@simple-auth-kit/cli 1.4.3 → 1.5.0

package/registry/combos/express-prisma/shared/src/routers/auth.router.ts

@@ -0,0 +1,398 @@
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+import type { AuthConfig } from "../auth.config.js";
+import { AuthService } from "../services/auth.service.js";
+import { HttpError } from "../http-error.js";
+import {
+  authenticated,
+  createTieredRouter,
+  publicRoute,
+  type TierMiddleware,
+} from "../route-tiers.js";
+import "../request-context.js";
+
+function requireString(value: unknown, field: string): string {
+  if (typeof value !== "string" || value.length === 0)
+    throw new HttpError(400, `${field} is required`);
+  return value;
+}
+
+const optionalString = (value: unknown): string | undefined =>
+  typeof value === "string" ? value : undefined;
+
+export interface AuthRouterDeps extends TierMiddleware {
+  auth: AuthService;
+  config: AuthConfig;
+}
+
+/**
+ * Identity endpoints — everything that is about *a user*, never about a group of them.
+ * Administration lives in admin.router.ts.
+ *
+ * Replaces the reference combo's `AuthController` (a Nest `@Controller`). Same endpoints, same
+ * validation, same status codes — just an Express `Router()` instead of a decorated class, and
+ * middleware passed in where the controller lists `@UseGuards(...)`. Every handler is wrapped in
+ * try/catch + `next(err)` so a thrown `HttpError`/`AuthCoreError` reaches the error-handling
+ * middleware mounted in create-auth-app.ts instead of leaking a bare 500.
+ */
+export function createAuthRouter(deps: AuthRouterDeps): RequestHandler {
+  const { auth, config, authentication, authorization } = deps;
+  const router = createTieredRouter({ authentication, authorization });
+
+  router.route(
+    "post",
+    "/signup",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const tokens = await auth.signup({
+          email: requireString(body.email, "email"),
+          password: requireString(body.password, "password"),
+          firstName: optionalString(body.firstName),
+          lastName: optionalString(body.lastName),
+          displayName: optionalString(body.displayName),
+          phone: optionalString(body.phone),
+          username: optionalString(body.username),
+          userAgent: req.headers["user-agent"],
+          ip: req.ip,
+        });
+        res.status(201).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/login",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const result = await auth.login({
+          identifier: requireString(body.identifier, "identifier"),
+          password: requireString(body.password, "password"),
+          userAgent: req.headers["user-agent"],
+          ip: req.ip,
+        });
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/login/2fa",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const tokens = await auth.loginTwoFactor({
+          challengeToken: requireString(body.challengeToken, "challengeToken"),
+          code: requireString(body.code, "code"),
+          userAgent: req.headers["user-agent"],
+          ip: req.ip,
+        });
+        res.status(200).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/refresh",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const tokens = await auth.refresh(
+          requireString(body.refreshToken, "refreshToken"),
+        );
+        res.status(200).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  // `roles`/`permissions` are whatever applies to this request — see authz.middleware.ts for how
+  // they are resolved. A request that names no authorization scope gets empty arrays.
+  //
+  // `permissions` is the caller's whole authorization: `defineAbilitiesFor(permissions)` from
+  // ability.ts rebuilds, in the client, the identical CASL ability the server's own route check
+  // just answered with, so the UI cannot disagree with what the API will allow. The slugs go on
+  // the wire rather than a serialised ability, so the payload is something a human can read in a
+  // log — and it is the same `req.authz` the ability was built from, not a re-resolution.
+  router.route(
+    "get",
+    "/me",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const { sub, sessionId } = req.auth!;
+        const [{ twoFactorEnabled }, profile] = await Promise.all([
+          auth.getTwoFactorStatus(sub),
+          auth.getProfile(sub),
+        ]);
+        res.status(200).json({
+          sub,
+          sessionId,
+          roles: req.authz?.roles ?? [],
+          permissions: req.authz?.permissions ?? [],
+          twoFactorEnabled,
+          email: profile.email,
+          firstName: profile.firstName,
+          lastName: profile.lastName,
+          displayName: profile.displayName,
+          phone: profile.phone,
+          username: profile.username,
+          photo: profile.photo,
+        });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "get",
+    "/sessions",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const sessions = await auth.listActiveSessions(req.auth!.sub);
+        res.status(200).json(sessions);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/logout",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const { sessionId, jti, sub } = req.auth!;
+        // Recorded so the row can later be told apart from a session an administrator ended —
+        // see `sessions.revoked_by`.
+        await auth.logout(sessionId, jti, config.accessTokenTtlSeconds, {
+          userId: sub,
+          ip: req.ip,
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/logout-all",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        await auth.logoutAll(req.auth!.sub, {
+          userId: req.auth!.sub,
+          ip: req.ip,
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/logout-others",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        await auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, {
+          userId: req.auth!.sub,
+          ip: req.ip,
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/password/change",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.changePassword(req.auth!.sub, req.auth!.sessionId, {
+          currentPassword: requireString(
+            body.currentPassword,
+            "currentPassword",
+          ),
+          newPassword: requireString(body.newPassword, "newPassword"),
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  // Self-service — no admin permission required. Updates the caller's own row directly; unrelated
+  // to any workspace. Same null-vs-undefined field parsing every PATCH handler in this codebase
+  // uses — see admin.router.ts's PATCH /users/:userId.
+  router.route(
+    "patch",
+    "/me",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const profile = await auth.updateProfile(req.auth!.sub, {
+          firstName:
+            body.firstName === null ? null : optionalString(body.firstName),
+          lastName:
+            body.lastName === null ? null : optionalString(body.lastName),
+          displayName:
+            body.displayName === null ? null : optionalString(body.displayName),
+          phone: body.phone === null ? null : optionalString(body.phone),
+          username:
+            body.username === null ? null : optionalString(body.username),
+          photo: body.photo === null ? null : optionalString(body.photo),
+        });
+        res.status(200).json(profile);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/2fa/enroll",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const result = await auth.enrollTwoFactor(req.auth!.sub);
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/2fa/confirm",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const result = await auth.confirmTwoFactor(
+          req.auth!.sub,
+          requireString(body.code, "code"),
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/2fa/disable",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.disableTwoFactor(
+          req.auth!.sub,
+          requireString(body.code, "code"),
+        );
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/password/forgot",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.requestPasswordReset(requireString(body.email, "email"));
+        res.status(200).json({ ok: true }); // always 200 — never reveal whether the email exists
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/password/reset",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.resetPassword(
+          requireString(body.token, "token"),
+          requireString(body.newPassword, "newPassword"),
+        );
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "get",
+    "/oauth/:provider/start",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const result = await auth.startOAuth(
+          requireString(req.params.provider, "provider"),
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "get",
+    "/oauth/:provider/callback",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const tokens = await auth.completeOAuthCallback(
+          requireString(req.params.provider, "provider"),
+          requireString(req.query.code, "code"),
+          requireString(req.query.state, "state"),
+        );
+        res.status(200).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  return router.handler;
+}

package/registry/combos/express-prisma/variants/base/src/create-auth-app.ts

@@ -2,25 +2,28 @@ import { PrismaPg } from "@prisma/adapter-pg";
 import express, { type Express } from "express";
 import swaggerUi from "swagger-ui-express";
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
-import { createAdminRouter } from "./admin.router.js";
-import { AuditLogRepository } from "./audit-log.repository.js";
-import { authCoreErrorMiddleware } from "./auth-core-error.middleware.js";
+import { createAdminRouter } from "./routers/admin.router.js";
+import { AuditLogRepository } from "./repositories/audit-log.repository.js";
+import { authCoreErrorMiddleware } from "./middleware/auth-core-error.middleware.js";
 import { AuthConfig, defaultAuthConfig } from "./auth.config.js";
-import { createAuthMiddleware } from "./auth.middleware.js";
-import { createAuthRouter } from "./auth.router.js";
-import { AuthService } from "./auth.service.js";
-import { createAuthzMiddleware } from "./authz.middleware.js";
-import { PrismaClient } from "../generated/prisma/client.js";
+import { createAuthMiddleware } from "./middleware/auth.middleware.js";
+import { createAuthRouter } from "./routers/auth.router.js";
+import { AuthService } from "./services/auth.service.js";
+import { createAuthzMiddleware } from "./middleware/authz.middleware.js";
+import { PrismaClient } from "./../generated/prisma/client.js";
 import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
+import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { openApiSpec } from "./openapi-spec.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { InMemoryPermissionCacheStore, PermissionCache } from "./permission-cache.js";
+import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
+import {
+  InMemoryPermissionCacheStore,
+  PermissionCache,
+} from "./permission-cache.js";
 import { InMemoryRateLimitStore } from "./rate-limit.store.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { responseEnvelope } from "./response-envelope.middleware.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
+import { RbacRepository } from "./repositories/rbac.repository.js";
+import { responseEnvelope } from "./middleware/response-envelope.middleware.js";
+import { SessionRepository } from "./repositories/session.repository.js";
+import { TwoFactorRepository } from "./repositories/two-factor.repository.js";
 
 export interface CreateAuthAppOptions {
   /** Overrides merged on top of `defaultAuthConfig`, same shape as the reference combo's `AuthModule.forRoot(config)`. */
@@ -39,7 +42,9 @@ export interface CreateAuthAppOptions {
 export function createAuthApp(options: CreateAuthAppOptions = {}): Express {
   const config: AuthConfig = { ...defaultAuthConfig, ...options.config };
 
-  const adapter = new PrismaPg({ connectionString: process.env["DATABASE_URL"] });
+  const adapter = new PrismaPg({
+    connectionString: process.env["DATABASE_URL"],
+  });
   const prisma = new PrismaClient({ adapter });
 
   const auditLog = new AuditLogRepository(prisma);
@@ -47,15 +52,30 @@ export function createAuthApp(options: CreateAuthAppOptions = {}): Express {
   const keys = new KeyProviderService();
   // Swap the store for a Redis-backed one by passing `rateLimitStore` in `config` — nothing in
   // this library's source changes.
-  const rateLimit: RateLimitDeps = config.rateLimitStore ?? new InMemoryRateLimitStore();
+  const rateLimit: RateLimitDeps =
+    config.rateLimitStore ?? new InMemoryRateLimitStore();
   // The cache seam. Swap the store for a Redis-backed one by passing `permissionCacheStore` in
   // `config` — nothing in this library's source changes. Keys are namespaced simpleauthkit:authz:*.
-  const permissionCache = new PermissionCache(config.permissionCacheStore ?? new InMemoryPermissionCacheStore(), config);
+  const permissionCache = new PermissionCache(
+    config.permissionCacheStore ?? new InMemoryPermissionCacheStore(),
+    config,
+  );
   const rbac = new RbacRepository(prisma, permissionCache);
   const twoFactor = new TwoFactorRepository(prisma);
   const oauth = new OAuthRepository(prisma);
   const passwordReset = new PasswordResetRepository(prisma);
-  const authService = new AuthService(prisma, sessions, keys, rateLimit, auditLog, rbac, twoFactor, oauth, passwordReset, config);
+  const authService = new AuthService(
+    prisma,
+    sessions,
+    keys,
+    rateLimit,
+    auditLog,
+    rbac,
+    twoFactor,
+    oauth,
+    passwordReset,
+    config,
+  );
 
   const authentication = createAuthMiddleware({ keys, sessions });
   // Roles are global here, but they are read from the database on the request that uses them —
@@ -79,13 +99,28 @@ export function createAuthApp(options: CreateAuthAppOptions = {}): Express {
   // slash) a plain 200 instead of swagger-ui-express's default 301 to "/docs/" — the
   // underlying static asset middleware would otherwise treat the mount root as a directory
   // listing and redirect.
-  app.use("/docs", swaggerUi.serveWithOptions({ redirect: false }), swaggerUi.setup(openApiSpec));
+  app.use(
+    "/docs",
+    swaggerUi.serveWithOptions({ redirect: false }),
+    swaggerUi.setup(openApiSpec),
+  );
   app.get("/docs-json", (_req, res) => res.json(openApiSpec));
   app.use(responseEnvelope());
   // Mounted before /auth so `/auth/admin/*` reaches the admin router rather than falling
   // through to the identity router's 404.
-  app.use("/auth/admin", createAdminRouter({ auth: authService, authentication, authorization }));
-  app.use("/auth", createAuthRouter({ auth: authService, config, authentication, authorization }));
+  app.use(
+    "/auth/admin",
+    createAdminRouter({ auth: authService, authentication, authorization }),
+  );
+  app.use(
+    "/auth",
+    createAuthRouter({
+      auth: authService,
+      config,
+      authentication,
+      authorization,
+    }),
+  );
   // Mounted last so it catches errors forwarded via `next(err)` from every route above.
   app.use(authCoreErrorMiddleware);
 

package/registry/combos/express-prisma/variants/base/src/{authz.middleware.ts → middleware/authz.middleware.ts}

@@ -1,8 +1,8 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { defineAbilitiesFor } from "./ability.js";
-import type { PermissionCache } from "./permission-cache.js";
-import type { RbacRepository } from "./rbac.repository.js";
-import "./request-context.js";
+import { defineAbilitiesFor } from "../ability.js";
+import type { PermissionCache } from "../permission-cache.js";
+import type { RbacRepository } from "../repositories/rbac.repository.js";
+import "../request-context.js";
 
 /**
  * Roles and permissions are global to this deployment: a user has one set, and it applies
@@ -41,13 +41,21 @@ export interface AuthzMiddlewareDeps {
  *
  * Replaces the reference combo's `AuthzGuard`.
  */
-export function createAuthzMiddleware(deps: AuthzMiddlewareDeps): RequestHandler {
+export function createAuthzMiddleware(
+  deps: AuthzMiddlewareDeps,
+): RequestHandler {
   const { rbac, cache } = deps;
-  return async function authzMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void> {
+  return async function authzMiddleware(
+    req: Request,
+    _res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     try {
       if (req.auth) {
         const userId = req.auth.sub;
-        req.authz = (await cache.resolve<AuthzContext>(userId, () => rbac.resolveAuthzContext(userId))) ?? { roles: [], permissions: [] };
+        req.authz = (await cache.resolve<AuthzContext>(userId, () =>
+          rbac.resolveAuthzContext(userId),
+        )) ?? { roles: [], permissions: [] };
         req.ability = defineAbilitiesFor(req.authz.permissions);
       }
       next();