@stacksjs/auth 0.70.87 → 0.70.90

package/dist/password/reset.js

@@ -0,0 +1,156 @@
+import { randomBytes } from "node:crypto";
+import { config } from "@stacksjs/config";
+import { db } from "@stacksjs/database";
+import { mail, template } from "@stacksjs/email";
+import { log } from "@stacksjs/logging";
+import { formatDate } from "@stacksjs/orm";
+import { makeHash, verifyHash } from "@stacksjs/security";
+import { sessionDestroyAll } from "../session-auth";
+import { revokeAllTokens } from "../tokens";
+function getTokenExpireMinutes() {
+  return config.auth.passwordReset?.expire ?? 60;
+}
+function isWithinExpiry(row) {
+  const explicit = row.expires_at;
+  if (typeof explicit === "string" || explicit instanceof Date)
+    return new Date(explicit).getTime() > Date.now();
+  const created = row.created_at;
+  if (typeof created === "string" || created instanceof Date) {
+    const expireMinutes = getTokenExpireMinutes();
+    return new Date(created).getTime() + expireMinutes * 60000 > Date.now();
+  }
+  return !1;
+}
+async function sendPasswordChangedNotification(userEmail) {
+  const appName = config.app.name || "Stacks", supportEmail = config.app.supportEmail || config.email?.from?.address || "", changedAt = new Date().toLocaleString("en-US", {
+    dateStyle: "full",
+    timeStyle: "short"
+  });
+  try {
+    const { html, text } = await template("password-changed", {
+      subject: `Your ${appName} password has been changed`,
+      variables: {
+        changedAt,
+        supportEmail
+      }
+    });
+    if (!html && !text) {
+      await mail.send({
+        to: userEmail,
+        subject: `Your ${appName} password has been changed`,
+        text: `Your ${appName} password was changed on ${changedAt}.${supportEmail ? ` If this wasn't you, contact ${supportEmail}.` : ""}`
+      });
+      return;
+    }
+    await mail.send({
+      to: userEmail,
+      subject: `Your ${appName} password has been changed`,
+      text,
+      html
+    });
+  } catch (error) {
+    console.error("[PasswordReset] Failed to send password changed notification:", error);
+  }
+}
+export function passwordResets(email) {
+  function generateResetToken() {
+    return randomBytes(32).toString("hex");
+  }
+  async function createResetToken() {
+    const token = generateResetToken(), hashedToken = await makeHash(token, { algorithm: "bcrypt" }), expireMinutes = getTokenExpireMinutes(), expiresAt = new Date(Date.now() + expireMinutes * 60000).toISOString();
+    await db.deleteFrom("password_resets").where("email", "=", email).execute();
+    await db.insertInto("password_resets").values({
+      email,
+      token: hashedToken,
+      expires_at: expiresAt
+    }).executeTakeFirst();
+    return token;
+  }
+  async function sendEmail() {
+    if (!await db.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst())
+      return;
+    const token = await createResetToken(), expireMinutes = getTokenExpireMinutes(), appName = config.app.name || "Stacks", base = config.app.url ? `https://${config.app.url}` : `http://localhost:${process.env.PORT || "3000"}`, filled = (config.auth.passwordReset?.url ?? "/password/reset/{token}?email={email}").replace("{token}", token).replace("{email}", encodeURIComponent(email)), resetUrl = /^https?:\/\//.test(filled) ? filled : `${base}${filled.startsWith("/") ? "" : "/"}${filled}`;
+    try {
+      const { html, text } = await template("password-reset", {
+        subject: `Reset Your ${appName} Password`,
+        variables: {
+          resetUrl,
+          expireMinutes
+        }
+      });
+      if (!html && !text)
+        throw Error("password-reset template missing or rendered empty");
+      await mail.send({
+        to: email,
+        subject: `Reset Your ${appName} Password`,
+        text,
+        html
+      });
+    } catch (templateError) {
+      const msg = templateError instanceof Error ? templateError.message : String(templateError);
+      console.warn(`[PasswordReset] template render failed, sending plain-text fallback: ${msg}`);
+      await mail.send({
+        to: email,
+        subject: `Reset Your ${appName} Password`,
+        text: `Reset your password by visiting: ${resetUrl}
+
+This link expires in ${expireMinutes} minutes. If you didn't request this, you can safely ignore this email.`
+      });
+    }
+  }
+  async function verifyToken(token) {
+    const result = await db.selectFrom("password_resets").where("email", "=", email).selectAll().executeTakeFirst();
+    if (!result)
+      return !1;
+    if (!isWithinExpiry(result)) {
+      await db.deleteFrom("password_resets").where("email", "=", email).execute();
+      return !1;
+    }
+    const hashedToken = result.token;
+    return await verifyHash(token, hashedToken);
+  }
+  async function resetPassword(token, newPassword) {
+    const result = await db.transaction(async (rawTrx) => {
+      const trx = rawTrx, resetRecord = await trx.selectFrom("password_resets").where("email", "=", email).selectAll().executeTakeFirst();
+      if (!resetRecord)
+        return { success: !1, message: "Invalid or expired reset token" };
+      if (!isWithinExpiry(resetRecord)) {
+        await trx.deleteFrom("password_resets").where("email", "=", email).execute();
+        return { success: !1, message: "This password reset link has expired. Please request a new one." };
+      }
+      const hashedToken = resetRecord.token;
+      if (!await verifyHash(token, hashedToken))
+        return { success: !1, message: "Invalid or expired reset token" };
+      const user = await trx.selectFrom("users").where("email", "=", email).selectAll().executeTakeFirst();
+      if (!user)
+        return { success: !1, message: "Invalid or expired reset token" };
+      const hashedPassword = await makeHash(newPassword, { algorithm: "bcrypt" });
+      try {
+        await trx.updateTable("users").set({ password: hashedPassword, password_changed_at: formatDate(new Date) }).where("email", "=", email).executeTakeFirst();
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (/password_changed_at|no such column|unknown column/i.test(message)) {
+          log.warn("[PasswordReset] password_changed_at column missing \u2014 run `buddy migrate`; resetting without the credential-version stamp");
+          await trx.updateTable("users").set({ password: hashedPassword }).where("email", "=", email).executeTakeFirst();
+        } else
+          throw err;
+      }
+      await trx.deleteFrom("password_resets").where("email", "=", email).execute();
+      return { success: !0, userId: Number(user.id) };
+    });
+    if (result.success) {
+      await revokeAllTokens(result.userId);
+      await sessionDestroyAll(result.userId);
+      sendPasswordChangedNotification(email).catch((err) => {
+        console.error("[PasswordReset] Failed to send notification:", err);
+      });
+      return { success: !0 };
+    }
+    return result;
+  }
+  return {
+    sendEmail,
+    verifyToken,
+    resetPassword
+  };
+}

package/dist/policy.js

@@ -0,0 +1,91 @@
+import { AuthorizationResponse } from "./gate";
+
+export class BasePolicy {
+  allow(message) {
+    return AuthorizationResponse.allow(message);
+  }
+  deny(message, code) {
+    return AuthorizationResponse.deny(message, code);
+  }
+  denyIf(condition, message) {
+    if (condition)
+      return this.deny(message);
+    return !0;
+  }
+  denyUnless(condition, message) {
+    if (!condition)
+      return this.deny(message);
+    return !0;
+  }
+  allowIf(condition, message) {
+    if (condition)
+      return this.allow(message);
+    return !1;
+  }
+}
+import { log } from "@stacksjs/logging";
+import * as p from "@stacksjs/path";
+import { policy as registerPolicy } from "./gate";
+export async function discoverPolicies() {
+  const { fs } = await import("@stacksjs/storage"), policiesDir = p.appPath("Policies");
+  if (!fs.existsSync(policiesDir)) {
+    log.debug("No Policies directory found");
+    return;
+  }
+  try {
+    const mappings = (await import(p.appPath("Gates.ts"))).policies || {};
+    for (const [modelName, config] of Object.entries(mappings)) {
+      const policyFile = typeof config === "string" ? config : config.policy, policyPath = `${policiesDir}/${policyFile}.ts`;
+      if (fs.existsSync(policyPath)) {
+        const policyModule = await import(policyPath), PolicyClass = policyModule.default || policyModule[policyFile];
+        if (PolicyClass) {
+          registerPolicy(modelName, PolicyClass);
+          log.debug(`Registered policy: ${policyFile} for ${modelName}`);
+        }
+      }
+    }
+  } catch {
+    log.debug("No Gates.ts found, using convention-based discovery");
+  }
+  const policyFiles = fs.readdirSync(policiesDir).filter((file) => file.endsWith("Policy.ts"));
+  for (const file of policyFiles) {
+    const policyName = file.replace(".ts", ""), modelName = policyName.replace("Policy", ""), policyPath = `${policiesDir}/${file}`;
+    try {
+      const policyModule = await import(policyPath), PolicyClass = policyModule.default || policyModule[policyName];
+      if (PolicyClass) {
+        registerPolicy(modelName, PolicyClass);
+        log.debug(`Auto-discovered policy: ${policyName} for ${modelName}`);
+      }
+    } catch (error) {
+      log.error(`Failed to load policy ${policyName}:`, error);
+    }
+  }
+}
+export async function registerGates() {
+  const { define, before, after } = await import("./gate");
+  try {
+    const gatesModule = await import(p.appPath("Gates.ts")), gates = gatesModule.gates || gatesModule.default?.gates || {};
+    for (const [ability, callback] of Object.entries(gates))
+      if (typeof callback === "function") {
+        define(ability, callback);
+        log.debug(`Registered gate: ${ability}`);
+      }
+    const beforeCallbacks = gatesModule.before || gatesModule.default?.before || [];
+    for (const callback of beforeCallbacks)
+      if (typeof callback === "function")
+        before(callback);
+    const afterCallbacks = gatesModule.after || gatesModule.default?.after || [];
+    for (const callback of afterCallbacks)
+      if (typeof callback === "function")
+        after(callback);
+    log.debug("Gates registered successfully");
+  } catch {
+    log.debug("No Gates.ts found or failed to load");
+  }
+}
+export async function initializeAuthorization() {
+  await registerGates();
+  await discoverPolicies();
+}
+
+export { AuthorizationResponse };

package/dist/rate-limiter.js

@@ -0,0 +1,91 @@
+import { HttpError } from "@stacksjs/error-handling";
+const MAX_ATTEMPTS = 5, LOCKOUT_DURATION = 900000, MAX_STORE_SIZE = 1e4, EVICTION_INTERVAL = 300000;
+
+class MemoryStore {
+  store = new Map;
+  lastEviction = Date.now();
+  evict() {
+    const now = Date.now(), intervalElapsed = now - this.lastEviction >= EVICTION_INTERVAL, overCapacity = this.store.size >= MAX_STORE_SIZE;
+    if (!intervalElapsed && !overCapacity)
+      return;
+    this.lastEviction = now;
+    for (const [key, value] of this.store)
+      if (value.lockedUntil > 0 && value.lockedUntil <= now)
+        this.store.delete(key);
+      else if (value.lockedUntil === 0 && value.attempts === 0)
+        this.store.delete(key);
+  }
+  get(key) {
+    this.evict();
+    return this.store.get(key);
+  }
+  set(key, entry) {
+    this.store.set(key, entry);
+  }
+  delete(key) {
+    this.store.delete(key);
+  }
+}
+
+class CacheStore {
+  prefix = "auth:ratelimit:";
+  async get(key) {
+    const { cache } = await import("@stacksjs/cache"), raw = await cache.get(`${this.prefix}${key}`);
+    if (raw == null)
+      return;
+    try {
+      return typeof raw === "string" ? JSON.parse(raw) : raw;
+    } catch {
+      return;
+    }
+  }
+  async set(key, entry, ttlMs) {
+    const { cache } = await import("@stacksjs/cache");
+    await cache.set(`${this.prefix}${key}`, JSON.stringify(entry), Math.ceil(ttlMs / 1000));
+  }
+  async delete(key) {
+    const { cache } = await import("@stacksjs/cache");
+    await cache.remove(`${this.prefix}${key}`);
+  }
+}
+let store = new MemoryStore;
+
+export class RateLimiter {
+  static useStore(custom) {
+    store = custom;
+  }
+  static useSharedStore() {
+    store = new CacheStore;
+  }
+  static useMemoryStore() {
+    store = new MemoryStore;
+  }
+  static async isRateLimited(email) {
+    email = email.toLowerCase();
+    const now = Date.now(), userAttempts = await store.get(email);
+    if (!userAttempts)
+      return !1;
+    if (userAttempts.lockedUntil > 0 && userAttempts.lockedUntil <= now) {
+      await store.delete(email);
+      return !1;
+    }
+    return userAttempts.lockedUntil > 0;
+  }
+  static async recordFailedAttempt(email) {
+    email = email.toLowerCase();
+    const now = Date.now(), userAttempts = await store.get(email) || { attempts: 0, lockedUntil: 0 };
+    userAttempts.attempts++;
+    if (userAttempts.attempts >= MAX_ATTEMPTS) {
+      userAttempts.lockedUntil = now + LOCKOUT_DURATION;
+      userAttempts.attempts = 0;
+    }
+    await store.set(email, userAttempts, LOCKOUT_DURATION);
+  }
+  static async resetAttempts(email) {
+    await store.delete(email.toLowerCase());
+  }
+  static async validateAttempt(email) {
+    if (await this.isRateLimited(email))
+      throw new HttpError(429, "Too many login attempts. Please try again later.");
+  }
+}

package/dist/rbac-seed.js

@@ -0,0 +1,30 @@
+import { createRole, findRole } from "./rbac";
+export const DEFAULT_ROLE_PACKS = [
+  {
+    name: "admin",
+    guard_name: "web",
+    description: "Full access. Sees every dashboard surface, every model, every infra control."
+  },
+  {
+    name: "dev",
+    guard_name: "web",
+    description: "Developer / infra. Sees dev-mode surfaces (CI, query inspector, runner alerts) but not billing/admin-only management."
+  },
+  {
+    name: "client",
+    guard_name: "web",
+    description: "End user / client. Sees content, orders, profile, billing \u2014 no dev tools, no infra surfaces."
+  }
+];
+export async function seedDefaultRoles() {
+  const created = [], skipped = [];
+  for (const pack of DEFAULT_ROLE_PACKS) {
+    if (await findRole(pack.name, pack.guard_name)) {
+      skipped.push({ name: pack.name, guard_name: pack.guard_name, reason: "already_exists" });
+      continue;
+    }
+    const role = await createRole(pack.name, pack.guard_name, pack.description);
+    created.push(role);
+  }
+  return { created, skipped };
+}

package/dist/rbac-store-bqb.js

@@ -0,0 +1,180 @@
+import { db } from "@stacksjs/database";
+import { isUniqueViolation } from "@stacksjs/orm";
+
+export { isUniqueViolation };
+export function swallowDuplicate(err) {
+  if (!isUniqueViolation(err))
+    throw err;
+}
+export function toRecord(row) {
+  if (!row)
+    return null;
+  return {
+    id: Number(row.id),
+    name: String(row.name),
+    guard_name: String(row.guard_name),
+    description: row.description == null ? void 0 : String(row.description),
+    created_at: row.created_at == null ? void 0 : String(row.created_at),
+    updated_at: row.updated_at == null ? void 0 : String(row.updated_at)
+  };
+}
+async function insertAndFetch(table, name, guardName, description) {
+  await db.insertInto(table).values({ name, guard_name: guardName, description: description ?? null }).execute();
+  const row = await db.selectFrom(table).selectAll().where("name", "=", name).where("guard_name", "=", guardName).orderBy("id", "desc").limit(1).executeTakeFirst(), rec = toRecord(row);
+  if (!rec)
+    throw Error(`[rbac] insertAndFetch(${table}, ${name}, ${guardName}) succeeded but follow-up SELECT returned nothing`);
+  return rec;
+}
+async function pivotAttach(table, cols) {
+  let q = db.selectFrom(table).select("user_id" in cols ? "user_id" : "role_id");
+  for (const [k, v] of Object.entries(cols))
+    q = q.where(k, "=", v);
+  if (await q.limit(1).executeTakeFirst())
+    return;
+  try {
+    await db.insertInto(table).values(cols).execute();
+  } catch (err) {
+    swallowDuplicate(err);
+  }
+}
+async function pivotDetach(table, cols) {
+  let q = db.deleteFrom(table);
+  for (const [k, v] of Object.entries(cols))
+    q = q.where(k, "=", v);
+  await q.execute();
+}
+async function pivotDetachAll(table, column, value) {
+  await db.deleteFrom(table).where(column, "=", value).execute();
+}
+async function pivotSync(table, ownerColumn, ownerId, targetColumn, targetIds) {
+  const unique = Array.from(new Set(targetIds));
+  await db.transaction(async (rawTrx) => {
+    const trx = rawTrx;
+    await trx.deleteFrom(table).where(ownerColumn, "=", ownerId).execute();
+    if (unique.length === 0)
+      return;
+    const rows = unique.map((id) => ({ [ownerColumn]: ownerId, [targetColumn]: id }));
+    try {
+      await trx.insertInto(table).values(rows).execute();
+    } catch (err) {
+      swallowDuplicate(err);
+      for (const id of unique)
+        try {
+          await trx.insertInto(table).values({ [ownerColumn]: ownerId, [targetColumn]: id }).execute();
+        } catch (innerErr) {
+          swallowDuplicate(innerErr);
+        }
+    }
+  });
+}
+export function createBqbRbacStore() {
+  return {
+    async findRoleByName(name, guardName = "web") {
+      const row = await db.selectFrom("roles").selectAll().where("name", "=", name).where("guard_name", "=", guardName).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async findRoleById(id) {
+      const row = await db.selectFrom("roles").selectAll().where("id", "=", id).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async createRole(name, guardName = "web", description) {
+      return await insertAndFetch("roles", name, guardName, description);
+    },
+    async deleteRole(id) {
+      await db.deleteFrom("user_roles").where("role_id", "=", id).execute();
+      await db.deleteFrom("role_permissions").where("role_id", "=", id).execute();
+      await db.deleteFrom("roles").where("id", "=", id).execute();
+    },
+    async getAllRoles(guardName) {
+      let q = db.selectFrom("roles").selectAll();
+      if (guardName)
+        q = q.where("guard_name", "=", guardName);
+      return (await q.orderBy("id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    async findPermissionByName(name, guardName = "web") {
+      const row = await db.selectFrom("permissions").selectAll().where("name", "=", name).where("guard_name", "=", guardName).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async findPermissionById(id) {
+      const row = await db.selectFrom("permissions").selectAll().where("id", "=", id).limit(1).executeTakeFirst();
+      return toRecord(row);
+    },
+    async createPermission(name, guardName = "web", description) {
+      return await insertAndFetch("permissions", name, guardName, description);
+    },
+    async deletePermission(id) {
+      await db.deleteFrom("user_permissions").where("permission_id", "=", id).execute();
+      await db.deleteFrom("role_permissions").where("permission_id", "=", id).execute();
+      await db.deleteFrom("permissions").where("id", "=", id).execute();
+    },
+    async getAllPermissions(guardName) {
+      let q = db.selectFrom("permissions").selectAll();
+      if (guardName)
+        q = q.where("guard_name", "=", guardName);
+      return (await q.orderBy("id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    async getUserRoles(userId) {
+      return (await db.selectFrom("roles").innerJoin("user_roles", "user_roles.role_id", "=", "roles.id").select([
+        "roles.id as id",
+        "roles.name as name",
+        "roles.guard_name as guard_name",
+        "roles.description as description",
+        "roles.created_at as created_at",
+        "roles.updated_at as updated_at"
+      ]).where("user_roles.user_id", "=", userId).orderBy("roles.id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    assignRoleToUser(userId, roleId) {
+      return pivotAttach("user_roles", { user_id: userId, role_id: roleId });
+    },
+    removeRoleFromUser(userId, roleId) {
+      return pivotDetach("user_roles", { user_id: userId, role_id: roleId });
+    },
+    removeAllRolesFromUser(userId) {
+      return pivotDetachAll("user_roles", "user_id", userId);
+    },
+    syncUserRoles(userId, roleIds) {
+      return pivotSync("user_roles", "user_id", userId, "role_id", roleIds);
+    },
+    async getUserDirectPermissions(userId) {
+      return (await db.selectFrom("permissions").innerJoin("user_permissions", "user_permissions.permission_id", "=", "permissions.id").select([
+        "permissions.id as id",
+        "permissions.name as name",
+        "permissions.guard_name as guard_name",
+        "permissions.description as description",
+        "permissions.created_at as created_at",
+        "permissions.updated_at as updated_at"
+      ]).where("user_permissions.user_id", "=", userId).orderBy("permissions.id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    assignPermissionToUser(userId, permissionId) {
+      return pivotAttach("user_permissions", { user_id: userId, permission_id: permissionId });
+    },
+    removePermissionFromUser(userId, permissionId) {
+      return pivotDetach("user_permissions", { user_id: userId, permission_id: permissionId });
+    },
+    removeAllPermissionsFromUser(userId) {
+      return pivotDetachAll("user_permissions", "user_id", userId);
+    },
+    syncUserPermissions(userId, permissionIds) {
+      return pivotSync("user_permissions", "user_id", userId, "permission_id", permissionIds);
+    },
+    async getRolePermissions(roleId) {
+      return (await db.selectFrom("permissions").innerJoin("role_permissions", "role_permissions.permission_id", "=", "permissions.id").select([
+        "permissions.id as id",
+        "permissions.name as name",
+        "permissions.guard_name as guard_name",
+        "permissions.description as description",
+        "permissions.created_at as created_at",
+        "permissions.updated_at as updated_at"
+      ]).where("role_permissions.role_id", "=", roleId).orderBy("permissions.id", "asc").execute()).map((r) => toRecord(r)).filter(Boolean);
+    },
+    assignPermissionToRole(roleId, permissionId) {
+      return pivotAttach("role_permissions", { role_id: roleId, permission_id: permissionId });
+    },
+    removePermissionFromRole(roleId, permissionId) {
+      return pivotDetach("role_permissions", { role_id: roleId, permission_id: permissionId });
+    },
+    syncRolePermissions(roleId, permissionIds) {
+      return pivotSync("role_permissions", "role_id", roleId, "permission_id", permissionIds);
+    }
+  };
+}