@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/github-oauth.ts

@@ -1,112 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a GitHub OAuth Provider integration.
- *
- * Flow: Frontend receives an authorization `code` via the GitHub OAuth redirect.
- * This provider exchanges the code for an access token, then fetches the user's
- * profile and primary email from the GitHub API.
- */
-export function createGitHubProvider(config: { clientId: string; clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "github",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Exchange code for access token
-                const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        "Accept": "application/json"
-                    },
-                    body: JSON.stringify({
-                        client_id: config.clientId,
-                        client_secret: config.clientSecret,
-                        code: payload.code,
-                        redirect_uri: payload.redirectUri
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get GitHub access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token?: string; error?: string };
-                if (tokenData.error || !tokenData.access_token) {
-                    logger.error("GitHub token exchange error", { detail: tokenData.error });
-                    return null;
-                }
-
-                const accessToken = tokenData.access_token;
-
-                // Fetch user profile
-                const profileResponse = await fetch("https://api.github.com/user", {
-                    headers: {
-                        "Authorization": `Bearer ${accessToken}`,
-                        "Accept": "application/vnd.github+json",
-                        "User-Agent": "Rebase-Auth"
-                    }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get GitHub user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const profileData = await profileResponse.json() as {
-                    id: number;
-                    login: string;
-                    name?: string | null;
-                    avatar_url?: string | null;
-                    email?: string | null;
-                };
-
-                // GitHub may not return email in profile if it's private.
-                // Fetch from /user/emails endpoint instead.
-                let email = profileData.email;
-                if (!email) {
-                    const emailsResponse = await fetch("https://api.github.com/user/emails", {
-                        headers: {
-                            "Authorization": `Bearer ${accessToken}`,
-                            "Accept": "application/vnd.github+json",
-                            "User-Agent": "Rebase-Auth"
-                        }
-                    });
-
-                    if (emailsResponse.ok) {
-                        const emails = await emailsResponse.json() as Array<{
-                            email: string;
-                            primary: boolean;
-                            verified: boolean;
-                        }>;
-                        const primary = emails.find(e => e.primary && e.verified) || emails.find(e => e.verified);
-                        email = primary?.email || null;
-                    }
-                }
-
-                if (!email) {
-                    logger.error("GitHub user has no verified email");
-                    return null;
-                }
-
-                return {
-                    providerId: String(profileData.id),
-                    email,
-                    displayName: profileData.name || profileData.login || null,
-                    photoUrl: profileData.avatar_url || null,
-                    emailVerified: true
-                };
-            } catch (error) {
-                logger.error("GitHub OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/gitlab-oauth.ts

@@ -1,72 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a GitLab OAuth Provider integration.
- * Works with both GitLab.com and self-hosted instances.
- */
-export function createGitLabProvider(config: {
-    clientId: string;
-    clientSecret: string;
-    baseUrl?: string;
-}): OAuthProvider<{ code: string; redirectUri: string }> {
-    const gitlabUrl = (config.baseUrl || "https://gitlab.com").replace(/\/$/, "");
-
-    return {
-        id: "gitlab",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                const tokenResponse = await fetch(`${gitlabUrl}/oauth/token`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({
-                        client_id: config.clientId,
-                        client_secret: config.clientSecret,
-                        code: payload.code,
-                        grant_type: "authorization_code",
-                        redirect_uri: payload.redirectUri
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get GitLab access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-
-                const profileResponse = await fetch(`${gitlabUrl}/api/v4/user`, {
-                    headers: { "Authorization": `Bearer ${tokenData.access_token}` }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get GitLab user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const p = await profileResponse.json() as {
-                    id: number; username: string; name?: string;
-                    email: string; avatar_url?: string | null;
-                };
-
-                if (!p.email) { logger.error("GitLab user has no email"); return null; }
-
-                return {
-                    providerId: String(p.id),
-                    email: p.email,
-                    displayName: p.name || p.username || null,
-                    photoUrl: p.avatar_url || null,
-                    emailVerified: true
-                };
-            } catch (error) {
-                logger.error("GitLab OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/google-oauth.ts

@@ -1,223 +0,0 @@
-import { OAuth2Client } from "google-auth-library/build/src/index.js";
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-export interface GoogleUserInfo {
-    googleId: string;
-    email: string;
-    displayName: string | null;
-    photoUrl: string | null;
-    emailVerified: boolean;
-}
-
-export interface GoogleProviderConfig {
-    clientId: string;
-    /**
-     * The OAuth 2.0 client secret from Google Cloud Console.
-     *
-     * Required for the **authorization code flow** (Path 3), where the
-     * frontend sends an authorization `code` and the backend exchanges it
-     * server-side for tokens. This is the most secure flow because tokens
-     * never touch the browser.
-     *
-     * When omitted, only ID-token and access-token verification are available
-     * (Paths 1 & 2), which rely on the frontend obtaining tokens directly.
-     */
-    clientSecret?: string;
-}
-
-/**
- * Creates a Google OAuth Provider integration.
- *
- * Supports three verification paths:
- *
- * **Path 1 – ID Token** (One Tap / Sign In With Google button):
- *   Frontend sends `idToken`. Backend verifies cryptographically using
- *   Google's public keys. No secret required.
- *
- * **Path 2 – Access Token** (popup via `initTokenClient`):
- *   Frontend sends `accessToken`. Backend validates by calling Google's
- *   userinfo endpoint. No secret required.
- *
- * **Path 3 – Authorization Code** (most secure, requires `clientSecret`):
- *   Frontend sends `code` + `redirectUri`. Backend exchanges the code
- *   server-side for an ID token using `clientId` + `clientSecret`, then
- *   verifies the ID token. Tokens never touch the browser.
- */
-export function createGoogleProvider(config: GoogleProviderConfig | string): OAuthProvider<{
-    idToken?: string;
-    accessToken?: string;
-    code?: string;
-    redirectUri?: string;
-}> {
-    const clientId = typeof config === "string" ? config : config.clientId;
-    const clientSecret = typeof config === "string" ? undefined : config.clientSecret;
-    const googleClient = new OAuth2Client(clientId, clientSecret);
-
-    return {
-        id: "google",
-        schema: z.object({
-            idToken: z.string().min(1).optional(),
-            accessToken: z.string().min(1).optional(),
-            code: z.string().min(1).optional(),
-            redirectUri: z.string().min(1).optional()
-        }).refine(
-            (data) => data.idToken || data.accessToken || (data.code && data.redirectUri),
-            { message: "One of idToken, accessToken, or code+redirectUri is required" }
-        ),
-        verify: async (payload: {
-            idToken?: string;
-            accessToken?: string;
-            code?: string;
-            redirectUri?: string;
-        }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Path 1: verify an ID token (One Tap / renderButton)
-                if (payload.idToken) {
-                    const ticket = await googleClient.verifyIdToken({
-                        idToken: payload.idToken,
-                        audience: clientId
-                    });
-
-                    const content = ticket.getPayload();
-                    if (!content) {
-                        throw new Error("Google ID token payload was empty");
-                    }
-
-                    return {
-                        providerId: content.sub,
-                        email: content.email || "",
-                        displayName: content.name || null,
-                        photoUrl: content.picture || null,
-                        emailVerified: true
-                    };
-                }
-
-                // Path 2: verify an access token via Google's userinfo endpoint
-                if (payload.accessToken) {
-                    const res = await fetch(
-                        "https://www.googleapis.com/oauth2/v3/userinfo",
-                        { headers: { Authorization: `Bearer ${payload.accessToken}` } }
-                    );
-                    if (!res.ok) {
-                        throw new Error(`Google userinfo request failed with status ${res.status}`);
-                    }
-                    const info = await res.json() as {
-                        sub: string;
-                        email?: string;
-                        name?: string;
-                        picture?: string;
-                    };
-                    if (!info.sub || !info.email) {
-                        throw new Error("Google userinfo response missing sub or email");
-                    }
-                    return {
-                        providerId: info.sub,
-                        email: info.email,
-                        displayName: info.name || null,
-                        photoUrl: info.picture || null,
-                        emailVerified: true
-                    };
-                }
-
-                // Path 3: authorization code exchange (most secure)
-                // The frontend obtained a one-time authorization code via the
-                // Google OAuth consent screen. We exchange it server-side for
-                // tokens, so the access/id tokens never touch the browser.
-                if (payload.code && payload.redirectUri) {
-                    if (!clientSecret) {
-                        throw new Error(
-                            "Google authorization code flow requires clientSecret. " +
-                            "Configure GOOGLE_CLIENT_SECRET in your environment."
-                        );
-                    }
-
-                    // Exchange the authorization code for tokens
-                    const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
-                        method: "POST",
-                        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                        body: new URLSearchParams({
-                            code: payload.code,
-                            client_id: clientId,
-                            client_secret: clientSecret,
-                            redirect_uri: payload.redirectUri,
-                            grant_type: "authorization_code"
-                        })
-                    });
-
-                    if (!tokenResponse.ok) {
-                        const errorBody = await tokenResponse.text();
-                        throw new Error(`Google token exchange failed (${tokenResponse.status}): ${errorBody}`);
-                    }
-
-                    const tokenData = await tokenResponse.json() as {
-                        id_token?: string;
-                        access_token?: string;
-                        error?: string;
-                        error_description?: string;
-                    };
-
-                    if (tokenData.error) {
-                        throw new Error(`Google token exchange error: ${tokenData.error} – ${tokenData.error_description || "no details"}`);
-                    }
-
-                    // Prefer verifying the ID token (cryptographic verification)
-                    if (tokenData.id_token) {
-                        const ticket = await googleClient.verifyIdToken({
-                            idToken: tokenData.id_token,
-                            audience: clientId
-                        });
-
-                        const content = ticket.getPayload();
-                        if (!content) {
-                            throw new Error("Google ID token payload was empty after code exchange");
-                        }
-
-                        return {
-                            providerId: content.sub,
-                            email: content.email || "",
-                            displayName: content.name || null,
-                            photoUrl: content.picture || null,
-                            emailVerified: true
-                        };
-                    }
-
-                    // Fallback: use the access token to fetch userinfo
-                    if (tokenData.access_token) {
-                        const userInfoRes = await fetch(
-                            "https://www.googleapis.com/oauth2/v3/userinfo",
-                            { headers: { Authorization: `Bearer ${tokenData.access_token}` } }
-                        );
-                        if (!userInfoRes.ok) {
-                            throw new Error(`Google userinfo request failed after code exchange (${userInfoRes.status})`);
-                        }
-                        const info = await userInfoRes.json() as {
-                            sub: string;
-                            email?: string;
-                            name?: string;
-                            picture?: string;
-                        };
-                        if (!info.sub || !info.email) {
-                            return null;
-                        }
-                        return {
-                            providerId: info.sub,
-                            email: info.email,
-                            displayName: info.name || null,
-                            photoUrl: info.picture || null,
-                            emailVerified: true
-                        };
-                    }
-
-                    throw new Error("Google token exchange returned neither id_token nor access_token");
-                }
-
-                throw new Error("No valid Google credential provided (expected idToken, accessToken, or code+redirectUri)");
-            } catch (error) {
-                logger.error("Google OAuth verification failed", { error: error });
-                throw error;
-            }
-        }
-    };
-}

package/src/auth/jwt.ts

@@ -1,208 +0,0 @@
-import jwt from "jsonwebtoken";
-import { createHash, randomBytes } from "crypto";
-import { logger } from "../utils/logger";
-
-export interface JwtConfig {
-    secret: string;
-    accessExpiresIn?: string;
-    refreshExpiresIn?: string;
-}
-
-export interface AccessTokenPayload {
-    userId: string;
-    roles: string[];
-    uid?: string;
-    /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
-    aal?: "aal1" | "aal2";
-    /** Email claim from the JWT, if present */
-    email?: string;
-    /** Display name claim from the JWT, if present */
-    displayName?: string;
-    /** Photo URL claim from the JWT, if present */
-    photoURL?: string;
-    /** Whether MFA has been verified for this session */
-    mfa_verified?: boolean;
-    /** Authentication Methods Reference — list of methods used (e.g. 'pwd', 'otp') */
-    amr?: string[];
-}
-
-let jwtConfig: JwtConfig = {
-    secret: "",
-    accessExpiresIn: "1h",
-    refreshExpiresIn: "30d"
-};
-
-/**
- * Configure JWT settings - call this during initialization.
- * Validates the secret strength to prevent deployment with default/weak secrets.
- */
-export function configureJwt(config: JwtConfig): void {
-    // Reject obviously weak/default secrets
-    const weakSecrets = new Set([
-        "secret",
-        "jwt-secret",
-        "jwt_secret",
-        "your-secret",
-        "your-super-secret-jwt-key-change-in-production",
-        "super-secret-jwt-key-change-in-production",
-        "change-me",
-        "changeme",
-        "password",
-        "test",
-        "mysecret",
-        "my-secret",
-        "my_secret",
-        "example-secret",
-        "please-change-me",
-        "replace-this-with-a-real-secret",
-        "default-secret",
-        "rebase_saas_jwt_secret_must_be_long_long_long_long",
-        "rebase_saas_service_key_must_be_long_long_long_long"
-    ]);
-
-    if (!config.secret || config.secret.length < 32) {
-        throw new Error(
-            "JWT secret is too short. Must be at least 32 characters. " +
-            "Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\""
-        );
-    }
-
-    if (weakSecrets.has(config.secret.toLowerCase())) {
-        throw new Error(
-            "JWT secret is a known default/weak value. Please use a strong, randomly generated secret. " +
-            "Generate one with: node -e \"logger.info(require('crypto').randomBytes(48).toString('base64'))\""
-        );
-    }
-
-    jwtConfig = {
-        ...jwtConfig,
-        ...config
-    };
-}
-
-/**
- * Generate an access token (short-lived, 1 hour by default)
- */
-export function generateAccessToken(
-    userId: string,
-    roles: string[],
-    aal: "aal1" | "aal2" = "aal1",
-    customClaims?: Record<string, unknown>
-): string {
-    if (!jwtConfig.secret) {
-        throw new Error("JWT secret not configured. Call configureJwt() first.");
-    }
-
-    const payload: Record<string, unknown> = {
-        userId,
-        roles,
-        aal,
-        ...customClaims
-    };
-
-    return jwt.sign(payload, jwtConfig.secret, {
-        expiresIn: jwtConfig.accessExpiresIn as jwt.SignOptions["expiresIn"],
-        algorithm: "HS256"
-    });
-}
-
-/**
- * Get the expiration time of an access token in milliseconds from now
- */
-export function getAccessTokenExpiryMs(): number {
-    const duration = jwtConfig.accessExpiresIn || "1h";
-    const match = duration.match(/^(\d+)([dhms])$/);
-
-    if (!match) {
-        // Default to 1 hour
-        return 60 * 60 * 1000;
-    }
-
-    const value = parseInt(match[1], 10);
-    const unit = match[2];
-
-    switch (unit) {
-        case "d": return value * 24 * 60 * 60 * 1000;
-        case "h": return value * 60 * 60 * 1000;
-        case "m": return value * 60 * 1000;
-        case "s": return value * 1000;
-        default: return 60 * 60 * 1000;
-    }
-}
-
-/**
- * Get the expiration timestamp for an access token
- */
-export function getAccessTokenExpiry(): number {
-    return Date.now() + getAccessTokenExpiryMs();
-}
-
-/**
- * Verify and decode an access token
- */
-export function verifyAccessToken(token: string): AccessTokenPayload | null {
-    if (!jwtConfig.secret) {
-        throw new Error("JWT secret not configured. Call configureJwt() first.");
-    }
-
-    try {
-        const decoded = jwt.verify(token, jwtConfig.secret, { algorithms: ["HS256"] }) as { userId?: string; uid?: string; sub?: string; roles?: string[]; aal?: string };
-        const id = decoded.userId || decoded.uid || decoded.sub;
-        if (!id) {
-            logger.error("[JWT] Verification failed: missing id in payload", { detail: decoded });
-            return null;
-        }
-
-        const aal = (decoded.aal === "aal1" || decoded.aal === "aal2") ? decoded.aal : "aal1";
-
-        return {
-            userId: id,
-            roles: decoded.roles || [],
-            aal
-        };
-    } catch (error) {
-        logger.error("[JWT] Verification failed", { error: error, detail: token.substring(0, 15) });
-        return null;
-    }
-}
-
-/**
- * Generate a random refresh token (long-lived, 30 days by default)
- */
-export function generateRefreshToken(): string {
-    return randomBytes(40).toString("hex");
-}
-
-/**
- * Hash a refresh token for database storage (don't store raw tokens)
- */
-export function hashRefreshToken(token: string): string {
-    return createHash("sha256").update(token).digest("hex");
-}
-
-/**
- * Calculate refresh token expiration date
- */
-export function getRefreshTokenExpiry(): Date {
-    const duration = jwtConfig.refreshExpiresIn || "30d";
-    const match = duration.match(/^(\d+)([dhms])$/);
-
-    if (!match) {
-        // Default to 30 days
-        return new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-    }
-
-    const value = parseInt(match[1], 10);
-    const unit = match[2];
-
-    let ms: number;
-    switch (unit) {
-        case "d": ms = value * 24 * 60 * 60 * 1000; break;
-        case "h": ms = value * 60 * 60 * 1000; break;
-        case "m": ms = value * 60 * 1000; break;
-        case "s": ms = value * 1000; break;
-        default: ms = 30 * 24 * 60 * 60 * 1000;
-    }
-
-    return new Date(Date.now() + ms);
-}