@things-factory/auth-base 8.0.0-beta.1 → 8.0.0-beta.2

package/server/service/user/user-types.ts

@@ -1,100 +0,0 @@
-import { ObjectType, InputType, Field, ID, Int } from 'type-graphql'
-import { GraphQLEmailAddress } from 'graphql-scalars'
-import { ObjectRef } from '@things-factory/shell'
-import { User } from './user'
-
-@ObjectType()
-export class PasswordRule {
-  @Field({ nullable: true })
-  lowerCase?: boolean
-
-  @Field({ nullable: true })
-  upperCase?: boolean
-
-  @Field({ nullable: true })
-  digit?: boolean
-
-  @Field({ nullable: true })
-  specialCharacter?: boolean
-
-  @Field({ nullable: true })
-  allowRepeat?: boolean
-
-  @Field({ nullable: true })
-  useTightPattern?: boolean
-
-  @Field({ nullable: true })
-  useLoosePattern?: boolean
-
-  @Field({ nullable: true })
-  tightCharacterLength?: number
-
-  @Field({ nullable: true })
-  looseCharacterLength?: number
-}
-
-@InputType()
-export class NewUser {
-  @Field()
-  username: string
-
-  @Field()
-  name: string
-
-  @Field({ nullable: true })
-  description?: string
-
-  @Field(type => GraphQLEmailAddress)
-  email: string
-
-  @Field({ nullable: true })
-  password?: string
-
-  @Field({ nullable: true })
-  userType?: string
-
-  @Field(type => [ObjectRef], { nullable: true })
-  roles?: ObjectRef[]
-}
-
-@InputType()
-export class UserPatch {
-  @Field(type => ID, { nullable: true })
-  id?: string
-
-  @Field({ nullable: true })
-  name?: string
-
-  @Field(type => [ObjectRef], { nullable: true })
-  domains?: [ObjectRef]
-
-  @Field({ nullable: true })
-  description?: string
-
-  @Field(type => GraphQLEmailAddress, { nullable: true })
-  email?: string
-
-  @Field({ nullable: true })
-  password?: string
-
-  @Field({ nullable: true })
-  status?: string
-
-  @Field(type => [ObjectRef], { nullable: true })
-  roles?: ObjectRef[]
-
-  @Field({ nullable: true })
-  userType?: string
-
-  @Field({ nullable: true })
-  cuFlag?: string
-}
-
-@ObjectType()
-export class UserList {
-  @Field(type => [User], { nullable: true })
-  items: User[]
-
-  @Field(type => Int, { nullable: true })
-  total: number
-}

package/server/service/user/user.ts

@@ -1,381 +0,0 @@
-import crypto from 'crypto'
-import jwt from 'jsonwebtoken'
-import { Directive, Field, ID, ObjectType } from 'type-graphql'
-import { GraphQLEmailAddress } from 'graphql-scalars'
-import {
-  Column,
-  CreateDateColumn,
-  Entity,
-  ILike,
-  Index,
-  JoinTable,
-  ManyToMany,
-  ManyToOne,
-  OneToMany,
-  PrimaryGeneratedColumn,
-  RelationId,
-  UpdateDateColumn
-} from 'typeorm'
-
-import { config } from '@things-factory/env'
-import { Domain, getRepository } from '@things-factory/shell'
-
-import { validatePasswordByRule } from '../../controllers/utils/password-rule'
-import { AuthError } from '../../errors/auth-error'
-import { SECRET } from '../../utils/get-secret'
-import { Role } from '../role/role'
-import { Privilege } from '../privilege/privilege'
-import { WebAuthCredential } from '../web-auth-credential/web-auth-credential'
-import { UsersAuthProviders } from '../users-auth-providers/users-auth-providers'
-import { getDomainsWithPrivilege } from '../../utils/get-user-domains'
-
-const ORMCONFIG = config.get('ormconfig', {})
-const DATABASE_TYPE = ORMCONFIG.type
-
-const sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'
-
-export enum UserStatus {
-  INACTIVE = 'inactive',
-  ACTIVATED = 'activated',
-  DELETED = 'deleted',
-  LOCKED = 'locked',
-  BANNED = 'banned',
-  PWD_RESET_REQUIRED = 'password_reset_required'
-}
-
-@Entity()
-@Index('ix_user_0', (user: User) => [user.email], {
-  unique: true
-})
-@Index('ix_user_1', (user: User) => [user.username], {
-  unique: true,
-  where: '"username" IS NOT NULL'
-})
-@ObjectType()
-export class User {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(type => ID)
-  readonly id: string
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  username: string
-
-  @Column()
-  @Field({ nullable: true })
-  name: string
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  description: string
-
-  @ManyToMany(type => Domain)
-  @JoinTable({ name: 'users_domains' })
-  @Field(type => [Domain])
-  domains?: Domain[]
-
-  @Column()
-  @Field(type => GraphQLEmailAddress)
-  email: string
-
-  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
-  @Column({
-    nullable: true,
-    type:
-      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'longtext'
-        : DATABASE_TYPE == 'oracle'
-          ? 'clob'
-          : DATABASE_TYPE == 'mssql'
-            ? 'nvarchar'
-            : 'varchar',
-    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined
-  })
-  password: string
-
-  @ManyToMany(type => Role, role => role.users)
-  @JoinTable({ name: 'users_roles' })
-  @Field(type => [Role])
-  roles?: Role[]
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  userType: string // default: 'user', enum: 'user', 'application', 'appliance'
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  reference: string
-
-  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
-  @Column({ nullable: true })
-  salt: string
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  locale: string
-
-  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  ssoId: string
-
-  @Column({
-    type:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'enum'
-        : DATABASE_TYPE == 'oracle'
-          ? 'varchar2'
-          : DATABASE_TYPE == 'mssql'
-            ? 'nvarchar'
-            : 'varchar',
-    enum:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,
-    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
-    default: UserStatus.INACTIVE
-  })
-  @Field(type => String)
-  status: UserStatus
-
-  @Column({ type: 'smallint', default: 0 })
-  failCount: number
-
-  @Column({ nullable: true })
-  passwordUpdatedAt: Date
-
-  @Field({ nullable: true })
-  owner: boolean /* should not be a column */
-
-  @OneToMany(() => WebAuthCredential, credential => credential.user)
-  credentials: WebAuthCredential[]
-
-  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)
-  @Field(type => [UsersAuthProviders], { nullable: true })
-  usersAuthProviders: UsersAuthProviders[]
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field({ nullable: true })
-  creator: User
-
-  @RelationId((user: User) => user.creator)
-  creatorId: string
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field({ nullable: true })
-  updater: User
-
-  @RelationId((user: User) => user.updater)
-  updaterId: string
-
-  @CreateDateColumn()
-  @Field({ nullable: true })
-  createdAt: Date
-
-  @UpdateDateColumn()
-  @Field({ nullable: true })
-  updatedAt: Date
-
-  /* signing for jsonwebtoken */
-  async sign(options?) {
-    var { expiresIn = sessionExpirySeconds } = options || {}
-
-    var user = {
-      username: this.username || this.email
-    }
-
-    return await jwt.sign(user, SECRET, {
-      expiresIn,
-      issuer: 'hatiolab.com',
-      subject: 'user'
-    })
-  }
-
-  /* validate password through password rule */
-  static validatePasswordByRule(password, lng) {
-    validatePasswordByRule(password, lng)
-  }
-
-  /* generate salt */
-  static generateSalt() {
-    return crypto.randomBytes(16).toString('hex')
-  }
-
-  /* encode password */
-  static encode(password: string, salt) {
-    return crypto
-      .createHmac('sha256', salt || SECRET)
-      .update(password)
-      .digest('base64')
-  }
-
-  /* verify password */
-  static verify(hashed, password, salt) {
-    return (
-      hashed ==
-        crypto
-          .createHmac('sha256', salt || SECRET)
-          .update(password)
-          .digest('base64') ||
-      hashed ==
-        crypto
-          .createHmac('sha1', salt || SECRET)
-          .update(password)
-          .digest('base64')
-    )
-  }
-
-  static async checkAuthWithEmail(decoded) {
-    if (!decoded?.email) {
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    }
-
-    const repository = getRepository(User)
-    var user = await repository.findOne({
-      where: { email: decoded.email },
-      relations: ['domains'],
-      cache: true
-    })
-
-    if (!user)
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    else {
-      switch (user.status) {
-        case UserStatus.INACTIVE:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.LOCKED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.DELETED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_DELETED
-          })
-      }
-
-      return user
-    }
-  }
-
-  static async checkAuth(decoded) {
-    // id 는 하위호환성을 위해 단기적으로 유지함
-    const { id, username } = decoded || {}
-
-    if (!id && !username) {
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    }
-
-    const repository = getRepository(User)
-    if (id) {
-      var user = await repository.findOne({
-        where: { id },
-        relations: ['domains', 'credentials'],
-        cache: true
-      })
-    } else {
-      var user = await repository.findOne({
-        where: { username },
-        relations: ['domains', 'credentials'],
-        cache: true
-      })
-
-      if (!user && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(username)) {
-        user = await repository.findOne({
-          where: {
-            email: ILike(username)
-          },
-          relations: ['domains', 'credentials'],
-          cache: true
-        })
-      }
-    }
-
-    if (!user)
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    else {
-      switch (user.status) {
-        case UserStatus.INACTIVE:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.LOCKED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.DELETED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_DELETED
-          })
-      }
-
-      const { defaultPassword } = config.get('password')
-
-      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {
-        user.status = UserStatus.PWD_RESET_REQUIRED
-      }
-
-      return user
-    }
-  }
-
-  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {
-    const result = await getRepository(Privilege)
-      .createQueryBuilder('privilege')
-      .innerJoin('privilege.roles', 'role')
-      .innerJoin('role.users', 'user')
-      .where('privilege.category = :category', { category })
-      .andWhere('privilege.name = :privilege', { privilege })
-      .andWhere('user.id = :userId', { userId: user.id })
-      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
-      .getCount()
-
-    return result > 0
-  }
-
-  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {
-    const result = await getRepository(User)
-      .createQueryBuilder('user')
-      .leftJoinAndSelect('user.roles', 'role')
-      .leftJoinAndSelect('role.privileges', 'privilege')
-      .select(['privilege.name AS privilege', 'privilege.category AS category'])
-      .where('user.id = :userId', { userId: user.id })
-      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
-      .orderBy('privilege.category')
-      .addOrderBy('privilege.name')
-      .getRawMany()
-
-    const distinct = result.reduce((acc, current) => {
-      const last = acc[acc.length - 1]
-      if (!last || last.privilege !== current.privilege || last.category !== current.category) {
-        acc.push(current)
-      }
-      return acc
-    }, [])
-
-    return distinct
-  }
-
-  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {
-    return getDomainsWithPrivilege(user, privilege, category)
-  }
-}

package/server/service/users-auth-providers/index.ts

@@ -1,5 +0,0 @@
-import { UsersAuthProviders } from './users-auth-providers'
-
-export const entities = [UsersAuthProviders]
-export const resolvers = []
-export const subscribers = []

package/server/service/users-auth-providers/users-auth-providers.ts

@@ -1,71 +0,0 @@
-import {
-  CreateDateColumn,
-  UpdateDateColumn,
-  DeleteDateColumn,
-  Entity,
-  Index,
-  Column,
-  RelationId,
-  ManyToOne,
-  PrimaryGeneratedColumn,
-  VersionColumn
-} from 'typeorm'
-import { ObjectType, Field, Int, ID, registerEnumType } from 'type-graphql'
-
-import { Domain } from '@things-factory/shell'
-import { User } from '../user/user'
-import { AuthProvider } from '../auth-provider/auth-provider'
-
-@Entity()
-@Index(
-  'ix_users_auth_providers_0',
-  (usersAuthProviders: UsersAuthProviders) => [
-    usersAuthProviders.domain,
-    usersAuthProviders.user,
-    usersAuthProviders.authProvider
-  ],
-  { unique: true }
-)
-@ObjectType({ description: 'Entity for UsersAuthProviders' })
-export class UsersAuthProviders {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(type => ID)
-  readonly id: string
-
-  @ManyToOne(type => Domain)
-  @Field(type => Domain)
-  domain?: Domain
-
-  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.domain)
-  domainId?: string
-
-  @ManyToOne(() => User, user => user.usersAuthProviders, {
-    onDelete: 'CASCADE'
-  })
-  @Field(type => User, { nullable: true })
-  user: User
-
-  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.user)
-  userId?: string
-
-  @ManyToOne(() => AuthProvider, authProvider => authProvider.usersAuthProviders, {
-    onDelete: 'CASCADE'
-  })
-  @Field(type => AuthProvider, { nullable: true })
-  authProvider: AuthProvider
-
-  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.authProvider)
-  authProviderId?: string
-
-  @Column()
-  @Field({ nullable: true })
-  ssoId: string
-
-  @CreateDateColumn()
-  @Field({ nullable: true })
-  createdAt?: Date
-
-  @UpdateDateColumn()
-  @Field({ nullable: true })
-  updatedAt: Date
-}

package/server/service/verification-token/index.ts

@@ -1,3 +0,0 @@
-import { VerificationToken, VerificationTokenType } from './verification-token'
-
-export const entities = [VerificationToken, VerificationTokenType]

package/server/service/verification-token/verification-token.ts

@@ -1,60 +0,0 @@
-import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from 'typeorm'
-import { config } from '@things-factory/env'
-import { ObjectType, Field, ID } from 'type-graphql'
-const ORMCONFIG = config.get('ormconfig', {})
-const DATABASE_TYPE = ORMCONFIG.type
-
-export enum VerificationTokenType {
-  ACTIVATION = 'activation',
-  PASSWORD_RESET = 'password-reset',
-  UNLOCK = 'unlock',
-  REQUEST_ACCESS_TOKEN = 'access-token'
-}
-
-@Entity()
-@ObjectType()
-export class VerificationToken {
-  @PrimaryColumn()
-  @Field(type => ID)
-  userId: string
-
-  @Column({
-    nullable: false
-  })
-  @Field()
-  token: string
-
-  @Column({
-    nullable: false,
-    type:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'enum'
-        : DATABASE_TYPE == 'oracle'
-          ? 'varchar2'
-          : DATABASE_TYPE == 'mssql'
-            ? 'nvarchar'
-            : 'varchar',
-    enum:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? VerificationTokenType
-        : undefined,
-    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
-    default: VerificationTokenType.ACTIVATION
-  })
-  @Field()
-  type: VerificationTokenType
-
-  @Column({
-    nullable: true
-  })
-  @Field({ nullable: true })
-  suppliment: string
-
-  @CreateDateColumn()
-  @Field()
-  createdAt: Date
-
-  @UpdateDateColumn()
-  @Field()
-  updatedAt: Date
-}

package/server/service/web-auth-credential/index.ts

@@ -1,3 +0,0 @@
-import { WebAuthCredential } from './web-auth-credential'
-
-export const entities = [WebAuthCredential]

package/server/service/web-auth-credential/web-auth-credential.ts

@@ -1,67 +0,0 @@
-import { Field, ID } from 'type-graphql'
-import {
-  CreateDateColumn,
-  UpdateDateColumn,
-  Entity,
-  Index,
-  Column,
-  RelationId,
-  ManyToOne,
-  PrimaryGeneratedColumn
-} from 'typeorm'
-
-import { User } from '../user/user'
-import { AuthenticatorTransportFuture } from '@simplewebauthn/server/script/deps'
-
-@Entity()
-@Index(
-  'ix_web_auth_credential_0',
-  (webAuthCredential: WebAuthCredential) => [webAuthCredential.user, webAuthCredential.credentialId],
-  { unique: true }
-)
-export class WebAuthCredential {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(type => ID)
-  readonly id: string
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field(type => User, { nullable: true })
-  user?: User
-
-  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.user)
-  userId?: string
-
-  @Column()
-  @Field({ nullable: true })
-  credentialId: string
-
-  @Column()
-  @Field({ nullable: true })
-  publicKey: string
-
-  @Column()
-  @Field({ nullable: true })
-  counter: number
-
-  @CreateDateColumn()
-  @Field({ nullable: true })
-  createdAt?: Date
-
-  @UpdateDateColumn()
-  @Field({ nullable: true })
-  updatedAt?: Date
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field(type => User, { nullable: true })
-  creator?: User
-
-  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.creator)
-  creatorId?: string
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field(type => User, { nullable: true })
-  updater?: User
-
-  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.updater)
-  updaterId?: string
-}