@stacksjs/defaults 0.70.58 → 0.70.60

package/app/Actions/AI/AskAction.ts

@@ -0,0 +1,40 @@
+import { Action } from '@stacksjs/actions'
+import { ask } from '@stacksjs/ai'
+import { schema } from '@stacksjs/validation'
+
+// TODO: this should have been auto-generated
+interface Request {
+  question: string
+}
+
+export default new Action({
+  name: 'AiAskAction',
+  description: 'Ask AI',
+  method: 'POST',
+
+  validations: {
+    question: {
+      rule: schema.string().min(3).max(255),
+      message: 'The question must be between 3 and 255 characters long.',
+    },
+  },
+
+  async handle(request: Request) {
+    try {
+      const question = request.question
+
+      console.log(`Question received: ${question}`)
+
+      return {
+        data: await ask(question),
+      }
+    }
+    catch (error) {
+      console.error('Error:', error)
+
+      return {
+        error: 'An error occurred while processing your request.',
+      }
+    }
+  },
+})

package/app/Actions/AI/SummaryAction.ts

@@ -0,0 +1,40 @@
+import { Action } from '@stacksjs/actions'
+import { summarize } from '@stacksjs/ai'
+import { schema } from '@stacksjs/validation'
+
+// TODO: this should have been auto-generated
+interface Request {
+  text: string
+}
+
+export default new Action({
+  name: 'AiSummaryAction',
+  description: 'Summary AI',
+  method: 'POST',
+
+  validations: {
+    text: {
+      rule: schema.string().min(3),
+      message: 'The text must be at least 3 characters long.',
+    },
+  },
+
+  async handle(request: Request) {
+    try {
+      const text = request.text
+
+      console.log(`Text received: ${text}`)
+
+      return {
+        data: await summarize(text),
+      }
+    }
+    catch (error) {
+      console.error('Error:', error)
+
+      return {
+        error: 'An error occurred while processing your request.',
+      }
+    }
+  },
+})

package/app/Actions/Auth/AuthUserAction.ts

@@ -0,0 +1,13 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'AuthUserAction',
+  description: 'Get the authenticated user',
+  method: 'GET',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    return response.json(user)
+  },
+})

package/app/Actions/Auth/CreateTokenAction.ts

@@ -0,0 +1,64 @@
+import { Action } from '@stacksjs/actions'
+import { createToken } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+
+export default new Action({
+  name: 'CreateTokenAction',
+  description: 'Create a new personal access token with custom scopes',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user) {
+      return response.unauthorized('Authentication required')
+    }
+
+    const name = request.get('name') || 'access-token'
+    const scopes = request.get('scopes') || ['*']
+    const expiresInMinutes = request.get('expires_in_minutes') || 60
+
+    await request.validate({
+      name: {
+        rule: schema.string().min(1).max(255).optional(),
+        message: {
+          min: 'Token name must be at least 1 character',
+          max: 'Token name must be at most 255 characters',
+        },
+      },
+    })
+
+    // Parse scopes - can be array or comma-separated string
+    let scopeArray: string[] = ['*']
+    if (Array.isArray(scopes)) {
+      scopeArray = scopes
+    }
+    else if (typeof scopes === 'string') {
+      scopeArray = scopes.split(',').map(s => s.trim()).filter(Boolean)
+    }
+
+    try {
+      const result = await createToken(user.id, name, scopeArray, {
+        expiresInMinutes: Number(expiresInMinutes) || 60,
+        withRefreshToken: true,
+        refreshExpiresInDays: 30,
+      })
+
+      return response.json({
+        access_token: result.plainTextToken,
+        refresh_token: result.refreshToken,
+        token_type: 'Bearer',
+        expires_in: result.expiresIn,
+        token: {
+          id: result.accessToken.id,
+          name: result.accessToken.name,
+          scopes: result.accessToken.scopes,
+          expires_at: result.accessToken.expiresAt?.toISOString() || null,
+        },
+      })
+    }
+    catch (error: any) {
+      return response.serverError(error.message || 'Failed to create token')
+    }
+  },
+})

package/app/Actions/Auth/DisableTwoFactorAction.ts

@@ -0,0 +1,37 @@
+import { Action } from '@stacksjs/actions'
+import { Auth, disableTwoFactor } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+
+export default new Action({
+  name: 'DisableTwoFactorAction',
+  description: 'Disable TOTP 2FA for the authenticated user, after re-confirming their password',
+  method: 'POST',
+
+  validations: {
+    password: {
+      rule: schema.string().min(1),
+      message: 'Password is required to disable two-factor authentication.',
+    },
+  },
+
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+    if (!user)
+      return response.unauthorized('Unauthorized')
+
+    const password = request.get('password')
+
+    // Disabling 2FA weakens the account — require the password again
+    // rather than trusting the bearer token alone (a stolen/leaked
+    // token shouldn't be enough to turn off the second factor it's
+    // meant to help guard against).
+    const confirmed = await Auth.validate({ email: user.email, password })
+    if (!confirmed)
+      return response.unauthorized('Incorrect password')
+
+    await disableTwoFactor(user.id as number)
+
+    return response.json({ enabled: false })
+  },
+})

package/app/Actions/Auth/EnableTwoFactorAction.ts

@@ -0,0 +1,37 @@
+import { Action } from '@stacksjs/actions'
+import { consumePendingTwoFactorSecret, enableTwoFactor } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+
+export default new Action({
+  name: 'EnableTwoFactorAction',
+  description: 'Verify a TOTP setup code against the server-stashed pending secret and, if valid, enable 2FA',
+  method: 'POST',
+
+  validations: {
+    code: {
+      rule: schema.string().min(6).max(6),
+      message: 'Code must be a 6-digit TOTP code.',
+    },
+  },
+
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+    if (!user)
+      return response.unauthorized('Unauthorized')
+
+    const code = request.get('code')
+
+    // The secret is never taken from the client — see
+    // GenerateTwoFactorSecretAction / two-factor.ts's doc comment.
+    const pendingSecret = await consumePendingTwoFactorSecret(user.id as number)
+    if (!pendingSecret)
+      return response.unauthorized('No pending setup found — please generate a new QR code and try again.')
+
+    const enabled = await enableTwoFactor(user.id as number, pendingSecret, code)
+    if (!enabled)
+      return response.unauthorized('Invalid code — please check your authenticator app and try again.')
+
+    return response.json({ enabled: true })
+  },
+})

package/app/Actions/Auth/GenerateAuthenticationAction.ts

@@ -0,0 +1,51 @@
+import type { PublicKeyCredentialRequestOptionsJSON } from '@stacksjs/auth'
+import { Action } from '@stacksjs/actions'
+import {
+  generateAuthenticationOptions,
+  getUserPasskeys,
+  storeWebAuthnChallenge,
+} from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { User } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'PasskeyAuthenticationAction',
+  description: 'Generate Passkey Authentication Options',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const email = request.get('email')
+
+    if (!email) {
+      return Response.json({ error: 'Email is required' }, { status: 422 })
+    }
+
+    const user = await User.where('email', email).first()
+
+    if (!user) {
+      return Response.json({ error: 'User not found' }, { status: 404 })
+    }
+
+    const userPasskeys = await getUserPasskeys(user.id as number)
+
+    // Use configured app URL for rpID instead of hardcoded localhost
+    const appUrl = config.app?.url || 'localhost'
+    const rpID = new URL(appUrl.startsWith('http') ? appUrl : `https://${appUrl}`).hostname
+
+    const options: PublicKeyCredentialRequestOptionsJSON = await generateAuthenticationOptions({
+      rpID,
+      allowCredentials: userPasskeys.map(passkey => ({
+        id: passkey.id,
+        transports: ['internal'],
+      })),
+    })
+
+    // Persist the challenge server-side so `VerifyAuthenticationAction`
+    // can consume it from the DB instead of trusting `body.challenge`.
+    // The previous round-trip-through-the-client pattern let an
+    // attacker who captured an assertion replay it as long as they
+    // also captured the challenge. See stacksjs/stacks#1866.
+    await storeWebAuthnChallenge(user.id as number, options.challenge, 'authentication')
+
+    return options
+  },
+})

package/app/Actions/Auth/GenerateRegistrationAction.ts

@@ -0,0 +1,53 @@
+import { Action } from '@stacksjs/actions'
+import { generateRegistrationOptions, getUserPasskeys, storeWebAuthnChallenge } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+
+export default new Action({
+  name: 'PasskeyRegistrationAction',
+  description: 'Generate Passkey Registration Options',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    // Enrolling a passkey attaches a new login credential to an
+    // account — the identity MUST come from the caller's own
+    // authenticated session, never a client-supplied `email` field.
+    // Trusting `request.get('email')` here let anyone who knew a
+    // victim's email register a passkey against that victim's
+    // account and log in as them, no password required. This route
+    // must stay behind `middleware('auth')` — see routes/dashboard.ts.
+    const user = await request.user()
+
+    if (!user)
+      return Response.json({ error: 'Unauthorized' }, { status: 401 })
+
+    const userPasskeys = await getUserPasskeys(user.id as number)
+    const userEmail = user.email ?? ''
+
+    // Use configured app URL for rpID instead of hardcoded localhost
+    const appUrl = config.app?.url || 'localhost'
+    const rpID = new URL(appUrl.startsWith('http') ? appUrl : `https://${appUrl}`).hostname
+    const rpName = config.app?.name || 'Stacks'
+
+    const options = await generateRegistrationOptions({
+      rpName,
+      rpID,
+      userName: userEmail,
+      attestationType: 'none',
+      excludeCredentials: userPasskeys.map(passkey => ({
+        id: passkey.id,
+        transports: ['internal'],
+      })),
+      authenticatorSelection: {
+        residentKey: 'preferred',
+        userVerification: 'preferred',
+        authenticatorAttachment: 'platform',
+      },
+    })
+
+    // Persist the challenge server-side so VerifyRegistrationAction
+    // can consume it instead of trusting `body.challenge`. See
+    // stacksjs/stacks#1866.
+    await storeWebAuthnChallenge(user.id as number, options.challenge, 'registration')
+
+    return options
+  },
+})

package/app/Actions/Auth/GenerateTwoFactorSecretAction.ts

@@ -0,0 +1,26 @@
+import { Action } from '@stacksjs/actions'
+import { generateTwoFactorSetup, stashPendingTwoFactorSecret } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'GenerateTwoFactorSecretAction',
+  description: 'Generate a new TOTP secret + otpauth URI for the authenticated user to scan',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+    if (!user)
+      return response.unauthorized('Unauthorized')
+
+    const appName = config.app?.name || 'Stacks'
+    const { secret, uri } = generateTwoFactorSetup(user.email ?? '', appName)
+
+    // Not persisted to users.two_factor_secret until EnableTwoFactorAction
+    // verifies a code produced from it — but stashed server-side now so
+    // that step never has to trust a client-supplied secret. See
+    // two-factor.ts's doc comment for why.
+    await stashPendingTwoFactorSecret(user.id as number, secret)
+
+    return response.json({ secret, uri })
+  },
+})

package/app/Actions/Auth/ListTokensAction.ts

@@ -0,0 +1,30 @@
+import { Action } from '@stacksjs/actions'
+import { tokens } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'ListTokensAction',
+  description: 'List all access tokens for the authenticated user',
+  method: 'GET',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user) {
+      return response.unauthorized('Authentication required')
+    }
+
+    const userTokens = await tokens(user.id)
+
+    return response.json({
+      tokens: userTokens.map(token => ({
+        id: token.id,
+        name: token.name,
+        scopes: token.scopes,
+        expires_at: token.expiresAt?.toISOString() || null,
+        created_at: token.createdAt.toISOString(),
+        last_used_at: token.updatedAt.toISOString(),
+      })),
+      count: userTokens.length,
+    })
+  },
+})

package/app/Actions/Auth/LoginAction.ts

@@ -0,0 +1,73 @@
+import { createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/auth'
+import { User } from '@stacksjs/orm'
+
+export default new Action({
+  name: 'LoginAction',
+  description: 'Login to the application',
+  method: 'POST',
+
+  validations: {
+    email: {
+      rule: schema.string().email(),
+      message: 'Email must be a valid email address.',
+    },
+    password: {
+      rule: schema.string().min(6).max(255),
+      message: 'Password must be between 6 and 255 characters.',
+    },
+  },
+
+  async handle(request: RequestInstance) {
+    const email = request.get('email')
+    const password = request.get('password')
+
+    // Verify credentials WITHOUT minting tokens yet — if the account
+    // has TOTP 2FA enabled, no token pack should exist until the code
+    // is also verified (VerifyTwoFactorLoginAction mints the real
+    // pack via Auth.loginUsingId, same as the non-2FA path below).
+    const isValid = await Auth.attempt({ email, password })
+    if (!isValid)
+      return response.unauthorized('Incorrect email or password')
+
+    const authedUser = await User.where('email', '=', email).first()
+    if (!authedUser)
+      return response.unauthorized('Incorrect email or password')
+
+    const { enabled: twoFactorEnabled } = await getTwoFactorState(authedUser.id as number)
+    if (twoFactorEnabled) {
+      const challengeToken = await createTwoFactorChallenge(authedUser.id as number)
+      return response.json({
+        requires_two_factor: true,
+        challenge_token: challengeToken,
+      })
+    }
+
+    const result = await Auth.loginUsingId(authedUser.id as number)
+    if (!result)
+      return response.unauthorized('Incorrect email or password')
+
+    const user = result.user
+
+    // OAuth2-compatible payload. Clients should:
+    //   - Send `Authorization: Bearer <access_token>` for API calls.
+    //   - Cache the access token for at most `expires_in` seconds.
+    //   - Exchange `refresh_token` at /auth/refresh when the access
+    //     token nears expiry. The refresh token is single-use; the
+    //     refresh response returns a new pair (rotation).
+    // The legacy `token` field is kept for backward compatibility
+    // with clients that haven't been updated yet — it shadows
+    // `access_token` and will be removed in a future major.
+    return response.json({
+      access_token: result.token,
+      refresh_token: result.refreshToken,
+      token_type: 'Bearer',
+      expires_in: result.expiresIn,
+      token: result.token,
+      user: {
+        id: user?.id,
+        email: user?.email,
+        name: user?.name,
+      },
+    })
+  },
+})

package/app/Actions/Auth/LogoutAction.ts

@@ -0,0 +1,16 @@
+import { Action } from '@stacksjs/actions'
+import { Auth } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'LogoutAction',
+  description: 'Logout from the application',
+  method: 'POST',
+  async handle() {
+    await Auth.logout()
+
+    return response.json({
+      message: 'Successfully logged out',
+    })
+  },
+})

package/app/Actions/Auth/LogoutAllAction.ts

@@ -0,0 +1,28 @@
+import { Action } from '@stacksjs/actions'
+import { revokeAllTokens, sessionDestroyAll } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+
+export default new Action({
+  name: 'LogoutAllAction',
+  description: 'Logout from all devices',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user?.id) {
+      return response.unauthorized('Authentication required')
+    }
+
+    // Revoke every access + refresh token, then destroy every session
+    // row for the user. Awaited un-caught (fail-loud) so a partial sweep
+    // surfaces as a 500 instead of a "logged out everywhere" that left a
+    // credential alive — same rationale as the password-reset sweep
+    // (stacksjs/stacks#1957, #1947).
+    await revokeAllTokens(Number(user.id))
+    await sessionDestroyAll(Number(user.id))
+
+    return response.json({
+      message: 'Successfully logged out from all devices',
+    })
+  },
+})

package/app/Actions/Auth/RefreshTokenAction.ts

@@ -0,0 +1,39 @@
+import { Action } from '@stacksjs/actions'
+import { refreshToken } from '@stacksjs/auth'
+import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+
+export default new Action({
+  name: 'RefreshTokenAction',
+  description: 'Exchange a refresh token for a new access token',
+  method: 'POST',
+  async handle(request: RequestInstance) {
+    const refreshTokenValue = request.get('refresh_token')
+
+    await request.validate({
+      refresh_token: {
+        rule: schema.string().min(1),
+        message: {
+          min: 'Refresh token is required',
+        },
+      },
+    })
+
+    try {
+      const result = await refreshToken(refreshTokenValue, {
+        expiresInMinutes: 60, // 1 hour access token
+        refreshExpiresInDays: 30, // 30 day refresh token
+      })
+
+      return response.json({
+        access_token: result.plainTextToken,
+        refresh_token: result.refreshToken,
+        token_type: 'Bearer',
+        expires_in: result.expiresIn,
+      })
+    }
+    catch (error: any) {
+      return response.unauthorized(error.message || 'Invalid or expired refresh token')
+    }
+  },
+})

package/app/Actions/Auth/RegisterAction.ts

@@ -0,0 +1,57 @@
+// No imports needed - everything is auto-imported!
+
+export default new Action({
+  name: 'RegisterAction',
+  description: 'Register a new user',
+  method: 'POST',
+
+  validations: {
+    email: {
+      rule: schema.string().email(),
+      message: 'Email must be a valid email address.',
+    },
+    password: {
+      rule: schema.string().min(6).max(255),
+      message: 'Password must be between 6 and 255 characters.',
+    },
+    name: {
+      rule: schema.string().min(2).max(255),
+      message: 'Name must be between 2 and 255 characters.',
+    },
+  },
+
+  async handle(request: RequestInstance) {
+    const email = request.get('email')
+    const password = request.get('password')
+    const name = request.get('name')
+
+    const result = await register({ email, password, name })
+
+    if (result) {
+      const user = await Auth.getUserFromToken(result.token)
+
+      // Fire `user:registered` so app/Events.ts listeners (welcome email,
+      // CRM sync, internal slack ping, etc.) actually run. Fire-and-forget
+      // — listener errors are caught by the wildcard handler so a flaky
+      // welcome email doesn't fail registration. The `to` alias matches
+      // the contract SendWelcomeEmail expects.
+      dispatch('user:registered', {
+        id: user?.id,
+        email: user?.email,
+        name: user?.name,
+        to: user?.email,
+      })
+
+      return response.json({
+        token: result.token,
+        user: {
+          id: user?.id,
+          email: user?.email,
+          name: user?.name,
+        },
+      })
+    }
+
+    return response.error('Registration failed')
+  },
+})

package/app/Actions/Auth/ResendVerificationAction.ts

@@ -0,0 +1,24 @@
+// No imports needed - everything is auto-imported!
+
+export default new Action({
+  name: 'ResendVerificationAction',
+  description: 'Resend email verification link',
+  method: 'POST',
+
+  async handle(request: RequestInstance) {
+    const user = await request.user()
+
+    if (!user) {
+      return response.unauthorized('Unauthenticated.')
+    }
+
+    const { resendVerificationEmail } = await import('@stacksjs/auth')
+    const result = await resendVerificationEmail(user)
+
+    if (!result.success) {
+      return response.json({ success: false, message: result.message }, 422)
+    }
+
+    return response.json({ success: true, message: result.message })
+  },
+})