@jskit-ai/auth-provider-local-core 0.1.34 → 0.1.36

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "kind": "runtime",
   "description": "Local auth provider with a file backend default and no database requirement.",
   "dependsOn": [
@@ -64,8 +64,8 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.130",
-        "@jskit-ai/kernel": "0.1.133",
+        "@jskit-ai/auth-core": "0.1.132",
+        "@jskit-ai/kernel": "0.1.134",
         "nodemailer": "^9.0.3",
         "dotenv": "^16.4.5"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -11,8 +11,8 @@
     "./server/lib/index": "./src/server/lib/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.130",
-    "@jskit-ai/kernel": "0.1.133",
+    "@jskit-ai/auth-core": "0.1.132",
+    "@jskit-ai/kernel": "0.1.134",
     "nodemailer": "^9.0.3"
   }
 }

package/src/server/lib/service.js

@@ -154,6 +154,23 @@ async function findExistingAppProfile(user, profileProjector) {
   return profile ? requireProfileResult(profile, "findByIdentity") : null;
 }
 
+async function findExistingAppProfileByLogin(login, profileProjector) {
+  if (!profileProjector || typeof profileProjector.findByLogin !== "function") {
+    return null;
+  }
+  const profile = await profileProjector.findByLogin(login);
+  return profile ? requireProfileResult(profile, "findByLogin") : null;
+}
+
+function appProfileLocalUserId(profile = null) {
+  if (
+    String(profile?.authProvider || "").trim().toLowerCase() !== PROVIDER_ID
+  ) {
+    return "";
+  }
+  return String(profile?.authProviderUserSid || "").trim();
+}
+
 async function buildSessionAuthPayload({ devAuth, profileProjector, request, session, user }) {
   if (!isDevAuthSession(session)) {
     return buildAuthPayload({ user, session: null, profileProjector });
@@ -230,17 +247,18 @@ function validateEmailInput(email) {
 
 function devLoginAsValidationError(fieldErrors = {}) {
   const messages = Object.values(fieldErrors).filter(Boolean);
-  return new AppError(400, messages[0] || "Provide a user id or email.", {
+  return new AppError(400, messages[0] || "Provide a user id, email, or login name.", {
     details: {
       fieldErrors
     }
   });
 }
 
-function devLoginAsUserNotFound({ email = "", userId = "" } = {}) {
+function devLoginAsUserNotFound({ email = "", login = "", userId = "" } = {}) {
   return devLoginAsValidationError({
     ...(userId ? { userId: "User not found." } : {}),
-    ...(email ? { email: "User not found." } : {})
+    ...(email ? { email: "User not found." } : {}),
+    ...(login ? { login: "User not found." } : {})
   });
 }
 
@@ -458,10 +476,12 @@ function createLocalAuthService({
     ensureDevAuthExchangeAvailable(devAuth, request);
     const userId = String(input?.userId || "").trim();
     const email = normalizeEmail(input?.email || "");
-    if (!userId && !email) {
+    const login = String(input?.login || "").trim();
+    if (!userId && !email && !login) {
       throw devLoginAsValidationError({
-        userId: "Provide a user id or email.",
-        email: "Provide a user id or email."
+        userId: "Provide a user id, email, or login name.",
+        email: "Provide a user id, email, or login name.",
+        login: "Provide a user id, email, or login name."
       });
     }
 
@@ -470,12 +490,18 @@ function createLocalAuthService({
       if (!user && email) {
         user = await tx.users.findByEmail(email);
       }
+      let appProfile = null;
+      if (!user && login) {
+        appProfile = await findExistingAppProfileByLogin(login, profileProjector);
+        const localUserId = appProfileLocalUserId(appProfile);
+        user = localUserId ? await tx.users.findById(localUserId) : null;
+      }
       if (!user || user.disabled) {
-        throw devLoginAsUserNotFound({ email, userId });
+        throw devLoginAsUserNotFound({ email, login, userId });
       }
-      const appProfile = await findExistingAppProfile(user, profileProjector);
+      appProfile ||= await findExistingAppProfile(user, profileProjector);
       if (profileProjector && !appProfile) {
-        throw devLoginAsUserNotFound({ email, userId });
+        throw devLoginAsUserNotFound({ email, login, userId });
       }
       const session = await createSessionForUser(tx, user, {
         purpose: DEV_AUTH_SESSION_PURPOSE

package/src/server/providers/AuthLocalServiceProvider.js

@@ -158,6 +158,9 @@ function createLazyProfileProjector(scope) {
     findByIdentity(identity, options = {}) {
       return resolveMethod("findByIdentity")(identity, options);
     },
+    findByLogin(login, options = {}) {
+      return resolveMethod("findByLogin")(login, options);
+    },
     syncIdentityProfile(profile, options = {}) {
       return resolveMethod("syncIdentityProfile")(profile, options);
     }

package/test/providerRuntime.test.js

@@ -234,6 +234,109 @@ test("local file auth login-as issues native cookies for an existing user", asyn
   assert.equal(authenticated.sessionPurpose, "dev-auth");
 });
 
+test("local login-as resolves an application login through its existing auth profile link", async () => {
+  const projectedProfile = {
+    id: "app-user-ada",
+    authProvider: "local",
+    authProviderUserSid: "",
+    displayName: "Ada",
+    email: "ada@example.com",
+    username: "merc"
+  };
+  let syncCalls = 0;
+  const { app } = await createStartedApp({
+    env: devAuthEnv(),
+    profileProjector: {
+      async findByIdentity() {
+        return projectedProfile;
+      },
+      async findByLogin(login) {
+        return login === "merc" ? projectedProfile : null;
+      },
+      async syncIdentityProfile(profile) {
+        syncCalls += 1;
+        return {
+          ...projectedProfile,
+          authProviderUserSid: profile.authProviderUserSid
+        };
+      }
+    }
+  });
+  const authService = app.make("authService");
+  const registered = await authService.register({
+    displayName: "Ada",
+    email: "ada@example.com",
+    password: "correct horse battery staple"
+  });
+  projectedProfile.authProviderUserSid = registered.actor.providerUserId;
+  syncCalls = 0;
+
+  const impersonated = await authService.devLoginAs(createDevAuthExchangeRequest(), {
+    login: "merc"
+  });
+
+  assert.equal(impersonated.profile.id, "app-user-ada");
+  assert.equal(impersonated.actor.providerUserId, registered.actor.providerUserId);
+  assert.equal(impersonated.session.purpose, "dev-auth");
+  assert.equal(syncCalls, 0);
+});
+
+test("local login-as rejects unknown, disabled, and non-local application logins", async () => {
+  const disabledProfile = {
+    id: "app-user-disabled",
+    authProvider: "local",
+    authProviderUserSid: "local-user-disabled",
+    displayName: "Disabled",
+    email: "disabled-login@example.com",
+    username: "disabled"
+  };
+  const { app } = await createStartedApp({
+    env: devAuthEnv(),
+    profileProjector: {
+      async findByIdentity() {
+        return null;
+      },
+      async findByLogin(login) {
+        if (login === "disabled") {
+          return disabledProfile;
+        }
+        if (login === "external") {
+          return {
+            id: "app-user-external",
+            authProvider: "external",
+            authProviderUserSid: "external-user-1",
+            displayName: "External",
+            email: "external@example.com",
+            username: login
+          };
+        }
+        return null;
+      },
+      async syncIdentityProfile() {
+        throw new Error("preview login must not synchronize profiles");
+      }
+    }
+  });
+  const backend = app.make("auth.local.backend");
+  await backend.withTransaction(async (tx) => {
+    await tx.users.create({
+      disabled: true,
+      displayName: "Disabled",
+      email: disabledProfile.email,
+      id: disabledProfile.authProviderUserSid,
+      password: await hashPassword("stored password value")
+    });
+  });
+  const authService = app.make("authService");
+
+  for (const login of ["missing", "disabled", "external"]) {
+    await assert.rejects(
+      () => authService.devLoginAs(createDevAuthExchangeRequest(), { login }),
+      /User not found/
+    );
+  }
+});
+
 test("local login-as never invokes the mutating profile projector", async () => {
   const projectedProfile = {
     id: "app-user-ada",