@skroz/profile-api 1.0.16 → 1.0.18

package/src/resolvers/createOauthResolver.ts

@@ -0,0 +1,136 @@
+import crypto from 'crypto';
+import { nanoid } from 'nanoid';
+import { Arg, Ctx, Mutation, Resolver } from 'type-graphql';
+import { ProfileAuthService } from '../services/ProfileAuthService';
+import { OAuthProvider } from '../oauth/OAuthProvider';
+import { OauthLoginInput, TelegramAuthData } from '../dto/OauthInput';
+import { ProfileContext } from '../types';
+
+export interface OauthResolverDependencies<
+  TContext extends ProfileContext = ProfileContext
+> {
+  authService: ProfileAuthService | ((ctx: TContext) => ProfileAuthService);
+  userType: any;
+  providers: Record<string, OAuthProvider>;
+  telegramBotToken?: string;
+  onUserCreated?: (user: any, ctx: TContext) => Promise<void>;
+  onLogin?: (user: any, ctx: TContext) => Promise<void>;
+}
+
+function validateTelegramHash(data: TelegramAuthData, botToken: string): boolean {
+  const { hash, ...rest } = data;
+
+  const sorted = Object.keys(rest)
+    .filter((k) => {
+      const value = (rest as any)[k];
+      return value !== undefined && value !== null && value !== '';
+    })
+    .sort()
+    .map((k) => `${k}=${(rest as any)[k]}`)
+    .join('\n');
+
+  const secret = crypto.createHash('sha256').update(botToken).digest();
+  const hmac = crypto.createHmac('sha256', secret as unknown as crypto.BinaryLike).update(sorted).digest('hex');
+
+  return hmac === hash;
+}
+
+export function createOauthResolver<
+  TContext extends ProfileContext = ProfileContext
+>(deps: OauthResolverDependencies<TContext>): any {
+  const {
+    authService,
+    userType,
+    providers,
+    telegramBotToken,
+    onUserCreated,
+    onLogin,
+  } = deps;
+
+  const getAuthService = (ctx: TContext): ProfileAuthService => {
+    if (typeof authService === 'function') return authService(ctx);
+    return authService;
+  };
+
+  @Resolver(() => userType)
+  class OauthResolver {
+    @Mutation(() => userType)
+    async oauthLogin(
+      @Arg('input') input: OauthLoginInput,
+      @Ctx() ctx: TContext
+    ) {
+      const service = getAuthService(ctx);
+
+      let user: any;
+      let isNew = false;
+
+      if (input.provider === 'telegram') {
+        if (!input.tgData) throw new Error('tgData is required for Telegram login');
+        if (!telegramBotToken) throw new Error('Telegram bot token is not configured');
+
+        if (!validateTelegramHash(input.tgData, telegramBotToken)) {
+          throw new Error('Telegram auth verification failed');
+        }
+
+        user = await service.db.findUserByTelegramId(input.tgData.id);
+
+        if (!user) {
+          const passwordHash = await service.hashPassword(nanoid(20));
+          user = await service.db.createUser({
+            email: null,
+            passwordHash,
+            isTempPassword: true,
+          });
+          await service.db.updateUserProviderId(user.id, 'telegram', input.tgData.id);
+          isNew = true;
+        }
+      } else {
+        if (!input.code) throw new Error('code is required for OAuth login');
+
+        const provider = providers[input.provider];
+        if (!provider) throw new Error(`Unknown OAuth provider: ${input.provider}`);
+
+        const profile = await provider.exchangeCode(input.code);
+
+        // 1. Find by provider ID
+        user = await service.db.findUserByProviderId(input.provider, profile.providerId);
+
+        if (!user && profile.email) {
+          // 2. Find by email — link provider ID to existing account
+          user = await service.db.findUserByEmail(profile.email);
+          if (user) {
+            await service.db.updateUserProviderId(user.id, input.provider, profile.providerId);
+          }
+        }
+
+        if (!user) {
+          // 3. Create new user
+          const passwordHash = await service.hashPassword(nanoid(20));
+          user = await service.db.createUser({
+            email: profile.email,
+            passwordHash,
+            isTempPassword: true,
+          });
+          await service.db.updateUserProviderId(user.id, input.provider, profile.providerId);
+          isNew = true;
+        }
+      }
+
+      if (user.isBanned) throw new Error('User is banned');
+
+      const userAgent = decodeURI(ctx.req.get('user-agent') || '');
+      await ctx.req.session.create({
+        userId: user.id,
+        ip: ctx.req.ip,
+        userAgent: userAgent.slice(0, 500),
+      });
+
+      if (isNew && onUserCreated) await onUserCreated(user, ctx);
+      if (!isNew && onLogin) await onLogin(user, ctx);
+
+      return user;
+    }
+  }
+
+  return OauthResolver;
+}

package/src/types/index.ts

@@ -19,8 +19,10 @@ export interface ProfileDbAdapter {
     findUserByEmail(email: string): Promise<AuthUser | null>;
     findUserById(id: number): Promise<AuthUser | null>;
     findUserByTelegramId(telegramId: string): Promise<AuthUser | null>;
-    createUser(data: { email: string; passwordHash: string }): Promise<AuthUser>;
+    createUser(data: { email?: string | null; passwordHash: string; isTempPassword?: boolean }): Promise<AuthUser>;
     isEmailTaken(email: string, excludeUserId?: number): Promise<boolean>;
+    findUserByProviderId(provider: string, id: string): Promise<AuthUser | null>;
+    updateUserProviderId(userId: number, provider: string, id: string): Promise<void>;
 }
 
 export interface ProfileAuthConfig {