@raclettejs/core 0.0.1

package/services/backend/src/domains/system/routes/route.user.login.ts

@@ -0,0 +1,243 @@
+import type { UserDoc } from "@/corePlugins/raclette__core/backend/datatypes/user/user.schema"
+import type { Static } from "@sinclair/typebox"
+import type { FastifyRequest, FastifyReply, FastifyInstance } from "fastify"
+import { Type } from "@sinclair/typebox"
+import { toPublicUser } from "@/corePlugins/raclette__core/backend/datatypes/user/user.schema"
+import { randomIdGenerator } from "@/helpers"
+import {
+  ForbiddenError,
+  NotFoundError,
+  UnauthorizedError,
+  UserError,
+} from "@/utils/errors"
+import { CACHE_CONFIG } from "@m/cache/providers/valkey/valkeyConfig"
+import { callDataTypeOperation } from "@c/contracting/contractRegistrar"
+
+const { LOGIN_ATTEMPTS, KEY_PREFIXES } = CACHE_CONFIG
+
+const LoginBodySchema = Type.Object({
+  email: Type.String(),
+  password: Type.String(),
+  deviceId: Type.Optional(Type.String()),
+})
+
+const ResponseSchema = Type.Object({
+  token: Type.String(),
+  decoded: Type.Any(),
+  user: Type.Any(),
+  requestId: Type.String(),
+})
+
+type LoginBody = Static<typeof LoginBodySchema>
+
+const randomId = randomIdGenerator(16)
+
+export default (fastify: FastifyInstance) => {
+  const trackLoginAttempt = async (key: string): Promise<void> => {
+    const attemptsKey = `${KEY_PREFIXES.LOGIN_ATTEMPTS}${key}`
+
+    const multi = fastify.cache.multi()
+
+    multi.incr(attemptsKey)
+    multi.expire(attemptsKey, LOGIN_ATTEMPTS.ATTEMPT_WINDOW)
+
+    const results = await multi.exec()
+    const attempts = results?.[0]?.[1] as number
+
+    if (attempts >= LOGIN_ATTEMPTS.MAX_ATTEMPTS) {
+      const lockKey = `${KEY_PREFIXES.LOGIN_LOCK}${key}`
+
+      await fastify.cache.setex(lockKey, LOGIN_ATTEMPTS.LOCKOUT_DURATION, "1")
+    }
+  }
+
+  const canAttemptLogin = async (key: string): Promise<boolean> => {
+    const lockKey = `${KEY_PREFIXES.LOGIN_LOCK}${key}`
+    const attemptsKey = `${KEY_PREFIXES.LOGIN_ATTEMPTS}${key}`
+
+    const [isLocked, attempts] = await Promise.all([
+      fastify.cache.exists(lockKey),
+      fastify.cache.get(attemptsKey),
+    ])
+
+    if (isLocked) {
+      fastify.log.info(`Login blocked for ${key}: Account is locked`)
+
+      return false
+    }
+
+    const attemptCount = attempts ? parseInt(attempts) : 0
+    const canAttempt = attemptCount < LOGIN_ATTEMPTS.MAX_ATTEMPTS
+
+    if (!canAttempt) {
+      fastify.log.info(
+        `Login blocked for ${key}: Too many attempts (${attemptCount})`,
+      )
+    }
+
+    return canAttempt
+  }
+
+  const resetLoginAttempts = async (key: string): Promise<void> => {
+    const lockKey = `${KEY_PREFIXES.LOGIN_LOCK}${key}`
+    const attemptsKey = `${KEY_PREFIXES.LOGIN_ATTEMPTS}${key}`
+
+    await Promise.all([
+      fastify.cache.del(attemptsKey),
+      fastify.cache.del(lockKey),
+    ])
+  }
+
+  const readUser = async (
+    email: string,
+    password: string,
+  ): Promise<UserDoc> => {
+    const user = await callDataTypeOperation(
+      "raclette__core",
+      "user",
+      "readByMail",
+      email,
+    )
+
+    if (!user) {
+      throw new NotFoundError("User not found")
+    }
+
+    if (user.blocked) {
+      throw new ForbiddenError("User is blocked")
+    }
+
+    if (!user.email_verified) {
+      throw new UnauthorizedError("Email not verified")
+    }
+
+    if (!user.active) {
+      throw new ForbiddenError("User account is inactive")
+    }
+
+    const isCorrectPassword = await user.checkPassword(password)
+
+    if (!isCorrectPassword) {
+      throw new UnauthorizedError("Invalid credentials")
+    }
+
+    return user
+  }
+
+  const checkDatabase = async () => {
+    const userCount = await callDataTypeOperation(
+      "raclette__core",
+      "user",
+      "readCount",
+    )
+
+    return userCount > 0
+  }
+
+  const handler = async (
+    request: FastifyRequest<{
+      Body: LoginBody
+    }>,
+    reply: FastifyReply,
+  ) => {
+    const { email, password, deviceId } = request.body
+    const clientKey = deviceId || request.ip || email.toLowerCase()
+
+    if (!(await checkDatabase())) {
+      // user database is empty
+      // this is a critical information for the frontend
+      const replyObj = {
+        statusCode: 500,
+        code: "RCLT_DB_NO_USERS",
+        error: "NoUsersInDatabase",
+        message: "No Users in Database",
+      }
+
+      return reply.code(replyObj.statusCode).send(replyObj)
+    }
+
+    try {
+      if (!(await canAttemptLogin(clientKey))) {
+        const remainingLockTime = await fastify.cache.ttl(
+          `${KEY_PREFIXES.LOGIN_LOCK}${clientKey}`,
+        )
+
+        return reply.code(429).send({
+          error: "Too many login attempts. Please try again later.",
+          lockTimeRemaining: remainingLockTime,
+        })
+      }
+
+      console.warn("TRACK LOGIN ATTEMPT")
+      await trackLoginAttempt(clientKey)
+
+      const user = await readUser(email, password)
+
+      // Reset login attempts on successful login
+      await resetLoginAttempts(clientKey)
+
+      // Create token with additional security measures
+      const tokenPayload = {
+        _id: user._id.split("|").pop(),
+        tokenId: randomId,
+        deviceId: deviceId || request.ip,
+        iat: Math.floor(Date.now() / 1000),
+      }
+
+      const token = fastify.jwt.sign(tokenPayload, {
+        expiresIn: "24h",
+      })
+      const decoded = fastify.jwt.decode(token)
+
+      fastify.log.info(`Successful login for user ${user._id}`)
+
+      return {
+        token,
+        decoded,
+        user: toPublicUser(user),
+        requestId: request.id,
+      }
+    } catch (error: any) {
+      fastify.log.error(`Login failed: ${error.message}`)
+
+      if (error instanceof UserError) {
+        return reply.code(error.statusCode).send({ error: error.message })
+      }
+
+      return reply.code(500).send({ error: "Authentication failed" })
+    }
+  }
+
+  return {
+    handler,
+    preValidation: (
+      request: FastifyRequest<{
+        Body: LoginBody
+      }>,
+      _reply: FastifyReply,
+      done: (error?: Error) => void,
+    ) => {
+      if (request.body?.email) {
+        request.body.email = request.body.email.toLowerCase().trim()
+      }
+      done()
+    },
+    schema: {
+      summary: "Authenticate user and receive access token",
+      description: `Secure login endpoint with rate limiting and brute force protection.
+        Implements Cache-based attempt tracking and temporary lockouts.
+        Max attempts: ${LOGIN_ATTEMPTS.MAX_ATTEMPTS}
+        Lockout duration: ${LOGIN_ATTEMPTS.LOCKOUT_DURATION} seconds
+        Attempt window: ${LOGIN_ATTEMPTS.ATTEMPT_WINDOW} seconds`,
+      tags: ["core/user"],
+      body: LoginBodySchema,
+      response: {
+        200: ResponseSchema,
+        429: Type.Object({
+          error: Type.String(),
+          lockTimeRemaining: Type.Number(),
+        }),
+      },
+    },
+  }
+}

package/services/backend/src/helpers/cors.ts

@@ -0,0 +1,28 @@
+export const getAllowedOrigins = (): (string | RegExp)[] => {
+  const origins: (string | RegExp)[] = []
+
+  // Development origins
+  if (process.env.NODE_ENV !== "production") {
+    origins.push("http://localhost:8081", "http://localhost:8083")
+  }
+
+  // Production/staging origins from environment
+  if (process.env.RACLETTE_FRONTEND_URL) {
+    origins.push(process.env.RACLETTE_FRONTEND_URL)
+  }
+
+  // Support multiple frontend URLs (comma-separated)
+  if (process.env.RACLETTE_FRONTEND_URLS) {
+    const urls = process.env.RACLETTE_FRONTEND_URLS.split(",").map((url) =>
+      url.trim(),
+    )
+    origins.push(...urls)
+  }
+
+  // Wildcard subdomain support for preview deployments (be careful with this)
+  if (process.env.RACLETTE_ALLOWED_DOMAIN_PATTERN) {
+    origins.push(new RegExp(process.env.RACLETTE_ALLOWED_DOMAIN_PATTERN))
+  }
+
+  return origins
+}

package/services/backend/src/helpers/index.ts

@@ -0,0 +1,19 @@
+import { customAlphabet } from "nanoid"
+export * from "./cors"
+
+const customCyperAlphabet =
+  "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+/**
+ * Random ID generator
+ *
+ * @param length - Required length for the output
+ * @returns Function that generates random IDs
+ * @example
+ * const generateId = randomIdGenerator(12);
+ * const id = generateId(); // => 'gdh6326GDJh0'
+ */
+const randomIdGenerator = (length = 16): (() => string) =>
+  customAlphabet(customCyperAlphabet, length)
+
+export { randomIdGenerator }

package/services/backend/src/index.ts

@@ -0,0 +1,3 @@
+export * from "./types"
+export * from "./utils"
+export * from "./core/contracting/contractRegistrar"

package/services/backend/src/modules/authentication/index.ts

@@ -0,0 +1,99 @@
+import type { FastifyRequest, FastifyReply, FastifyInstance } from "fastify"
+import jwt from "@fastify/jwt"
+import fastifyPlugin from "fastify-plugin"
+import type { User } from "@shared/types"
+import configService from "@c/config/configService"
+
+export const authenticate = async (
+  req: FastifyRequest,
+  res: FastifyReply,
+  fastify: FastifyInstance,
+) => {
+  {
+    const { requireAuthentication } = configService.getConfig()?.global ?? {
+      requireAuthentication: true,
+    }
+    const isAdminTagRequired = configService.isAdminTagRequired()
+    // Skip JWT verification and database queries, if global.requireAuthentication is configured to false
+    if (!requireAuthentication) {
+      const mockUser: Partial<User> = {
+        _id: "SYSTEM",
+      }
+
+      req.user = mockUser
+      return
+    }
+
+    try {
+      await req.jwtVerify()
+      // fetch current user data from the db
+      const { _id } = req.user
+      const adminTag = await fastify.database
+        .collection("raclette__core-tag")
+        .findOne({ title: "ADMIN", locked: true, type: "system" })
+      // IMPORTANT
+      // due to some very weird behaviour, mongoose always returns empty results
+      // so we are using mongodb directly until we fix this
+      let isAdmin = false
+      const user = await fastify.database
+        .collection("raclette__core-user")
+        .findOne(
+          { _id },
+          { projection: { password: 0, resetKey: 0 } }, // Exclude sensitive fields
+        )
+      if (user && user.tags && adminTag) {
+        user.tags.forEach((tag) => {
+          if (adminTag._id === tag) {
+            isAdmin = true
+          }
+        })
+      }
+      if (isAdminTagRequired && !isAdmin) {
+        fastify.log.error("User not allowed in workbench")
+        throw new Error("User not allowed in workbench")
+      }
+      if (isAdmin) {
+        user.isAdmin = true
+      }
+
+      if (!user) {
+        fastify.log.error("User not found")
+        throw new Error("User not found")
+      }
+
+      const account = await fastify.database
+        .collection("raclette__core-account")
+        .findOne({ _id: user.account })
+
+      user.account = account
+
+      req.user = user
+    } catch (error) {
+      return res.send(error)
+    }
+  }
+}
+
+export default fastifyPlugin(async (fastify: FastifyInstance, opts = {}) => {
+  // provide some sensible options
+  const defaults = {
+    secret: false,
+    decode: { complete: true },
+    sign: {
+      iss: "api.projectjournal.pacifico.info",
+      expiresIn: "30d",
+    },
+    verify: { allowedIss: "api.projectjournal.pacifico.info" },
+  }
+
+  // merge proved opts with defaults
+  const mergedOptions = { ...defaults, ...opts }
+
+  /* register the plugin */
+  fastify.register(jwt, mergedOptions)
+
+  // decorate the fastify instance, so we can call it anywhere
+  fastify.decorate("authenticate", (req, res) => {
+    return authenticate(req, res, fastify)
+  })
+})

package/services/backend/src/modules/cache/cacheManager.ts

@@ -0,0 +1,207 @@
+import type { CacheOptions, CacheService, CacheResult } from "@/types"
+import type { ValkeyService } from "@/modules/cache/providers/valkey/valkeyTypes"
+
+/**
+ * Creates a cache service with the given options
+ */
+export const createCacheService = (
+  cache: ValkeyService,
+  options: CacheOptions = {},
+): CacheService => {
+  const prefix = options.prefix ? `${options.prefix}:` : "cache:"
+  const defaultTtl = options.defaultTtl
+
+  const buildKey = (key: string): string => `${prefix}${key}`
+
+  const service: CacheService = {
+    cache: async <T>(
+      key: string,
+      data: T,
+      options: {
+        ttl?: number
+        serialize?: (data: T) => string
+        deserialize?: (data: string) => T
+      } = {},
+    ): Promise<CacheResult<T>> => {
+      const fullKey = buildKey(key)
+
+      // Default serialization/deserialization uses JSON
+      const serialize = options.serialize || JSON.stringify
+
+      const serializedNewData = serialize(data)
+
+      // Get previously cached data
+      const previousData = await cache.get(fullKey)
+
+      // Determine if data has changed
+      const hasChanged =
+        previousData === null || previousData !== serializedNewData
+
+      // Cache the new data if it changed or doesn't exist
+      if (hasChanged) {
+        const ttl = options.ttl ?? defaultTtl
+
+        if (ttl) {
+          await cache.setex(fullKey, ttl, serializedNewData)
+        } else {
+          await cache.set(fullKey, serializedNewData)
+        }
+      }
+
+      return {
+        changed: hasChanged,
+        data: data,
+      }
+    },
+
+    get: async <T>(
+      key: string,
+      deserialize: (data: string) => T = JSON.parse,
+    ): Promise<T | null> => {
+      const fullKey = buildKey(key)
+      const data = await cache.get(fullKey)
+
+      if (data === null) {
+        return null
+      }
+
+      return deserialize(data)
+    },
+
+    forceUpdate: async <T>(
+      key: string,
+      data: T,
+      options: { ttl?: number } = {},
+    ): Promise<T> => {
+      const fullKey = buildKey(key)
+      const serialized = JSON.stringify(data)
+
+      const ttl = options.ttl ?? defaultTtl
+
+      if (ttl) {
+        await cache.setex(fullKey, ttl, serialized)
+      } else {
+        await cache.set(fullKey, serialized)
+      }
+
+      return data
+    },
+
+    invalidate: async (key: string): Promise<void> => {
+      const fullKey = buildKey(key)
+      await cache.del(fullKey)
+    },
+
+    invalidatePattern: async (pattern: string): Promise<number> => {
+      const fullPattern = buildKey(pattern)
+      const keys = await cache.keys(fullPattern)
+
+      if (keys.length > 0) {
+        await cache.del(...keys)
+      }
+
+      return keys.length
+    },
+
+    // Get all keys matching a pattern (within this service's namespace)
+    getKeysByPattern: async (pattern: string): Promise<string[]> => {
+      const fullPattern = buildKey(pattern)
+      const keys = await cache.keys(fullPattern)
+
+      // Strip the prefix to return clean keys to the caller
+      return keys.map((key) => key.replace(prefix, ""))
+    },
+
+    // Get TTL for a specific key
+    getTtl: async (key: string): Promise<number> => {
+      const fullKey = buildKey(key)
+      return await cache.ttl(fullKey)
+    },
+
+    // Get multiple keys with their metadata
+    getKeysWithMetadata: async (
+      pattern: string,
+    ): Promise<
+      Array<{
+        key: string
+        ttl: number
+        exists: boolean
+      }>
+    > => {
+      const fullPattern = buildKey(pattern)
+      const keys = await cache.keys(fullPattern)
+
+      const metadata = await Promise.all(
+        keys.map(async (fullKey) => {
+          const cleanKey = fullKey.replace(prefix, "")
+          const ttl = await cache.ttl(fullKey)
+
+          return {
+            key: cleanKey,
+            ttl,
+            exists: true,
+          }
+        }),
+      )
+
+      return metadata
+    },
+
+    // Invalidate multiple specific keys atomically
+    invalidateMultiple: async (keys: string[]): Promise<number> => {
+      if (keys.length === 0) return 0
+
+      const fullKeys = keys.map((key) => buildKey(key))
+      await cache.del(...fullKeys)
+
+      return keys.length
+    },
+
+    // Check if a key exists
+    exists: async (key: string): Promise<boolean> => {
+      const fullKey = buildKey(key)
+      const result = await cache.exists(fullKey)
+      return result === 1
+    },
+
+    // Get key information (value + metadata)
+    getWithMetadata: async <T>(
+      key: string,
+      deserialize: (data: string) => T = JSON.parse,
+    ): Promise<{
+      value: T | null
+      ttl: number
+      exists: boolean
+    }> => {
+      const fullKey = buildKey(key)
+
+      const [value, ttl, exists] = await Promise.all([
+        cache.get(fullKey),
+        cache.ttl(fullKey),
+        cache.exists(fullKey),
+      ])
+
+      return {
+        value: value ? deserialize(value) : null,
+        ttl,
+        exists: exists === 1,
+      }
+    },
+
+    namespace: (
+      namespace: string,
+      namespaceOptions: CacheOptions = {},
+    ): CacheService => {
+      const newPrefix = namespaceOptions.prefix || `${prefix}${namespace}:`
+      const newOptions = {
+        ...options,
+        ...namespaceOptions,
+        prefix: newPrefix,
+      }
+
+      return createCacheService(cache, newOptions)
+    },
+  }
+
+  return service
+}