@rebasepro/server-core 0.0.1-canary.4d4fb3e → 0.0.1-canary.ca2cb6e

package/src/auth/facebook-oauth.ts

@@ -0,0 +1,72 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a Facebook / Meta OAuth Provider integration.
+ *
+ * Uses the authorization code flow to exchange a code for an access token,
+ * then fetches user profile from the Facebook Graph API.
+ */
+export function createFacebookProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "facebook",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenUrl = new URL("https://graph.facebook.com/v19.0/oauth/access_token");
+                tokenUrl.searchParams.set("client_id", config.clientId);
+                tokenUrl.searchParams.set("client_secret", config.clientSecret);
+                tokenUrl.searchParams.set("redirect_uri", payload.redirectUri);
+                tokenUrl.searchParams.set("code", payload.code);
+
+                const tokenResponse = await fetch(tokenUrl.toString());
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get Facebook access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+                const accessToken = tokenData.access_token;
+
+                // Fetch user profile with email and profile picture
+                const profileUrl = new URL("https://graph.facebook.com/v19.0/me");
+                profileUrl.searchParams.set("fields", "id,name,email,picture.type(large)");
+                profileUrl.searchParams.set("access_token", accessToken);
+
+                const profileResponse = await fetch(profileUrl.toString());
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get Facebook user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    id: string;
+                    name?: string;
+                    email?: string;
+                    picture?: { data?: { url?: string } };
+                };
+
+                if (!profileData.email) {
+                    console.error("Facebook user has no email (email permission may not have been granted)");
+                    return null;
+                }
+
+                return {
+                    providerId: profileData.id,
+                    email: profileData.email,
+                    displayName: profileData.name || null,
+                    photoUrl: profileData.picture?.data?.url || null
+                };
+            } catch (error) {
+                console.error("Facebook OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/github-oauth.ts

@@ -0,0 +1,110 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a GitHub OAuth Provider integration.
+ *
+ * Flow: Frontend receives an authorization `code` via the GitHub OAuth redirect.
+ * This provider exchanges the code for an access token, then fetches the user's
+ * profile and primary email from the GitHub API.
+ */
+export function createGitHubProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "github",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        "Accept": "application/json"
+                    },
+                    body: JSON.stringify({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get GitHub access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token?: string; error?: string };
+                if (tokenData.error || !tokenData.access_token) {
+                    console.error("GitHub token exchange error:", tokenData.error);
+                    return null;
+                }
+
+                const accessToken = tokenData.access_token;
+
+                // Fetch user profile
+                const profileResponse = await fetch("https://api.github.com/user", {
+                    headers: {
+                        "Authorization": `Bearer ${accessToken}`,
+                        "Accept": "application/vnd.github+json",
+                        "User-Agent": "Rebase-Auth"
+                    }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get GitHub user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    id: number;
+                    login: string;
+                    name?: string | null;
+                    avatar_url?: string | null;
+                    email?: string | null;
+                };
+
+                // GitHub may not return email in profile if it's private.
+                // Fetch from /user/emails endpoint instead.
+                let email = profileData.email;
+                if (!email) {
+                    const emailsResponse = await fetch("https://api.github.com/user/emails", {
+                        headers: {
+                            "Authorization": `Bearer ${accessToken}`,
+                            "Accept": "application/vnd.github+json",
+                            "User-Agent": "Rebase-Auth"
+                        }
+                    });
+
+                    if (emailsResponse.ok) {
+                        const emails = await emailsResponse.json() as Array<{
+                            email: string;
+                            primary: boolean;
+                            verified: boolean;
+                        }>;
+                        const primary = emails.find(e => e.primary && e.verified) || emails.find(e => e.verified);
+                        email = primary?.email || null;
+                    }
+                }
+
+                if (!email) {
+                    console.error("GitHub user has no verified email");
+                    return null;
+                }
+
+                return {
+                    providerId: String(profileData.id),
+                    email,
+                    displayName: profileData.name || profileData.login || null,
+                    photoUrl: profileData.avatar_url || null
+                };
+            } catch (error) {
+                console.error("GitHub OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/gitlab-oauth.ts

@@ -0,0 +1,70 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+/**
+ * Creates a GitLab OAuth Provider integration.
+ * Works with both GitLab.com and self-hosted instances.
+ */
+export function createGitLabProvider(config: {
+    clientId: string;
+    clientSecret: string;
+    baseUrl?: string;
+}): OAuthProvider<{ code: string; redirectUri: string }> {
+    const gitlabUrl = (config.baseUrl || "https://gitlab.com").replace(/\/$/, "");
+
+    return {
+        id: "gitlab",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const tokenResponse = await fetch(`${gitlabUrl}/oauth/token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret,
+                        code: payload.code,
+                        grant_type: "authorization_code",
+                        redirect_uri: payload.redirectUri
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    console.error("Failed to get GitLab access token:", await tokenResponse.text());
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string };
+
+                const profileResponse = await fetch(`${gitlabUrl}/api/v4/user`, {
+                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
+                });
+
+                if (!profileResponse.ok) {
+                    console.error("Failed to get GitLab user info:", await profileResponse.text());
+                    return null;
+                }
+
+                const p = await profileResponse.json() as {
+                    id: number; username: string; name?: string;
+                    email: string; avatar_url?: string | null;
+                };
+
+                if (!p.email) { console.error("GitLab user has no email"); return null; }
+
+                return {
+                    providerId: String(p.id),
+                    email: p.email,
+                    displayName: p.name || p.username || null,
+                    photoUrl: p.avatar_url || null
+                };
+            } catch (error) {
+                console.error("GitLab OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}

package/src/auth/google-oauth.ts

@@ -1,4 +1,6 @@
 import { OAuth2Client } from "google-auth-library/build/src/index.js";
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
 
 export interface GoogleUserInfo {
     googleId: string;
@@ -8,53 +10,39 @@ export interface GoogleUserInfo {
     emailVerified: boolean;
 }
 
-let googleClient: OAuth2Client | null = null;
-let configuredClientId: string | null = null;
-
-/**
- * Configure Google OAuth - call this during initialization
- */
-export function configureGoogleOAuth(clientId: string): void {
-    configuredClientId = clientId;
-    googleClient = new OAuth2Client(clientId);
-}
-
 /**
- * Verify a Google ID token and extract user information
- * @param idToken The ID token from Google Sign-In on the frontend
+ * Creates a Google OAuth Provider integration
  */
-export async function verifyGoogleIdToken(idToken: string): Promise<GoogleUserInfo | null> {
-    if (!googleClient || !configuredClientId) {
-        throw new Error("Google OAuth not configured. Call configureGoogleOAuth() first.");
-    }
-
-    try {
-        const ticket = await googleClient.verifyIdToken({
-            idToken,
-            audience: configuredClientId
-        });
-
-        const payload = ticket.getPayload();
-        if (!payload) {
-            return null;
+export function createGoogleProvider(clientId: string): OAuthProvider<{ idToken: string }> {
+    const googleClient = new OAuth2Client(clientId);
+
+    return {
+        id: "google",
+        schema: z.object({
+            idToken: z.string().min(1, "ID token is required")
+        }),
+        verify: async (payload: { idToken: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                const ticket = await googleClient.verifyIdToken({
+                    idToken: payload.idToken,
+                    audience: clientId
+                });
+
+                const content = ticket.getPayload();
+                if (!content) {
+                    return null;
+                }
+
+                return {
+                    providerId: content.sub,
+                    email: content.email || "",
+                    displayName: content.name || null,
+                    photoUrl: content.picture || null
+                };
+            } catch (error) {
+                console.error("Failed to verify Google ID token:", error);
+                return null;
+            }
         }
-
-        return {
-            googleId: payload.sub,
-            email: payload.email || "",
-            displayName: payload.name || null,
-            photoUrl: payload.picture || null,
-            emailVerified: payload.email_verified || false
-        };
-    } catch (error) {
-        console.error("Failed to verify Google ID token:", error);
-        return null;
-    }
-}
-
-/**
- * Check if Google OAuth is configured
- */
-export function isGoogleOAuthConfigured(): boolean {
-    return googleClient !== null && configuredClientId !== null;
+    };
 }

package/src/auth/index.ts

@@ -1,12 +1,25 @@
 // Auth module exports
+export * from "./interfaces";
+
 export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry } from "./jwt";
 export type { JwtConfig, AccessTokenPayload } from "./jwt";
 
 export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
 export type { PasswordValidationResult } from "./password";
 
-export { configureGoogleOAuth, verifyGoogleIdToken, isGoogleOAuthConfigured } from "./google-oauth";
-export type { GoogleUserInfo } from "./google-oauth";
+// OAuth Providers
+export { createGoogleProvider } from "./google-oauth";
+export { createLinkedinProvider } from "./linkedin-oauth";
+export { createGitHubProvider } from "./github-oauth";
+export { createMicrosoftProvider } from "./microsoft-oauth";
+export { createAppleProvider } from "./apple-oauth";
+export { createFacebookProvider } from "./facebook-oauth";
+export { createTwitterProvider } from "./twitter-oauth";
+export { createDiscordProvider } from "./discord-oauth";
+export { createGitLabProvider } from "./gitlab-oauth";
+export { createBitbucketProvider } from "./bitbucket-oauth";
+export { createSlackProvider } from "./slack-oauth";
+export { createSpotifyProvider } from "./spotify-oauth";
 
 export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware } from "./middleware";
 export type { AuthMiddlewareOptions, AuthResult } from "./middleware";

package/src/auth/interfaces.ts

@@ -1,6 +1,8 @@
+import { z } from "zod";
+
 /**
  * Authentication Abstraction Interfaces
- * 
+ *
  * These interfaces define the contracts for authentication-related operations.
  * Implementations can use different databases (PostgreSQL, MongoDB, etc.) to
  * store user, role, and token data.
@@ -15,8 +17,6 @@ export interface UserData {
     passwordHash?: string | null;
     displayName?: string | null;
     photoUrl?: string | null;
-    provider: string;
-    googleId?: string | null;
     emailVerified: boolean;
     emailVerificationToken?: string | null;
     emailVerificationSentAt?: Date | null;
@@ -32,11 +32,46 @@ export interface CreateUserData {
     passwordHash?: string;
     displayName?: string;
     photoUrl?: string;
-    provider?: string;
-    googleId?: string;
     emailVerified?: boolean;
 }
 
+/**
+ * User Identity Data (OAuth accounts linked to user)
+ */
+export interface UserIdentityData {
+    id: string;
+    userId: string;
+    provider: string;
+    providerId: string;
+    profileData?: Record<string, unknown> | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+
+/**
+ * Standardized profile data returned by an OAuth provider verification payload
+ */
+export interface OAuthProviderProfile {
+    providerId: string;
+    email: string;
+    displayName?: string | null;
+    photoUrl?: string | null;
+}
+
+/**
+ * Pluggable OAuth Provider integration strategy
+ */
+export interface OAuthProvider<T = unknown> {
+    /** The identifier of the provider (e.g. "github", "google") */
+    id: string;
+
+    /** Zod schema validating the expected request payload (e.g. { code: string }) */
+    schema: z.ZodSchema<T>;
+
+    /** Verify external tokens/codes and return a standardized user profile */
+    verify: (payload: T) => Promise<OAuthProviderProfile | null>;
+}
+
 /**
  * Role data structure
  */
@@ -110,6 +145,8 @@ export interface ListUsersOptions {
     orderBy?: string;
     /** Sort direction (default "desc") */
     orderDir?: "asc" | "desc";
+    /** Filter by role ID */
+    roleId?: string;
 }
 
 /**
@@ -144,9 +181,19 @@ export interface UserRepository {
     getUserByEmail(email: string): Promise<UserData | null>;
 
     /**
-     * Get a user by Google ID
+     * Get a user by an OAuth identity
+     */
+    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
+
+    /**
+     * Get all identities linked to a user
+     */
+    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
+
+    /**
+     * Link a new OAuth identity to a user
      */
-    getUserByGoogleId(googleId: string): Promise<UserData | null>;
+    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
 
     /**
      * Update a user

package/src/auth/jwt.ts

@@ -10,6 +10,7 @@ export interface JwtConfig {
 export interface AccessTokenPayload {
     userId: string;
     roles: string[];
+    uid?: string;
 }
 
 let jwtConfig: JwtConfig = {
@@ -30,10 +31,18 @@ export function configureJwt(config: JwtConfig): void {
         "jwt_secret",
         "your-secret",
         "your-super-secret-jwt-key-change-in-production",
+        "super-secret-jwt-key-change-in-production",
         "change-me",
         "changeme",
         "password",
-        "test"
+        "test",
+        "mysecret",
+        "my-secret",
+        "my_secret",
+        "example-secret",
+        "please-change-me",
+        "replace-this-with-a-real-secret",
+        "default-secret"
     ]);
 
     if (!config.secret || config.secret.length < 32) {
@@ -64,7 +73,8 @@ export function generateAccessToken(userId: string, roles: string[]): string {
         throw new Error("JWT secret not configured. Call configureJwt() first.");
     }
 
-    const payload: AccessTokenPayload = { userId, roles };
+    const payload: AccessTokenPayload = { userId,
+roles };
 
     return jwt.sign(payload, jwtConfig.secret, {
         expiresIn: jwtConfig.accessExpiresIn as jwt.SignOptions["expiresIn"],
@@ -112,12 +122,19 @@ export function verifyAccessToken(token: string): AccessTokenPayload | null {
     }
 
     try {
-        const decoded = jwt.verify(token, jwtConfig.secret, { algorithms: ["HS256"] }) as jwt.JwtPayload & AccessTokenPayload;
+        const decoded = jwt.verify(token, jwtConfig.secret, { algorithms: ["HS256"] }) as { userId?: string; uid?: string; sub?: string; roles?: string[] };
+        const id = decoded.userId || decoded.uid || decoded.sub;
+        if (!id) {
+            console.error("[JWT] Verification failed: missing id in payload", decoded);
+            return null;
+        }
+
         return {
-            userId: decoded.userId,
-            roles: decoded.roles
+            userId: id,
+            roles: decoded.roles || []
         };
     } catch (error) {
+        console.error("[JWT] Verification failed:", error, "Token start:", token.substring(0, 15));
         return null;
     }
 }

package/src/auth/linkedin-oauth.ts

@@ -0,0 +1,81 @@
+import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
+import { z } from "zod";
+
+export interface LinkedinUserInfo {
+    linkedinId: string;
+    email: string;
+    displayName: string | null;
+    photoUrl: string | null;
+    emailVerified: boolean;
+}
+
+/**
+ * Creates a LinkedIn OAuth Provider integration
+ */
+export function createLinkedinProvider(config: { clientId: string, clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
+    return {
+        id: "linkedin",
+        schema: z.object({
+            code: z.string().min(1, "Auth code is required"),
+            redirectUri: z.string().url("Valid redirect URI is required")
+        }),
+        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
+            try {
+                // Exchange code for access token
+                const tokenResponse = await fetch("https://www.linkedin.com/oauth/v2/accessToken", {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/x-www-form-urlencoded"
+                    },
+                    body: new URLSearchParams({
+                        grant_type: "authorization_code",
+                        code: payload.code,
+                        redirect_uri: payload.redirectUri,
+                        client_id: config.clientId,
+                        client_secret: config.clientSecret
+                    })
+                });
+
+                if (!tokenResponse.ok) {
+                    const errBody = await tokenResponse.text();
+                    console.error("Failed to get LinkedIn access token:", errBody);
+                    return null;
+                }
+
+                const tokenData = await tokenResponse.json() as { access_token: string; id_token?: string };
+                const accessToken = tokenData.access_token;
+
+                // Fetch User Info using OIDC userinfo endpoint
+                const profileResponse = await fetch("https://api.linkedin.com/v2/userinfo", {
+                    headers: {
+                        "Authorization": `Bearer ${accessToken}`
+                    }
+                });
+
+                if (!profileResponse.ok) {
+                    const errBody = await profileResponse.text();
+                    console.error("Failed to get LinkedIn user info:", errBody);
+                    return null;
+                }
+
+                const profileData = await profileResponse.json() as {
+                    sub: string;
+                    email: string;
+                    name?: string;
+                    picture?: string;
+                    email_verified?: boolean;
+                };
+
+                return {
+                    providerId: profileData.sub,
+                    email: profileData.email,
+                    displayName: profileData.name || null,
+                    photoUrl: profileData.picture || null
+                };
+            } catch (error) {
+                console.error("LinkedIn OAuth error:", error);
+                return null;
+            }
+        }
+    };
+}