@omersx/bemms 0.0.0-stage → 0.1.0

package/src/lib/audit/index.ts

@@ -0,0 +1,103 @@
+import { db } from '@/lib/db';
+import { auditLogs } from '@/lib/db/schema';
+import { getLogger } from '@/lib/logger';
+
+const log = getLogger('audit');
+
+export interface AuditLogEntry {
+  actorUserId?: string | null;
+  actorId?: string | null;
+  organizationId?: string | null;
+  hospitalId?: string | null;
+  entityType: string;
+  entityId: string;
+  actionType?: any;
+  action?: any;
+  previousState?: unknown;
+  newState?: unknown;
+  details?: unknown;
+  changeReason?: string;
+  ipAddress?: string;
+  sessionId?: string;
+}
+
+const VALID_AUDIT_ACTIONS = new Set([
+  'CREATE', 'UPDATE', 'DEACTIVATE', 'ARCHIVE', 'TRANSFER', 'PURGE', 'SIGN', 'POLICY_CHANGE', 'LOGIN', 'LOGOUT', 'FAILED_LOGIN'
+]);
+
+function normalizeAuditAction(action?: string): string {
+  if (!action) return 'CREATE';
+  const upper = String(action).toUpperCase();
+  if (VALID_AUDIT_ACTIONS.has(upper)) return upper;
+  if (upper.includes('IMPORT') || upper.includes('INSERT') || upper.includes('INVITE') || upper.includes('ASSIGN')) return 'CREATE';
+  if (upper.includes('PURGE') || upper.includes('RESET') || upper.includes('CLEAR')) return 'PURGE';
+  if (upper.includes('DEACTIVATE') || upper.includes('DELETE') || upper.includes('REMOVE') || upper.includes('REVOKE')) return 'DEACTIVATE';
+  if (upper.includes('ARCHIVE')) return 'ARCHIVE';
+  if (upper.includes('TRANSFER')) return 'TRANSFER';
+  if (upper.includes('SIGN')) return 'SIGN';
+  return 'UPDATE';
+}
+
+/**
+ * Creates an audit log entry in the database.
+ * Never throws an error — fails gracefully and logs errors to prevent disrupting application flow.
+ */
+export async function createAuditLog(arg1: any, arg2?: any) {
+  let entry: AuditLogEntry;
+  let tx: any;
+
+  if (arg1 && typeof arg1 === 'object' && ('entityType' in arg1 || 'actionType' in arg1 || 'action' in arg1)) {
+    entry = arg1;
+    tx = arg2;
+  } else {
+    tx = arg1;
+    entry = arg2;
+  }
+
+  if (!entry) return;
+
+  const dbClient = tx || db;
+  const actionType = normalizeAuditAction(entry.actionType || entry.action) as any;
+  const actorUserId = entry.actorUserId || entry.actorId || null;
+  const newState = entry.newState !== undefined ? entry.newState : entry.details;
+
+  try {
+    const result = await dbClient.insert(auditLogs).values({
+      actorUserId,
+      organizationId: entry.organizationId || null,
+      hospitalId: entry.hospitalId || null,
+      entityType: entry.entityType,
+      entityId: entry.entityId,
+      actionType,
+      previousState: entry.previousState ? JSON.stringify(entry.previousState) : null,
+      newState: newState ? JSON.stringify(newState) : null,
+      changeReason: entry.changeReason || null,
+      ipAddress: entry.ipAddress || null,
+      sessionId: entry.sessionId || null,
+    });
+    log.debug('Audit log created', { entityType: entry.entityType, entityId: entry.entityId, action: actionType });
+    return result;
+  } catch (err) {
+    log.error('Failed to create audit log', err, { entityType: entry.entityType, entityId: entry.entityId });
+    // Don't throw — audit logging should never break the main flow
+  }
+}
+
+/**
+ * Creates an audit log entry, automatically extracting IP address from request headers if available.
+ */
+export async function createAuditLogFromRequest(entry: AuditLogEntry, request?: Request) {
+  let ipAddress = entry.ipAddress;
+  
+  if (request && !ipAddress) {
+    const forwardedFor = request.headers.get('x-forwarded-for');
+    if (forwardedFor) {
+      ipAddress = forwardedFor.split(',')[0].trim();
+    }
+  }
+  
+  return createAuditLog({
+    ...entry,
+    ipAddress,
+  });
+}

package/src/lib/auth/__tests__/rbac.test.ts

@@ -0,0 +1,33 @@
+import { describe, it, expect, vi } from 'vitest';
+
+vi.mock('@/lib/auth', () => ({
+  auth: vi.fn(),
+}));
+
+vi.mock('@/lib/db', () => ({
+  db: { query: {} },
+}));
+
+import { hasRole } from '../rbac';
+
+describe('hasRole', () => {
+  it('returns true when user has the specified role', () => {
+    const userRoles = ['BIOMED_ENG', 'STAFF'];
+    expect(hasRole(userRoles, 'BIOMED_ENG')).toBe(true);
+  });
+
+  it('returns true when user has at least one of multiple requested roles', () => {
+    const userRoles = ['BIOMED_TECH'];
+    expect(hasRole(userRoles, 'BIOMED_ENG', 'BIOMED_TECH', 'SYS_ADMIN')).toBe(true);
+  });
+
+  it('returns false when user does not have the specified role', () => {
+    const userRoles = ['STAFF'];
+    expect(hasRole(userRoles, 'SYS_ADMIN', 'ORG_ADMIN')).toBe(false);
+  });
+
+  it('returns false for empty user roles', () => {
+    expect(hasRole([], 'SYS_ADMIN')).toBe(false);
+  });
+});
+

package/src/lib/auth/index.ts

@@ -0,0 +1,338 @@
+import NextAuth from 'next-auth';
+import Credentials from 'next-auth/providers/credentials';
+import { DrizzleAdapter } from '@auth/drizzle-adapter';
+import { db } from '@/lib/db';
+import { users, accounts, sessions, userRoleAssignments, roles } from '@/lib/db/schema';
+import { verifyPassword } from '@/lib/auth/password';
+import { eq, and, or } from 'drizzle-orm';
+import { getLogger } from '@/lib/logger';
+import { createAuditLog } from '@/lib/audit';
+
+const log = getLogger('auth');
+
+// ---------------------------------------------------------------------------
+// In-memory rate limiter for login attempts (per identifier)
+// ---------------------------------------------------------------------------
+const LOGIN_MAX_ATTEMPTS = 5;           // max attempts before lockout
+const LOGIN_WINDOW_MS = 15 * 60 * 1000; // 15-minute sliding window
+
+interface RateLimitEntry {
+  attempts: number;
+  firstAttemptAt: number;
+  lockedUntil: number | null;
+}
+
+const loginAttempts = new Map<string, RateLimitEntry>();
+
+function checkRateLimit(identifier: string): { allowed: boolean; retryAfterMs?: number } {
+  const now = Date.now();
+  const entry = loginAttempts.get(identifier);
+
+  if (!entry) return { allowed: true };
+
+  // If currently locked out
+  if (entry.lockedUntil && now < entry.lockedUntil) {
+    return { allowed: false, retryAfterMs: entry.lockedUntil - now };
+  }
+
+  // If lock has expired, reset
+  if (entry.lockedUntil && now >= entry.lockedUntil) {
+    loginAttempts.delete(identifier);
+    return { allowed: true };
+  }
+
+  // If window has expired, reset
+  if (now - entry.firstAttemptAt > LOGIN_WINDOW_MS) {
+    loginAttempts.delete(identifier);
+    return { allowed: true };
+  }
+
+  if (entry.attempts >= LOGIN_MAX_ATTEMPTS) {
+    // Lock out for the remainder of the window
+    entry.lockedUntil = entry.firstAttemptAt + LOGIN_WINDOW_MS;
+    return { allowed: false, retryAfterMs: entry.lockedUntil - now };
+  }
+
+  return { allowed: true };
+}
+
+function recordFailedAttempt(identifier: string): void {
+  const now = Date.now();
+  const entry = loginAttempts.get(identifier);
+
+  if (!entry || now - entry.firstAttemptAt > LOGIN_WINDOW_MS) {
+    loginAttempts.set(identifier, { attempts: 1, firstAttemptAt: now, lockedUntil: null });
+    return;
+  }
+
+  entry.attempts += 1;
+
+  if (entry.attempts >= LOGIN_MAX_ATTEMPTS) {
+    entry.lockedUntil = entry.firstAttemptAt + LOGIN_WINDOW_MS;
+    log.warn('Account temporarily locked due to excessive failed login attempts', {
+      identifier,
+      attempts: entry.attempts,
+      lockedUntilMs: entry.lockedUntil,
+    });
+  }
+}
+
+function clearRateLimit(identifier: string): void {
+  loginAttempts.delete(identifier);
+}
+
+// Periodically clean up expired entries to prevent memory leak (every 30 min)
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of loginAttempts.entries()) {
+    if (now - entry.firstAttemptAt > LOGIN_WINDOW_MS) {
+      loginAttempts.delete(key);
+    }
+  }
+}, 30 * 60 * 1000).unref();
+
+// ---------------------------------------------------------------------------
+// Sanitize login identifier — escape SQL LIKE pattern characters
+// ---------------------------------------------------------------------------
+function sanitizeLikeIdentifier(input: string): string {
+  return input.replace(/[%_\\]/g, (ch) => `\\${ch}`);
+}
+
+// ---------------------------------------------------------------------------
+// NextAuth configuration
+// ---------------------------------------------------------------------------
+export const { handlers, signIn, signOut, auth } = NextAuth({
+  adapter: DrizzleAdapter(db, {
+    usersTable: users as any,
+    accountsTable: accounts as any,
+    sessionsTable: sessions as any,
+  }) as any,
+  session: {
+    strategy: 'jwt',
+    maxAge: 8 * 60 * 60, // 8 hours — one hospital shift
+  },
+  pages: { signIn: '/login' },
+  providers: [
+    Credentials({
+      credentials: {
+        email: { label: 'Username or Email', type: 'text' },
+        password: { label: 'Password', type: 'password' },
+      },
+      authorize: async (credentials) => {
+        if (!credentials?.email || !credentials?.password) {
+          return null;
+        }
+
+        const identifier = (credentials.email as string).trim();
+        const sanitized = sanitizeLikeIdentifier(identifier);
+
+        // Check rate limit before doing any work
+        const rateCheck = checkRateLimit(identifier.toLowerCase());
+        if (!rateCheck.allowed) {
+          log.warn('Login attempt blocked by rate limiter', {
+            identifier,
+            retryAfterMs: rateCheck.retryAfterMs,
+          });
+          return null;
+        }
+
+        let userResult;
+        try {
+          userResult = await db.query.users.findFirst({
+            where: or(
+              eq(users.email, sanitized),
+              eq(users.email, `${sanitized}@bemms.local`),
+              eq(users.employeeIdentifier, sanitized)
+            ),
+          });
+        } catch (dbError: any) {
+          log.error('Database connection error during login', dbError);
+          throw new Error('DATABASE_CONNECTION_ERROR');
+        }
+
+        if (!userResult || !userResult.passwordHash) {
+          log.warn('Failed login attempt', { identifier });
+          recordFailedAttempt(identifier.toLowerCase());
+          try {
+            await createAuditLog({
+              entityType: 'user_session',
+              entityId: identifier,
+              actionType: 'FAILED_LOGIN',
+              newState: {
+                attemptedIdentifier: identifier,
+                reason: 'user_not_found',
+                attemptedAt: new Date().toISOString(),
+              },
+            });
+          } catch (auditErr) {
+            log.error('Failed to create failed-login audit log', auditErr);
+          }
+          return null;
+        }
+
+        if (userResult.accountStatus !== 'active') {
+          log.warn('Failed login attempt', { identifier });
+          recordFailedAttempt(identifier.toLowerCase());
+          try {
+            await createAuditLog({
+              actorUserId: userResult.id,
+              organizationId: userResult.organizationId,
+              entityType: 'user_session',
+              entityId: userResult.id,
+              actionType: 'FAILED_LOGIN',
+              newState: {
+                attemptedIdentifier: identifier,
+                reason: 'account_inactive',
+                attemptedAt: new Date().toISOString(),
+              },
+            });
+          } catch (auditErr) {
+            log.error('Failed to create failed-login audit log', auditErr);
+          }
+          return null;
+        }
+
+        const isPasswordValid = await verifyPassword(
+          credentials.password as string,
+          userResult.passwordHash
+        );
+
+        if (!isPasswordValid) {
+          log.warn('Failed login attempt', { identifier });
+          recordFailedAttempt(identifier.toLowerCase());
+          try {
+            await createAuditLog({
+              actorUserId: userResult.id,
+              organizationId: userResult.organizationId,
+              entityType: 'user_session',
+              entityId: userResult.id,
+              actionType: 'FAILED_LOGIN',
+              newState: {
+                attemptedIdentifier: identifier,
+                reason: 'invalid_credentials',
+                attemptedAt: new Date().toISOString(),
+              },
+            });
+          } catch (auditErr) {
+            log.error('Failed to create failed-login audit log', auditErr);
+          }
+          return null;
+        }
+
+        // Successful login — clear rate limit counter
+        clearRateLimit(identifier.toLowerCase());
+
+        return {
+          id: userResult.id,
+          email: userResult.email,
+          fullName: userResult.fullName,
+          organizationId: userResult.organizationId,
+          accountStatus: userResult.accountStatus,
+          avatarUrl: userResult.avatarUrl,
+        };
+      },
+    }),
+  ],
+  events: {
+    async signIn({ user, account }) {
+      // Log successful login
+      log.info('User signed in', { userId: user.id, email: user.email });
+
+      // Create audit log entry for LOGIN
+      try {
+        await createAuditLog({
+          actorUserId: user.id,
+          organizationId: (user as any).organizationId || null,
+          entityType: 'user_session',
+          entityId: user.id || 'unknown',
+          actionType: 'LOGIN',
+          newState: {
+            email: user.email,
+            fullName: (user as any).fullName,
+            loginAt: new Date().toISOString(),
+            provider: account?.provider || 'credentials',
+          },
+        });
+      } catch (err) {
+        log.error('Failed to create login audit log', err);
+      }
+
+      // Update lastLoginAt on the user record
+      try {
+        await db
+          .update(users)
+          .set({ lastLoginAt: new Date() })
+          .where(eq(users.id, user.id as string));
+      } catch (err) {
+        log.error('Failed to update lastLoginAt', err);
+      }
+    },
+    async signOut({ token }: any) {
+      // Log sign out
+      const userId = (token as any)?.id || (token as any)?.sub;
+      log.info('User signed out', { userId });
+
+      try {
+        await createAuditLog({
+          actorUserId: userId || null,
+          entityType: 'user_session',
+          entityId: userId || 'unknown',
+          actionType: 'LOGOUT',
+          newState: {
+            logoutAt: new Date().toISOString(),
+          },
+        });
+      } catch (err) {
+        log.error('Failed to create logout audit log', err);
+      }
+    },
+  },
+  callbacks: {
+    async jwt({ token, user, trigger }) {
+      if (user) {
+        token.id = user.id;
+        token.fullName = (user as any).fullName;
+        token.organizationId = (user as any).organizationId;
+        token.avatarUrl = (user as any).avatarUrl;
+        token.rolesLoadedAt = Date.now();
+      }
+
+      // Refresh roles from DB with a TTL of 5 minutes to reduce DB queries
+      const ROLE_REFRESH_TTL_MS = 5 * 60 * 1000;
+      const rolesLoadedAt = (token.rolesLoadedAt as number) || 0;
+      const shouldRefreshRoles = trigger === 'signIn' || Date.now() - rolesLoadedAt > ROLE_REFRESH_TTL_MS;
+
+      const userId = (token.id as string) || (token.sub as string) || (user?.id as string);
+      if (userId && shouldRefreshRoles) {
+        try {
+          const assignments = await db
+            .select({ code: roles.code })
+            .from(userRoleAssignments)
+            .innerJoin(roles, eq(userRoleAssignments.roleId, roles.id))
+            .where(and(
+              eq(userRoleAssignments.userId, userId),
+              eq(userRoleAssignments.status, 'active')
+            ));
+
+          token.roles = assignments.map((a: any) => a.code);
+          token.rolesLoadedAt = Date.now();
+        } catch (e) {
+          log.error('Failed to load user roles in jwt callback', e);
+          if (!token.roles) token.roles = [];
+        }
+      }
+
+      return token;
+    },
+    async session({ session, token }) {
+      if (session.user && token) {
+        session.user.id = (token.id as string) || (token.sub as string);
+        session.user.fullName = token.fullName as string;
+        session.user.organizationId = token.organizationId as string;
+        session.user.avatarUrl = token.avatarUrl as string;
+        session.user.roles = (token.roles as string[]) || [];
+      }
+      return session;
+    },
+  },
+});

package/src/lib/auth/password.ts

@@ -0,0 +1,10 @@
+import bcrypt from 'bcryptjs';
+
+export async function hashPassword(password: string): Promise<string> {
+  return bcrypt.hash(password, 12);
+}
+
+export async function verifyPassword(password: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(password, hash);
+}
+

package/src/lib/auth/rbac.ts

@@ -0,0 +1,103 @@
+import { auth } from '@/lib/auth';
+import { db } from '@/lib/db';
+import { rolePermissions, permissions, userAccessScopes, userRoleAssignments, roles as rolesTable } from '@/lib/db/schema';
+import { eq, and, or } from 'drizzle-orm';
+import { RoleCode, SessionUser } from '@/lib/auth/types';
+
+export class AuthorizationError extends Error {
+  constructor(message: string = 'Unauthorized') {
+    super(message);
+    this.name = 'AuthorizationError';
+  }
+}
+
+export async function getCurrentUser(): Promise<SessionUser | null> {
+  const session = await auth();
+  return session?.user as SessionUser | null;
+}
+
+export async function requireAuth(): Promise<SessionUser> {
+  const user = await getCurrentUser();
+  if (!user) {
+    throw new AuthorizationError('Authentication required');
+  }
+  return user;
+}
+
+export function hasRole(userRoles: string[], ...roles: RoleCode[]): boolean {
+  return roles.some(role => userRoles.includes(role));
+}
+
+export async function requireRole(...roles: RoleCode[]): Promise<SessionUser> {
+  const user = await requireAuth();
+  if (!hasRole(user.roles, ...roles)) {
+    throw new AuthorizationError('Insufficient role permissions');
+  }
+  return user;
+}
+
+export async function requireScope(params: { organizationId?: string, hospitalId?: string, departmentId?: string, locationId?: string }): Promise<SessionUser> {
+  const user = await requireAuth();
+  
+  if (user.roles.includes('SYS_ADMIN')) {
+    return user;
+  }
+  
+  const scopes = await db.query.userAccessScopes.findMany({
+    where: eq(userAccessScopes.userId, user.id)
+  });
+  
+  const hasScope = scopes.some(scope => {
+    let match = true;
+    if (params.organizationId && scope.organizationId && scope.organizationId !== params.organizationId) match = false;
+    if (params.hospitalId && scope.hospitalId && scope.hospitalId !== params.hospitalId) match = false;
+    if (params.departmentId && scope.departmentId && scope.departmentId !== params.departmentId) match = false;
+    if (params.locationId && scope.locationId && scope.locationId !== params.locationId) match = false;
+    return match;
+  });
+
+  if (!hasScope) {
+    throw new AuthorizationError('Insufficient access scope');
+  }
+  
+  return user;
+}
+
+export async function requirePermission(module: string, action: string): Promise<SessionUser> {
+  const user = await requireAuth();
+  
+  if (user.roles.includes('SYS_ADMIN')) {
+    return user;
+  }
+
+  const userRoles = await db
+    .select({ roleId: userRoleAssignments.roleId })
+    .from(userRoleAssignments)
+    .where(eq(userRoleAssignments.userId, user.id));
+    
+  if (!userRoles.length) {
+    throw new AuthorizationError('No roles assigned');
+  }
+
+  const roleIds = userRoles.map(r => r.roleId);
+
+  const permCheck = await db
+    .select()
+    .from(rolePermissions)
+    .innerJoin(permissions, eq(rolePermissions.permissionId, permissions.id))
+    .where(
+      and(
+        or(...roleIds.map(id => eq(rolePermissions.roleId, id))),
+        eq(permissions.module, module as any),
+        eq(permissions.action, action as any)
+      )
+    )
+    .limit(1);
+
+  if (permCheck.length === 0) {
+    throw new AuthorizationError(`Missing permission: ${module}:${action}`);
+  }
+
+  return user;
+}
+

package/src/lib/auth/types.ts

@@ -0,0 +1,57 @@
+import { DefaultSession, User } from 'next-auth';
+
+declare module 'next-auth' {
+  interface Session {
+    user: {
+      id: string;
+      email: string;
+      fullName: string;
+      organizationId: string | null;
+      roles: string[];
+      avatarUrl: string | null;
+    } & DefaultSession["user"]
+  }
+  
+  interface User {
+    fullName: string;
+    organizationId: string | null;
+    accountStatus: string;
+    avatarUrl: string | null;
+  }
+}
+
+export type RoleCode = 
+  | 'SYS_ADMIN' 
+  | 'ORG_ADMIN' 
+  | 'HOSP_ADMIN' 
+  | 'BIOMED_MGR' 
+  | 'BIOMED_ENG' 
+  | 'BIOMED_TECH' 
+  | 'DEPT_MGR' 
+  | 'STAFF' 
+  | 'AUDITOR';
+
+export type PermissionModule = 
+  | 'USERS'
+  | 'ROLES'
+  | 'DEVICES'
+  | 'MAINTENANCE'
+  | 'WORK_ORDERS'
+  | 'SETTINGS';
+
+export type PermissionAction = 
+  | 'CREATE'
+  | 'READ'
+  | 'UPDATE'
+  | 'DELETE'
+  | 'APPROVE';
+
+export interface SessionUser {
+  id: string;
+  email: string;
+  fullName: string;
+  organizationId: string | null;
+  roles: string[];
+  avatarUrl: string | null;
+}
+

package/src/lib/constants/departments.ts

@@ -0,0 +1,16 @@
+export interface DefaultDepartmentTemplate {
+  name: string;
+  code: string;
+  departmentType: string;
+}
+
+export const DEFAULT_HOSPITAL_DEPARTMENTS: DefaultDepartmentTemplate[] = [
+  { name: 'Emergency Department', code: 'EMERG', departmentType: 'Emergency' },
+  { name: 'Intensive Care Unit (ICU)', code: 'ICU', departmentType: 'Intensive Care' },
+  { name: 'Surgery & Operating Theatre', code: 'SURG', departmentType: 'Surgical' },
+  { name: 'Clinical Laboratory', code: 'LAB', departmentType: 'Laboratory' },
+  { name: 'Radiology & Medical Imaging', code: 'RAD', departmentType: 'Diagnostic & Imaging' },
+  { name: 'Pediatrics', code: 'PED', departmentType: 'Pediatrics' },
+  { name: 'Dental Clinic', code: 'DENT', departmentType: 'Dental' },
+];
+