@hed-hog/core 0.0.4

package/src/oauth/providers/microsoft.provider.ts

@@ -0,0 +1,76 @@
+import { HttpService } from '@nestjs/axios';
+import { forwardRef, Inject, Injectable, OnModuleInit } from '@nestjs/common';
+import { SettingService } from '../../setting/setting.service';
+import { BaseOAuthProvider } from './abstract.provider';
+
+@Injectable()
+export class MicrosoftProvider
+  extends BaseOAuthProvider
+  implements OnModuleInit {
+  public settings: Record<string, any> = {};
+
+  constructor(
+    http: HttpService,
+    @Inject(forwardRef(() => SettingService))
+    private readonly setting: SettingService,
+  ) {
+    super(http);
+  }
+
+  async onModuleInit() {
+    this.settings = await this.setting.getSettingValues([
+      'microsoft_client_id',
+      'microsoft_client_secret',
+      'microsoft_scopes',
+      'url',
+    ]);
+  }
+
+  getProviderType() {
+    return 'MICROSOFT';
+  }
+
+  getAuthUrl(callbackPath: string): string {
+    const redirectURI = new URL(callbackPath, this.settings['url']).toString();
+    const scopes = this.settings['microsoft_scopes']
+    const params = new URLSearchParams({
+      client_id: this.settings['microsoft_client_id'],
+      redirect_uri: redirectURI,
+      response_type: 'code',
+      scope: scopes.join(' '),
+      response_mode: 'query',
+      prompt: 'consent',
+    });
+
+    return `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?${params}`;
+  }
+
+  async getProfile(code: string, type: string): Promise<any> {
+    const token = await this.fetchToken({
+      code,
+      url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+      clientId: this.settings['microsoft_client_id'],
+      clientSecret: this.settings['microsoft_client_secret'],
+      redirectUri: `${this.settings['url']}/callback/microsoft/${type}`,
+    });
+
+    const profile = await this.fetchProfile(
+      token.access_token,
+      'https://graph.microsoft.com/v1.0/me',
+    );
+
+    const pictureUrl = 'https://graph.microsoft.com/v1.0/me/photo/$value';
+    return {
+      id: profile.id,
+      email: profile.mail || profile.userPrincipalName,
+      name: profile.displayName,
+      picture: pictureUrl,
+      oauth_tokens: {
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        expires_in: token.expires_in,
+        token_type: token.token_type,
+      },
+    };
+  }
+}

package/src/profile/dto/change-password.dto.ts

@@ -0,0 +1,16 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsString, MinLength } from 'class-validator';
+
+export class ChangePasswordDto {
+  @IsString({
+      message: (args) =>  getLocaleText('profile.changePassword.currentPasswordIsString', args.value)
+  })
+  @MinLength(6)
+  currentPassword: string;
+
+  @IsString({
+      message: (args) =>  getLocaleText('profile.changePassword.newPasswordIsString', args.value)
+  })
+  @MinLength(6)
+  newPassword: string;
+}

package/src/profile/dto/email-verification-confirm.dto.ts

@@ -0,0 +1,19 @@
+
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+export class EmailVerificationDto {
+  @IsString()
+  pin: string;
+
+  @IsString()
+  @IsNotEmpty() 
+  hash: string;
+
+  @IsString()
+  @IsNotEmpty() 
+  name: string;
+
+  @IsEmail()
+  @IsNotEmpty()
+  email: string;
+}

package/src/profile/dto/generate-webauthn-registration-options.dto.ts

@@ -0,0 +1,7 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class GenerateWebAuthnRegistrationOptionsDto {
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+}

package/src/profile/dto/regenerate-recovery-codes.dto.ts

@@ -0,0 +1,18 @@
+import { IsIn, IsOptional, IsString } from 'class-validator';
+
+export class RegenerateRecoveryCodesDto {
+  @IsOptional()
+  @IsString()
+  verificationCode?: string;
+
+  @IsOptional()
+  @IsString()
+  hash?: string;
+
+  @IsOptional()
+  @IsIn(['totp', 'email', 'recovery', 'webauthn'])
+  verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn';
+
+  @IsOptional()
+  assertionResponse?: any;
+}

package/src/profile/dto/remove-email-mfa.dto.ts

@@ -0,0 +1,11 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class RemoveEmailMfaDto {
+    @IsString()
+    @IsNotEmpty()
+    token: string;
+
+    @IsString()
+    @IsNotEmpty()
+    hash: string;
+}

package/src/profile/dto/remove-mfa-with-recovery-code.dto.ts

@@ -0,0 +1,7 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class RemoveMfaWithRecoveryCodeDto {
+  @IsString()
+  @IsNotEmpty()
+  recoveryCode: string;
+}

package/src/profile/dto/remove-mfa.dto.ts

@@ -0,0 +1,18 @@
+import { IsIn, IsOptional, IsString } from 'class-validator';
+
+export class RemoveMfaDto {
+  @IsOptional()
+  @IsString()
+  token?: string;
+
+  @IsOptional()
+  @IsString()
+  hash?: string;
+
+  @IsOptional()
+  @IsIn(['totp', 'email', 'recovery', 'webauthn'])
+  verificationType?: 'totp' | 'email' | 'recovery' | 'webauthn';
+
+  @IsOptional()
+  assertionResponse?: any;
+}

package/src/profile/dto/remove-totp-mfa.dto.ts

@@ -0,0 +1,7 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class RemoveTotpMfaDto {
+    @IsString()
+    @IsNotEmpty()
+    token: string;
+}

package/src/profile/dto/send-email-verification.dto.ts

@@ -0,0 +1,9 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsEmail } from 'class-validator';
+
+export class SendEmailVerificationDto {
+  @IsEmail({},{
+    message: (args) =>  getLocaleText('profile.sendEmailVerification.emailIsString', args.value)
+  })
+  email: string;
+}

package/src/profile/dto/set-preferences.dto.ts

@@ -0,0 +1,11 @@
+import { IsIn, IsOptional, Length } from "class-validator";
+
+export class SetPreferencesDto {
+  @IsOptional()
+  @IsIn(["light", "dark", "system"])
+  theme?: string;
+  
+  @IsOptional()
+  @Length(2, 2)
+  language?: string;
+}

package/src/profile/dto/update.dto.ts

@@ -0,0 +1,10 @@
+
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsString } from 'class-validator';
+
+export class UpdateDto {
+  @IsString({
+    message: (args) =>  getLocaleText('profile.update.nameRequired', args.value)
+  })
+  name: string;
+}

package/src/profile/dto/verify-before-add-mfa.dto.ts

@@ -0,0 +1,16 @@
+import { IsIn, IsOptional, IsString } from 'class-validator';
+
+export class VerifyBeforeAddMfaDto {
+  @IsString()
+  verificationCode: string;
+
+  @IsOptional()
+  @IsString()
+  hash?: string;
+
+  @IsIn(['totp', 'email', 'recovery', 'webauthn'])
+  verificationType: 'totp' | 'email' | 'recovery' | 'webauthn';
+
+  @IsOptional()
+  assertionResponse?: any;
+}

package/src/profile/dto/verify-mfa-totp.dto.ts

@@ -0,0 +1,19 @@
+import { IsNotEmpty, IsString, Matches, MaxLength, MinLength } from 'class-validator';
+
+export class VerifyMfaTotpDto {
+    @IsString()
+    @IsNotEmpty()
+    name: string;
+
+    @IsString()
+    @IsNotEmpty()
+    @MinLength(6)
+    @MaxLength(6)
+    @Matches(/^\d{6}$/, { message: 'Token must be a 6-digit numeric string' })
+    token: string;
+
+    @IsString()
+    @IsNotEmpty()
+    secret: string;
+
+}

package/src/profile/dto/verify-webauthn-registration.dto.ts

@@ -0,0 +1,11 @@
+import { IsNotEmpty, IsObject, IsString } from 'class-validator';
+
+export class VerifyWebAuthnRegistrationDto {
+  @IsString()
+  @IsNotEmpty()
+  name: string;
+
+  @IsObject()
+  @IsNotEmpty()
+  attestationResponse: any;
+}

package/src/profile/dto/verify-webauthn.dto.ts

@@ -0,0 +1,7 @@
+import { IsNotEmpty, IsObject } from 'class-validator';
+
+export class VerifyWebAuthnDto {
+  @IsObject()
+  @IsNotEmpty()
+  assertionResponse: any;
+}

package/src/profile/profile.controller.ts

@@ -0,0 +1,201 @@
+import { User } from '@hed-hog/api';
+import { Locale } from '@hed-hog/api-locale';
+import { Body, Controller, Delete, Get, Param, ParseIntPipe, Post, Put, UploadedFile, UseInterceptors } from '@nestjs/common';
+import { FileInterceptor } from '@nestjs/platform-express';
+import { ChangePasswordDto } from './dto/change-password.dto';
+import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
+import { GenerateWebAuthnRegistrationOptionsDto } from './dto/generate-webauthn-registration-options.dto';
+import { RegenerateRecoveryCodesDto } from './dto/regenerate-recovery-codes.dto';
+import { RemoveEmailMfaDto } from './dto/remove-email-mfa.dto';
+import { RemoveMfaWithRecoveryCodeDto } from './dto/remove-mfa-with-recovery-code.dto';
+import { RemoveMfaDto } from './dto/remove-mfa.dto';
+import { RemoveTotpMfaDto } from './dto/remove-totp-mfa.dto';
+import { SendEmailVerificationDto } from './dto/send-email-verification.dto';
+import { SetPreferencesDto } from './dto/set-preferences.dto';
+import { UpdateDto } from './dto/update.dto';
+import { VerifyBeforeAddMfaDto } from './dto/verify-before-add-mfa.dto';
+import { VerifyMfaTotpDto } from './dto/verify-mfa-totp.dto';
+import { VerifyWebAuthnRegistrationDto } from './dto/verify-webauthn-registration.dto';
+import { VerifyWebAuthnDto } from './dto/verify-webauthn.dto';
+import { ProfileService } from './profile.service';
+
+@Controller('profile')
+export class ProfileController {
+
+  constructor(private readonly profileService: ProfileService) {}
+  
+  @Put('preferences')
+  async updatePreferences(@User() { id }, @Body() data: SetPreferencesDto, @Locale() locale: string) {
+    return this.profileService.updatePreferences(locale, id, data);
+  }
+
+  @Post('mfa/check-verification')
+  async checkMfaBeforeAdd(@User() { id }, @Locale() locale: string) {
+    return this.profileService.checkMfaBeforeAdd(locale, id);
+  }
+
+  @Post('mfa/check-verification-remove')
+  async checkMfaBeforeRemove(@User() { id }, @Locale() locale: string) {
+    return this.profileService.checkMfaBeforeRemove(locale, id);
+  }
+
+  @Post('mfa/verify-before-add')
+  async verifyBeforeAddMfa(
+    @User() { id },
+    @Body() data: VerifyBeforeAddMfaDto,
+    @Locale() locale: string
+  ) {
+    return this.profileService.verifyBeforeAddMfa(locale, id, data);
+  }
+
+  @Post('totp/generate')
+  async generateMfaTotp(@User() { id }, @Locale() locale: string) {
+    return this.profileService.generateMfaTotp(locale, id);
+  }
+
+  @Post('totp/verify')
+  async verifyMfaTotp(@User() { id }, @Body() { token, secret, name }: VerifyMfaTotpDto) {
+    return this.profileService.verifyMfaTotp(id, token, secret, name);
+  }
+
+  @Delete('totp/:mfaId/remove')
+  async removeMfaTotp(@User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token }: RemoveTotpMfaDto) {
+    return this.profileService.removeMfaTotp(id, mfaId, token);
+  }
+
+  @Post('email/verify/confirm')
+  confirmEmailVerification(@User() {id}, @Body() data: EmailVerificationDto, @Locale() locale: string) {
+    return this.profileService.confirmEmailVerification(locale, id, data);
+  }
+
+  @Post('email/verify')
+  sendEmailVerification(@User() {id}, @Body() data: SendEmailVerificationDto, @Locale() locale: string) {
+    return this.profileService.sendEmailVerification(locale, id, data);
+  }
+  
+  @Post('email/send-code-to-remove')
+  sendCodeToRemove(@User() {id}, @Locale() locale: string, @Body() { email }: SendEmailVerificationDto) {
+    return this.profileService.sendCodeToRemove(locale, id, email);
+  }
+
+  @Get('email')
+  getEmailIdentifier(@User() {id}) {
+    return this.profileService.getEmailIdentifier(id);
+  }
+
+  @Delete('email/:mfaId/remove')
+  async removeMfaEmail(@Locale() locale: string, @User() { id }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { token, hash }: RemoveEmailMfaDto) {
+    return this.profileService.removeMfaEmail(locale, id, mfaId, token, hash);
+  }
+
+  @Get()
+  getProfile(@User() {id}) {
+    return this.profileService.getProfile(id);
+  }
+
+  @Get('mfa')
+  getMFAMethod(@User() {id}) {
+    return this.profileService.getMFAMethods(id);
+  }
+
+  @Put('update-mfa/:mfaId')
+  updateMFA(@User() { id: userId }, @Param('mfaId', ParseIntPipe) mfaId: number, @Body() { name }: UpdateDto) {
+    return this.profileService.updateMFA(userId, mfaId, { name });
+  }
+
+  @Delete('mfa/:mfaId/remove-with-recovery-code')
+  async removeMfaWithRecoveryCode(
+    @User() { id },
+    @Param('mfaId', ParseIntPipe) mfaId: number,
+    @Body() { recoveryCode }: RemoveMfaWithRecoveryCodeDto,
+    @Locale() locale: string
+  ) {
+    return this.profileService.removeMfaWithRecoveryCode(locale, id, mfaId, recoveryCode);
+  }
+
+  @Delete('mfa/:mfaId/remove')
+  async removeMfa(
+    @User() { id },
+    @Param('mfaId', ParseIntPipe) mfaId: number,
+    @Body() data: RemoveMfaDto,
+    @Locale() locale: string
+  ) {
+    return this.profileService.removeMfa(locale, id, mfaId, data);
+  }
+
+  @Post('recovery-codes/send-verification')
+  async sendRecoveryCodesVerification(
+    @User() { id },
+    @Locale() locale: string
+  ) {
+    return this.profileService.sendRecoveryCodesVerification(locale, id);
+  }
+
+  @Post('recovery-codes/regenerate')
+  async regenerateRecoveryCodes(
+    @User() { id },
+    @Body() data: RegenerateRecoveryCodesDto,
+    @Locale() locale: string
+  ) {
+    return this.profileService.regenerateRecoveryCodes(locale, id, data);
+  }
+
+  @Post('webauthn/generate')
+  async generateWebAuthnRegistrationOptions(
+    @User() { id },
+    @Body() { name }: GenerateWebAuthnRegistrationOptionsDto,
+    @Locale() locale: string
+  ) {
+    return this.profileService.generateWebAuthnRegistrationOptions(locale, id, name);
+  }
+
+  @Post('webauthn/verify')
+  async verifyWebAuthnRegistration(
+    @User() { id },
+    @Body() { name, attestationResponse }: VerifyWebAuthnRegistrationDto,
+    @Locale() locale: string
+  ) {
+    return this.profileService.verifyWebAuthnRegistration(locale, id, name, attestationResponse);
+  }
+
+  @Post('webauthn/authenticate/generate')
+  async generateWebAuthnAuthenticationOptions(
+    @User() { id },
+    @Locale() locale: string
+  ) {
+    return this.profileService.generateWebAuthnAuthenticationOptions(locale, id);
+  }
+
+  @Post('webauthn/authenticate/verify')
+  async verifyWebAuthnAuthentication(
+    @User() { id },
+    @Body() { assertionResponse }: VerifyWebAuthnDto
+  ) {
+    return this.profileService.verifyWebAuthnAuthentication(id, assertionResponse);
+  }
+
+  @Delete('webauthn/:mfaId/remove')
+  async removeWebAuthnMfa(
+    @User() { id },
+    @Param('mfaId', ParseIntPipe) mfaId: number,
+    @Locale() locale: string
+  ) {
+    return this.profileService.removeWebAuthnMfa(locale, id, mfaId);
+  }
+
+  @Put('change-password')
+  changePassword(@User() {id}, @Body() body: ChangePasswordDto, @Locale() locale: string) {
+    return this.profileService.changePassword(locale, id, body);
+  }
+
+  @UseInterceptors(FileInterceptor('file'))
+  @Put('avatar')
+  updateAvatar(@User() { id }, @UploadedFile() file: MulterFile) {
+    return this.profileService.updateAvatar(id, file);
+  }
+
+  @Put()
+  update(@Body() data: UpdateDto, @User() {id}) {
+    return this.profileService.update(id, data);
+  }
+}

package/src/profile/profile.module.ts

@@ -0,0 +1,21 @@
+import { forwardRef, Module } from '@nestjs/common';
+import { ChallengeModule } from '../challenge/challenge.module';
+import { SecurityModule } from '../security/security.module';
+import { SettingModule } from '../setting/setting.module';
+import { TokenModule } from '../token/token.module';
+import { UserModule } from '../user/user.module';
+import { ProfileController } from './profile.controller';
+import { ProfileService } from './profile.service';
+
+@Module({
+  imports: [
+    forwardRef(() => UserModule),
+    forwardRef(() => SecurityModule),
+    forwardRef(() => ChallengeModule),
+    forwardRef(() => SettingModule),
+    forwardRef(() => TokenModule),
+  ],
+  controllers: [ProfileController],
+  providers: [ProfileService],
+})
+export class ProfileModule {}