@remit/auth-service 0.0.16 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/auth-service",
-  "version": "0.0.16",
+  "version": "0.1.1",
   "description": "better-auth identity service for the self-host stack",
   "type": "module",
   "main": "src/index.ts",
@@ -21,6 +21,10 @@
     "./schema": {
       "types": "./src/schema/auth-schema-sqlite.ts",
       "default": "./src/schema/auth-schema-sqlite.ts"
+    },
+    "./people": {
+      "types": "./src/people.ts",
+      "default": "./src/people.ts"
     }
   },
   "scripts": {
@@ -38,7 +42,11 @@
     "better-sqlite3": "^12.11.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
-    "@types/better-sqlite3": "^7.6.13"
+    "@types/better-sqlite3": "^7.6.13",
+    "@remit/data-ports": "*",
+    "@remit/drizzle-sqlite-schema": "*",
+    "@remit/api-openapi-types": "*",
+    "@remit/domain-enums": "*"
   },
   "license": "MIT",
   "publishConfig": {

package/src/auth.ts

@@ -1,7 +1,16 @@
+import { logger } from "@remit/logger";
 import type { Auth as BetterAuthInstance } from "better-auth";
-import { betterAuth } from "better-auth";
+import { betterAuth, type GenericEndpointContext } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { APIError, createAuthMiddleware, isAPIError } from "better-auth/api";
 import { jwt } from "better-auth/plugins";
+import {
+	deleteSessions,
+	type IdentityStore,
+	isUserDisabled,
+	markSignedIn,
+	sessionUserOf,
+} from "./identity-store.js";
 import * as authSchemaSqlite from "./schema/auth-schema-sqlite.js";
 
 export interface AuthConfig {
@@ -20,6 +29,7 @@ export interface AuthConfig {
 	 * `disableSignUp`; accounts are then provisioned out-of-band.
 	 */
 	selfSignUpEnabled: boolean;
+	signInEnabled: boolean;
 }
 
 // The drizzle adapter better-auth runs against. better-sqlite3 and its drizzle
@@ -52,6 +62,92 @@ const buildAuthAdapter = async (config: AuthConfig) => {
  */
 export const CLIENT_IP_HEADER = "x-remit-client-ip";
 
+export const SIGN_IN_DISABLED = {
+	code: "SIGN_IN_DISABLED",
+	message: "Sign-in is turned off on this server.",
+} as const;
+
+export const ACCOUNT_DISABLED = {
+	code: "ACCOUNT_DISABLED",
+	message: "This account is disabled.",
+} as const;
+
+const RESET_TOKEN_TTL_SECONDS = 24 * 60 * 60;
+
+const MIN_PASSWORD_LENGTH = 12;
+
+const MAX_PASSWORD_LENGTH = 128;
+
+const UNKNOWN = "unknown";
+
+const clientIpOf = (ctx: GenericEndpointContext | null): string =>
+	ctx?.request?.headers.get(CLIENT_IP_HEADER) ??
+	ctx?.headers?.get(CLIENT_IP_HEADER) ??
+	UNKNOWN;
+
+const SESSION_PATHS: ReadonlySet<string> = new Set(["/token", "/get-session"]);
+
+/**
+ * The kill switch, then the disabled check on the two paths that carry a
+ * session forward. A sign-in that commits its session just after a disable
+ * would otherwise keep minting tokens; here that user's sessions go and the
+ * mint is refused.
+ */
+const gate = (store: IdentityStore, signInEnabled: boolean) =>
+	createAuthMiddleware(async (ctx) => {
+		if (!signInEnabled && ctx.path !== "/jwks") {
+			throw new APIError("FORBIDDEN", { ...SIGN_IN_DISABLED });
+		}
+		if (!SESSION_PATHS.has(ctx.path)) return;
+		const sessionToken = await ctx.getSignedCookie(
+			ctx.context.authCookies.sessionToken.name,
+			ctx.context.secret,
+		);
+		if (!sessionToken) return;
+		const user = sessionUserOf(store, sessionToken);
+		if (!user?.disabled) return;
+		store.immediate(() => {
+			deleteSessions(store, user.userId);
+			store.audit({
+				actor: user.userId,
+				target: user.userId,
+				action: "SignInRefusedDisabled",
+				outcome: "RefusedDisabled",
+				clientIp: clientIpOf(ctx),
+			});
+		});
+		throw new APIError("FORBIDDEN", { ...ACCOUNT_DISABLED });
+	});
+
+/**
+ * Every redeem of a reset link leaves a log line carrying its Origin, and a
+ * refused one an audit record. A refused token names no user.
+ */
+const resetAudit = (store: IdentityStore) =>
+	createAuthMiddleware(async (ctx) => {
+		if (ctx.path !== "/reset-password") return;
+		const refused = isAPIError(ctx.context.returned);
+		// biome-ignore lint/plugin/no-logger-info: a reset redeem is an audit-grade signal
+		logger.info(
+			{
+				origin: ctx.request?.headers.get("origin") ?? null,
+				clientIp: clientIpOf(ctx),
+				accepted: !refused,
+			},
+			"Password reset redeem",
+		);
+		if (!refused) return;
+		store.immediate(() =>
+			store.audit({
+				actor: UNKNOWN,
+				target: UNKNOWN,
+				action: "PasswordResetRefused",
+				outcome: "RefusedToken",
+				clientIp: clientIpOf(ctx),
+			}),
+		);
+	});
+
 const intEnv = (name: string, fallback: number): number => {
 	const raw = process.env[name];
 	if (!raw) return fallback;
@@ -75,6 +171,7 @@ const intEnv = (name: string, fallback: number): number => {
 // the public type stable across any consumer's dependency graph.
 export const createAuth = async (
 	config: AuthConfig,
+	store: IdentityStore,
 ): Promise<BetterAuthInstance> => {
 	const database = await buildAuthAdapter(config);
 
@@ -87,6 +184,47 @@ export const createAuth = async (
 			enabled: true,
 			autoSignIn: true,
 			disableSignUp: !config.selfSignUpEnabled,
+			minPasswordLength: MIN_PASSWORD_LENGTH,
+			maxPasswordLength: MAX_PASSWORD_LENGTH,
+			resetPasswordTokenExpiresIn: RESET_TOKEN_TTL_SECONDS,
+			revokeSessionsOnPasswordReset: true,
+			onPasswordReset: async ({ user }, request) => {
+				store.immediate(() =>
+					store.audit({
+						actor: user.id,
+						target: user.id,
+						action: "PasswordResetRedeemed",
+						outcome: "Succeeded",
+						clientIp: request?.headers.get(CLIENT_IP_HEADER) ?? UNKNOWN,
+					}),
+				);
+			},
+		},
+		hooks: {
+			before: gate(store, config.signInEnabled),
+			after: resetAudit(store),
+		},
+		databaseHooks: {
+			session: {
+				create: {
+					before: async (session, ctx) => {
+						if (!isUserDisabled(store.db, session.userId)) return;
+						store.immediate(() =>
+							store.audit({
+								actor: session.userId,
+								target: session.userId,
+								action: "SignInRefusedDisabled",
+								outcome: "RefusedDisabled",
+								clientIp: clientIpOf(ctx),
+							}),
+						);
+						throw new APIError("FORBIDDEN", { ...ACCOUNT_DISABLED });
+					},
+					after: async (session) => {
+						markSignedIn(store, session.userId);
+					},
+				},
+			},
 		},
 		// Listing one header, and not better-auth's `x-forwarded-for` default,
 		// is what keeps the resolved address out of a caller's reach: an
@@ -118,10 +256,27 @@ export const createAuth = async (
 				},
 			},
 		},
-		user: { modelName: "auth_user" },
+		user: {
+			modelName: "auth_user",
+			additionalFields: {
+				disabled: {
+					type: "boolean",
+					required: false,
+					defaultValue: false,
+					input: false,
+					returned: false,
+				},
+			},
+		},
 		session: { modelName: "auth_session" },
 		account: { modelName: "auth_account" },
-		verification: { modelName: "auth_verification" },
+		verification: {
+			modelName: "auth_verification",
+			storeIdentifier: {
+				default: "plain",
+				overrides: { "reset-password": "hashed" },
+			},
+		},
 		plugins: [
 			jwt({
 				schema: { jwks: { modelName: "auth_jwks" } },

package/src/config.ts

@@ -11,6 +11,11 @@ const required = (name: string, value: string | undefined): string => {
 	return value;
 };
 
+const isSwitchOn = (raw: string | undefined): boolean => {
+	const value = (raw ?? "").trim().toLowerCase();
+	return value !== "false" && value !== "0" && value !== "no";
+};
+
 /**
  * Whether self-service signup is open on the better-auth tier. Mirrors the
  * Cognito user pool's `selfSignUpEnabled` prop: enabled means users can
@@ -23,10 +28,16 @@ const required = (name: string, value: string | undefined): string => {
  */
 export const resolveSelfSignUpEnabled = (
 	raw: string | undefined = process.env.SELF_SIGN_UP_ENABLED,
-): boolean => {
-	const value = (raw ?? "").trim().toLowerCase();
-	return value !== "false" && value !== "0" && value !== "no";
-};
+): boolean => isSwitchOn(raw);
+
+/**
+ * The self-host kill switch. `SIGN_IN_ENABLED` reads like
+ * `SELF_SIGN_UP_ENABLED`: unset or any other value is on, and an explicit
+ * `false`/`0`/`no` turns every sign-in, token mint and session read off.
+ */
+export const resolveSignInEnabled = (
+	raw: string | undefined = process.env.SIGN_IN_ENABLED,
+): boolean => isSwitchOn(raw);
 
 export interface DataConnectionConfig {
 	connectionString: string;
@@ -59,6 +70,7 @@ export const resolveAuthConfig = (): AuthConfig => {
 			.map((origin) => origin.trim())
 			.filter((origin) => origin.length > 0),
 		selfSignUpEnabled: resolveSelfSignUpEnabled(),
+		signInEnabled: resolveSignInEnabled(),
 	};
 };
 

package/src/identity-store.ts

@@ -0,0 +1,286 @@
+import { randomUUID } from "node:crypto";
+import { logger } from "@remit/logger";
+import { and, desc, eq, inArray, isNull, lt } from "drizzle-orm";
+import type {
+	BetterSQLite3Database,
+	drizzle,
+} from "drizzle-orm/better-sqlite3";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import {
+	auth_session,
+	auth_user,
+	identity_audit_event,
+	identity_step_up,
+} from "./schema/auth-schema-sqlite.js";
+
+export type AuditAction =
+	| "KillSwitchOn"
+	| "KillSwitchOff"
+	| "StepUpPassed"
+	| "StepUpFailed"
+	| "SessionsRevoked"
+	| "PasswordResetIssued"
+	| "PasswordResetRedeemed"
+	| "PasswordResetRefused"
+	| "UserDisabled"
+	| "UserEnabled"
+	| "SignInRefusedDisabled"
+	| "PeopleRequestRefused";
+
+export type AuditOutcome =
+	| "Succeeded"
+	| "RefusedSelf"
+	| "RefusedCallerDisabled"
+	| "RefusedSignInOff"
+	| "RefusedForeignOrigin"
+	| "RefusedStepUp"
+	| "RefusedToken"
+	| "RefusedDisabled";
+
+export interface AuditRecord {
+	actor: string;
+	target: string;
+	action: AuditAction;
+	outcome: AuditOutcome;
+	clientIp: string;
+}
+
+export const HOST_CLIENT_IP = "host";
+
+const AUDIT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
+
+// The MCP connector's tables share the app database. auth-service cannot depend
+// on mcp-server, so the four columns a revocation writes are declared here.
+const mcp_oauth_consent = sqliteTable("mcp_oauth_consent", {
+	userId: text("user_id"),
+});
+const mcp_oauth_access_token = sqliteTable("mcp_oauth_access_token", {
+	userId: text("user_id"),
+	revoked: integer("revoked", { mode: "timestamp_ms" }),
+});
+const mcp_oauth_refresh_token = sqliteTable("mcp_oauth_refresh_token", {
+	userId: text("user_id"),
+	revoked: integer("revoked", { mode: "timestamp_ms" }),
+});
+const mcp_session = sqliteTable("mcp_session", {
+	userId: text("user_id"),
+});
+
+export type IdentityDb = ReturnType<typeof drizzle>;
+
+type SqliteDb = BetterSQLite3Database<Record<string, unknown>>;
+
+export interface IdentityStore {
+	db: IdentityDb;
+	immediate<T>(work: () => T): T;
+	audit(record: AuditRecord): string;
+	relabel(auditEventId: string, record: AuditRecord): void;
+	close(): void;
+}
+
+const logAudit = (record: AuditRecord): void => {
+	// biome-ignore lint/plugin/no-logger-info: an identity audit record is an audit-grade signal
+	logger.info({ audit: record }, "Identity audit event");
+};
+
+const insertAudit = (db: SqliteDb, record: AuditRecord): string => {
+	const now = Date.now();
+	const auditEventId = randomUUID();
+	db.delete(identity_audit_event)
+		.where(
+			lt(identity_audit_event.occurredAt, new Date(now - AUDIT_RETENTION_MS)),
+		)
+		.run();
+	db.insert(identity_audit_event)
+		.values({ auditEventId, occurredAt: new Date(now), ...record })
+		.run();
+	return auditEventId;
+};
+
+export const writeAudit = (db: SqliteDb, record: AuditRecord): void => {
+	insertAudit(db, record);
+	logAudit(record);
+};
+
+export const identityStore = (db: IdentityDb): IdentityStore => {
+	let pending: AuditRecord[] | null = null;
+	const sqlite = db.$client;
+
+	const log = (record: AuditRecord): void => {
+		if (pending) pending.push(record);
+		else logAudit(record);
+	};
+
+	const audit = (record: AuditRecord): string => {
+		const auditEventId = insertAudit(db, record);
+		log(record);
+		return auditEventId;
+	};
+
+	const relabel = (auditEventId: string, record: AuditRecord): void => {
+		db.update(identity_audit_event)
+			.set({ action: record.action, outcome: record.outcome })
+			.where(eq(identity_audit_event.auditEventId, auditEventId))
+			.run();
+		log(record);
+	};
+
+	const immediate = <T>(work: () => T): T => {
+		pending = [];
+		const written = pending;
+		const result = (() => {
+			try {
+				return sqlite.transaction(work).immediate();
+			} finally {
+				pending = null;
+			}
+		})();
+		for (const record of written) logAudit(record);
+		return result;
+	};
+
+	return { db, immediate, audit, relabel, close: () => sqlite.close() };
+};
+
+export const openIdentityStore = async (
+	filename: string,
+): Promise<IdentityStore> => {
+	const { default: Database } = await import("better-sqlite3");
+	const { drizzle } = await import("drizzle-orm/better-sqlite3");
+	const sqlite = new Database(filename);
+	sqlite.pragma("journal_mode = WAL");
+	sqlite.pragma("busy_timeout = 5000");
+	sqlite.pragma("synchronous = NORMAL");
+	sqlite.pragma("foreign_keys = ON");
+	return identityStore(drizzle(sqlite));
+};
+
+export interface UserRow {
+	userId: string;
+	email: string;
+	disabled: boolean;
+	createdAt: Date;
+	lastSignInAt: Date;
+}
+
+export const findUser = (
+	store: IdentityStore,
+	userId: string,
+): UserRow | undefined =>
+	store.db
+		.select({
+			userId: auth_user.id,
+			email: auth_user.email,
+			disabled: auth_user.disabled,
+			createdAt: auth_user.createdAt,
+			lastSignInAt: auth_user.lastSignInAt,
+		})
+		.from(auth_user)
+		.where(eq(auth_user.id, userId))
+		.get();
+
+export const isUserDisabled = (db: SqliteDb, userId: string): boolean =>
+	db
+		.select({ disabled: auth_user.disabled })
+		.from(auth_user)
+		.where(eq(auth_user.id, userId))
+		.get()?.disabled === true;
+
+export const sessionUserOf = (
+	store: IdentityStore,
+	sessionToken: string,
+): { userId: string; disabled: boolean } | undefined =>
+	store.db
+		.select({ userId: auth_user.id, disabled: auth_user.disabled })
+		.from(auth_session)
+		.innerJoin(auth_user, eq(auth_user.id, auth_session.userId))
+		.where(eq(auth_session.token, sessionToken))
+		.get();
+
+export const markSignedIn = (store: IdentityStore, userId: string): void => {
+	store.db
+		.update(auth_user)
+		.set({ lastSignInAt: new Date() })
+		.where(eq(auth_user.id, userId))
+		.run();
+};
+
+export const deleteSessions = (store: IdentityStore, userId: string): void => {
+	store.db.delete(auth_session).where(eq(auth_session.userId, userId)).run();
+};
+
+export const revokeUser = (store: IdentityStore, userId: string): void => {
+	const { db } = store;
+	const revoked = new Date();
+	deleteSessions(store, userId);
+	db.delete(mcp_oauth_consent)
+		.where(eq(mcp_oauth_consent.userId, userId))
+		.run();
+	db.update(mcp_oauth_access_token)
+		.set({ revoked })
+		.where(
+			and(
+				eq(mcp_oauth_access_token.userId, userId),
+				isNull(mcp_oauth_access_token.revoked),
+			),
+		)
+		.run();
+	db.update(mcp_oauth_refresh_token)
+		.set({ revoked })
+		.where(
+			and(
+				eq(mcp_oauth_refresh_token.userId, userId),
+				isNull(mcp_oauth_refresh_token.revoked),
+			),
+		)
+		.run();
+	db.delete(mcp_session).where(eq(mcp_session.userId, userId)).run();
+	db.delete(identity_step_up)
+		.where(eq(identity_step_up.callerUserId, userId))
+		.run();
+};
+
+const revokeEveryone = (store: IdentityStore): void => {
+	const { db } = store;
+	const revoked = new Date();
+	db.delete(auth_session).run();
+	db.delete(mcp_oauth_consent).run();
+	db.update(mcp_oauth_access_token)
+		.set({ revoked })
+		.where(isNull(mcp_oauth_access_token.revoked))
+		.run();
+	db.update(mcp_oauth_refresh_token)
+		.set({ revoked })
+		.where(isNull(mcp_oauth_refresh_token.revoked))
+		.run();
+	db.delete(mcp_session).run();
+	db.delete(identity_step_up).run();
+};
+
+export const applySignInSwitch = (
+	store: IdentityStore,
+	signInEnabled: boolean,
+): void => {
+	store.immediate(() => {
+		if (!signInEnabled) revokeEveryone(store);
+		const latest = store.db
+			.select({ action: identity_audit_event.action })
+			.from(identity_audit_event)
+			.where(
+				inArray(identity_audit_event.action, ["KillSwitchOn", "KillSwitchOff"]),
+			)
+			.orderBy(desc(identity_audit_event.occurredAt))
+			.limit(1)
+			.get();
+		const state: AuditAction = signInEnabled ? "KillSwitchOff" : "KillSwitchOn";
+		const changed = latest ? latest.action !== state : !signInEnabled;
+		if (!changed) return;
+		store.audit({
+			actor: "env",
+			target: "all",
+			action: state,
+			outcome: "Succeeded",
+			clientIp: HOST_CLIENT_IP,
+		});
+	});
+};

package/src/index.ts

@@ -1,9 +1,11 @@
 export { toNodeHandler } from "better-auth/node";
 export {
+	ACCOUNT_DISABLED,
 	type Auth,
 	type AuthConfig,
 	CLIENT_IP_HEADER,
 	createAuth,
+	SIGN_IN_DISABLED,
 } from "./auth.js";
 export {
 	AUTH_BASE_PATH,
@@ -13,9 +15,24 @@ export {
 	resolveAuthConfig,
 	resolveDataConnectionConfig,
 	resolveSelfSignUpEnabled,
+	resolveSignInEnabled,
 	resolveVerifierConfig,
 	type VerifierConfig,
 } from "./config.js";
+export {
+	type AuditRecord,
+	HOST_CLIENT_IP,
+	type IdentityStore,
+	isUserDisabled,
+	openIdentityStore,
+	writeAudit,
+} from "./identity-store.js";
+export {
+	createPeopleDirectory,
+	type PeopleAdmin,
+	type PeopleConfig,
+	type PeopleDirectory,
+} from "./people.js";
 export {
 	type AuthFetchHandler,
 	withRateLimitLogging,