@hilbras/keystone 1.1.0

package/src/services/domain/authentication.ts

@@ -0,0 +1,279 @@
+import crypto from "node:crypto";
+import { eq, and, gt, isNull } from "drizzle-orm";
+import { config, isZitadelConfigured } from "../../config.js";
+import { db } from "../../db/index.js";
+import { users, passwordResetTokens, type User } from "../../db/schema.js";
+import { createHumanUser, verifyPassword as verifyZitadelPassword } from "../zitadel.js";
+import { createTokenSet, rotateRefreshToken, revokeRefreshToken, type TokenSet } from "../tokens.js";
+import { isPasswordBreached } from "../hibp.js";
+import { recordFailedLogin, isFailedLoginAnomaly } from "../anomalyDetection.js";
+import { emit } from "../events/bus.js";
+import type { UserRepository, ApplicationRepository } from "../../repositories/types.js";
+import { ok, err, type Result } from "../../lib/result.js";
+import { hashPassword, verifyPassword } from "../secrets/index.js";
+
+export interface AuthContext {
+  app?: { id: string; clientId: string; orgId: string };
+  org?: { id: string };
+}
+
+export interface RegisterInput {
+  username: string;
+  email: string;
+  password: string;
+  name?: string;
+  clientId?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface LoginInput {
+  email: string;
+  password: string;
+  clientId?: string;
+}
+
+export interface TokenResponse {
+  user: User;
+  tokens: TokenSet;
+  context: AuthContext;
+}
+
+export class AuthenticationDomainService {
+  constructor(
+    private readonly users: UserRepository,
+    private readonly applications: ApplicationRepository
+  ) {}
+
+  private async loadAppContext(clientId?: string): Promise<AuthContext> {
+    if (!clientId) return {};
+    const app = await this.applications.findByClientId(clientId);
+    if (!app) return {};
+    return {
+      app: { id: app.id, clientId: app.clientId, orgId: app.orgId },
+      org: { id: app.orgId },
+    };
+  }
+
+  async register(input: RegisterInput): Promise<Result<TokenResponse>> {
+    if (config.HIBP_CHECK_ENABLED) {
+      const breached = await isPasswordBreached(input.password);
+      if (breached) {
+        return err({ code: "BREACHED_PASSWORD", message: "This password has appeared in a data breach.", statusCode: 400 });
+      }
+    }
+
+    const existing = await this.users.findByEmail(input.email);
+    if (existing) {
+      return err({ code: "EMAIL_EXISTS", message: "An account with this email already exists.", statusCode: 409 });
+    }
+
+    const passwordHash = await hashPassword(input.password);
+    const username = await this.users.ensureUniqueUsername(
+      input.username.toLowerCase().trim().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32)
+    );
+
+    let zitadelUserId: string | undefined;
+    if (isZitadelConfigured()) {
+      try {
+        zitadelUserId = await createHumanUser({
+          username: input.username,
+          email: input.email,
+          name: input.name || input.username,
+          password: input.password,
+        });
+      } catch (err) {
+        console.warn("Zitadel user mirror failed; continuing with local user", err);
+      }
+    }
+
+    const user = await this.users.create({
+      email: input.email,
+      username,
+      name: input.name || input.username,
+      passwordHash,
+      provider: "password",
+      emailVerified: !config.EMAIL_VERIFICATION_REQUIRED,
+      zitadelUserId,
+      metadata: input.metadata,
+    });
+
+    if (config.EMAIL_VERIFICATION_REQUIRED) {
+      try {
+        const { sendVerificationEmail } = await import("../emailVerification.js");
+        sendVerificationEmail(user).catch((err: unknown) => {
+          console.error("[auth] failed to send verification email:", err);
+        });
+      } catch {
+        // emailVerification module may not be available in all configurations
+      }
+    }
+
+    const context = await this.loadAppContext(input.clientId);
+    const tokens = await createTokenSet(user, undefined, undefined, {
+      appId: context.app?.id,
+      orgId: context.org?.id,
+      clientId: context.app?.clientId,
+    });
+
+    await emit({
+      type: "user_registered",
+      payload: {
+        provider: "password",
+        zitadelUserId,
+        userId: user.id,
+        username: user.username,
+        email: user.email,
+        client_id: input.clientId,
+        appId: context.app?.id,
+        orgId: context.org?.id,
+      },
+    });
+
+    return ok({ user, tokens, context });
+  }
+
+  async login(input: LoginInput): Promise<Result<TokenResponse>> {
+    const user = await this.users.findByEmail(input.email);
+
+    if (!user) {
+      if (isZitadelConfigured()) {
+        await verifyZitadelPassword(input.email, input.password).catch(() => {});
+      }
+      await recordFailedLogin(input.email);
+      await emit({ type: "user_login_failed", payload: { reason: "unknown_user" } });
+      if (await isFailedLoginAnomaly(input.email)) {
+        return err({ code: "TOO_MANY_ATTEMPTS", message: "Too many failed attempts. Please try again later.", statusCode: 429 });
+      }
+      return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
+    }
+
+    if (user.lockedUntil && user.lockedUntil > new Date()) {
+      await emit({ type: "user_login_failed", payload: { reason: "account_locked", userId: user.id } });
+      return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
+    }
+
+    let valid = false;
+    if (user.passwordHash) {
+      valid = await verifyPassword(input.password, user.passwordHash);
+    } else if (user.provider === "zitadel" && isZitadelConfigured()) {
+      valid = await verifyZitadelPassword(input.email, input.password);
+    }
+
+    if (!valid) {
+      const updated = await this.users.recordFailedLogin(user.id);
+      await emit({ type: "user_login_failed", payload: { reason: "invalid_password", userId: user.id } });
+
+      const attempts = updated?.failedLoginAttempts ?? 0;
+      if (attempts >= config.ACCOUNT_LOCKOUT_THRESHOLD) {
+        const lockedUntil = new Date(Date.now() + config.ACCOUNT_LOCKOUT_DURATION_SECONDS * 1000);
+        await this.users.lockAccount(user.id, lockedUntil);
+        return err({ code: "ACCOUNT_LOCKED", message: "Account locked due to too many failed attempts. Try again later.", statusCode: 403 });
+      }
+
+      if (await isFailedLoginAnomaly(user.id)) {
+        return err({ code: "TOO_MANY_ATTEMPTS", message: "Too many failed attempts. Please try again later.", statusCode: 429 });
+      }
+      return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
+    }
+
+    await this.users.resetFailedLogins(user.id);
+    await this.users.updateLastSeen(user.id);
+    const context = await this.loadAppContext(input.clientId);
+    const tokens = await createTokenSet(user, undefined, undefined, {
+      appId: context.app?.id,
+      orgId: context.org?.id,
+      clientId: context.app?.clientId,
+    });
+
+    await emit({
+      type: "user_login",
+      payload: { provider: user.provider, userId: user.id, appId: context.app?.id, orgId: context.org?.id },
+    });
+
+    return ok({ user, tokens, context });
+  }
+
+  async refresh(refreshToken: string, clientId?: string): Promise<Result<{ tokens: TokenSet; userId?: string }>> {
+    const tokens = await rotateRefreshToken(refreshToken, undefined, undefined);
+    if (!tokens) {
+      await emit({ type: "token_refresh_failed", payload: { reason: "invalid_refresh_token" } });
+      return err({ code: "INVALID_REFRESH_TOKEN", message: "Invalid or expired session.", statusCode: 401 });
+    }
+
+    await emit({ type: "token_refresh", payload: {} });
+    return ok({ tokens, userId: undefined });
+  }
+
+  async logout(refreshToken?: string): Promise<Result<void>> {
+    if (refreshToken) {
+      await revokeRefreshToken(refreshToken);
+    }
+    return ok(undefined);
+  }
+
+  async createPasswordResetToken(email: string): Promise<Result<{ token: string; user: User } | null>> {
+    const user = await this.users.findByEmail(email);
+    if (!user) return ok(null);
+
+    const token = crypto.randomBytes(48).toString("base64url");
+    const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
+    const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+    await db.insert(passwordResetTokens).values({
+      userId: user.id,
+      tokenHash,
+      expiresAt,
+    });
+
+    await emit({ type: "password_reset_requested", payload: { userId: user.id } });
+    return ok({ token, user });
+  }
+
+  async resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>> {
+    const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
+    const now = new Date();
+
+    const [record] = await db
+      .select()
+      .from(passwordResetTokens)
+      .where(
+        and(
+          eq(passwordResetTokens.tokenHash, tokenHash),
+          gt(passwordResetTokens.expiresAt, now),
+          isNull(passwordResetTokens.usedAt)
+        )
+      )
+      .limit(1);
+
+    if (!record) {
+      return err({ code: "INVALID_TOKEN", message: "Invalid or expired reset token.", statusCode: 400 });
+    }
+
+    const user = await this.users.findById(record.userId);
+    if (!user) {
+      return err({ code: "USER_NOT_FOUND", message: "User not found.", statusCode: 400 });
+    }
+
+    if (config.HIBP_CHECK_ENABLED) {
+      const breached = await isPasswordBreached(newPassword);
+      if (breached) {
+        return err({ code: "BREACHED_PASSWORD", message: "This password has appeared in a data breach.", statusCode: 400 });
+      }
+    }
+
+    const passwordHash = await hashPassword(newPassword);
+    await db.transaction(async (tx) => {
+      await tx
+        .update(passwordResetTokens)
+        .set({ usedAt: now })
+        .where(eq(passwordResetTokens.id, record.id));
+      await tx
+        .update(users)
+        .set({ passwordHash, updatedAt: now })
+        .where(eq(users.id, user.id));
+    });
+
+    await emit({ type: "password_reset_completed", payload: { userId: user.id } });
+    return ok(user);
+  }
+}

package/src/services/domain/authorization.ts

@@ -0,0 +1,49 @@
+import type { OrgMembership } from "../../db/schema.js";
+import type { OrganizationRepository, PermissionRepository } from "../../repositories/types.js";
+import { ok, err, type Result } from "../../lib/result.js";
+
+export interface PermissionInput {
+  resource: string;
+  action: string;
+}
+
+export { type PermissionInput as PermissionRequirement };
+export type OrgRole = "owner" | "admin" | "member";
+
+export class AuthorizationDomainService {
+  constructor(
+    private readonly organizations: OrganizationRepository,
+    private readonly permissions: PermissionRepository
+  ) {}
+
+  async requirePermission(role: string, resource: string, action: string): Promise<Result<void>> {
+    const allowed = await this.permissions.hasPermission(role, resource, action);
+    if (!allowed) {
+      return err({ code: "FORBIDDEN", message: `Missing permission ${resource}:${action}`, statusCode: 403 });
+    }
+    return ok(undefined);
+  }
+
+  async hasPermission(role: string, resource: string, action: string): Promise<boolean> {
+    return this.permissions.hasPermission(role, resource, action);
+  }
+
+  async hasAnyPermission(role: string, required: PermissionInput[]): Promise<boolean> {
+    return this.permissions.hasAnyPermission(role, required);
+  }
+
+  async requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<Result<OrgMembership>> {
+    const membership = await this.organizations.findMembership(orgId, userId);
+    if (!membership) {
+      return err({ code: "NOT_MEMBER", message: "Not a member of this organization", statusCode: 403 });
+    }
+    if (!allowedRoles.includes(membership.role as OrgRole)) {
+      return err({ code: "INSUFFICIENT_ROLE", message: "Insufficient organization permissions", statusCode: 403 });
+    }
+    return ok(membership);
+  }
+
+  async isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined> {
+    return this.organizations.findMembership(orgId, userId);
+  }
+}

package/src/services/domain/identity.ts

@@ -0,0 +1,108 @@
+import type { User } from "../../db/schema.js";
+import type { UserRepository, IdentityRepository } from "../../repositories/types.js";
+import type { TokenSet } from "../tokens.js";
+import { createTokenSet } from "../tokens.js";
+import { emit } from "../events/bus.js";
+import { getFederationAuthorizeUrl as getFederationAuthorizeUrlService, completeFederationLogin as completeFederationLoginService } from "../federation.js";
+import { ok, err, type Result } from "../../lib/result.js";
+
+export class IdentityDomainService {
+  constructor(
+    private readonly users: UserRepository,
+    private readonly identities: IdentityRepository
+  ) {}
+
+  async findUser(id: string): Promise<Result<User>> {
+    const user = await this.users.findById(id);
+    if (!user) return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+    return ok(user);
+  }
+
+  async findUserByEmail(email: string): Promise<Result<User>> {
+    const user = await this.users.findByEmail(email);
+    if (!user) return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+    return ok(user);
+  }
+
+  async upsertInvitedUser(input: { email: string; name?: string; username?: string }): Promise<Result<User>> {
+    const existing = await this.users.findByEmail(input.email);
+    if (existing) return ok(existing);
+
+    const baseUsername = input.username || input.email.split("@")[0];
+    const username = await this.users.ensureUniqueUsername(
+      baseUsername.toLowerCase().trim().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32)
+    );
+
+    const user = await this.users.create({
+      email: input.email,
+      username,
+      name: input.name || username,
+      provider: "password",
+      emailVerified: false,
+    });
+    return ok(user);
+  }
+
+  async updateUserProfile(
+    userId: string,
+    updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>
+  ): Promise<Result<User>> {
+    const updated = await this.users.update(userId, updates);
+    if (!updated) return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+    return ok(updated);
+  }
+
+  async deactivate(userId: string): Promise<Result<void>> {
+    await this.users.deactivate(userId);
+    return ok(undefined);
+  }
+
+  async listOrganizationUsers(orgId: string): Promise<User[]> {
+    return this.users.listByOrg(orgId);
+  }
+
+  async touchLastSeen(userId: string): Promise<void> {
+    await this.users.updateLastSeen(userId);
+  }
+
+  async linkUserIdentity(
+    userId: string,
+    providerId: string,
+    providerType: string,
+    externalSub: string,
+    email?: string
+  ): Promise<Result<void>> {
+    await this.identities.link({ userId, providerId, providerType, externalSub, email });
+    return ok(undefined);
+  }
+
+  async getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{ url: string }>> {
+    const url = await getFederationAuthorizeUrlService(provider, state, redirectUri);
+    return ok({ url });
+  }
+
+  async completeFederationLogin(
+    provider: string,
+    code: string,
+    redirectUri: string
+  ): Promise<Result<{ user: User; tokens: { accessToken: string; refreshToken: string } }>> {
+    const result = await completeFederationLoginService(provider, code, redirectUri);
+    await emit({
+      type: "federation_login",
+      payload: { provider, userId: result.user.id, email: result.user.email },
+    });
+    return ok(result);
+  }
+
+  async issueLocalTokenSet(
+    user: User,
+    opts?: {
+      appId?: string;
+      orgId?: string;
+      clientId?: string;
+      deviceFingerprint?: string;
+    }
+  ): Promise<TokenSet> {
+    return createTokenSet(user, undefined, undefined, opts, opts?.deviceFingerprint);
+  }
+}

package/src/services/domain/index.ts

@@ -0,0 +1,4 @@
+export { AuthenticationDomainService } from "./authentication.js";
+export { AuthorizationDomainService } from "./authorization.js";
+export { IdentityDomainService } from "./identity.js";
+export { OrganizationDomainService } from "./organization.js";

package/src/services/domain/organization.ts

@@ -0,0 +1,114 @@
+import type { Organization, Application, OrgMembership } from "../../db/schema.js";
+import type { OrganizationRepository, ApplicationRepository, UserRepository } from "../../repositories/types.js";
+import { emit } from "../events/bus.js";
+import { ok, err, type Result } from "../../lib/result.js";
+
+export type OrgRole = "owner" | "admin" | "member";
+
+export class OrganizationDomainService {
+  constructor(
+    private readonly organizations: OrganizationRepository,
+    private readonly applications: ApplicationRepository,
+    private readonly users?: UserRepository
+  ) {}
+
+  async createOrganization(
+    input: { name: string; slug?: string; plan?: string },
+    userId?: string
+  ): Promise<Result<Organization>> {
+    const org = await this.organizations.create(input);
+    if (userId) {
+      await this.organizations.addMembership({ orgId: org.id, userId, role: "owner" });
+    }
+    return ok(org);
+  }
+
+  async getOrganization(id: string): Promise<Result<Organization>> {
+    const org = await this.organizations.findById(id);
+    if (!org) return err({ code: "ORG_NOT_FOUND", message: "Organization not found", statusCode: 404 });
+    return ok(org);
+  }
+
+  async listUserOrganizations(userId: string): Promise<Organization[]> {
+    return this.organizations.listByUserId(userId);
+  }
+
+  async addOrgMembership(input: { orgId: string; userId: string; role: OrgRole }): Promise<Result<OrgMembership>> {
+    const membership = await this.organizations.addMembership(input);
+    return ok(membership);
+  }
+
+  async getMembership(orgId: string, userId: string): Promise<Result<OrgMembership>> {
+    const membership = await this.organizations.findMembership(orgId, userId);
+    if (!membership) return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+    return ok(membership);
+  }
+
+  async updateMembershipRole(
+    orgId: string,
+    userId: string,
+    role: OrgRole
+  ): Promise<Result<OrgMembership>> {
+    const updated = await this.organizations.updateMembershipRole(orgId, userId, role);
+    if (!updated) return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+    return ok(updated);
+  }
+
+  async removeMembership(orgId: string, userId: string): Promise<Result<boolean>> {
+    return ok(await this.organizations.removeMembership(orgId, userId));
+  }
+
+  async removeOrgMember(orgId: string, userId: string): Promise<Result<{ success: boolean }>> {
+    const membership = await this.organizations.findMembership(orgId, userId);
+    if (!membership) return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+
+    if (membership.role === "owner" && (await this.organizations.countOwners(orgId)) <= 1) {
+      return err({ code: "LAST_OWNER", message: "Cannot remove the last owner", statusCode: 400 });
+    }
+
+    await this.organizations.removeMembership(orgId, userId);
+    return ok({ success: true });
+  }
+
+  async deactivateOrgUser(orgId: string, userId: string): Promise<Result<{ success: boolean }>> {
+    const membership = await this.organizations.findMembership(orgId, userId);
+    if (!membership) {
+      return err({ code: "MEMBERSHIP_NOT_FOUND", message: "User is not a member of this organization", statusCode: 404 });
+    }
+    if (this.users) {
+      await this.users.deactivate(userId);
+    }
+    await this.organizations.removeMembership(orgId, userId);
+    return ok({ success: true });
+  }
+
+  async listOrgMembers(orgId: string) {
+    return this.organizations.listMembers(orgId);
+  }
+
+  async createApplication(input: {
+    orgId: string;
+    name: string;
+    redirectUris?: string[];
+    allowedOrigins?: string[];
+  }): Promise<Result<Application & { clientSecret: string }>> {
+    const app = await this.applications.create(input);
+    await emit({ type: "application_created", payload: { orgId: input.orgId, appId: app.id } });
+    return ok(app);
+  }
+
+  async listOrganizationApplications(orgId: string): Promise<Application[]> {
+    return this.applications.listByOrgId(orgId);
+  }
+
+  async updateApplication(
+    appId: string,
+    orgId: string,
+    updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean; branding: Record<string, unknown> }>
+  ): Promise<Result<Application>> {
+    const updated = await this.applications.update(appId, orgId, updates);
+    if (!updated) return err({ code: "APP_NOT_FOUND", message: "Application not found", statusCode: 404 });
+    await emit({ type: "application_updated", payload: { orgId, appId: updated.id } });
+    return ok(updated);
+  }
+}