@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/linkedin-oauth.ts

@@ -1,83 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-export interface LinkedinUserInfo {
-    linkedinId: string;
-    email: string;
-    displayName: string | null;
-    photoUrl: string | null;
-    emailVerified: boolean;
-}
-
-/**
- * Creates a LinkedIn OAuth Provider integration
- */
-export function createLinkedinProvider(config: { clientId: string, clientSecret: string }): OAuthProvider<{ code: string; redirectUri: string }> {
-    return {
-        id: "linkedin",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Exchange code for access token
-                const tokenResponse = await fetch("https://www.linkedin.com/oauth/v2/accessToken", {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/x-www-form-urlencoded"
-                    },
-                    body: new URLSearchParams({
-                        grant_type: "authorization_code",
-                        code: payload.code,
-                        redirect_uri: payload.redirectUri,
-                        client_id: config.clientId,
-                        client_secret: config.clientSecret
-                    })
-                });
-
-                if (!tokenResponse.ok) {
-                    const errBody = await tokenResponse.text();
-                    logger.error("Failed to get LinkedIn access token", { detail: errBody });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string; id_token?: string };
-                const accessToken = tokenData.access_token;
-
-                // Fetch User Info using OIDC userinfo endpoint
-                const profileResponse = await fetch("https://api.linkedin.com/v2/userinfo", {
-                    headers: {
-                        "Authorization": `Bearer ${accessToken}`
-                    }
-                });
-
-                if (!profileResponse.ok) {
-                    const errBody = await profileResponse.text();
-                    logger.error("Failed to get LinkedIn user info", { detail: errBody });
-                    return null;
-                }
-
-                const profileData = await profileResponse.json() as {
-                    sub: string;
-                    email: string;
-                    name?: string;
-                    picture?: string;
-                    email_verified?: boolean;
-                };
-
-                return {
-                    providerId: profileData.sub,
-                    email: profileData.email,
-                    displayName: profileData.name || null,
-                    photoUrl: profileData.picture || null,
-                    emailVerified: profileData.email_verified === true
-                };
-            } catch (error) {
-                logger.error("LinkedIn OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/magic-link-routes.ts

@@ -1,167 +0,0 @@
-import { Hono } from "hono";
-import type { AuthModuleConfig } from "./routes";
-import type { ResolvedAuthHooks } from "./auth-hooks";
-import type { HonoEnv } from "../api/types";
-import { ApiError } from "../api/errors";
-import { generateSecureToken, hashToken } from "./admin-user-ops";
-import { getMagicLinkTemplate } from "../email/templates";
-import { strictAuthLimiter } from "./rate-limiter";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-
-/**
- * Magic link token expiry (15 minutes from now)
- */
-function getMagicLinkExpiry(): Date {
-    return new Date(Date.now() + 15 * 60 * 1000);
-}
-
-/**
- * Mount magic link routes onto the auth router.
- *
- * Follows the same delegation pattern as `mountMfaRoutes()` and `mountSessionRoutes()`.
- */
-export function mountMagicLinkRoutes(deps: {
-    router: Hono<HonoEnv>;
-    config: AuthModuleConfig;
-    ops: ResolvedAuthHooks;
-    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
-    buildAuthResponse: (
-        user: { id: string; email: string; displayName?: string | null; photoUrl?: string | null; metadata?: Record<string, unknown> | null },
-        roleIds: string[],
-        accessToken: string,
-        refreshToken: string
-    ) => unknown;
-    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{ roleIds: string[]; accessToken: string; refreshToken: string }>;
-    applyTransformHook: (
-        response: AuthResponsePayload,
-        method: TransformAuthResponseContext["method"],
-        request: Request,
-        userId: string
-    ) => Promise<AuthResponsePayload>;
-}) {
-    const { router, config, ops, parseBody, buildAuthResponse, createSessionAndTokens, applyTransformHook } = deps;
-    const { authRepo, emailService, emailConfig } = config;
-
-    const magicLinkSchema = z.object({
-        email: z.string().email("Invalid email address").max(255)
-    });
-
-    const verifyMagicLinkSchema = z.object({
-        token: z.string().min(1, "Token is required")
-    });
-
-    function isEmailConfigured(): boolean {
-        return !!(emailService && emailService.isConfigured());
-    }
-
-    /**
-     * POST /auth/magic-link
-     * Request a magic link email
-     */
-    router.post("/magic-link", strictAuthLimiter, async (c) => {
-        const { email } = parseBody(magicLinkSchema, await c.req.json());
-
-        // Require email service
-        if (!isEmailConfigured()) {
-            throw ApiError.serviceUnavailable("Email service not configured. Magic link login is not available.", "EMAIL_NOT_CONFIGURED");
-        }
-
-        // Always return success (security: don't reveal if email exists)
-        const user = await authRepo.getUserByEmail(email);
-
-        if (user) {
-            // Call beforeLogin hook if provided (throw to reject)
-            if (ops.beforeLogin) {
-                await ops.beforeLogin(email, "magic-link");
-            }
-
-            // Generate magic link token
-            const token = generateSecureToken();
-            const tokenHash = hashToken(token);
-            const expiresAt = getMagicLinkExpiry();
-
-            await authRepo.createMagicLinkToken(user.id, tokenHash, expiresAt);
-
-            // Build magic link URL
-            const baseUrl = emailConfig?.magicLinkUrl || emailConfig?.resetPasswordUrl || "";
-            const magicLinkUrl = `${baseUrl}/auth/magic-link?token=${token}`;
-
-            // Get email template
-            const appName = emailConfig?.appName || "Rebase";
-            const templateFn = emailConfig?.templates?.magicLink;
-            const emailContent = templateFn
-                ? templateFn(magicLinkUrl, { email: user.email, displayName: user.displayName })
-                : getMagicLinkTemplate(magicLinkUrl, { email: user.email, displayName: user.displayName }, appName);
-
-            // Send email
-            try {
-                await emailService!.send({
-                    to: user.email,
-                    subject: emailContent.subject,
-                    html: emailContent.html,
-                    text: emailContent.text
-                });
-            } catch (emailError: unknown) {
-                logger.error("Failed to send magic link email", { error: emailError instanceof Error ? emailError.message : emailError });
-                // Don't reveal email sending failure to client
-            }
-        }
-
-        // Always return success
-        return c.json({
-            success: true,
-            message: "If an account with that email exists, a magic link has been sent."
-        });
-    });
-
-    /**
-     * POST /auth/magic-link/verify
-     * Verify magic link token and create session
-     */
-    router.post("/magic-link/verify", strictAuthLimiter, async (c) => {
-        const { token } = parseBody(verifyMagicLinkSchema, await c.req.json());
-
-        // Find valid token
-        const tokenHash = hashToken(token);
-        const storedToken = await authRepo.findValidMagicLinkToken(tokenHash);
-
-        if (!storedToken) {
-            throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
-        }
-
-        // Mark token as used (one-time use)
-        await authRepo.markMagicLinkTokenUsed(tokenHash);
-
-        // Get user
-        const user = await authRepo.getUserById(storedToken.userId);
-        if (!user) {
-            throw ApiError.badRequest("Invalid or expired magic link", "INVALID_TOKEN");
-        }
-
-        // Clicking a magic link proves email ownership — auto-verify
-        if (!user.emailVerified) {
-            await authRepo.setEmailVerified(user.id, true);
-            user.emailVerified = true;
-        }
-
-        // Create session
-        const { roleIds, accessToken, refreshToken } = await createSessionAndTokens(
-            user.id,
-            c.req.header("user-agent") || "unknown",
-            c.req.header("x-forwarded-for") || "unknown"
-        );
-
-        // Fire onAuthenticated hook (fire-and-forget)
-        if (ops.onAuthenticated) {
-            ops.onAuthenticated(user, "magic-link").catch(err => {
-                logger.error("[AuthHooks] onAuthenticated error", { error: err instanceof Error ? err.message : err });
-            });
-        }
-
-        const authResponse = buildAuthResponse(user, roleIds, accessToken, refreshToken) as AuthResponsePayload;
-        const finalResponse = await applyTransformHook(authResponse, "magic-link", c.req.raw, user.id);
-        return c.json(finalResponse);
-    });
-}

package/src/auth/mfa-crypto.ts

@@ -1,91 +0,0 @@
-/**
- * Envelope encryption for TOTP secrets using AES-256-GCM.
- *
- * - Derives a 32-byte key via SHA-256 from `MFA_ENCRYPTION_KEY` or `JWT_SECRET`.
- * - Generates a random 12-byte IV per encryption call.
- * - Returns ciphertexts in the format `iv_hex:authTag_hex:ciphertext_hex`.
- *
- * @module
- */
-
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
-import { logger } from "../utils/logger";
-
-const ALGORITHM = "aes-256-gcm";
-const IV_BYTES = 12;
-const AUTH_TAG_LENGTH = 16;
-
-/**
- * Resolve the raw key string from environment variables.
- *
- * Prefers `MFA_ENCRYPTION_KEY`; falls back to `JWT_SECRET` with a warning.
- * Throws if neither is set.
- */
-function resolveKeyString(): string {
-    const explicit = process.env.MFA_ENCRYPTION_KEY;
-    if (explicit) {
-        return explicit;
-    }
-
-    const fallback = process.env.JWT_SECRET;
-    if (fallback) {
-        logger.warn(
-            "[MFA-Crypto] MFA_ENCRYPTION_KEY is not set — falling back to JWT_SECRET. " +
-                "Set a dedicated MFA_ENCRYPTION_KEY for production."
-        );
-        return fallback;
-    }
-
-    throw new Error(
-        "Cannot encrypt TOTP secret: neither MFA_ENCRYPTION_KEY nor JWT_SECRET is configured."
-    );
-}
-
-/**
- * Derive a deterministic 32-byte AES-256 key from the raw secret string.
- */
-function deriveKey(raw: string): Buffer {
-    return createHash("sha256").update(raw).digest();
-}
-
-/**
- * Encrypt a plaintext TOTP secret.
- *
- * @param plaintext - The Base32 TOTP secret to encrypt.
- * @returns A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
- */
-export function encryptTotpSecret(plaintext: string): string {
-    const key = deriveKey(resolveKeyString());
-    const iv = randomBytes(IV_BYTES);
-
-    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-
-    return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
-}
-
-/**
- * Decrypt a previously encrypted TOTP secret.
- *
- * @param ciphertext - A string in the format `iv_hex:authTag_hex:ciphertext_hex`.
- * @returns The original Base32 TOTP secret.
- */
-export function decryptTotpSecret(ciphertext: string): string {
-    const parts = ciphertext.split(":");
-    if (parts.length !== 3) {
-        throw new Error("Invalid encrypted TOTP secret format — expected iv:authTag:ciphertext");
-    }
-
-    const [ivHex, authTagHex, encryptedHex] = parts;
-    const key = deriveKey(resolveKeyString());
-    const iv = Buffer.from(ivHex, "hex");
-    const authTag = Buffer.from(authTagHex, "hex");
-    const encrypted = Buffer.from(encryptedHex, "hex");
-
-    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
-    decipher.setAuthTag(authTag);
-
-    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
-    return decrypted.toString("utf8");
-}

package/src/auth/mfa-routes.ts

@@ -1,323 +0,0 @@
-import { Hono } from "hono";
-import { z } from "zod";
-import { ApiError } from "../api/errors";
-import { HonoEnv } from "../api/types";
-import { requireAuth } from "./middleware";
-import { logger } from "../utils/logger";
-import {
-    generateTotpSecret,
-    verifyTotp,
-    base32Decode,
-    generateRecoveryCodes,
-    hashRecoveryCode
-} from "./mfa";
-import { encryptTotpSecret, decryptTotpSecret } from "./mfa-crypto";
-import {
-    generateAccessToken,
-    generateRefreshToken,
-    hashRefreshToken,
-    getRefreshTokenExpiry,
-    getAccessTokenExpiry,
-    type AccessTokenPayload
-} from "./jwt";
-import type { AuthModuleConfig } from "./routes";
-import { resolveAuthHooks } from "./auth-hooks";
-import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-
-export function mountMfaRoutes(
-    router: Hono<HonoEnv>,
-    config: AuthModuleConfig,
-    ops: ReturnType<typeof resolveAuthHooks>,
-    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T,
-    applyTransformHook?: (
-        response: AuthResponsePayload,
-        method: TransformAuthResponseContext["method"],
-        request: Request,
-        userId: string
-    ) => Promise<AuthResponsePayload>
-): void {
-    const authRepo = config.authRepo;
-    const emailConfig = config.emailConfig;
-
-    /**
-     * POST /auth/mfa/enroll
-     * Start MFA enrollment: generate TOTP secret and recovery codes
-     */
-    router.post("/mfa/enroll", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;
-        const friendlyName = typeof body.friendlyName === "string" ? body.friendlyName : undefined;
-        const issuer = typeof body.issuer === "string" ? body.issuer : emailConfig?.appName || "Rebase";
-
-        // Get user for account name
-        const user = await authRepo.getUserById(userCtx.userId);
-        if (!user) {
-            throw ApiError.notFound("User not found");
-        }
-
-        // Generate TOTP secret
-        const { secret, uri } = generateTotpSecret(issuer, user.email);
-
-        // Encrypt the TOTP secret before storage (AES-256-GCM envelope encryption)
-        const encryptedSecret = encryptTotpSecret(secret);
-        const factor = await authRepo.createMfaFactor(
-            user.id,
-            "totp",
-            encryptedSecret,
-            friendlyName
-        );
-
-        // Generate recovery codes
-        const codes = generateRecoveryCodes(10);
-        const codeHashes = codes.map(hashRecoveryCode);
-        await authRepo.createRecoveryCodes(user.id, codeHashes);
-
-        return c.json(
-            {
-                factor: {
-                    id: factor.id,
-                    factorType: factor.factorType,
-                    friendlyName: factor.friendlyName
-                },
-                totp: {
-                    secret,
-                    uri,
-                    qrUri: uri
-                },
-                recoveryCodes: codes
-            },
-            201
-        );
-    });
-
-    /**
-     * POST /auth/mfa/verify
-     * Verify TOTP code to complete MFA enrollment
-     */
-    router.post("/mfa/verify", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const verifySchema = z.object({
-            factorId: z.string().min(1, "Factor ID is required"),
-            code: z.string().length(6, "Code must be 6 digits")
-        });
-        const { factorId, code } = parseBody(verifySchema, await c.req.json());
-
-        // Get the factor
-        const factor = await authRepo.getMfaFactorById(factorId);
-        if (!factor || factor.userId !== userCtx.userId) {
-            throw ApiError.notFound("MFA factor not found");
-        }
-
-        if (factor.verified) {
-            throw ApiError.badRequest("Factor is already verified", "ALREADY_VERIFIED");
-        }
-
-        // Decrypt and verify the TOTP code
-        const decryptedSecret = decryptTotpSecret(factor.secretEncrypted);
-        const secretBuffer = base32Decode(decryptedSecret);
-        const isValid = verifyTotp(secretBuffer, code);
-
-        if (!isValid) {
-            throw ApiError.unauthorized("Invalid TOTP code", "INVALID_CODE");
-        }
-
-        // Mark factor as verified
-        await authRepo.verifyMfaFactor(factorId);
-
-        return c.json({
-            success: true,
-            message: "MFA factor verified and enrolled"
-        });
-    });
-
-    /**
-     * POST /auth/mfa/challenge
-     * Create an MFA challenge during login (user has MFA enrolled)
-     */
-    router.post("/mfa/challenge", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const challengeSchema = z.object({
-            factorId: z.string().min(1, "Factor ID is required")
-        });
-        const { factorId } = parseBody(challengeSchema, await c.req.json());
-
-        // Verify the factor belongs to this user and is verified
-        const factor = await authRepo.getMfaFactorById(factorId);
-        if (!factor || factor.userId !== userCtx.userId) {
-            throw ApiError.notFound("MFA factor not found");
-        }
-
-        if (!factor.verified) {
-            throw ApiError.badRequest("MFA factor is not yet verified", "FACTOR_NOT_VERIFIED");
-        }
-
-        const ipAddress = c.req.header("x-forwarded-for") || "unknown";
-        const challenge = await authRepo.createMfaChallenge(factorId, ipAddress);
-
-        return c.json({
-            challengeId: challenge.id,
-            factorId: challenge.factorId,
-            expiresAt: new Date(Date.now() + 5 * 60 * 1000).toISOString()
-        });
-    });
-
-    /**
-     * POST /auth/mfa/challenge/verify
-     * Verify a TOTP code for an active challenge, upgrade aal1 → aal2
-     */
-    router.post("/mfa/challenge/verify", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const challengeVerifySchema = z.object({
-            challengeId: z.string().min(1, "Challenge ID is required"),
-            code: z.string().min(1, "Code is required")
-        });
-        const { challengeId, code } = parseBody(challengeVerifySchema, await c.req.json());
-
-        // Find the challenge
-        const challenge = await authRepo.getMfaChallengeById(challengeId);
-        if (!challenge) {
-            throw ApiError.badRequest("Invalid or expired challenge", "INVALID_CHALLENGE");
-        }
-
-        // Get the factor and verify ownership
-        const factor = await authRepo.getMfaFactorById(challenge.factorId);
-        if (!factor || factor.userId !== userCtx.userId) {
-            throw ApiError.notFound("MFA factor not found");
-        }
-
-        // Try TOTP verification first (standard 6-digit codes)
-        const decryptedSecret = decryptTotpSecret(factor.secretEncrypted);
-        const secretBuffer = base32Decode(decryptedSecret);
-        let isValid = verifyTotp(secretBuffer, code);
-
-        // Fall back to recovery code verification if TOTP didn't match
-        if (!isValid) {
-            const codeHash = hashRecoveryCode(code);
-            isValid = await authRepo.useRecoveryCode(userCtx.userId, codeHash);
-        }
-
-        if (!isValid) {
-            throw ApiError.unauthorized("Invalid verification code", "INVALID_CODE");
-        }
-
-        // Mark challenge as verified
-        await authRepo.verifyMfaChallenge(challengeId);
-
-        // Generate new access token with aal2
-        const roles = await authRepo.getUserRoles(userCtx.userId);
-        const roleIds = roles.map((r) => r.id);
-        const accessToken = generateAccessToken(userCtx.userId, roleIds, "aal2");
-        const refreshToken = generateRefreshToken();
-
-        // Create new refresh token
-        await authRepo.createRefreshToken(
-            userCtx.userId,
-            hashRefreshToken(refreshToken),
-            getRefreshTokenExpiry(),
-            c.req.header("user-agent") || "unknown",
-            c.req.header("x-forwarded-for") || "unknown"
-        );
-
-        // Fire onMfaVerified hook
-        if (ops.onMfaVerified) {
-            ops.onMfaVerified(userCtx.userId, factor.id).catch((err) => {
-                logger.error("[AuthHooks] onMfaVerified error", {
-                    error: err instanceof Error ? err.message : err
-                });
-            });
-        }
-
-        let mfaResponse: AuthResponsePayload = {
-            tokens: {
-                accessToken,
-                refreshToken,
-                accessTokenExpiresAt: getAccessTokenExpiry()
-            }
-        };
-        if (applyTransformHook) {
-            mfaResponse = await applyTransformHook(mfaResponse, "mfa", c.req.raw, userCtx.userId);
-        }
-        return c.json(mfaResponse);
-    });
-
-    /**
-     * GET /auth/mfa/factors
-     * List enrolled MFA factors for the current user
-     */
-    router.get("/mfa/factors", requireAuth, async (c) => {
-        const userCtx = c.get("user") as { userId: string; roles?: string[] } | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        const factors = await authRepo.getMfaFactors(userCtx.userId);
-        return c.json({
-            factors: factors.map((f) => ({
-                id: f.id,
-                factorType: f.factorType,
-                friendlyName: f.friendlyName,
-                verified: f.verified,
-                createdAt: f.createdAt
-            }))
-        });
-    });
-
-    /**
-     * DELETE /auth/mfa/unenroll
-     * Remove an MFA factor
-     */
-    router.delete("/mfa/unenroll", requireAuth, async (c) => {
-        const userCtx = c.get("user") as AccessTokenPayload | undefined;
-        if (!userCtx) {
-            throw ApiError.unauthorized("Not authenticated");
-        }
-
-        // Require aal2 (MFA-verified session) to unenroll MFA factors
-        if (userCtx.aal !== "aal2") {
-            throw ApiError.forbidden(
-                "MFA verification required to unenroll. Please re-authenticate with your second factor.",
-                "AAL2_REQUIRED"
-            );
-        }
-
-        const unenrollSchema = z.object({
-            factorId: z.string().min(1, "Factor ID is required")
-        });
-        const { factorId } = parseBody(unenrollSchema, await c.req.json());
-
-        // Verify ownership
-        const factor = await authRepo.getMfaFactorById(factorId);
-        if (!factor || factor.userId !== userCtx.userId) {
-            throw ApiError.notFound("MFA factor not found");
-        }
-
-        await authRepo.deleteMfaFactor(factorId, userCtx.userId);
-
-        // If no more verified factors, clean up recovery codes
-        const hasFactors = await authRepo.hasVerifiedMfaFactors(userCtx.userId);
-        if (!hasFactors) {
-            await authRepo.deleteAllRecoveryCodes(userCtx.userId);
-        }
-
-        return c.json({
-            success: true,
-            message: "MFA factor removed"
-        });
-    });
-}