@hed-hog/core 0.0.4

package/hedhog/table/user_account.yaml

@@ -0,0 +1,29 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: provider
+    type: enum
+    values:
+      - google
+      - facebook
+      - github
+      - apple
+      - microsoft
+  - name: provider_user_id
+  - name: email
+    isNullable: true
+  - name: scopes
+    isNullable: true
+  - name: refresh_token
+    type: bytes
+    isNullable: true
+  - name: token_expires_at
+    type: datetime
+    isNullable: true
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_activity.yaml

@@ -0,0 +1,13 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: action
+    type: text
+  - type: created_at
+  - type: updated_at
+

package/hedhog/table/user_credential.yaml

@@ -0,0 +1,24 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: type
+    type: enum
+    values:
+      - password
+  - name: hash
+  - name: revoked_at
+    type: datetime
+    isNullable: true
+  - name: expires_at
+    type: datetime
+    isNullable: true
+  - name: requires_reset
+    type: boolean
+    default: false
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_identifier.yaml

@@ -0,0 +1,23 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: type
+    isUnique: true
+    type: enum
+    values:
+      - email
+      - username
+      - phone
+      - cpf
+  - name: value
+    isUnique: true
+  - name: verified_at
+    type: datetime
+    isNullable: true
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_mfa.yaml

@@ -0,0 +1,23 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: type
+    type: enum
+    values:
+      - webauthn
+      - totp
+      - email
+  - name: name
+  - name: verified_at
+    type: datetime
+    isNullable: true
+  - name: suspended_until
+    type: datetime
+    isNullable: true
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_mfa_challenge.yaml

@@ -0,0 +1,19 @@
+columns:
+  - type: pk
+  - name: user_mfa_id
+    type: fk
+    references:
+      table: user_mfa
+      column: id
+      onDelete: CASCADE
+  - name: hash
+  - name: expires_at
+    type: datetime
+  - name: verified_at
+    type: datetime
+    isNullable: true
+  - name: attempts
+    type: int
+    default: 0
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_mfa_email.yaml

@@ -0,0 +1,11 @@
+columns:
+  - type: pk
+  - name: user_mfa_id
+    type: fk
+    references:
+      table: user_mfa
+      column: id
+      onDelete: CASCADE
+  - name: email
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_mfa_phone.yaml

@@ -0,0 +1,11 @@
+columns:
+  - type: pk
+  - name: user_mfa_id
+    type: fk
+    references:
+      table: user_mfa
+      column: id
+      onDelete: CASCADE
+  - name: phone
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_mfa_totp.yaml

@@ -0,0 +1,12 @@
+columns:
+  - type: pk
+  - name: user_mfa_id
+    type: fk
+    references:
+      table: user_mfa
+      column: id
+      onDelete: CASCADE
+  - name: secret
+    type: bytes
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_mfa_webauthn.yaml

@@ -0,0 +1,19 @@
+columns:
+  - type: pk
+  - name: user_mfa_id
+    type: fk
+    references:
+      table: user_mfa
+      column: id
+      onDelete: CASCADE
+  - name: credential_id
+    type: bytes
+  - name: public_key
+    type: bytes
+  - name: sign_count
+    type: int
+  - name: last_used_at
+    type: datetime
+    isNullable: true
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_recovery_code.yaml

@@ -0,0 +1,16 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    isUnique: true
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: hash
+    isUnique: true
+  - name: used_at
+    type: datetime
+    isNullable: true
+  - type: created_at
+  - type: updated_at

package/hedhog/table/user_session.yaml

@@ -0,0 +1,18 @@
+columns:
+  - type: pk
+  - name: user_id
+    type: fk
+    references:
+      table: user
+      column: id
+      onDelete: CASCADE
+  - name: hash
+  - name: ip_address
+  - name: user_agent
+  - name: revoked_at
+    type: datetime
+    isNullable: true
+  - name: expires_at
+    type: datetime
+  - type: created_at
+  - type: updated_at

package/package.json

@@ -0,0 +1,72 @@
+{
+  "name": "@hed-hog/core",
+  "version": "0.0.4",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.918.0",
+    "@aws-sdk/s3-request-presigner": "^3.918.0",
+    "@azure/storage-blob": "^12.27.0",
+    "@google-cloud/storage": "^7.16.0",
+    "@nestjs/axios": "*",
+    "@nestjs/common": "*",
+    "@nestjs/config": "^4.0.2",
+    "@nestjs/core": "^11",
+    "@nestjs/jwt": "^11",
+    "@nestjs/mapped-types": "*",
+    "@nestjs/schedule": "^6.0.1",
+    "@simplewebauthn/server": "^13.2.2",
+    "argon2": "^0.44.0",
+    "axios": "^1.9.0",
+    "cookie-parser": "^1.4.7",
+    "handlebars": "^4.7.8",
+    "jsonwebtoken": "^9.0.2",
+    "multer": "^2.0.1",
+    "png-to-ico": "^2.1.8",
+    "qrcode": "^1.5.4",
+    "rxjs": "^7.8.2",
+    "sharp": "^0.34.2",
+    "speakeasy": "^2.0.0",
+    "uuid": "^11.1.0",
+    "@hed-hog/api": "0.0.3",
+    "@hed-hog/api-mail": "0.0.7",
+    "@hed-hog/types": "0.0.1",
+    "@hed-hog/api-pagination": "0.0.3",
+    "@hed-hog/api-prisma": "0.0.4",
+    "@hed-hog/api-locale": "0.0.10"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "typesVersions": {
+    "*": {
+      "*": [
+        "./dist/index.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "hedhog"
+  ],
+  "devDependencies": {
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^4.17.24",
+    "@types/multer": "^2.0.0"
+  },
+  "scripts": {
+    "_dev": "pnpm build --watch",
+    "lint": "eslint \"{src,apps,libs,test}/**/*.ts\"",
+    "prebuild": "npx ts-node ../../scripts/build-dependencies.ts libraries/core",
+    "build": "tsc --project tsconfig.production.json",
+    "patch": "npx ts-node ../../scripts/patch.ts libraries/core",
+    "prod": "pnpm run patch && pnpm run build && pnpm publish --access public --no-git-checks"
+  }
+}

package/src/auth/auth.controller.ts

@@ -0,0 +1,215 @@
+import { Public, Role, User } from '@hed-hog/api';
+import { Locale } from '@hed-hog/api-locale';
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  forwardRef,
+  Get,
+  Headers,
+  Inject,
+  Ip,
+  Post,
+  Req,
+  Res
+} from '@nestjs/common';
+import { TokenService } from '../token/token.service';
+import { CreateWithEmailAndPasswordDTO } from '../user/dto/create-with-email-and-password.dto';
+import { UserService } from '../user/user.service';
+import { AuthService } from './auth.service';
+import { ForgetDTO } from './dto/forget.dto';
+import { LoginWithCodeDTO } from './dto/login-with-code.dto';
+import { LoginWithRecoveryCodeDTO } from './dto/login-with-recovery-code';
+import { LoginDTO } from './dto/login.dto';
+import { ResendMfaCodeDTO } from './dto/resend-mfa-code.dto';
+import { ResetDTO } from './dto/reset.dto';
+
+@Controller('auth')
+export class AuthController {
+  constructor(
+    @Inject(forwardRef(() => AuthService))
+    private readonly service: AuthService,
+    @Inject(forwardRef(() => TokenService))
+    private readonly token: TokenService,
+    @Inject(forwardRef(() => UserService))
+    private readonly user: UserService,
+  ) { }
+
+  @Role()
+  @Get('verify')
+  async verify(@User() { id }, @Locale() locale: string) {
+    return this.service.verifyUser(locale, id);
+  }
+
+  @Public()
+  @Post('refresh')
+  async refresh(
+    @Locale() locale: string,
+    @Req() req,
+    @Res({ passthrough: true }) res,
+    @Body('refreshToken') refreshTokenFromBody: string,
+    @Headers('user-agent') userAgent: string,
+    @Ip() ipAddress: string
+  ) {
+    const currentRefreshToken = req.cookies['rt'] || refreshTokenFromBody;
+    const { session, refreshToken, accessToken } = await this.service.refreshAccessToken(locale, currentRefreshToken, ipAddress, userAgent);
+    await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
+
+    if (!req.cookies['rt'] && refreshTokenFromBody) {
+      return {
+        accessToken,
+        refreshToken
+      };
+    }
+    return { accessToken };
+  }
+
+  @Public()
+  @Post('login')
+  async login(
+    @Locale() locale: string,
+    @Body() data: LoginDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    const { accessToken, refreshToken, session, mfaMethods, mfaToken, requiresMfa } = await this.service.loginWithEmailAndPassword(locale, ipAddress, userAgent, data);
+
+    if (requiresMfa){
+      return { requiresMfa, mfaToken, mfaMethods }
+    }
+
+    await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
+    if (data.refreshToken) {
+      return { accessToken, refreshToken };
+    }
+    return { accessToken };
+  }
+
+  @Public()
+  @Post('signup')
+  async registerWithEmailAndPassword(
+    @Locale() locale: string,
+    @Body() data: CreateWithEmailAndPasswordDTO,
+  ) {
+    return this.user.createWithEmailAndPassword(locale, data);
+  }
+
+  @Public()
+  @Post('login-code')
+  async loginCode(
+    @Locale() locale: string,
+    @Body() { token, code, methodType }: LoginWithCodeDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    const { accessToken, refreshToken, session } = await this.service.verifyMfaCode(
+      locale,
+      token,
+      code,
+      ipAddress,
+      userAgent,
+      methodType
+    );
+
+    await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
+    return { accessToken, refreshToken };
+  }
+
+  @Public()
+  @Post('login-recovery-code')
+  async loginRecoveryCode(
+    @Locale() locale: string,
+    @Body() { token, code }: LoginWithRecoveryCodeDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    const { accessToken, refreshToken, session } = await this.service.verifyMfaRecoveryCode(
+      locale,
+      token,
+      code,
+      ipAddress,
+      userAgent
+    );
+
+    await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
+    return { accessToken, refreshToken };
+  }
+
+  @Public()
+  @Post('resend-mfa-code')
+  async resendMfaCode(
+    @Locale() locale: string,
+    @Body() { token }: ResendMfaCodeDTO,
+  ) {
+    return this.service.resendMfaCode(locale, token);
+  }
+
+  @Public()
+  @Post('webauthn/generate')
+  async generateWebAuthnOptions(
+    @Body() { mfaToken }: { mfaToken: string }
+  ) {
+    return this.service.generateWebAuthnAuthenticationOptions(mfaToken);
+  }
+
+  @Public()
+  @Post('webauthn/verify')
+  async verifyWebAuthn(
+    @Locale() locale: string,
+    @Body() { mfaToken, assertionResponse }: { mfaToken: string; assertionResponse: any },
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+    @Res({ passthrough: true }) res,
+  ) {
+    const { accessToken, refreshToken, session } = await this.service.verifyWebAuthnAuthentication(
+      locale,
+      mfaToken,
+      assertionResponse,
+      ipAddress,
+      userAgent
+    );
+
+    await this.token.setRefreshTokenCookie(locale, res, refreshToken, session.expires_at);
+    return { accessToken, refreshToken };
+  }
+
+  @Public()
+  @Post('forgot')
+  async forgot(
+    @Locale() locale: string,
+    @Body()
+    data: ForgetDTO,
+  ) {
+    return this.service.forgotPassword(locale, data);
+  }
+
+  @Public()
+  @Post('logout')
+  async logout(
+    @Req() req,
+    @Res({ passthrough: true }) res,
+    @Body('refreshToken') refreshTokenFromBody: string,
+  ) {
+    const refreshToken = req.cookies['rt'] || refreshTokenFromBody;
+    if (!refreshToken) {
+      throw new BadRequestException('Refresh token not provided');
+    }
+
+    await this.service.logout(res, req, refreshToken);
+    return { success: true };
+  }
+
+  @Public()
+  @Post('forgot-reset')
+  async forgotReset(
+    @Locale() locale: string,
+    @Body() { password, code }: ResetDTO,
+    @Ip() ipAddress: string,
+    @Headers('user-agent') userAgent: string,
+  ) {
+    return this.service.forgotResetPassword(locale, password, code, ipAddress, userAgent);
+  }
+}

package/src/auth/auth.module.ts

@@ -0,0 +1,106 @@
+import { MailModule as MailSendModule } from '@hed-hog/api-mail';
+import { PrismaModule, PrismaService } from '@hed-hog/api-prisma';
+import { HttpModule } from '@nestjs/axios';
+import { forwardRef, Global, MiddlewareConsumer, Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { APP_GUARD, Reflector } from '@nestjs/core';
+import { JwtModule } from '@nestjs/jwt';
+import cookieParser from 'cookie-parser';
+import { ChallengeModule } from '../challenge/challenge.module';
+import { ChallengeService } from '../challenge/challenge.service';
+import { MailSentModule } from '../mail-sent/mail-sent.module';
+import { MailVarModule } from '../mail-var/mail-var.module';
+import { MailModule } from '../mail/mail.module';
+import { SecurityModule } from '../security/security.module';
+import { SessionModule } from '../session/session.module';
+import { SettingModule } from '../setting/setting.module';
+import { TokenModule } from '../token/token.module';
+import { TokenService } from '../token/token.service';
+import { UserModule } from '../user/user.module';
+import { IsStrongPasswordWithSettingsConstraint } from '../validators/is-strong-password-with-settings.validator';
+import { AuthController } from './auth.controller';
+import { AuthService } from './auth.service';
+import { AuthGuard } from './guards/auth.guard';
+
+@Global()
+@Module({
+  imports: [
+    forwardRef(() =>
+      JwtModule.registerAsync({
+        global: true,
+        imports: [PrismaModule],
+        inject: [PrismaService],
+        useFactory: async (prisma: PrismaService) => {
+          try {
+            const authSettings = await prisma.setting.findMany({
+              where: {
+                slug: {
+                  in: [
+                    'access-token-expiration-minutes'
+                  ]
+                }
+              },
+              select: {
+                slug: true,
+                value: true,
+              }
+            });
+
+            const settings = new Map<string, string>();
+
+            for (const setting of authSettings) {
+              settings.set(setting.slug, setting.value);
+            }
+
+            const expirationMinutes = settings.get('access-token-expiration-minutes');
+            const expiresIn = expirationMinutes ? parseInt(expirationMinutes, 10) * 60 : 15 * 60;
+
+            return {
+              secret: String(process.env.JWT_SECRET),
+              global: true,
+              signOptions: {
+                expiresIn, // in seconds
+              },
+            };
+          } catch (error) {
+            console.error('Error loading JWT settings from database:', error);
+            throw error;
+          }
+        },
+      }),
+    ),
+    forwardRef(() => PrismaModule),
+    forwardRef(() => MailModule),
+    forwardRef(() => SettingModule),
+    forwardRef(() => MailVarModule),
+    forwardRef(() => MailSentModule),
+    forwardRef(() => MailSendModule),
+    forwardRef(() => UserModule),
+    forwardRef(() => SecurityModule),
+    forwardRef(() => TokenModule),
+    forwardRef(() => ChallengeModule),
+    forwardRef(() => SessionModule),
+    ConfigModule,
+    HttpModule,
+  ],
+  controllers: [AuthController],
+  providers: [
+    Reflector,
+    AuthService,
+    TokenService,
+    ChallengeService,
+    IsStrongPasswordWithSettingsConstraint,
+    {
+      provide: APP_GUARD,
+      useClass: AuthGuard,
+    },
+  ],
+  exports: [AuthService],
+})
+export class AuthModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer
+      .apply(cookieParser())
+      .forRoutes('auth');
+  }
+}