@things-factory/auth-base 8.0.0-beta.9 → 8.0.2

package/server/service/user/user.ts

@@ -0,0 +1,354 @@
+import crypto from 'crypto'
+import jwt from 'jsonwebtoken'
+import { Directive, Field, ID, ObjectType } from 'type-graphql'
+import { GraphQLEmailAddress } from 'graphql-scalars'
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  Index,
+  JoinTable,
+  ManyToMany,
+  ManyToOne,
+  OneToMany,
+  PrimaryGeneratedColumn,
+  RelationId,
+  UpdateDateColumn
+} from 'typeorm'
+
+import { config } from '@things-factory/env'
+import { Domain, getRepository } from '@things-factory/shell'
+
+import { validatePasswordByRule } from '../../controllers/utils/password-rule'
+import { AuthError } from '../../errors/auth-error'
+import { SECRET } from '../../utils/get-secret'
+import { Role } from '../role/role'
+import { Privilege } from '../privilege/privilege'
+import { WebAuthCredential } from '../web-auth-credential/web-auth-credential'
+import { UsersAuthProviders } from '../users-auth-providers/users-auth-providers'
+import { getDomainsWithPrivilege } from '../../utils/get-user-domains'
+
+const ORMCONFIG = config.get('ormconfig', {})
+const DATABASE_TYPE = ORMCONFIG.type
+
+const sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'
+
+export enum UserStatus {
+  INACTIVE = 'inactive',
+  ACTIVATED = 'activated',
+  DELETED = 'deleted',
+  LOCKED = 'locked',
+  BANNED = 'banned',
+  PWD_RESET_REQUIRED = 'password_reset_required'
+}
+
+@Entity()
+@Index('ix_user_0', (user: User) => [user.email], { unique: true })
+@ObjectType()
+export class User {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(type => ID)
+  readonly id: string
+
+  @Column()
+  @Field({ nullable: true })
+  name: string
+
+  @Column({ nullable: true })
+  @Field({ nullable: true })
+  description: string
+
+  @ManyToMany(type => Domain)
+  @JoinTable({ name: 'users_domains' })
+  @Field(type => [Domain])
+  domains?: Domain[]
+
+  @Column()
+  @Field(type => GraphQLEmailAddress)
+  email: string
+
+  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
+  @Column({
+    nullable: true,
+    type:
+      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+        ? 'longtext'
+        : DATABASE_TYPE == 'oracle'
+          ? 'clob'
+          : DATABASE_TYPE == 'mssql'
+            ? 'nvarchar'
+            : 'varchar',
+    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined
+  })
+  password: string
+
+  @ManyToMany(type => Role, role => role.users)
+  @JoinTable({ name: 'users_roles' })
+  @Field(type => [Role])
+  roles?: Role[]
+
+  @Column({ nullable: true })
+  @Field({ nullable: true })
+  userType: string // default: 'user', enum: 'user', 'application', 'appliance'
+
+  @Column({ nullable: true })
+  @Field({ nullable: true })
+  reference: string
+
+  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
+  @Column({ nullable: true })
+  salt: string
+
+  @Column({ nullable: true })
+  @Field({ nullable: true })
+  locale: string
+
+  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
+  @Column({ nullable: true })
+  @Field({ nullable: true })
+  ssoId: string
+
+  @Column({
+    type:
+      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+        ? 'enum'
+        : DATABASE_TYPE == 'oracle'
+          ? 'varchar2'
+          : DATABASE_TYPE == 'mssql'
+            ? 'nvarchar'
+            : 'varchar',
+    enum:
+      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,
+    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
+    default: UserStatus.INACTIVE
+  })
+  @Field(type => String)
+  status: UserStatus
+
+  @Column({ type: 'smallint', default: 0 })
+  failCount: number
+
+  @Column({ nullable: true })
+  passwordUpdatedAt: Date
+
+  @Field({ nullable: true })
+  owner: boolean /* should not be a column */
+
+  @OneToMany(() => WebAuthCredential, credential => credential.user)
+  credentials: WebAuthCredential[]
+
+  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)
+  @Field(type => [UsersAuthProviders], { nullable: true })
+  usersAuthProviders: UsersAuthProviders[]
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field({ nullable: true })
+  creator: User
+
+  @RelationId((user: User) => user.creator)
+  creatorId: string
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field({ nullable: true })
+  updater: User
+
+  @RelationId((user: User) => user.updater)
+  updaterId: string
+
+  @CreateDateColumn()
+  @Field({ nullable: true })
+  createdAt: Date
+
+  @UpdateDateColumn()
+  @Field({ nullable: true })
+  updatedAt: Date
+
+  /* signing for jsonwebtoken */
+  async sign(options?) {
+    var { expiresIn = sessionExpirySeconds, subdomain } = options || {}
+
+    var user = {
+      id: this.id,
+      userType: this.userType,
+      status: this.status,
+      domain: {
+        subdomain
+      }
+    }
+
+    return await jwt.sign(user, SECRET, {
+      expiresIn,
+      issuer: 'hatiolab.com',
+      subject: 'user'
+    })
+  }
+
+  /* validate password through password rule */
+  static validatePasswordByRule(password, lng) {
+    validatePasswordByRule(password, lng)
+  }
+
+  /* generate salt */
+  static generateSalt() {
+    return crypto.randomBytes(16).toString('hex')
+  }
+
+  /* encode password */
+  static encode(password: string, salt) {
+    return crypto
+      .createHmac('sha256', salt || SECRET)
+      .update(password)
+      .digest('base64')
+  }
+
+  /* verify password */
+  static verify(hashed, password, salt) {
+    return (
+      hashed ==
+        crypto
+          .createHmac('sha256', salt || SECRET)
+          .update(password)
+          .digest('base64') ||
+      hashed ==
+        crypto
+          .createHmac('sha1', salt || SECRET)
+          .update(password)
+          .digest('base64')
+    )
+  }
+
+  static async checkAuthWithEmail(decoded) {
+    if (!decoded?.email) {
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    }
+
+    const repository = getRepository(User)
+    var user = await repository.findOne({
+      where: { email: decoded.email },
+      relations: ['domains'],
+      cache: true
+    })
+
+    if (!user)
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    else {
+      switch (user.status) {
+        case UserStatus.INACTIVE:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
+            detail: {
+              email: user.email
+            }
+          })
+        case UserStatus.LOCKED:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
+            detail: {
+              email: user.email
+            }
+          })
+        case UserStatus.DELETED:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_DELETED
+          })
+      }
+
+      return user
+    }
+  }
+
+  static async checkAuth(decoded) {
+    if (decoded?.id === undefined) {
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    }
+
+    const repository = getRepository(User)
+    var user = await repository.findOne({
+      where: { id: decoded.id },
+      relations: ['domains', 'credentials'],
+      cache: true
+    })
+
+    if (!user)
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    else {
+      switch (user.status) {
+        case UserStatus.INACTIVE:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
+            detail: {
+              email: user.email
+            }
+          })
+        case UserStatus.LOCKED:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
+            detail: {
+              email: user.email
+            }
+          })
+        case UserStatus.DELETED:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_DELETED
+          })
+      }
+
+      const { defaultPassword } = config.get('password')
+
+      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {
+        user.status = UserStatus.PWD_RESET_REQUIRED
+      }
+
+      return user
+    }
+  }
+
+  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {
+    const result = await getRepository(Privilege)
+      .createQueryBuilder('privilege')
+      .innerJoin('privilege.roles', 'role')
+      .innerJoin('role.users', 'user')
+      .where('privilege.category = :category', { category })
+      .andWhere('privilege.name = :privilege', { privilege })
+      .andWhere('user.id = :userId', { userId: user.id })
+      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
+      .getCount()
+
+    return result > 0
+  }
+
+  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {
+    const result = await getRepository(User)
+      .createQueryBuilder('user')
+      .leftJoinAndSelect('user.roles', 'role')
+      .leftJoinAndSelect('role.privileges', 'privilege')
+      .select(['privilege.name AS privilege', 'privilege.category AS category'])
+      .where('user.id = :userId', { userId: user.id })
+      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
+      .orderBy('privilege.category')
+      .addOrderBy('privilege.name')
+      .getRawMany()
+
+    const distinct = result.reduce((acc, current) => {
+      const last = acc[acc.length - 1]
+      if (!last || last.privilege !== current.privilege || last.category !== current.category) {
+        acc.push(current)
+      }
+      return acc
+    }, [])
+
+    return distinct
+  }
+
+  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {
+    return getDomainsWithPrivilege(user, privilege, category)
+  }
+}

package/server/service/users-auth-providers/index.ts

@@ -0,0 +1,5 @@
+import { UsersAuthProviders } from './users-auth-providers'
+
+export const entities = [UsersAuthProviders]
+export const resolvers = []
+export const subscribers = []

package/server/service/users-auth-providers/users-auth-providers.ts

@@ -0,0 +1,71 @@
+import {
+  CreateDateColumn,
+  UpdateDateColumn,
+  DeleteDateColumn,
+  Entity,
+  Index,
+  Column,
+  RelationId,
+  ManyToOne,
+  PrimaryGeneratedColumn,
+  VersionColumn
+} from 'typeorm'
+import { ObjectType, Field, Int, ID, registerEnumType } from 'type-graphql'
+
+import { Domain } from '@things-factory/shell'
+import { User } from '../user/user'
+import { AuthProvider } from '../auth-provider/auth-provider'
+
+@Entity()
+@Index(
+  'ix_users_auth_providers_0',
+  (usersAuthProviders: UsersAuthProviders) => [
+    usersAuthProviders.domain,
+    usersAuthProviders.user,
+    usersAuthProviders.authProvider
+  ],
+  { unique: true }
+)
+@ObjectType({ description: 'Entity for UsersAuthProviders' })
+export class UsersAuthProviders {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(type => ID)
+  readonly id: string
+
+  @ManyToOne(type => Domain)
+  @Field(type => Domain)
+  domain?: Domain
+
+  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.domain)
+  domainId?: string
+
+  @ManyToOne(() => User, user => user.usersAuthProviders, {
+    onDelete: 'CASCADE'
+  })
+  @Field(type => User, { nullable: true })
+  user: User
+
+  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.user)
+  userId?: string
+
+  @ManyToOne(() => AuthProvider, authProvider => authProvider.usersAuthProviders, {
+    onDelete: 'CASCADE'
+  })
+  @Field(type => AuthProvider, { nullable: true })
+  authProvider: AuthProvider
+
+  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.authProvider)
+  authProviderId?: string
+
+  @Column()
+  @Field({ nullable: true })
+  ssoId: string
+
+  @CreateDateColumn()
+  @Field({ nullable: true })
+  createdAt?: Date
+
+  @UpdateDateColumn()
+  @Field({ nullable: true })
+  updatedAt: Date
+}

package/server/service/verification-token/index.ts

@@ -0,0 +1,3 @@
+import { VerificationToken, VerificationTokenType } from './verification-token'
+
+export const entities = [VerificationToken, VerificationTokenType]

package/server/service/verification-token/verification-token.ts

@@ -0,0 +1,60 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from 'typeorm'
+import { config } from '@things-factory/env'
+import { ObjectType, Field, ID } from 'type-graphql'
+const ORMCONFIG = config.get('ormconfig', {})
+const DATABASE_TYPE = ORMCONFIG.type
+
+export enum VerificationTokenType {
+  ACTIVATION = 'activation',
+  PASSWORD_RESET = 'password-reset',
+  UNLOCK = 'unlock',
+  REQUEST_ACCESS_TOKEN = 'access-token'
+}
+
+@Entity()
+@ObjectType()
+export class VerificationToken {
+  @PrimaryColumn()
+  @Field(type => ID)
+  userId: string
+
+  @Column({
+    nullable: false
+  })
+  @Field()
+  token: string
+
+  @Column({
+    nullable: false,
+    type:
+      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+        ? 'enum'
+        : DATABASE_TYPE == 'oracle'
+          ? 'varchar2'
+          : DATABASE_TYPE == 'mssql'
+            ? 'nvarchar'
+            : 'varchar',
+    enum:
+      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+        ? VerificationTokenType
+        : undefined,
+    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
+    default: VerificationTokenType.ACTIVATION
+  })
+  @Field()
+  type: VerificationTokenType
+
+  @Column({
+    nullable: true
+  })
+  @Field({ nullable: true })
+  suppliment: string
+
+  @CreateDateColumn()
+  @Field()
+  createdAt: Date
+
+  @UpdateDateColumn()
+  @Field()
+  updatedAt: Date
+}

package/server/service/web-auth-credential/index.ts

@@ -0,0 +1,3 @@
+import { WebAuthCredential } from './web-auth-credential'
+
+export const entities = [WebAuthCredential]

package/server/service/web-auth-credential/web-auth-credential.ts

@@ -0,0 +1,67 @@
+import { Field, ID } from 'type-graphql'
+import {
+  CreateDateColumn,
+  UpdateDateColumn,
+  Entity,
+  Index,
+  Column,
+  RelationId,
+  ManyToOne,
+  PrimaryGeneratedColumn
+} from 'typeorm'
+
+import { User } from '../user/user'
+import { AuthenticatorTransportFuture } from '@simplewebauthn/server/script/deps'
+
+@Entity()
+@Index(
+  'ix_web_auth_credential_0',
+  (webAuthCredential: WebAuthCredential) => [webAuthCredential.user, webAuthCredential.credentialId],
+  { unique: true }
+)
+export class WebAuthCredential {
+  @PrimaryGeneratedColumn('uuid')
+  @Field(type => ID)
+  readonly id: string
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field(type => User, { nullable: true })
+  user?: User
+
+  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.user)
+  userId?: string
+
+  @Column()
+  @Field({ nullable: true })
+  credentialId: string
+
+  @Column()
+  @Field({ nullable: true })
+  publicKey: string
+
+  @Column()
+  @Field({ nullable: true })
+  counter: number
+
+  @CreateDateColumn()
+  @Field({ nullable: true })
+  createdAt?: Date
+
+  @UpdateDateColumn()
+  @Field({ nullable: true })
+  updatedAt?: Date
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field(type => User, { nullable: true })
+  creator?: User
+
+  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.creator)
+  creatorId?: string
+
+  @ManyToOne(type => User, { nullable: true })
+  @Field(type => User, { nullable: true })
+  updater?: User
+
+  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.updater)
+  updaterId?: string
+}

package/server/templates/account-unlock-email.ts

@@ -0,0 +1,65 @@
+export function getUnlockUserEmailForm({ name, resetUrl }) {
+  return `
+  <html lang="en">
+    <head>
+      <meta charset="utf-8" />
+      
+      <title>reset password</title>
+      <meta name="description" content="Password Reset" />
+      <meta name="author" content="hatiolab" />
+      <meta name="google" content="notranslate"/>
+    </head>
+
+    <body>
+      <div style="background-color:#f6f6f6">
+        <!--header begin-->
+        <div style="background-color:#fff;padding:0 10px;border-top: 2px solid #394e64;">
+          <a href="#" target="_blank"
+            ><img
+              src="http://www.hatiolab.com/assets/img/logo-operato.png"
+              style="max-height:50px"
+          /></a>
+        </div>
+        <!--header end-->
+
+        <!--title begin-->
+        <div
+          style="background-color:#22a6a7;padding:12px 10px 10px 10px;min-height:50px;"
+        >
+          <img
+            src="http://www.hatiolab.com/assets/img/icon-mail.png"
+            style="float:left;margin:0 10px 0 40px"
+          />
+          <span style="display:block;color:#fff;font-size:20px"
+            >Hi ${name}!</span
+          >
+          <span style="display:block;color:#fff;font-size:34px;font-weight:bold"
+            >Unlock Account</span
+          >
+        </div>
+        <!--title end-->
+
+        <!--body begin-->
+        <p style="padding:10px 20px;line-height:1.5;font-size:16px">
+          Click the button below to unlock account and reset password.
+          <br />
+          <a
+            href="${resetUrl}"
+            style="display:inline-block;margin:10px 5px 5px 0;border-radius:7px;background-color:#22a6a7;padding:7px 15px;color:#fff;font-size:18px;text-decoration:none;text-transform:capitalize;"
+            >unlock account</a
+          >
+        </p>
+        <!--body end-->
+
+        <!--footer begin-->
+        <div
+          style="background-color:#3d5874;padding:7px 20px 5px 20px;font-size:12px;color:#efefef"
+        >
+          © Hatio, Lab. Inc. All rights reserved.
+        </div>
+        <!--footer end-->
+      </div>
+    </body>
+  </html>
+  `
+}

package/server/templates/invitation-email.ts

@@ -0,0 +1,66 @@
+export function getInvitationEmailForm({ email, acceptUrl }) {
+  return `
+  <html lang="en">
+    <head>
+      <meta charset="utf-8" />
+      
+      <title>Invitation from Operato</title>
+      <meta name="description" content="Invitation" />
+      <meta name="author" content="hatiolab" />
+      <meta name="google" content="notranslate"/>
+    </head>
+
+    <body>
+      <div style="background-color:#f6f6f6">
+        <!--header begin-->
+        <div style="background-color:#fff;padding:0 10px;border-top: 2px solid #394e64;">
+          <a href="#" target="_blank"
+            ><img
+              src="http://www.hatiolab.com/assets/img/logo-operato.png"
+              style="max-height:50px"
+          /></a>
+        </div>
+        <!--header end-->
+
+        <!--title begin-->
+        <div
+          style="background-color:#22a6a7;padding:12px 10px 10px 10px;min-height:50px;"
+        >
+          <img
+            src="http://www.hatiolab.com/assets/img/icon-mail.png"
+            style="float:left;margin:0 10px 0 40px"
+          />
+          <span style="display:block;color:#fff;font-size:20px"
+            >Hi ${email}!</span
+          >
+          <span style="display:block;color:#fff;font-size:34px;font-weight:bold"
+            >Verify your email</span
+          >
+        </div>
+        <!--title end-->
+
+        <!--body begin-->
+        <p style="padding:10px 20px;line-height:1.5;font-size:16px">
+          You're invited from Operato. 
+          Simply click the button below to verify your email address.
+          <br />
+          <a
+            href="${acceptUrl}"
+            style="display:inline-block;margin:10px 5px 5px 0;border-radius:7px;background-color:#22a6a7;padding:7px 15px;color:#fff;font-size:18px;text-decoration:none;text-transform:capitalize;"
+            >Verify</a
+          >
+        </p>
+        <!--body end-->
+
+        <!--footer begin-->
+        <div
+          style="background-color:#3d5874;padding:7px 20px 5px 20px;font-size:12px;color:#efefef"
+        >
+          © Hatio, Lab. Inc. All rights reserved.
+        </div>
+        <!--footer end-->
+      </div>
+    </body>
+  </html>
+  `
+}