@things-factory/auth-base 8.0.0-alpha.8 → 8.0.0-beta.1

package/server/router/auth-public-process-router.ts

@@ -1,4 +1,5 @@
 import Router from 'koa-router'
+import { ILike } from 'typeorm'
 
 import { config } from '@things-factory/env'
 import { getRepository, getSiteRootPath } from '@things-factory/shell'
@@ -31,16 +32,26 @@ export const authPublicProcessRouter = new Router({
 })
 
 authPublicProcessRouter.post('/join', async (context, next) => {
-  const { email } = context.request.body || {}
+  const { username } = context.request.body || {}
 
-  const user: User = await getRepository(User).findOneBy({
-    email
+  const repository = getRepository(User)
+
+  var user = await repository.findOne({
+    where: { username },
+    relations: ['domains']
   })
 
+  if (!user && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(username)) {
+    user = await repository.findOne({
+      where: { email: ILike(username) },
+      relations: ['domains']
+    })
+  }
+
   if (user) {
-    context.redirect(`/auth/signin?email=${email}`)
+    context.redirect(`/auth/signin?username=${username}`)
   } else {
-    context.redirect(`/auth/signup?email=${email}`)
+    context.redirect(`/auth/signup?username=${username}`)
   }
 })
 
@@ -200,10 +211,9 @@ authPublicProcessRouter.post('/forgot-password', async (context, next) => {
 
 authPublicProcessRouter.post('/reset-password', async (context, next) => {
   const { header, t } = context
+  const { password, token } = context.request.body
 
   try {
-    const { password, token } = context.request.body
-
     if (!(token && password)) {
       let message = t('error.token or password is invalid')
 
@@ -232,7 +242,7 @@ authPublicProcessRouter.post('/reset-password', async (context, next) => {
 
     await resetPassword(token, password, context)
 
-    var message = t('text.password reset succeed')
+    var message = t('text.password changed successfully')
     context.body = message
 
     clearAccessTokenCookie(context)
@@ -255,10 +265,12 @@ authPublicProcessRouter.post('/reset-password', async (context, next) => {
 
     if (accepts(header.accept, ['text/html', '*/*'])) {
       await context.render('auth-page', {
-        pageElement: 'auth-result',
-        elementScript: '/auth/result.js',
+        pageElement: 'reset-password',
+        elementScript: '/auth/reset-password.js',
         data: {
+          token,
           message: e.message,
+          passwordRule,
           disableUserSignupProcess,
           disableUserFavoredLanguage,
           languages

package/server/router/auth-signin-router.ts

@@ -19,13 +19,13 @@ const SSOLinks = Object.values(SSOConfig)
 export const authSigninRouter = new Router()
 
 authSigninRouter.get('/auth/signin', async (context, next) => {
-  const { redirect_to, email } = context.query
+  const { redirect_to, username } = context.query
 
   await context.render('auth-page', {
     pageElement: 'auth-signin',
     elementScript: '/auth/signin.js',
     data: {
-      email,
+      username,
       redirectTo: redirect_to,
       ssoLinks: SSOLinks,
       disableUserSignupProcess,
@@ -37,7 +37,7 @@ authSigninRouter.get('/auth/signin', async (context, next) => {
 
 authSigninRouter.post('/auth/signin', signinMiddleware, async (context, next) => {
   const { request, t } = context
-  const { token, user, domain } = context.state
+  const { token, domain } = context.state
   const { body: reqBody, header } = request
 
   if (!accepts(header.accept, ['text/html', '*/*'])) {

package/server/router/webauthn-router.ts

@@ -5,17 +5,75 @@ import { appPackage } from '@things-factory/env'
 import { generateRegistrationOptions, generateAuthenticationOptions } from '@simplewebauthn/server'
 
 import { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential'
-import {
-  PublicKeyCredentialCreationOptionsJSON,
-} from '@simplewebauthn/server/script/deps'
+import { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server/script/deps'
 import { setAccessTokenCookie } from '../utils/access-token-cookie'
-import { createWebAuthnMiddleware } from '../middlewares/webauthn-middleware';
+import { createWebAuthnMiddleware } from '../middlewares/webauthn-middleware'
 
 export const webAuthnGlobalPublicRouter = new Router()
 export const webAuthnGlobalPrivateRouter = new Router()
 
 const { name: rpName } = appPackage as any
 
+// Generate authentication challenge for the currently logged-in user
+webAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async (context, next) => {
+  const { user } = context.state
+  const rpID = context.hostname
+
+  if (!user) {
+    context.status = 401
+    context.body = { error: 'User not authenticated' }
+    return
+  }
+
+  const webAuthCredentials = await getRepository(WebAuthCredential).find({
+    where: { user: { id: user.id } }
+  })
+
+  if (webAuthCredentials.length === 0) {
+    context.status = 400
+    context.body = { error: 'No biometric credentials registered for this user' }
+    return
+  }
+
+  const options = await generateAuthenticationOptions({
+    rpID,
+    userVerification: 'preferred',
+    allowCredentials: webAuthCredentials.map(credential => ({
+      id: credential.credentialId,
+      type: 'public-key'
+    }))
+  })
+
+  context.session.challenge = options.challenge
+  context.body = options
+})
+
+// Verify biometric authentication
+webAuthnGlobalPrivateRouter.post(
+  '/auth/verify-webauthn',
+  /* reuse webauthn-login as webauthn-verify strategy */
+  createWebAuthnMiddleware('webauthn-login'),
+  async (context, next) => {
+    const { user } = context.state
+    const { request } = context
+    const { body: reqBody } = request
+
+    if (!user) {
+      context.status = 401
+      context.body = { verified: false, message: 'User not authenticated' }
+      return
+    }
+
+    context.body = {
+      verified: true,
+      message: 'Biometric authentication successful'
+    }
+
+    await next()
+  }
+)
+
+// Generate registration challenge for the currently logged-in user
 webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (context, next) => {
   const { user } = context.state
   const rpID = context.hostname
@@ -53,8 +111,10 @@ webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (cont
   context.body = options
 })
 
-webAuthnGlobalPrivateRouter.post('/auth/verify-registration', createWebAuthnMiddleware('webauthn-register'));
+// Verify registration
+webAuthnGlobalPrivateRouter.post('/auth/verify-registration', createWebAuthnMiddleware('webauthn-register'))
 
+// Generate sign-in challenge
 webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context, next) => {
   const rpID = context.hostname
 
@@ -67,10 +127,12 @@ webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context
   context.body = options
 })
 
+// Sign in with biometric authentication
 webAuthnGlobalPublicRouter.post(
-  '/auth/signin-webauthn', createWebAuthnMiddleware('webauthn-login'),
+  '/auth/signin-webauthn',
+  createWebAuthnMiddleware('webauthn-login'),
   async (context, next) => {
-    const { domain, user } = context. state
+    const { domain, user } = context.state
     const { request } = context
     const { body: reqBody } = request
 
@@ -79,9 +141,9 @@ webAuthnGlobalPublicRouter.post(
 
     var redirectURL = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`
 
-    /* 2단계 인터렉션 때문에 브라우저에서 fetch(...)로 진행될 것이므로, redirect(3xx) 응답으로 처리할 수 없다. 따라서, 데이타로 redirectURL를 응답한다. */
+    /* Due to the two-step interaction, it will be processed by fetch(...) in the browser, so it cannot be handled with a redirect(3xx) response. Therefore, respond with redirectURL as data. */
     context.body = { redirectURL, verified: true }
 
-    await next();
+    await next()
   }
 )

package/server/service/appliance/appliance.ts

@@ -73,7 +73,10 @@ export class Appliance {
         ? 'longtext'
         : DATABASE_TYPE == 'oracle'
           ? 'clob'
-          : 'varchar'
+          : DATABASE_TYPE == 'mssql'
+            ? 'nvarchar'
+            : 'varchar',
+    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined
   })
   @Field({ nullable: true })
   @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')

package/server/service/application/application.ts

@@ -99,7 +99,10 @@ export class Application {
         ? 'longtext'
         : DATABASE_TYPE == 'oracle'
           ? 'clob'
-          : 'varchar'
+          : DATABASE_TYPE == 'mssql'
+            ? 'nvarchar'
+            : 'varchar',
+    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined
   })
   @Field({ nullable: true })
   @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
@@ -115,8 +118,14 @@ export class Application {
         ? 'enum'
         : DATABASE_TYPE == 'oracle'
           ? 'varchar2'
-          : 'smallint',
-    enum: ApplicationType,
+          : DATABASE_TYPE == 'mssql'
+            ? 'nvarchar'
+            : 'varchar',
+    enum:
+      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+        ? ApplicationType
+        : undefined,
+    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
     default: ApplicationType.OTHERS
   })
   @Field()

package/server/service/invitation/invitation-mutation.ts

@@ -1,8 +1,11 @@
+import { ILike } from 'typeorm'
+
 import { Arg, Ctx, Mutation, Resolver } from 'type-graphql'
 import { GraphQLEmailAddress } from 'graphql-scalars'
 
 import { getRepository } from '@things-factory/shell'
 
+import { User, UserStatus } from '../../service/user/user'
 import { sendInvitationEmail } from '../../controllers/invitation'
 import { Invitation } from './invitation'
 
@@ -32,32 +35,44 @@ export class InvitationMutation {
     @Arg('type') type: string,
     @Ctx() context: ResolverContext
   ) {
-    const repository = getRepository(Invitation)
+    const { user: updater } = context.state
+    const invitationRepository = getRepository(Invitation)
 
-    const oldone = await repository.findOneBy({
-      email,
-      type,
-      reference
+    var user = await getRepository(User).findOne({
+      where: {
+        email: ILike(email),
+        status: UserStatus.ACTIVATED
+      }
     })
 
-    // TODO send invitation
+    if (!user) {
+      throw new Error(`user not found: ${email}`)
+    }
+
     await sendInvitationEmail({
       invitation: {
         email,
         reference,
         type
       },
+      user,
       context
     })
 
+    const oldone = await invitationRepository.findOneBy({
+      email,
+      type,
+      reference
+    })
+
     // update or create
-    return await repository.save({
+    return await invitationRepository.save({
+      creator: updater,
       ...oldone, // take only id from oldone for update
       email,
       reference,
       type,
-      creator: context.state.user,
-      updater: context.state.user
+      updater: updater
     })
   }
 }