@rebasepro/server-core 0.7.0 → 0.9.0

package/src/auth/mfa.ts

@@ -1,161 +0,0 @@
-/**
- * TOTP (Time-based One-Time Password) implementation.
- *
- * Pure Node.js crypto implementation — no external dependencies required.
- * Implements RFC 6238 (TOTP) and RFC 4226 (HOTP).
- */
-
-import { createHmac, randomBytes, createHash } from "crypto";
-
-// ─── Base32 Encoding/Decoding ────────────────────────────────────────────────
-
-const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-
-/**
- * Encode a Buffer to Base32 string (RFC 4648)
- */
-export function base32Encode(buffer: Buffer): string {
-    let bits = 0;
-    let value = 0;
-    let output = "";
-
-    for (let i = 0; i < buffer.length; i++) {
-        value = (value << 8) | buffer[i];
-        bits += 8;
-
-        while (bits >= 5) {
-            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
-            bits -= 5;
-        }
-    }
-
-    if (bits > 0) {
-        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
-    }
-
-    return output;
-}
-
-/**
- * Decode a Base32 string to Buffer
- */
-export function base32Decode(encoded: string): Buffer {
-    const cleanInput = encoded.replace(/=+$/, "").toUpperCase();
-    const bytes: number[] = [];
-    let bits = 0;
-    let value = 0;
-
-    for (let i = 0; i < cleanInput.length; i++) {
-        const index = BASE32_ALPHABET.indexOf(cleanInput[i]);
-        if (index === -1) continue;
-
-        value = (value << 5) | index;
-        bits += 5;
-
-        if (bits >= 8) {
-            bytes.push((value >>> (bits - 8)) & 255);
-            bits -= 8;
-        }
-    }
-
-    return Buffer.from(bytes);
-}
-
-// ─── HOTP/TOTP ───────────────────────────────────────────────────────────────
-
-/**
- * Generate an HOTP value per RFC 4226
- */
-function generateHotp(secret: Buffer, counter: bigint): string {
-    const hmac = createHmac("sha1", secret);
-    const counterBuffer = Buffer.alloc(8);
-    counterBuffer.writeBigInt64BE(counter);
-    hmac.update(counterBuffer);
-    const hash = hmac.digest();
-
-    const offset = hash[hash.length - 1] & 0x0f;
-    const code =
-        (((hash[offset] & 0x7f) << 24) |
-            (hash[offset + 1] << 16) |
-            (hash[offset + 2] << 8) |
-            hash[offset + 3]) %
-        1000000;
-
-    return code.toString().padStart(6, "0");
-}
-
-/**
- * Generate a TOTP value for the current time step
- */
-export function generateTotp(secret: Buffer, timeStep = 30): string {
-    const counter = BigInt(Math.floor(Date.now() / 1000 / timeStep));
-    return generateHotp(secret, counter);
-}
-
-/**
- * Verify a TOTP token with a configurable time window
- *
- * @param secret - The shared secret as a Buffer
- * @param token - The 6-digit TOTP code to verify
- * @param window - Number of time steps to check on each side (default: 1)
- * @returns true if the token is valid within the window
- */
-export function verifyTotp(secret: Buffer, token: string, window = 1): boolean {
-    const timeStep = 30;
-    const counter = BigInt(Math.floor(Date.now() / 1000 / timeStep));
-    for (let i = -window; i <= window; i++) {
-        if (generateHotp(secret, counter + BigInt(i)) === token) {
-            return true;
-        }
-    }
-    return false;
-}
-
-// ─── Secret Generation ───────────────────────────────────────────────────────
-
-/**
- * Generate a new TOTP secret and return the setup information
- *
- * @param issuer - The issuer name (app name) for the QR code
- * @param accountName - The account identifier (usually email)
- * @returns Object with base32 secret and otpauth URI
- */
-export function generateTotpSecret(issuer: string, accountName: string): {
-    secret: string;
-    uri: string;
-} {
-    // Generate a 20-byte random secret (160 bits, recommended by RFC 4226)
-    const secretBuffer = randomBytes(20);
-    const secret = base32Encode(secretBuffer);
-
-    // Build otpauth:// URI for QR code generation
-    const encodedIssuer = encodeURIComponent(issuer);
-    const encodedAccount = encodeURIComponent(accountName);
-    const uri = `otpauth://totp/${encodedIssuer}:${encodedAccount}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
-
-    return { secret,
-uri };
-}
-
-// ─── Recovery Codes ──────────────────────────────────────────────────────────
-
-/**
- * Generate a set of one-time recovery codes
- *
- * @param count - Number of recovery codes to generate (default: 10)
- * @returns Array of formatted recovery code strings (e.g. "A1B2C-D3E4F")
- */
-export function generateRecoveryCodes(count = 10): string[] {
-    return Array.from({ length: count }, () => {
-        const raw = randomBytes(5).toString("hex").toUpperCase();
-        const parts = raw.match(/.{1,5}/g);
-        return parts ? parts.join("-") : raw;
-    });
-}
-
-/**
- * Hash a recovery code for storage
- */
-export function hashRecoveryCode(code: string): string {
-    return createHash("sha256").update(code.replace(/-/g, "").toUpperCase()).digest("hex");
-}

package/src/auth/microsoft-oauth.ts

@@ -1,90 +0,0 @@
-import type { OAuthProvider, OAuthProviderProfile } from "./interfaces";
-import { z } from "zod";
-import { logger } from "../utils/logger";
-
-/**
- * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
- *
- * Supports both personal Microsoft accounts and work/school (Azure AD) accounts
- * via the "common" tenant endpoint. Uses the authorization code flow.
- */
-export function createMicrosoftProvider(config: {
-    clientId: string;
-    clientSecret: string;
-    /** Tenant ID. Defaults to "common" which allows both personal and organizational accounts. */
-    tenantId?: string;
-}): OAuthProvider<{ code: string; redirectUri: string }> {
-    const tenantId = config.tenantId || "common";
-
-    return {
-        id: "microsoft",
-        schema: z.object({
-            code: z.string().min(1, "Auth code is required"),
-            redirectUri: z.string().url("Valid redirect URI is required")
-        }),
-        verify: async (payload: { code: string; redirectUri: string }): Promise<OAuthProviderProfile | null> => {
-            try {
-                // Exchange code for access token
-                const tokenResponse = await fetch(
-                    `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`,
-                    {
-                        method: "POST",
-                        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                        body: new URLSearchParams({
-                            client_id: config.clientId,
-                            client_secret: config.clientSecret,
-                            code: payload.code,
-                            redirect_uri: payload.redirectUri,
-                            grant_type: "authorization_code",
-                            scope: "openid profile email User.Read"
-                        })
-                    }
-                );
-
-                if (!tokenResponse.ok) {
-                    logger.error("Failed to get Microsoft access token", { detail: await tokenResponse.text() });
-                    return null;
-                }
-
-                const tokenData = await tokenResponse.json() as { access_token: string };
-                const accessToken = tokenData.access_token;
-
-                // Fetch user profile from Microsoft Graph
-                const profileResponse = await fetch("https://graph.microsoft.com/v1.0/me", {
-                    headers: { "Authorization": `Bearer ${accessToken}` }
-                });
-
-                if (!profileResponse.ok) {
-                    logger.error("Failed to get Microsoft user info", { detail: await profileResponse.text() });
-                    return null;
-                }
-
-                const profileData = await profileResponse.json() as {
-                    id: string;
-                    displayName?: string | null;
-                    mail?: string | null;
-                    userPrincipalName?: string | null;
-                };
-
-                const email = profileData.mail || profileData.userPrincipalName;
-                if (!email) {
-                    logger.error("Microsoft user has no email");
-                    return null;
-                }
-
-                // Attempt to fetch profile photo URL (Graph returns binary, not a URL).
-                // We skip this and let the frontend use the Microsoft Graph photo endpoint.
-                return {
-                    providerId: profileData.id,
-                    email,
-                    displayName: profileData.displayName || null,
-                    photoUrl: null,
-                    emailVerified: true
-                };
-            } catch (error) {
-                logger.error("Microsoft OAuth error", { error: error });
-                return null;
-            }
-        }
-    };
-}

package/src/auth/middleware.ts

@@ -1,369 +0,0 @@
-import { MiddlewareHandler, Context } from "hono";
-import { DataDriver } from "@rebasepro/types";
-import { verifyAccessToken, AccessTokenPayload } from "./jwt";
-import { HonoEnv } from "../api/types";
-import { scopeDataDriver } from "./rls-scope";
-import { safeCompare } from "./crypto-utils";
-import { isApiKeyToken, validateApiKey } from "./api-keys/api-key-middleware";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
-import { logger } from "../utils/logger";
-
-/**
- * Result from a custom auth validator.
- * - `false`/`null`/`undefined` = not authenticated
- * - `true` = authenticated as default user
- * - object with `userId` or `uid` = authenticated with user info
- */
-export type AuthResult = boolean | null | undefined | { userId?: string; uid?: string; roles?: string[]; [key: string]: unknown };
-
-/**
- * Options for creating an auth middleware via createAuthMiddleware()
- */
-export interface AuthMiddlewareOptions {
-    /** DataDriver to scope via withAuth() for RLS */
-    driver: DataDriver;
-    /**
-     * Optional per-request driver resolver for multi-data-source backends.
-     * Given the request context, returns the unscoped delegate to use (e.g.
-     * Postgres vs Mongo, picked by the request's collection data source).
-     * When omitted, `driver` is used for every request.
-     */
-    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
-    /**
-     * If true, return 401 when no valid token is present.
-     *
-     * **Defaults to `true` (secure by default).** Set to `false` only for
-     * intentionally public endpoints where access control is fully delegated
-     * to Postgres Row-Level Security policies.
-     */
-    requireAuth?: boolean;
-    /** Optional custom validator (for non-JWT auth, e.g. Firebase Auth) */
-    validator?: (c: Context<HonoEnv>) => Promise<AuthResult>;
-    /**
-     * A static secret key for server-to-server / script authentication.
-     *
-     * When a request sends `Authorization: Bearer <key>` and the key matches
-     * this value, the request is granted admin-level access (uid: `service`,
-     * roles: `["admin"]`) **without** JWT verification. The driver is scoped
-     * via `withAuth()` with the service identity.
-     *
-     * This is the Rebase equivalent of a Firebase Service Account key.
-     * Set via `REBASE_SERVICE_KEY` in `.env` and pass through the backend config.
-     *
-     * **Security:** The comparison uses constant-time equality to prevent
-     * timing attacks. The key must be at least 32 characters.
-     */
-    serviceKey?: string;
-    /**
-     * API key store for authenticating `rk_` prefixed tokens.
-     * When set, tokens starting with `rk_` are validated against the
-     * database instead of being treated as JWTs.
-     */
-    apiKeyStore?: ApiKeyStore;
-}
-
-/**
- * Hono middleware that requires a valid JWT token
- * Returns 401 if token is missing or invalid
- */
-export const requireAuth: MiddlewareHandler<HonoEnv> = async (
-    c,
-    next
-) => {
-    const authHeader = c.req.header("authorization");
-    const queryToken = c.req.query("token");
-    const hasBearer = authHeader && authHeader.startsWith("Bearer ");
-
-    if (!hasBearer && !queryToken) {
-        return c.json({
-            error: {
-                message: "Authorization header or token query parameter missing or invalid",
-                code: "UNAUTHORIZED"
-            }
-        }, 401);
-    }
-
-    const token = hasBearer ? authHeader!.substring(7) : queryToken!;
-    const payload = verifyAccessToken(token);
-
-    if (!payload) {
-        return c.json({
-            error: {
-                message: "Invalid or expired token",
-                code: "UNAUTHORIZED"
-            }
-        }, 401);
-    }
-
-    c.set("user", payload);
-    return next();
-};
-
-/**
- * Factory that creates a requireAuth middleware with optional service key support.
- *
- * When `serviceKey` is provided, the middleware will check if the Bearer token
- * matches the service key using constant-time comparison. If it matches, the
- * request is authenticated as a service user with admin privileges.
- *
- * This allows admin routes (which use standalone requireAuth + requireAdmin)
- * to be accessed via service keys for scripts and server-to-server calls.
- */
-export function createRequireAuth(options?: { serviceKey?: string }): MiddlewareHandler<HonoEnv> {
-    if (!options?.serviceKey) return requireAuth;
-
-    const key = options.serviceKey;
-    return async (c, next) => {
-        const authHeader = c.req.header("authorization");
-        const queryToken = c.req.query("token");
-        const hasBearer = authHeader && authHeader.startsWith("Bearer ");
-
-        if (!hasBearer && !queryToken) {
-            return c.json({
-                error: {
-                    message: "Authorization header or token query parameter missing or invalid",
-                    code: "UNAUTHORIZED"
-                }
-            }, 401);
-        }
-
-        const token = hasBearer ? authHeader!.substring(7) : queryToken!;
-
-        // Check service key first (constant-time comparison)
-        if (safeCompare(token, key)) {
-            c.set("user", { userId: "service",
-roles: ["admin"] } as AccessTokenPayload);
-            return next();
-        }
-
-        // Fall back to JWT verification
-        const payload = verifyAccessToken(token);
-
-        if (!payload) {
-            return c.json({
-                error: {
-                    message: "Invalid or expired token",
-                    code: "UNAUTHORIZED"
-                }
-            }, 401);
-        }
-
-        c.set("user", payload);
-        return next();
-    };
-}
-
-/**
- * Middleware that requires the user to have an admin or schema-admin role.
- * Must be used AFTER requireAuth or on a route where user is guaranteed.
- */
-export const requireAdmin: MiddlewareHandler<HonoEnv> = async (
-    c,
-    next
-) => {
-    const user = c.get("user");
-    if (!user) {
-        return c.json({
-            error: {
-                message: "User not authenticated. requireAuth middleware is missing?",
-                code: "UNAUTHORIZED"
-            }
-        }, 401);
-    }
-
-    const roles = (typeof user === "object" && user !== null && "roles" in user) ? (user.roles || []) : [];
-    const isAdmin = roles.some((role: string) => {
-        return role === "admin" || role === "schema-admin";
-    });
-
-    if (!isAdmin) {
-        return c.json({
-            error: {
-                message: "Admin privileges required for this operation",
-                code: "FORBIDDEN"
-            }
-        }, 403);
-    }
-
-    return next();
-};
-
-
-/**
- * Middleware that optionally extracts user from JWT
- * Does not return 401 if token is missing - allows anonymous access
- */
-export const optionalAuth: MiddlewareHandler<HonoEnv> = async (
-    c,
-    next
-) => {
-    const authHeader = c.req.header("authorization");
-    const queryToken = c.req.query("token");
-    const hasBearer = authHeader && authHeader.startsWith("Bearer ");
-
-    if (hasBearer || queryToken) {
-        const token = hasBearer ? authHeader!.substring(7) : queryToken!;
-        const payload = verifyAccessToken(token);
-        if (payload) {
-            c.set("user", payload);
-        }
-    }
-
-    return next();
-};
-
-/**
- * Extract user from token - for WebSocket authentication
- */
-export function extractUserFromToken(token: string): AccessTokenPayload | null {
-    return verifyAccessToken(token);
-}
-
-/**
- * Create a configurable auth middleware that handles:
- * 1. Token extraction (via custom validator or JWT Bearer token)
- * 2. RLS-scoped DataDriver via withAuth()
- * 3. Enforcement (401 when requireAuth is true and no user)
- *
- * **Secure by default:** `requireAuth` defaults to `true`. Anonymous
- * access is only allowed when the developer explicitly opts out by
- * setting `requireAuth: false`, indicating that Postgres RLS policies
- * fully control access.
- *
- * **Fail-closed:** The raw unscoped driver is never placed in the
- * request context. Every code path either scopes via `withAuth()` or
- * rejects the request. This prevents silent RLS bypass.
- *
- * This is the single source of truth for HTTP auth in Rebase.
- * Use this instead of manually parsing tokens in route handlers.
- */
-
-export function createAuthMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler<HonoEnv> {
-    const { driver: baseDriver, resolveDriver, requireAuth: enforceAuth = true, validator, serviceKey, apiKeyStore } = options;
-
-    return async (c, next) => {
-        // Pick the per-request delegate (multi-data-source) before scoping.
-        const driver = resolveDriver ? resolveDriver(c) : baseDriver;
-        if (validator) {
-            // Custom validator path (e.g., Firebase Auth, API keys)
-            try {
-                const authResult = await validator(c);
-                if (authResult && typeof authResult === "object") {
-                    const id = ("userId" in authResult ? authResult.userId : undefined)
-                        || ("uid" in authResult ? authResult.uid : undefined);
-                    if (id) {
-                        const roles = authResult.roles || [];
-                        c.set("user", { userId: id,
-roles });
-                        const user = { uid: id,
-roles,
-...authResult };
-                        c.set("driver", await scopeDataDriver(driver, user));
-                    } else {
-                        // Validator returned an object but without an ID — scope as anon
-                        c.set("driver", await scopeDataDriver(driver, { uid: "anon",
-roles: ["anon"] }));
-                    }
-                } else if (authResult === true) {
-                    c.set("user", { userId: "default",
-roles: [] });
-                    c.set("driver", await scopeDataDriver(driver, { uid: "default",
-roles: [] }));
-                } else {
-                    // Not authenticated — scope as anon so RLS can evaluate.
-                    // Fail closed: if anon scoping fails, reject instead of
-                    // falling back to the raw driver.
-                    c.set("driver", await scopeDataDriver(driver, { uid: "anon",
-roles: ["anon"] }));
-                }
-            } catch (error) {
-                return c.json({ error: { message: "Unauthorized",
-code: "UNAUTHORIZED" } }, 401);
-            }
-        } else {
-            // Default JWT path (with optional service key support)
-            const authHeader = c.req.header("authorization");
-            const queryToken = c.req.query("token");
-            const hasBearer = authHeader && authHeader.startsWith("Bearer ");
-
-            if (hasBearer || queryToken) {
-                const token = hasBearer ? authHeader!.substring(7) : queryToken!;
-
-                // ── Service Key check ──────────────────────────────────
-                // Check BEFORE JWT verification. Service keys are static
-                // secrets (like Firebase SA keys) that grant admin access
-                // for scripts, cron jobs, and server-to-server calls.
-                if (serviceKey && safeCompare(token, serviceKey)) {
-                    const serviceUser: AccessTokenPayload = {
-                        userId: "service",
-                        roles: ["admin"]
-                    };
-                    c.set("user", serviceUser);
-                    try {
-                        c.set("driver", await scopeDataDriver(driver, {
-                            uid: "service",
-                            roles: ["admin"]
-                        }));
-                    } catch (error) {
-                        logger.error("[AUTH] RLS scoping failed for service key", { error: error });
-                        return c.json({ error: { message: "Internal authentication error",
-code: "INTERNAL_ERROR" } }, 500);
-                    }
-                } else if (apiKeyStore && isApiKeyToken(token)) {
-                    // ── API Key verification ──────────────────────────────
-                    // Tokens starting with `rk_` are validated against the
-                    // api_keys table instead of JWT verification.
-                    const result = await validateApiKey(c, token, {
-                        store: apiKeyStore,
-                        driver
-                    });
-                    if (result !== true) {
-                        return result;
-                    }
-                } else {
-                    // ── JWT verification ───────────────────────────────────
-                    const payload = extractUserFromToken(token);
-
-                    if (payload) {
-                        c.set("user", payload);
-                        try {
-                            const user = { uid: payload.userId,
-roles: payload.roles };
-                            c.set("driver", await scopeDataDriver(driver, user));
-                        } catch (error) {
-                            // withAuth() failed for a valid token — reject (fail closed)
-                            logger.error("[AUTH] RLS scoping failed for authenticated user", { error: error });
-                            return c.json({ error: { message: "Internal authentication error",
-code: "INTERNAL_ERROR" } }, 500);
-                        }
-                    } else {
-                        // Token present but invalid — always reject.
-                        // Providing a malformed token should never grant access,
-                        // regardless of requireAuth setting.
-                        return c.json({ error: { message: "Invalid or expired token",
-code: "UNAUTHORIZED" } }, 401);
-                    }
-                }
-            } else {
-                // No token provided — scope as anon for RLS evaluation.
-                // Fail closed: if anon scoping fails, return 500 rather
-                // than silently proceeding with an unscoped driver.
-                try {
-                    c.set("driver", await scopeDataDriver(driver, { uid: "anon",
-roles: ["anon"] }));
-                } catch (error) {
-                    logger.error("[AUTH] Failed to create anon-scoped driver", { error: error });
-                    return c.json({ error: { message: "Server configuration error",
-code: "INTERNAL_ERROR" } }, 500);
-                }
-            }
-        }
-
-        if (enforceAuth && !c.get("user")) {
-            return c.json({ error: { message: "Unauthorized: Authentication required",
-code: "UNAUTHORIZED" } }, 401);
-        }
-
-        return next();
-    };
-}

package/src/auth/password.ts

@@ -1,77 +0,0 @@
-import { scrypt, randomBytes, timingSafeEqual } from "crypto";
-import { promisify } from "util";
-
-const scryptAsync = promisify(scrypt);
-
-// Scrypt parameters (recommended values for 2024+)
-const SALT_LENGTH = 32;
-const KEY_LENGTH = 64;
-const SCRYPT_PARAMS = { N: 16384,
-r: 8,
-p: 1 };
-
-export interface PasswordValidationResult {
-    valid: boolean;
-    errors: string[];
-}
-
-/**
- * Password requirements:
- * - Minimum 8 characters
- * - At least 1 uppercase letter
- * - At least 1 lowercase letter
- * - At least 1 number
- */
-export function validatePasswordStrength(password: string): PasswordValidationResult {
-    const errors: string[] = [];
-
-    if (password.length < 8) {
-        errors.push("Password must be at least 8 characters long");
-    }
-
-    if (!/[A-Z]/.test(password)) {
-        errors.push("Password must contain at least one uppercase letter");
-    }
-
-    if (!/[a-z]/.test(password)) {
-        errors.push("Password must contain at least one lowercase letter");
-    }
-
-    if (!/[0-9]/.test(password)) {
-        errors.push("Password must contain at least one number");
-    }
-
-    return {
-        valid: errors.length === 0,
-        errors
-    };
-}
-
-/**
- * Hash a password using Node's built-in scrypt
- * Returns format: salt:hash (both hex encoded)
- */
-export async function hashPassword(password: string): Promise<string> {
-    const salt = randomBytes(SALT_LENGTH);
-    const derivedKey = await scryptAsync(password, salt, KEY_LENGTH) as Buffer;
-    return `${salt.toString("hex")}:${derivedKey.toString("hex")}`;
-}
-
-/**
- * Verify a password against a scrypt hash
- * Expects format: salt:hash (both hex encoded)
- */
-export async function verifyPassword(password: string, storedHash: string): Promise<boolean> {
-    const [saltHex, hashHex] = storedHash.split(":");
-    if (!saltHex || !hashHex) {
-        return false;
-    }
-
-    const salt = Buffer.from(saltHex, "hex");
-    const storedKey = Buffer.from(hashHex, "hex");
-
-    const derivedKey = await scryptAsync(password, salt, KEY_LENGTH) as Buffer;
-
-    // Use timing-safe comparison to prevent timing attacks
-    return timingSafeEqual(derivedKey, storedKey);
-}