@sqrzro/server 2.0.0-bz.7 → 2.0.0-bz.9

package/LICENSE

@@ -1,4 +1,4 @@
-Copyright 2023 Richard Carter
+Copyright 2024 Richard Carter
 
 Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
 

package/README.md

@@ -1 +1,25 @@
-Square Zero Components
+<div align="center">
+
+<h1>
+    <img src="assets/logo.svg" alt="" width="64" style="margin-bottom: 5px">
+    <br />
+    Square Zero Server
+</h1>
+
+</div>  
+  
+<hr />
+
+## @sqrzro/server/auth
+
+## @sqrzro/server/cache
+
+## @sqrzro/server/db
+
+## @sqrzro/server/forms
+
+## @sqrzro/server/lists
+
+## @sqrzro/server/mail
+
+## @sqrzro/server/url

package/auth.d.ts

@@ -0,0 +1 @@
+export * from './dist/auth/index';

package/auth.js

@@ -0,0 +1 @@
+module.exports = require('./dist/auth/index');

package/cache.d.ts

@@ -0,0 +1 @@
+export * from './dist/cache/index';

package/cache.js

@@ -0,0 +1 @@
+module.exports = require('./dist/cache/index');

package/database.d.ts

@@ -0,0 +1 @@
+export * from './dist/database/index';

package/database.js

@@ -0,0 +1 @@
+module.exports = require('./dist/database/index');

package/dist/auth/AuthService.d.ts

@@ -0,0 +1,14 @@
+import type { Errorable } from '@sqrzro/interfaces';
+import type { LoginFormFields, PasswordFormFields, PasswordResetFormFields, UserObject } from './interfaces';
+export declare function handleLogout(): Promise<void>;
+export declare function getAllowedRoles(): number[];
+export declare function handleLoginForm(formData: LoginFormFields): Promise<Errorable<string>>;
+interface RegisterUserArgs {
+    email: string;
+    password?: string;
+    role?: number;
+}
+export declare function registerUser({ email, password, role, }: RegisterUserArgs): Promise<UserObject | null>;
+export declare function handlePasswordForm(formData: PasswordFormFields, mailFn: (email: string, token: string) => Promise<boolean>): Promise<Errorable<boolean>>;
+export declare function handlePasswordResetForm(formData: PasswordResetFormFields): Promise<Errorable<string | null>>;
+export {};

package/dist/auth/AuthService.js

@@ -0,0 +1,135 @@
+import { and, eq, inArray } from 'drizzle-orm';
+import { db } from '../database/DatabaseService';
+import { authResetTable, authUserTable } from '../database/schema';
+import { submitForm } from '../forms/FormService';
+import ValidationError from '../forms/ValidationError';
+import { checkMFAEnabled } from './MFAService';
+import { hashPassword, verifyPassword } from './PasswordService';
+import { createUserSession, generateID, getScopeByID, getSessionID, invalidateSession, invalidateUserSessions, } from './SessionService';
+import LoginRequest from './LoginRequest';
+import PasswordRequest from './PasswordRequest';
+import PasswordResetRequest from './PasswordResetRequest';
+const RESET_TOKEN_LENGTH = 40;
+// Set expiry to 1 hour (in ms)
+const RESET_TOKEN_EXPIRY = 3600000;
+export async function handleLogout() {
+    const id = getSessionID();
+    if (id) {
+        await invalidateSession(id);
+    }
+}
+export function getAllowedRoles() {
+    const roles = process.env.AUTH_ALLOWED_ROLES;
+    if (!roles) {
+        throw new Error('AUTH_ALLOWED_ROLES is not defined. Authentication will not be possible.');
+    }
+    return roles
+        .split(',')
+        .map((role) => Number(role))
+        .filter((role) => !isNaN(role));
+}
+async function handleUserSession(userID) {
+    await createUserSession(userID, checkMFAEnabled() ? 'MFA' : 'AUTHED');
+    const scope = await getScopeByID('AUTHED');
+    return scope?.redirectOnAuth || null;
+}
+async function getUserByEmail(email) {
+    const [user] = await db
+        .select()
+        .from(authUserTable)
+        .where(and(eq(authUserTable.email, email), inArray(authUserTable.role, getAllowedRoles())))
+        .limit(1);
+    return user;
+}
+async function loginUser({ email, password }) {
+    const user = await getUserByEmail(email);
+    if (!user?.password || !(await verifyPassword(password, user.password))) {
+        throw new ValidationError({ email: '', password: '' });
+    }
+    const session = await handleUserSession(user.id);
+    if (!session) {
+        throw new ValidationError({ email: '', password: '' });
+    }
+    return session;
+}
+export async function handleLoginForm(formData) {
+    const response = await submitForm({
+        fn: loginUser,
+        formData,
+        request: LoginRequest,
+    });
+    return response;
+}
+export async function registerUser({ email, password, role, }) {
+    const hash = password ? await hashPassword(password) : null;
+    const [user] = await db
+        .insert(authUserTable)
+        .values({ id: generateID(), email, password: hash, role })
+        .returning();
+    return user;
+}
+async function createPasswordResetToken(email) {
+    const user = await getUserByEmail(email);
+    if (!user) {
+        return null;
+    }
+    await db.delete(authResetTable).where(eq(authResetTable.userId, user.id));
+    const id = generateID(RESET_TOKEN_LENGTH);
+    await db.insert(authResetTable).values({
+        id,
+        userId: user.id,
+        expiresAt: new Date(new Date().getTime() + RESET_TOKEN_EXPIRY),
+    });
+    return id;
+}
+export async function handlePasswordForm(formData, mailFn) {
+    async function mutateFn(data) {
+        const token = await createPasswordResetToken(data.email);
+        if (!token) {
+            // Return true, even though the email doesn't exist (to prevent user enumeration)
+            return true;
+        }
+        return mailFn(data.email, token);
+    }
+    const response = await submitForm({
+        fn: mutateFn,
+        formData,
+        request: PasswordRequest,
+    });
+    return response;
+}
+async function validatePasswordResetToken(password, token) {
+    const [result] = await db
+        .select()
+        .from(authResetTable)
+        .where(eq(authResetTable.id, token))
+        .limit(1);
+    if (!result) {
+        return null;
+    }
+    await db.delete(authResetTable).where(eq(authResetTable.id, token));
+    if (!result || result.expiresAt < new Date()) {
+        return null;
+    }
+    await invalidateUserSessions(result.userId);
+    await db
+        .update(authUserTable)
+        .set({ password: await hashPassword(password) })
+        .where(and(eq(authUserTable.id, result.userId), inArray(authUserTable.role, getAllowedRoles())));
+    return result.userId;
+}
+export async function handlePasswordResetForm(formData) {
+    async function mutateFn(data) {
+        const userID = await validatePasswordResetToken(data.password, data.token);
+        if (!userID) {
+            return null;
+        }
+        return handleUserSession(userID);
+    }
+    const response = await submitForm({
+        fn: mutateFn,
+        formData,
+        request: PasswordResetRequest,
+    });
+    return response;
+}

package/dist/auth/ClientService.d.ts

@@ -0,0 +1,11 @@
+import type { NextRequest } from 'next/server';
+import type { AuthClient } from '../database/schema';
+export declare function getClientByID(id: string): Promise<AuthClient | null>;
+interface RegisterClientArgs {
+    alias: string;
+    id?: string;
+    secret?: string;
+}
+export declare function registerClient({ alias, id, secret, }: RegisterClientArgs): Promise<AuthClient | null>;
+export declare function handleClientAuth(request: NextRequest): Promise<AuthClient | null>;
+export {};

package/dist/auth/ClientService.js

@@ -0,0 +1,47 @@
+import { eq } from 'drizzle-orm';
+import { db } from '../database/DatabaseService';
+import { authClientTable } from '../database/schema';
+import { hashPassword, verifyPassword } from './PasswordService';
+import { generateID } from './SessionService';
+const ID_LENGTH = 16;
+const SECRET_LENGTH = 64;
+export async function getClientByID(id) {
+    const [client] = await db
+        .select()
+        .from(authClientTable)
+        .where(eq(authClientTable.id, id))
+        .limit(1);
+    return client;
+}
+export async function registerClient({ alias, id, secret, }) {
+    const [client] = await db
+        .insert(authClientTable)
+        .values({
+        alias,
+        id: id || generateID(ID_LENGTH),
+        secret: await hashPassword(secret || generateID(SECRET_LENGTH)),
+    })
+        .returning();
+    return client;
+}
+export async function handleClientAuth(request) {
+    const { headers } = request;
+    const header = headers.get('authorization');
+    if (!header) {
+        return null;
+    }
+    const auth = Buffer.from(header.replace('Basic ', ''), 'base64')
+        .toString('utf-8')
+        .replace(/:$/u, '');
+    const [id, ...secret] = auth.split('-');
+    const [client] = await db
+        .select()
+        .from(authClientTable)
+        .where(eq(authClientTable.id, id))
+        .limit(1);
+    if (!client) {
+        return null;
+    }
+    const isVerified = await verifyPassword(secret.join(''), client.secret);
+    return isVerified ? client : null;
+}

package/dist/auth/LoginRequest.js

@@ -0,0 +1,8 @@
+/* eslint-disable @typescript-eslint/no-magic-numbers */
+import Joi from 'joi';
+import { createSchema } from '../forms/ValidationService';
+const LoginRequest = createSchema({
+    email: Joi.string().email({ minDomainSegments: 2, tlds: false }).required(),
+    password: Joi.string().min(8).required(),
+});
+export default LoginRequest;

package/dist/auth/MFARequest.d.ts

@@ -0,0 +1,4 @@
+import Joi from 'joi';
+import type { MFAFormFields } from './interfaces';
+declare const MFARequest: Joi.ObjectSchema<MFAFormFields>;
+export default MFARequest;

package/dist/auth/MFARequest.js

@@ -0,0 +1,9 @@
+/* eslint-disable @typescript-eslint/no-magic-numbers */
+import Joi from 'joi';
+import { createSchema } from '../forms/ValidationService';
+const MFARequest = createSchema({
+    token: Joi.string()
+        .pattern(/^[0-9]{6}$/u)
+        .required(),
+});
+export default MFARequest;

package/dist/auth/MFAService.d.ts

@@ -0,0 +1,6 @@
+import type { Errorable } from '@sqrzro/interfaces';
+import type { MFAFormFields, UserObject } from './interfaces';
+export declare function checkMFAEnabled(): boolean;
+export declare function generateMFA(name: string, email?: string): Promise<string | null>;
+export declare function checkUserHasMFA(user: UserObject): Promise<boolean>;
+export declare function handleMFAForm(formData: MFAFormFields): Promise<Errorable<boolean>>;

package/dist/auth/MFAService.js

@@ -0,0 +1,105 @@
+import { and, eq, isNotNull, isNull } from 'drizzle-orm';
+import qrcode from 'qrcode';
+import { authenticator } from 'otplib';
+import { db } from '../database/DatabaseService';
+import { authMFATable, authUserTable } from '../database/schema';
+import { submitForm } from '../forms/FormService';
+import MFARequest from './MFARequest';
+import { createUserSession, generateID, getSessionUser } from './SessionService';
+export function checkMFAEnabled() {
+    return process.env.AUTH_MFA_ENABLED !== 'false';
+}
+export async function generateMFA(name, email) {
+    if (!checkMFAEnabled() || !email) {
+        return null;
+    }
+    const [user] = await db
+        .select()
+        .from(authUserTable)
+        .where(eq(authUserTable.email, email))
+        .limit(1);
+    if (!user) {
+        return null;
+    }
+    const secret = authenticator.generateSecret();
+    const otpauth = authenticator.keyuri(email, name, secret);
+    // Delete all the unverified MFA entries for this user
+    await db
+        .delete(authMFATable)
+        .where(and(eq(authMFATable.userId, user.id), isNull(authMFATable.verifiedAt)));
+    // Add the new MFA entry
+    await db.insert(authMFATable).values({
+        id: generateID(),
+        name: 'Default',
+        secret,
+        userId: user.id,
+    });
+    return new Promise((resolve, reject) => {
+        qrcode.toDataURL(otpauth, { rendererOpts: { quality: 1 }, margin: 0, scale: 2 }, (err, data) => {
+            if (err) {
+                reject(err);
+            }
+            resolve(data);
+        });
+    });
+}
+export async function checkUserHasMFA(user) {
+    if (!checkMFAEnabled()) {
+        return false;
+    }
+    const [mfa] = await db
+        .select()
+        .from(authMFATable)
+        .where(and(eq(authMFATable.userId, user.id), isNotNull(authMFATable.verifiedAt)))
+        .limit(1);
+    return Boolean(mfa);
+}
+async function markAsVerified(userID) {
+    if (!checkMFAEnabled()) {
+        return;
+    }
+    await db
+        .update(authMFATable)
+        .set({ verifiedAt: new Date() })
+        .where(eq(authMFATable.userId, userID));
+}
+async function validateUserToken(userID, token) {
+    if (!checkMFAEnabled()) {
+        return false;
+    }
+    const [mfa] = await db
+        .select()
+        .from(authMFATable)
+        .where(eq(authMFATable.userId, userID))
+        .limit(1);
+    if (!mfa) {
+        return false;
+    }
+    return authenticator.check(token, mfa.secret);
+}
+async function handleMFA(formData) {
+    if (!checkMFAEnabled()) {
+        return false;
+    }
+    const user = await getSessionUser();
+    if (!user) {
+        return false;
+    }
+    const isValid = await validateUserToken(user.id, formData.token);
+    if (!isValid) {
+        return false;
+    }
+    await markAsVerified(user.id);
+    return createUserSession(user.id, 'AUTHED');
+}
+export async function handleMFAForm(formData) {
+    if (!checkMFAEnabled()) {
+        return [null, new Error('MFA is not enabled')];
+    }
+    const response = await submitForm({
+        fn: handleMFA,
+        formData,
+        request: MFARequest,
+    });
+    return response;
+}

package/dist/auth/PasswordRequest.d.ts

@@ -0,0 +1,4 @@
+import Joi from 'joi';
+import type { PasswordFormFields } from './interfaces';
+declare const PasswordRequest: Joi.ObjectSchema<PasswordFormFields>;
+export default PasswordRequest;

package/dist/auth/PasswordRequest.js

@@ -0,0 +1,12 @@
+/* eslint-disable @typescript-eslint/no-magic-numbers */
+import Joi from 'joi';
+import { createSchema } from '../forms/ValidationService';
+const PasswordRequest = createSchema({
+    email: Joi.string().max(60).email({ minDomainSegments: 2, tlds: false }).required().messages({
+        'any.required': 'Please provide your email address, so we can send you a reset link',
+        'string.empty': 'Please provide your email address, so we can send you a reset link',
+        'string.email': 'Please make sure your email address is valid',
+        'string.max': 'Please make sure your email address is valid',
+    }),
+});
+export default PasswordRequest;

package/dist/auth/PasswordResetRequest.d.ts

@@ -0,0 +1,4 @@
+import Joi from 'joi';
+import type { PasswordResetFormFields } from './interfaces';
+declare const PasswordResetRequest: Joi.ObjectSchema<PasswordResetFormFields>;
+export default PasswordResetRequest;

package/dist/auth/PasswordResetRequest.js

@@ -0,0 +1,13 @@
+/* eslint-disable @typescript-eslint/no-magic-numbers */
+import Joi from 'joi';
+import { createSchema } from '../forms/ValidationService';
+const PasswordResetRequest = createSchema({
+    token: Joi.string()
+        .pattern(/[a-z0-9]{40}/u)
+        .required(),
+    password: Joi.string().required().messages({
+        'any.required': 'Please provide your new password',
+        'string.empty': 'Please provide your new password',
+    }),
+});
+export default PasswordResetRequest;

package/dist/auth/PasswordService.d.ts

@@ -0,0 +1,8 @@
+type PasswordRule = 'lower' | 'min' | 'number' | 'symbol' | 'upper';
+export type PasswordRuleObject = Partial<Record<PasswordRule, number>>;
+type PasswordValidityObject = Record<PasswordRule, boolean>;
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(data?: string, encrypted?: string): Promise<boolean>;
+export declare function getPasswordComplexity(password: string, rules?: Partial<PasswordRuleObject>): Promise<Partial<PasswordValidityObject>>;
+export declare function checkPasswordComplexity(password: string, rules?: Partial<PasswordRuleObject>): Promise<Partial<boolean>>;
+export {};

package/dist/auth/PasswordService.js

@@ -0,0 +1,54 @@
+import bcrypt from 'bcryptjs';
+const PW_SALT_ROUNDS = 12;
+const PASSWORD_RULES = {
+    min: 8,
+    upper: 1,
+    lower: 1,
+    number: 1,
+    symbol: 1,
+};
+function checkPasswordMin(password, value) {
+    return password.length >= value;
+}
+function checkPasswordUpper(password, value) {
+    return password.replace(/[^A-Z]/gu, '').length >= value;
+}
+function checkPasswordLower(password, value) {
+    return password.replace(/[^a-z]/gu, '').length >= value;
+}
+function checkPasswordNumber(password, value) {
+    return password.replace(/[^0-9]/gu, '').length >= value;
+}
+function checkPasswordSymbol(password, value) {
+    return password.replace(/[^$]/gu, '').length >= value;
+}
+const PASSWORD_FUNCTIONS = {
+    min: checkPasswordMin,
+    upper: checkPasswordUpper,
+    lower: checkPasswordLower,
+    number: checkPasswordNumber,
+    symbol: checkPasswordSymbol,
+};
+export async function hashPassword(password) {
+    const hash = await bcrypt.hash(password, PW_SALT_ROUNDS);
+    return hash;
+}
+export async function verifyPassword(data, encrypted) {
+    if (!data || !encrypted) {
+        return false;
+    }
+    const verified = await bcrypt.compare(data, encrypted);
+    return verified;
+}
+export async function getPasswordComplexity(password, rules = PASSWORD_RULES) {
+    const entries = Object.entries(rules);
+    const validity = entries.reduce((acc, [rule, value]) => {
+        acc[rule] = PASSWORD_FUNCTIONS[rule](password, value);
+        return acc;
+    }, {});
+    return Promise.resolve(validity);
+}
+export async function checkPasswordComplexity(password, rules = PASSWORD_RULES) {
+    const validity = await getPasswordComplexity(password, rules);
+    return Promise.resolve(Object.values(validity).every(Boolean));
+}

package/dist/auth/SessionService.d.ts

@@ -0,0 +1,42 @@
+import { Lucia } from 'lucia';
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import type { Scope } from '../database/schema';
+interface ScopeData {
+    allowedRoute?: string;
+    redirectOnAuth?: string;
+    redirectOnUnauth?: string;
+}
+export type ScopeObject = Record<Scope, ScopeData>;
+interface DatabaseSessionAttributes {
+    scope: Scope;
+}
+interface DatabaseUserAttributes {
+    email: string;
+    role: number;
+}
+declare module 'lucia' {
+    interface Register {
+        Lucia: typeof lucia;
+        DatabaseSessionAttributes: DatabaseSessionAttributes;
+        DatabaseUserAttributes: DatabaseUserAttributes;
+    }
+}
+export declare const lucia: Lucia<DatabaseSessionAttributes, DatabaseUserAttributes>;
+export declare function generateID(length?: number): string;
+export declare function invalidateSession(id: string): Promise<void>;
+export declare function invalidateUserSessions(id: string): Promise<void>;
+export declare function createUserSession(id: string, scope?: Scope): Promise<boolean>;
+export declare function getSessionID(): string | null;
+export declare function checkSessionExists(): boolean;
+export declare function getSessionUser(): Promise<{
+    id: string;
+    email: string;
+    role: number;
+} | null>;
+export declare function checkRouteAllowed(pathname: string, route?: string): boolean;
+export declare function getScopes(): Promise<ScopeObject>;
+export declare function getScopeByID(id: Scope): Promise<ScopeData>;
+export declare function setScopes(customScopes?: Partial<ScopeObject>): Promise<void>;
+export declare function handleSession(request: NextRequest, customScopes?: Partial<ScopeObject>): Promise<NextResponse>;
+export {};