@things-factory/auth-base 7.0.0-alpha.9 → 7.0.0

package/helps/config/password.zh.md

@@ -0,0 +1,65 @@
+# password
+
+可以灵活定义密码设置规则，并基于这些规则验证密码的有效性。
+
+密码规则可以调整大小写字母、数字、特殊字符和长度等各种元素，以便根据安全策略自定义密码规则。
+
+- `lowerCase` (默认值: `true`):
+
+  - 布尔值，指示是否包含小写字母。如果设置，密码必须至少包含一个小写字母。
+
+- `upperCase` (默认值: `true`):
+
+  - 布尔值，指示是否包含大写字母。如果设置，密码必须至少包含一个大写字母。
+
+- `digit` (默认值: `true`):
+
+  - 布尔值，指示是否包含数字。如果设置，密码必须至少包含一个数字。
+
+- `specialCharacter` (默认值: `true`):
+
+  - 布尔值，指示是否包含特殊字符。如果设置，密码必须至少包含一个特殊字符(!@#$%^&\*())。
+
+- `allowRepeat` (默认值: `false`):
+
+  - 布尔值，指示是否允许字符重复。如果设置，密码中字符不得连续重复两次以上。
+
+- `useTightPattern` (默认值: `true`):
+
+  - 布尔值，指示是否使用严格的密码模式。如果设置，密码必须严格遵循长度和各个元素（小写字母、大写字母、数字、特殊字符）的要求。
+
+- `useLoosePattern` (默认值: `false`):
+
+  - 布尔值，指示是否使用宽松的密码模式。如果设置，密码只严格检查长度，忽略其他元素的要求。
+
+- `tightCharacterLength` (默认值: `8`):
+
+  - 使用严格密码模式时，密码的最小长度。
+
+- `looseCharacterLength` (默认值: `15`):
+
+  - 使用宽松密码模式时，密码的最小长度。
+
+- `defaultPassword` (默认值: false):
+  - 管理员注册用户时，设置给新用户的默认密码。
+  - 如果此值为false，则管理员无法使用用户注册功能。
+
+## default
+
+```
+module.exports = {
+  password: {
+    lowerCase: true,
+    upperCase: false,
+    digit: true,
+    specialCharacter: true,
+    allowRepeat: true,
+    useTightPattern: true,
+    useLoosePattern: false,
+    tightCharacterLength: 8,
+    looseCharacterLength: 15,
+    history: 2,
+    defaultPassword: false
+  },
+}
+```

package/helps/config/publicHomeRoute.ja.md

@@ -0,0 +1,14 @@
+# publicHomeRoute
+
+ログインしていないユーザーがアプリケーションURLに初めてアクセスしたときに表示されるページのパスを指定します。
+
+通常は '/public/home' パスにルーティングされ、イントロ画面が表示されます。
+ログインページに直接移動したい場合は、この設定を '/auth/signin' に設定します。
+
+## default
+
+```
+module.exports = {
+  publicHomeRoute: '/public/home',
+}
+```

package/helps/config/publicHomeRoute.ko.md

@@ -0,0 +1,14 @@
+# publicHomeRoute
+
+로그인되지 않은 사용자가 어플리케이션 URL에 처음 접근했을 때, 보여지게 될 페이지의 path를 지정한다.
+
+보통 '/public/home' 패스로 라우팅되어 인트로 화면을 볼 수 있다.
+만약, 로그인 페이지로 바로 이동하고 싶다면, 이 설정을 '/auth/signin' 으로 설정하면 된다.
+
+## default
+
+```
+module.exports = {
+  publicHomeRoute: '/public/home',
+}
+```

package/helps/config/publicHomeRoute.md

@@ -1,9 +1,9 @@
 # publicHomeRoute
 
-로그인되지 않은 사용자가 어플리케이션 URL에 처음 접근했을 때, 보여지게 될 페이지의 path를 지정한다.
+specifies the path of the page to be displayed when a user who is not logged in first accesses the application URL.
 
-보통 '/public/home' 패스로 라우팅되어 인트로 화면을 볼 수 있다.
-만약, 로그인 페이지로 바로 이동하고 싶다면, 이 설정을 '/auth/signin' 으로 설정하면 된다.
+usually routed to the '/public/home' path to display the intro screen.
+if you want to go directly to the login page, set this to '/auth/signin'.
 
 ## default
 

package/helps/config/publicHomeRoute.ms.md

@@ -0,0 +1,14 @@
+# publicHomeRoute
+
+menentukan laluan halaman yang akan dipaparkan apabila pengguna yang belum log masuk mengakses URL aplikasi buat kali pertama.
+
+biasanya akan dilalukan ke laluan '/public/home' untuk memaparkan skrin pengenalan.
+jika ingin terus ke halaman log masuk, tetapkan ini ke '/auth/signin'.
+
+## default
+
+```
+module.exports = {
+  publicHomeRoute: '/public/home',
+}
+```

package/helps/config/publicHomeRoute.zh.md

@@ -0,0 +1,14 @@
+# publicHomeRoute
+
+指定未登录用户首次访问应用程序URL时显示的页面路径。
+
+通常会路由到 '/public/home' 路径，以显示介绍页面。
+如果希望直接跳转到登录页面，可以将此设置为 '/auth/signin'。
+
+## default
+
+```
+module.exports = {
+  publicHomeRoute: '/public/home',
+}
+```

package/helps/config/session.ja.md

@@ -0,0 +1,45 @@
+# session
+
+セッション有効期間に関する設定を行うことができます。
+
+- expirySeconds: セッション有効時間（秒単位）
+
+  - この値は、ユーザーセッションが非アクティブの後に何秒で期限切れになるかを定義します。
+  - これを1800に設定すると、30分の非アクティブ後にセッションが期限切れになります。
+
+- expiryPolicy: セッション有効期限ポリシー
+
+  - この設定は、セッションのタイムアウトをどのように管理するかを決定します。
+  - オプション：
+
+    - 'rolling' - セッションのタイムアウトはユーザーのアクティビティに基づいて延長されます。
+      各新しいリクエストは、タイマーを指定されたタイムアウト期間にリセットします。
+    - 'fixed' - セッションのタイムアウトは固定されて
+
+## default
+
+```
+module.exports = {
+  session: {
+    /*
+      Session Expiry Time in Seconds
+      This value defines the duration in seconds after which a user session will expire due to inactivity.
+      Setting this to 1800 means the session will expire after 30 minutes of inactivity.
+    */
+    expirySeconds: 60 * 60 * 24 * 7,
+    /*
+      Session Expiry Policy
+      This setting determines how the session timeout is managed.
+      Options:
+        'rolling' - The session timeout is extended based on user activity.
+                    Each new request resets the timer to the specified timeout duration.
+        'fixed'   - The session timeout is fixed and based on the initial login time.
+                    The session will expire after the specified duration, regardless of user activity.
+
+      Example:
+      expiryPolicy: 'rolling' or 'fixed'
+    */
+    expiryPolicy: 'fixed'
+  },
+}
+```

package/helps/config/session.ko.md

@@ -0,0 +1,49 @@
+# session
+
+세션 유효기간과 관련한 설정을 할 수 있다.
+
+- expirySeconds: Session Expiry Time in Seconds
+
+  - This value defines the duration in seconds after which a user session will expire due to inactivity.
+  - Setting this to 1800 means the session will expire after 30 minutes of inactivity.
+
+- expiryPolicy: Session Expiry Policy
+
+  - This setting determines how the session timeout is managed.
+  - Options:
+
+    - 'rolling' - The session timeout is extended based on user activity.
+      Each new request resets the timer to the specified timeout duration.
+    - 'fixed' - The session timeout is fixed and based on the initial login time.
+      The session will expire after the specified duration, regardless of user activity.
+
+          Example:
+          expiryPolicy: 'rolling' or 'fixed'
+
+## default
+
+```
+module.exports = {
+  session: {
+    /*
+      Session Expiry Time in Seconds
+      This value defines the duration in seconds after which a user session will expire due to inactivity.
+      Setting this to 1800 means the session will expire after 30 minutes of inactivity.
+    */
+    expirySeconds: 60 * 60 * 24 * 7,
+    /*
+      Session Expiry Policy
+      This setting determines how the session timeout is managed.
+      Options:
+        'rolling' - The session timeout is extended based on user activity.
+                    Each new request resets the timer to the specified timeout duration.
+        'fixed'   - The session timeout is fixed and based on the initial login time.
+                    The session will expire after the specified duration, regardless of user activity.
+
+      Example:
+      expiryPolicy: 'rolling' or 'fixed'
+    */
+    expiryPolicy: 'fixed'
+  },
+}
+```

package/helps/config/session.md

@@ -1,23 +1,23 @@
 # session
 
-세션 유효기간과 관련한 설정을 할 수 있다.
+you can set the session expiration settings.
 
 - expirySeconds: Session Expiry Time in Seconds
 
-  - This value defines the duration in seconds after which a user session will expire due to inactivity.
-  - Setting this to 1800 means the session will expire after 30 minutes of inactivity.
+  - this value defines the duration in seconds after which a user session will expire due to inactivity.
+  - setting this to 1800 means the session will expire after 30 minutes of inactivity.
 
 - expiryPolicy: Session Expiry Policy
 
-  - This setting determines how the session timeout is managed.
-  - Options:
+  - this setting determines how the session timeout is managed.
+  - options:
 
-    - 'rolling' - The session timeout is extended based on user activity.
-      Each new request resets the timer to the specified timeout duration.
-    - 'fixed' - The session timeout is fixed and based on the initial login time.
-      The session will expire after the specified duration, regardless of user activity.
+    - 'rolling' - the session timeout is extended based on user activity.
+      each new request resets the timer to the specified timeout duration.
+    - 'fixed' - the session timeout is fixed and based on the initial login time.
+      the session will expire after the specified duration, regardless of user activity.
 
-          Example:
+          example:
           expiryPolicy: 'rolling' or 'fixed'
 
 ## default

package/helps/config/session.ms.md

@@ -0,0 +1,46 @@
+# session
+
+boleh menetapkan tetapan berkaitan tempoh sah sesi.
+
+- expirySeconds: Masa Tamat Sesi dalam Detik
+
+  - nilai ini menentukan tempoh dalam detik selepas mana sesi pengguna akan tamat akibat ketidakaktifan.
+  - menetapkan ini kepada 1800 bermaksud sesi akan tamat selepas 30 minit ketidakaktifan.
+
+- expiryPolicy: Polisi Tamat Sesi
+
+  - tetapan ini menentukan bagaimana masa tamat sesi diuruskan.
+  - pilihan:
+
+    - 'rolling' - masa tamat sesi dilanjutkan berdasarkan aktiviti pengguna.
+      setiap permintaan baru menetapkan semula pemasa kepada tempoh tamat yang ditentukan.
+    - 'fixed' - masa tamat sesi adalah tetap dan berdasarkan masa log masuk awal.
+      sesi akan tamat selepas tempoh yang dit
+
+## default
+
+```
+module.exports = {
+  session: {
+    /*
+      Session Expiry Time in Seconds
+      This value defines the duration in seconds after which a user session will expire due to inactivity.
+      Setting this to 1800 means the session will expire after 30 minutes of inactivity.
+    */
+    expirySeconds: 60 * 60 * 24 * 7,
+    /*
+      Session Expiry Policy
+      This setting determines how the session timeout is managed.
+      Options:
+        'rolling' - The session timeout is extended based on user activity.
+                    Each new request resets the timer to the specified timeout duration.
+        'fixed'   - The session timeout is fixed and based on the initial login time.
+                    The session will expire after the specified duration, regardless of user activity.
+
+      Example:
+      expiryPolicy: 'rolling' or 'fixed'
+    */
+    expiryPolicy: 'fixed'
+  },
+}
+```

package/helps/config/session.zh.md

@@ -0,0 +1,49 @@
+# session
+
+可以设置与会话有效期相关的设置。
+
+- expirySeconds: Session Expiry Time in Seconds
+
+  - 此值定义由于不活动，用户会话将在多少秒后过期。
+  - 将此值设置为1800意味着会话将在30分钟不活动后过期。
+
+- expiryPolicy: Session Expiry Policy
+
+  - 此设置确定如何管理会话超时。
+  - 选项：
+
+    - 'rolling' - 会话超时基于用户活动延长。
+      每个新请求将计时器重置为指定的超时持续时间。
+    - 'fixed' - 会话超时是固定的，基于初始登录时间。
+      无论用户活动如何，会话将在指定的持续时间后过期。
+
+          例子:
+          expiryPolicy: 'rolling' or 'fixed'
+
+## default
+
+```
+module.exports = {
+  session: {
+    /*
+      Session Expiry Time in Seconds
+      This value defines the duration in seconds after which a user session will expire due to inactivity.
+      Setting this to 1800 means the session will expire after 30 minutes of inactivity.
+    */
+    expirySeconds: 60 * 60 * 24 * 7,
+    /*
+      Session Expiry Policy
+      This setting determines how the session timeout is managed.
+      Options:
+        'rolling' - The session timeout is extended based on user activity.
+                    Each new request resets the timer to the specified timeout duration.
+        'fixed'   - The session timeout is fixed and based on the initial login time.
+                    The session will expire after the specified duration, regardless of user activity.
+
+      Example:
+      expiryPolicy: 'rolling' or 'fixed'
+    */
+    expiryPolicy: 'fixed'
+  },
+}
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "7.0.0-alpha.9",
+  "version": "7.0.0",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -30,18 +30,21 @@
     "migration:create": "node ../../node_modules/typeorm/cli.js migration:create -d ./server/migrations"
   },
   "dependencies": {
-    "@things-factory/email-base": "^7.0.0-alpha.9",
-    "@things-factory/env": "^7.0.0-alpha.0",
-    "@things-factory/i18n-base": "^7.0.0-alpha.9",
-    "@things-factory/shell": "^7.0.0-alpha.9",
-    "@things-factory/utils": "^7.0.0-alpha.0",
+    "@simplewebauthn/browser": "^10.0.0",
+    "@simplewebauthn/server": "^10.0.0",
+    "@things-factory/email-base": "^7.0.0",
+    "@things-factory/env": "^7.0.0",
+    "@things-factory/shell": "^7.0.0",
+    "@things-factory/utils": "^7.0.0",
+    "@types/webappsec-credential-management": "^0.6.8",
     "jsonwebtoken": "^9.0.0",
     "koa-passport": "^6.0.0",
     "koa-session": "^6.4.0",
     "oauth2orize-koa": "^1.3.2",
+    "passport": "^0.7.0",
+    "passport-custom": "^1.1.1",
     "passport-jwt": "^4.0.0",
-    "passport-local": "^1.0.0",
-    "popsicle-cookie-jar": "^1.0.0"
+    "passport-local": "^1.0.0"
   },
-  "gitHead": "99fc5aead211b3c82e3ebbf76e8d5d1db01b1ddc"
+  "gitHead": "00f3917ca132679e3571f3f4fd16f4caf84f488e"
 }

package/server/constants/error-code.ts

@@ -15,3 +15,6 @@ export const PASSWORD_PATTERN_NOT_MATCHED = 'password should match the rule'
 export const USER_DUPLICATED = 'user duplicated'
 export const PASSWORD_USED_PAST = 'password used in the past'
 export const VERIFICATION_ERROR = 'user or verification token not found'
+export const AUTHN_VERIFICATION_FAILED = 'authn verification failed'
+export const USER_CREDENTIAL_NOT_FOUND = 'user credential not found'
+export const AUTH_ERROR = 'auth error'

package/server/middlewares/authenticate-401-middleware.ts

@@ -15,7 +15,7 @@ export async function authenticate401Middleware(context, next) {
     var message
 
     if (err instanceof AuthError) {
-      message = context.t(`error.${err.errorCode}`, err.detail || {})
+      message = (context.t && context.t(`error.${err.errorCode}`, err.detail || {})) || err.errorCode
     } else {
       if (err?.status !== 401) {
         throw err

package/server/middlewares/domain-authenticate-middleware.ts

@@ -19,10 +19,14 @@ declare global {
 }
 
 process.domainOwnerGranted = async (domain: Domain, user: User): Promise<boolean> => {
-  return domain && domain.owner === user.id
+  return user && domain && domain.owner === user.id
 }
 
 process.superUserGranted = async (domain: Domain, user: User): Promise<boolean> => {
+  if (!user) {
+    return false
+  }
+
   if (!user.domains.length) {
     user = await getRepository(User).findOne({
       where: { id: user.id },

package/server/middlewares/index.ts

@@ -20,7 +20,7 @@ export function initMiddlewares(app: any) {
   app.use(
     session(
       {
-        key: accessTokenCookieKey,
+        key: 'tfsession',
         maxAge: MAX_AGE,
         overwrite: true,
         httpOnly: true,
@@ -63,4 +63,5 @@ process.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware)
 export * from './jwt-authenticate-middleware'
 export * from './domain-authenticate-middleware'
 export * from './signin-middleware'
+export * from './webauthn-middleware'
 export * from './authenticate-401-middleware'

package/server/middlewares/webauthn-middleware.ts

@@ -0,0 +1,127 @@
+import passport from 'koa-passport'
+import { Strategy as CustomStrategy } from 'passport-custom'
+
+import { getRepository } from '@things-factory/shell'
+
+import { User } from '../service/user/user'
+import { AuthError } from '../errors/auth-error'
+
+import { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential'
+import { verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'
+
+import { AuthenticatorAssertionResponse } from '@simplewebauthn/types'
+
+passport.use(
+  'webauthn-register',
+  new CustomStrategy(async (context, done) => {
+    const { body, session, user, hostname, origin } = context as any
+
+    const challenge = session.challenge
+
+    const verification = await verifyRegistrationResponse({
+      response: body,
+      expectedChallenge: challenge,
+      expectedOrigin: origin,
+      expectedRPID: hostname,
+      expectedType: 'webauthn.create',
+      requireUserVerification: false
+    })
+
+    if (verification.verified) {
+      const { registrationInfo } = verification
+      const publicKey = Buffer.from(registrationInfo.credentialPublicKey).toString('base64')
+
+      if (user) {
+        const webAuthRepository = getRepository(WebAuthCredential)
+        await webAuthRepository.save({
+          user,
+          credentialId: registrationInfo.credentialID,
+          publicKey,
+          counter: registrationInfo.counter,
+          creator: user,
+          updater: user
+        })
+      }
+
+      return done(null, user)
+    } else {
+      return done(null, false)
+    }
+  })
+)
+
+passport.use(
+  'webauthn-login',
+  new CustomStrategy(async (context, done) => {
+    try {
+      const { body, session, origin, hostname } = context as any
+
+      const challenge = session.challenge
+  
+      const assertionResponse = body as {
+        id: string
+        response: AuthenticatorAssertionResponse
+      }
+  
+      const credential = await getRepository(WebAuthCredential).findOne({
+        where: {
+          credentialId: assertionResponse.id
+        },
+        relations: ['user']
+      })
+  
+      if (!credential) {
+        return done(null, false)
+      }
+  
+      const verification = await verifyAuthenticationResponse({
+        response: body,
+        expectedChallenge: challenge,
+        expectedOrigin: origin,
+        expectedRPID: hostname,
+        requireUserVerification: false,
+        authenticator: {
+          credentialID: credential.credentialId,
+          credentialPublicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),
+          counter: credential.counter
+        }
+      })
+  
+      if (verification.verified) {
+        const { authenticationInfo } = verification
+        credential.counter = authenticationInfo.newCounter
+        await getRepository(WebAuthCredential).save(credential)
+  
+        const user = credential.user
+        return done(null, user)
+      } else {
+        return done(verification, false)
+      }
+    } catch(error) {
+      return done(error, false)
+    }
+  })
+)
+
+export function createWebAuthnMiddleware(strategy: 'webauthn-register' | 'webauthn-login') {
+  return async function webAuthnMiddleware(context, next) {
+    return passport.authenticate(
+      strategy,
+      { session: true, failureMessage: true, failWithError: true },
+      async (err, user) => {
+        if (err || !user) {
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED,
+            detail: err
+          })
+        } else {
+          context.state.user = user
+
+          context.body = { user, verified: true }
+        }
+
+        await next()
+      }
+    )(context, next)
+  }
+}

package/server/router/auth-private-process-router.ts

@@ -41,7 +41,7 @@ authPrivateProcessRouter
     }
   })
   .post('/delete-user', async (context, next) => {
-    const { t } = context
+    const { t, session } = context
     var { user } = context.state
     var { email: userEmail } = user
 
@@ -67,8 +67,15 @@ authPrivateProcessRouter
     clearAccessTokenCookie(context)
   })
   .get('/profile', async (context, next) => {
+    const { t } = context
     const { domain, user, unsafeIP, prohibitedPrivileges } = context.state
 
+    if (!domain) {
+      context.status = 401
+      context.body = t('error.user validation failed')
+      return
+    }
+
     let domains: Partial<Domain>[] = await getUserDomains(user)
     domains = domains.filter((d: Domain) => d.extType == domainType)
 

package/server/router/index.ts

@@ -6,3 +6,4 @@ export * from './oauth2'
 export * from './auth-checkin-router'
 export * from './auth-signin-router'
 export * from './auth-signup-router'
+export * from './webauthn-router'