@nabhiraj/nab-auth 0.0.0-stage → 0.1.0

package/src/authenticationLogic/repositories/userRepository.js

@@ -0,0 +1,281 @@
+import { randomUUID } from "node:crypto";
+import argon2 from "argon2";
+import { MongoClient } from "mongodb";
+
+export function createUserRepository({ mongo, defaultAdmin, passwordHash }) {
+  let client;
+  let usersCollection;
+  let potentialUsersCollection;
+
+  function requireUsersCollection() {
+    if (!usersCollection) {
+      throw new Error("Database connection has not been initialized");
+    }
+  }
+
+  function requirePotentialUsersCollection() {
+    if (!potentialUsersCollection) {
+      throw new Error("Database connection has not been initialized");
+    }
+  }
+
+  async function findUserByEmail(email) {
+    requireUsersCollection();
+    return usersCollection.findOne({ email: normalizeEmail(email) });
+  }
+
+  async function findUserByUserId(userId) {
+    requireUsersCollection();
+    return usersCollection.findOne({ user_id: userId });
+  }
+
+  async function insertUser(email, passwordHashValue) {
+    requireUsersCollection();
+    const userId = randomUUID();
+
+    await usersCollection.insertOne({
+      user_id: userId,
+      email: normalizeEmail(email),
+      passwordHash: passwordHashValue,
+      nab_role: [],
+      createdAt: new Date()
+    });
+
+    return userId;
+  }
+
+  async function ensureDefaultAdminUser() {
+    if (!defaultAdmin.enabled) {
+      return;
+    }
+
+    const existingAdmin = await findUserByEmail(defaultAdmin.email);
+
+    if (existingAdmin) {
+      return;
+    }
+
+    const passwordHashValue = await argon2.hash(defaultAdmin.password, {
+      type: argon2.argon2id,
+      ...passwordHash
+    });
+
+    try {
+      const userId = randomUUID();
+      await usersCollection.insertOne({
+        user_id: userId,
+        email: normalizeEmail(defaultAdmin.email),
+        passwordHash: passwordHashValue,
+        nab_role: defaultAdmin.roles,
+        createdAt: new Date()
+      });
+    } catch (error) {
+      if (error.code !== 11000) {
+        throw error;
+      }
+    }
+  }
+
+  return {
+    async connectToDatabase() {
+      if (usersCollection) {
+        return usersCollection;
+      }
+
+      if (typeof mongo.uri !== "string" || !mongo.uri) {
+        throw new Error("mongo.uri must be configured before connecting");
+      }
+
+      client = new MongoClient(mongo.uri);
+      await client.connect();
+
+      const database = client.db(mongo.databaseName);
+      await ensureCollection(database, mongo.usersCollectionName);
+      await ensureCollection(database, mongo.potentialUsersCollectionName);
+
+      usersCollection = database.collection(mongo.usersCollectionName);
+      potentialUsersCollection = database.collection(
+        mongo.potentialUsersCollectionName
+      );
+
+      await addMissingUserIds(usersCollection);
+      await addMissingUserRoles(usersCollection);
+      await usersCollection.createIndex({ email: 1 }, { unique: true });
+      await usersCollection.createIndex({ user_id: 1 }, { unique: true });
+      await potentialUsersCollection.createIndex({ email: 1 }, { unique: true });
+      await potentialUsersCollection.createIndex(
+        { expiresAt: 1 },
+        { expireAfterSeconds: 0 }
+      );
+      await ensureDefaultAdminUser();
+
+      return usersCollection;
+    },
+
+    async closeDatabase() {
+      usersCollection = undefined;
+      potentialUsersCollection = undefined;
+
+      if (client) {
+        await client.close();
+        client = undefined;
+      }
+    },
+
+    findUserByEmail,
+    findUserByUserId,
+    insertUser,
+
+    async upsertPotentialUser(
+      email,
+      verificationCodeHash,
+      codeGeneratedAt,
+      codeExpiresAt
+    ) {
+      requirePotentialUsersCollection();
+
+      if (await findUserByEmail(email)) {
+        return false;
+      }
+
+      await potentialUsersCollection.updateOne(
+        { email: normalizeEmail(email) },
+        {
+          $set: {
+            verificationCodeHash,
+            codeGeneratedAt,
+            codeExpiresAt,
+            expiresAt: codeExpiresAt,
+            updatedAt: new Date()
+          },
+          $setOnInsert: { createdAt: new Date() }
+        },
+        { upsert: true }
+      );
+
+      return true;
+    },
+
+    async findPotentialUserByEmail(email) {
+      requirePotentialUsersCollection();
+      return potentialUsersCollection.findOne({ email: normalizeEmail(email) });
+    },
+
+    async deletePotentialUserByEmail(email) {
+      requirePotentialUsersCollection();
+      await potentialUsersCollection.deleteOne({ email: normalizeEmail(email) });
+    },
+
+    async updateUserPassword(userId, passwordHashValue) {
+      requireUsersCollection();
+      const result = await usersCollection.updateOne(
+        { user_id: userId },
+        { $set: { passwordHash: passwordHashValue, updatedAt: new Date() } }
+      );
+      return result.matchedCount > 0;
+    },
+
+    async updateUserTwoFactorCode(
+      userId,
+      twoFactorCodeHash,
+      twoFactorCodeGeneratedAt,
+      twoFactorCodeExpiresAt
+    ) {
+      requireUsersCollection();
+      const result = await usersCollection.updateOne(
+        { user_id: userId },
+        {
+          $set: {
+            twoFactorCodeHash,
+            twoFactorCodeGeneratedAt,
+            twoFactorCodeExpiresAt,
+            updatedAt: new Date()
+          }
+        }
+      );
+      return result.matchedCount > 0;
+    },
+
+    async consumeUserTwoFactorCode(userId, twoFactorCodeHash) {
+      requireUsersCollection();
+      const result = await usersCollection.updateOne(
+        { user_id: userId, twoFactorCodeHash },
+        {
+          $unset: {
+            twoFactorCodeHash: "",
+            twoFactorCodeGeneratedAt: "",
+            twoFactorCodeExpiresAt: ""
+          },
+          $set: { updatedAt: new Date() }
+        }
+      );
+      return result.modifiedCount > 0;
+    },
+
+    async addUserRoles(userId, roles) {
+      return updateUserRoles(usersCollection, userId, {
+        $addToSet: { nab_role: { $each: roles } }
+      });
+    },
+
+    async removeUserRole(userId, role) {
+      return updateUserRoles(usersCollection, userId, { $pull: { nab_role: role } });
+    },
+
+    async replaceUserRoles(userId, roles) {
+      return updateUserRoles(usersCollection, userId, { $set: { nab_role: roles } });
+    }
+  };
+}
+
+async function ensureCollection(database, collectionName) {
+  const collectionExists = await database
+    .listCollections({ name: collectionName }, { nameOnly: true })
+    .hasNext();
+
+  if (collectionExists) {
+    return;
+  }
+
+  try {
+    await database.createCollection(collectionName);
+  } catch (error) {
+    if (error.code !== 48) {
+      throw error;
+    }
+  }
+}
+
+async function addMissingUserIds(usersCollection) {
+  const filter = {
+    $or: [{ user_id: { $exists: false } }, { user_id: null }, { user_id: "" }]
+  };
+
+  for await (const user of usersCollection.find(filter)) {
+    await usersCollection.updateOne(
+      { _id: user._id, ...filter },
+      { $set: { user_id: randomUUID() } }
+    );
+  }
+}
+
+async function addMissingUserRoles(usersCollection) {
+  await usersCollection.updateMany(
+    { nab_role: { $exists: false } },
+    { $set: { nab_role: [] } }
+  );
+}
+
+async function updateUserRoles(usersCollection, userId, update) {
+  const result = await usersCollection.updateOne({ user_id: userId }, update);
+
+  if (result.matchedCount === 0) {
+    return null;
+  }
+
+  return usersCollection.findOne({ user_id: userId });
+}
+
+export function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}

package/src/authenticationLogic/routes/authRoutes.js

@@ -0,0 +1,40 @@
+import { Router } from "express";
+
+export function createAuthRouter({ controller, middleware, config }) {
+  const authRouter = Router();
+
+  const registrationMiddleware = config.authorization.userRegistrationRequiresNabAdmin
+    ? [middleware.requireJwt, middleware.requireNabAdmin]
+    : [];
+  const passwordChangeMiddleware = config.authorization.passwordChangeRequiresNabAdmin
+    ? [middleware.requireJwt, middleware.requireNabAdmin]
+    : [middleware.requireJwt];
+  const roleManagementMiddleware = [
+    middleware.requireJwt,
+    middleware.requireNabAdmin
+  ];
+
+  authRouter.post("/roles", ...roleManagementMiddleware, controller.addRoles);
+  authRouter.delete(
+    "/roles",
+    ...roleManagementMiddleware,
+    controller.removeRole
+  );
+  authRouter.put(
+    "/roles",
+    ...roleManagementMiddleware,
+    controller.replaceRoles
+  );
+  authRouter.patch(
+    "/password",
+    ...passwordChangeMiddleware,
+    controller.changePassword
+  );
+  authRouter.post("/potential-users", controller.createPotentialUser);
+  authRouter.post("/2fa/code", controller.generateTwoFactorCode);
+  authRouter.post("/register", ...registrationMiddleware, controller.registerUser);
+  authRouter.post("/token", controller.issueToken);
+  authRouter.post("/refresh", controller.refreshToken);
+
+  return authRouter;
+}

package/src/authenticationLogic/services/jwtKeyProvider.js

@@ -0,0 +1,108 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+
+export function createJwtKeyProvider(jwtConfig) {
+  return jwtConfig.keyProvider || createFileJwtKeyProvider(jwtConfig);
+}
+
+export function createFileJwtKeyProvider({ keys, keyCacheTtlMs }) {
+  let publicKeyCache;
+  let privateKeyCache;
+
+  async function loadPublicKeyCache() {
+    const publicKeyConfig = await readJsonFile(
+      keys.publicKeyPath,
+      "jwt.keys.publicKeyPath"
+    );
+
+    if (!Array.isArray(publicKeyConfig.keys)) {
+      throw new Error("Public JWT key file must contain a keys array");
+    }
+
+    const publicKeys = new Map();
+
+    for (const key of publicKeyConfig.keys) {
+      if (typeof key?.kid !== "string" || typeof key.publicKey !== "string") {
+        throw new Error(
+          "Each public JWT key must contain string fields: kid, publicKey"
+        );
+      }
+
+      if (publicKeys.has(key.kid)) {
+        throw new Error(`Duplicate public JWT key id: ${key.kid}`);
+      }
+
+      publicKeys.set(key.kid, key.publicKey);
+    }
+
+    publicKeyCache = {
+      expiresAt: Date.now() + keyCacheTtlMs,
+      publicKeys
+    };
+  }
+
+  async function ensurePublicKeyCache() {
+    if (!publicKeyCache || Date.now() >= publicKeyCache.expiresAt) {
+      await loadPublicKeyCache();
+    }
+  }
+
+  async function getPublicKey(keyId) {
+    await ensurePublicKeyCache();
+
+    const publicKey = publicKeyCache.publicKeys.get(keyId);
+
+    if (!publicKey) {
+      throw new Error(`Unknown JWT key id: ${keyId || "missing"}`);
+    }
+
+    return publicKey;
+  }
+
+  async function getActiveSigningKey() {
+      if (!privateKeyCache || Date.now() >= privateKeyCache.expiresAt) {
+        const privateKeyConfig = await readJsonFile(
+          keys.privateKeyPath,
+          "jwt.keys.privateKeyPath"
+        );
+
+        if (
+          typeof privateKeyConfig.kid !== "string" ||
+          typeof privateKeyConfig.privateKey !== "string"
+        ) {
+          throw new Error(
+            "Private JWT key file must contain string fields: kid, privateKey"
+          );
+        }
+
+        await getPublicKey(privateKeyConfig.kid);
+
+        privateKeyCache = {
+          expiresAt: Date.now() + keyCacheTtlMs,
+          keyId: privateKeyConfig.kid,
+          privateKey: privateKeyConfig.privateKey
+        };
+      }
+
+      return {
+        keyId: privateKeyCache.keyId,
+        privateKey: privateKeyCache.privateKey
+      };
+  }
+
+  return { getActiveSigningKey, getPublicKey };
+}
+
+async function readJsonFile(pathValue, keyName) {
+  if (typeof pathValue !== "string" || !pathValue) {
+    throw new Error(`${keyName} must be set`);
+  }
+
+  const keyPath = resolve(process.cwd(), pathValue);
+
+  try {
+    return JSON.parse(await readFile(keyPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Unable to read ${keyName} at ${keyPath}: ${error.message}`);
+  }
+}

package/src/authenticationLogic/services/tokenService.js

@@ -0,0 +1,86 @@
+import jwt from "jsonwebtoken";
+
+export function createTokenService({ jwt: jwtConfig, keyProvider }) {
+  function validatePayload(payload) {
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+      throw new TypeError("Token payload must be an object");
+    }
+  }
+
+  function signAccessToken(payload, subject, signingKey) {
+    return jwt.sign({ ...payload, tokenType: "access" }, signingKey.privateKey, {
+      subject,
+      issuer: jwtConfig.issuer,
+      audience: jwtConfig.audience,
+      expiresIn: jwtConfig.accessTokenTtl,
+      algorithm: jwtConfig.algorithm,
+      keyid: signingKey.keyId
+    });
+  }
+
+  function signRefreshToken(subject, signingKey) {
+    return jwt.sign({ tokenType: "refresh" }, signingKey.privateKey, {
+      subject,
+      issuer: jwtConfig.issuer,
+      audience: jwtConfig.audience,
+      expiresIn: jwtConfig.refreshTokenTtl,
+      algorithm: jwtConfig.algorithm,
+      keyid: signingKey.keyId
+    });
+  }
+
+  return {
+    async createAccessToken(payload, subject) {
+      validatePayload(payload);
+      return signAccessToken(payload, subject, await keyProvider.getActiveSigningKey());
+    },
+
+    async createRefreshToken(subject) {
+      return signRefreshToken(subject, await keyProvider.getActiveSigningKey());
+    },
+
+    async createTokenPair(payload, subject) {
+      validatePayload(payload);
+      const signingKey = await keyProvider.getActiveSigningKey();
+
+      return {
+        accessToken: signAccessToken(payload, subject, signingKey),
+        refreshToken: signRefreshToken(subject, signingKey)
+      };
+    },
+
+    async verifyRefreshToken(token) {
+      const decoded = jwt.decode(token, { complete: true });
+
+      if (
+        !decoded ||
+        typeof decoded !== "object" ||
+        typeof decoded.header?.kid !== "string" ||
+        decoded.header.alg !== jwtConfig.algorithm
+      ) {
+        throw new Error("Invalid refresh token header");
+      }
+
+      const payload = jwt.verify(
+        token,
+        await keyProvider.getPublicKey(decoded.header.kid),
+        {
+          algorithms: [jwtConfig.algorithm],
+          issuer: jwtConfig.issuer,
+          audience: jwtConfig.audience
+        }
+      );
+
+      if (
+        typeof payload !== "object" ||
+        payload === null ||
+        payload.tokenType !== "refresh" ||
+        typeof payload.sub !== "string"
+      ) {
+        throw new Error("Invalid refresh token");
+      }
+
+      return payload;
+    }
+  };
+}

package/src/authenticationLogic/services/verificationCodeService.js

@@ -0,0 +1,26 @@
+import { randomInt } from "node:crypto";
+import argon2 from "argon2";
+
+export function generateNumericVerificationCode(digits) {
+  if (!Number.isInteger(digits) || digits < 1 || digits > 9) {
+    throw new TypeError("Verification code digits must be an integer from 1 to 9");
+  }
+
+  const minimum = digits === 1 ? 0 : 10 ** (digits - 1);
+  const maximum = 10 ** digits;
+
+  return String(randomInt(minimum, maximum)).padStart(digits, "0");
+}
+
+export function hashVerificationCode(code) {
+  return argon2.hash(code, {
+    type: argon2.argon2id,
+    memoryCost: 19456,
+    timeCost: 2,
+    parallelism: 1
+  });
+}
+
+export function verifyVerificationCode(code, codeHash) {
+  return argon2.verify(codeHash, code);
+}