@hilbras/keystone 1.1.0

package/src/plugins/rateLimit.ts

@@ -0,0 +1,133 @@
+import crypto from "node:crypto";
+import fp from "fastify-plugin";
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { redis, isRedisReady } from "../services/redis.js";
+
+interface RateLimitPluginOptions {
+  keyPrefix: string;
+  maxAttempts: number;
+  windowSeconds: number;
+}
+
+export interface GlobalRateLimitOptions {
+  maxRequests?: number;
+  windowSeconds?: number;
+  keyPrefix?: string;
+}
+
+/**
+ * Atomic sliding-window rate limit script.
+ *
+ * Returns the number of requests already seen in the current window *before*
+ * recording the current request. The request is only recorded when the count
+ * is still below the limit, so blocked requests do not pollute the window.
+ */
+const slidingWindowLua = `
+local key = KEYS[1]
+local windowMs = tonumber(ARGV[1])
+local now = tonumber(ARGV[2])
+local member = ARGV[3]
+local maxAttempts = tonumber(ARGV[4])
+local windowStart = now - windowMs
+
+redis.call("zremrangebyscore", key, 0, windowStart)
+local count = redis.call("zcard", key)
+if count >= maxAttempts then
+  return count
+end
+
+redis.call("zadd", key, now, member)
+redis.call("pexpire", key, windowMs)
+return count
+`;
+
+async function isAllowed(key: string, maxAttempts: number, windowSeconds: number): Promise<boolean> {
+  if (!isRedisReady()) {
+    // Fail open when Redis is not connected; the endpoint remains functional.
+    return true;
+  }
+
+  const now = Date.now();
+  const member = `${now}:${cryptoRandom()}`;
+
+  try {
+    const count = (await redis.eval(
+      slidingWindowLua,
+      1,
+      key,
+      windowSeconds * 1000,
+      now,
+      member,
+      maxAttempts
+    )) as number;
+    return count < maxAttempts;
+  } catch (err) {
+    // Fail open on transient Redis errors so a network blip cannot lock users out.
+    console.error("[rateLimit] Redis error:", err);
+    return true;
+  }
+}
+
+function cryptoRandom(): string {
+  return crypto.randomBytes(8).toString("hex");
+}
+
+function clientIdentifier(request: FastifyRequest): string {
+  return (
+    (request.headers["x-forwarded-for"] as string)?.split(",")[0]?.trim() ||
+    request.ip
+  );
+}
+
+export function rateLimit(options: RateLimitPluginOptions) {
+  return async function preHandler(request: FastifyRequest, reply: FastifyReply) {
+    const id = clientIdentifier(request);
+    const key = `${options.keyPrefix}:${id}:${(request.body as Record<string, string> | undefined)?.email ?? ""}`;
+    const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
+    if (!allowed) {
+      return reply
+        .header("Retry-After", String(options.windowSeconds))
+        .status(429)
+        .send({ error: "Too many attempts. Please try again later." });
+    }
+  };
+}
+
+export function globalRateLimit(options: GlobalRateLimitOptions = {}) {
+  const maxRequests = options.maxRequests ?? 100;
+  const windowSeconds = options.windowSeconds ?? 60;
+  const keyPrefix = options.keyPrefix ?? "global";
+
+  return async function onRequest(request: FastifyRequest, reply: FastifyReply) {
+    const id = clientIdentifier(request);
+    const key = `${keyPrefix}:${id}`;
+    const allowed = await isAllowed(key, maxRequests, windowSeconds);
+    if (!allowed) {
+      return reply
+        .header("Retry-After", String(windowSeconds))
+        .status(429)
+        .send({ error: "Rate limit exceeded. Please slow down." });
+    }
+  };
+}
+
+export function appRateLimit(options: { maxAttempts: number; windowSeconds: number }) {
+  return async function preHandler(request: FastifyRequest, reply: FastifyReply) {
+    const clientId = (request.body as Record<string, string> | undefined)?.client_id ?? "anonymous";
+    const id = clientIdentifier(request);
+    const key = `app:${clientId}:${id}`;
+    const allowed = await isAllowed(key, options.maxAttempts, options.windowSeconds);
+    if (!allowed) {
+      return reply
+        .header("Retry-After", String(options.windowSeconds))
+        .status(429)
+        .send({ error: "Too many attempts for this application. Please try again later." });
+    }
+  };
+}
+
+export default fp(async function rateLimitPlugin(app: FastifyInstance) {
+  app.addHook("onClose", async () => {
+    await redis.quit();
+  });
+});

package/src/plugins/requestLogger.ts

@@ -0,0 +1,25 @@
+import fp from "fastify-plugin";
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+
+export default fp(async function requestLogger(app: FastifyInstance) {
+  app.addHook("onRequest", async (request: FastifyRequest, reply: FastifyReply) => {
+    (request as unknown as Record<string, unknown>)._startTime = Date.now();
+    reply.header("request-id", request.id);
+  });
+
+  app.addHook("onResponse", async (request: FastifyRequest, reply: FastifyReply) => {
+    const start = (request as unknown as Record<string, unknown>)._startTime as number | undefined;
+    const durationMs = start ? Date.now() - start : undefined;
+    request.log.info(
+      {
+        requestId: request.id,
+        method: request.method,
+        path: request.url,
+        statusCode: reply.statusCode,
+        durationMs,
+        ip: request.ip,
+      },
+      "request"
+    );
+  });
+});

package/src/plugins/tracing.ts

@@ -0,0 +1,22 @@
+import { NodeSDK } from "@opentelemetry/sdk-node";
+import { getNodeAutoInstrumentations } from "@opentelemetry/auto-instrumentations-node";
+import { config } from "../config.js";
+
+let sdk: NodeSDK | undefined;
+
+export function startTracing(): void {
+  if (sdk) return;
+  if (config.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+    sdk = new NodeSDK({
+      instrumentations: [getNodeAutoInstrumentations()],
+    });
+    sdk.start();
+  }
+}
+
+export async function stopTracing(): Promise<void> {
+  if (sdk) {
+    await sdk.shutdown();
+    sdk = undefined;
+  }
+}

package/src/repositories/apiKey.ts

@@ -0,0 +1,158 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { apiKeys, type ApiKey } from "../db/schema.js";
+
+type ApiKeyPublic = Omit<ApiKey, "keyHash">;
+
+export interface ApiKeyRepository {
+  create(input: {
+    userId?: string | null;
+    serviceAccountId?: string | null;
+    orgId?: string | null;
+    appId?: string | null;
+    name: string;
+    prefix: string;
+    keyHash: string;
+    scopes?: string[];
+    expiresAt?: Date | null;
+  }): Promise<ApiKey>;
+  listByUserId(userId: string): Promise<ApiKeyPublic[]>;
+  listByOrgId(orgId: string): Promise<ApiKeyPublic[]>;
+  listByServiceAccountId(serviceAccountId: string): Promise<ApiKeyPublic[]>;
+  revokeByKeyIdAndUserId(keyId: string, userId: string): Promise<ApiKeyPublic | undefined>;
+  revokeByKeyIdAndOrgId(keyId: string, orgId: string): Promise<ApiKeyPublic | undefined>;
+}
+
+export class DrizzleApiKeyRepository implements ApiKeyRepository {
+  async create(input: {
+    userId?: string | null;
+    serviceAccountId?: string | null;
+    orgId?: string | null;
+    appId?: string | null;
+    name: string;
+    prefix: string;
+    keyHash: string;
+    scopes?: string[];
+    expiresAt?: Date | null;
+  }): Promise<ApiKey> {
+    const [record] = await db
+      .insert(apiKeys)
+      .values({
+        userId: input.userId ?? null,
+        serviceAccountId: input.serviceAccountId ?? null,
+        orgId: input.orgId ?? null,
+        appId: input.appId ?? null,
+        name: input.name,
+        prefix: input.prefix,
+        keyHash: input.keyHash,
+        scopes: input.scopes?.length ? input.scopes : ["api:read"],
+        expiresAt: input.expiresAt ?? null,
+      })
+      .returning();
+    return record;
+  }
+
+  async listByUserId(userId: string): Promise<ApiKeyPublic[]> {
+    return db
+      .select({
+        id: apiKeys.id,
+        userId: apiKeys.userId,
+        serviceAccountId: apiKeys.serviceAccountId,
+        orgId: apiKeys.orgId,
+        appId: apiKeys.appId,
+        name: apiKeys.name,
+        prefix: apiKeys.prefix,
+        scopes: apiKeys.scopes,
+        lastUsedAt: apiKeys.lastUsedAt,
+        expiresAt: apiKeys.expiresAt,
+        revokedAt: apiKeys.revokedAt,
+        createdAt: apiKeys.createdAt,
+      })
+      .from(apiKeys)
+      .where(eq(apiKeys.userId, userId));
+  }
+
+  async listByOrgId(orgId: string): Promise<ApiKeyPublic[]> {
+    return db
+      .select({
+        id: apiKeys.id,
+        userId: apiKeys.userId,
+        serviceAccountId: apiKeys.serviceAccountId,
+        orgId: apiKeys.orgId,
+        appId: apiKeys.appId,
+        name: apiKeys.name,
+        prefix: apiKeys.prefix,
+        scopes: apiKeys.scopes,
+        lastUsedAt: apiKeys.lastUsedAt,
+        expiresAt: apiKeys.expiresAt,
+        revokedAt: apiKeys.revokedAt,
+        createdAt: apiKeys.createdAt,
+      })
+      .from(apiKeys)
+      .where(eq(apiKeys.orgId, orgId));
+  }
+
+  async listByServiceAccountId(serviceAccountId: string): Promise<ApiKeyPublic[]> {
+    return db
+      .select({
+        id: apiKeys.id,
+        userId: apiKeys.userId,
+        serviceAccountId: apiKeys.serviceAccountId,
+        orgId: apiKeys.orgId,
+        appId: apiKeys.appId,
+        name: apiKeys.name,
+        prefix: apiKeys.prefix,
+        scopes: apiKeys.scopes,
+        lastUsedAt: apiKeys.lastUsedAt,
+        expiresAt: apiKeys.expiresAt,
+        revokedAt: apiKeys.revokedAt,
+        createdAt: apiKeys.createdAt,
+      })
+      .from(apiKeys)
+      .where(eq(apiKeys.serviceAccountId, serviceAccountId));
+  }
+
+  async revokeByKeyIdAndUserId(keyId: string, userId: string): Promise<ApiKeyPublic | undefined> {
+    const [record] = await db
+      .update(apiKeys)
+      .set({ revokedAt: new Date() })
+      .where(and(eq(apiKeys.id, keyId), eq(apiKeys.userId, userId)))
+      .returning({
+        id: apiKeys.id,
+        userId: apiKeys.userId,
+        serviceAccountId: apiKeys.serviceAccountId,
+        orgId: apiKeys.orgId,
+        appId: apiKeys.appId,
+        name: apiKeys.name,
+        prefix: apiKeys.prefix,
+        scopes: apiKeys.scopes,
+        lastUsedAt: apiKeys.lastUsedAt,
+        expiresAt: apiKeys.expiresAt,
+        revokedAt: apiKeys.revokedAt,
+        createdAt: apiKeys.createdAt,
+      });
+    return record;
+  }
+
+  async revokeByKeyIdAndOrgId(keyId: string, orgId: string): Promise<ApiKeyPublic | undefined> {
+    const [record] = await db
+      .update(apiKeys)
+      .set({ revokedAt: new Date() })
+      .where(and(eq(apiKeys.id, keyId), eq(apiKeys.orgId, orgId)))
+      .returning({
+        id: apiKeys.id,
+        userId: apiKeys.userId,
+        serviceAccountId: apiKeys.serviceAccountId,
+        orgId: apiKeys.orgId,
+        appId: apiKeys.appId,
+        name: apiKeys.name,
+        prefix: apiKeys.prefix,
+        scopes: apiKeys.scopes,
+        lastUsedAt: apiKeys.lastUsedAt,
+        expiresAt: apiKeys.expiresAt,
+        revokedAt: apiKeys.revokedAt,
+        createdAt: apiKeys.createdAt,
+      });
+    return record;
+  }
+}

package/src/repositories/application.ts

@@ -0,0 +1,70 @@
+import crypto from "node:crypto";
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { applications, type Application } from "../db/schema.js";
+import { generateClientSecret, hashClientSecret } from "../services/secrets.js";
+import type {
+  ApplicationRepository,
+  CreateApplicationInput,
+  UpdateApplicationInput,
+} from "./types.js";
+
+export class DrizzleApplicationRepository implements ApplicationRepository {
+  private generateClientId(): string {
+    return `app_${crypto.randomBytes(16).toString("base64url")}`;
+  }
+
+  async create(input: CreateApplicationInput): Promise<Application & { clientSecret: string }> {
+    const clientSecret = input.clientSecret || generateClientSecret();
+    const [app] = await db
+      .insert(applications)
+      .values({
+        orgId: input.orgId,
+        clientId: input.clientId || this.generateClientId(),
+        clientSecretHash: hashClientSecret(clientSecret),
+        name: input.name,
+        redirectUris: input.redirectUris ?? [],
+        allowedOrigins: input.allowedOrigins ?? [],
+      })
+      .returning();
+    return { ...app, clientSecret };
+  }
+
+  async findByClientId(clientId: string): Promise<Application | undefined> {
+    const [app] = await db
+      .select()
+      .from(applications)
+      .where(eq(applications.clientId, clientId))
+      .limit(1);
+    return app;
+  }
+
+  async listByOrgId(orgId: string): Promise<Application[]> {
+    return db.select().from(applications).where(eq(applications.orgId, orgId));
+  }
+
+  async update(
+    appId: string,
+    orgId: string,
+    input: UpdateApplicationInput
+  ): Promise<Application | undefined> {
+    const [updated] = await db
+      .update(applications)
+      .set(input)
+      .where(and(eq(applications.id, appId), eq(applications.orgId, orgId)))
+      .returning();
+    return updated;
+  }
+
+  async verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined> {
+    const [app] = await db
+      .select()
+      .from(applications)
+      .where(and(eq(applications.clientId, clientId), eq(applications.isActive, true)))
+      .limit(1);
+
+    if (!app) return undefined;
+    if (app.clientSecretHash !== hashClientSecret(secret)) return undefined;
+    return app;
+  }
+}

package/src/repositories/audit.ts

@@ -0,0 +1,32 @@
+import { eq, and, desc, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { auditLog } from "../db/schema.js";
+import type { AuditRepository } from "./types.js";
+
+export class DrizzleAuditRepository implements AuditRepository {
+  async list(opts: {
+    orgId?: string;
+    appId?: string;
+    userId?: string;
+    event?: string;
+    limit?: number;
+    offset?: number;
+  }): Promise<typeof auditLog.$inferSelect[]> {
+    const limit = opts.limit ?? 50;
+    const offset = opts.offset ?? 0;
+
+    const conditions = [];
+    if (opts.orgId) conditions.push(eq(auditLog.orgId, opts.orgId));
+    if (opts.appId) conditions.push(eq(auditLog.appId, opts.appId));
+    if (opts.userId) conditions.push(eq(auditLog.userId, opts.userId));
+    if (opts.event) conditions.push(eq(auditLog.event, opts.event));
+
+    return db
+      .select()
+      .from(auditLog)
+      .where(conditions.length ? and(...conditions) : sql`true`)
+      .orderBy(desc(auditLog.createdAt))
+      .limit(limit)
+      .offset(offset);
+  }
+}

package/src/repositories/index.ts

@@ -0,0 +1,9 @@
+export * from "./types.js";
+export { DrizzleUserRepository, DrizzleIdentityRepository } from "./user.js";
+export { DrizzleOrganizationRepository } from "./organization.js";
+export { DrizzleApplicationRepository } from "./application.js";
+export { DrizzleAuditRepository } from "./audit.js";
+export { DrizzlePermissionRepository } from "./permission.js";
+export { DrizzleApiKeyRepository, type ApiKeyRepository } from "./apiKey.js";
+export { DrizzleSamlConnectionRepository, type SamlConnectionRepository } from "./samlConnection.js";
+export { DrizzleOidcConnectionRepository, type OidcConnectionRepository } from "./oidcConnection.js";

package/src/repositories/oidcConnection.ts

@@ -0,0 +1,111 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { oidcConnections, type OidcConnection } from "../db/schema.js";
+
+export type OidcConnectionListItem = {
+  id: string;
+  name: string;
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  userinfoEndpoint: string | null;
+  jwksUri: string | null;
+  clientId: string;
+  scopes: string[];
+  isActive: boolean;
+  createdAt: Date;
+};
+
+export interface OidcConnectionRepository {
+  listByOrgId(orgId: string): Promise<OidcConnectionListItem[]>;
+  findById(id: string): Promise<OidcConnection | undefined>;
+  findActiveById(id: string): Promise<OidcConnection | undefined>;
+  create(input: {
+    orgId: string;
+    name: string;
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint?: string;
+    jwksUri?: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+    attributeMapping?: Record<string, unknown>;
+    isActive?: boolean;
+  }): Promise<OidcConnection>;
+  deleteByIdAndOrgId(id: string, orgId: string): Promise<OidcConnection | undefined>;
+}
+
+export class DrizzleOidcConnectionRepository implements OidcConnectionRepository {
+  async listByOrgId(orgId: string) {
+    return db
+      .select({
+        id: oidcConnections.id,
+        name: oidcConnections.name,
+        issuer: oidcConnections.issuer,
+        authorizationEndpoint: oidcConnections.authorizationEndpoint,
+        tokenEndpoint: oidcConnections.tokenEndpoint,
+        userinfoEndpoint: oidcConnections.userinfoEndpoint,
+        jwksUri: oidcConnections.jwksUri,
+        clientId: oidcConnections.clientId,
+        scopes: oidcConnections.scopes,
+        isActive: oidcConnections.isActive,
+        createdAt: oidcConnections.createdAt,
+      })
+      .from(oidcConnections)
+      .where(eq(oidcConnections.orgId, orgId));
+  }
+
+  async findById(id: string) {
+    const [connection] = await db.select().from(oidcConnections).where(eq(oidcConnections.id, id)).limit(1);
+    return connection;
+  }
+
+  async findActiveById(id: string) {
+    const [connection] = await db.select().from(oidcConnections).where(and(eq(oidcConnections.id, id), eq(oidcConnections.isActive, true))).limit(1);
+    return connection;
+  }
+
+  async create(input: {
+    orgId: string;
+    name: string;
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint?: string;
+    jwksUri?: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+    attributeMapping?: Record<string, unknown>;
+    isActive?: boolean;
+  }) {
+    const [connection] = await db
+      .insert(oidcConnections)
+      .values({
+        orgId: input.orgId,
+        name: input.name,
+        issuer: input.issuer,
+        authorizationEndpoint: input.authorizationEndpoint,
+        tokenEndpoint: input.tokenEndpoint,
+        userinfoEndpoint: input.userinfoEndpoint,
+        jwksUri: input.jwksUri,
+        clientId: input.clientId,
+        clientSecret: input.clientSecret,
+        scopes: input.scopes ?? ["openid", "profile", "email"],
+        attributeMapping: input.attributeMapping ?? {},
+        isActive: input.isActive ?? true,
+      })
+      .returning();
+    return connection;
+  }
+
+  async deleteByIdAndOrgId(id: string, orgId: string) {
+    const [record] = await db
+      .delete(oidcConnections)
+      .where(and(eq(oidcConnections.id, id), eq(oidcConnections.orgId, orgId)))
+      .returning();
+    return record;
+  }
+}