@jskit-ai/auth-provider-local-core 0.1.2 → 0.1.3

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "kind": "runtime",
   "description": "Local auth provider with a file backend default and no database requirement.",
   "dependsOn": [
@@ -41,13 +41,14 @@ export default Object.freeze({
         },
         {
           "subpath": "./server/lib/index",
-          "summary": "Exports local auth service and file backend helpers."
+          "summary": "Exports local auth service, file backend helpers, and password strategy helpers."
         }
       ],
       "containerTokens": {
         "server": [
           "authService",
-          "auth.local.backend"
+          "auth.local.backend",
+          "auth.local.passwordStrategy"
         ],
         "client": []
       }
@@ -56,8 +57,8 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.101",
-        "@jskit-ai/kernel": "0.1.103",
+        "@jskit-ai/auth-core": "0.1.102",
+        "@jskit-ai/kernel": "0.1.104",
         "nodemailer": "^7.0.10",
         "dotenv": "^16.4.5"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -11,8 +11,8 @@
     "./server/lib/index": "./src/server/lib/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.101",
-    "@jskit-ai/kernel": "0.1.103",
+    "@jskit-ai/auth-core": "0.1.102",
+    "@jskit-ai/kernel": "0.1.104",
     "nodemailer": "^7.0.10"
   }
 }

package/src/server/lib/index.js

@@ -1,2 +1,3 @@
 export { createLocalAuthService } from "./service.js";
 export { createLocalFileBackend } from "./fileBackend.js";
+export { hashPassword, normalizePasswordStrategy, verifyPassword } from "./passwords.js";

package/src/server/lib/passwords.js

@@ -41,4 +41,41 @@ async function verifyPassword(password, record) {
   return expected.length === actual.length && timingSafeEqual(expected, actual);
 }
 
-export { hashPassword, verifyPassword };
+function normalizePasswordStrategy(strategy = null) {
+  if (!strategy) {
+    return Object.freeze({
+      hashPassword,
+      verifyPassword
+    });
+  }
+
+  if (typeof strategy !== "object" || Array.isArray(strategy)) {
+    throw new TypeError("Local auth password strategy must be an object.");
+  }
+
+  const normalized = strategy;
+  const strategyHashPassword = typeof normalized.hashPassword === "undefined"
+    ? hashPassword
+    : normalized.hashPassword;
+  const strategyVerifyPassword = typeof normalized.verifyPassword === "undefined"
+    ? verifyPassword
+    : normalized.verifyPassword;
+
+  if (typeof strategyHashPassword !== "function") {
+    throw new TypeError("Local auth password strategy hashPassword must be a function.");
+  }
+  if (typeof strategyVerifyPassword !== "function") {
+    throw new TypeError("Local auth password strategy verifyPassword must be a function.");
+  }
+
+  return Object.freeze({
+    async hashPassword(password) {
+      return strategyHashPassword.call(strategy, password);
+    },
+    async verifyPassword(password, record) {
+      return strategyVerifyPassword.call(strategy, password, record);
+    }
+  });
+}
+
+export { hashPassword, verifyPassword, normalizePasswordStrategy };

package/src/server/lib/service.js

@@ -8,7 +8,7 @@ import { buildSecurityStatusFromAuthMethodsStatus } from "@jskit-ai/auth-core/sh
 import { normalizeAuthActor, normalizeAuthResult } from "@jskit-ai/auth-core/server/authActor";
 import { normalizeEmail } from "@jskit-ai/auth-core/server/utils";
 import { throwUnsupportedAuthOperation } from "@jskit-ai/auth-core/server/unsupportedOperation";
-import { hashPassword, verifyPassword } from "./passwords.js";
+import { normalizePasswordStrategy } from "./passwords.js";
 import { randomToken, sha256Base64url, signToken, verifySignedToken } from "./tokens.js";
 
 const ACCESS_TOKEN_COOKIE = "jskit_local_access_token";
@@ -191,7 +191,7 @@ async function maybeSendRecoveryEmail(config, recoveryUrl, email) {
   });
 }
 
-function createLocalAuthService({ backend, config, profileProjector = null }) {
+function createLocalAuthService({ backend, config, profileProjector = null, passwordStrategy = null }) {
   if (!backend || typeof backend.withTransaction !== "function") {
     throw new Error("Local auth requires auth.local.backend with withTransaction().");
   }
@@ -199,6 +199,7 @@ function createLocalAuthService({ backend, config, profileProjector = null }) {
     throw new Error("Local auth requires a session secret.");
   }
 
+  const passwords = normalizePasswordStrategy(passwordStrategy);
   const isProduction = config.nodeEnv === "production";
   const profileProjectionEnabled = typeof profileProjector?.syncIdentityProfile === "function";
   const recoveryDelivery = config.smtpConfigured
@@ -284,7 +285,7 @@ function createLocalAuthService({ backend, config, profileProjector = null }) {
     const email = validateEmailInput(input.email);
     validatePasswordInput(input.password);
     const displayName = normalizeDisplayName(input.displayName, email);
-    const password = await hashPassword(input.password);
+    const password = await passwords.hashPassword(input.password);
     const result = await backend.withTransaction(async (tx) => {
       const existing = await tx.users.findByEmail(email);
       if (existing) {
@@ -312,7 +313,7 @@ function createLocalAuthService({ backend, config, profileProjector = null }) {
     const password = String(input.password || "");
     return backend.withTransaction(async (tx) => {
       const user = await tx.users.findByEmail(email);
-      if (!user || user.disabled || !(await verifyPassword(password, user.password))) {
+      if (!user || user.disabled || !(await passwords.verifyPassword(password, user.password))) {
         throw new AppError(401, "Invalid email or password.");
       }
       const session = await createSessionForUser(tx, user);
@@ -517,7 +518,7 @@ function createLocalAuthService({ backend, config, profileProjector = null }) {
     if (!payload?.sub || !payload?.sid) {
       throw new AppError(401, "Authentication required.");
     }
-    const password = await hashPassword(input.password);
+    const password = await passwords.hashPassword(input.password);
     await backend.withTransaction(async (tx) => {
       const session = await tx.sessions.findById(String(payload.sid));
       if (!session || session.revokedAt || isExpiredIso(session.expiresAt)) {
@@ -546,13 +547,13 @@ function createLocalAuthService({ backend, config, profileProjector = null }) {
     }
 
     const currentPassword = String(input.currentPassword || "");
-    const password = await hashPassword(input.newPassword);
+    const password = await passwords.hashPassword(input.newPassword);
     await backend.withTransaction(async (tx) => {
       const user = await tx.users.findById(authResult.actor.providerUserId);
       if (!user || user.disabled) {
         throw new AppError(401, "Authentication required.");
       }
-      if (!(await verifyPassword(currentPassword, user.password))) {
+      if (!(await passwords.verifyPassword(currentPassword, user.password))) {
         throw new AppError(401, "Current password is invalid.");
       }
       await tx.users.updatePassword(user.id, password);

package/src/server/providers/AuthLocalServiceProvider.js

@@ -173,12 +173,24 @@ class AuthLocalServiceProvider {
       const config = resolveConfig(scope);
       const backend = scope.make("auth.local.backend");
       const profileProjector = scope.has("auth.profile.projector")
-        ? scope.make("auth.profile.projector")
+        ? {
+            async syncIdentityProfile(profile) {
+              const projector = scope.make("auth.profile.projector");
+              if (!projector || typeof projector.syncIdentityProfile !== "function") {
+                throw new Error("auth.profile.projector.syncIdentityProfile() must be a function.");
+              }
+              return projector.syncIdentityProfile(profile);
+            }
+          }
+        : null;
+      const passwordStrategy = scope.has("auth.local.passwordStrategy")
+        ? scope.make("auth.local.passwordStrategy")
         : null;
       return createLocalAuthService({
         backend,
         config,
-        profileProjector
+        profileProjector,
+        passwordStrategy
       });
     });
   }

package/test/providerRuntime.test.js

@@ -8,9 +8,13 @@ import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
 import { AuthActionsServiceProvider } from "@jskit-ai/auth-core/server/providers/AuthActionsServiceProvider";
 import { AuthLocalServiceProvider } from "../src/server/providers/AuthLocalServiceProvider.js";
 import { AuthProviderServiceProvider } from "../src/server/providers/AuthProviderServiceProvider.js";
-import { createLocalFileBackend } from "../src/server/lib/fileBackend.js";
-import { createLocalAuthService } from "../src/server/lib/service.js";
-import { hashPassword } from "../src/server/lib/passwords.js";
+import {
+  createLocalAuthService,
+  createLocalFileBackend,
+  hashPassword,
+  normalizePasswordStrategy,
+  verifyPassword
+} from "../src/server/lib/index.js";
 
 function createAppConfigFixture() {
   return {
@@ -46,7 +50,7 @@ function createReplyFixture() {
   };
 }
 
-async function createStartedApp({ profileProjector = null } = {}) {
+async function createStartedApp({ profileProjector = null, profileProjectorFactory = null, passwordStrategy = null } = {}) {
   const storeDir = await fs.mkdtemp(path.join(os.tmpdir(), "jskit-auth-local-"));
   const app = createApplication();
   app.instance("appConfig", createAppConfigFixture());
@@ -69,6 +73,12 @@ async function createStartedApp({ profileProjector = null } = {}) {
   if (profileProjector) {
     app.instance("auth.profile.projector", profileProjector);
   }
+  if (profileProjectorFactory) {
+    app.singleton("auth.profile.projector", profileProjectorFactory);
+  }
+  if (passwordStrategy) {
+    app.instance("auth.local.passwordStrategy", passwordStrategy);
+  }
   await app.start({
     providers: [
       ActionRuntimeServiceProvider,
@@ -134,6 +144,72 @@ test("local auth provider registers, logs in, reads session, and logs out with f
   assert.match(usersFile, /^user:v1:/);
 });
 
+test("local auth provider resolves a custom password strategy from the container", async () => {
+  const passwordStrategy = {
+    prefix: "strategy",
+    async hashPassword(password) {
+      return {
+        algorithm: "test-password",
+        version: "v1",
+        salt: "",
+        hash: `${this.prefix}-${password}`
+      };
+    },
+    async verifyPassword(password, record) {
+      return record?.algorithm === "test-password" && record?.hash === `${this.prefix}-${password}`;
+    }
+  };
+  const { app } = await createStartedApp({ passwordStrategy });
+  const authService = app.make("authService");
+
+  await authService.register({
+    email: "strategy@example.com",
+    password: "strategy password value",
+    displayName: "Strategy User"
+  });
+
+  const loggedIn = await authService.login({
+    email: "strategy@example.com",
+    password: "strategy password value"
+  });
+
+  assert.equal(loggedIn.actor.email, "strategy@example.com");
+});
+
+test("local auth password strategy supports partial overrides and rejects invalid methods", async () => {
+  const strategy = normalizePasswordStrategy({
+    verifyPassword(password, record) {
+      return record === `legacy:${this.realm}:${password}`;
+    },
+    realm: "users"
+  });
+
+  const defaultHashed = await strategy.hashPassword("new password value");
+  assert.equal(await verifyPassword("new password value", defaultHashed), true);
+  assert.equal(await strategy.verifyPassword("old password value", "legacy:users:old password value"), true);
+
+  assert.throws(
+    () => normalizePasswordStrategy("invalid"),
+    /Local auth password strategy must be an object/
+  );
+  assert.throws(
+    () => normalizePasswordStrategy([]),
+    /Local auth password strategy must be an object/
+  );
+  assert.throws(
+    () => normalizePasswordStrategy({ hashPassword: "invalid" }),
+    /Local auth password strategy hashPassword must be a function/
+  );
+  assert.throws(
+    () => normalizePasswordStrategy({ hashPassword: null }),
+    /Local auth password strategy hashPassword must be a function/
+  );
+  assert.throws(
+    () => normalizePasswordStrategy({ verifyPassword: "invalid" }),
+    /Local auth password strategy verifyPassword must be a function/
+  );
+});
+
 test("local auth login verifies password and creates session in one backend transaction", async () => {
   const password = await hashPassword("current password value");
   let transactions = 0;
@@ -190,6 +266,102 @@ test("local auth login verifies password and creates session in one backend tran
   assert.equal(transactions, 1);
 });
 
+test("local auth service accepts a custom strategy for legacy stored password records", async () => {
+  const usersByEmail = new Map([
+    [
+      "legacy@example.com",
+      {
+        id: "usr_legacy",
+        email: "legacy@example.com",
+        displayName: "Legacy User",
+        password: {
+          algorithm: "legacy-bcrypt",
+          hash: "legacy password value"
+        },
+        disabled: false
+      }
+    ]
+  ]);
+  const sessions = [];
+  const backend = {
+    async withTransaction(callback) {
+      const tx = {
+        users: {
+          async findByEmail(email) {
+            return usersByEmail.get(email) || null;
+          },
+          async create(input) {
+            const user = {
+              ...input,
+              disabled: false
+            };
+            usersByEmail.set(user.email, user);
+            return user;
+          }
+        },
+        sessions: {
+          async create(input) {
+            const session = {
+              ...input,
+              createdAt: new Date().toISOString(),
+              revokedAt: ""
+            };
+            sessions.push(session);
+            return session;
+          }
+        }
+      };
+      return callback(tx);
+    }
+  };
+  const passwordStrategy = {
+    async hashPassword(password) {
+      return {
+        algorithm: "test-scrypt",
+        version: "v1",
+        salt: "test",
+        hash: `hashed-${password}`
+      };
+    },
+    async verifyPassword(password, record) {
+      if (record?.algorithm === "legacy-bcrypt") {
+        return record.hash === password;
+      }
+      return record?.algorithm === "test-scrypt" && record.hash === `hashed-${password}`;
+    }
+  };
+  const authService = createLocalAuthService({
+    backend,
+    passwordStrategy,
+    config: {
+      nodeEnv: "test",
+      sessionSecret: "test-secret",
+      appPublicUrl: "http://localhost:5173",
+      smtpConfigured: false,
+      recoveryDevOutput: "disabled"
+    }
+  });
+
+  const legacyLogin = await authService.login({
+    email: "legacy@example.com",
+    password: "legacy password value"
+  });
+  assert.equal(legacyLogin.actor.email, "legacy@example.com");
+
+  await authService.register({
+    email: "new-strategy@example.com",
+    password: "new password value",
+    displayName: "New Strategy"
+  });
+  assert.deepEqual(usersByEmail.get("new-strategy@example.com").password, {
+    algorithm: "test-scrypt",
+    version: "v1",
+    salt: "test",
+    hash: "hashed-new password value"
+  });
+  assert.equal(sessions.length, 2);
+});
+
 test("local auth provider completes recovery through a recovery-scoped session", async () => {
   const { app } = await createStartedApp();
   const authService = app.make("authService");
@@ -349,6 +521,42 @@ test("local auth provider changes password through the account-security contract
   assert.equal(login.actor.email, "lin@example.com");
 });
 
+test("local auth provider defers profile projector resolution until projection is needed", async () => {
+  let projectorResolved = 0;
+  let projectionCalls = 0;
+  const { app } = await createStartedApp({
+    profileProjectorFactory: () => {
+      projectorResolved += 1;
+      return {
+        async syncIdentityProfile(profile) {
+          projectionCalls += 1;
+          return {
+            ...profile,
+            id: "app-profile-id",
+            profileSource: "users"
+          };
+        }
+      };
+    }
+  });
+
+  assert.equal(projectorResolved, 0);
+
+  const authService = app.make("authService");
+  assert.equal(authService.getCapabilities().features.appProfileProjection, true);
+  assert.equal(projectorResolved, 0);
+
+  const registered = await authService.register({
+    email: "projector@example.com",
+    password: "projector password value",
+    displayName: "Projector User"
+  });
+
+  assert.equal(projectorResolved, 1);
+  assert.equal(projectionCalls, 1);
+  assert.equal(registered.actor.appUserId, "app-profile-id");
+});
+
 test("local auth provider projects app profile when auth.profile.projector is installed", async () => {
   const projectedProfiles = [];
   const { app } = await createStartedApp({