@hilbras/keystone 1.6.0 → 1.9.0

package/src/services/domain/authentication.ts

@@ -1,279 +0,0 @@
-import crypto from "node:crypto";
-import { eq, and, gt, isNull } from "drizzle-orm";
-import { config, isZitadelConfigured } from "../../config.js";
-import { db } from "../../db/index.js";
-import { users, passwordResetTokens, type User } from "../../db/schema.js";
-import { createHumanUser, verifyPassword as verifyZitadelPassword } from "../zitadel.js";
-import { createTokenSet, rotateRefreshToken, revokeRefreshToken, type TokenSet } from "../tokens.js";
-import { isPasswordBreached } from "../hibp.js";
-import { recordFailedLogin, isFailedLoginAnomaly } from "../anomalyDetection.js";
-import { emit } from "../events/bus.js";
-import type { UserRepository, ApplicationRepository } from "../../repositories/types.js";
-import { ok, err, type Result } from "../../lib/result.js";
-import { hashPassword, verifyPassword } from "../secrets/index.js";
-
-export interface AuthContext {
-  app?: { id: string; clientId: string; orgId: string };
-  org?: { id: string };
-}
-
-export interface RegisterInput {
-  username: string;
-  email: string;
-  password: string;
-  name?: string;
-  clientId?: string;
-  metadata?: Record<string, unknown>;
-}
-
-export interface LoginInput {
-  email: string;
-  password: string;
-  clientId?: string;
-}
-
-export interface TokenResponse {
-  user: User;
-  tokens: TokenSet;
-  context: AuthContext;
-}
-
-export class AuthenticationDomainService {
-  constructor(
-    private readonly users: UserRepository,
-    private readonly applications: ApplicationRepository
-  ) {}
-
-  private async loadAppContext(clientId?: string): Promise<AuthContext> {
-    if (!clientId) return {};
-    const app = await this.applications.findByClientId(clientId);
-    if (!app) return {};
-    return {
-      app: { id: app.id, clientId: app.clientId, orgId: app.orgId },
-      org: { id: app.orgId },
-    };
-  }
-
-  async register(input: RegisterInput): Promise<Result<TokenResponse>> {
-    if (config.HIBP_CHECK_ENABLED) {
-      const breached = await isPasswordBreached(input.password);
-      if (breached) {
-        return err({ code: "BREACHED_PASSWORD", message: "This password has appeared in a data breach.", statusCode: 400 });
-      }
-    }
-
-    const existing = await this.users.findByEmail(input.email);
-    if (existing) {
-      return err({ code: "EMAIL_EXISTS", message: "An account with this email already exists.", statusCode: 409 });
-    }
-
-    const passwordHash = await hashPassword(input.password);
-    const username = await this.users.ensureUniqueUsername(
-      input.username.toLowerCase().trim().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32)
-    );
-
-    let zitadelUserId: string | undefined;
-    if (isZitadelConfigured()) {
-      try {
-        zitadelUserId = await createHumanUser({
-          username: input.username,
-          email: input.email,
-          name: input.name || input.username,
-          password: input.password,
-        });
-      } catch (err) {
-        console.warn("Zitadel user mirror failed; continuing with local user", err);
-      }
-    }
-
-    const user = await this.users.create({
-      email: input.email,
-      username,
-      name: input.name || input.username,
-      passwordHash,
-      provider: "password",
-      emailVerified: !config.EMAIL_VERIFICATION_REQUIRED,
-      zitadelUserId,
-      metadata: input.metadata,
-    });
-
-    if (config.EMAIL_VERIFICATION_REQUIRED) {
-      try {
-        const { sendVerificationEmail } = await import("../emailVerification.js");
-        sendVerificationEmail(user).catch((err: unknown) => {
-          console.error("[auth] failed to send verification email:", err);
-        });
-      } catch {
-        // emailVerification module may not be available in all configurations
-      }
-    }
-
-    const context = await this.loadAppContext(input.clientId);
-    const tokens = await createTokenSet(user, undefined, undefined, {
-      appId: context.app?.id,
-      orgId: context.org?.id,
-      clientId: context.app?.clientId,
-    });
-
-    await emit({
-      type: "user_registered",
-      payload: {
-        provider: "password",
-        zitadelUserId,
-        userId: user.id,
-        username: user.username,
-        email: user.email,
-        client_id: input.clientId,
-        appId: context.app?.id,
-        orgId: context.org?.id,
-      },
-    });
-
-    return ok({ user, tokens, context });
-  }
-
-  async login(input: LoginInput): Promise<Result<TokenResponse>> {
-    const user = await this.users.findByEmail(input.email);
-
-    if (!user) {
-      if (isZitadelConfigured()) {
-        await verifyZitadelPassword(input.email, input.password).catch(() => {});
-      }
-      await recordFailedLogin(input.email);
-      await emit({ type: "user_login_failed", payload: { reason: "unknown_user" } });
-      if (await isFailedLoginAnomaly(input.email)) {
-        return err({ code: "TOO_MANY_ATTEMPTS", message: "Too many failed attempts. Please try again later.", statusCode: 429 });
-      }
-      return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
-    }
-
-    if (user.lockedUntil && user.lockedUntil > new Date()) {
-      await emit({ type: "user_login_failed", payload: { reason: "account_locked", userId: user.id } });
-      return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
-    }
-
-    let valid = false;
-    if (user.passwordHash) {
-      valid = await verifyPassword(input.password, user.passwordHash);
-    } else if (user.provider === "zitadel" && isZitadelConfigured()) {
-      valid = await verifyZitadelPassword(input.email, input.password);
-    }
-
-    if (!valid) {
-      const updated = await this.users.recordFailedLogin(user.id);
-      await emit({ type: "user_login_failed", payload: { reason: "invalid_password", userId: user.id } });
-
-      const attempts = updated?.failedLoginAttempts ?? 0;
-      if (attempts >= config.ACCOUNT_LOCKOUT_THRESHOLD) {
-        const lockedUntil = new Date(Date.now() + config.ACCOUNT_LOCKOUT_DURATION_SECONDS * 1000);
-        await this.users.lockAccount(user.id, lockedUntil);
-        return err({ code: "ACCOUNT_LOCKED", message: "Account locked due to too many failed attempts. Try again later.", statusCode: 403 });
-      }
-
-      if (await isFailedLoginAnomaly(user.id)) {
-        return err({ code: "TOO_MANY_ATTEMPTS", message: "Too many failed attempts. Please try again later.", statusCode: 429 });
-      }
-      return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
-    }
-
-    await this.users.resetFailedLogins(user.id);
-    await this.users.updateLastSeen(user.id);
-    const context = await this.loadAppContext(input.clientId);
-    const tokens = await createTokenSet(user, undefined, undefined, {
-      appId: context.app?.id,
-      orgId: context.org?.id,
-      clientId: context.app?.clientId,
-    });
-
-    await emit({
-      type: "user_login",
-      payload: { provider: user.provider, userId: user.id, appId: context.app?.id, orgId: context.org?.id },
-    });
-
-    return ok({ user, tokens, context });
-  }
-
-  async refresh(refreshToken: string, clientId?: string): Promise<Result<{ tokens: TokenSet; userId?: string }>> {
-    const tokens = await rotateRefreshToken(refreshToken, undefined, undefined);
-    if (!tokens) {
-      await emit({ type: "token_refresh_failed", payload: { reason: "invalid_refresh_token" } });
-      return err({ code: "INVALID_REFRESH_TOKEN", message: "Invalid or expired session.", statusCode: 401 });
-    }
-
-    await emit({ type: "token_refresh", payload: {} });
-    return ok({ tokens, userId: undefined });
-  }
-
-  async logout(refreshToken?: string): Promise<Result<void>> {
-    if (refreshToken) {
-      await revokeRefreshToken(refreshToken);
-    }
-    return ok(undefined);
-  }
-
-  async createPasswordResetToken(email: string): Promise<Result<{ token: string; user: User } | null>> {
-    const user = await this.users.findByEmail(email);
-    if (!user) return ok(null);
-
-    const token = crypto.randomBytes(48).toString("base64url");
-    const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
-    const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
-
-    await db.insert(passwordResetTokens).values({
-      userId: user.id,
-      tokenHash,
-      expiresAt,
-    });
-
-    await emit({ type: "password_reset_requested", payload: { userId: user.id } });
-    return ok({ token, user });
-  }
-
-  async resetPasswordWithToken(token: string, newPassword: string): Promise<Result<User>> {
-    const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
-    const now = new Date();
-
-    const [record] = await db
-      .select()
-      .from(passwordResetTokens)
-      .where(
-        and(
-          eq(passwordResetTokens.tokenHash, tokenHash),
-          gt(passwordResetTokens.expiresAt, now),
-          isNull(passwordResetTokens.usedAt)
-        )
-      )
-      .limit(1);
-
-    if (!record) {
-      return err({ code: "INVALID_TOKEN", message: "Invalid or expired reset token.", statusCode: 400 });
-    }
-
-    const user = await this.users.findById(record.userId);
-    if (!user) {
-      return err({ code: "USER_NOT_FOUND", message: "User not found.", statusCode: 400 });
-    }
-
-    if (config.HIBP_CHECK_ENABLED) {
-      const breached = await isPasswordBreached(newPassword);
-      if (breached) {
-        return err({ code: "BREACHED_PASSWORD", message: "This password has appeared in a data breach.", statusCode: 400 });
-      }
-    }
-
-    const passwordHash = await hashPassword(newPassword);
-    await db.transaction(async (tx) => {
-      await tx
-        .update(passwordResetTokens)
-        .set({ usedAt: now })
-        .where(eq(passwordResetTokens.id, record.id));
-      await tx
-        .update(users)
-        .set({ passwordHash, updatedAt: now })
-        .where(eq(users.id, user.id));
-    });
-
-    await emit({ type: "password_reset_completed", payload: { userId: user.id } });
-    return ok(user);
-  }
-}

package/src/services/domain/authorization.ts

@@ -1,49 +0,0 @@
-import type { OrgMembership } from "../../db/schema.js";
-import type { OrganizationRepository, PermissionRepository } from "../../repositories/types.js";
-import { ok, err, type Result } from "../../lib/result.js";
-
-export interface PermissionInput {
-  resource: string;
-  action: string;
-}
-
-export { type PermissionInput as PermissionRequirement };
-export type OrgRole = "owner" | "admin" | "member";
-
-export class AuthorizationDomainService {
-  constructor(
-    private readonly organizations: OrganizationRepository,
-    private readonly permissions: PermissionRepository
-  ) {}
-
-  async requirePermission(role: string, resource: string, action: string): Promise<Result<void>> {
-    const allowed = await this.permissions.hasPermission(role, resource, action);
-    if (!allowed) {
-      return err({ code: "FORBIDDEN", message: `Missing permission ${resource}:${action}`, statusCode: 403 });
-    }
-    return ok(undefined);
-  }
-
-  async hasPermission(role: string, resource: string, action: string): Promise<boolean> {
-    return this.permissions.hasPermission(role, resource, action);
-  }
-
-  async hasAnyPermission(role: string, required: PermissionInput[]): Promise<boolean> {
-    return this.permissions.hasAnyPermission(role, required);
-  }
-
-  async requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<Result<OrgMembership>> {
-    const membership = await this.organizations.findMembership(orgId, userId);
-    if (!membership) {
-      return err({ code: "NOT_MEMBER", message: "Not a member of this organization", statusCode: 403 });
-    }
-    if (!allowedRoles.includes(membership.role as OrgRole)) {
-      return err({ code: "INSUFFICIENT_ROLE", message: "Insufficient organization permissions", statusCode: 403 });
-    }
-    return ok(membership);
-  }
-
-  async isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined> {
-    return this.organizations.findMembership(orgId, userId);
-  }
-}

package/src/services/domain/identity.ts

@@ -1,108 +0,0 @@
-import type { User } from "../../db/schema.js";
-import type { UserRepository, IdentityRepository } from "../../repositories/types.js";
-import type { TokenSet } from "../tokens.js";
-import { createTokenSet } from "../tokens.js";
-import { emit } from "../events/bus.js";
-import { getFederationAuthorizeUrl as getFederationAuthorizeUrlService, completeFederationLogin as completeFederationLoginService } from "../federation.js";
-import { ok, err, type Result } from "../../lib/result.js";
-
-export class IdentityDomainService {
-  constructor(
-    private readonly users: UserRepository,
-    private readonly identities: IdentityRepository
-  ) {}
-
-  async findUser(id: string): Promise<Result<User>> {
-    const user = await this.users.findById(id);
-    if (!user) return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
-    return ok(user);
-  }
-
-  async findUserByEmail(email: string): Promise<Result<User>> {
-    const user = await this.users.findByEmail(email);
-    if (!user) return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
-    return ok(user);
-  }
-
-  async upsertInvitedUser(input: { email: string; name?: string; username?: string }): Promise<Result<User>> {
-    const existing = await this.users.findByEmail(input.email);
-    if (existing) return ok(existing);
-
-    const baseUsername = input.username || input.email.split("@")[0];
-    const username = await this.users.ensureUniqueUsername(
-      baseUsername.toLowerCase().trim().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32)
-    );
-
-    const user = await this.users.create({
-      email: input.email,
-      username,
-      name: input.name || username,
-      provider: "password",
-      emailVerified: false,
-    });
-    return ok(user);
-  }
-
-  async updateUserProfile(
-    userId: string,
-    updates: Partial<{ name: string; username: string; role: string; emailVerified: boolean }>
-  ): Promise<Result<User>> {
-    const updated = await this.users.update(userId, updates);
-    if (!updated) return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
-    return ok(updated);
-  }
-
-  async deactivate(userId: string): Promise<Result<void>> {
-    await this.users.deactivate(userId);
-    return ok(undefined);
-  }
-
-  async listOrganizationUsers(orgId: string): Promise<User[]> {
-    return this.users.listByOrg(orgId);
-  }
-
-  async touchLastSeen(userId: string): Promise<void> {
-    await this.users.updateLastSeen(userId);
-  }
-
-  async linkUserIdentity(
-    userId: string,
-    providerId: string,
-    providerType: string,
-    externalSub: string,
-    email?: string
-  ): Promise<Result<void>> {
-    await this.identities.link({ userId, providerId, providerType, externalSub, email });
-    return ok(undefined);
-  }
-
-  async getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{ url: string }>> {
-    const url = await getFederationAuthorizeUrlService(provider, state, redirectUri);
-    return ok({ url });
-  }
-
-  async completeFederationLogin(
-    provider: string,
-    code: string,
-    redirectUri: string
-  ): Promise<Result<{ user: User; tokens: { accessToken: string; refreshToken: string } }>> {
-    const result = await completeFederationLoginService(provider, code, redirectUri);
-    await emit({
-      type: "federation_login",
-      payload: { provider, userId: result.user.id, email: result.user.email },
-    });
-    return ok(result);
-  }
-
-  async issueLocalTokenSet(
-    user: User,
-    opts?: {
-      appId?: string;
-      orgId?: string;
-      clientId?: string;
-      deviceFingerprint?: string;
-    }
-  ): Promise<TokenSet> {
-    return createTokenSet(user, undefined, undefined, opts, opts?.deviceFingerprint);
-  }
-}

package/src/services/domain/index.ts

@@ -1,4 +0,0 @@
-export { AuthenticationDomainService } from "./authentication.js";
-export { AuthorizationDomainService } from "./authorization.js";
-export { IdentityDomainService } from "./identity.js";
-export { OrganizationDomainService } from "./organization.js";

package/src/services/domain/organization.ts

@@ -1,114 +0,0 @@
-import type { Organization, Application, OrgMembership } from "../../db/schema.js";
-import type { OrganizationRepository, ApplicationRepository, UserRepository } from "../../repositories/types.js";
-import { emit } from "../events/bus.js";
-import { ok, err, type Result } from "../../lib/result.js";
-
-export type OrgRole = "owner" | "admin" | "member";
-
-export class OrganizationDomainService {
-  constructor(
-    private readonly organizations: OrganizationRepository,
-    private readonly applications: ApplicationRepository,
-    private readonly users?: UserRepository
-  ) {}
-
-  async createOrganization(
-    input: { name: string; slug?: string; plan?: string },
-    userId?: string
-  ): Promise<Result<Organization>> {
-    const org = await this.organizations.create(input);
-    if (userId) {
-      await this.organizations.addMembership({ orgId: org.id, userId, role: "owner" });
-    }
-    return ok(org);
-  }
-
-  async getOrganization(id: string): Promise<Result<Organization>> {
-    const org = await this.organizations.findById(id);
-    if (!org) return err({ code: "ORG_NOT_FOUND", message: "Organization not found", statusCode: 404 });
-    return ok(org);
-  }
-
-  async listUserOrganizations(userId: string): Promise<Organization[]> {
-    return this.organizations.listByUserId(userId);
-  }
-
-  async addOrgMembership(input: { orgId: string; userId: string; role: OrgRole }): Promise<Result<OrgMembership>> {
-    const membership = await this.organizations.addMembership(input);
-    return ok(membership);
-  }
-
-  async getMembership(orgId: string, userId: string): Promise<Result<OrgMembership>> {
-    const membership = await this.organizations.findMembership(orgId, userId);
-    if (!membership) return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
-    return ok(membership);
-  }
-
-  async updateMembershipRole(
-    orgId: string,
-    userId: string,
-    role: OrgRole
-  ): Promise<Result<OrgMembership>> {
-    const updated = await this.organizations.updateMembershipRole(orgId, userId, role);
-    if (!updated) return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
-    return ok(updated);
-  }
-
-  async removeMembership(orgId: string, userId: string): Promise<Result<boolean>> {
-    return ok(await this.organizations.removeMembership(orgId, userId));
-  }
-
-  async removeOrgMember(orgId: string, userId: string): Promise<Result<{ success: boolean }>> {
-    const membership = await this.organizations.findMembership(orgId, userId);
-    if (!membership) return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
-
-    if (membership.role === "owner" && (await this.organizations.countOwners(orgId)) <= 1) {
-      return err({ code: "LAST_OWNER", message: "Cannot remove the last owner", statusCode: 400 });
-    }
-
-    await this.organizations.removeMembership(orgId, userId);
-    return ok({ success: true });
-  }
-
-  async deactivateOrgUser(orgId: string, userId: string): Promise<Result<{ success: boolean }>> {
-    const membership = await this.organizations.findMembership(orgId, userId);
-    if (!membership) {
-      return err({ code: "MEMBERSHIP_NOT_FOUND", message: "User is not a member of this organization", statusCode: 404 });
-    }
-    if (this.users) {
-      await this.users.deactivate(userId);
-    }
-    await this.organizations.removeMembership(orgId, userId);
-    return ok({ success: true });
-  }
-
-  async listOrgMembers(orgId: string) {
-    return this.organizations.listMembers(orgId);
-  }
-
-  async createApplication(input: {
-    orgId: string;
-    name: string;
-    redirectUris?: string[];
-    allowedOrigins?: string[];
-  }): Promise<Result<Application & { clientSecret: string }>> {
-    const app = await this.applications.create(input);
-    await emit({ type: "application_created", payload: { orgId: input.orgId, appId: app.id } });
-    return ok(app);
-  }
-
-  async listOrganizationApplications(orgId: string): Promise<Application[]> {
-    return this.applications.listByOrgId(orgId);
-  }
-
-  async updateApplication(
-    appId: string,
-    orgId: string,
-    updates: Partial<{ name: string; redirectUris: string[]; allowedOrigins: string[]; allowedIps: string[]; blockedIps: string[]; isActive: boolean; branding: Record<string, unknown> }>
-  ): Promise<Result<Application>> {
-    const updated = await this.applications.update(appId, orgId, updates);
-    if (!updated) return err({ code: "APP_NOT_FOUND", message: "Application not found", statusCode: 404 });
-    await emit({ type: "application_updated", payload: { orgId, appId: updated.id } });
-    return ok(updated);
-  }
-}