@nabhiraj/nab-auth 0.0.0-stage → 0.1.1

package/src/authenticationLogic/controllers/authController.js

@@ -0,0 +1,516 @@
+import argon2 from "argon2";
+import { parseCookie } from "cookie";
+import { normalizeEmail } from "../repositories/userRepository.js";
+import {
+  generateNumericVerificationCode,
+  hashVerificationCode,
+  verifyVerificationCode
+} from "../services/verificationCodeService.js";
+
+const dummyPasswordHash =
+  "$argon2id$v=19$m=19456,p=1,t=2$4q0Ld3WLtjFp/T4xsM65OA$6fForJ99UdqrscIWMKksrwr/rNpl/bZ3qZc8v/p1YlI";
+
+export function createAuthController({
+  config,
+  repository,
+  tokenService,
+  payloadFactory,
+  options = {}
+}) {
+  if (typeof payloadFactory !== "function") {
+    throw new TypeError("createAuthController expects a payload function");
+  }
+
+  const { sendRegistrationCode, sendTwoFactorCode } = options;
+  validateCallback(sendRegistrationCode, "sendRegistrationCode");
+  validateCallback(sendTwoFactorCode, "sendTwoFactorCode");
+
+  const findTargetUser = async (body) => {
+    const userId = body?.user_id;
+    const email = body?.email;
+
+    if (
+      (userId !== undefined && email !== undefined) ||
+      (userId === undefined && email === undefined)
+    ) {
+      return { error: "Provide exactly one of user_id or email" };
+    }
+
+    if (userId !== undefined) {
+      if (typeof userId !== "string" || !userId) {
+        return { error: "user_id must be a non-empty string" };
+      }
+
+      return { user: await repository.findUserByUserId(userId) };
+    }
+
+    if (typeof email !== "string" || !email.trim()) {
+      return { error: "email must be a non-empty string" };
+    }
+
+    return { user: await repository.findUserByEmail(normalizeEmail(email)) };
+  };
+
+  const normalizeRoles = (roles, allowEmpty = false) => {
+    if (!Array.isArray(roles) || (!allowEmpty && roles.length === 0)) {
+      return { error: "roles must be an array of strings" };
+    }
+
+    const normalizedRoles = roles.map((role) =>
+      typeof role === "string" ? role.trim() : role
+    );
+
+    if (normalizedRoles.some((role) => typeof role !== "string" || !role)) {
+      return { error: "roles must be an array of strings" };
+    }
+
+    return { roles: [...new Set(normalizedRoles)] };
+  };
+
+  const roleResponse = (user) => ({
+    user_id: user.user_id,
+    email: user.email,
+    nab_role: user.nab_role
+  });
+
+  async function createPotentialUser(req, res, next) {
+    try {
+      const email = req.body?.email;
+
+      if (typeof email !== "string" || !email.trim()) {
+        return res.status(400).json({ message: "email is required" });
+      }
+
+      const normalizedEmail = normalizeEmail(email);
+
+      if (await repository.findUserByEmail(normalizedEmail)) {
+        await repository.deletePotentialUserByEmail(normalizedEmail);
+        return res.status(409).json({ message: "User already exists" });
+      }
+
+      requireDeliveryCallback(
+        sendRegistrationCode,
+        "sendRegistrationCode",
+        config.codeDelivery
+      );
+
+      const verificationCode = generateNumericVerificationCode(
+        config.registration.codeDigits
+      );
+      const codeGeneratedAt = new Date();
+      const codeExpiresAt = new Date(
+        codeGeneratedAt.getTime() + config.registration.codeTtlMs
+      );
+      const verificationCodeHash = await hashVerificationCode(verificationCode);
+      const potentialUserCreated = await repository.upsertPotentialUser(
+        normalizedEmail,
+        verificationCodeHash,
+        codeGeneratedAt,
+        codeExpiresAt
+      );
+
+      if (!potentialUserCreated) {
+        return res.status(409).json({ message: "User already exists" });
+      }
+
+      if (sendRegistrationCode) {
+        await sendRegistrationCode({
+          email: normalizedEmail,
+          verificationCode,
+          codeGeneratedAt,
+          codeExpiresAt
+        });
+        return res.status(202).json({ message: "Verification code sent" });
+      }
+
+      return res.status(201).json({
+        email: normalizedEmail,
+        verificationCode,
+        expiresAt: codeExpiresAt
+      });
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function registerUser(req, res, next) {
+    try {
+      const email = req.body?.email;
+      const password = req.body?.password;
+
+      if (!isNonEmptyString(email) || !isNonEmptyString(password)) {
+        return res.status(400).json({ message: "email and password are required" });
+      }
+
+      const normalizedEmail = normalizeEmail(email);
+      if (await repository.findUserByEmail(normalizedEmail)) {
+        return res.status(409).json({ message: "User already exists" });
+      }
+
+      if (config.registration.verificationRequired) {
+        const verificationCode = req.body?.verificationCode;
+
+        if (!isNonEmptyString(verificationCode)) {
+          return res.status(400).json({ message: "verificationCode is required" });
+        }
+
+        const potentialUser = await repository.findPotentialUserByEmail(
+          normalizedEmail
+        );
+        const codeMatches = await codeMatchesRecord(
+          verificationCode,
+          potentialUser?.verificationCodeHash,
+          potentialUser?.codeExpiresAt
+        );
+
+        if (!codeMatches) {
+          return res.status(400).json({
+            message: "Invalid or expired verification code"
+          });
+        }
+      }
+
+      try {
+        const userId = await repository.insertUser(
+          normalizedEmail,
+          await hashPassword(password, config.passwordHash)
+        );
+
+        if (config.registration.verificationRequired) {
+          await repository.deletePotentialUserByEmail(normalizedEmail);
+        }
+
+        return res.status(201).json({ user_id: userId, email: normalizedEmail });
+      } catch (error) {
+        if (error.code === 11000) {
+          return res.status(409).json({ message: "User already exists" });
+        }
+        throw error;
+      }
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function generateTwoFactorCode(req, res, next) {
+    try {
+      if (!config.twoFactor.required) {
+        return res.status(400).json({ message: "Two-factor authentication is disabled" });
+      }
+
+      const user = await authenticatePrimaryCredentials(req.body);
+      if (!user) {
+        return res.status(401).json({ message: "Invalid email or password" });
+      }
+
+      requireDeliveryCallback(
+        sendTwoFactorCode,
+        "sendTwoFactorCode",
+        config.codeDelivery
+      );
+
+      const verificationCode = generateNumericVerificationCode(
+        config.twoFactor.codeDigits
+      );
+      const codeGeneratedAt = new Date();
+      const codeExpiresAt = new Date(
+        codeGeneratedAt.getTime() + config.twoFactor.codeTtlMs
+      );
+      await repository.updateUserTwoFactorCode(
+        user.user_id,
+        await hashVerificationCode(verificationCode),
+        codeGeneratedAt,
+        codeExpiresAt
+      );
+
+      if (sendTwoFactorCode) {
+        await sendTwoFactorCode({
+          email: user.email,
+          verificationCode,
+          codeGeneratedAt,
+          codeExpiresAt
+        });
+        return res.status(202).json({ message: "Two-factor code sent" });
+      }
+
+      return res.status(201).json({
+        email: user.email,
+        verificationCode,
+        expiresAt: codeExpiresAt
+      });
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function issueToken(req, res, next) {
+    try {
+      const user = await authenticatePrimaryCredentials(req.body);
+      if (!user) {
+        return res.status(401).json({ message: "Invalid email or password" });
+      }
+
+      if (config.twoFactor.required) {
+        const twoFactorCode = req.body?.twoFactorCode;
+        const codeMatches = await codeMatchesRecord(
+          twoFactorCode,
+          user.twoFactorCodeHash,
+          user.twoFactorCodeExpiresAt
+        );
+
+        if (!codeMatches) {
+          return res.status(401).json({
+            message: twoFactorCode
+              ? "Invalid or expired two-factor code"
+              : "Two-factor code is required"
+          });
+        }
+      }
+
+      const payload = await payloadFactory(user);
+      const tokens = await tokenService.createTokenPair(payload, user.user_id);
+
+      if (config.twoFactor.required) {
+        const codeConsumed = await repository.consumeUserTwoFactorCode(
+          user.user_id,
+          user.twoFactorCodeHash
+        );
+
+        if (!codeConsumed) {
+          return res.status(401).json({
+            message: "Invalid or already used two-factor code"
+          });
+        }
+      }
+
+      setRefreshCookie(res, tokens.refreshToken, config.refreshCookie);
+      return res.json({ accessToken: tokens.accessToken });
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function refreshToken(req, res, next) {
+    try {
+      const refreshTokenFromBody = req.body?.refresh_token;
+      const cookies = parseCookie(req.headers.cookie || "");
+      const refreshToken =
+        isNonEmptyString(refreshTokenFromBody)
+          ? refreshTokenFromBody
+          : cookies[config.refreshCookie.name];
+
+      if (!refreshToken) {
+        return res.status(401).json({ message: "Refresh token is required" });
+      }
+
+      let tokenPayload;
+      try {
+        tokenPayload = await tokenService.verifyRefreshToken(refreshToken);
+      } catch {
+        return res.status(401).json({ message: "Invalid or expired refresh token" });
+      }
+
+      const user = await repository.findUserByUserId(tokenPayload.sub);
+      if (!user) {
+        return res.status(401).json({ message: "Invalid or expired refresh token" });
+      }
+
+      const payload = await payloadFactory(user);
+      const tokens = await tokenService.createTokenPair(payload, user.user_id);
+      setRefreshCookie(res, tokens.refreshToken, config.refreshCookie);
+      return res.json({ accessToken: tokens.accessToken });
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function changePassword(req, res, next) {
+    try {
+      const newPassword = req.body?.newPassword;
+      const requestedUserId = req.body?.user_id;
+      const requestedEmail = req.body?.email;
+
+      if (
+        !isNonEmptyString(newPassword) ||
+        (requestedUserId !== undefined && !isNonEmptyString(requestedUserId)) ||
+        (requestedEmail !== undefined && !isNonEmptyString(requestedEmail)) ||
+        (requestedUserId !== undefined && requestedEmail !== undefined)
+      ) {
+        return res.status(400).json({
+          message: "newPassword is required; provide either user_id or email, not both"
+        });
+      }
+
+      const authenticatedUserId = req.auth?.sub;
+      if (!isNonEmptyString(authenticatedUserId)) {
+        return res.status(401).json({ message: "Invalid access token" });
+      }
+
+      const targetUser = requestedUserId
+        ? await repository.findUserByUserId(requestedUserId)
+        : requestedEmail
+          ? await repository.findUserByEmail(normalizeEmail(requestedEmail))
+          : await repository.findUserByUserId(authenticatedUserId);
+
+      if (!targetUser) {
+        return res.status(404).json({ message: "User not found" });
+      }
+
+      if (
+        targetUser.user_id !== authenticatedUserId &&
+        (!req.auth?.nab_role?.includes(config.authorization.adminRole) ||
+          !config.authorization.nabAdminCanChangeOtherUsersPasswords)
+      ) {
+        return res.status(403).json({
+          message: "Nab admin permission is required to change another user's password"
+        });
+      }
+
+      const userUpdated = await repository.updateUserPassword(
+        targetUser.user_id,
+        await hashPassword(newPassword, config.passwordHash)
+      );
+
+      return userUpdated
+        ? res.status(204).send()
+        : res.status(404).json({ message: "User not found" });
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function addRoles(req, res, next) {
+    try {
+      const normalized = normalizeRoles(req.body?.roles);
+      if (normalized.error) return res.status(400).json({ message: normalized.error });
+
+      const target = await findTargetUser(req.body);
+      if (target.error) return res.status(400).json({ message: target.error });
+      if (!target.user) return res.status(404).json({ message: "User not found" });
+
+      return res.json(
+        roleResponse(await repository.addUserRoles(target.user.user_id, normalized.roles))
+      );
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function removeRole(req, res, next) {
+    try {
+      const role = req.body?.role;
+      if (!isNonEmptyString(role)) {
+        return res.status(400).json({ message: "role must be a non-empty string" });
+      }
+
+      const target = await findTargetUser(req.body);
+      if (target.error) return res.status(400).json({ message: target.error });
+      if (!target.user) return res.status(404).json({ message: "User not found" });
+
+      return res.json(
+        roleResponse(await repository.removeUserRole(target.user.user_id, role.trim()))
+      );
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function replaceRoles(req, res, next) {
+    try {
+      const normalized = normalizeRoles(req.body?.roles, true);
+      if (normalized.error) return res.status(400).json({ message: normalized.error });
+
+      const target = await findTargetUser(req.body);
+      if (target.error) return res.status(400).json({ message: target.error });
+      if (!target.user) return res.status(404).json({ message: "User not found" });
+
+      return res.json(
+        roleResponse(
+          await repository.replaceUserRoles(target.user.user_id, normalized.roles)
+        )
+      );
+    } catch (error) {
+      next(error);
+    }
+  }
+
+  async function authenticatePrimaryCredentials(body) {
+    const email = body?.email;
+    const password = body?.password;
+
+    if (!isNonEmptyString(email) || !isNonEmptyString(password)) {
+      return null;
+    }
+
+    const user = await repository.findUserByEmail(normalizeEmail(email));
+    const passwordMatches = await argon2.verify(
+      user?.passwordHash || dummyPasswordHash,
+      password
+    );
+    return user && passwordMatches ? user : null;
+  }
+
+  return {
+    createPotentialUser,
+    registerUser,
+    generateTwoFactorCode,
+    issueToken,
+    refreshToken,
+    changePassword,
+    addRoles,
+    removeRole,
+    replaceRoles
+  };
+}
+
+async function codeMatchesRecord(code, codeHash, expiresAt) {
+  if (
+    !isNonEmptyString(code) ||
+    !isNonEmptyString(codeHash) ||
+    !(expiresAt instanceof Date) ||
+    expiresAt.getTime() <= Date.now()
+  ) {
+    return false;
+  }
+
+  try {
+    return await verifyVerificationCode(code, codeHash);
+  } catch {
+    return false;
+  }
+}
+
+function setRefreshCookie(res, refreshToken, cookieConfig) {
+  res.cookie(cookieConfig.name, refreshToken, {
+    httpOnly: cookieConfig.httpOnly,
+    secure: cookieConfig.secure,
+    sameSite: cookieConfig.sameSite,
+    path: cookieConfig.path,
+    maxAge: cookieConfig.maxAgeMs
+  });
+}
+
+async function hashPassword(password, passwordHashConfig) {
+  return argon2.hash(password, {
+    type: argon2.argon2id,
+    ...passwordHashConfig
+  });
+}
+
+function validateCallback(callback, name) {
+  if (callback !== undefined && typeof callback !== "function") {
+    throw new TypeError(`${name} must be a function`);
+  }
+}
+
+function requireDeliveryCallback(callback, name, codeDeliveryConfig) {
+  if (!callback && !codeDeliveryConfig.allowCodeInResponseWithoutSender) {
+    throw new Error(
+      `${name} must be configured when code responses are disabled`
+    );
+  }
+}
+
+function isNonEmptyString(value) {
+  return typeof value === "string" && !!value.trim();
+}

package/src/authenticationLogic/createAuthenticationLibrary.js

@@ -0,0 +1,43 @@
+import { createAuthConfig } from "./config/createAuthConfig.js";
+import { createAuthController } from "./controllers/authController.js";
+import { createJwtMiddleware } from "./middleware/jwtMiddleware.js";
+import { createUserRepository } from "./repositories/userRepository.js";
+import { createAuthRouter } from "./routes/authRoutes.js";
+import { createJwtKeyProvider } from "./services/jwtKeyProvider.js";
+import { createTokenService } from "./services/tokenService.js";
+
+export function createAuthenticationLibrary(configOverrides = {}) {
+  const config = createAuthConfig(configOverrides);
+  const keyProvider = createJwtKeyProvider(config.jwt);
+  const repository = createUserRepository({
+    mongo: config.mongo,
+    defaultAdmin: config.defaultAdmin,
+    passwordHash: config.passwordHash
+  });
+  const tokenService = createTokenService({ jwt: config.jwt, keyProvider });
+  const middleware = createJwtMiddleware({
+    jwt: config.jwt,
+    keyProvider,
+    authorization: config.authorization
+  });
+
+  return {
+    config,
+    connectToDatabase: repository.connectToDatabase,
+    closeDatabase: repository.closeDatabase,
+    requireJwt: middleware.requireJwt,
+    requireNabAdmin: middleware.requireNabAdmin,
+    jwtErrorHandler: middleware.jwtErrorHandler,
+    createAuthRouter(payloadFactory, options = {}) {
+      const controller = createAuthController({
+        config,
+        repository,
+        tokenService,
+        payloadFactory,
+        options
+      });
+
+      return createAuthRouter({ controller, middleware, config });
+    }
+  };
+}

package/src/authenticationLogic/index.js

@@ -0,0 +1,3 @@
+export { createAuthenticationLibrary } from "./createAuthenticationLibrary.js";
+export { defaultAuthConfig } from "./config/defaultAuthConfig.js";
+export { createFileJwtKeyProvider } from "./services/jwtKeyProvider.js";

package/src/authenticationLogic/middleware/jwtMiddleware.js

@@ -0,0 +1,35 @@
+import { expressjwt } from "express-jwt";
+
+export function createJwtMiddleware({ jwt: jwtConfig, keyProvider, authorization }) {
+  const requireJwt = expressjwt({
+    secret: async (req, token) => {
+      if (token?.header?.alg !== jwtConfig.algorithm) {
+        throw new Error("Invalid JWT algorithm");
+      }
+
+      return keyProvider.getPublicKey(token.header.kid);
+    },
+    algorithms: [jwtConfig.algorithm],
+    issuer: jwtConfig.issuer,
+    audience: jwtConfig.audience,
+    isRevoked: async (req, token) => token?.payload?.tokenType !== "access"
+  });
+
+  function requireNabAdmin(req, res, next) {
+    if (!req.auth?.nab_role?.includes(authorization.adminRole)) {
+      return res.status(403).json({ message: "Nab admin role is required" });
+    }
+
+    next();
+  }
+
+  function jwtErrorHandler(error, req, res, next) {
+    if (error.name === "UnauthorizedError") {
+      return res.status(401).json({ message: "Invalid or missing JWT" });
+    }
+
+    next(error);
+  }
+
+  return { requireJwt, requireNabAdmin, jwtErrorHandler };
+}