@manojkmfsi/monodog 1.1.30 → 1.1.31

package/.env.example

@@ -1,19 +1,5 @@
 # GitHub OAuth Configuration
 GITHUB_CLIENT_ID=your_client_id_here
 GITHUB_CLIENT_SECRET=your_client_secret_here
-OAUTH_REDIRECT_URI=http://localhost:3000/auth/callback
+OAUTH_REDIRECT_URI=http://localhost:3010/auth/callback
 
-# Database Configuration
-# DATABASE_URL=postgresql://user:password@localhost:5432/monodog
-
-# # Server Configuration
-# SERVER_HOST=localhost
-# SERVER_PORT=5000
-# DASHBOARD_HOST=localhost
-# DASHBOARD_PORT=3000
-
-# # Logging Level (debug, info, warn, error)
-# LOG_LEVEL=info
-
-# # Environment
-# NODE_ENV=development

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @manojkmfsi/monoapp
 
+## 1.1.31
+
+### Patch Changes
+
+- [`0541cc8`](https://github.com/manojkmfsi/monodog/commit/0541cc88c639265386c29a59b09e6b63cdee6064) - vnbbnbn,n,mnm,m
+
+- [`785a90a`](https://github.com/manojkmfsi/monodog/commit/785a90a9c15354559f13a88bf1f9486c9794fc18) - ffhjhkklnbncxdflk,
+
+- [`3a32768`](https://github.com/manojkmfsi/monodog/commit/3a32768c4e1be683847d9308632c1d4eb85e43fd) - ccfckjjlkklkm,m.,m.,
+
+- [`efee08b`](https://github.com/manojkmfsi/monodog/commit/efee08b5d8cc52f35b7a21dae69ca7dde5b99427) - fgkjlkn,m cgfcbv
+
 ## 1.1.30
 
 ### Patch Changes

package/dist/controllers/auth-controller.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * Authentication Controller
+ * Thin controller that handles HTTP concerns and delegates business logic to auth-service
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refresh = exports.logout = exports.validate = exports.me = exports.callback = exports.login = void 0;
+const auth_service_1 = require("../services/auth-service");
+const logger_1 = require("../middleware/logger");
+/**
+ * Start OAuth login flow
+ * GET /auth/login
+ */
+const login = (req, res) => {
+    try {
+        const redirectUrl = req.query.redirect || '/';
+        const result = (0, auth_service_1.initiateLogin)(redirectUrl);
+        res.json({
+            success: true,
+            authUrl: result.authUrl,
+            message: 'Redirect to this URL to authenticate with GitHub',
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Login initiation failed: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Login failed',
+            message: error instanceof Error ? error.message : 'Failed to initiate GitHub OAuth flow',
+        });
+    }
+};
+exports.login = login;
+/**
+ * OAuth callback handler
+ * GET /auth/callback?code=...&state=...
+ */
+const callback = async (req, res) => {
+    try {
+        const { code, state, error, error_description } = req.query;
+        // Handle OAuth errors from GitHub
+        if (error) {
+            logger_1.AppLogger.warn(`OAuth error: ${error} - ${error_description}`);
+            res.status(400).json({
+                success: false,
+                error: error,
+                message: error_description,
+            });
+            return;
+        }
+        if (!code || !state) {
+            logger_1.AppLogger.warn('OAuth callback missing code or state');
+            res.status(400).json({
+                success: false,
+                error: 'Missing parameters',
+                message: 'OAuth code and state are required',
+            });
+            return;
+        }
+        const result = await (0, auth_service_1.handleOAuthCallback)(code, state);
+        res.json({
+            success: true,
+            message: 'Authentication successful',
+            ...result,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`OAuth callback failed: ${error}`);
+        const message = error instanceof Error ? error.message : 'Failed to complete GitHub OAuth flow';
+        if (message.includes('CSRF')) {
+            res.status(400).json({
+                success: false,
+                error: 'Invalid state',
+                message,
+            });
+        }
+        else {
+            res.status(500).json({
+                success: false,
+                error: 'Authentication failed',
+                message,
+            });
+        }
+    }
+};
+exports.callback = callback;
+/**
+ * Get current user session
+ * GET /auth/me
+ */
+const me = (req, res) => {
+    try {
+        const session = (0, auth_service_1.getCurrentSession)(req);
+        res.json({
+            success: true,
+            ...session,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to get user session: ${error}`);
+        res.status(401).json({
+            success: false,
+            error: 'Unauthorized',
+            message: error instanceof Error ? error.message : 'Failed to retrieve user information',
+        });
+    }
+};
+exports.me = me;
+/**
+ * Validate session
+ * POST /auth/validate
+ */
+const validate = async (req, res) => {
+    try {
+        const result = await (0, auth_service_1.validateCurrentSession)(req);
+        res.json({
+            success: true,
+            ...result,
+            message: 'Session is valid',
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Session validation failed: ${error}`);
+        if (error instanceof Error && error.message.includes('no longer valid')) {
+            res.status(401).json({
+                success: false,
+                valid: false,
+                error: 'Unauthorized',
+                message: error.message,
+            });
+        }
+        else {
+            res.status(500).json({
+                success: false,
+                valid: false,
+                error: 'Validation failed',
+                message: error instanceof Error ? error.message : 'Failed to validate session',
+            });
+        }
+    }
+};
+exports.validate = validate;
+/**
+ * Logout
+ * POST /auth/logout
+ */
+const logout = (req, res) => {
+    try {
+        (0, auth_service_1.logoutUser)(req);
+        res.json({
+            success: true,
+            message: 'Logout successful',
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Logout failed: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Logout failed',
+            message: error instanceof Error ? error.message : 'Failed to logout',
+        });
+    }
+};
+exports.logout = logout;
+/**
+ * Refresh session (token)
+ * POST /auth/refresh
+ */
+const refresh = async (req, res) => {
+    try {
+        const result = await (0, auth_service_1.refreshUserSession)(req);
+        res.json({
+            success: true,
+            message: 'Session refreshed successfully',
+            ...result,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Session refresh failed: ${error}`);
+        if (error instanceof Error && error.message.includes('no longer valid')) {
+            res.status(401).json({
+                success: false,
+                error: 'Unauthorized',
+                message: error.message,
+            });
+        }
+        else {
+            res.status(500).json({
+                success: false,
+                error: 'Refresh failed',
+                message: error instanceof Error ? error.message : 'Failed to refresh session',
+            });
+        }
+    }
+};
+exports.refresh = refresh;

package/dist/controllers/permission-controller.js

@@ -0,0 +1,152 @@
+"use strict";
+/**
+ * Permission Controller
+ * Thin controller that handles HTTP concerns and delegates business logic to permission-service
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidateCache = exports.checkActionPermission = exports.getRepositoryPermission = void 0;
+const auth_middleware_1 = require("../middleware/auth-middleware");
+const permission_service_1 = require("../services/permission-service");
+const logger_1 = require("../middleware/logger");
+/**
+ * Get user's permission for a specific repository
+ * GET /permissions/:owner/:repo
+ */
+const getRepositoryPermission = async (req, res) => {
+    try {
+        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+        if (!session) {
+            res.status(401).json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'No active session',
+            });
+            return;
+        }
+        const { owner, repo } = req.params;
+        const forceRefresh = req.query.refresh === 'true';
+        if (!owner || !repo) {
+            res.status(400).json({
+                success: false,
+                error: 'Bad request',
+                message: 'Owner and repo parameters are required',
+            });
+            return;
+        }
+        logger_1.AppLogger.debug(`Checking permission for ${session.user.login} in ${owner}/${repo}`);
+        const permissionCheck = await (0, permission_service_1.checkRepositoryPermission)(session.accessToken, session.user.id, session.user.login, owner, repo, forceRefresh);
+        res.json({
+            success: true,
+            owner,
+            repo,
+            user: session.user.login,
+            ...permissionCheck,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to check permission: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Internal server error',
+            message: 'Failed to check repository permission',
+        });
+    }
+};
+exports.getRepositoryPermission = getRepositoryPermission;
+/**
+ * Check if user can perform a specific action
+ * POST /permissions/:owner/:repo/can-action
+ */
+const checkActionPermission = async (req, res) => {
+    try {
+        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+        if (!session) {
+            res.status(401).json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'No active session',
+            });
+            return;
+        }
+        const { owner, repo } = req.params;
+        const { action } = req.body;
+        if (!owner || !repo) {
+            res.status(400).json({
+                success: false,
+                error: 'Bad request',
+                message: 'Owner and repo parameters are required',
+            });
+            return;
+        }
+        if (!action || !['read', 'write', 'maintain', 'admin'].includes(action)) {
+            res.status(400).json({
+                success: false,
+                error: 'Bad request',
+                message: 'Valid action is required (read, write, maintain, or admin)',
+            });
+            return;
+        }
+        logger_1.AppLogger.debug(`Checking if ${session.user.login} can perform '${action}' in ${owner}/${repo}`);
+        const actionCheck = await (0, permission_service_1.checkUserAction)(session.accessToken, session.user.id, session.user.login, owner, repo, action);
+        res.json({
+            success: true,
+            owner,
+            repo,
+            user: session.user.login,
+            ...actionCheck,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to check action permission: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Internal server error',
+            message: 'Failed to check action permission',
+        });
+    }
+};
+exports.checkActionPermission = checkActionPermission;
+/**
+ * Invalidate permission cache for a repository
+ * POST /permissions/:owner/:repo/invalidate
+ */
+const invalidateCache = (req, res) => {
+    try {
+        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+        if (!session) {
+            res.status(401).json({
+                success: false,
+                error: 'Unauthorized',
+                message: 'No active session',
+            });
+            return;
+        }
+        const { owner, repo } = req.params;
+        if (!owner || !repo) {
+            res.status(400).json({
+                success: false,
+                error: 'Bad request',
+                message: 'Owner and repo parameters are required',
+            });
+            return;
+        }
+        logger_1.AppLogger.debug(`Invalidating permission cache for ${session.user.login} in ${owner}/${repo}`);
+        (0, permission_service_1.invalidatePermissionCache)(session.user.id, owner, repo);
+        res.json({
+            success: true,
+            message: 'Permission cache invalidated',
+            owner,
+            repo,
+            user: session.user.login,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to invalidate cache: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Internal server error',
+            message: 'Failed to invalidate permission cache',
+        });
+    }
+};
+exports.invalidateCache = invalidateCache;

package/dist/routes/auth-routes.js

@@ -5,368 +5,37 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
-const github_oauth_service_1 = require("../services/github-oauth-service");
+const auth_controller_1 = require("../controllers/auth-controller");
 const auth_middleware_1 = require("../middleware/auth-middleware");
-const permission_service_1 = require("../services/permission-service");
-const logger_1 = require("../middleware/logger");
-const utilities_1 = require("../utils/utilities");
 const router = (0, express_1.Router)();
-// OAuth configuration (should come from environment variables)
-// const GITHUB_CLIENT_ID = process.env.GITHUB_CLIENT_ID || '';
-// const GITHUB_CLIENT_SECRET = process.env.GITHUB_CLIENT_SECRET || '';
-// const OAUTH_REDIRECT_URI = process.env.OAUTH_REDIRECT_URI || 'http://localhost:3000/auth/callback';
-// State store for CSRF protection
-const stateStore = new Map();
-const STATE_EXPIRY = 10 * 60 * 1000; // 10 minutes
-/**
- * Generate random state for CSRF protection
- */
-function generateState() {
-    return Math.random().toString(36).substring(2, 15) +
-        Math.random().toString(36).substring(2, 15);
-}
-/**
- * Validate OAuth state
- */
-function validateState(state) {
-    const entry = stateStore.get(state);
-    if (!entry) {
-        return false;
-    }
-    // Check if state has expired
-    if (Date.now() - entry.createdAt > STATE_EXPIRY) {
-        stateStore.delete(state);
-        return false;
-    }
-    return true;
-}
-/**
- * Get redirect URL from state
- */
-function getRedirectUrl(state) {
-    const entry = stateStore.get(state);
-    return entry?.redirectUrl;
-}
-/**
- * Clear state after use
- */
-function clearState(state) {
-    stateStore.delete(state);
-}
 /**
  * Start OAuth login flow
  * GET /auth/login
  */
-router.get('/login', (req, res) => {
-    try {
-        if (!process.env.GITHUB_CLIENT_ID) {
-            logger_1.AppLogger.error('GitHub client ID not configured');
-            res.status(500).json({
-                error: 'OAuth not configured',
-                message: 'GitHub OAuth is not properly configured',
-            });
-            return;
-        }
-        const state = generateState();
-        const redirectUrl = req.query.redirect || '/';
-        // Store state for validation
-        stateStore.set(state, {
-            createdAt: Date.now(),
-            redirectUrl,
-        });
-        const authUrl = (0, github_oauth_service_1.generateAuthorizationUrl)(process.env.GITHUB_CLIENT_ID, process.env.OAUTH_REDIRECT_URI, state);
-        res.json({
-            success: true,
-            authUrl,
-            message: 'Redirect to this URL to authenticate with GitHub',
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Login initiation failed: ${error}`);
-        res.status(500).json({
-            error: 'Login failed',
-            message: 'Failed to initiate GitHub OAuth flow',
-        });
-    }
-});
+router.get('/login', auth_controller_1.login);
 /**
  * OAuth callback handler
  * GET /auth/callback?code=...&state=...
  */
-router.get('/callback', async (req, res) => {
-    try {
-        const { code, state, error, error_description } = req.query;
-        // Handle OAuth errors
-        if (error) {
-            logger_1.AppLogger.warn(`OAuth error: ${error} - ${error_description}`);
-            res.status(400).json({
-                success: false,
-                error: error,
-                message: error_description,
-            });
-            return;
-        }
-        // Validate code and state
-        if (!code || !state) {
-            logger_1.AppLogger.warn('OAuth callback missing code or state');
-            res.status(400).json({
-                success: false,
-                error: 'Missing parameters',
-                message: 'OAuth code and state are required',
-            });
-            return;
-        }
-        // Validate state for CSRF protection
-        if (!validateState(state)) {
-            logger_1.AppLogger.warn(`Invalid or expired state in OAuth callback: ${state}`);
-            res.status(400).json({
-                success: false,
-                error: 'Invalid state',
-                message: 'CSRF validation failed',
-            });
-            return;
-        }
-        if (!process.env.GITHUB_CLIENT_SECRET) {
-            logger_1.AppLogger.error('GitHub client secret not configured');
-            res.status(500).json({
-                error: 'OAuth not configured',
-                message: 'GitHub OAuth is not properly configured',
-            });
-            return;
-        }
-        // Exchange code for access token
-        logger_1.AppLogger.debug('Exchanging OAuth code for access token');
-        const tokenResponse = await (0, github_oauth_service_1.exchangeCodeForToken)(code, process.env.GITHUB_CLIENT_ID, process.env.GITHUB_CLIENT_SECRET, process.env.OAUTH_REDIRECT_URI);
-        // Get user information
-        logger_1.AppLogger.debug('Retrieving authenticated user information');
-        const user = await (0, github_oauth_service_1.getAuthenticatedUser)(tokenResponse.access_token);
-        // Fetch user's repository permission
-        let permission = null;
-        try {
-            logger_1.AppLogger.debug(`Fetching repository permission for user ${user.login}`);
-            // Extract repository info from git remote
-            const repoInfo = await (0, utilities_1.getRepositoryInfoFromGit)();
-            if (!repoInfo) {
-                logger_1.AppLogger.warn('Could not extract repository info from git remote - permission fetch skipped');
-            }
-            else {
-                const { owner, repo } = repoInfo;
-                permission = await (0, permission_service_1.getUserRepositoryPermission)(tokenResponse.access_token, user.id, user.login, owner, repo);
-                logger_1.AppLogger.info(`User ${user.login} has ${permission.permission} permission on ${owner}/${repo}`);
-            }
-        }
-        catch (permError) {
-            logger_1.AppLogger.error(`Failed to fetch repository permission: ${permError}`);
-            // Continue without permission - will be checked on protected routes
-            permission = null;
-        }
-        // Create session with permission
-        const session = {
-            accessToken: tokenResponse.access_token,
-            expiresIn: 3600, // 1 hour default
-            expiresAt: Date.now() + 24 * 60 * 60 * 1000, // 24 hours
-            user,
-            scopes: tokenResponse.scope.split(','),
-            permission, // Include fetched permission in session
-        };
-        // Store session and get token
-        const sessionToken = (0, auth_middleware_1.storeSession)(session);
-        // Get redirect URL
-        const redirectUrl = getRedirectUrl(state) || '/';
-        // Clear state
-        clearState(state);
-        logger_1.AppLogger.info(`User authenticated: ${user.login} with permission: ${permission?.permission || 'unknown'}`);
-        res.json({
-            success: true,
-            message: 'Authentication successful',
-            sessionToken,
-            redirectUrl,
-            user: {
-                id: user.id,
-                login: user.login,
-                name: user.name,
-                avatar_url: user.avatar_url,
-            },
-            permission: permission ? {
-                level: permission.permission,
-                role: permission.role,
-                owner: permission.owner,
-                repo: permission.repo,
-            } : null,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`OAuth callback failed: ${error}`);
-        res.status(500).json({
-            success: false,
-            error: 'Authentication failed',
-            message: 'Failed to complete GitHub OAuth flow',
-        });
-    }
-});
+router.get('/callback', auth_controller_1.callback);
 /**
  * Get current user session
  * GET /auth/me
  */
-router.get('/me', auth_middleware_1.authenticationMiddleware, (req, res) => {
-    try {
-        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
-        if (!session) {
-            res.status(401).json({
-                error: 'Unauthorized',
-                message: 'No active session',
-            });
-            return;
-        }
-        res.json({
-            success: true,
-            user: {
-                id: session.user.id,
-                login: session.user.login,
-                name: session.user.name,
-                email: session.user.email,
-                avatar_url: session.user.avatar_url,
-                public_repos: session.user.public_repos,
-                followers: session.user.followers,
-                following: session.user.following,
-            },
-            scopes: session.scopes,
-            expiresAt: session.expiresAt,
-            permission: session.permission || null,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Failed to get user session: ${error}`);
-        res.status(500).json({
-            error: 'Internal server error',
-            message: 'Failed to retrieve user information',
-        });
-    }
-});
+router.get('/me', auth_middleware_1.authenticationMiddleware, auth_controller_1.me);
 /**
  * Validate session
  * POST /auth/validate
  */
-router.post('/validate', auth_middleware_1.authenticationMiddleware, async (req, res) => {
-    try {
-        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
-        if (!session) {
-            res.status(401).json({
-                success: false,
-                valid: false,
-                message: 'No active session',
-            });
-            return;
-        }
-        // Validate token with GitHub
-        const isValid = await (0, github_oauth_service_1.validateToken)(session.accessToken);
-        if (!isValid) {
-            // Token is no longer valid, invalidate session
-            const token = req.headers.authorization?.replace('Bearer ', '') ||
-                req.cookies?.['auth-token'];
-            if (token) {
-                (0, auth_middleware_1.invalidateSession)(token);
-            }
-            res.status(401).json({
-                success: false,
-                valid: false,
-                message: 'Session token is no longer valid',
-            });
-            return;
-        }
-        res.json({
-            success: true,
-            valid: true,
-            message: 'Session is valid',
-            expiresAt: session.expiresAt,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Session validation failed: ${error}`);
-        res.status(500).json({
-            success: false,
-            valid: false,
-            error: 'Validation failed',
-            message: 'Failed to validate session',
-        });
-    }
-});
+router.post('/validate', auth_middleware_1.authenticationMiddleware, auth_controller_1.validate);
 /**
  * Logout
  * POST /auth/logout
  */
-router.post('/logout', auth_middleware_1.authenticationMiddleware, (req, res) => {
-    try {
-        const token = req.headers.authorization?.replace('Bearer ', '') ||
-            req.cookies?.['auth-token'];
-        if (token) {
-            (0, auth_middleware_1.invalidateSession)(token);
-        }
-        res.json({
-            success: true,
-            message: 'Logout successful',
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Logout failed: ${error}`);
-        res.status(500).json({
-            success: false,
-            error: 'Logout failed',
-            message: 'Failed to logout',
-        });
-    }
-});
+router.post('/logout', auth_middleware_1.authenticationMiddleware, auth_controller_1.logout);
 /**
  * Refresh session (token)
  * POST /auth/refresh
  */
-router.post('/refresh', auth_middleware_1.authenticationMiddleware, async (req, res) => {
-    try {
-        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
-        if (!session) {
-            res.status(401).json({
-                success: false,
-                error: 'Unauthorized',
-                message: 'No active session',
-            });
-            return;
-        }
-        // Validate token is still valid
-        const isValid = await (0, github_oauth_service_1.validateToken)(session.accessToken);
-        if (!isValid) {
-            res.status(401).json({
-                success: false,
-                error: 'Unauthorized',
-                message: 'Token is no longer valid with GitHub',
-            });
-            return;
-        }
-        // Create new session with updated expiry
-        const newSession = {
-            ...session,
-            expiresAt: Date.now() + 24 * 60 * 60 * 1000, // Extend 24 hours
-        };
-        const newToken = (0, auth_middleware_1.storeSession)(newSession);
-        // Invalidate old token
-        const oldToken = req.headers.authorization?.replace('Bearer ', '') ||
-            req.cookies?.['auth-token'];
-        if (oldToken) {
-            (0, auth_middleware_1.invalidateSession)(oldToken);
-        }
-        res.json({
-            success: true,
-            message: 'Session refreshed successfully',
-            sessionToken: newToken,
-            expiresAt: newSession.expiresAt,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Session refresh failed: ${error}`);
-        res.status(500).json({
-            success: false,
-            error: 'Refresh failed',
-            message: 'Failed to refresh session',
-        });
-    }
-});
+router.post('/refresh', auth_middleware_1.authenticationMiddleware, auth_controller_1.refresh);
 exports.default = router;

package/dist/routes/permission-routes.js

@@ -6,156 +6,21 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
 const auth_middleware_1 = require("../middleware/auth-middleware");
-const permission_service_1 = require("../services/permission-service");
-const logger_1 = require("../middleware/logger");
+const permission_controller_1 = require("../controllers/permission-controller");
 const router = (0, express_1.Router)();
 /**
  * Get user's permission for a specific repository
  * GET /permissions/:owner/:repo
  */
-router.get('/:owner/:repo', auth_middleware_1.authenticationMiddleware, async (req, res) => {
-    try {
-        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
-        if (!session) {
-            res.status(401).json({
-                error: 'Unauthorized',
-                message: 'No active session',
-            });
-            return;
-        }
-        const { owner, repo } = req.params;
-        const forceRefresh = req.query.refresh === 'true';
-        if (!owner || !repo) {
-            res.status(400).json({
-                error: 'Bad request',
-                message: 'Owner and repo parameters are required',
-            });
-            return;
-        }
-        logger_1.AppLogger.debug(`Checking permission for ${session.user.login} in ${owner}/${repo}`);
-        // Get permission from cache or GitHub API
-        const cachedPermission = await (0, permission_service_1.getUserRepositoryPermission)(session.accessToken, session.user.id, session.user.login, owner, repo, forceRefresh);
-        const response = {
-            permission: cachedPermission.permission,
-            role: cachedPermission.role,
-            canAdmin: cachedPermission.permission === 'admin',
-            canMaintain: (0, permission_service_1.canPerformAction)(cachedPermission.permission, 'maintain'),
-            canWrite: (0, permission_service_1.canPerformAction)(cachedPermission.permission, 'write'),
-            canRead: (0, permission_service_1.canPerformAction)(cachedPermission.permission, 'read'),
-            denied: cachedPermission.permission === 'none',
-        };
-        res.json({
-            success: true,
-            owner,
-            repo,
-            user: session.user.login,
-            ...response,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Failed to check permission: ${error}`);
-        res.status(500).json({
-            success: false,
-            error: 'Internal server error',
-            message: 'Failed to check repository permission',
-        });
-    }
-});
+router.get('/:owner/:repo', auth_middleware_1.authenticationMiddleware, permission_controller_1.getRepositoryPermission);
 /**
  * Check if user can perform a specific action
  * POST /permissions/:owner/:repo/can-action
  */
-router.post('/:owner/:repo/can-action', auth_middleware_1.authenticationMiddleware, async (req, res) => {
-    try {
-        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
-        if (!session) {
-            res.status(401).json({
-                error: 'Unauthorized',
-                message: 'No active session',
-            });
-            return;
-        }
-        const { owner, repo } = req.params;
-        const { action } = req.body;
-        if (!owner || !repo) {
-            res.status(400).json({
-                error: 'Bad request',
-                message: 'Owner and repo parameters are required',
-            });
-            return;
-        }
-        if (!action || !['read', 'write', 'maintain', 'admin'].includes(action)) {
-            res.status(400).json({
-                error: 'Bad request',
-                message: 'Valid action is required (read, write, maintain, or admin)',
-            });
-            return;
-        }
-        logger_1.AppLogger.debug(`Checking if ${session.user.login} can perform '${action}' in ${owner}/${repo}`);
-        // Get permission
-        const cachedPermission = await (0, permission_service_1.getUserRepositoryPermission)(session.accessToken, session.user.id, session.user.login, owner, repo);
-        // Check if user can perform action
-        const can = (0, permission_service_1.canPerformAction)(cachedPermission.permission, action);
-        res.json({
-            success: true,
-            owner,
-            repo,
-            user: session.user.login,
-            action,
-            can,
-            permission: cachedPermission.permission,
-            role: cachedPermission.role,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Failed to check action permission: ${error}`);
-        res.status(500).json({
-            success: false,
-            error: 'Internal server error',
-            message: 'Failed to check action permission',
-        });
-    }
-});
+router.post('/:owner/:repo/can-action', auth_middleware_1.authenticationMiddleware, permission_controller_1.checkActionPermission);
 /**
  * Invalidate permission cache for a repository
  * POST /permissions/:owner/:repo/invalidate
  */
-router.post('/:owner/:repo/invalidate', auth_middleware_1.authenticationMiddleware, (req, res) => {
-    try {
-        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
-        if (!session) {
-            res.status(401).json({
-                error: 'Unauthorized',
-                message: 'No active session',
-            });
-            return;
-        }
-        const { owner, repo } = req.params;
-        if (!owner || !repo) {
-            res.status(400).json({
-                error: 'Bad request',
-                message: 'Owner and repo parameters are required',
-            });
-            return;
-        }
-        logger_1.AppLogger.debug(`Invalidating permission cache for ${session.user.login} in ${owner}/${repo}`);
-        // Invalidate cache
-        (0, permission_service_1.invalidatePermissionCache)(session.user.id, owner, repo);
-        res.json({
-            success: true,
-            message: 'Permission cache invalidated',
-            owner,
-            repo,
-            user: session.user.login,
-        });
-    }
-    catch (error) {
-        logger_1.AppLogger.error(`Failed to invalidate cache: ${error}`);
-        res.status(500).json({
-            success: false,
-            error: 'Internal server error',
-            message: 'Failed to invalidate permission cache',
-        });
-    }
-});
+router.post('/:owner/:repo/invalidate', auth_middleware_1.authenticationMiddleware, permission_controller_1.invalidateCache);
 exports.default = router;

package/dist/services/auth-service.js

@@ -0,0 +1,239 @@
+"use strict";
+/**
+ * Authentication Service
+ * Handles all authentication business logic including OAuth flow, session management
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initiateLogin = initiateLogin;
+exports.handleOAuthCallback = handleOAuthCallback;
+exports.getCurrentSession = getCurrentSession;
+exports.validateCurrentSession = validateCurrentSession;
+exports.logoutUser = logoutUser;
+exports.refreshUserSession = refreshUserSession;
+const github_oauth_service_1 = require("./github-oauth-service");
+const auth_middleware_1 = require("../middleware/auth-middleware");
+const permission_service_1 = require("./permission-service");
+const logger_1 = require("../middleware/logger");
+const utilities_1 = require("../utils/utilities");
+// State store for CSRF protection
+const stateStore = new Map();
+const STATE_EXPIRY = 10 * 60 * 1000; // 10 minutes
+/**
+ * Generate random state for CSRF protection
+ */
+function generateState() {
+    return Math.random().toString(36).substring(2, 15) +
+        Math.random().toString(36).substring(2, 15);
+}
+/**
+ * Validate OAuth state
+ */
+function validateState(state) {
+    const entry = stateStore.get(state);
+    if (!entry) {
+        return false;
+    }
+    // Check if state has expired
+    if (Date.now() - entry.createdAt > STATE_EXPIRY) {
+        stateStore.delete(state);
+        return false;
+    }
+    return true;
+}
+/**
+ * Get redirect URL from state
+ */
+function getRedirectUrl(state) {
+    const entry = stateStore.get(state);
+    return entry?.redirectUrl;
+}
+/**
+ * Clear state after use
+ */
+function clearState(state) {
+    stateStore.delete(state);
+}
+/**
+ * Initiate login by generating authorization URL
+ * @param redirectUrl - Where to redirect after login
+ * @returns Login URL response with state
+ */
+function initiateLogin(redirectUrl = '/') {
+    if (!process.env.GITHUB_CLIENT_ID) {
+        throw new Error('GitHub client ID not configured');
+    }
+    const state = generateState();
+    // Store state for validation
+    stateStore.set(state, {
+        createdAt: Date.now(),
+        redirectUrl,
+    });
+    const authUrl = (0, github_oauth_service_1.generateAuthorizationUrl)(process.env.GITHUB_CLIENT_ID, process.env.OAUTH_REDIRECT_URI, state);
+    return {
+        authUrl,
+        state,
+    };
+}
+/**
+ * Handle OAuth callback and create session
+ * @param code - OAuth authorization code
+ * @param state - CSRF protection state
+ * @returns OAuth callback response with session token
+ */
+async function handleOAuthCallback(code, state) {
+    // Validate code and state
+    if (!code || !state) {
+        throw new Error('OAuth code and state are required');
+    }
+    // Validate state for CSRF protection
+    if (!validateState(state)) {
+        throw new Error('Invalid or expired state - CSRF validation failed');
+    }
+    if (!process.env.GITHUB_CLIENT_SECRET) {
+        throw new Error('GitHub client secret not configured');
+    }
+    // Exchange code for access token
+    logger_1.AppLogger.debug('Exchanging OAuth code for access token');
+    const tokenResponse = await (0, github_oauth_service_1.exchangeCodeForToken)(code, process.env.GITHUB_CLIENT_ID, process.env.GITHUB_CLIENT_SECRET, process.env.OAUTH_REDIRECT_URI);
+    // Get user information
+    logger_1.AppLogger.debug('Retrieving authenticated user information');
+    const user = await (0, github_oauth_service_1.getAuthenticatedUser)(tokenResponse.access_token);
+    // Fetch user's repository permission
+    let permission = null;
+    try {
+        logger_1.AppLogger.debug(`Fetching repository permission for user ${user.login}`);
+        // Extract repository info from git remote
+        const repoInfo = await (0, utilities_1.getRepositoryInfoFromGit)();
+        if (!repoInfo) {
+            logger_1.AppLogger.warn('Could not extract repository info from git remote - permission fetch skipped');
+        }
+        else {
+            const { owner, repo } = repoInfo;
+            permission = await (0, permission_service_1.getUserRepositoryPermission)(tokenResponse.access_token, user.id, user.login, owner, repo);
+            logger_1.AppLogger.info(`User ${user.login} has ${permission.permission} permission on ${owner}/${repo}`);
+        }
+    }
+    catch (permError) {
+        logger_1.AppLogger.error(`Failed to fetch repository permission: ${permError}`);
+        // Continue without permission - will be checked on protected routes
+        permission = null;
+    }
+    // Create session with permission
+    const session = {
+        accessToken: tokenResponse.access_token,
+        expiresIn: 3600, // 1 hour default
+        expiresAt: Date.now() + 24 * 60 * 60 * 1000, // 24 hours
+        user,
+        scopes: tokenResponse.scope.split(','),
+        permission, // Include fetched permission in session
+    };
+    // Store session and get token
+    const sessionToken = (0, auth_middleware_1.storeSession)(session);
+    // Get redirect URL
+    const redirectUrl = getRedirectUrl(state) || '/';
+    // Clear state
+    clearState(state);
+    logger_1.AppLogger.info(`User authenticated: ${user.login} with permission: ${permission?.permission || 'unknown'}`);
+    return {
+        sessionToken,
+        redirectUrl,
+        user: {
+            id: user.id,
+            login: user.login,
+            name: user.name,
+            avatar_url: user.avatar_url,
+        },
+        permission: permission ? {
+            level: permission.permission,
+            role: permission.role,
+            owner: permission.owner,
+            repo: permission.repo,
+        } : null,
+    };
+}
+/**
+ * Get current user session from request
+ * @param req - Express request
+ * @returns Session response
+ */
+function getCurrentSession(req) {
+    const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+    if (!session) {
+        throw new Error('No active session');
+    }
+    return {
+        user: session.user,
+        scopes: session.scopes,
+        expiresAt: session.expiresAt,
+        permission: session.permission || null,
+    };
+}
+/**
+ * Validate current session with GitHub
+ * @param req - Express request
+ * @returns Validation response
+ */
+async function validateCurrentSession(req) {
+    const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+    if (!session) {
+        throw new Error('No active session');
+    }
+    // Validate token with GitHub
+    const isValid = await (0, github_oauth_service_1.validateToken)(session.accessToken);
+    if (!isValid) {
+        // Token is no longer valid, invalidate session
+        const token = req.headers.authorization?.replace('Bearer ', '') ||
+            req.cookies?.['auth-token'];
+        if (token) {
+            (0, auth_middleware_1.invalidateSession)(token);
+        }
+        throw new Error('Session token is no longer valid');
+    }
+    return {
+        valid: true,
+        expiresAt: session.expiresAt,
+    };
+}
+/**
+ * Logout user by invalidating session
+ * @param req - Express request
+ */
+function logoutUser(req) {
+    const token = req.headers.authorization?.replace('Bearer ', '') ||
+        req.cookies?.['auth-token'];
+    if (token) {
+        (0, auth_middleware_1.invalidateSession)(token);
+    }
+}
+/**
+ * Refresh session token
+ * @param req - Express request
+ * @returns New session token and expiry
+ */
+async function refreshUserSession(req) {
+    const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+    if (!session) {
+        throw new Error('No active session');
+    }
+    // Validate token is still valid
+    const isValid = await (0, github_oauth_service_1.validateToken)(session.accessToken);
+    if (!isValid) {
+        throw new Error('Token is no longer valid with GitHub');
+    }
+    // Create new session with updated expiry
+    const newSession = {
+        ...session,
+        expiresAt: Date.now() + 24 * 60 * 60 * 1000, // Extend 24 hours
+    };
+    const newToken = (0, auth_middleware_1.storeSession)(newSession);
+    // Invalidate old token
+    const oldToken = req.headers.authorization?.replace('Bearer ', '') ||
+        req.cookies?.['auth-token'];
+    if (oldToken) {
+        (0, auth_middleware_1.invalidateSession)(oldToken);
+    }
+    return {
+        sessionToken: newToken,
+        expiresAt: newSession.expiresAt,
+    };
+}

package/dist/services/permission-service.js

@@ -11,6 +11,8 @@ exports.invalidateUserCache = invalidateUserCache;
 exports.clearAllCache = clearAllCache;
 exports.getCacheStats = getCacheStats;
 exports.canPerformAction = canPerformAction;
+exports.checkRepositoryPermission = checkRepositoryPermission;
+exports.checkUserAction = checkUserAction;
 const github_oauth_service_1 = require("./github-oauth-service");
 const logger_1 = require("../middleware/logger");
 // Cache storage: key = `${userId}:${owner}/${repo}`
@@ -172,3 +174,31 @@ function canPerformAction(permission, requiredAction) {
     const allowedPermissions = actionPermissionMap[requiredAction] || [];
     return allowedPermissions.includes(permission);
 }
+/**
+ * Get user's permission for a specific repository with response formatting
+ */
+async function checkRepositoryPermission(accessToken, userId, username, owner, repo, forceRefresh = false) {
+    const cachedPermission = await getUserRepositoryPermission(accessToken, userId, username, owner, repo, forceRefresh);
+    return {
+        permission: cachedPermission.permission,
+        role: cachedPermission.role,
+        canAdmin: cachedPermission.permission === 'admin',
+        canMaintain: canPerformAction(cachedPermission.permission, 'maintain'),
+        canWrite: canPerformAction(cachedPermission.permission, 'write'),
+        canRead: canPerformAction(cachedPermission.permission, 'read'),
+        denied: cachedPermission.permission === 'none',
+    };
+}
+/**
+ * Check if user can perform a specific action with response formatting
+ */
+async function checkUserAction(accessToken, userId, username, owner, repo, action) {
+    const cachedPermission = await getUserRepositoryPermission(accessToken, userId, username, owner, repo);
+    const can = canPerformAction(cachedPermission.permission, action);
+    return {
+        action,
+        can,
+        permission: cachedPermission.permission,
+        role: cachedPermission.role,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manojkmfsi/monodog",
-  "version": "1.1.30",
+  "version": "1.1.31",
   "description": "App for monodog monorepo",
   "license": "MIT",
   "author": "Mindfiredigital",