@revealui/auth 0.0.0-canary-20260409021642

package/dist/server/auth.js

@@ -0,0 +1,393 @@
+/**
+ * Authentication Functions (Server-side)
+ *
+ * Sign in and sign up functionality with password hashing.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { logger } from '@revealui/core/observability/logger';
+import { getClient } from '@revealui/db/client';
+import { oauthAccounts, users } from '@revealui/db/schema';
+import bcrypt from 'bcryptjs';
+import { and, eq, isNull } from 'drizzle-orm';
+import { clearFailedAttempts, isAccountLocked, recordFailedAttempt } from './brute-force.js';
+import { validatePasswordStrength } from './password-validation.js';
+import { checkRateLimit } from './rate-limit.js';
+import { createSession, rotateSession } from './session.js';
+/** Grace period after signup during which unverified users can still sign in (24 hours) */
+const EMAIL_VERIFICATION_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
+/**
+ * Sign in with email and password
+ *
+ * @param email - User email
+ * @param password - User password
+ * @param options - Additional options (userAgent, ipAddress)
+ * @returns Sign in result with user and session token
+ */
+export async function signIn(email, password, options) {
+    try {
+        // Rate limiting by IP address
+        const ipKey = options?.ipAddress || 'unknown';
+        const rateLimit = await checkRateLimit(`signin:${ipKey}`);
+        if (!rateLimit.allowed) {
+            return {
+                success: false,
+                reason: 'rate_limited',
+                error: 'Too many login attempts. Please try again later.',
+            };
+        }
+        // Brute force protection by email
+        const bruteForceCheck = await isAccountLocked(email);
+        if (bruteForceCheck.locked) {
+            const lockMinutes = bruteForceCheck.lockUntil
+                ? Math.ceil((bruteForceCheck.lockUntil - Date.now()) / (60 * 1000))
+                : 30;
+            return {
+                success: false,
+                reason: 'account_locked',
+                error: `Account locked due to too many failed attempts. Please try again in ${lockMinutes} minutes.`,
+            };
+        }
+        let db;
+        try {
+            db = getClient();
+        }
+        catch (clientError) {
+            logger.error('Error getting database client', clientError instanceof Error ? clientError : undefined, {
+                message: clientError instanceof Error ? clientError.message : String(clientError),
+            });
+            return {
+                success: false,
+                reason: 'database_error',
+                error: 'Database connection failed',
+            };
+        }
+        // Find user by email
+        let user;
+        try {
+            const result = await db
+                .select()
+                .from(users)
+                .where(and(eq(users.email, email), isNull(users.deletedAt)))
+                .limit(1);
+            user = result[0];
+        }
+        catch (dbError) {
+            logger.error('Error querying user', dbError instanceof Error ? dbError : undefined, {
+                message: dbError instanceof Error ? dbError.message : String(dbError),
+                name: dbError instanceof Error ? dbError.name : 'unknown',
+                stack: dbError instanceof Error ? dbError.stack : undefined,
+            });
+            return {
+                success: false,
+                reason: 'database_error',
+                error: 'Database error',
+            };
+        }
+        // Always return same error message to prevent user enumeration
+        const invalidCredentialsMessage = 'Invalid email or password';
+        if (!user) {
+            await recordFailedAttempt(email);
+            return {
+                success: false,
+                reason: 'invalid_credentials',
+                error: invalidCredentialsMessage,
+            };
+        }
+        // Check if user has a password (not OAuth-only user)
+        if (!user.password) {
+            await recordFailedAttempt(email);
+            return {
+                success: false,
+                reason: 'invalid_credentials',
+                error: invalidCredentialsMessage,
+            };
+        }
+        // Verify password hash
+        let isValid;
+        try {
+            isValid = await bcrypt.compare(password, user.password);
+        }
+        catch {
+            logger.error('Error comparing password');
+            await recordFailedAttempt(email);
+            return {
+                success: false,
+                reason: 'invalid_credentials',
+                error: invalidCredentialsMessage,
+            };
+        }
+        if (!isValid) {
+            await recordFailedAttempt(email);
+            return {
+                success: false,
+                reason: 'invalid_credentials',
+                error: invalidCredentialsMessage,
+            };
+        }
+        // Successful login - clear failed attempts
+        await clearFailedAttempts(email);
+        // Check email verification (with grace period for new accounts)
+        if (!user.emailVerified) {
+            const accountAge = Date.now() - user.createdAt.getTime();
+            if (accountAge > EMAIL_VERIFICATION_GRACE_PERIOD_MS) {
+                return {
+                    success: false,
+                    reason: 'email_not_verified',
+                    error: 'Please verify your email address before signing in.',
+                };
+            }
+        }
+        // Check if MFA is enabled — if so, return early and require TOTP verification
+        if (user.mfaEnabled) {
+            return {
+                success: true,
+                requiresMfa: true,
+                mfaUserId: user.id,
+            };
+        }
+        // Rotate session: delete all existing sessions for this user, then create
+        // a fresh one. This prevents session fixation attacks where an attacker
+        // plants a session token that the victim later authenticates.
+        let token;
+        try {
+            const sessionResult = await rotateSession(user.id, {
+                userAgent: options?.userAgent || 'Unknown',
+                ipAddress: options?.ipAddress || 'Unknown',
+            });
+            token = sessionResult.token;
+        }
+        catch {
+            logger.error('Error creating session');
+            return {
+                success: false,
+                reason: 'session_error',
+                error: 'Failed to create session',
+            };
+        }
+        return {
+            success: true,
+            user,
+            sessionToken: token,
+        };
+    }
+    catch {
+        logger.error('Unexpected error in signIn');
+        return {
+            success: false,
+            reason: 'unexpected_error',
+            error: 'Unexpected error',
+        };
+    }
+}
+/**
+ * Check if a given email is allowed to sign up.
+ *
+ * Behavior:
+ * - If REVEALUI_SIGNUP_OPEN is 'true', all emails are allowed.
+ * - If REVEALUI_SIGNUP_WHITELIST is set (comma-separated emails), only listed emails pass.
+ * - If neither env var is set, signups are open (backwards compatible).
+ *
+ * @param email - Lowercase, trimmed email to check
+ * @returns true if signup is allowed
+ */
+export function isSignupAllowed(email) {
+    const signupOpen = process.env.REVEALUI_SIGNUP_OPEN;
+    if (signupOpen === 'true') {
+        return true;
+    }
+    const whitelist = process.env.REVEALUI_SIGNUP_WHITELIST;
+    if (!whitelist) {
+        return true;
+    }
+    const allowedEmails = whitelist
+        .split(',')
+        .map((e) => e.trim().toLowerCase())
+        .filter(Boolean);
+    return allowedEmails.includes(email.toLowerCase());
+}
+/**
+ * Sign up a new user
+ *
+ * @param email - User email
+ * @param password - User password
+ * @param name - User name
+ * @param options - Additional options
+ * @returns Sign up result with user and session token
+ */
+export async function signUp(email, password, name, options) {
+    try {
+        // Signup gating: check email whitelist before anything else
+        if (!isSignupAllowed(email)) {
+            return {
+                success: false,
+                error: 'Signups are currently restricted. Contact the administrator for access.',
+            };
+        }
+        // Rate limiting by IP address
+        const ipKey = options?.ipAddress || 'unknown';
+        const rateLimit = await checkRateLimit(`signup:${ipKey}`);
+        if (!rateLimit.allowed) {
+            return {
+                success: false,
+                error: 'Too many registration attempts. Please try again later.',
+            };
+        }
+        // Validate password strength
+        const passwordValidation = validatePasswordStrength(password);
+        if (!passwordValidation.valid) {
+            return {
+                success: false,
+                error: passwordValidation.errors.join('. '),
+            };
+        }
+        let db;
+        try {
+            db = getClient();
+        }
+        catch {
+            logger.error('Error getting database client');
+            return {
+                success: false,
+                error: 'Database connection failed',
+            };
+        }
+        // Check if user already exists (by email in users table or OAuth accounts).
+        // Both checks prevent account collision: a password signup must not collide
+        // with an existing OAuth identity for the same email address.
+        let existing;
+        try {
+            const result = await db.select().from(users).where(eq(users.email, email)).limit(1);
+            existing = result[0];
+        }
+        catch {
+            logger.error('Error checking existing user');
+            return {
+                success: false,
+                error: 'Database error',
+            };
+        }
+        if (existing) {
+            return {
+                success: false,
+                error: 'Unable to create account',
+            };
+        }
+        // Block signup if an OAuth account already uses this email.
+        // Without this check, an attacker could create a password account
+        // for an email that was registered via OAuth, enabling account takeover.
+        try {
+            const [existingOAuth] = await db
+                .select({ id: oauthAccounts.id })
+                .from(oauthAccounts)
+                .where(eq(oauthAccounts.providerEmail, email))
+                .limit(1);
+            if (existingOAuth) {
+                return {
+                    success: false,
+                    error: 'Unable to create account',
+                };
+            }
+        }
+        catch {
+            logger.error('Error checking OAuth accounts');
+            return {
+                success: false,
+                error: 'Database error',
+            };
+        }
+        // Hash password
+        let hashedPassword;
+        try {
+            hashedPassword = await bcrypt.hash(password, 12);
+        }
+        catch {
+            logger.error('Error hashing password');
+            return {
+                success: false,
+                error: 'Failed to process password',
+            };
+        }
+        // Generate email verification token.
+        // Store the SHA-256 hash in the DB; send the raw token in the email link.
+        // A DB breach cannot be used to verify arbitrary emails without the raw token.
+        const rawEmailVerificationToken = randomBytes(32).toString('hex');
+        const emailVerificationToken = createHash('sha256')
+            .update(rawEmailVerificationToken)
+            .digest('hex');
+        const emailVerificationTokenExpiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24h
+        // Create user
+        let user;
+        try {
+            const result = await db
+                .insert(users)
+                .values({
+                id: crypto.randomUUID(),
+                email,
+                name,
+                password: hashedPassword,
+                emailVerified: false,
+                emailVerificationToken,
+                emailVerificationTokenExpiresAt,
+                tosAcceptedAt: options?.tosAcceptedAt ?? null,
+                tosVersion: options?.tosVersion ?? null,
+            })
+                .returning();
+            user = result[0];
+        }
+        catch {
+            logger.error('Error creating user');
+            return {
+                success: false,
+                error: 'Failed to create user',
+            };
+        }
+        if (!user) {
+            return {
+                success: false,
+                error: 'User creation returned no result',
+            };
+        }
+        // Create session
+        let token;
+        try {
+            const sessionResult = await createSession(user.id, {
+                userAgent: options?.userAgent || 'Unknown',
+                ipAddress: options?.ipAddress || 'Unknown',
+            });
+            token = sessionResult.token;
+        }
+        catch {
+            logger.error('Error creating session');
+            // Clean up orphaned user so the email isn't permanently locked out.
+            // Without this, a retry would fail with "Unable to create account"
+            // because the user row already exists but has no valid session.
+            try {
+                await db.delete(users).where(eq(users.id, user.id));
+            }
+            catch {
+                logger.error('Failed to clean up orphaned user after session creation failure', undefined, {
+                    userId: user.id,
+                });
+            }
+            return {
+                success: false,
+                error: 'Failed to create session',
+            };
+        }
+        // Return the raw (unhashed) token so the caller can include it in the
+        // verification email link. The DB holds only the hash.
+        const userWithRawToken = { ...user, emailVerificationToken: rawEmailVerificationToken };
+        return {
+            success: true,
+            user: userWithRawToken,
+            sessionToken: token,
+        };
+    }
+    catch {
+        logger.error('Unexpected error in signUp');
+        return {
+            success: false,
+            error: 'Unexpected error',
+        };
+    }
+}

package/dist/server/brute-force.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Brute Force Protection
+ *
+ * Tracks failed login attempts and locks accounts after threshold.
+ * Uses storage abstraction (database or in-memory).
+ */
+export interface BruteForceConfig {
+    maxAttempts: number;
+    lockDurationMs: number;
+    windowMs: number;
+}
+/**
+ * Override default brute force configuration globally.
+ * Per-call config parameters still take precedence.
+ */
+export declare function configureBruteForce(overrides: Partial<BruteForceConfig>): void;
+/**
+ * Reset brute force configuration to defaults (for testing).
+ */
+export declare function resetBruteForceConfig(): void;
+/**
+ * Records a failed login attempt
+ *
+ * @param email - User email
+ * @param config - Brute force configuration
+ */
+export declare function recordFailedAttempt(email: string, config?: BruteForceConfig): Promise<void>;
+/**
+ * Clears failed attempts for an email (on successful login)
+ *
+ * @param email - User email
+ */
+export declare function clearFailedAttempts(email: string): Promise<void>;
+/**
+ * Checks if account is locked due to brute force attempts
+ *
+ * @param email - User email
+ * @param config - Brute force configuration
+ * @returns Lock status
+ */
+export declare function isAccountLocked(email: string, config?: BruteForceConfig): Promise<{
+    locked: boolean;
+    lockUntil?: number;
+    attemptsRemaining: number;
+}>;
+/**
+ * Gets failed attempt count for an email
+ *
+ * @param email - User email
+ * @returns Failed attempt count
+ */
+export declare function getFailedAttemptCount(email: string): Promise<number>;
+//# sourceMappingURL=brute-force.d.ts.map

package/dist/server/brute-force.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brute-force.d.ts","sourceRoot":"","sources":["../../src/server/brute-force.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAUD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAE9E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AA+BD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,gBAA+B,GACtC,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,gBAA+B,GACtC,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CA6C7E;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1E"}

package/dist/server/brute-force.js

@@ -0,0 +1,163 @@
+/**
+ * Brute Force Protection
+ *
+ * Tracks failed login attempts and locks accounts after threshold.
+ * Uses storage abstraction (database or in-memory).
+ */
+import { getStorage } from './storage/index.js';
+const DEFAULT_CONFIG = {
+    maxAttempts: 5,
+    lockDurationMs: 30 * 60 * 1000, // 30 minutes
+    windowMs: 15 * 60 * 1000, // 15 minutes
+};
+let globalConfig = { ...DEFAULT_CONFIG };
+/**
+ * Override default brute force configuration globally.
+ * Per-call config parameters still take precedence.
+ */
+export function configureBruteForce(overrides) {
+    globalConfig = { ...DEFAULT_CONFIG, ...overrides };
+}
+/**
+ * Reset brute force configuration to defaults (for testing).
+ */
+export function resetBruteForceConfig() {
+    globalConfig = { ...DEFAULT_CONFIG };
+}
+/**
+ * Serialize failed attempt entry
+ */
+function serializeEntry(entry) {
+    return JSON.stringify(entry);
+}
+/**
+ * Deserialize failed attempt entry
+ */
+function deserializeEntry(data) {
+    if (!data) {
+        return null;
+    }
+    try {
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get storage key for failed attempts
+ */
+function getStorageKey(email) {
+    return `brute_force:${email}`;
+}
+/**
+ * Records a failed login attempt
+ *
+ * @param email - User email
+ * @param config - Brute force configuration
+ */
+export async function recordFailedAttempt(email, config = globalConfig) {
+    const storage = getStorage();
+    const storageKey = getStorageKey(email);
+    const updater = (entryData) => {
+        const now = Date.now();
+        const entry = deserializeEntry(entryData) || { count: 0, windowStart: now };
+        // Reset if lock expired
+        if (entry.lockUntil && entry.lockUntil < now) {
+            entry.count = 0;
+            entry.lockUntil = undefined;
+            entry.windowStart = now;
+        }
+        // Reset if window expired
+        if (now - entry.windowStart > config.windowMs) {
+            entry.count = 0;
+            entry.windowStart = now;
+        }
+        entry.count++;
+        // Lock account if threshold reached
+        if (entry.count >= config.maxAttempts) {
+            entry.lockUntil = now + config.lockDurationMs;
+        }
+        const ttlSeconds = Math.ceil(Math.max(config.windowMs, entry.lockUntil ? entry.lockUntil - now : config.windowMs) / 1000);
+        return { value: serializeEntry(entry), ttlSeconds };
+    };
+    if (storage.atomicUpdate) {
+        await storage.atomicUpdate(storageKey, updater);
+    }
+    else {
+        // Fallback for storage backends that don't support atomic updates
+        const existing = await storage.get(storageKey);
+        const { value, ttlSeconds } = updater(existing);
+        await storage.set(storageKey, value, ttlSeconds);
+    }
+}
+/**
+ * Clears failed attempts for an email (on successful login)
+ *
+ * @param email - User email
+ */
+export async function clearFailedAttempts(email) {
+    const storage = getStorage();
+    const storageKey = getStorageKey(email);
+    await storage.del(storageKey);
+}
+/**
+ * Checks if account is locked due to brute force attempts
+ *
+ * @param email - User email
+ * @param config - Brute force configuration
+ * @returns Lock status
+ */
+export async function isAccountLocked(email, config = globalConfig) {
+    const storage = getStorage();
+    const storageKey = getStorageKey(email);
+    const now = Date.now();
+    const entryData = await storage.get(storageKey);
+    const entry = deserializeEntry(entryData);
+    if (!entry) {
+        return {
+            locked: false,
+            attemptsRemaining: config.maxAttempts,
+        };
+    }
+    // Check if lock expired
+    if (entry.lockUntil && entry.lockUntil < now) {
+        await storage.del(storageKey);
+        return {
+            locked: false,
+            attemptsRemaining: config.maxAttempts,
+        };
+    }
+    // Check if window expired
+    if (now - entry.windowStart > config.windowMs) {
+        await storage.del(storageKey);
+        return {
+            locked: false,
+            attemptsRemaining: config.maxAttempts,
+        };
+    }
+    if (entry.lockUntil) {
+        return {
+            locked: true,
+            lockUntil: entry.lockUntil,
+            attemptsRemaining: 0,
+        };
+    }
+    return {
+        locked: false,
+        attemptsRemaining: Math.max(0, config.maxAttempts - entry.count),
+    };
+}
+/**
+ * Gets failed attempt count for an email
+ *
+ * @param email - User email
+ * @returns Failed attempt count
+ */
+export async function getFailedAttemptCount(email) {
+    const storage = getStorage();
+    const storageKey = getStorageKey(email);
+    const entryData = await storage.get(storageKey);
+    const entry = deserializeEntry(entryData);
+    return entry?.count || 0;
+}

package/dist/server/errors.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Authentication Error Types
+ *
+ * Custom error classes for authentication operations.
+ */
+export declare class AuthError extends Error {
+    code: string;
+    statusCode: number;
+    constructor(message: string, code: string, statusCode?: number);
+}
+export declare class SessionError extends AuthError {
+    constructor(message?: string, statusCode?: number);
+}
+export declare class AuthenticationError extends AuthError {
+    constructor(message?: string, statusCode?: number);
+}
+export declare class DatabaseError extends AuthError {
+    originalError?: Error;
+    constructor(message?: string, originalError?: unknown);
+}
+export declare class TokenError extends AuthError {
+    constructor(message?: string, statusCode?: number);
+}
+export declare class OAuthAccountConflictError extends AuthError {
+    email: string;
+    constructor(email: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/server/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,qBAAa,SAAU,SAAQ,KAAK;IAGzB,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,MAAM;gBAFzB,OAAO,EAAE,MAAM,EACR,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAY;CAKlC;AAED,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,GAAE,MAAwB,EAAE,UAAU,GAAE,MAAY;CAIxE;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,GAAE,MAAgC,EAAE,UAAU,GAAE,MAAY;CAIhF;AAED,qBAAa,aAAc,SAAQ,SAAS;IACnC,aAAa,CAAC,EAAE,KAAK,CAAC;gBAEjB,OAAO,GAAE,MAAyB,EAAE,aAAa,CAAC,EAAE,OAAO;CAOxE;AAED,qBAAa,UAAW,SAAQ,SAAS;gBAC3B,OAAO,GAAE,MAAsB,EAAE,UAAU,GAAE,MAAY;CAItE;AAED,qBAAa,yBAA0B,SAAQ,SAAS;IAC/C,KAAK,EAAE,MAAM,CAAC;gBAET,KAAK,EAAE,MAAM;CAS1B"}

package/dist/server/errors.js

@@ -0,0 +1,51 @@
+/**
+ * Authentication Error Types
+ *
+ * Custom error classes for authentication operations.
+ */
+export class AuthError extends Error {
+    code;
+    statusCode;
+    constructor(message, code, statusCode = 500) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.name = 'AuthError';
+    }
+}
+export class SessionError extends AuthError {
+    constructor(message = 'Session error', statusCode = 401) {
+        super(message, 'SESSION_ERROR', statusCode);
+        this.name = 'SessionError';
+    }
+}
+export class AuthenticationError extends AuthError {
+    constructor(message = 'Authentication failed', statusCode = 401) {
+        super(message, 'AUTHENTICATION_ERROR', statusCode);
+        this.name = 'AuthenticationError';
+    }
+}
+export class DatabaseError extends AuthError {
+    originalError;
+    constructor(message = 'Database error', originalError) {
+        super(message, 'DATABASE_ERROR', 500);
+        this.name = 'DatabaseError';
+        if (originalError instanceof Error) {
+            this.originalError = originalError;
+        }
+    }
+}
+export class TokenError extends AuthError {
+    constructor(message = 'Token error', statusCode = 401) {
+        super(message, 'TOKEN_ERROR', statusCode);
+        this.name = 'TokenError';
+    }
+}
+export class OAuthAccountConflictError extends AuthError {
+    email;
+    constructor(email) {
+        super('An account with this email already exists. Sign in with your password or original provider.', 'OAUTH_ACCOUNT_CONFLICT', 409);
+        this.name = 'OAuthAccountConflictError';
+        this.email = email;
+    }
+}