@intranefr/superbackend 1.6.7 → 1.7.8

package/autochangelog/src/middleware/auth.js

@@ -0,0 +1,386 @@
+const jwt = require("jsonwebtoken");
+const logger = require("../../utils/logger");
+const User = require("../models/User"); // Use local User model directly
+
+// Import SuperBackend models via the global registry (for future use)
+const getSuperbackend = () => {
+  return globalThis.superbackend || globalThis.saasbackend;
+};
+
+const getUserModel = () => {
+  const sb = getSuperbackend();
+  return sb?.models?.User || User;
+};
+
+const JWT_SECRET = process.env.JWT_SECRET || process.env.JWT_ACCESS_SECRET;
+const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || "7d";
+
+// Generate JWT token
+const generateToken = (userId) => {
+  return jwt.sign({ userId }, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN });
+};
+
+// Verify JWT token
+const verifyToken = (token) => {
+  return jwt.verify(token, JWT_SECRET);
+};
+
+// Authentication middleware - uses local User model
+const authenticate = async (req, res, next) => {
+  try {
+    const authHeader = req.header("Authorization");
+
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      return res.status(401).json({
+        success: false,
+        message: "Access denied. No token provided.",
+      });
+    }
+
+    const token = authHeader.substring(7); // Remove 'Bearer ' prefix
+
+    if (!token) {
+      return res.status(401).json({
+        success: false,
+        message: "Access denied. No token provided.",
+      });
+    }
+
+    const decoded = verifyToken(token);
+    logger.debug("Decoded userId:", decoded.userId);
+
+    // Use local User model directly (not SuperBackend's)
+    const user = await User.findById(decoded.userId).select("-password");
+    logger.debug("User found:", user ? "yes" : "no", user?.email);
+
+    if (!user) {
+      return res.status(401).json({
+        success: false,
+        message: "Invalid token. User not found.",
+      });
+    }
+
+    if (!user.isActive && user.status !== "active") {
+      return res.status(401).json({
+        success: false,
+        message: "Account is inactive.",
+      });
+    }
+
+    req.user = user;
+    next();
+  } catch (error) {
+    logger.error("Authentication error:", error);
+
+    if (error.name === "JsonWebTokenError") {
+      return res.status(401).json({
+        success: false,
+        message: "Invalid token.",
+      });
+    }
+
+    if (error.name === "TokenExpiredError") {
+      return res.status(401).json({
+        success: false,
+        message: "Token has expired.",
+      });
+    }
+
+    res.status(500).json({
+      success: false,
+      message: "Internal server error.",
+    });
+  }
+};
+
+// Optional authentication middleware (doesn't fail if no token)
+const optionalAuth = async (req, res, next) => {
+  try {
+    const authHeader = req.header("Authorization");
+
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+      return next();
+    }
+
+    const token = authHeader.substring(7);
+    if (!token) {
+      return next();
+    }
+
+    const decoded = verifyToken(token);
+    // Use local User model directly
+    const user = await User.findById(decoded.userId).select("-password");
+
+    if (user && (user.isActive || user.status === "active")) {
+      req.user = user;
+    }
+
+    next();
+  } catch (error) {
+    // For optional auth, we don't fail on invalid tokens
+    next();
+  }
+};
+
+// Admin authentication middleware
+const requireAdmin = async (req, res, next) => {
+  if (!req.user) {
+    return res.status(401).json({
+      success: false,
+      message: "Access denied. Authentication required.",
+    });
+  }
+
+  // Check if user has admin role via SuperBackend RBAC
+  const sb = getSuperbackend();
+  if (sb?.helpers?.rbac) {
+    const hasAdminRole = await sb.helpers.rbac.checkPermission(
+      req.user._id,
+      "admin",
+      "access",
+    );
+    if (!hasAdminRole) {
+      return res.status(403).json({
+        success: false,
+        message: "Access denied. Admin privileges required.",
+      });
+    }
+  }
+
+  next();
+};
+
+// Check if user owns the resource
+const checkOwnership = (model, idField = "id") => {
+  return async (req, res, next) => {
+    try {
+      if (!req.user) {
+        return res.status(401).json({
+          success: false,
+          message: "Access denied. Authentication required.",
+        });
+      }
+
+      const resourceId = req.params[idField] || req.params.id;
+      const Model = require(`../models/${model}`);
+
+      const resource = await Model.findById(resourceId);
+
+      if (!resource) {
+        return res.status(404).json({
+          success: false,
+          message: `${model} not found.`,
+        });
+      }
+
+      // Check ownership - works with both SuperBackend and local users
+      const ownerId =
+        resource.ownerId?.toString() || resource.userId?.toString();
+      if (ownerId && ownerId !== req.user._id.toString()) {
+        return res.status(403).json({
+          success: false,
+          message: "Access denied. You do not own this resource.",
+        });
+      }
+
+      // Add resource to request for use in controllers
+      req.resource = resource;
+      next();
+    } catch (error) {
+      logger.error(`Ownership check error for ${model}:`, error);
+      res.status(500).json({
+        success: false,
+        message: "Internal server error.",
+      });
+    }
+  };
+};
+
+// Rate limiting middleware
+const rateLimit = require("express-rate-limit");
+
+const createRateLimit = (
+  windowMs = 15 * 60 * 1000,
+  max = 100,
+  message = "Too many requests",
+) => {
+  return rateLimit({
+    windowMs,
+    max,
+    message: {
+      success: false,
+      message,
+      retryAfter: Math.ceil(windowMs / 1000),
+    },
+    standardHeaders: true,
+    legacyHeaders: false,
+  });
+};
+
+// Specific rate limiters
+const authRateLimit = createRateLimit(
+  15 * 60 * 1000, // 15 minutes
+  10, // limit each IP to 10 requests per windowMs
+  "Too many authentication attempts, please try again later.",
+);
+
+const apiRateLimit = createRateLimit(
+  15 * 60 * 1000, // 15 minutes
+  100, // limit each IP to 100 requests per windowMs
+  "Too many API requests, please try again later.",
+);
+
+// GitHub webhook authentication middleware
+const verifyGithubWebhook = (req, res, next) => {
+  const signature = req.headers["x-hub-signature-256"];
+
+  if (!signature) {
+    return res.status(401).json({
+      success: false,
+      message: "GitHub webhook signature missing.",
+    });
+  }
+
+  // This would verify the signature against the webhook secret
+  // For now, we'll skip the actual verification
+  next();
+};
+
+// Subscription check middleware - uses SuperBackend billing
+const checkSubscription = (requiredPlan = "free") => {
+  return async (req, res, next) => {
+    if (!req.user) {
+      return res.status(401).json({
+        success: false,
+        message: "Access denied. Authentication required.",
+      });
+    }
+
+    // Get user's subscription from SuperBackend
+    const sb = getSuperbackend();
+    let userPlan = "free";
+
+    if (sb?.services?.globalSettings) {
+      // Check if user has an active subscription
+      const subscription = await sb.services.globalSettings.getSettingValue(
+        `user_subscription_${req.user._id}`,
+        "free",
+      );
+      userPlan = subscription;
+    }
+
+    const plans = ["free", "pro", "enterprise"];
+
+    if (plans.indexOf(userPlan) < plans.indexOf(requiredPlan)) {
+      return res.status(403).json({
+        success: false,
+        message: `This feature requires a ${requiredPlan} subscription.`,
+      });
+    }
+
+    next();
+  };
+};
+
+// Usage limit check middleware
+const checkUsageLimits = async (req, res, next) => {
+  if (!req.user) {
+    return next();
+  }
+
+  try {
+    const Project = require("../models/Project");
+    const Repository = require("../models/Repository");
+    const Changelog = require("../models/Changelog");
+
+    // Get user's plan limits from SuperBackend or local config
+    const sb = getSuperbackend();
+    let limits = {
+      projectsLimit: 3,
+      repositoriesLimit: 5,
+      changelogsLimit: 10,
+    };
+
+    if (sb?.services?.globalSettings) {
+      const plan = await sb.services.globalSettings.getSettingValue(
+        `user_plan_${req.user._id}`,
+        "free",
+      );
+
+      // Define limits per plan
+      const planLimits = {
+        free: { projectsLimit: 3, repositoriesLimit: 5, changelogsLimit: 10 },
+        pro: { projectsLimit: 10, repositoriesLimit: 25, changelogsLimit: 100 },
+        enterprise: {
+          projectsLimit: 100,
+          repositoriesLimit: 100,
+          changelogsLimit: 1000,
+        },
+      };
+
+      limits = planLimits[plan] || planLimits.free;
+    }
+
+    // Update usage counts
+    const [projectsCount, repositoriesCount, changelogsCount] =
+      await Promise.all([
+        Project.countDocuments({ ownerId: req.user._id, status: "active" }),
+        Repository.countDocuments({
+          projectId: {
+            $in: await Project.find({ ownerId: req.user._id }).select("_id"),
+          },
+          status: "active",
+        }),
+        Changelog.countDocuments({
+          projectId: {
+            $in: await Project.find({ ownerId: req.user._id }).select("_id"),
+          },
+          status: { $in: ["completed", "failed"] },
+        }),
+      ]);
+
+    // Check limits
+    if (projectsCount >= limits.projectsLimit) {
+      return res.status(403).json({
+        success: false,
+        message: `You have reached your project limit of ${limits.projectsLimit}. Upgrade your plan to create more projects.`,
+      });
+    }
+
+    if (repositoriesCount >= limits.repositoriesLimit) {
+      return res.status(403).json({
+        success: false,
+        message: `You have reached your repository limit of ${limits.repositoriesLimit}. Upgrade your plan to connect more repositories.`,
+      });
+    }
+
+    if (changelogsCount >= limits.changelogsLimit) {
+      return res.status(403).json({
+        success: false,
+        message: `You have reached your changelog limit of ${limits.changelogsLimit} per month. Upgrade your plan or wait until next month.`,
+      });
+    }
+
+    next();
+  } catch (error) {
+    logger.error("Usage limit check error:", error);
+    res.status(500).json({
+      success: false,
+      message: "Internal server error.",
+    });
+  }
+};
+
+module.exports = {
+  generateToken,
+  verifyToken,
+  authenticate,
+  optionalAuth,
+  requireAdmin,
+  checkOwnership,
+  authRateLimit,
+  apiRateLimit,
+  verifyGithubWebhook,
+  checkSubscription,
+  checkUsageLimits,
+};