@rebasepro/server-core 0.0.1-canary.4d4fb3e

package/src/auth/admin-routes.ts

@@ -0,0 +1,488 @@
+import { Hono } from "hono";
+import { ApiError } from "../api/errors";
+import type { AuthRepository } from "./interfaces";
+import { requireAuth, requireAdmin } from "./middleware";
+import { hashPassword, validatePasswordStrength } from "./password";
+import { AuthModuleConfig } from "./routes";
+import { HonoEnv } from "../api/types";
+import { randomBytes, createHash } from "crypto";
+import { getUserInvitationTemplate, getPasswordResetTemplate } from "../email/templates";
+
+/**
+ * Generate a cryptographically secure random password that meets strength requirements.
+ */
+function generateSecurePassword(): string {
+    const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+    const lower = "abcdefghjkmnpqrstuvwxyz";
+    const digits = "23456789";
+    const all = upper + lower + digits;
+
+    // Guarantee at least one of each required class
+    const pick = (chars: string) => chars[Math.floor(Math.random() * chars.length)];
+    const parts = [pick(upper), pick(lower), pick(digits)];
+
+    // Fill remaining with random chars (16 total)
+    for (let i = parts.length; i < 16; i++) {
+        parts.push(pick(all));
+    }
+
+    // Shuffle
+    for (let i = parts.length - 1; i > 0; i--) {
+        const j = Math.floor(Math.random() * (i + 1));
+        [parts[i], parts[j]] = [parts[j], parts[i]];
+    }
+    return parts.join("");
+}
+
+/**
+ * Generate a secure random token
+ */
+function generateSecureToken(): string {
+    return randomBytes(40).toString("hex");
+}
+
+/**
+ * Hash a token for database storage
+ */
+function hashToken(token: string): string {
+    return createHash("sha256").update(token).digest("hex");
+}
+
+/**
+ * Create admin routes for user and role management
+ */
+export function createAdminRoutes(config: AuthModuleConfig): Hono<HonoEnv> {
+    const router = new Hono<HonoEnv>();
+    const authRepo = config.authRepo;
+    const { emailService, emailConfig } = config;
+
+    // Apply auth middleware to all routes
+    router.use("/*", requireAuth);
+
+    router.post("/bootstrap", async (c) => {
+        const user = c.get("user");
+        if (!user || typeof user !== "object") {
+            throw ApiError.unauthorized("Not authenticated");
+        }
+
+        const users = await authRepo.listUsers();
+        let hasAdmin = false;
+
+        for (const u of users) {
+            const roles = await authRepo.getUserRoleIds(u.id);
+            if (roles.includes("admin")) {
+                hasAdmin = true;
+                break;
+            }
+        }
+
+        if (hasAdmin) {
+            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.");
+        }
+
+        const userId = "userId" in user ? user.userId : undefined;
+        if (!userId) {
+            throw ApiError.unauthorized("User ID not found in auth context");
+        }
+        await authRepo.setUserRoles(userId, ["admin"]);
+
+        return c.json({
+            success: true,
+            message: "You are now an admin",
+            user: {
+                uid: userId,
+                roles: ["admin"]
+            }
+        });
+    });
+
+    router.get("/users", requireAdmin, async (c) => {
+        const limitParam = c.req.query("limit");
+        const offsetParam = c.req.query("offset");
+        const search = c.req.query("search");
+        const orderBy = c.req.query("orderBy");
+        const orderDir = c.req.query("orderDir") as "asc" | "desc" | undefined;
+
+        // If pagination params are provided, use the paginated path
+        if (limitParam !== undefined || search) {
+            const limit = limitParam ? parseInt(limitParam, 10) : 25;
+            const offset = offsetParam ? parseInt(offsetParam, 10) : 0;
+
+            const result = await authRepo.listUsersPaginated({
+                limit,
+                offset,
+                search: search || undefined,
+                orderBy: orderBy || undefined,
+                orderDir: orderDir || undefined
+            });
+
+            const usersWithRoles = await Promise.all(
+                result.users.map(async (u) => {
+                    const roles = await authRepo.getUserRoleIds(u.id);
+                    return {
+                        uid: u.id,
+                        email: u.email,
+                        displayName: u.displayName,
+                        photoURL: u.photoUrl,
+                        provider: u.provider,
+                        roles,
+                        createdAt: u.createdAt,
+                        updatedAt: u.updatedAt
+                    };
+                })
+            );
+
+            return c.json({
+                users: usersWithRoles,
+                total: result.total,
+                limit: result.limit,
+                offset: result.offset
+            });
+        }
+
+        // Legacy: return all users (no pagination)
+        const users = await authRepo.listUsers();
+        const usersWithRoles = await Promise.all(
+            users.map(async (u) => {
+                const roles = await authRepo.getUserRoleIds(u.id);
+                return {
+                    uid: u.id,
+                    email: u.email,
+                    displayName: u.displayName,
+                    photoURL: u.photoUrl,
+                    provider: u.provider,
+                    roles,
+                    createdAt: u.createdAt,
+                    updatedAt: u.updatedAt
+                };
+            })
+        );
+        return c.json({ users: usersWithRoles });
+    });
+
+    router.get("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const result = await authRepo.getUserWithRoles(userId);
+
+        if (!result) {
+            throw ApiError.notFound("User not found");
+        }
+
+        return c.json({
+            user: {
+                uid: result.user.id,
+                email: result.user.email,
+                displayName: result.user.displayName,
+                photoURL: result.user.photoUrl,
+                provider: result.user.provider,
+                roles: result.roles.map(r => r.id),
+                createdAt: result.user.createdAt,
+                updatedAt: result.user.updatedAt
+            }
+        });
+    });
+
+    router.post("/users", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        const { email, displayName, password, roles } = body;
+
+        if (!email) {
+            throw ApiError.badRequest("Email is required", "INVALID_INPUT");
+        }
+
+        const existing = await authRepo.getUserByEmail(email);
+        if (existing) {
+            throw ApiError.conflict("Email already exists", "EMAIL_EXISTS");
+        }
+
+        // Use provided password or auto-generate one
+        const clearPassword = password || generateSecurePassword();
+
+        const validation = validatePasswordStrength(clearPassword);
+        if (!validation.valid) {
+            throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
+        }
+        const passwordHash = await hashPassword(clearPassword);
+
+        const user = await authRepo.createUser({
+            email: email.toLowerCase(),
+            displayName: displayName || null,
+            passwordHash,
+            provider: "email"
+        });
+
+        if (roles && Array.isArray(roles) && roles.length > 0) {
+            await authRepo.setUserRoles(user.id, roles);
+        } else if (config.defaultRole) {
+            await authRepo.assignDefaultRole(user.id, config.defaultRole);
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(user.id);
+
+        // Determine if we can send an invitation email
+        const isEmailConfigured = !!(emailService && emailService.isConfigured());
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        if (isEmailConfigured && !password) {
+            // Send invitation email via password-reset token flow
+            try {
+                const token = generateSecureToken();
+                const tokenHash = hashToken(token);
+                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                await authRepo.createPasswordResetToken(user.id, tokenHash, expiresAt);
+
+                const baseUrl = emailConfig?.resetPasswordUrl || "";
+                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                const appName = emailConfig?.appName || "Rebase";
+                const templateFn = emailConfig?.templates?.userInvitation;
+                const emailContent = templateFn
+                    ? templateFn(setPasswordUrl, { email: user.email, displayName: user.displayName })
+                    : getUserInvitationTemplate(setPasswordUrl, { email: user.email, displayName: user.displayName }, appName);
+
+                await emailService!.send({
+                    to: user.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+                invitationSent = true;
+            } catch (emailError: unknown) {
+                console.error("Failed to send invitation email:", emailError instanceof Error ? emailError.message : emailError);
+                // Fall back to returning the temporary password
+                temporaryPassword = clearPassword;
+            }
+        } else if (!password) {
+            // No email service — return the auto-generated password one-time
+            temporaryPassword = clearPassword;
+        }
+        // If admin provided a password explicitly, don't return it or send email
+
+        return c.json({
+            user: {
+                uid: user.id,
+                email: user.email,
+                displayName: user.displayName,
+                roles: userRoles
+            },
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 201);
+    });
+
+    router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const isEmailConfigured = !!(emailService && emailService.isConfigured());
+        let invitationSent = false;
+        let temporaryPassword: string | undefined;
+
+        if (isEmailConfigured) {
+            try {
+                const token = generateSecureToken();
+                const tokenHash = hashToken(token);
+                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+
+                await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
+
+                const baseUrl = emailConfig?.resetPasswordUrl || "";
+                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
+
+                const appName = emailConfig?.appName || "Rebase";
+                const templateFn = emailConfig?.templates?.passwordReset;
+                const emailContent = templateFn
+                    ? templateFn(setPasswordUrl, { email: existing.email, displayName: existing.displayName })
+                    : getPasswordResetTemplate(setPasswordUrl, { email: existing.email, displayName: existing.displayName }, appName);
+
+                await emailService!.send({
+                    to: existing.email,
+                    subject: emailContent.subject,
+                    html: emailContent.html,
+                    text: emailContent.text
+                });
+                invitationSent = true;
+            } catch (emailError: unknown) {
+                console.error("Failed to send reset email:", emailError instanceof Error ? emailError.message : emailError);
+                // Fall back to returning the temporary password
+                const clearPassword = generateSecurePassword();
+                const passwordHash = await hashPassword(clearPassword);
+                await authRepo.updatePassword(existing.id, passwordHash);
+                temporaryPassword = clearPassword;
+            }
+        } else {
+            // No email service — generate password, set it, and return one-time
+            const clearPassword = generateSecurePassword();
+            const passwordHash = await hashPassword(clearPassword);
+            await authRepo.updatePassword(existing.id, passwordHash);
+            temporaryPassword = clearPassword;
+        }
+
+        const userRoles = await authRepo.getUserRoleIds(existing.id);
+
+        return c.json({
+            user: {
+                uid: existing.id,
+                email: existing.email,
+                displayName: existing.displayName,
+                roles: userRoles
+            },
+            invitationSent,
+            ...(temporaryPassword ? { temporaryPassword } : {})
+        }, 200);
+    });
+
+    router.put("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const body = await c.req.json();
+        const { email, displayName, password, roles } = body;
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        const updates: Record<string, unknown> = {};
+        if (email !== undefined) updates.email = email.toLowerCase();
+        if (displayName !== undefined) updates.displayName = displayName;
+
+        if (password) {
+            const validation = validatePasswordStrength(password);
+            if (!validation.valid) {
+                throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
+            }
+            updates.passwordHash = await hashPassword(password);
+        }
+
+        if (Object.keys(updates).length > 0) {
+            await authRepo.updateUser(userId, updates);
+        }
+
+        if (roles !== undefined && Array.isArray(roles)) {
+            await authRepo.setUserRoles(userId, roles);
+        }
+
+        const result = await authRepo.getUserWithRoles(userId);
+
+        return c.json({
+            user: {
+                uid: result!.user.id,
+                email: result!.user.email,
+                displayName: result!.user.displayName,
+                roles: result!.roles.map(r => r.id)
+            }
+        });
+    });
+
+    router.delete("/users/:userId", requireAdmin, async (c) => {
+        const userId = c.req.param("userId");
+        const user = c.get("user");
+
+        const currentUserId = user && typeof user === "object" && "userId" in user ? user.userId : undefined;
+        if (currentUserId === userId) {
+            throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
+        }
+
+        const existing = await authRepo.getUserById(userId);
+        if (!existing) {
+            throw ApiError.notFound("User not found");
+        }
+
+        await authRepo.deleteUser(userId);
+
+        return c.json({ success: true });
+    });
+
+    router.get("/roles", requireAdmin, async (c) => {
+        const roles = await authRepo.listRoles();
+
+        return c.json({
+            roles: roles.map(r => ({
+                id: r.id,
+                name: r.name,
+                isAdmin: r.isAdmin,
+                defaultPermissions: r.defaultPermissions,
+                config: r.config
+            }))
+        });
+    });
+
+    router.get("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+        const role = await authRepo.getRoleById(roleId);
+
+        if (!role) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        return c.json({ role });
+    });
+
+    router.post("/roles", requireAdmin, async (c) => {
+        const body = await c.req.json();
+        const { id, name, isAdmin, defaultPermissions, config } = body;
+
+        if (!id || !name) {
+            throw ApiError.badRequest("Role ID and name are required", "INVALID_INPUT");
+        }
+
+        const existing = await authRepo.getRoleById(id);
+        if (existing) {
+            throw ApiError.conflict("Role already exists", "ROLE_EXISTS");
+        }
+
+        const role = await authRepo.createRole({
+            id,
+            name,
+            isAdmin: isAdmin ?? false,
+            defaultPermissions: defaultPermissions ?? null,
+            config: config ?? null
+        });
+
+        return c.json({ role }, 201);
+    });
+
+    router.put("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+        const body = await c.req.json();
+        const { name, isAdmin, defaultPermissions, config } = body;
+
+        const existing = await authRepo.getRoleById(roleId);
+        if (!existing) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        const role = await authRepo.updateRole(roleId, {
+            name,
+            isAdmin,
+            defaultPermissions,
+            config
+        });
+
+        return c.json({ role });
+    });
+
+    router.delete("/roles/:roleId", requireAdmin, async (c) => {
+        const roleId = c.req.param("roleId");
+
+        if (["admin", "editor", "viewer"].includes(roleId)) {
+            throw ApiError.badRequest("Cannot delete built-in roles", "BUILTIN_ROLE");
+        }
+
+        const existing = await authRepo.getRoleById(roleId);
+        if (!existing) {
+            throw ApiError.notFound("Role not found");
+        }
+
+        await authRepo.deleteRole(roleId);
+
+        return c.json({ success: true });
+    });
+
+    return router;
+}

package/src/auth/google-oauth.ts

@@ -0,0 +1,60 @@
+import { OAuth2Client } from "google-auth-library/build/src/index.js";
+
+export interface GoogleUserInfo {
+    googleId: string;
+    email: string;
+    displayName: string | null;
+    photoUrl: string | null;
+    emailVerified: boolean;
+}
+
+let googleClient: OAuth2Client | null = null;
+let configuredClientId: string | null = null;
+
+/**
+ * Configure Google OAuth - call this during initialization
+ */
+export function configureGoogleOAuth(clientId: string): void {
+    configuredClientId = clientId;
+    googleClient = new OAuth2Client(clientId);
+}
+
+/**
+ * Verify a Google ID token and extract user information
+ * @param idToken The ID token from Google Sign-In on the frontend
+ */
+export async function verifyGoogleIdToken(idToken: string): Promise<GoogleUserInfo | null> {
+    if (!googleClient || !configuredClientId) {
+        throw new Error("Google OAuth not configured. Call configureGoogleOAuth() first.");
+    }
+
+    try {
+        const ticket = await googleClient.verifyIdToken({
+            idToken,
+            audience: configuredClientId
+        });
+
+        const payload = ticket.getPayload();
+        if (!payload) {
+            return null;
+        }
+
+        return {
+            googleId: payload.sub,
+            email: payload.email || "",
+            displayName: payload.name || null,
+            photoUrl: payload.picture || null,
+            emailVerified: payload.email_verified || false
+        };
+    } catch (error) {
+        console.error("Failed to verify Google ID token:", error);
+        return null;
+    }
+}
+
+/**
+ * Check if Google OAuth is configured
+ */
+export function isGoogleOAuthConfigured(): boolean {
+    return googleClient !== null && configuredClientId !== null;
+}

package/src/auth/index.ts

@@ -0,0 +1,21 @@
+// Auth module exports
+export { configureJwt, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry } from "./jwt";
+export type { JwtConfig, AccessTokenPayload } from "./jwt";
+
+export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
+export type { PasswordValidationResult } from "./password";
+
+export { configureGoogleOAuth, verifyGoogleIdToken, isGoogleOAuthConfigured } from "./google-oauth";
+export type { GoogleUserInfo } from "./google-oauth";
+
+export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware } from "./middleware";
+export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
+
+
+export { createAuthRoutes } from "./routes";
+export type { AuthModuleConfig } from "./routes";
+
+export { createAdminRoutes } from "./admin-routes";
+
+
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter } from "./rate-limiter";