@simple-auth-kit/cli 1.4.3 → 1.5.1

package/registry/combos/express-drizzle/shared/src/routers/auth.router.ts

@@ -0,0 +1,395 @@
+import type { NextFunction, Request, RequestHandler, Response } from "express";
+import type { AuthConfig } from "../auth.config.js";
+import { AuthService } from "../services/auth.service.js";
+import { HttpError } from "../http-error.js";
+import {
+  authenticated,
+  createTieredRouter,
+  publicRoute,
+  type TierMiddleware,
+} from "../route-tiers.js";
+import "../request-context.js";
+
+function requireString(value: unknown, field: string): string {
+  if (typeof value !== "string" || value.length === 0)
+    throw new HttpError(400, `${field} is required`);
+  return value;
+}
+
+const optionalString = (value: unknown): string | undefined =>
+  typeof value === "string" ? value : undefined;
+
+export interface AuthRouterDeps extends TierMiddleware {
+  auth: AuthService;
+  config: AuthConfig;
+}
+
+/**
+ * Identity endpoints — everything that is about *a user*, never about a group of them.
+ * Administration lives in admin.router.ts.
+ *
+ * Replaces the reference combo's `AuthController` (a Nest `@Controller`). Same endpoints, same
+ * validation, same status codes — just an Express `Router()` instead of a decorated class, and
+ * middleware passed in where the controller lists `@UseGuards(...)`. Every handler is wrapped in
+ * try/catch + `next(err)` so a thrown `HttpError`/`AuthCoreError` reaches the error-handling
+ * middleware mounted in create-auth-app.ts instead of leaking a bare 500.
+ */
+export function createAuthRouter(deps: AuthRouterDeps): RequestHandler {
+  const { auth, config, authentication, authorization } = deps;
+  const router = createTieredRouter({ authentication, authorization });
+
+  router.route(
+    "post",
+    "/signup",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const tokens = await auth.signup({
+          email: requireString(body.email, "email"),
+          password: requireString(body.password, "password"),
+          firstName: optionalString(body.firstName),
+          lastName: optionalString(body.lastName),
+          displayName: optionalString(body.displayName),
+          phone: optionalString(body.phone),
+          username: optionalString(body.username),
+          userAgent: req.headers["user-agent"],
+          ip: req.ip,
+        });
+        res.status(201).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/login",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const result = await auth.login({
+          identifier: requireString(body.identifier, "identifier"),
+          password: requireString(body.password, "password"),
+          userAgent: req.headers["user-agent"],
+          ip: req.ip,
+        });
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/login/2fa",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const tokens = await auth.loginTwoFactor({
+          challengeToken: requireString(body.challengeToken, "challengeToken"),
+          code: requireString(body.code, "code"),
+          userAgent: req.headers["user-agent"],
+          ip: req.ip,
+        });
+        res.status(200).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/refresh",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const tokens = await auth.refresh(
+          requireString(body.refreshToken, "refreshToken"),
+        );
+        res.status(200).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  // `roles`/`permissions` are whatever applies to this request — see authz.middleware.ts for how
+  // they are resolved. A request that names no authorization scope gets empty arrays.
+  //
+  // `permissions` is the caller's whole authorization: `defineAbilitiesFor(permissions)` from
+  // ability.ts rebuilds, in the client, the identical CASL ability the server's own route check
+  // just answered with, so the UI cannot disagree with what the API will allow. The slugs go on
+  // the wire rather than a serialised ability, so the payload is something a human can read in a
+  // log — and it is the same `req.authz` the ability was built from, not a re-resolution.
+  router.route(
+    "get",
+    "/me",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const { sub, sessionId } = req.auth!;
+        const [{ twoFactorEnabled }, profile] = await Promise.all([
+          auth.getTwoFactorStatus(sub),
+          auth.getProfile(sub),
+        ]);
+        res.status(200).json({
+          sub,
+          sessionId,
+          roles: req.authz?.roles ?? [],
+          permissions: req.authz?.permissions ?? [],
+          twoFactorEnabled,
+          email: profile.email,
+          firstName: profile.firstName,
+          lastName: profile.lastName,
+          displayName: profile.displayName,
+          phone: profile.phone,
+          username: profile.username,
+          photo: profile.photo,
+        });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "get",
+    "/sessions",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const sessions = await auth.listActiveSessions(req.auth!.sub);
+        res.status(200).json(sessions);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/logout",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const { sessionId, jti, sub } = req.auth!;
+        // Recorded so the row can later be told apart from a session an administrator ended —
+        // see `sessions.revoked_by`.
+        await auth.logout(sessionId, jti, config.accessTokenTtlSeconds, {
+          userId: sub,
+          ip: req.ip,
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/logout-all",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        await auth.logoutAll(req.auth!.sub, {
+          userId: req.auth!.sub,
+          ip: req.ip,
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/logout-others",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        await auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, {
+          userId: req.auth!.sub,
+          ip: req.ip,
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/password/change",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.changePassword(req.auth!.sub, req.auth!.sessionId, {
+          currentPassword: requireString(
+            body.currentPassword,
+            "currentPassword",
+          ),
+          newPassword: requireString(body.newPassword, "newPassword"),
+        });
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "patch",
+    "/me",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const profile = await auth.updateProfile(req.auth!.sub, {
+          firstName:
+            body.firstName === null ? null : optionalString(body.firstName),
+          lastName:
+            body.lastName === null ? null : optionalString(body.lastName),
+          displayName:
+            body.displayName === null ? null : optionalString(body.displayName),
+          phone: body.phone === null ? null : optionalString(body.phone),
+          username:
+            body.username === null ? null : optionalString(body.username),
+          photo: body.photo === null ? null : optionalString(body.photo),
+        });
+        res.status(200).json(profile);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/2fa/enroll",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const result = await auth.enrollTwoFactor(req.auth!.sub);
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/2fa/confirm",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        const result = await auth.confirmTwoFactor(
+          req.auth!.sub,
+          requireString(body.code, "code"),
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/2fa/disable",
+    authenticated(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.disableTwoFactor(
+          req.auth!.sub,
+          requireString(body.code, "code"),
+        );
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/password/forgot",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.requestPasswordReset(requireString(body.email, "email"));
+        res.status(200).json({ ok: true }); // always 200 — never reveal whether the email exists
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "post",
+    "/password/reset",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const body = req.body as Record<string, unknown>;
+        await auth.resetPassword(
+          requireString(body.token, "token"),
+          requireString(body.newPassword, "newPassword"),
+        );
+        res.status(200).json({ ok: true });
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "get",
+    "/oauth/:provider/start",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const result = await auth.startOAuth(
+          requireString(req.params.provider, "provider"),
+        );
+        res.status(200).json(result);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  router.route(
+    "get",
+    "/oauth/:provider/callback",
+    publicRoute(),
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        const tokens = await auth.completeOAuthCallback(
+          requireString(req.params.provider, "provider"),
+          requireString(req.query.code, "code"),
+          requireString(req.query.state, "state"),
+        );
+        res.status(200).json(tokens);
+      } catch (err) {
+        next(err);
+      }
+    },
+  );
+
+  return router.handler;
+}

package/registry/combos/express-drizzle/variants/base/src/create-auth-app.ts

@@ -3,25 +3,28 @@ import swaggerUi from "swagger-ui-express";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
-import { createAdminRouter } from "./admin.router.js";
-import { AuditLogRepository } from "./audit-log.repository.js";
-import { authCoreErrorMiddleware } from "./auth-core-error.middleware.js";
+import { createAdminRouter } from "./routers/admin.router.js";
+import { AuditLogRepository } from "./repositories/audit-log.repository.js";
+import { authCoreErrorMiddleware } from "./middleware/auth-core-error.middleware.js";
 import { AuthConfig, defaultAuthConfig } from "./auth.config.js";
-import { createAuthMiddleware } from "./auth.middleware.js";
-import { createAuthRouter } from "./auth.router.js";
-import { AuthService } from "./auth.service.js";
-import { createAuthzMiddleware } from "./authz.middleware.js";
+import { createAuthMiddleware } from "./middleware/auth.middleware.js";
+import { createAuthRouter } from "./routers/auth.router.js";
+import { AuthService } from "./services/auth.service.js";
+import { createAuthzMiddleware } from "./middleware/authz.middleware.js";
 import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
+import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { openApiSpec } from "./openapi-spec.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { InMemoryPermissionCacheStore, PermissionCache } from "./permission-cache.js";
+import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
+import {
+  InMemoryPermissionCacheStore,
+  PermissionCache,
+} from "./permission-cache.js";
 import { InMemoryRateLimitStore } from "./rate-limit.store.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { responseEnvelope } from "./response-envelope.middleware.js";
+import { RbacRepository } from "./repositories/rbac.repository.js";
+import { responseEnvelope } from "./middleware/response-envelope.middleware.js";
 import * as schema from "./schema.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
+import { SessionRepository } from "./repositories/session.repository.js";
+import { TwoFactorRepository } from "./repositories/two-factor.repository.js";
 
 /**
  * Factory wiring a Drizzle `NodePgDatabase` (from a `pg.Pool`) plus all the plain classes,
@@ -39,15 +42,30 @@ export function createAuthApp(config: Partial<AuthConfig> = {}): Express {
   const keys = new KeyProviderService();
   // Swap the store for a Redis-backed one by passing `rateLimitStore` in `config` — nothing in
   // this library's source changes.
-  const rateLimit: RateLimitDeps = resolvedConfig.rateLimitStore ?? new InMemoryRateLimitStore();
+  const rateLimit: RateLimitDeps =
+    resolvedConfig.rateLimitStore ?? new InMemoryRateLimitStore();
   // The cache seam. Swap the store for a Redis-backed one by passing `permissionCacheStore` in
   // `config` — nothing in this library's source changes. Keys are namespaced simpleauthkit:authz:*.
-  const permissionCache = new PermissionCache(resolvedConfig.permissionCacheStore ?? new InMemoryPermissionCacheStore(), resolvedConfig);
+  const permissionCache = new PermissionCache(
+    resolvedConfig.permissionCacheStore ?? new InMemoryPermissionCacheStore(),
+    resolvedConfig,
+  );
   const rbac = new RbacRepository(db, permissionCache);
   const twoFactor = new TwoFactorRepository(db);
   const oauth = new OAuthRepository(db);
   const passwordReset = new PasswordResetRepository(db);
-  const authService = new AuthService(db, sessions, keys, rateLimit, auditLog, rbac, twoFactor, oauth, passwordReset, resolvedConfig);
+  const authService = new AuthService(
+    db,
+    sessions,
+    keys,
+    rateLimit,
+    auditLog,
+    rbac,
+    twoFactor,
+    oauth,
+    passwordReset,
+    resolvedConfig,
+  );
 
   const requireAuth = createAuthMiddleware(keys, sessions);
   // Roles are global here, but they are read from the database on the request that uses them —
@@ -66,8 +84,23 @@ export function createAuthApp(config: Partial<AuthConfig> = {}): Express {
   const app = express();
   app.use(express.json());
   app.use(responseEnvelope());
-  app.use("/auth/admin", createAdminRouter({ auth: authService, authentication: requireAuth, authorization: requireAuthz }));
-  app.use("/auth", createAuthRouter({ auth: authService, config: resolvedConfig, authentication: requireAuth, authorization: requireAuthz }));
+  app.use(
+    "/auth/admin",
+    createAdminRouter({
+      auth: authService,
+      authentication: requireAuth,
+      authorization: requireAuthz,
+    }),
+  );
+  app.use(
+    "/auth",
+    createAuthRouter({
+      auth: authService,
+      config: resolvedConfig,
+      authentication: requireAuth,
+      authorization: requireAuthz,
+    }),
+  );
   // Hand-authored OpenAPI spec (see openapi-spec.ts) — this combo has no NestJS decorators to
   // generate one from, so it's served as static JSON, same as the nestjs-* combos' /docs-json.
   app.use("/docs", swaggerUi.serve, swaggerUi.setup(openApiSpec));

package/registry/combos/express-drizzle/variants/base/src/{authz.middleware.ts → middleware/authz.middleware.ts}

@@ -1,8 +1,8 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { defineAbilitiesFor } from "./ability.js";
-import type { PermissionCache } from "./permission-cache.js";
-import type { RbacRepository } from "./rbac.repository.js";
-import "./request-context.js";
+import { defineAbilitiesFor } from "../ability.js";
+import type { PermissionCache } from "../permission-cache.js";
+import type { RbacRepository } from "../repositories/rbac.repository.js";
+import "../request-context.js";
 
 /**
  * Roles and permissions are global to this deployment: a user has one set, and it applies
@@ -41,13 +41,21 @@ export interface AuthzMiddlewareDeps {
  *
  * Replaces the reference combo's `AuthzGuard`.
  */
-export function createAuthzMiddleware(deps: AuthzMiddlewareDeps): RequestHandler {
+export function createAuthzMiddleware(
+  deps: AuthzMiddlewareDeps,
+): RequestHandler {
   const { rbac, cache } = deps;
-  return async function authzMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void> {
+  return async function authzMiddleware(
+    req: Request,
+    _res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     try {
       if (req.auth) {
         const userId = req.auth.sub;
-        req.authz = (await cache.resolve<AuthzContext>(userId, () => rbac.resolveAuthzContext(userId))) ?? { roles: [], permissions: [] };
+        req.authz = (await cache.resolve<AuthzContext>(userId, () =>
+          rbac.resolveAuthzContext(userId),
+        )) ?? { roles: [], permissions: [] };
         req.ability = defineAbilitiesFor(req.authz.permissions);
       }
       next();

package/registry/combos/express-drizzle/variants/base/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,9 +1,14 @@
 import { and, count, desc, eq, gte, lte, type SQL } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import * as schema from "./schema.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import * as schema from "../schema.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -45,7 +50,10 @@ export function toAuditLogEntry(row: AuditLogRow): AuditLogEntry {
 /** "role_assigned" -> "Role assigned". Derived rather than passed in, so core never has to carry display text. */
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 /**
@@ -56,7 +64,10 @@ export function humanizeAction(action: string): string {
 export class AuditLogRepository {
   constructor(private readonly db: NodePgDatabase<typeof schema>) {}
 
-  async append(event: AuditEvent, opts: { remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { remarks?: string } = {},
+  ): Promise<void> {
     await this.db.insert(schema.auditLogs).values({
       action: event.type,
       name: humanizeAction(event.type),
@@ -73,10 +84,14 @@ export class AuditLogRepository {
     const conditions: SQL[] = [];
 
     const userIdBig = toIdOrUndefined(filter.userId);
-    if (userIdBig !== undefined) conditions.push(eq(schema.auditLogs.userId, userIdBig));
-    if (filter.action) conditions.push(eq(schema.auditLogs.action, filter.action));
-    if (filter.since) conditions.push(gte(schema.auditLogs.createdAt, new Date(filter.since)));
-    if (filter.until) conditions.push(lte(schema.auditLogs.createdAt, new Date(filter.until)));
+    if (userIdBig !== undefined)
+      conditions.push(eq(schema.auditLogs.userId, userIdBig));
+    if (filter.action)
+      conditions.push(eq(schema.auditLogs.action, filter.action));
+    if (filter.since)
+      conditions.push(gte(schema.auditLogs.createdAt, new Date(filter.since)));
+    if (filter.until)
+      conditions.push(lte(schema.auditLogs.createdAt, new Date(filter.until)));
     const where = conditions.length ? and(...conditions) : undefined;
 
     const rows = await this.db
@@ -86,7 +101,10 @@ export class AuditLogRepository {
       .orderBy(desc(schema.auditLogs.createdAt), desc(schema.auditLogs.id))
       .limit(limit)
       .offset((page - 1) * limit);
-    const [{ value: total }] = await this.db.select({ value: count() }).from(schema.auditLogs).where(where);
+    const [{ value: total }] = await this.db
+      .select({ value: count() })
+      .from(schema.auditLogs)
+      .where(where);
 
     return { items: rows, meta: buildPageMeta(page, limit, total) };
   }