@maka/maka-cli 5.2.6 → 5.2.7

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-methods.js.jsx

@@ -0,0 +1,273 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import { verifyAuth0Token, findOrCreateUserFromAuth0 } from '../auth0-validator';
+
+// Hook into Meteor logout to clean up Auth0 session
+Accounts.onLogout((options) => {
+  const user = options.user;
+
+  // If user has Auth0 account linked, we log the logout
+  // Note: Client-side should handle Auth0 logout via auth0Client.logout()
+  if (user?.services?.auth0) {
+    console.log(`User ${user._id} logged out (Auth0 ID: ${user.services.auth0.id})`);
+  }
+});
+
+/**
+ * Meteor Methods for Auth0 Authentication
+ *
+ * These methods handle the server-side Auth0 authentication flow,
+ * including token verification and user account creation/linking.
+ */
+
+/**
+ * Check if the user's Auth0 token has expired
+ */
+const isTokenExpired = (user) => {
+  const auth0Data = user?.services?.auth0;
+  if (!auth0Data?.expiresAt) {
+    return true;
+  }
+  return new Date() >= new Date(auth0Data.expiresAt);
+};
+
+Meteor.methods({
+  /**
+   * Authenticate user with Auth0 ID token
+   *
+   * @param idToken - The Auth0 ID token received from the client
+   * @returns Object containing userId and login token
+   */
+  async 'auth0.login'(idToken, accessToken) {
+    // Validate input
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+
+      // Find or create user from Auth0 data (store both idToken and accessToken)
+      const userId = await findOrCreateUserFromAuth0(tokenPayload, idToken, accessToken);
+
+      // Generate Meteor login token
+      const stampedLoginToken = Accounts._generateStampedLoginToken();
+      const loginToken = stampedLoginToken.token;
+
+      // Store login token for the user
+      Accounts._insertLoginToken(userId, stampedLoginToken);
+
+      // Return userId and token for client-side login
+      return {
+        userId,
+        token: loginToken,
+        tokenExpires: stampedLoginToken.when,
+      };
+    } catch (error) {
+      console.error('Auth0 login error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-login-failed',
+        'Failed to authenticate with Auth0',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Link Auth0 account to existing Meteor user
+   *
+   * @param idToken - The Auth0 ID token
+   */
+  async 'auth0.linkAccount'(idToken, accessToken) {
+    // Must be logged in to link account
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to link Auth0 account');
+    }
+
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+      const auth0Id = tokenPayload.sub;
+
+      // Check if Auth0 account is already linked to another user
+      const existingUser = await Meteor.users.findOneAsync({
+        'services.auth0.id': auth0Id,
+        _id: { $ne: this.userId },
+      });
+
+      if (existingUser) {
+        throw new Meteor.Error(
+          'auth0-already-linked',
+          'This Auth0 account is already linked to another user'
+        );
+      }
+
+      // Link Auth0 account to current user
+      await Meteor.users.updateAsync(this.userId, {
+        $set: {
+          // Profile data (client-accessible)
+          'profile.auth0': {
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email: tokenPayload.email,
+            email_verified: tokenPayload.email_verified,
+          },
+          // Token data (server-only)
+          'services.auth0': {
+            id: auth0Id,
+            idToken: idToken,
+            accessToken: accessToken,
+            expiresAt: new Date(tokenPayload.exp * 1000),
+            issuedAt: new Date(tokenPayload.iat * 1000),
+          },
+        },
+      });
+
+      return { success: true };
+    } catch (error) {
+      console.error('Auth0 link account error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-link-failed',
+        'Failed to link Auth0 account',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Unlink Auth0 account from current user
+   */
+  async 'auth0.unlinkAccount'() {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to unlink Auth0 account');
+    }
+
+    const user = await Meteor.users.findOneAsync(this.userId);
+
+    if (!user?.services?.auth0) {
+      throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+    }
+
+    // Make sure user has another way to login (password or other service)
+    if (!user.services.password && Object.keys(user.services).length === 1) {
+      throw new Meteor.Error(
+        'last-login-method',
+        'Cannot unlink Auth0 - it is your only login method. Add a password first.'
+      );
+    }
+
+    await Meteor.users.updateAsync(this.userId, {
+      $unset: {
+        'services.auth0': '',
+        'profile.auth0': '',
+      },
+    });
+
+    return { success: true };
+  },
+
+  /**
+   * Check if the current user's Auth0 token is valid
+   * Returns token expiry status
+   */
+  async 'auth0.checkTokenValidity'() {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in');
+    }
+
+    const user = await Meteor.users.findOneAsync(this.userId);
+
+    if (!user?.services?.auth0) {
+      throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+    }
+
+    const expired = isTokenExpired(user);
+
+    return {
+      isValid: !expired,
+      expiresAt: user.services.auth0.expiresAt,
+      issuedAt: user.services.auth0.issuedAt,
+    };
+  },
+
+  /**
+   * Refresh Auth0 token and update Meteor user session
+   * This method validates the new token and updates the user's token data
+   */
+  async 'auth0.refreshToken'(idToken, accessToken) {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in');
+    }
+
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the new Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+
+      // Get current user
+      const user = await Meteor.users.findOneAsync(this.userId);
+
+      if (!user?.services?.auth0) {
+        throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+      }
+
+      // Verify the token is for the same Auth0 user
+      if (user.services.auth0.id !== tokenPayload.sub) {
+        throw new Meteor.Error(
+          'token-mismatch',
+          'Token does not match current user Auth0 account'
+        );
+      }
+
+      // Update token data in services.auth0 (server-only)
+      await Meteor.users.updateAsync(this.userId, {
+        $set: {
+          'services.auth0.idToken': idToken,
+          'services.auth0.accessToken': accessToken,
+          'services.auth0.expiresAt': new Date(tokenPayload.exp * 1000),
+          'services.auth0.issuedAt': new Date(tokenPayload.iat * 1000),
+          // Also update profile data in case it changed
+          'profile.auth0.name': tokenPayload.name,
+          'profile.auth0.picture': tokenPayload.picture,
+          'profile.auth0.email': tokenPayload.email,
+          'profile.auth0.email_verified': tokenPayload.email_verified,
+        },
+      });
+
+      return {
+        success: true,
+        expiresAt: new Date(tokenPayload.exp * 1000),
+      };
+    } catch (error) {
+      console.error('Auth0 token refresh error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-refresh-failed',
+        'Failed to refresh Auth0 token',
+        error.message
+      );
+    }
+  },
+});

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-methods.js.tsx

@@ -0,0 +1,275 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import { verifyAuth0Token, findOrCreateUserFromAuth0 } from '../auth0-validator';
+
+// Hook into Meteor logout to clean up Auth0 session
+Accounts.onLogout((options: any) => {
+  const user = options.user;
+
+  // If user has Auth0 account linked, we log the logout
+  // Note: Client-side should handle Auth0 logout via auth0Client.logout()
+  if (user?.services?.auth0) {
+    console.log(`User ${user._id} logged out (Auth0 ID: ${user.services.auth0.id})`);
+  }
+});
+
+/**
+ * Meteor Methods for Auth0 Authentication
+ *
+ * These methods handle the server-side Auth0 authentication flow,
+ * including token verification and user account creation/linking.
+ */
+
+/**
+ * Check if the user's Auth0 token has expired
+ */
+const isTokenExpired = (user: any): boolean => {
+  const auth0Data = user?.services?.auth0;
+  if (!auth0Data?.expiresAt) {
+    return true;
+  }
+  return new Date() >= new Date(auth0Data.expiresAt);
+};
+
+Meteor.methods({
+  /**
+   * Authenticate user with Auth0 ID token
+   *
+   * @param idToken - The Auth0 ID token received from the client
+   * @param accessToken - The Auth0 access token (optional)
+   * @returns Object containing userId and login token
+   */
+  async 'auth0.login'(idToken: string, accessToken?: string) {
+    // Validate input
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+
+      // Find or create user from Auth0 data (store both idToken and accessToken)
+      const userId = await findOrCreateUserFromAuth0(tokenPayload, idToken, accessToken);
+
+      // Generate Meteor login token
+      const stampedLoginToken = Accounts._generateStampedLoginToken();
+      const loginToken = stampedLoginToken.token;
+
+      // Store login token for the user
+      Accounts._insertLoginToken(userId, stampedLoginToken);
+
+      // Return userId and token for client-side login
+      return {
+        userId,
+        token: loginToken,
+        tokenExpires: stampedLoginToken.when,
+      };
+    } catch (error) {
+      console.error('Auth0 login error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-login-failed',
+        'Failed to authenticate with Auth0',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Link Auth0 account to existing Meteor user
+   *
+   * @param idToken - The Auth0 ID token
+   * @param accessToken - The Auth0 access token (optional)
+   */
+  async 'auth0.linkAccount'(idToken: string, accessToken?: string) {
+    // Must be logged in to link account
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to link Auth0 account');
+    }
+
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+      const auth0Id = tokenPayload.sub;
+
+      // Check if Auth0 account is already linked to another user
+      const existingUser = await Meteor.users.findOneAsync({
+        'services.auth0.id': auth0Id,
+        _id: { $ne: this.userId },
+      });
+
+      if (existingUser) {
+        throw new Meteor.Error(
+          'auth0-already-linked',
+          'This Auth0 account is already linked to another user'
+        );
+      }
+
+      // Link Auth0 account to current user
+      await Meteor.users.updateAsync(this.userId, {
+        $set: {
+          // Profile data (client-accessible)
+          'profile.auth0': {
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email: tokenPayload.email,
+            email_verified: tokenPayload.email_verified,
+          },
+          // Token data (server-only)
+          'services.auth0': {
+            id: auth0Id,
+            idToken: idToken,
+            accessToken: accessToken,
+            expiresAt: new Date(tokenPayload.exp * 1000),
+            issuedAt: new Date(tokenPayload.iat * 1000),
+          },
+        },
+      });
+
+      return { success: true };
+    } catch (error) {
+      console.error('Auth0 link account error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-link-failed',
+        'Failed to link Auth0 account',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Unlink Auth0 account from current user
+   */
+  async 'auth0.unlinkAccount'() {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to unlink Auth0 account');
+    }
+
+    const user = await Meteor.users.findOneAsync(this.userId);
+
+    if (!user?.services?.auth0) {
+      throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+    }
+
+    // Make sure user has another way to login (password or other service)
+    if (!user.services.password && Object.keys(user.services).length === 1) {
+      throw new Meteor.Error(
+        'last-login-method',
+        'Cannot unlink Auth0 - it is your only login method. Add a password first.'
+      );
+    }
+
+    await Meteor.users.updateAsync(this.userId, {
+      $unset: {
+        'services.auth0': '',
+        'profile.auth0': '',
+      },
+    });
+
+    return { success: true };
+  },
+
+  /**
+   * Check if the current user's Auth0 token is valid
+   * Returns token expiry status
+   */
+  async 'auth0.checkTokenValidity'() {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in');
+    }
+
+    const user = await Meteor.users.findOneAsync(this.userId);
+
+    if (!user?.services?.auth0) {
+      throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+    }
+
+    const expired = isTokenExpired(user);
+
+    return {
+      isValid: !expired,
+      expiresAt: user.services.auth0.expiresAt,
+      issuedAt: user.services.auth0.issuedAt,
+    };
+  },
+
+  /**
+   * Refresh Auth0 token and update Meteor user session
+   * This method validates the new token and updates the user's token data
+   */
+  async 'auth0.refreshToken'(idToken: string, accessToken?: string) {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in');
+    }
+
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the new Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+
+      // Get current user
+      const user = await Meteor.users.findOneAsync(this.userId);
+
+      if (!user?.services?.auth0) {
+        throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+      }
+
+      // Verify the token is for the same Auth0 user
+      if (user.services.auth0.id !== tokenPayload.sub) {
+        throw new Meteor.Error(
+          'token-mismatch',
+          'Token does not match current user Auth0 account'
+        );
+      }
+
+      // Update token data in services.auth0 (server-only)
+      await Meteor.users.updateAsync(this.userId, {
+        $set: {
+          'services.auth0.idToken': idToken,
+          'services.auth0.accessToken': accessToken,
+          'services.auth0.expiresAt': new Date(tokenPayload.exp * 1000),
+          'services.auth0.issuedAt': new Date(tokenPayload.iat * 1000),
+          // Also update profile data in case it changed
+          'profile.auth0.name': tokenPayload.name,
+          'profile.auth0.picture': tokenPayload.picture,
+          'profile.auth0.email': tokenPayload.email,
+          'profile.auth0.email_verified': tokenPayload.email_verified,
+        },
+      });
+
+      return {
+        success: true,
+        expiresAt: new Date(tokenPayload.exp * 1000),
+      };
+    } catch (error) {
+      console.error('Auth0 token refresh error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-refresh-failed',
+        'Failed to refresh Auth0 token',
+        error.message
+      );
+    }
+  },
+});