@soapjs/soap-auth 0.1.0

package/build/strategies/credential-based-auth.strategy.js

@@ -0,0 +1,205 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialBasedAuthStrategy = void 0;
+const errors_1 = require("../errors");
+const base_auth_strategy_1 = require("./base-auth.strategy");
+class CredentialBasedAuthStrategy extends base_auth_strategy_1.BaseAuthStrategy {
+    config;
+    session;
+    logger;
+    constructor(config, session, logger) {
+        super(config, session, logger);
+        this.config = config;
+        this.session = session;
+        this.logger = logger;
+    }
+    async authenticate(context) {
+        try {
+            const credentials = await this.extractCredentials(context);
+            if (!credentials)
+                throw new errors_1.MissingCredentialsError();
+            await this.isAccountLocked(credentials.identifier);
+            await this.checkFailedAttempts(credentials.identifier);
+            await this.checkRateLimit(credentials.identifier);
+            await this.checkPasswordExpiry(credentials.identifier);
+            const valid = await this.verifyCredentials(credentials);
+            if (!valid) {
+                await this.config.login.incrementFailedAttempts?.(credentials.identifier);
+                throw new errors_1.InvalidCredentialsError();
+            }
+            await this.config.login.resetFailedAttempts?.(credentials.identifier);
+            const user = await this.retrieveUser(credentials);
+            if (!user)
+                throw new errors_1.UserNotFoundError();
+            await this.checkMfa(user, context);
+            await this.isAuthorized(user);
+            await this.handleSession(user, context);
+            return { user };
+        }
+        catch (e) {
+            const error = new errors_1.AuthError(e, "Authentication failed.");
+            this.logger.error("Authentication failed:", error);
+            await this.config.logout.onFailure?.({ context, error: error });
+            throw error;
+        }
+    }
+    async handleSession(user, context) {
+        if (this.session) {
+            const sessionId = this.session.generateSessionId();
+            await this.session.set(sessionId, user);
+        }
+    }
+    async logout(context) {
+        try {
+            if (this.session) {
+                const sessionId = this.session.getSessionId?.(context);
+                if (!sessionId) {
+                    throw new Error("Session ID is missing in the context.");
+                }
+                await this.session.destroy(sessionId);
+                this.logger.info(`Session destroyed successfully, sessionId: ${sessionId}`);
+            }
+            await this.config.logout.onSuccess?.(context);
+            this.logger.info(`User logged out successfully.`);
+        }
+        catch (e) {
+            const error = new errors_1.AuthError(e, "Logout process failed.");
+            this.logger.error("Error during logout:", e);
+            await this.config.logout.onFailure?.({ context, error: e });
+            throw error;
+        }
+    }
+    async requestPasswordReset(identifier, email) {
+        try {
+            if (!this.config.passwordReset?.generateResetToken) {
+                throw new Error("Password reset token generation is not configured.");
+            }
+            const token = await this.config.passwordReset.generateResetToken(identifier);
+            if (email) {
+                await this.config.passwordReset.sendResetEmail?.(email, token);
+            }
+            await this.config.passwordReset.onSuccess?.({ identifier });
+            this.logger.info(`Password reset requested for identifier: ${identifier}`);
+        }
+        catch (e) {
+            const error = new errors_1.AuthError(e, "Password reset request error.");
+            this.logger.error("Password reset request error:", e);
+            await this.config.passwordReset.onFailure?.({ identifier, error: e });
+            throw error;
+        }
+    }
+    async resetPassword(identifier, token, newPassword) {
+        try {
+            if (!this.config.passwordReset?.validateResetToken) {
+                throw new Error("Password reset token validation is not configured.");
+            }
+            const isValid = await this.config.passwordReset.validateResetToken(token);
+            if (!isValid) {
+                throw new Error("Invalid or expired reset token.");
+            }
+            await this.config.passwordReset.updatePassword(identifier, newPassword);
+            await this.config.passwordReset.onSuccess?.({ identifier });
+            this.logger.info(`Password successfully reset for identifier: ${identifier}`);
+        }
+        catch (e) {
+            const error = new errors_1.AuthError(e, "Password reset error");
+            this.logger.error("Password reset error:", e);
+            await this.config.passwordReset.onFailure?.({ identifier, error: e });
+            throw error;
+        }
+    }
+    async changePassword(identifier, oldPassword, newPassword) {
+        try {
+            if (!this.config.login.verifyUserCredentials) {
+                throw new Error("Credential verification is not configured.");
+            }
+            const isAuthenticated = await this.config.login.verifyUserCredentials(identifier, oldPassword);
+            if (!isAuthenticated) {
+                throw new errors_1.InvalidCredentialsError();
+            }
+            await this.config.passwordReset?.updatePassword?.(identifier, newPassword);
+            await this.config.passwordReset?.onSuccess?.({ identifier });
+            this.logger.info(`Password changed successfully for identifier: ${identifier}`);
+        }
+        catch (e) {
+            const error = new errors_1.AuthError(e, "Change password error");
+            this.logger.error("Change password error:", e);
+            await this.config.passwordReset?.onFailure?.({ identifier, error: e });
+            throw error;
+        }
+    }
+    async auditLoginAttempt(identifier, success, context) {
+        await this.config.audit?.logAttempt?.(identifier, success, context);
+    }
+    async auditPasswordChange(identifier, context) {
+        await this.config.audit?.logPasswordChange?.(identifier, context);
+    }
+    validatePasswordPolicy(password) {
+        return this.config.passwordPolicy.validatePassword?.(password) ?? true;
+    }
+    async checkFailedAttempts(identifier) {
+        try {
+            if (this.config.security?.maxFailedLoginAttempts) {
+                const failedAttempts = (await this.config.login.getFailedAttempts?.(identifier)) || 0;
+                if (failedAttempts >= this.config.security.maxFailedLoginAttempts) {
+                    this.logger.warn(`User ${identifier} is temporarily locked out.`);
+                    throw new errors_1.AccountLockedError();
+                }
+            }
+        }
+        catch (e) {
+            this.logger.error("Check failed attempts:", e);
+        }
+    }
+    async isAccountLocked(account, ...args) {
+        if (await this.config.isAccountLocked?.(account, ...args)) {
+            throw new errors_1.AccountLockedError();
+        }
+        if (typeof account === "string" && this.config.security?.lockoutDuration) {
+            const lockoutKey = `lockout:${account}`;
+            const lockoutSession = await this.session?.get(lockoutKey);
+            if (lockoutSession) {
+                const elapsed = Date.now() - Number(lockoutSession.date);
+                if (elapsed < this.config.security.lockoutDuration * 60 * 1000) {
+                    this.logger.warn(`Account ${account} is temporarily locked out.`);
+                    return true;
+                }
+                else {
+                    await this.session?.destroy(lockoutKey);
+                }
+            }
+        }
+        return false;
+    }
+    async incrementFailedAttempts(account) {
+        if (this.config.login.incrementFailedAttempts) {
+            await this.config.login.incrementFailedAttempts(account);
+            const failedAttempts = (await this.config.login.getFailedAttempts?.(account)) || 0;
+            if (this.config.security?.maxFailedLoginAttempts &&
+                failedAttempts >= this.config.security.maxFailedLoginAttempts) {
+                const lockoutKey = `lockout:${account}`;
+                await this.session?.set(lockoutKey, {
+                    date: Date.now(),
+                });
+                this.logger.warn(`Account ${account} has been locked due to failed attempts.`);
+                this.notifyAccountLocked(account);
+            }
+        }
+    }
+    async notifyAccountLocked(identifier) {
+        if (this.config.security?.notifyOnLockout) {
+            await this.config.security.notifyOnLockout(identifier);
+        }
+    }
+    async checkPasswordExpiry(identifier) {
+        if (this.config.passwordPolicy?.passwordExpirationDays) {
+            const lastChanged = await this.config.passwordPolicy.getLastPasswordChange?.(identifier);
+            if (lastChanged &&
+                Date.now() - Number(lastChanged) >
+                    this.config.passwordPolicy.passwordExpirationDays * 86400000) {
+                throw new Error("Password expired, please reset your password.");
+            }
+        }
+    }
+}
+exports.CredentialBasedAuthStrategy = CredentialBasedAuthStrategy;

package/build/strategies/jwt/jwt.strategy.d.ts

@@ -0,0 +1,10 @@
+import * as Soap from "@soapjs/soap";
+import { TokenBasedAuthStrategy } from "../token-based-auth.strategy";
+import { JwtConfig } from "./jwt.types";
+import { SessionHandler } from "../../session/session-handler";
+export declare class JwtStrategy<TContext = unknown, TUser = unknown> extends TokenBasedAuthStrategy<TContext, TUser> {
+    protected config: JwtConfig<TContext, TUser>;
+    protected session?: SessionHandler;
+    protected logger?: Soap.Logger;
+    constructor(config: JwtConfig<TContext, TUser>, session?: SessionHandler, logger?: Soap.Logger);
+}

package/build/strategies/jwt/jwt.strategy.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtStrategy = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const util_1 = require("util");
+const token_based_auth_strategy_1 = require("../token-based-auth.strategy");
+const errors_1 = require("../../errors");
+const jwt_tools_1 = require("./jwt.tools");
+const verifyAsync = (0, util_1.promisify)(jsonwebtoken_1.default.verify);
+class JwtStrategy extends token_based_auth_strategy_1.TokenBasedAuthStrategy {
+    config;
+    session;
+    logger;
+    constructor(config, session, logger) {
+        if (!config.access.secretKey) {
+            throw new errors_1.UndefinedTokenSecretError("Access");
+        }
+        if (config.refresh && !config.refresh.secretKey) {
+            throw new errors_1.UndefinedTokenSecretError("Refresh");
+        }
+        const accessTokenConfig = (0, jwt_tools_1.prepareAccessTokenConfig)(config);
+        const refreshTokenConfig = (0, jwt_tools_1.prepareRefreshTokenConfig)(config);
+        super(config, {
+            ...accessTokenConfig,
+            generate(payload) {
+                return jsonwebtoken_1.default.sign(payload, accessTokenConfig.secretKey, accessTokenConfig.signOptions);
+            },
+            verify(token) {
+                try {
+                    if (!token)
+                        throw new errors_1.UndefinedTokenError("Access");
+                    if (!accessTokenConfig.secretKey)
+                        throw new errors_1.UndefinedTokenSecretError("Access");
+                    return verifyAsync(token, accessTokenConfig.secretKey, accessTokenConfig.verifyOptions);
+                }
+                catch (error) {
+                    this.logger?.error("JWT verification failed:", error);
+                    throw new errors_1.InvalidTokenError("Access");
+                }
+            },
+        }, {
+            ...refreshTokenConfig,
+            generate(payload) {
+                return jsonwebtoken_1.default.sign(payload, refreshTokenConfig.secretKey, refreshTokenConfig.signOptions);
+            },
+            verify(token) {
+                try {
+                    if (!token)
+                        throw new errors_1.UndefinedTokenError("Refresh");
+                    if (!refreshTokenConfig.secretKey)
+                        throw new errors_1.UndefinedTokenSecretError("Refresh");
+                    return verifyAsync(token, refreshTokenConfig.secretKey, refreshTokenConfig.verifyOptions);
+                }
+                catch (error) {
+                    this.logger?.error("JWT verification failed:", error);
+                    throw new errors_1.InvalidTokenError("Refresh");
+                }
+            },
+        });
+        this.config = config;
+        this.session = session;
+        this.logger = logger;
+        this.logger?.info("JWTStrategy initialized with provided configurations.");
+    }
+}
+exports.JwtStrategy = JwtStrategy;

package/build/strategies/jwt/jwt.tools.d.ts

@@ -0,0 +1,3 @@
+import { JwtAccessTokenHandlerConfig, JwtConfig, JwtRefreshTokenHandlerConfig } from "./jwt.types";
+export declare const prepareAccessTokenConfig: (config: JwtConfig) => JwtAccessTokenHandlerConfig;
+export declare const prepareRefreshTokenConfig: (config: JwtConfig) => JwtRefreshTokenHandlerConfig;

package/build/strategies/jwt/jwt.tools.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareRefreshTokenConfig = exports.prepareAccessTokenConfig = void 0;
+const Soap = __importStar(require("@soapjs/soap"));
+const prepareAccessTokenConfig = (config) => {
+    return Soap.removeUndefinedProperties({
+        ...config.access,
+        tokenType: "Access",
+        expiresIn: config.access.expiresIn || "1h",
+        signOptions: {
+            ...config.access.signOptions,
+            algorithm: config.access.signOptions.algorithm || "HS256",
+            expiresIn: config.access.expiresIn || "1h",
+            audience: config.access.audience,
+            issuer: config.access.issuer,
+            subject: config.access.subject,
+        },
+        verifyOptions: config.access.verifyOptions
+            ? {
+                ...config.access.verifyOptions,
+                algorithms: config.access.verifyOptions.algorithms || ["HS256"],
+                expiresIn: config.access.expiresIn || "1h",
+                audience: config.access.audience,
+                issuer: config.access.issuer,
+                subject: config.access.subject,
+            }
+            : {},
+    });
+};
+exports.prepareAccessTokenConfig = prepareAccessTokenConfig;
+const prepareRefreshTokenConfig = (config) => {
+    return Soap.removeUndefinedProperties({
+        ...config.refresh,
+        secretKey: config.refresh.secretKey,
+        tokenType: "Refresh",
+        signOptions: {
+            ...config.refresh.signOptions,
+            algorithm: config.refresh.signOptions.algorithm || "HS256",
+            expiresIn: config.refresh.expiresIn || "7d",
+            audience: config.refresh.audience,
+            issuer: config.refresh.issuer,
+            subject: config.refresh.subject,
+        },
+        verifyOptions: config.refresh.verifyOptions
+            ? {
+                ...config.refresh.verifyOptions,
+                algorithm: config.refresh.verifyOptions.algorithms || ["HS256"],
+                expiresIn: config.refresh.expiresIn || "7d",
+                audience: config.refresh.audience,
+                issuer: config.refresh.issuer,
+                subject: config.refresh.subject,
+            }
+            : {},
+    });
+};
+exports.prepareRefreshTokenConfig = prepareRefreshTokenConfig;

package/build/strategies/jwt/jwt.types.d.ts

@@ -0,0 +1,33 @@
+import { TokenBasedAuthStrategyConfig, TokenHandlerConfig } from "../../types";
+export interface JwtVerifyOptions {
+    algorithms?: string[];
+    notBefore?: string | number;
+    clockTolerance?: number;
+    ignoreExpiration?: boolean;
+    ignoreNotBefore?: boolean;
+    complete?: boolean;
+    clockTimestamp?: number;
+    [key: string]: any;
+}
+export interface JwtSignOptions {
+    algorithm?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "none";
+    notBefore?: string | number;
+    jwtid?: string;
+    issuedAt?: number;
+    mutatePayload?: (payload: Record<string, any>) => Record<string, any>;
+    noTimestamp?: boolean;
+    keyid?: string;
+    allowUnsafe?: boolean;
+}
+export type JwtAccessTokenHandlerConfig = {
+    verifyOptions?: JwtVerifyOptions;
+    signOptions: JwtSignOptions;
+} & TokenHandlerConfig;
+export type JwtRefreshTokenHandlerConfig = {
+    verifyOptions?: JwtVerifyOptions;
+    signOptions: JwtSignOptions;
+} & TokenHandlerConfig;
+export type JwtConfig<TContext = unknown, TUser = unknown> = {
+    access: JwtAccessTokenHandlerConfig;
+    refresh?: JwtRefreshTokenHandlerConfig;
+} & TokenBasedAuthStrategyConfig<TContext, TUser>;

package/build/strategies/jwt/jwt.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/strategies/local/local.strategy.d.ts

@@ -0,0 +1,25 @@
+import * as Soap from "@soapjs/soap";
+import { CredentialBasedAuthStrategy } from "../credential-based-auth.strategy";
+import { LocalStrategyConfig } from "./local.types";
+import { SessionHandler } from "../../session/session-handler";
+export declare class LocalStrategy<TContext = unknown, TUser = unknown> extends CredentialBasedAuthStrategy<TContext, TUser> {
+    protected config: LocalStrategyConfig<TContext, TUser>;
+    protected session?: SessionHandler;
+    protected logger?: Soap.Logger;
+    constructor(config: LocalStrategyConfig<TContext, TUser>, session?: SessionHandler, logger?: Soap.Logger);
+    protected extractCredentials(context?: TContext): Promise<{
+        identifier: string;
+        password: string;
+    }>;
+    protected verifyCredentials(credentials: {
+        identifier: string;
+        password: string;
+    }): Promise<boolean>;
+    protected retrieveUser(credentials: {
+        identifier: string;
+        password: string;
+    }): Promise<TUser | null>;
+    requestPasswordReset(email: string): Promise<void>;
+    resetPassword(email: string, token: string, newPassword: string): Promise<void>;
+    changePassword(email: string, oldPassword: string, newPassword: string): Promise<void>;
+}

package/build/strategies/local/local.strategy.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalStrategy = void 0;
+const errors_1 = require("../../errors");
+const credential_based_auth_strategy_1 = require("../credential-based-auth.strategy");
+class LocalStrategy extends credential_based_auth_strategy_1.CredentialBasedAuthStrategy {
+    config;
+    session;
+    logger;
+    constructor(config, session, logger) {
+        super(config, session, logger);
+        this.config = config;
+        this.session = session;
+        this.logger = logger;
+    }
+    async extractCredentials(context) {
+        return this.config.login.extractCredentials(context);
+    }
+    async verifyCredentials(credentials) {
+        return this.config.login.verifyUserCredentials(credentials.identifier, credentials.password);
+    }
+    async retrieveUser(credentials) {
+        return this.config.login.retrieveUserData(credentials.identifier);
+    }
+    async requestPasswordReset(email) {
+        try {
+            if (!this.config.passwordReset?.generateResetToken) {
+                throw new Error("Password reset token generation is not configured.");
+            }
+            const token = await this.config.passwordReset.generateResetToken(email);
+            await this.config.passwordReset.sendResetEmail?.(email, token);
+            this.logger?.info(`Password reset requested for email: ${email}`);
+            await this.config.passwordReset.onSuccess?.({ email });
+        }
+        catch (error) {
+            this.logger?.error("Password reset request error:", error);
+            await this.config.passwordReset.onFailure?.({ email, error });
+            throw new errors_1.AuthError(error, "Password reset request failed.");
+        }
+    }
+    async resetPassword(email, token, newPassword) {
+        try {
+            if (!this.config.passwordReset?.validateResetToken) {
+                throw new Error("Password reset token validation is not configured.");
+            }
+            const isValid = await this.config.passwordReset.validateResetToken(token);
+            if (!isValid)
+                throw new Error("Invalid or expired reset token.");
+            await this.config.passwordReset.updatePassword(email, newPassword);
+            this.logger?.info(`Password reset successful for email: ${email}`);
+            await this.config.passwordReset.onSuccess?.({ email });
+        }
+        catch (error) {
+            this.logger?.error("Password reset error:", error);
+            await this.config.passwordReset.onFailure?.({ email, error });
+            throw new errors_1.AuthError(error, "Password reset failed.");
+        }
+    }
+    async changePassword(email, oldPassword, newPassword) {
+        try {
+            const isAuthenticated = await this.config.login.verifyUserCredentials(email, oldPassword);
+            if (!isAuthenticated) {
+                throw new errors_1.InvalidCredentialsError();
+            }
+            await this.config.passwordReset?.updatePassword?.(email, newPassword);
+            this.logger?.info(`Password changed successfully for email: ${email}`);
+            await this.config.passwordReset?.onSuccess?.({ email });
+        }
+        catch (error) {
+            this.logger?.error("Change password error:", error);
+            await this.config.passwordReset?.onFailure?.({ email, error });
+            throw new errors_1.AuthError(error, "Change password failed.");
+        }
+    }
+}
+exports.LocalStrategy = LocalStrategy;

package/build/strategies/local/local.types.d.ts

@@ -0,0 +1,3 @@
+import { CredentialBasedAuthStrategyConfig } from "../../types";
+export interface LocalStrategyConfig<TContext = unknown, TUser = unknown> extends CredentialBasedAuthStrategyConfig<TContext, TUser> {
+}

package/build/strategies/local/local.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/strategies/oauth2/oauth2.strategy.d.ts

@@ -0,0 +1,35 @@
+import * as Soap from "@soapjs/soap";
+import { TokenHandlerConfig, AuthResult } from "../../types";
+import { TokenBasedAuthStrategy } from "../token-based-auth.strategy";
+import { OAuth2StrategyConfig } from "./oauth2.types";
+import { SessionHandler } from "../../session/session-handler";
+export declare class OAuth2Strategy<TContext = unknown, TUser = unknown> extends TokenBasedAuthStrategy<TContext, TUser> {
+    protected config: OAuth2StrategyConfig<TContext, TUser>;
+    protected accessTokenHandler: TokenHandlerConfig;
+    protected refreshTokenHandler?: TokenHandlerConfig;
+    protected session?: SessionHandler;
+    protected logger?: Soap.Logger;
+    constructor(config: OAuth2StrategyConfig<TContext, TUser>, accessTokenHandler: TokenHandlerConfig, refreshTokenHandler?: TokenHandlerConfig, session?: SessionHandler, logger?: Soap.Logger);
+    authenticate(context: TContext): Promise<AuthResult<TUser>>;
+    protected verifyAuthorizationCode(context: TContext, code: string): void;
+    protected extractAuthorizationCode(context: TContext): string | null;
+    protected redirectUser(context: TContext, authUrl: string): void;
+    protected buildAuthorizationUrl(context: TContext): string;
+    protected exchangeCodeForToken(context: TContext, code: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+    }>;
+    handleAuthorizationRedirect(context: TContext): void;
+    protected retrieveUser(accessToken: string): Promise<TUser | null>;
+    protected exchangeClientCredentials(): Promise<{
+        accessToken: string;
+    }>;
+    protected exchangePasswordGrant(): Promise<{
+        accessToken: string;
+    }>;
+    refreshAccessToken(context: TContext): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+    }>;
+    revokeToken(token: string): Promise<void>;
+}