@rebasepro/server-core 0.4.0 → 0.6.0

package/src/auth/admin-routes.ts

@@ -1,534 +0,0 @@
-import { Hono } from "hono";
-import { ApiError, errorHandler } from "../api/errors";
-import type { AuthRepository } from "./interfaces";
-import { requireAuth, requireAdmin, createRequireAuth } from "./middleware";
-import type { AuthHooks } from "./auth-hooks";
-import { resolveAuthHooks } from "./auth-hooks";
-import { AuthModuleConfig } from "./routes";
-import type { BackendHooks, AdminUser, BackendHookContext } from "@rebasepro/types";
-
-interface AdminRouteOptions extends AuthModuleConfig {
-    serviceKey?: string;
-    /**
-     * Callback to persistently mark bootstrap as completed.
-     * Invoked after the first admin user is promoted via POST /admin/bootstrap.
-     */
-    setBootstrapCompleted?: () => Promise<void>;
-    /**
-     * Backend-level hooks for intercepting admin data.
-     */
-    hooks?: BackendHooks;
-    /**
-     * Auth hooks for customizing password hashing, credential
-     * verification, lifecycle hooks, etc.
-     */
-    authHooks?: AuthHooks;
-}
-import { HonoEnv } from "../api/types";
-import { randomBytes, createHash } from "crypto";
-import { getUserInvitationTemplate, getPasswordResetTemplate } from "../email/templates";
-
-/**
- * Generate a cryptographically secure random password that meets strength requirements.
- */
-function generateSecurePassword(): string {
-    const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
-    const lower = "abcdefghjkmnpqrstuvwxyz";
-    const digits = "23456789";
-    const all = upper + lower + digits;
-
-    // Guarantee at least one of each required class
-    const pick = (chars: string) => chars[Math.floor(Math.random() * chars.length)];
-    const parts = [pick(upper), pick(lower), pick(digits)];
-
-    // Fill remaining with random chars (16 total)
-    for (let i = parts.length; i < 16; i++) {
-        parts.push(pick(all));
-    }
-
-    // Shuffle
-    for (let i = parts.length - 1; i > 0; i--) {
-        const j = Math.floor(Math.random() * (i + 1));
-        [parts[i], parts[j]] = [parts[j], parts[i]];
-    }
-    return parts.join("");
-}
-
-/**
- * Generate a secure random token
- */
-function generateSecureToken(): string {
-    return randomBytes(40).toString("hex");
-}
-
-/**
- * Hash a token for database storage
- */
-function hashToken(token: string): string {
-    return createHash("sha256").update(token).digest("hex");
-}
-
-/**
- * Create admin routes for user and role management
- */
-export function createAdminRoutes(config: AdminRouteOptions): Hono<HonoEnv> {
-    const router = new Hono<HonoEnv>();
-    const authRepo = config.authRepo;
-    const { emailService, emailConfig, hooks, authHooks } = config;
-    const ops = resolveAuthHooks(authHooks);
-
-    /** Build a BackendHookContext from Hono's context object */
-    function buildHookContext(c: { get: (key: string) => unknown }, method: BackendHookContext["method"]): BackendHookContext {
-        const user = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        return {
-            requestUser: user ? { userId: user.userId, roles: user.roles ?? [] } : undefined,
-            method
-        };
-    }
-
-    /** Apply users.afterRead hook to an AdminUser, returning null to filter out */
-    async function applyUserAfterRead(user: AdminUser, ctx: BackendHookContext): Promise<AdminUser | null> {
-        if (!hooks?.users?.afterRead) return user;
-        return hooks.users.afterRead(user, ctx);
-    }
-
-    /** Apply users.afterRead hook to an array and filter nulls */
-    async function applyUserAfterReadBatch(users: AdminUser[], ctx: BackendHookContext): Promise<AdminUser[]> {
-        if (!hooks?.users?.afterRead) return users;
-        const results = await Promise.all(users.map(u => applyUserAfterRead(u, ctx)));
-        return results.filter((u): u is AdminUser => u !== null);
-    }
-
-
-
-    /** Convert a DB user record + role IDs into the AdminUser API shape */
-    function toAdminUser(u: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; createdAt?: Date | string; updatedAt?: Date | string }, roles: string[]): AdminUser {
-        return {
-            uid: u.id,
-            email: u.email,
-            displayName: u.displayName ?? null,
-            photoURL: u.photoUrl ?? null,
-            provider: "custom",
-            roles,
-            createdAt: u.createdAt instanceof Date ? u.createdAt.toISOString() : (u.createdAt ?? new Date().toISOString()),
-            updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : (u.updatedAt ?? new Date().toISOString())
-        };
-    }
-
-    // Attach Rebase error handler to ensure exceptions are correctly formatted
-    // instead of caught by Hono's default error handler from the sub-router.
-    router.onError(errorHandler);
-
-    // Apply auth middleware to all routes (service-key-aware when configured)
-    router.use("/*", createRequireAuth({ serviceKey: config.serviceKey }));
-
-    /**
-     * POST /admin/bootstrap
-     *
-     * One-time endpoint to promote the calling user to admin.
-     * Guarded by three layers:
-     *   1. Authentication (handled by middleware above)
-     *   2. Persistent `bootstrap_completed` flag (when `setBootstrapCompleted` is provided)
-     *   3. Database check — no existing admin users
-     *
-     * Once invoked successfully the persistent flag is set, permanently disabling
-     * this endpoint even if all admin users are later deleted.
-     */
-    router.post("/bootstrap", async (c) => {
-        const user = c.get("user");
-        if (!user || typeof user !== "object") {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        // ── Guard 1: persistent flag ──────────────────────────────────
-        if (config.isBootstrapCompleted) {
-            const alreadyDone = await config.isBootstrapCompleted();
-            if (alreadyDone) {
-                throw ApiError.forbidden("Bootstrap has already been completed.", "BOOTSTRAP_COMPLETED");
-            }
-        }
-
-        // ── Guard 2: no existing admin users ─────────────────────────
-        const users = await authRepo.listUsers();
-        let hasAdmin = false;
-
-        for (const u of users) {
-            const roles = await authRepo.getUserRoleIds(u.id);
-            if (roles.includes("admin")) {
-                hasAdmin = true;
-                break;
-            }
-        }
-
-        if (hasAdmin) {
-            throw ApiError.forbidden("Admin users already exist. Bootstrap not allowed.", "BOOTSTRAP_COMPLETED");
-        }
-
-        // ── Promote caller ───────────────────────────────────────────
-        const userId = "userId" in user ? user.userId : undefined;
-        if (!userId) {
-            throw ApiError.unauthorized("User ID not found in auth context");
-        }
-        const caller = await authRepo.getUserById(userId);
-        if (!caller) {
-            throw ApiError.notFound("Authenticated user does not exist in the database. Please sign out and sign in/register again.", "USER_NOT_FOUND");
-        }
-        await authRepo.setUserRoles(userId, ["admin"]);
-
-        // ── Set persistent flag ──────────────────────────────────────
-        if (config.setBootstrapCompleted) {
-            await config.setBootstrapCompleted();
-        }
-
-        return c.json({
-            success: true,
-            message: "You are now an admin",
-            user: {
-                uid: userId,
-                roles: ["admin"]
-            }
-        });
-    });
-
-    router.get("/users", requireAdmin, async (c) => {
-        const limitParam = c.req.query("limit");
-        const offsetParam = c.req.query("offset");
-        const search = c.req.query("search");
-        const orderBy = c.req.query("orderBy");
-        const orderDir = c.req.query("orderDir") as "asc" | "desc" | undefined;
-        const hookCtx = buildHookContext(c, "GET");
-
-        const limit = limitParam ? parseInt(limitParam, 10) : 25;
-        const offset = offsetParam ? parseInt(offsetParam, 10) : 0;
-
-        const result = await authRepo.listUsersPaginated({
-            limit,
-            offset,
-            search: search || undefined,
-            orderBy: orderBy || undefined,
-            orderDir: orderDir || undefined,
-            roleId: c.req.query("role") || undefined
-        });
-
-        let usersWithRoles: AdminUser[] = await Promise.all(
-            result.users.map(async (u) => {
-                const roles = await authRepo.getUserRoleIds(u.id);
-                return toAdminUser(u, roles);
-            })
-        );
-
-        usersWithRoles = await applyUserAfterReadBatch(usersWithRoles, hookCtx);
-
-        return c.json({
-            users: usersWithRoles,
-            total: result.total,
-            limit: result.limit,
-            offset: result.offset
-        });
-    });
-
-    router.get("/users/:userId", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const result = await authRepo.getUserWithRoles(userId);
-
-        if (!result) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const hookCtx = buildHookContext(c, "GET");
-        let adminUser: AdminUser | null = toAdminUser(result.user, result.roles.map(r => r.id));
-
-        adminUser = await applyUserAfterRead(adminUser, hookCtx);
-        if (!adminUser) {
-            throw ApiError.notFound("User not found");
-        }
-
-        return c.json({ user: adminUser });
-    });
-
-    router.post("/users", requireAdmin, async (c) => {
-        const body = await c.req.json();
-        const { password } = body;
-        let { email, displayName, roles } = body;
-
-        if (!email) {
-            throw ApiError.badRequest("Email is required", "INVALID_INPUT");
-        }
-
-        // Apply beforeSave hook
-        const hookCtx = buildHookContext(c, "POST");
-        if (hooks?.users?.beforeSave) {
-            const hooked = await hooks.users.beforeSave({ email, displayName, roles }, hookCtx);
-            email = hooked.email ?? email;
-            displayName = hooked.displayName ?? displayName;
-            roles = hooked.roles ?? roles;
-        }
-
-        const existing = await authRepo.getUserByEmail(email);
-        if (existing) {
-            throw ApiError.conflict("Email already exists", "EMAIL_EXISTS");
-        }
-
-        // Use provided password or auto-generate one
-        const clearPassword = password || generateSecurePassword();
-
-        const validation = ops.validatePasswordStrength(clearPassword);
-        if (!validation.valid) {
-            throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
-        }
-        const passwordHash = await ops.hashPassword(clearPassword);
-
-        const user = await authRepo.createUser({
-            email: email.toLowerCase(),
-            displayName: displayName || null,
-            passwordHash
-        });
-
-        if (roles && Array.isArray(roles) && roles.length > 0) {
-            await authRepo.setUserRoles(user.id, roles);
-        } else if (config.defaultRole) {
-            await authRepo.assignDefaultRole(user.id, config.defaultRole);
-        }
-
-        const userRoles = await authRepo.getUserRoleIds(user.id);
-
-        // Determine if we can send an invitation email
-        const isEmailConfigured = !!(emailService && emailService.isConfigured());
-        let invitationSent = false;
-        let temporaryPassword: string | undefined;
-
-        if (isEmailConfigured && !password) {
-            // Send invitation email via password-reset token flow
-            try {
-                const token = generateSecureToken();
-                const tokenHash = hashToken(token);
-                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
-
-                await authRepo.createPasswordResetToken(user.id, tokenHash, expiresAt);
-
-                const baseUrl = emailConfig?.resetPasswordUrl || "";
-                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
-
-                const appName = emailConfig?.appName || "Rebase";
-                const templateFn = emailConfig?.templates?.userInvitation;
-                const emailContent = templateFn
-                    ? templateFn(setPasswordUrl, { email: user.email,
-displayName: user.displayName })
-                    : getUserInvitationTemplate(setPasswordUrl, { email: user.email,
-displayName: user.displayName }, appName);
-
-                await emailService!.send({
-                    to: user.email,
-                    subject: emailContent.subject,
-                    html: emailContent.html,
-                    text: emailContent.text
-                });
-                invitationSent = true;
-            } catch (emailError: unknown) {
-                console.error("Failed to send invitation email:", emailError instanceof Error ? emailError.message : emailError);
-                // Fall back to returning the temporary password
-                temporaryPassword = clearPassword;
-            }
-        } else if (!password) {
-            // No email service — return the auto-generated password one-time
-            temporaryPassword = clearPassword;
-        }
-        // If admin provided a password explicitly, don't return it or send email
-
-        const createdAdminUser: AdminUser = toAdminUser(user, userRoles);
-
-        // Fire afterSave hook (fire-and-forget for side-effects)
-        if (hooks?.users?.afterSave) {
-            Promise.resolve(hooks.users.afterSave(createdAdminUser, hookCtx)).catch(err => {
-                console.error("[BackendHooks] users.afterSave error:", err instanceof Error ? err.message : err);
-            });
-        }
-
-        return c.json({
-            user: createdAdminUser,
-            invitationSent,
-            ...(temporaryPassword ? { temporaryPassword } : {})
-        }, 201);
-    });
-
-    router.post("/users/:userId/reset-password", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const existing = await authRepo.getUserById(userId);
-        if (!existing) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const isEmailConfigured = !!(emailService && emailService.isConfigured());
-        let invitationSent = false;
-        let temporaryPassword: string | undefined;
-
-        if (isEmailConfigured) {
-            try {
-                const token = generateSecureToken();
-                const tokenHash = hashToken(token);
-                const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
-
-                await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
-
-                const baseUrl = emailConfig?.resetPasswordUrl || "";
-                const setPasswordUrl = `${baseUrl}/reset-password?token=${token}`;
-
-                const appName = emailConfig?.appName || "Rebase";
-                const templateFn = emailConfig?.templates?.passwordReset;
-                const emailContent = templateFn
-                    ? templateFn(setPasswordUrl, { email: existing.email,
-displayName: existing.displayName })
-                    : getPasswordResetTemplate(setPasswordUrl, { email: existing.email,
-displayName: existing.displayName }, appName);
-
-                await emailService!.send({
-                    to: existing.email,
-                    subject: emailContent.subject,
-                    html: emailContent.html,
-                    text: emailContent.text
-                });
-                invitationSent = true;
-            } catch (emailError: unknown) {
-                console.error("Failed to send reset email:", emailError instanceof Error ? emailError.message : emailError);
-                // Fall back to returning the temporary password
-                const clearPassword = generateSecurePassword();
-                const passwordHash = await ops.hashPassword(clearPassword);
-                await authRepo.updatePassword(existing.id, passwordHash);
-                temporaryPassword = clearPassword;
-            }
-        } else {
-            // No email service — generate password, set it, and return one-time
-            const clearPassword = generateSecurePassword();
-            const passwordHash = await ops.hashPassword(clearPassword);
-            await authRepo.updatePassword(existing.id, passwordHash);
-            temporaryPassword = clearPassword;
-        }
-
-        const userRoles = await authRepo.getUserRoleIds(existing.id);
-
-        return c.json({
-            user: {
-                uid: existing.id,
-                email: existing.email,
-                displayName: existing.displayName,
-                roles: userRoles
-            },
-            invitationSent,
-            ...(temporaryPassword ? { temporaryPassword } : {})
-        }, 200);
-    });
-
-    router.put("/users/:userId", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const body = await c.req.json();
-        const { password } = body;
-        let { email, displayName, roles } = body;
-
-        const existing = await authRepo.getUserById(userId);
-        if (!existing) {
-            throw ApiError.notFound("User not found");
-        }
-
-        // Apply beforeSave hook
-        const hookCtx = buildHookContext(c, "PUT");
-        if (hooks?.users?.beforeSave) {
-            const hooked = await hooks.users.beforeSave({ email, displayName, roles }, hookCtx);
-            email = hooked.email ?? email;
-            displayName = hooked.displayName ?? displayName;
-            roles = hooked.roles ?? roles;
-        }
-
-        const updates: Record<string, unknown> = {};
-        if (email !== undefined) updates.email = email.toLowerCase();
-        if (displayName !== undefined) updates.displayName = displayName;
-
-        if (password) {
-            const validation = ops.validatePasswordStrength(password);
-            if (!validation.valid) {
-                throw ApiError.badRequest(validation.errors.join(". "), "WEAK_PASSWORD");
-            }
-            updates.passwordHash = await ops.hashPassword(password);
-        }
-
-        if (Object.keys(updates).length > 0) {
-            await authRepo.updateUser(userId, updates);
-        }
-
-        if (roles !== undefined && Array.isArray(roles)) {
-            const currentRoles = await authRepo.getUserRoleIds(userId);
-            const wasAdmin = currentRoles.includes("admin");
-            const willBeAdmin = roles.includes("admin");
-            
-            if (wasAdmin && !willBeAdmin) {
-                const adminUsers = await authRepo.listUsersPaginated({
-                    roleId: "admin",
-                    limit: 1
-                });
-                if (adminUsers.total <= 1) {
-                    throw ApiError.forbidden("Cannot demote the last administrator", "LAST_ADMIN");
-                }
-            }
-            await authRepo.setUserRoles(userId, roles);
-        }
-
-        const result = await authRepo.getUserWithRoles(userId);
-
-        const updatedAdminUser: AdminUser = toAdminUser(result!.user, result!.roles.map(r => r.id));
-
-        // Fire afterSave hook (fire-and-forget)
-        if (hooks?.users?.afterSave) {
-            Promise.resolve(hooks.users.afterSave(updatedAdminUser, hookCtx)).catch(err => {
-                console.error("[BackendHooks] users.afterSave error:", err instanceof Error ? err.message : err);
-            });
-        }
-
-        return c.json({ user: updatedAdminUser });
-    });
-
-    router.delete("/users/:userId", requireAdmin, async (c) => {
-        const userId = c.req.param("userId");
-        const user = c.get("user");
-
-        const currentUserId = user && typeof user === "object" && "userId" in user ? user.userId : undefined;
-        if (currentUserId === userId) {
-            throw ApiError.badRequest("Cannot delete your own account", "SELF_DELETE");
-        }
-
-        const existing = await authRepo.getUserById(userId);
-        if (!existing) {
-            throw ApiError.notFound("User not found");
-        }
-
-        const roles = await authRepo.getUserRoleIds(userId);
-        if (roles.includes("admin")) {
-            const adminUsers = await authRepo.listUsersPaginated({
-                roleId: "admin",
-                limit: 1
-            });
-            if (adminUsers.total <= 1) {
-                throw ApiError.forbidden("Cannot delete the last administrator", "LAST_ADMIN");
-            }
-        }
-
-        // Apply beforeDelete hook (throw to abort)
-        const hookCtx = buildHookContext(c, "DELETE");
-        if (hooks?.users?.beforeDelete) {
-            await hooks.users.beforeDelete(userId, hookCtx);
-        }
-
-        await authRepo.deleteUser(userId);
-
-        // Fire afterDelete hook (fire-and-forget)
-        if (hooks?.users?.afterDelete) {
-            Promise.resolve(hooks.users.afterDelete(userId, hookCtx)).catch(err => {
-                console.error("[BackendHooks] users.afterDelete error:", err instanceof Error ? err.message : err);
-            });
-        }
-
-        return c.json({ success: true });
-    });
-
-
-
-    return router;
-}