@hed-hog/core 0.0.4

package/src/auth/dto/login-with-recovery-code.ts

@@ -0,0 +1,10 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsJWT, IsString } from 'class-validator';
+
+export class LoginWithRecoveryCodeDTO {
+  @IsString({ message: (args) => getLocaleText('validation.codeMustBeString', args.value) })
+  code: string;
+
+  @IsJWT({ message: (args) => getLocaleText('validation.tokenMustBeJWT', args.value) })
+  token: string;
+}

package/src/auth/dto/login.dto.ts

@@ -0,0 +1,33 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { Transform } from 'class-transformer';
+import { IsBoolean, IsEmail, IsOptional, IsStrongPassword } from 'class-validator';
+
+export class LoginDTO {
+  @IsEmail({}, { message: (args) => getLocaleText('validation.emailInvalid', args.value) })
+  set email(value: string) {
+    this._email = value?.trim().toLowerCase();
+  }
+  get email(): string {
+    return this._email;
+  }
+  private _email: string;
+
+  @IsStrongPassword(
+    {
+      minLength: 6,
+      minLowercase: 0,
+      minUppercase: 0,
+      minNumbers: 0,
+      minSymbols: 0,
+    },
+    {
+      message: (args) => getLocaleText('validation.passwordStrength', args.value),
+    },
+  )
+  password: string;
+
+  @IsOptional()
+  @IsBoolean()
+  @Transform(({ value }) => value === undefined ? false : value)
+  refreshToken?: boolean = false;
+}

package/src/auth/dto/resend-mfa-code.dto.ts

@@ -0,0 +1,6 @@
+import { IsJWT } from 'class-validator';
+
+export class ResendMfaCodeDTO {
+  @IsJWT({ message: 'Token inválido' })
+  token: string;
+}

package/src/auth/dto/reset.dto.ts

@@ -0,0 +1,13 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsNotEmpty, MinLength } from 'class-validator';
+
+export class ResetDTO {
+  @IsNotEmpty({
+    message: (args) =>  getLocaleText('reset.password.required', args.value)
+  })
+  @MinLength(8, { message: (args) => getLocaleText('reset.password.minLength', args.value) })
+  password: string;
+
+  @IsNotEmpty({ message: (args) => getLocaleText('reset.code.required', args.value) })
+  code: string;
+}

package/src/auth/enums/multifactor-type.enum.ts

@@ -0,0 +1,4 @@
+export enum MultifactorType {
+  EMAIL = 1,
+  APP = 2,
+}

package/src/auth/guards/auth.guard.ts

@@ -0,0 +1,59 @@
+import { IS_PUBLIC_KEY } from '@hed-hog/api';
+import { getLocaleText } from '@hed-hog/api-locale';
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { TokenService } from '../../token/token.service';
+
+@Injectable()
+export class AuthGuard implements CanActivate {
+  constructor(
+    private token: TokenService,
+    private reflector: Reflector,
+  ) { }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractTokenFromHeader(request);
+    const locale = request.headers['locale'] || request.headers['accept-language'] || 'en';
+
+    if (!token) {
+      if (isPublic) {
+        return true;
+      } else {
+        throw new UnauthorizedException(
+          getLocaleText('accessDenied', locale, 'Access denied.'),
+        );
+      }
+    }
+    try {
+      const payload = await this.token.verify(locale, token);
+
+      request['auth'] = payload;
+    } catch (error) {
+      if (isPublic) {
+        return true;
+      } else {
+        throw new UnauthorizedException(error);
+      }
+    }
+
+    return true;
+  }
+
+  private extractTokenFromHeader(request: Request): string | undefined {
+    const [type, token] = request.headers.authorization?.split(' ') ?? [];
+
+    return type === 'Bearer' ? token : undefined;
+  }
+}

package/src/challenge/challenge.module.ts

@@ -0,0 +1,20 @@
+import { PrismaModule } from "@hed-hog/api-prisma";
+import { forwardRef, Module } from "@nestjs/common";
+import { MailModule } from "../mail/mail.module";
+import { SecurityModule } from "../security/security.module";
+import { SettingModule } from "../setting/setting.module";
+import { TokenModule } from "../token/token.module";
+import { ChallengeService } from "./challenge.service";
+
+@Module({
+  providers: [ChallengeService],
+  exports: [ChallengeService],
+  imports: [
+     forwardRef(() => PrismaModule),
+     forwardRef(() => SettingModule),
+     forwardRef(() => TokenModule),
+     forwardRef(() => SecurityModule),
+     forwardRef(() => MailModule),
+  ]
+})
+export class ChallengeModule { }

package/src/challenge/challenge.service.ts

@@ -0,0 +1,327 @@
+import { getLocaleText } from "@hed-hog/api-locale";
+import { PrismaService } from '@hed-hog/api-prisma';
+import { BadRequestException, forwardRef, Inject, Injectable, NotFoundException, OnModuleInit } from "@nestjs/common";
+import { MailService } from "../mail/mail.service";
+import { SecurityService } from "../security/security.service";
+import { SettingService } from "../setting/setting.service";
+import { TokenService } from "../token/token.service";
+
+@Injectable()
+export class ChallengeService implements OnModuleInit {
+
+  public settings: Record<string, any> = {};
+
+  constructor(
+    private readonly prisma: PrismaService,
+    @Inject(forwardRef(() => SecurityService))
+    private readonly security: SecurityService,
+    @Inject(forwardRef(() => SettingService))
+    private readonly setting: SettingService,
+    @Inject(forwardRef(() => TokenService))
+    private readonly token: TokenService,
+    @Inject(forwardRef(() => MailService))
+    private readonly mail: MailService,
+  ) { }
+
+  async onModuleInit() {
+    this.settings = await this.setting.getSettingValues([
+      'mfa-challenge-expiration-minutes',
+      'mfa-email-code-length',
+      'url'
+    ]);
+  }
+
+  async verifyEmail(locale: string, userId: number, email: string) {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { name: true }
+    });
+
+    if (!user) {
+      throw new NotFoundException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    const code = Array.from(crypto.getRandomValues(new Uint8Array(this.settings['mfa-email-code-length'] || 6)))
+      .map(n => (n % 10).toString())
+      .join('');
+
+    const codeHash = this.security.hashWithPepper(code);
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email,
+        slug: 'auth-sign-up-confirm-email',
+        variables: {
+          code,
+          name: user.name,
+        }
+      }
+    );
+
+    return { codeHash };
+  }
+
+  async verifyMultipleEmails(locale: string, userId: number, emails: string[]) {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { name: true }
+    });
+
+    if (!user) {
+      throw new NotFoundException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    const code = Array.from(crypto.getRandomValues(new Uint8Array(this.settings['mfa-email-code-length'] || 6)))
+      .map(n => (n % 10).toString())
+      .join('');
+
+
+    const codeHash = this.security.hashWithPepper(code);
+    for (const email of emails) {
+      this.mail.sendTemplatedMail(
+        locale,
+        {
+          email,
+          slug: 'auth-sign-up-confirm-email',
+          variables: {
+            code,
+            name: user.name,
+          }
+        }
+      );
+    }
+
+    return { codeHash };
+  }
+
+  async forgotEmail(locale: string, email: string) {
+    const openChallengesCount = await this.prisma.user_mfa_challenge.count({
+      where: {
+        user_mfa: {
+          user_mfa_email: {
+            some: { email }
+          }
+        },
+        expires_at: { gt: new Date() }
+      }
+    });
+
+    if (openChallengesCount >= 3) {
+      throw new BadRequestException(getLocaleText('forgot.rateLimit', locale, 'Too many password reset requests. Please try again later.'));
+    }
+
+    const userMfaEmail = await this.prisma.user_mfa_email.findFirst({
+      where: { email },
+      include: {
+        user_mfa: { include: { user: true } },
+      },
+    });
+
+    if (!userMfaEmail) throw new BadRequestException(getLocaleText('forgot.userNotFound', locale, 'User not found'));
+    const token = await this.token.createOpaqueToken(16);
+    const hash = this.security.hashWithPepper(token);
+    const challenge = await this.prisma.user_mfa_challenge.create({
+      data: {
+        hash,
+        expires_at: new Date(Date.now() + (this.settings['mfa-challenge-expiration-minutes'] || 15) * 60000),
+        user_mfa_id: userMfaEmail.user_mfa_id,
+      },
+    });
+
+    const tokenBase64 = Buffer.from(token).toString('base64');
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email,
+        slug: 'auth-forget-password',
+        variables: {
+          link: `${this.settings['url']}/reset-password?token=${tokenBase64}`,
+          name: userMfaEmail.user_mfa.user.name,
+        }
+      }
+    );
+
+    return challenge;
+  }
+
+  async verifyCodePassword(locale: string, code: string) {
+    const hash = this.security.hashWithPepper(code);
+    const challenge = await this.prisma.user_mfa_challenge.findFirst({
+      where: {
+        hash,
+        expires_at: { gt: new Date() }
+      },
+      include: {
+        user_mfa: { include: { user: true } },
+      },
+    });
+
+    if (!challenge) {
+      throw new BadRequestException(getLocaleText('challenge.invalidOrExpired', locale, 'The provided code is invalid or has expired.'));
+    }
+
+    return challenge;
+  }
+
+  async verifyCode(locale: string, userId: number, code: string, providedHash: string, name?: string, email?: string) {
+    const hash = this.security.hashWithPepper(code);
+    if (providedHash && hash !== providedHash){
+      throw new BadRequestException(getLocaleText('challenge.invalidOrExpired', locale, 'The provided code is invalid or has expired.'));
+    }
+
+    if (name && email){
+      const challenge = await this.prisma.user_mfa.create({
+        data: {
+          name,
+          type: 'email',
+          user_id: userId,
+          verified_at: new Date(),
+          user_mfa_challenge: {
+            create: {
+              hash: providedHash,
+              expires_at: new Date(),
+              verified_at: new Date(),
+              attempts: 1,
+            }
+          },
+          user_mfa_email: {
+            create: {
+              email: email,
+            },
+          }
+        }
+      })
+
+      if (challenge.user_id !== userId) {
+        throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+      }
+
+      return challenge;
+    }
+    
+    return { success: true }
+  }
+
+  async sendMfaCodeByEmail(locale: string, userId: number, email: string) {
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { name: true }
+    });
+
+    if (!user) {
+      throw new BadRequestException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    const code = Array.from(crypto.getRandomValues(new Uint8Array(this.settings['mfa-email-code-length'] || 6)))
+      .map(n => (n % 10).toString())
+      .join('');
+          
+    const hash = this.security.hashWithPepper(code);
+    const expiresAt = new Date(Date.now() + (this.settings['mfa-challenge-expiration-minutes'] || 15) * 60000);
+    const existingUserMfa = await this.prisma.user_mfa.findFirst({
+      where: { user_id: userId, type: 'email' },
+      select: { id: true }
+    });
+
+    await this.prisma.user_mfa_challenge.create({
+      data: {
+        hash,
+        expires_at: expiresAt,
+        user_mfa: existingUserMfa
+          ? { connect: { id: existingUserMfa.id } }
+          : { create: { name: user.name, type: 'email', user: { connect: { id: userId } } } }
+      }
+    });
+
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email,
+        slug: 'auth-mfa-code',
+        variables: {
+          code,
+          name: user.name,
+        }
+      }
+    );
+
+    return { success: true };
+  }
+
+  async verifyMfaEmailCode(locale: string, userId: number, code: string): Promise<boolean> {
+    const hash = this.security.hashWithPepper(code);
+    const challenge = await this.prisma.user_mfa_challenge.findFirst({
+      where: {
+        hash,
+        expires_at: { gt: new Date() },
+        user_mfa: {
+          user_id: userId,
+          type: 'email'
+        }
+      }
+    });
+
+    if (!challenge) {
+      return false;
+    }
+
+    await this.prisma.user_mfa_challenge.delete({
+      where: { id: challenge.id }
+    });
+
+    return true;
+  }
+
+  async sendMfaCodeToMultipleEmails(locale: string, userId: number, emails: string[]) {
+    if (!emails || emails.length === 0) {
+      return { success: true };
+    }
+
+    const user = await this.prisma.user.findUnique({
+      where: { id: userId },
+      select: { name: true }
+    });
+
+    if (!user) {
+      throw new BadRequestException(getLocaleText('userNotFound', locale, 'User not found.'));
+    }
+
+    const code = Array.from(crypto.getRandomValues(new Uint8Array(this.settings['mfa-email-code-length'] || 6)))
+      .map(n => (n % 10).toString())
+      .join('');
+
+    const hash = this.security.hashWithPepper(code);
+    const expiresAt = new Date(Date.now() + (this.settings['mfa-challenge-expiration-minutes'] || 15) * 60000);
+    
+    const existingUserMfa = await this.prisma.user_mfa.findFirst({
+      where: { user_id: userId, type: 'email' },
+      select: { id: true }
+    });
+
+    await this.prisma.user_mfa_challenge.create({
+      data: {
+        hash,
+        expires_at: expiresAt,
+        user_mfa: existingUserMfa
+          ? { connect: { id: existingUserMfa.id } }
+          : { create: { name: user.name, type: 'email', user: { connect: { id: userId } } } }
+      }
+    });
+
+    for (const email of emails) {
+      this.mail.sendTemplatedMail(
+        locale,
+        {
+          email,
+          slug: 'auth-mfa-code',
+          variables: {
+            code,
+            name: user.name,
+          }
+        }
+      );
+    }
+
+    return { success: true };
+  }
+}

package/src/core/system.controller.ts

@@ -0,0 +1,15 @@
+import { Controller, forwardRef, Get, Inject } from '@nestjs/common';
+import { SystemService } from './system.service';
+
+@Controller('system')
+export class SystemController {
+  constructor(
+    @Inject(forwardRef(() => SystemService))
+    private readonly service: SystemService,
+  ) {}
+
+  @Get()
+  async index() {
+    return this.service.index();
+  }
+}

package/src/core/system.module.ts

@@ -0,0 +1,17 @@
+import { PrismaModule } from '@hed-hog/api-prisma';
+import { forwardRef, Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { SystemController } from './system.controller';
+import { SystemService } from './system.service';
+
+@Module({
+  imports: [
+    forwardRef(() =>
+      JwtModule,
+    ),
+    forwardRef(() => PrismaModule),
+  ],
+  controllers: [SystemController],
+  providers: [SystemService],
+})
+export class SystemModule { }