@restingowlorg/owlauth 1.0.1

package/dist/repositories/mongo/user.repo.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MongoUserRepo = void 0;
+const mongodb_1 = require("mongodb");
+/**
+ * MongoDB implementation of UserRepository
+ */
+class MongoUserRepo {
+    constructor(collection) {
+        this.collection = collection;
+    }
+    async create(input) {
+        const { email, username, passwordHash } = input;
+        const now = new Date();
+        const result = await this.collection.insertOne({
+            email,
+            username,
+            password: passwordHash,
+            created_at: now,
+            updated_at: now
+        });
+        return {
+            id: result.insertedId.toString(),
+            email,
+            username,
+            password: passwordHash
+        };
+    }
+    async findByEmail(email) {
+        var _a, _b;
+        const user = await this.collection.findOne({ email });
+        if (!user)
+            return null;
+        return {
+            id: (_b = (_a = user._id) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "", // safe fallback just in case
+            email: user.email,
+            username: user.username,
+            password: user.password
+        };
+    }
+    async findById(id) {
+        var _a, _b;
+        let objectId;
+        try {
+            objectId = new mongodb_1.ObjectId(id);
+        }
+        catch {
+            return null;
+        }
+        const user = await this.collection.findOne({ _id: objectId });
+        if (!user)
+            return null;
+        return {
+            id: (_b = (_a = user._id) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "",
+            email: user.email,
+            username: user.username,
+            password: user.password
+        };
+    }
+    async findByUsername(username) {
+        var _a, _b;
+        const user = await this.collection.findOne({ username });
+        if (!user)
+            return null;
+        return {
+            id: (_b = (_a = user._id) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "",
+            email: user.email,
+            username: user.username,
+            password: user.password
+        };
+    }
+    async updatePassword(userId, passwordHash) {
+        let objectId;
+        try {
+            objectId = new mongodb_1.ObjectId(userId.toString());
+        }
+        catch {
+            return false;
+        }
+        const result = await this.collection.updateOne({ _id: objectId }, { $set: { password: passwordHash, updated_at: new Date() } });
+        return result.modifiedCount > 0;
+    }
+}
+exports.MongoUserRepo = MongoUserRepo;

package/dist/repositories/postgresql/magic.link.repo.d.ts

@@ -0,0 +1,21 @@
+import { Pool } from "pg";
+import { MagicLinkToken, MagicLinkRow } from "../../types";
+import { MagicLinkRepository } from "../contracts";
+export declare class PostgresMagicLinkRepository implements MagicLinkRepository {
+    private readonly table;
+    private readonly pool;
+    constructor(table: string, pool: Pool);
+    private getTable;
+    create(token: {
+        userId: string;
+        tokenHash: string;
+        expiresAt: Date;
+        usedAt?: Date;
+    }): Promise<MagicLinkToken>;
+    findByTokenHash(tokenHash: string): Promise<MagicLinkToken | null>;
+    findById(id: string | number): Promise<MagicLinkToken | null>;
+    consume(id: string | number): Promise<boolean>;
+    deleteByUserId(userId: string | number): Promise<boolean>;
+    invalidateByUserId(userId: string | number): Promise<boolean>;
+    findAll(): Promise<MagicLinkRow[]>;
+}

package/dist/repositories/postgresql/magic.link.repo.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresMagicLinkRepository = void 0;
+class PostgresMagicLinkRepository {
+    constructor(table, pool) {
+        this.table = table;
+        this.pool = pool;
+    }
+    getTable() {
+        if (this.table.includes(".")) {
+            const [schema, table] = this.table.split(".");
+            return `"${schema}"."${table}"`;
+        }
+        return `"${this.table}"`;
+    }
+    async create(token) {
+        var _a;
+        const result = await this.pool.query(`
+      INSERT INTO ${this.getTable()} (user_id, token, expires_at, used_at)
+      VALUES ($1, $2, $3, $4)
+      RETURNING *
+      `, [token.userId, token.tokenHash, token.expiresAt, (_a = token.usedAt) !== null && _a !== void 0 ? _a : null]);
+        const row = result.rows[0];
+        return {
+            id: row.id,
+            userId: row.user_id,
+            tokenHash: row.token,
+            expiresAt: row.expires_at,
+            usedAt: row.used_at,
+            createdAt: row.created_at
+        };
+    }
+    async findByTokenHash(tokenHash) {
+        const result = await this.pool.query(`SELECT * FROM ${this.getTable()} WHERE token = $1`, [tokenHash]);
+        const row = result.rows[0];
+        if (!row)
+            return null;
+        return {
+            id: row.id,
+            userId: row.user_id,
+            tokenHash: row.token,
+            expiresAt: row.expires_at,
+            usedAt: row.used_at,
+            createdAt: row.created_at
+        };
+    }
+    async findById(id) {
+        const result = await this.pool.query(`SELECT * FROM ${this.getTable()} WHERE id = $1`, [id]);
+        const row = result.rows[0];
+        if (!row)
+            return null;
+        return {
+            id: row.id,
+            userId: row.user_id,
+            tokenHash: row.token,
+            expiresAt: row.expires_at,
+            usedAt: row.used_at,
+            createdAt: row.created_at
+        };
+    }
+    async consume(id) {
+        var _a;
+        const result = await this.pool.query(`UPDATE ${this.getTable()} SET used_at = NOW() WHERE id = $1 AND used_at IS NULL`, [id]);
+        return ((_a = result.rowCount) !== null && _a !== void 0 ? _a : 0) > 0;
+    }
+    async deleteByUserId(userId) {
+        var _a;
+        const result = await this.pool.query(`DELETE FROM ${this.getTable()} WHERE user_id = $1`, [
+            userId
+        ]);
+        return ((_a = result.rowCount) !== null && _a !== void 0 ? _a : 0) > 0;
+    }
+    async invalidateByUserId(userId) {
+        var _a, _b;
+        await this.pool.query(`UPDATE ${this.getTable()} SET used_at = NOW() WHERE user_id = $1 AND used_at IS NULL`, [userId]);
+        // Confirm that no active tokens remain for this user
+        const checkResult = await this.pool.query(`SELECT count(*) as count FROM ${this.getTable()} WHERE user_id = $1 AND used_at IS NULL`, [userId]);
+        const row = checkResult.rows[0];
+        const activeCount = parseInt((_b = (_a = row === null || row === void 0 ? void 0 : row.count) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : "0", 10);
+        return activeCount === 0;
+    }
+    async findAll() {
+        const result = await this.pool.query(`
+      SELECT * FROM ${this.getTable()}
+      WHERE used_at IS NULL AND expires_at > NOW()
+      `);
+        return result.rows.map((row) => ({
+            id: row.id,
+            user_id: row.user_id,
+            token: row.token,
+            expires_at: row.expires_at,
+            used_at: row.used_at,
+            created_at: row.created_at
+        }));
+    }
+}
+exports.PostgresMagicLinkRepository = PostgresMagicLinkRepository;

package/dist/repositories/postgresql/user.repo.d.ts

@@ -0,0 +1,14 @@
+import { Pool } from "pg";
+import { User, CreateUserInput } from "../../types";
+import { UserRepository } from "../contracts";
+export declare class PostgresUserRepository implements UserRepository {
+    private readonly table;
+    private readonly pool;
+    constructor(table: string, pool: Pool);
+    private getTable;
+    create(input: CreateUserInput): Promise<User>;
+    findByEmail(email: string): Promise<User | null>;
+    findById(id: string): Promise<User | null>;
+    findByUsername(username: string): Promise<User | null>;
+    updatePassword(userId: string | number, passwordHash: string): Promise<boolean>;
+}

package/dist/repositories/postgresql/user.repo.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresUserRepository = void 0;
+class PostgresUserRepository {
+    constructor(table, pool) {
+        this.table = table;
+        this.pool = pool;
+    }
+    getTable() {
+        if (this.table.includes(".")) {
+            const [schema, table] = this.table.split(".");
+            return `"${schema}"."${table}"`;
+        }
+        return `"${this.table}"`;
+    }
+    async create(input) {
+        const { email, username, passwordHash } = input;
+        const result = await this.pool.query(`
+      INSERT INTO ${this.getTable()} (email, username, password)
+      VALUES ($1, $2, $3)
+      RETURNING *
+      `, [email, username, passwordHash]);
+        return result.rows[0];
+    }
+    async findByEmail(email) {
+        var _a;
+        const result = await this.pool.query(`SELECT * FROM ${this.getTable()} WHERE email = $1`, [email]);
+        return (_a = result.rows[0]) !== null && _a !== void 0 ? _a : null;
+    }
+    async findById(id) {
+        var _a;
+        const result = await this.pool.query(`SELECT * FROM ${this.getTable()} WHERE id = $1`, [id]);
+        return (_a = result.rows[0]) !== null && _a !== void 0 ? _a : null;
+    }
+    async findByUsername(username) {
+        var _a;
+        const result = await this.pool.query(`SELECT * FROM ${this.getTable()} WHERE username = $1`, [username]);
+        return (_a = result.rows[0]) !== null && _a !== void 0 ? _a : null;
+    }
+    async updatePassword(userId, passwordHash) {
+        var _a;
+        const result = await this.pool.query(`
+      UPDATE ${this.getTable()}
+      SET password = $1
+      WHERE id = $2
+      `, [passwordHash, userId]);
+        return ((_a = result.rowCount) !== null && _a !== void 0 ? _a : 0) > 0;
+    }
+}
+exports.PostgresUserRepository = PostgresUserRepository;

package/dist/services/auth.service.d.ts

@@ -0,0 +1,22 @@
+import { ICryptoAdapter, IAuditLogger } from "../types";
+import { UserRepository } from "../repositories/contracts";
+import { AuthResult, LoginResult, SignupResult, ChangePasswordResult } from "../types/index";
+export declare class AuthService {
+    private readonly users;
+    private readonly crypto;
+    private readonly logger;
+    constructor(users: UserRepository, crypto: ICryptoAdapter, logger: IAuditLogger);
+    signup(email: string, username: string, password: string, options?: {
+        blockedPasswords?: string[];
+        pwnedPasswordFailClosed?: boolean;
+        correlationId?: string;
+    }): Promise<AuthResult<LoginResult>>;
+    login(email: string, password: string, options?: {
+        correlationId?: string;
+    }): Promise<AuthResult<SignupResult>>;
+    changePassword(userId: string | number, currentPassword: string, newPassword: string, options?: {
+        blockedPasswords?: string[];
+        pwnedPasswordFailClosed?: boolean;
+        correlationId?: string;
+    }): Promise<AuthResult<ChangePasswordResult>>;
+}

package/dist/services/auth.service.js

@@ -0,0 +1,362 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const core_1 = require("@zxcvbn-ts/core");
+const pwned_passwords_1 = require("../infra/security/pwned-passwords");
+const check_blocked_passwords_1 = require("../utils/check-blocked-passwords");
+class AuthService {
+    constructor(users, crypto, logger) {
+        this.users = users;
+        this.crypto = crypto;
+        this.logger = logger;
+    }
+    async signup(email, username, password, options) {
+        try {
+            // Basic validation
+            if (!email || !username || !password) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { reason: "Missing required fields" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Email, username, and password are required.",
+                    httpCode: 400
+                };
+            }
+            if (!/^[a-zA-Z0-9_]{3,20}$/.test(username)) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { username, reason: "Invalid username format" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Invalid username format.",
+                    httpCode: 400
+                };
+            }
+            if ((0, check_blocked_passwords_1.containsBlockedPasswords)(password, email, username, options === null || options === void 0 ? void 0 : options.blockedPasswords)) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { username, reason: "Password contains blocked keywords" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Password cannot contain username, email, or blocked words",
+                    httpCode: 400
+                };
+            }
+            // Password strength
+            if ((0, core_1.zxcvbn)(password).score < 3) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { username, reason: "Password too weak" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return { success: false, data: undefined, message: "Password too weak.", httpCode: 400 };
+            }
+            // Breached password check
+            const breachCheck = await (0, pwned_passwords_1.isBreachedPassword)(password);
+            if (breachCheck.detected) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { username, reason: "Password found in data breach" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Password found in data breach.",
+                    httpCode: 400
+                };
+            }
+            if (breachCheck.error && (options === null || options === void 0 ? void 0 : options.pwnedPasswordFailClosed)) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { username, reason: "Breached password check failed (Fail-Closed)" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Security check unavailable. Please try again later.",
+                    httpCode: 503
+                };
+            }
+            // Username uniqueness
+            if (this.users.findByUsername) {
+                const existingUser = await this.users.findByUsername(username);
+                if (existingUser) {
+                    this.logger.audit({
+                        type: "SIGNUP_FAILURE",
+                        email,
+                        metadata: { username, reason: "Username already taken" },
+                        correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                    });
+                    return {
+                        success: false,
+                        data: undefined,
+                        message: "Username already taken.",
+                        httpCode: 400
+                    };
+                }
+            }
+            // Email uniqueness
+            const existingEmail = await this.users.findByEmail(email);
+            if (existingEmail) {
+                this.logger.audit({
+                    type: "SIGNUP_FAILURE",
+                    email,
+                    metadata: { username, reason: "Email already registered" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Email already registered.",
+                    httpCode: 400
+                };
+            }
+            // Hash password and create user
+            const passwordHash = await this.crypto.hashPassword(password);
+            const input = { email, username, passwordHash };
+            const user = await this.users.create(input);
+            if (!user) {
+                this.logger.error("Signup failed", new Error("User creation returned null"), { email }, options === null || options === void 0 ? void 0 : options.correlationId);
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Failed to create user",
+                    httpCode: 500
+                };
+            }
+            this.logger.audit({
+                type: "SIGNUP",
+                email: user.email,
+                correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+            });
+            return {
+                success: true,
+                data: {
+                    user: {
+                        id: user.id,
+                        email: user.email,
+                        username: user.username
+                    }
+                },
+                message: "User signed up",
+                httpCode: 201
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Unknown error";
+            this.logger.error("Signup exception", err, { email }, options === null || options === void 0 ? void 0 : options.correlationId);
+            return {
+                success: false,
+                data: undefined,
+                message: "Signup failed: " + message,
+                httpCode: 500
+            };
+        }
+    }
+    async login(email, password, options) {
+        try {
+            // -------------------- Input Validation --------------------
+            if (!email || !password) {
+                this.logger.audit({
+                    type: "LOGIN_FAILURE",
+                    email,
+                    metadata: { reason: "Missing required fields" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Email and password are required.",
+                    httpCode: 400
+                };
+            }
+            // -------------------- Find User --------------------
+            const user = await this.users.findByEmail(email);
+            if (!user) {
+                this.logger.audit({
+                    type: "LOGIN_FAILURE",
+                    email,
+                    metadata: { reason: "User not found" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Invalid credentials.",
+                    httpCode: 401
+                };
+            }
+            // -------------------- Verify Password --------------------
+            const valid = await this.crypto.verifyPassword(password, user.password);
+            if (!valid) {
+                this.logger.audit({
+                    type: "LOGIN_FAILURE",
+                    email,
+                    metadata: { reason: "Invalid password" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Invalid credentials.",
+                    httpCode: 401
+                };
+            }
+            // -------------------- Return Safe Response --------------------
+            this.logger.audit({ type: "LOGIN_SUCCESS", email, correlationId: options === null || options === void 0 ? void 0 : options.correlationId });
+            return {
+                success: true,
+                data: {
+                    user: {
+                        id: user.id,
+                        email: user.email,
+                        username: user.username
+                    }
+                },
+                message: "User logged in",
+                httpCode: 200
+            };
+        }
+        catch (err) {
+            this.logger.error("Login exception", err, { email }, options === null || options === void 0 ? void 0 : options.correlationId);
+            return {
+                success: false,
+                data: undefined,
+                message: "Login failed : Unknown error",
+                httpCode: 500
+            };
+        }
+    }
+    async changePassword(userId, currentPassword, newPassword, options) {
+        try {
+            // Fetch user
+            const user = await this.users.findById(userId);
+            if (!user) {
+                return { success: false, data: undefined, message: "User not found", httpCode: 404 };
+            }
+            // Verify current password
+            const valid = await this.crypto.verifyPassword(currentPassword, user.password);
+            if (!valid) {
+                this.logger.audit({
+                    type: "PASSWORD_CHANGE",
+                    metadata: { success: false, reason: "Current password incorrect" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Current password incorrect",
+                    httpCode: 401
+                };
+            }
+            // Check blocked passwords
+            if ((0, check_blocked_passwords_1.containsBlockedPasswords)(newPassword, user.email, user.username, options === null || options === void 0 ? void 0 : options.blockedPasswords)) {
+                this.logger.audit({
+                    type: "PASSWORD_CHANGE",
+                    metadata: { success: false, reason: "New password contains blocked keywords" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "New password cannot contain username, email, or blocked words",
+                    httpCode: 400
+                };
+            }
+            // Password strength
+            if ((0, core_1.zxcvbn)(newPassword).score < 3) {
+                this.logger.audit({
+                    type: "PASSWORD_CHANGE",
+                    metadata: { success: false, reason: "New password too weak" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return { success: false, data: undefined, message: "New password too weak", httpCode: 400 };
+            }
+            // Breach check
+            const breachCheck = await (0, pwned_passwords_1.isBreachedPassword)(newPassword);
+            if (breachCheck.detected) {
+                this.logger.audit({
+                    type: "PASSWORD_CHANGE",
+                    metadata: { success: false, reason: "New password found in data breach" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "New password found in data breach",
+                    httpCode: 400
+                };
+            }
+            if (breachCheck.error && (options === null || options === void 0 ? void 0 : options.pwnedPasswordFailClosed)) {
+                this.logger.audit({
+                    type: "PASSWORD_CHANGE",
+                    metadata: { success: false, reason: "Breached password check failed (Fail-Closed)" },
+                    correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+                });
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Security check unavailable. Please try again later.",
+                    httpCode: 503
+                };
+            }
+            // Hash new password and update
+            const newHash = await this.crypto.hashPassword(newPassword);
+            const updated = await this.users.updatePassword(userId, newHash);
+            if (!updated) {
+                this.logger.error("Password update failed", new Error("Database update returned false"), undefined, options === null || options === void 0 ? void 0 : options.correlationId);
+                return {
+                    success: false,
+                    data: undefined,
+                    message: "Failed to update password",
+                    httpCode: 500
+                };
+            }
+            this.logger.audit({
+                type: "PASSWORD_CHANGE",
+                metadata: { success: true },
+                correlationId: options === null || options === void 0 ? void 0 : options.correlationId
+            });
+            return {
+                success: true,
+                message: "Password updated successfully",
+                data: {
+                    user: {
+                        id: user.id,
+                        email: user.email,
+                        username: user.username
+                    }
+                },
+                httpCode: 200
+            };
+        }
+        catch (err) {
+            this.logger.error("Password change exception", err, undefined, options === null || options === void 0 ? void 0 : options.correlationId);
+            return {
+                success: false,
+                data: undefined,
+                message: "Password change failed",
+                httpCode: 500
+            };
+        }
+    }
+}
+exports.AuthService = AuthService;

package/dist/services/auth.service.test.d.ts

@@ -0,0 +1 @@
+export {};