@restforgejs/platform 5.2.13 → 5.3.5

package/generators/lib/auth/templates/processor/login.js.tmpl

@@ -0,0 +1,152 @@
+'use strict';
+
+/**
+ * Processor: login
+ * Verifikasi kredensial, lalu terbitkan JWT access token + refresh token.
+ * Method: POST
+ */
+
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const {
+  generateAccessToken,
+  getAccessTokenExpiryMin
+} = require('../../../../components/handlers/{{AUTH_MIDDLEWARE_NAME}}');
+
+const BCRYPT_ROUNDS = 12;
+const MAX_FAILED_LOGIN = 5;
+
+function getRefreshExpiryDays() {
+  return parseInt(process.env.REFRESH_TOKEN_EXPIRY_DAYS || '30', 10);
+}
+
+module.exports = {
+  async process(input, services, req) {
+    const { db, logger } = services;
+
+    try {
+      const { username, password } = input;
+
+      if (!username || !password) {
+        return {
+          success: false,
+          statusCode: 400,
+          message: 'Username and password are required.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const userRows = await db.executeQuery(
+        `SELECT user_id, username, email, full_name,
+                password_hash, is_active, is_locked, failed_login_count
+         FROM public.{{AUTH_USER_TABLE}}
+         WHERE username = $1`,
+        [username]
+      );
+      const user = userRows[0] || null;
+
+      if (!user) {
+        return {
+          success: false,
+          statusCode: 401,
+          message: 'Invalid username or password.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      if (!user.is_active) {
+        return {
+          success: false,
+          statusCode: 403,
+          message: 'Account is inactive. Contact administrator.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      if (user.is_locked) {
+        return {
+          success: false,
+          statusCode: 403,
+          message: 'Account locked due to too many failed login attempts. Contact administrator.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const passwordValid = await bcrypt.compare(password, user.password_hash);
+
+      if (!passwordValid) {
+        const newFailedCount = (user.failed_login_count || 0) + 1;
+        const shouldLock = newFailedCount >= MAX_FAILED_LOGIN;
+
+        await db.executeQuery(
+          `UPDATE public.{{AUTH_USER_TABLE}}
+           SET failed_login_count = $1, is_locked = $2, updated_at = NOW()
+           WHERE user_id = $3`,
+          [newFailedCount, shouldLock, user.user_id]
+        );
+
+        const message = shouldLock
+          ? 'Account locked due to too many failed login attempts. Contact administrator.'
+          : `Invalid username or password. Attempts remaining: ${MAX_FAILED_LOGIN - newFailedCount}.`;
+
+        return {
+          success: false,
+          statusCode: 401,
+          message,
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      // Login berhasil — reset counter, update last_login_at
+      await db.executeQuery(
+        `UPDATE public.{{AUTH_USER_TABLE}}
+         SET failed_login_count = 0, last_login_at = NOW(), updated_at = NOW()
+         WHERE user_id = $1`,
+        [user.user_id]
+      );
+
+      const accessToken = generateAccessToken(user);
+      const expiresIn = getAccessTokenExpiryMin() * 60;
+
+      // Refresh token: `<user_id>:<random-hex>`, disimpan sebagai hash bcrypt
+      const refreshTokenRaw = `${user.user_id}:${crypto.randomBytes(64).toString('hex')}`;
+      const refreshTokenHash = await bcrypt.hash(refreshTokenRaw, BCRYPT_ROUNDS);
+      const refreshExpiresAt = new Date();
+      refreshExpiresAt.setDate(refreshExpiresAt.getDate() + getRefreshExpiryDays());
+
+      await db.executeQuery(
+        `INSERT INTO public.{{AUTH_REFRESH_TOKEN_TABLE}}
+            (token_id, user_id, token_hash, expires_at, created_at)
+         VALUES ($1, $2, $3, $4, NOW())`,
+        [crypto.randomUUID(), user.user_id, refreshTokenHash, refreshExpiresAt]
+      );
+
+      return {
+        success: true,
+        statusCode: 200,
+        message: 'Login successful.',
+        data: {
+          access_token: accessToken,
+          refresh_token: refreshTokenRaw,
+          token_type: 'Bearer',
+          expires_in: expiresIn,
+          user: {
+            user_id: user.user_id,
+            username: user.username,
+            email: user.email,
+            full_name: user.full_name
+          }
+        },
+        timestamp: new Date().toISOString()
+      };
+    } catch (error) {
+      logger.error({ error: error.message }, '[auth-login] Unexpected error');
+      return {
+        success: false,
+        statusCode: 500,
+        message: 'An internal server error occurred.',
+        timestamp: new Date().toISOString()
+      };
+    }
+  }
+};

package/generators/lib/auth/templates/processor/logout.js.tmpl

@@ -0,0 +1,58 @@
+'use strict';
+
+/**
+ * Processor: logout
+ * Revoke refresh token bila disertakan. Selalu sukses (idempoten dari sisi client).
+ * Method: POST
+ */
+
+const bcrypt = require('bcrypt');
+
+module.exports = {
+  async process(input, services, req) {
+    const { db, logger } = services;
+
+    try {
+      const { refresh_token } = input;
+
+      if (refresh_token) {
+        const colonIdx = refresh_token.indexOf(':');
+        if (colonIdx >= 0) {
+          const userId = refresh_token.substring(0, colonIdx);
+
+          const tokenRows = await db.executeQuery(
+            `SELECT token_id, token_hash
+             FROM public.{{AUTH_REFRESH_TOKEN_TABLE}}
+             WHERE user_id = $1 AND is_revoked = FALSE`,
+            [userId]
+          );
+
+          for (const t of (tokenRows || [])) {
+            if (await bcrypt.compare(refresh_token, t.token_hash)) {
+              await db.executeQuery(
+                'UPDATE public.{{AUTH_REFRESH_TOKEN_TABLE}} SET is_revoked = TRUE WHERE token_id = $1',
+                [t.token_id]
+              );
+              break;
+            }
+          }
+        }
+      }
+
+      return {
+        success: true,
+        statusCode: 200,
+        message: 'Logout successful.',
+        timestamp: new Date().toISOString()
+      };
+    } catch (error) {
+      logger.error({ error: error.message }, '[auth-logout] Unexpected error');
+      return {
+        success: false,
+        statusCode: 500,
+        message: 'An internal server error occurred.',
+        timestamp: new Date().toISOString()
+      };
+    }
+  }
+};

package/generators/lib/auth/templates/processor/me.js.tmpl

@@ -0,0 +1,64 @@
+'use strict';
+
+/**
+ * Processor: me
+ * Mengembalikan profil user dari JWT access token (header Authorization).
+ * Method: GET
+ */
+
+const { verifyToken } = require('../../../../components/handlers/{{AUTH_MIDDLEWARE_NAME}}');
+
+module.exports = {
+  async process(input, services, req) {
+    const { db, logger } = services;
+
+    try {
+      let decoded;
+      try {
+        decoded = verifyToken(req);
+      } catch (err) {
+        return {
+          success: false,
+          statusCode: err.statusCode || 401,
+          message: err.message,
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const userRows = await db.executeQuery(
+        `SELECT user_id, username, email, full_name,
+                is_active, is_locked, last_login_at,
+                created_at, updated_at
+         FROM public.{{AUTH_USER_TABLE}}
+         WHERE user_id = $1`,
+        [decoded.sub]
+      );
+      const user = userRows[0] || null;
+
+      if (!user) {
+        return {
+          success: false,
+          statusCode: 404,
+          message: 'User not found.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      return {
+        success: true,
+        statusCode: 200,
+        message: 'OK',
+        data: user,
+        timestamp: new Date().toISOString()
+      };
+    } catch (error) {
+      logger.error({ error: error.message }, '[auth-me] Unexpected error');
+      return {
+        success: false,
+        statusCode: 500,
+        message: 'An internal server error occurred.',
+        timestamp: new Date().toISOString()
+      };
+    }
+  }
+};

package/generators/lib/auth/templates/processor/refresh.js.tmpl

@@ -0,0 +1,134 @@
+'use strict';
+
+/**
+ * Processor: refresh
+ * Tukar refresh token dengan access token baru (dengan token rotation:
+ * refresh token lama di-revoke, refresh token baru diterbitkan).
+ * Method: POST
+ */
+
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+const {
+  generateAccessToken,
+  getAccessTokenExpiryMin
+} = require('../../../../components/handlers/{{AUTH_MIDDLEWARE_NAME}}');
+
+const BCRYPT_ROUNDS = 12;
+
+function getRefreshExpiryDays() {
+  return parseInt(process.env.REFRESH_TOKEN_EXPIRY_DAYS || '30', 10);
+}
+
+module.exports = {
+  async process(input, services, req) {
+    const { db, logger } = services;
+
+    try {
+      const { refresh_token } = input;
+
+      if (!refresh_token) {
+        return {
+          success: false,
+          statusCode: 400,
+          message: 'refresh_token is required.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const colonIdx = refresh_token.indexOf(':');
+      if (colonIdx < 0) {
+        return {
+          success: false,
+          statusCode: 401,
+          message: 'Invalid refresh token.',
+          timestamp: new Date().toISOString()
+        };
+      }
+      const userId = refresh_token.substring(0, colonIdx);
+
+      const tokenRows = await db.executeQuery(
+        `SELECT token_id, token_hash
+         FROM public.{{AUTH_REFRESH_TOKEN_TABLE}}
+         WHERE user_id = $1 AND is_revoked = FALSE AND expires_at > NOW()`,
+        [userId]
+      );
+
+      let matched = null;
+      for (const t of (tokenRows || [])) {
+        if (await bcrypt.compare(refresh_token, t.token_hash)) {
+          matched = t;
+          break;
+        }
+      }
+
+      if (!matched) {
+        return {
+          success: false,
+          statusCode: 401,
+          message: 'Invalid or expired refresh token.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const userRows = await db.executeQuery(
+        `SELECT user_id, username, email, full_name, is_active, is_locked
+         FROM public.{{AUTH_USER_TABLE}}
+         WHERE user_id = $1`,
+        [userId]
+      );
+      const user = userRows[0] || null;
+
+      if (!user || !user.is_active || user.is_locked) {
+        return {
+          success: false,
+          statusCode: 403,
+          message: 'User account is inactive or locked.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      // Rotation: revoke token lama
+      await db.executeQuery(
+        'UPDATE public.{{AUTH_REFRESH_TOKEN_TABLE}} SET is_revoked = TRUE WHERE token_id = $1',
+        [matched.token_id]
+      );
+
+      const accessToken = generateAccessToken(user);
+      const expiresIn = getAccessTokenExpiryMin() * 60;
+
+      const newRefreshRaw = `${user.user_id}:${crypto.randomBytes(64).toString('hex')}`;
+      const newRefreshHash = await bcrypt.hash(newRefreshRaw, BCRYPT_ROUNDS);
+      const refreshExpiresAt = new Date();
+      refreshExpiresAt.setDate(refreshExpiresAt.getDate() + getRefreshExpiryDays());
+
+      await db.executeQuery(
+        `INSERT INTO public.{{AUTH_REFRESH_TOKEN_TABLE}}
+            (token_id, user_id, token_hash, expires_at, created_at)
+         VALUES ($1, $2, $3, $4, NOW())`,
+        [crypto.randomUUID(), user.user_id, newRefreshHash, refreshExpiresAt]
+      );
+
+      return {
+        success: true,
+        statusCode: 200,
+        message: 'Token refreshed successfully.',
+        data: {
+          access_token: accessToken,
+          refresh_token: newRefreshRaw,
+          token_type: 'Bearer',
+          expires_in: expiresIn
+        },
+        timestamp: new Date().toISOString()
+      };
+    } catch (error) {
+      logger.error({ error: error.message }, '[auth-refresh] Unexpected error');
+      return {
+        success: false,
+        statusCode: 500,
+        message: 'An internal server error occurred.',
+        timestamp: new Date().toISOString()
+      };
+    }
+  }
+};

package/generators/lib/auth/templates/processor/register.js.tmpl

@@ -0,0 +1,77 @@
+'use strict';
+
+/**
+ * Processor: register
+ * Membuat user baru dengan password ter-hash bcrypt.
+ * Method: POST
+ */
+
+const bcrypt = require('bcrypt');
+const crypto = require('crypto');
+
+const BCRYPT_ROUNDS = 12;
+
+module.exports = {
+  async process(input, services, req) {
+    const { db, logger } = services;
+
+    try {
+      const { username, password, email, full_name } = input;
+
+      if (!username || !password) {
+        return {
+          success: false,
+          statusCode: 400,
+          message: 'Username and password are required.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const existing = await db.executeQuery(
+        'SELECT user_id FROM public.{{AUTH_USER_TABLE}} WHERE username = $1',
+        [username]
+      );
+      if (existing && existing.length > 0) {
+        return {
+          success: false,
+          statusCode: 409,
+          message: 'Username is already taken.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const passwordHash = await bcrypt.hash(password, BCRYPT_ROUNDS);
+      const userId = crypto.randomUUID();
+
+      await db.executeQuery(
+        `INSERT INTO public.{{AUTH_USER_TABLE}}
+            (user_id, username, email, full_name, password_hash,
+             is_active, is_locked, failed_login_count,
+             password_changed_at, created_at)
+         VALUES ($1, $2, $3, $4, $5, TRUE, FALSE, 0, NOW(), NOW())`,
+        [userId, username, email || null, full_name || null, passwordHash]
+      );
+
+      return {
+        success: true,
+        statusCode: 201,
+        message: 'Registration successful.',
+        data: {
+          user_id: userId,
+          username,
+          email: email || null,
+          full_name: full_name || null
+        },
+        timestamp: new Date().toISOString()
+      };
+    } catch (error) {
+      logger.error({ error: error.message }, '[auth-register] Unexpected error');
+      return {
+        success: false,
+        statusCode: 500,
+        message: 'An internal server error occurred.',
+        timestamp: new Date().toISOString()
+      };
+    }
+  }
+};

package/generators/lib/auth/templates/processor/reset-password.js.tmpl

@@ -0,0 +1,106 @@
+'use strict';
+
+/**
+ * Processor: reset-password (prototype, tanpa verifikasi email)
+ * Reset password berdasarkan email saja, tanpa token/link verifikasi.
+ * Method: POST  body: { email, new_password, confirm_password }
+ *
+ * Catatan keamanan: tanpa verifikasi kepemilikan email, siapa pun yang tahu
+ * email terdaftar dapat mengganti password. Hanya layak untuk prototype lokal.
+ */
+
+const bcrypt = require('bcrypt');
+
+const BCRYPT_ROUNDS = 12;
+const MIN_PASSWORD = 6;
+
+module.exports = {
+  async process(input, services, req) {
+    const { db, logger } = services;
+
+    try {
+      const { email, new_password, confirm_password } = input;
+
+      if (!email || !new_password || !confirm_password) {
+        return {
+          success: false,
+          statusCode: 400,
+          message: 'Email, new password, and confirmation are required.',
+          timestamp: new Date().toISOString()
+        };
+      }
+      if (new_password.length < MIN_PASSWORD) {
+        return {
+          success: false,
+          statusCode: 400,
+          message: `Password must be at least ${MIN_PASSWORD} characters.`,
+          timestamp: new Date().toISOString()
+        };
+      }
+      if (new_password !== confirm_password) {
+        return {
+          success: false,
+          statusCode: 400,
+          message: 'Password confirmation does not match.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const rows = await db.executeQuery(
+        'SELECT user_id FROM public.{{AUTH_USER_TABLE}} WHERE email = $1',
+        [email]
+      );
+
+      if (!rows || rows.length === 0) {
+        return {
+          success: false,
+          statusCode: 404,
+          message: 'Email is not registered.',
+          timestamp: new Date().toISOString()
+        };
+      }
+      if (rows.length > 1) {
+        // Email tidak unik di schema; tolak daripada diam-diam mereset banyak akun.
+        return {
+          success: false,
+          statusCode: 409,
+          message: 'Email is registered to multiple accounts. Contact administrator.',
+          timestamp: new Date().toISOString()
+        };
+      }
+
+      const userId = rows[0].user_id;
+      const passwordHash = await bcrypt.hash(new_password, BCRYPT_ROUNDS);
+
+      // Reset password sekaligus buka kunci akun dan reset hitungan gagal login.
+      await db.executeQuery(
+        `UPDATE public.{{AUTH_USER_TABLE}}
+         SET password_hash = $1, password_changed_at = NOW(), updated_at = NOW(),
+             failed_login_count = 0, is_locked = FALSE
+         WHERE user_id = $2`,
+        [passwordHash, userId]
+      );
+
+      // Revoke semua refresh token lama: paksa login ulang di seluruh sesi.
+      await db.executeQuery(
+        'UPDATE public.{{AUTH_REFRESH_TOKEN_TABLE}} SET is_revoked = TRUE WHERE user_id = $1',
+        [userId]
+      );
+
+      return {
+        success: true,
+        statusCode: 200,
+        message: 'Password updated successfully. Please sign in with your new password.',
+        timestamp: new Date().toISOString()
+      };
+    } catch (error) {
+      logger.error({ error: error.message }, '[auth-reset-password] Unexpected error');
+      return {
+        success: false,
+        statusCode: 500,
+        message: 'An internal server error occurred.',
+        timestamp: new Date().toISOString()
+      };
+    }
+  }
+};

package/generators/lib/auth/templates/rfx_auth-middleware.js.tmpl

@@ -0,0 +1,79 @@
+'use strict';
+
+/**
+ * Auth Middleware (prototype, tanpa RBAC)
+ *
+ * Hanya menangani JWT: sign access token, verify Bearer token, dan guard
+ * `requireAuth` untuk melindungi endpoint lain. Tidak ada role/permission.
+ */
+
+const jwt = require('jsonwebtoken');
+
+function getJwtSecret() {
+  return process.env.JWT_SECRET || 'CHANGE-THIS-TO-RANDOM-SECRET-IN-PRODUCTION';
+}
+
+function getAccessTokenExpiryMin() {
+  return parseInt(process.env.ACCESS_TOKEN_EXPIRY_MIN || '60', 10);
+}
+
+/**
+ * Decode + verifikasi JWT dari header `Authorization: Bearer <token>`.
+ * @throws {Error} err.statusCode = 401 bila tidak valid.
+ */
+function verifyToken(req) {
+  const authHeader = req.headers['authorization'];
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    const err = new Error('Token tidak ditemukan');
+    err.statusCode = 401;
+    throw err;
+  }
+
+  const token = authHeader.substring(7);
+  try {
+    return jwt.verify(token, getJwtSecret());
+  } catch (jwtErr) {
+    const err = new Error('Token tidak valid atau sudah kedaluwarsa');
+    err.statusCode = 401;
+    throw err;
+  }
+}
+
+/**
+ * Express middleware: verifikasi JWT lalu set req.user.
+ */
+function requireAuth(req, res, next) {
+  try {
+    req.user = verifyToken(req);
+    next();
+  } catch (err) {
+    return res.status(err.statusCode || 401).json({
+      success: false,
+      message: err.message
+    });
+  }
+}
+
+/**
+ * Generate JWT access token. Payload ramping: hanya identitas user.
+ */
+function generateAccessToken(user) {
+  const payload = {
+    sub: user.user_id,
+    username: user.username,
+    email: user.email
+  };
+
+  return jwt.sign(payload, getJwtSecret(), {
+    algorithm: process.env.JWT_ALGORITHM || 'HS256',
+    expiresIn: `${getAccessTokenExpiryMin()}m`
+  });
+}
+
+module.exports = {
+  verifyToken,
+  requireAuth,
+  generateAccessToken,
+  getJwtSecret,
+  getAccessTokenExpiryMin
+};