@rebasepro/server-core 0.0.1-canary.000dc36

package/src/auth/admin-routes.ts

@@ -0,0 +1,605 @@
+import { Hono } from "hono";
+import { ApiError, errorHandler } from "../api/errors";
+import type { AuthRepository } from "./interfaces";
+import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
+import { hashPassword, validatePasswordStrength } from "./password";
+import { AuthModuleConfig } from "./routes";
+import type { BackendHooks, AdminUser, AdminRole, BackendHookContext } from "@rebasepro/types";
+
+interface AdminRouteOptions extends AuthModuleConfig {
+    serviceKey?: string;
+    /**
+     * Callback to persistently mark bootstrap as completed.
+     * Invoked after the first admin user is promoted via POST /admin/bootstrap.
+     */
+    setBootstrapCompleted?: () => Promise<void>;
+    /**
+     * Backend-level hooks for intercepting admin data.
+     */
+    hooks?: BackendHooks;
+}
+import { HonoEnv } from "../api/types";
+import { randomBytes, createHash } from "crypto";
+import { getUserInvitationTemplate, getPasswordResetTemplate } from "../email/templates";
+
+/**
+ * Generate a cryptographically secure random password that meets strength requirements.
+ */
+function generateSecurePassword(): string {
+    const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+    const lower = "abcdefghjkmnpqrstuvwxyz";
+    const digits = "23456789";
+    const all = upper + lower + digits;
+
+    // Guarantee at least one of each required class
+    const pick = (chars: string) => chars[Math.floor(Math.random() * chars.length)];
+    const parts = [pick(upper), pick(lower), pick(digits)];
+
+    // Fill remaining with random chars (16 total)
+    for (let i = parts.length; i < 16; i++) {
+        parts.push(pick(all));
+    }
+
+    // Shuffle
+    for (let i = parts.length - 1; i > 0; i--) {
+        const j = Math.floor(Math.random() * (i + 1));
+        [parts[i], parts[j]] = [parts[j], parts[i]];
+    }
+    return parts.join("");
+}
+
+/**
+ * Generate a secure random token
+ */
+function generateSecureToken(): string {
+    return randomBytes(40).toString("hex");
+}
+
+/**
+ * Hash a token for database storage
+ */
+function hashToken(token: string): string {
+    return createHash("sha256").update(token).digest("hex");
+}
+
+/**
+ * Create admin routes for user and role management
+ */
+export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    const authRepo = config.authRepo;
+    const { emailService, emailConfig, hooks } = config;
+
+    /** Build a BackendHookContext from Hono's context object */
+    function buildHookContext(c: { get: (key: string) => unknown }, method: BackendHookContext["method"]): BackendHookContext {
+        const user = c.get("user") as { userId: string; roles?: string[] } | undefined;
+        return {
+            requestUser: user ? { userId: user.userId, roles: user.roles ?? [] } : undefined,
+            method
+        };
+    }
+
+    /** Apply users.afterRead hook to an AdminUser, returning null to filter out */
+    async function applyUserAfterRead(user: AdminUser, ctx: BackendHookContext): Promise<AdminUser | null> {
+        if (!hooks?.users?.afterRead) return user;
+        return hooks.users.afterRead(user, ctx);
+    }
+
+    /** Apply users.afterRead hook to an array and filter nulls */
+    async function applyUserAfterReadBatch(users: AdminUser[], ctx: BackendHookContext): Promise<AdminUser[]> {
+        if (!hooks?.users?.afterRead) return users;
+        const results = await Promise.all(users.map(u => applyUserAfterRead(u, ctx)));
+        return results.filter((u): u is AdminUser => u !== null);
+    }
+
+    /** Apply roles.afterRead hook to an array and filter nulls */
+    async function applyRoleAfterReadBatch(roles: AdminRole[], ctx: BackendHookContext): Promise<AdminRole[]> {
+        if (!hooks?.roles?.afterRead) return roles;
+        const results = await Promise.all(roles.map(r => hooks!.roles!.afterRead!(r, ctx)));
+        return results.filter((r): r is AdminRole => r !== null);
+    }
+
+    /** Convert a DB user record + role IDs into the AdminUser API shape */
+    function toAdminUser(u: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; createdAt?: Date | string; updatedAt?: Date | string }, roles: string[]): AdminUser {
+        return {
+            uid: u.id,
+            email: u.email,
+            displayName: u.displayName ?? null,
+            photoURL: u.photoUrl ?? null,
+            provider: "custom",
+            roles,
+            createdAt: u.createdAt instanceof Date ? u.createdAt.toISOString() : (u.createdAt ?? new Date().toISOString()),
+            updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : (u.updatedAt ?? new Date().toISOString())
+        };
+    }
+
+    // Attach Rebase error handler to ensure exceptions are correctly formatted
+    // instead of caught by Hono's default error handler from the sub-router.
+    router.onError(errorHandler);
+
+    // Apply auth middleware to all routes (service-key-aware when configured)
+    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
+
+    /**
+     * POST /admin/bootstrap
+     *
+     * One-time endpoint to promote the calling user to admin.
+     * Guarded by three layers:
+     *   1. Authentication (handled by middleware above)
+     *   2. Persistent `bootstrap_completed` flag (when `setBootstrapCompleted` is provided)
+     *   3. Database check — no existing admin users
+     *
+     * Once invoked successfully the persistent flag is set, permanently disabling
+     * this endpoint even if all admin users are later deleted.
+     */
+    router.post("/bootstrap", async (c) => {
+        const user = c.get("user");
+        if (!user || typeof user !== "object") {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        // ── Guard 1: persistent flag ──────────────────────────────────
+        if (config.isBootstrapCompleted) {
+            const alreadyDone = await config.isBootstrapCompleted();
+            if (alreadyDone) {
+                throw ApiError.forbidden("Bootstrap has already been completed.", "BOOTSTRAP_COMPLETED");
+            }
+        }
+
+        // ── Guard 2: no existing admin users ─────────────────────────
+        const users = await authRepo.listUsers();
+        let hasAdmin = false;
+
+        for (const u of users) {
+            const roles = await authRepo.getUserRoleIds(u.id);
+            if (roles.includes("admin")) {
+                hasAdmin = true;
+                break;
+            }
+        }
+
+        if (hasAdmin) {
+            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
+        }
+
+        // ── Promote caller ───────────────────────────────────────────
+        const userId = "userId" in user ? user.userId : undefined;
+        if (!userId) {
+            throw ApiError.unauthorized("User ID not found in auth context");
+        }
+        await authRepo.setUserRoles(userId, ["admin"]);
+
+        // ── Set persistent flag ──────────────────────────────────────
+        if (config.setBootstrapCompleted) {
+            await config.setBootstrapCompleted();
+        }
+
+        return c.json({
+            success: true,
+            message: "You are now an admin",
+            user: {
+                uid: userId,
+                roles: ["admin"]
+            }
+        });
+    });
+
+    router.get("/users", requireAdmin, async (c) => {
+        const limitParam = c.req.query("limit");
+        const offsetParam = c.req.query("offset");
+        const search = c.req.query("search");
+        const orderBy = c.req.query("orderBy");
+        const orderDir = c.req.query("orderDir") as "asc" | "desc" | undefined;
+        const hookCtx = buildHookContext(c, "GET");
+
+        // If pagination params are provided, use the paginated path
+        if (limitParam !== undefined || search) {
+            const limit = limitParam ? parseInt(limitParam, 10) : 25;
+            const offset = offsetParam ? parseInt(offsetParam, 10) : 0;
+
+            const result = await authRepo.listUsersPaginated({
+                limit,
+                offset,
+                search: search || undefined,
+                orderBy: orderBy || undefined,
+                orderDir: orderDir || undefined,
+                roleId: c.req.query("role") || undefined
+            });
+
+            let usersWithRoles: AdminUser[] = await Promise.all(
+                result.users.map(async (u) => {
+                    const roles = await authRepo.getUserRoleIds(u.id);
+                    return toAdminUser(u, roles);
+                })
+            );
+
+            usersWithRoles = await applyUserAfterReadBatch(usersWithRoles, hookCtx);
+
+            return c.json({
+                users: usersWithRoles,
+                total: result.total,
+                limit: result.limit,
+                offset: result.offset
+            });
+        }
+
+        // Legacy: return all users (no pagination)
+        const users = await authRepo.listUsers();
+        let usersWithRoles: AdminUser[] = await Promise.all(
+            users.map(async (u) => {
+                const roles = await authRepo.getUserRoleIds(u.id);
+                return toAdminUser(u, roles);
+            })
+        );
+
+        usersWithRoles = await applyUserAfterReadBatch(usersWithRoles, hookCtx);
+
+        return c.json({ users: usersWithRoles });
+    });
+
+    router.get("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const result = await authRepo.getUserWithRoles(userId);
+
+        if (!result) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const hookCtx = buildHookContext(c, "GET");
+        let adminUser: AdminUser | null = toAdminUser(result.user, result.roles.map(r => r.id));
+
+        adminUser = await applyUserAfterRead(adminUser, hookCtx);
+        if (!adminUser) {
+            throw ApiError.notFound("User not found");
+        }
+
+        return c.json({ user: adminUser });
+    });
+
+    router.post("/users", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        let { email, displayName, password, roles } = body;
+
+        if (!email) {
+            throw ApiError.badRequest("Email is required", "INVALID_INPUT");
+        }
+
+        // Apply beforeSave hook
+        const hookCtx = buildHookContext(c, "POST");
+        if (hooks?.users?.beforeSave) {
+            const hooked = await hooks.users.beforeSave({ email, displayName, roles }, hookCtx);
+            email = hooked.email ?? email;
+            displayName = hooked.displayName ?? displayName;
+            roles = hooked.roles ?? roles;
+        }
+
+        const existing = await authRepo.getUserByEmail(email);
+        if (existing) {
+            throw ApiError.conflict("Email already exists", "EMAIL_EXISTS");
+        }
+
+        // Use provided password or auto-generate one
+        const clearPassword = password || generateSecurePassword();
+
+        const validation = validatePasswordStrength(clearPassword);
+        if (!validation.valid) {
+            throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
+        }
+        const passwordHash = await hashPassword(clearPassword);
+
+        const user = await authRepo.createUser({
+            email: email.toLowerCase(),
+            displayName: displayName || null,
+            passwordHash
+        });
+
+        if (roles && Array.isArray(roles) && roles.length > 0) {
+            await authRepo.setUserRoles(user.id, roles);
+        } else if (config.defaultRole) {
+            await authRepo.assignDefaultRole(user.id, config.defaultRole);
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(user.id);
+
+        // Determine if we can send an invitation email
+        const isEmailConfigured = !!(emailService && emailService.isConfigured());
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        if (isEmailConfigured && !password) {
+            // Send invitation email via password-reset token flow
+            try {
+                const token = generateSecureToken();
+                const tokenHash = hashToken(token);
+                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                await authRepo.createPasswordResetToken(user.id, tokenHash, expiresAt);
+
+                const baseUrl = emailConfig?.resetPasswordUrl || "";
+                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                const appName = emailConfig?.appName || "Rebase";
+                const templateFn = emailConfig?.templates?.userInvitation;
+                const emailContent = templateFn
+                    ? templateFn(setPasswordUrl, { email: user.email,
+displayName: user.displayName })
+                    : getUserInvitationTemplate(setPasswordUrl, { email: user.email,
+displayName: user.displayName }, appName);
+
+                await emailService!.send({
+                    to: user.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+                invitationSent = true;
+            } catch (emailError: unknown) {
+                console.error("Failed to send invitation email:", emailError instanceof Error ? emailError.message : emailError);
+                // Fall back to returning the temporary password
+                temporaryPassword = clearPassword;
+            }
+        } else if (!password) {
+            // No email service — return the auto-generated password one-time
+            temporaryPassword = clearPassword;
+        }
+        // If admin provided a password explicitly, don't return it or send email
+
+        const createdAdminUser: AdminUser = toAdminUser(user, userRoles);
+
+        // Fire afterSave hook (fire-and-forget for side-effects)
+        if (hooks?.users?.afterSave) {
+            Promise.resolve(hooks.users.afterSave(createdAdminUser, hookCtx)).catch(err => {
+                console.error("[BackendHooks] users.afterSave error:", err instanceof Error ? err.message : err);
+            });
+        }
+
+        return c.json({
+            user: createdAdminUser,
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 201);
+    });
+
+    router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const isEmailConfigured = !!(emailService && emailService.isConfigured());
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        if (isEmailConfigured) {
+            try {
+                const token = generateSecureToken();
+                const tokenHash = hashToken(token);
+                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
+
+                const baseUrl = emailConfig?.resetPasswordUrl || "";
+                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                const appName = emailConfig?.appName || "Rebase";
+                const templateFn = emailConfig?.templates?.passwordReset;
+                const emailContent = templateFn
+                    ? templateFn(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName })
+                    : getPasswordResetTemplate(setPasswordUrl, { email: existing.email,
+displayName: existing.displayName }, appName);
+
+                await emailService!.send({
+                    to: existing.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+                invitationSent = true;
+            } catch (emailError: unknown) {
+                console.error("Failed to send reset email:", emailError instanceof Error ? emailError.message : emailError);
+                // Fall back to returning the temporary password
+                const clearPassword = generateSecurePassword();
+                const passwordHash = await hashPassword(clearPassword);
+                await authRepo.updatePassword(existing.id, passwordHash);
+                temporaryPassword = clearPassword;
+            }
+        } else {
+            // No email service — generate password, set it, and return one-time
+            const clearPassword = generateSecurePassword();
+            const passwordHash = await hashPassword(clearPassword);
+            await authRepo.updatePassword(existing.id, passwordHash);
+            temporaryPassword = clearPassword;
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(existing.id);
+
+        return c.json({
+            user: {
+                uid: existing.id,
+                email: existing.email,
+                displayName: existing.displayName,
+                roles: userRoles
+            },
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 200);
+    });
+
+    router.put("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const body = await c.req.json();
+        let { email, displayName, password, roles } = body;
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        // Apply beforeSave hook
+        const hookCtx = buildHookContext(c, "PUT");
+        if (hooks?.users?.beforeSave) {
+            const hooked = await hooks.users.beforeSave({ email, displayName, roles }, hookCtx);
+            email = hooked.email ?? email;
+            displayName = hooked.displayName ?? displayName;
+            roles = hooked.roles ?? roles;
+        }
+
+        const updates: Record<string, unknown> = {};
+        if (email !== undefined) updates.email = email.toLowerCase();
+        if (displayName !== undefined) updates.displayName = displayName;
+
+        if (password) {
+            const validation = validatePasswordStrength(password);
+            if (!validation.valid) {
+                throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
+            }
+            updates.passwordHash = await hashPassword(password);
+        }
+
+        if (Object.keys(updates).length > 0) {
+            await authRepo.updateUser(userId, updates);
+        }
+
+        if (roles !== undefined && Array.isArray(roles)) {
+            await authRepo.setUserRoles(userId, roles);
+        }
+
+        const result = await authRepo.getUserWithRoles(userId);
+
+        const updatedAdminUser: AdminUser = toAdminUser(result!.user, result!.roles.map(r => r.id));
+
+        // Fire afterSave hook (fire-and-forget)
+        if (hooks?.users?.afterSave) {
+            Promise.resolve(hooks.users.afterSave(updatedAdminUser, hookCtx)).catch(err => {
+                console.error("[BackendHooks] users.afterSave error:", err instanceof Error ? err.message : err);
+            });
+        }
+
+        return c.json({ user: updatedAdminUser });
+    });
+
+    router.delete("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const user = c.get("user");
+
+        const currentUserId = user && typeof user === "object" && "userId" in user ? user.userId : undefined;
+        if (currentUserId === userId) {
+            throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
+        }
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        // Apply beforeDelete hook (throw to abort)
+        const hookCtx = buildHookContext(c, "DELETE");
+        if (hooks?.users?.beforeDelete) {
+            await hooks.users.beforeDelete(userId, hookCtx);
+        }
+
+        await authRepo.deleteUser(userId);
+
+        // Fire afterDelete hook (fire-and-forget)
+        if (hooks?.users?.afterDelete) {
+            Promise.resolve(hooks.users.afterDelete(userId, hookCtx)).catch(err => {
+                console.error("[BackendHooks] users.afterDelete error:", err instanceof Error ? err.message : err);
+            });
+        }
+
+        return c.json({ success: true });
+    });
+
+    router.get("/roles", requireAdmin, async (c) => {
+        const roles = await authRepo.listRoles();
+        const hookCtx = buildHookContext(c, "GET");
+
+        let adminRoles: AdminRole[] = roles.map(r => ({
+            id: r.id,
+            name: r.name,
+            isAdmin: r.isAdmin,
+            defaultPermissions: r.defaultPermissions,
+            config: r.config
+        }));
+
+        adminRoles = await applyRoleAfterReadBatch(adminRoles, hookCtx);
+
+        return c.json({ roles: adminRoles });
+    });
+
+    router.get("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+        const role = await authRepo.getRoleById(roleId);
+
+        if (!role) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        return c.json({ role });
+    });
+
+    router.post("/roles", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        const { id, name, isAdmin, defaultPermissions, config } = body;
+
+        if (!id || !name) {
+            throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
+        }
+
+        const existing = await authRepo.getRoleById(id);
+        if (existing) {
+            throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
+        }
+
+        const role = await authRepo.createRole({
+            id,
+            name,
+            isAdmin: isAdmin ?? false,
+            defaultPermissions: defaultPermissions ?? null,
+            config: config ?? null
+        });
+
+        return c.json({ role }, 201);
+    });
+
+    router.put("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+        const body = await c.req.json();
+        const { name, isAdmin, defaultPermissions, config } = body;
+
+        const existing = await authRepo.getRoleById(roleId);
+        if (!existing) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        const role = await authRepo.updateRole(roleId, {
+            name,
+            isAdmin,
+            defaultPermissions,
+            config
+        });
+
+        return c.json({ role });
+    });
+
+    router.delete("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+
+        if (["admin", "editor", "viewer"].includes(roleId)) {
+            throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
+        }
+
+        const existing = await authRepo.getRoleById(roleId);
+        if (!existing) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        await authRepo.deleteRole(roleId);
+
+        return c.json({ success: true });
+    });
+
+    return router;
+}