' | 'token';
+export type CredentialStatus = 'active' | 'pending' | 'revoked';
+export declare class Credential {
+    id: string;
+    name: string;
+    user_id: string;
+    type: CredentialType;
+    status: CredentialStatus;
+    confirmation: string;
+    invite: string;
+    recovery: string;
+    refreshCode: string;
+    password?: Password;
+    sso?: Sso;
+    token?: Token;
+    clone(model: this): this;
+    createPassword(id: string, name: string, user_id: string, status: CredentialStatus, base64Password: string, confirmationCode: string | undefined, inviteCode: string | undefined): this;
+    setNewPassword(base64Password: string): this;
+    invalidateCredential(): this;
+    checkPasswordCorrectness(base64Password: string): boolean;
+    changePassword(oldBase64Password: string, newBase64Password: string): boolean;
+    checkConfirmed(code: string, base64password: string): boolean;
+    checkInvite(invite: string, base64password: string): boolean;
+    checkRecovery(recovery: string, base64password: string): boolean;
+    setRecoveryCode(recovery: string): boolean;
+    setRefreshCode(token: string): boolean;
+}
+export declare class Password {
+    hash: string;
+    salt: string;
+    length: number;
+    iterations: number;
+    lastChangedAt: string;
+    create(base64Password: string): Password;
+    clone(model: Password): Password;
+    checkPasswordCorrectness(base64password: string): boolean;
+    private setPassword;
+    private getHash;
+}
+export declare class Sso {
+}
+export declare class Token {
+}

package/dist/models/credential.js

@@ -0,0 +1,221 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Token = exports.Sso = exports.Password = exports.Credential = void 0;
+const date_1 = require("@hapiboo/date");
+const crypto_1 = require("@hapiboo/crypto");
+const flux_1 = require("@hapiboo/flux");
+const settings_1 = require("../service/settings");
+const naming_1 = require("./naming");
+let Credential = class Credential {
+    constructor() {
+        this.id = '';
+        this.name = '';
+        this.user_id = '';
+        this.type = 'password';
+        this.status = 'active';
+        this.confirmation = '';
+        this.invite = '';
+        this.recovery = '';
+        this.refreshCode = '';
+    }
+    clone(model) {
+        this.id = model.id;
+        this.name = model.name;
+        this.user_id = model.user_id;
+        this.type = model.type;
+        this.status = model.status;
+        this.confirmation = model.confirmation;
+        this.invite = model.invite;
+        this.recovery = model.recovery;
+        this.refreshCode = model.refreshCode;
+        if (model.password) {
+            this.password = new Password().clone(model.password);
+        }
+        else {
+            this.password = undefined;
+        }
+        if (model.sso) {
+            this.sso = new Sso();
+        }
+        else {
+            this.sso = undefined;
+        }
+        if (model.token) {
+            this.token = new Token();
+        }
+        else {
+            this.token = undefined;
+        }
+        return this;
+    }
+    createPassword(id, name, user_id, status, base64Password, confirmationCode, inviteCode) {
+        this.id = id;
+        this.name = name;
+        this.user_id = user_id;
+        this.type = 'password';
+        this.status = status;
+        this.confirmation = confirmationCode ?? '';
+        this.invite = inviteCode ?? '';
+        this.password = new Password().create(base64Password);
+        this.sso = undefined;
+        this.token = undefined;
+        return this;
+    }
+    setNewPassword(base64Password) {
+        if (this.type === 'password') {
+            this.password = new Password().create(base64Password);
+            this.recovery = '';
+            this.refreshCode = '';
+        }
+        return this;
+    }
+    invalidateCredential() {
+        this.status = 'revoked';
+        this.confirmation = '';
+        this.invite = '';
+        this.recovery = '';
+        this.refreshCode = '';
+        return this;
+    }
+    checkPasswordCorrectness(base64Password) {
+        return (this.type === 'password' && this.password !== undefined) && this.password.checkPasswordCorrectness(base64Password);
+    }
+    changePassword(oldBase64Password, newBase64Password) {
+        if (this.checkPasswordCorrectness(oldBase64Password)) {
+            this.setNewPassword(newBase64Password);
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+    checkConfirmed(code, base64password) {
+        if (this.type === 'password' && this.confirmation === code && this.checkPasswordCorrectness(base64password) && this.status === 'pending') {
+            this.status = 'active';
+            this.confirmation = '';
+            this.invite = '';
+            this.recovery = '';
+            this.refreshCode = '';
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+    checkInvite(invite, base64password) {
+        if (this.type === 'password' && this.invite === invite && this.status === 'pending') {
+            this.setNewPassword(base64password);
+            this.status = 'active';
+            this.confirmation = '';
+            this.invite = '';
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+    checkRecovery(recovery, base64password) {
+        if (this.type === 'password' && this.recovery === recovery) {
+            this.setNewPassword(base64password);
+            this.confirmation = '';
+            this.invite = '';
+            this.status = 'active';
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+    setRecoveryCode(recovery) {
+        if (this.type === 'password') {
+            this.recovery = recovery;
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+    setRefreshCode(token) {
+        if (this.type === 'password') {
+            this.refreshCode = token;
+            return true;
+        }
+        else {
+            return false;
+        }
+    }
+};
+exports.Credential = Credential;
+__decorate([
+    (0, flux_1.FluxIdentifier)()
+], Credential.prototype, "id", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.name)
+], Credential.prototype, "name", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.user_id)
+], Credential.prototype, "user_id", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.type)
+], Credential.prototype, "type", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.status)
+], Credential.prototype, "status", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.confirmation)
+], Credential.prototype, "confirmation", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.invite)
+], Credential.prototype, "invite", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.credentials.columns.recovery)
+], Credential.prototype, "recovery", void 0);
+exports.Credential = Credential = __decorate([
+    (0, flux_1.FluxTable)(naming_1.naming.credentials.table)
+], Credential);
+class Password {
+    constructor() {
+        this.hash = '';
+        this.salt = '';
+        this.length = 0;
+        this.iterations = 0;
+        this.lastChangedAt = date_1.DateObject.now().toUtc();
+    }
+    create(base64Password) {
+        this.setPassword(base64Password);
+        return this;
+    }
+    clone(model) {
+        this.length = model.length;
+        this.iterations = model.iterations;
+        this.salt = model.salt;
+        this.hash = model.hash;
+        return this;
+    }
+    checkPasswordCorrectness(base64password) {
+        return this.hash === this.getHash(base64password);
+    }
+    setPassword(base64Password) {
+        this.length = settings_1.authSettings.passwordHashLength;
+        this.iterations = settings_1.authSettings.passwordHashIterations;
+        this.salt = crypto_1.cryptoProvider.generateSalt(this.length);
+        this.hash = this.getHash(base64Password);
+        this.lastChangedAt = date_1.DateObject.now().toUtc();
+    }
+    getHash(base64Password) {
+        return crypto_1.cryptoProvider.generateHash(base64Password, this.salt, this.iterations, this.length);
+    }
+}
+exports.Password = Password;
+class Sso {
+}
+exports.Sso = Sso;
+class Token {
+}
+exports.Token = Token;

package/dist/models/index.d.ts

@@ -0,0 +1,4 @@
+import { Credential, CredentialType } from './credential';
+import { Role, UserAccess, Permission } from './role';
+import { User, UserType } from './user';
+export { Credential, CredentialType, Role, UserAccess, Permission, User, UserType };

package/dist/models/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.User = exports.Permission = exports.UserAccess = exports.Role = exports.Credential = void 0;
+const credential_1 = require("./credential");
+Object.defineProperty(exports, "Credential", { enumerable: true, get: function () { return credential_1.Credential; } });
+const role_1 = require("./role");
+Object.defineProperty(exports, "Role", { enumerable: true, get: function () { return role_1.Role; } });
+Object.defineProperty(exports, "UserAccess", { enumerable: true, get: function () { return role_1.UserAccess; } });
+Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return role_1.Permission; } });
+const user_1 = require("./user");
+Object.defineProperty(exports, "User", { enumerable: true, get: function () { return user_1.User; } });

package/dist/models/naming.d.ts

@@ -0,0 +1,50 @@
+export declare const naming: {
+    users: {
+        table: string;
+        columns: {
+            account_id: string;
+            type: string;
+            status: string;
+        };
+        indexes: {
+            by_account: string;
+            by_type: string;
+        };
+    };
+    credentials: {
+        table: string;
+        columns: {
+            name: string;
+            user_id: string;
+            type: string;
+            status: string;
+            confirmation: string;
+            invite: string;
+            recovery: string;
+        };
+    };
+    roles: {
+        table: string;
+    };
+    permissions: {
+        table: string;
+    };
+    user_access: {
+        table: string;
+        columns: {
+            account_id: string;
+            user_id: string;
+            permission_id: string;
+            role_id: string;
+        };
+        indexes: {
+            user_account: string;
+            user_permission: string;
+            user_role: string;
+            account_permission: string;
+            account_role: string;
+            account_user: string;
+            role_permission: string;
+        };
+    };
+};

package/dist/models/naming.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.naming = void 0;
+exports.naming = {
+    users: {
+        table: 'authentication.users',
+        columns: {
+            account_id: 'account_id',
+            type: 'type',
+            status: 'status',
+        },
+        indexes: {
+            by_account: 'by_account',
+            by_type: 'by_type',
+        }
+    },
+    credentials: {
+        table: 'authentication.credentials',
+        columns: {
+            name: 'name',
+            user_id: 'user_id',
+            type: 'type',
+            status: 'status',
+            confirmation: 'confirmation',
+            invite: 'invite',
+            recovery: 'recovery',
+        }
+    },
+    roles: {
+        table: 'authentication.roles'
+    },
+    permissions: {
+        table: 'authentication.permissions'
+    },
+    user_access: {
+        table: 'authentication.user_access',
+        columns: {
+            account_id: 'account_id',
+            user_id: 'user_id',
+            permission_id: 'permission_id',
+            role_id: 'role_id',
+        },
+        indexes: {
+            user_account: 'user_account',
+            user_permission: 'user_permission',
+            user_role: 'user_role',
+            account_permission: 'account_permission',
+            account_role: 'account_role',
+            account_user: 'account_user',
+            role_permission: 'role_permission',
+        }
+    }
+};

package/dist/models/role.d.ts

@@ -0,0 +1,28 @@
+import { IFluxObject } from '@hapiboo/flux';
+export declare class Role {
+    id: string;
+    name: string;
+    description: string;
+    lucide_icon: string;
+    permissions: string[];
+    clone(model: this): this;
+    create(id: string, name: string, description: string, lucide_icon: string, permissions: string[]): Role;
+    edit(name: string, description: string, lucide_icon: string, permissions: string[]): Role;
+}
+export declare class Permission implements IFluxObject {
+    id: string;
+    name: string;
+    constructor();
+    clone(model: this): this;
+    create(id: string, name: string): Permission;
+}
+export declare class UserAccess {
+    id: string;
+    account_id: string;
+    user_id: string;
+    permission_id: string;
+    role_id: string | undefined;
+    clone(model: this): this;
+    createFromRole(id: string, account_id: string, user_id: string, role_id: string, permission_id: string): UserAccess;
+    createFromPermission(id: string, account_id: string, user_id: string, permission_id: string): UserAccess;
+}

package/dist/models/role.js

@@ -0,0 +1,133 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserAccess = exports.Permission = exports.Role = void 0;
+const flux_1 = require("@hapiboo/flux");
+const naming_1 = require("./naming");
+let Role = class Role {
+    constructor() {
+        this.id = '';
+        this.name = '';
+        this.description = '';
+        this.lucide_icon = '';
+        this.permissions = [];
+    }
+    clone(model) {
+        this.id = model.id;
+        this.name = model.name;
+        this.description = model.description;
+        this.lucide_icon = model.lucide_icon;
+        this.permissions = [...model.permissions];
+        return this;
+    }
+    create(id, name, description, lucide_icon, permissions) {
+        this.id = id;
+        this.name = name;
+        this.description = description;
+        this.lucide_icon = lucide_icon;
+        this.permissions = permissions;
+        return this;
+    }
+    edit(name, description, lucide_icon, permissions) {
+        this.name = name;
+        this.description = description;
+        this.lucide_icon = lucide_icon;
+        this.permissions = permissions;
+        return this;
+    }
+};
+exports.Role = Role;
+__decorate([
+    (0, flux_1.FluxIdentifier)()
+], Role.prototype, "id", void 0);
+exports.Role = Role = __decorate([
+    (0, flux_1.FluxTable)(naming_1.naming.roles.table)
+], Role);
+let Permission = class Permission {
+    constructor() {
+        this.id = '';
+        this.name = '';
+        return this;
+    }
+    clone(model) {
+        this.id = model.id;
+        this.name = model.name;
+        return this;
+    }
+    create(id, name) {
+        this.id = id;
+        this.name = name;
+        return this;
+    }
+};
+exports.Permission = Permission;
+__decorate([
+    (0, flux_1.FluxIdentifier)()
+], Permission.prototype, "id", void 0);
+exports.Permission = Permission = __decorate([
+    (0, flux_1.FluxTable)(naming_1.naming.permissions.table)
+], Permission);
+let UserAccess = class UserAccess {
+    constructor() {
+        this.id = '';
+        this.account_id = '';
+        this.user_id = '';
+        this.permission_id = '';
+    }
+    clone(model) {
+        this.id = model.id;
+        this.account_id = model.account_id;
+        this.user_id = model.user_id;
+        this.role_id = model.role_id;
+        this.permission_id = model.permission_id;
+        return this;
+    }
+    createFromRole(id, account_id, user_id, role_id, permission_id) {
+        this.id = id;
+        this.account_id = account_id;
+        this.user_id = user_id;
+        this.permission_id = permission_id;
+        this.role_id = role_id;
+        return this;
+    }
+    createFromPermission(id, account_id, user_id, permission_id) {
+        this.id = id;
+        this.account_id = account_id;
+        this.user_id = user_id;
+        this.permission_id = permission_id;
+        this.role_id = undefined;
+        return this;
+    }
+};
+exports.UserAccess = UserAccess;
+__decorate([
+    (0, flux_1.FluxIdentifier)()
+], UserAccess.prototype, "id", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.user_access.columns.account_id)
+], UserAccess.prototype, "account_id", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.user_access.columns.user_id)
+], UserAccess.prototype, "user_id", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.user_access.columns.permission_id)
+], UserAccess.prototype, "permission_id", void 0);
+__decorate([
+    (0, flux_1.FluxColumn)(naming_1.naming.user_access.columns.role_id)
+], UserAccess.prototype, "role_id", void 0);
+exports.UserAccess = UserAccess = __decorate([
+    (0, flux_1.FluxTable)(naming_1.naming.user_access.table),
+    (0, flux_1.FluxIndex)(naming_1.naming.user_access.indexes.user_account, naming_1.naming.user_access.columns.user_id, naming_1.naming.user_access.columns.account_id),
+    (0, flux_1.FluxIndex)(naming_1.naming.user_access.indexes.user_permission, naming_1.naming.user_access.columns.user_id, naming_1.naming.user_access.columns.permission_id)
+    //@FluxIndex(naming.user_access.indexes.user_role, naming.user_access.columns.user_id, naming.user_access.columns.role_id)
+    //@FluxIndex(naming.user_access.indexes.account_permission, naming.user_access.columns.account_id, naming.user_access.columns.permission_id)
+    //@FluxIndex(naming.user_access.indexes.account_role, naming.user_access.columns.account_id, naming.user_access.columns.role_id)
+    ,
+    (0, flux_1.FluxIndex)(naming_1.naming.user_access.indexes.account_user, naming_1.naming.user_access.columns.account_id, naming_1.naming.user_access.columns.user_id)
+    //@FluxIndex(naming.user_access.indexes.role_permission, naming.user_access.columns.role_id, naming.user_access.columns.permission_id)
+], UserAccess);

package/dist/models/user.d.ts

@@ -0,0 +1,25 @@
+export type UserType = 'standard' | 'admin';
+export type UserStatus = 'created' | 'active' | 'banned' | 'deleted';
+export declare class User {
+    id: string;
+    account_id: string;
+    type: UserType;
+    status: UserStatus;
+    profile: Profile;
+    createdAt: string;
+    updatedAt: string;
+    lastLoginAt: string;
+    clone(model: this): this;
+    create(id: string, account_id: string | undefined, type: UserType, status: UserStatus, display: string, email: string): User;
+    updateName(name: string): this;
+    confirm(): this;
+}
+export declare class Profile {
+    display: string;
+    email: string;
+    phone: string;
+    locale: string;
+    avatarUrl: string;
+    clone(model: this): this;
+    create(display: string, email: string): Profile;
+}