@things-factory/auth-base 8.0.0 → 9.0.0-beta.3

package/server/service/user/user.ts

@@ -1,354 +0,0 @@
-import crypto from 'crypto'
-import jwt from 'jsonwebtoken'
-import { Directive, Field, ID, ObjectType } from 'type-graphql'
-import { GraphQLEmailAddress } from 'graphql-scalars'
-import {
-  Column,
-  CreateDateColumn,
-  Entity,
-  Index,
-  JoinTable,
-  ManyToMany,
-  ManyToOne,
-  OneToMany,
-  PrimaryGeneratedColumn,
-  RelationId,
-  UpdateDateColumn
-} from 'typeorm'
-
-import { config } from '@things-factory/env'
-import { Domain, getRepository } from '@things-factory/shell'
-
-import { validatePasswordByRule } from '../../controllers/utils/password-rule'
-import { AuthError } from '../../errors/auth-error'
-import { SECRET } from '../../utils/get-secret'
-import { Role } from '../role/role'
-import { Privilege } from '../privilege/privilege'
-import { WebAuthCredential } from '../web-auth-credential/web-auth-credential'
-import { UsersAuthProviders } from '../users-auth-providers/users-auth-providers'
-import { getDomainsWithPrivilege } from '../../utils/get-user-domains'
-
-const ORMCONFIG = config.get('ormconfig', {})
-const DATABASE_TYPE = ORMCONFIG.type
-
-const sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'
-
-export enum UserStatus {
-  INACTIVE = 'inactive',
-  ACTIVATED = 'activated',
-  DELETED = 'deleted',
-  LOCKED = 'locked',
-  BANNED = 'banned',
-  PWD_RESET_REQUIRED = 'password_reset_required'
-}
-
-@Entity()
-@Index('ix_user_0', (user: User) => [user.email], { unique: true })
-@ObjectType()
-export class User {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(type => ID)
-  readonly id: string
-
-  @Column()
-  @Field({ nullable: true })
-  name: string
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  description: string
-
-  @ManyToMany(type => Domain)
-  @JoinTable({ name: 'users_domains' })
-  @Field(type => [Domain])
-  domains?: Domain[]
-
-  @Column()
-  @Field(type => GraphQLEmailAddress)
-  email: string
-
-  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
-  @Column({
-    nullable: true,
-    type:
-      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'longtext'
-        : DATABASE_TYPE == 'oracle'
-          ? 'clob'
-          : DATABASE_TYPE == 'mssql'
-            ? 'nvarchar'
-            : 'varchar',
-    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined
-  })
-  password: string
-
-  @ManyToMany(type => Role, role => role.users)
-  @JoinTable({ name: 'users_roles' })
-  @Field(type => [Role])
-  roles?: Role[]
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  userType: string // default: 'user', enum: 'user', 'application', 'appliance'
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  reference: string
-
-  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
-  @Column({ nullable: true })
-  salt: string
-
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  locale: string
-
-  @Directive('@privilege(category: "security", privilege: "query", domainOwnerGranted: true)')
-  @Column({ nullable: true })
-  @Field({ nullable: true })
-  ssoId: string
-
-  @Column({
-    type:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'enum'
-        : DATABASE_TYPE == 'oracle'
-          ? 'varchar2'
-          : DATABASE_TYPE == 'mssql'
-            ? 'nvarchar'
-            : 'varchar',
-    enum:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,
-    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
-    default: UserStatus.INACTIVE
-  })
-  @Field(type => String)
-  status: UserStatus
-
-  @Column({ type: 'smallint', default: 0 })
-  failCount: number
-
-  @Column({ nullable: true })
-  passwordUpdatedAt: Date
-
-  @Field({ nullable: true })
-  owner: boolean /* should not be a column */
-
-  @OneToMany(() => WebAuthCredential, credential => credential.user)
-  credentials: WebAuthCredential[]
-
-  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)
-  @Field(type => [UsersAuthProviders], { nullable: true })
-  usersAuthProviders: UsersAuthProviders[]
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field({ nullable: true })
-  creator: User
-
-  @RelationId((user: User) => user.creator)
-  creatorId: string
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field({ nullable: true })
-  updater: User
-
-  @RelationId((user: User) => user.updater)
-  updaterId: string
-
-  @CreateDateColumn()
-  @Field({ nullable: true })
-  createdAt: Date
-
-  @UpdateDateColumn()
-  @Field({ nullable: true })
-  updatedAt: Date
-
-  /* signing for jsonwebtoken */
-  async sign(options?) {
-    var { expiresIn = sessionExpirySeconds, subdomain } = options || {}
-
-    var user = {
-      id: this.id,
-      userType: this.userType,
-      status: this.status,
-      domain: {
-        subdomain
-      }
-    }
-
-    return await jwt.sign(user, SECRET, {
-      expiresIn,
-      issuer: 'hatiolab.com',
-      subject: 'user'
-    })
-  }
-
-  /* validate password through password rule */
-  static validatePasswordByRule(password, lng) {
-    validatePasswordByRule(password, lng)
-  }
-
-  /* generate salt */
-  static generateSalt() {
-    return crypto.randomBytes(16).toString('hex')
-  }
-
-  /* encode password */
-  static encode(password: string, salt) {
-    return crypto
-      .createHmac('sha256', salt || SECRET)
-      .update(password)
-      .digest('base64')
-  }
-
-  /* verify password */
-  static verify(hashed, password, salt) {
-    return (
-      hashed ==
-        crypto
-          .createHmac('sha256', salt || SECRET)
-          .update(password)
-          .digest('base64') ||
-      hashed ==
-        crypto
-          .createHmac('sha1', salt || SECRET)
-          .update(password)
-          .digest('base64')
-    )
-  }
-
-  static async checkAuthWithEmail(decoded) {
-    if (!decoded?.email) {
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    }
-
-    const repository = getRepository(User)
-    var user = await repository.findOne({
-      where: { email: decoded.email },
-      relations: ['domains'],
-      cache: true
-    })
-
-    if (!user)
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    else {
-      switch (user.status) {
-        case UserStatus.INACTIVE:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.LOCKED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.DELETED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_DELETED
-          })
-      }
-
-      return user
-    }
-  }
-
-  static async checkAuth(decoded) {
-    if (decoded?.id === undefined) {
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    }
-
-    const repository = getRepository(User)
-    var user = await repository.findOne({
-      where: { id: decoded.id },
-      relations: ['domains', 'credentials'],
-      cache: true
-    })
-
-    if (!user)
-      throw new AuthError({
-        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
-      })
-    else {
-      switch (user.status) {
-        case UserStatus.INACTIVE:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.LOCKED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
-            detail: {
-              email: user.email
-            }
-          })
-        case UserStatus.DELETED:
-          throw new AuthError({
-            errorCode: AuthError.ERROR_CODES.USER_DELETED
-          })
-      }
-
-      const { defaultPassword } = config.get('password')
-
-      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {
-        user.status = UserStatus.PWD_RESET_REQUIRED
-      }
-
-      return user
-    }
-  }
-
-  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {
-    const result = await getRepository(Privilege)
-      .createQueryBuilder('privilege')
-      .innerJoin('privilege.roles', 'role')
-      .innerJoin('role.users', 'user')
-      .where('privilege.category = :category', { category })
-      .andWhere('privilege.name = :privilege', { privilege })
-      .andWhere('user.id = :userId', { userId: user.id })
-      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
-      .getCount()
-
-    return result > 0
-  }
-
-  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {
-    const result = await getRepository(User)
-      .createQueryBuilder('user')
-      .leftJoinAndSelect('user.roles', 'role')
-      .leftJoinAndSelect('role.privileges', 'privilege')
-      .select(['privilege.name AS privilege', 'privilege.category AS category'])
-      .where('user.id = :userId', { userId: user.id })
-      .andWhere('role.domain.id = :domainId', { domainId: domain.id })
-      .orderBy('privilege.category')
-      .addOrderBy('privilege.name')
-      .getRawMany()
-
-    const distinct = result.reduce((acc, current) => {
-      const last = acc[acc.length - 1]
-      if (!last || last.privilege !== current.privilege || last.category !== current.category) {
-        acc.push(current)
-      }
-      return acc
-    }, [])
-
-    return distinct
-  }
-
-  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {
-    return getDomainsWithPrivilege(user, privilege, category)
-  }
-}

package/server/service/users-auth-providers/index.ts

@@ -1,5 +0,0 @@
-import { UsersAuthProviders } from './users-auth-providers'
-
-export const entities = [UsersAuthProviders]
-export const resolvers = []
-export const subscribers = []

package/server/service/users-auth-providers/users-auth-providers.ts

@@ -1,71 +0,0 @@
-import {
-  CreateDateColumn,
-  UpdateDateColumn,
-  DeleteDateColumn,
-  Entity,
-  Index,
-  Column,
-  RelationId,
-  ManyToOne,
-  PrimaryGeneratedColumn,
-  VersionColumn
-} from 'typeorm'
-import { ObjectType, Field, Int, ID, registerEnumType } from 'type-graphql'
-
-import { Domain } from '@things-factory/shell'
-import { User } from '../user/user'
-import { AuthProvider } from '../auth-provider/auth-provider'
-
-@Entity()
-@Index(
-  'ix_users_auth_providers_0',
-  (usersAuthProviders: UsersAuthProviders) => [
-    usersAuthProviders.domain,
-    usersAuthProviders.user,
-    usersAuthProviders.authProvider
-  ],
-  { unique: true }
-)
-@ObjectType({ description: 'Entity for UsersAuthProviders' })
-export class UsersAuthProviders {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(type => ID)
-  readonly id: string
-
-  @ManyToOne(type => Domain)
-  @Field(type => Domain)
-  domain?: Domain
-
-  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.domain)
-  domainId?: string
-
-  @ManyToOne(() => User, user => user.usersAuthProviders, {
-    onDelete: 'CASCADE'
-  })
-  @Field(type => User, { nullable: true })
-  user: User
-
-  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.user)
-  userId?: string
-
-  @ManyToOne(() => AuthProvider, authProvider => authProvider.usersAuthProviders, {
-    onDelete: 'CASCADE'
-  })
-  @Field(type => AuthProvider, { nullable: true })
-  authProvider: AuthProvider
-
-  @RelationId((usersAuthProviders: UsersAuthProviders) => usersAuthProviders.authProvider)
-  authProviderId?: string
-
-  @Column()
-  @Field({ nullable: true })
-  ssoId: string
-
-  @CreateDateColumn()
-  @Field({ nullable: true })
-  createdAt?: Date
-
-  @UpdateDateColumn()
-  @Field({ nullable: true })
-  updatedAt: Date
-}

package/server/service/verification-token/index.ts

@@ -1,3 +0,0 @@
-import { VerificationToken, VerificationTokenType } from './verification-token'
-
-export const entities = [VerificationToken, VerificationTokenType]

package/server/service/verification-token/verification-token.ts

@@ -1,60 +0,0 @@
-import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from 'typeorm'
-import { config } from '@things-factory/env'
-import { ObjectType, Field, ID } from 'type-graphql'
-const ORMCONFIG = config.get('ormconfig', {})
-const DATABASE_TYPE = ORMCONFIG.type
-
-export enum VerificationTokenType {
-  ACTIVATION = 'activation',
-  PASSWORD_RESET = 'password-reset',
-  UNLOCK = 'unlock',
-  REQUEST_ACCESS_TOKEN = 'access-token'
-}
-
-@Entity()
-@ObjectType()
-export class VerificationToken {
-  @PrimaryColumn()
-  @Field(type => ID)
-  userId: string
-
-  @Column({
-    nullable: false
-  })
-  @Field()
-  token: string
-
-  @Column({
-    nullable: false,
-    type:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? 'enum'
-        : DATABASE_TYPE == 'oracle'
-          ? 'varchar2'
-          : DATABASE_TYPE == 'mssql'
-            ? 'nvarchar'
-            : 'varchar',
-    enum:
-      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
-        ? VerificationTokenType
-        : undefined,
-    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
-    default: VerificationTokenType.ACTIVATION
-  })
-  @Field()
-  type: VerificationTokenType
-
-  @Column({
-    nullable: true
-  })
-  @Field({ nullable: true })
-  suppliment: string
-
-  @CreateDateColumn()
-  @Field()
-  createdAt: Date
-
-  @UpdateDateColumn()
-  @Field()
-  updatedAt: Date
-}

package/server/service/web-auth-credential/index.ts

@@ -1,3 +0,0 @@
-import { WebAuthCredential } from './web-auth-credential'
-
-export const entities = [WebAuthCredential]

package/server/service/web-auth-credential/web-auth-credential.ts

@@ -1,67 +0,0 @@
-import { Field, ID } from 'type-graphql'
-import {
-  CreateDateColumn,
-  UpdateDateColumn,
-  Entity,
-  Index,
-  Column,
-  RelationId,
-  ManyToOne,
-  PrimaryGeneratedColumn
-} from 'typeorm'
-
-import { User } from '../user/user'
-import { AuthenticatorTransportFuture } from '@simplewebauthn/server/script/deps'
-
-@Entity()
-@Index(
-  'ix_web_auth_credential_0',
-  (webAuthCredential: WebAuthCredential) => [webAuthCredential.user, webAuthCredential.credentialId],
-  { unique: true }
-)
-export class WebAuthCredential {
-  @PrimaryGeneratedColumn('uuid')
-  @Field(type => ID)
-  readonly id: string
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field(type => User, { nullable: true })
-  user?: User
-
-  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.user)
-  userId?: string
-
-  @Column()
-  @Field({ nullable: true })
-  credentialId: string
-
-  @Column()
-  @Field({ nullable: true })
-  publicKey: string
-
-  @Column()
-  @Field({ nullable: true })
-  counter: number
-
-  @CreateDateColumn()
-  @Field({ nullable: true })
-  createdAt?: Date
-
-  @UpdateDateColumn()
-  @Field({ nullable: true })
-  updatedAt?: Date
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field(type => User, { nullable: true })
-  creator?: User
-
-  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.creator)
-  creatorId?: string
-
-  @ManyToOne(type => User, { nullable: true })
-  @Field(type => User, { nullable: true })
-  updater?: User
-
-  @RelationId((webAuthCredential: WebAuthCredential) => webAuthCredential.updater)
-  updaterId?: string
-}

package/server/templates/account-unlock-email.ts

@@ -1,65 +0,0 @@
-export function getUnlockUserEmailForm({ name, resetUrl }) {
-  return `
-  <html lang="en">
-    <head>
-      <meta charset="utf-8" />
-      
-      <title>reset password</title>
-      <meta name="description" content="Password Reset" />
-      <meta name="author" content="hatiolab" />
-      <meta name="google" content="notranslate"/>
-    </head>
-
-    <body>
-      <div style="background-color:#f6f6f6">
-        <!--header begin-->
-        <div style="background-color:#fff;padding:0 10px;border-top: 2px solid #394e64;">
-          <a href="#" target="_blank"
-            ><img
-              src="http://www.hatiolab.com/assets/img/logo-operato.png"
-              style="max-height:50px"
-          /></a>
-        </div>
-        <!--header end-->
-
-        <!--title begin-->
-        <div
-          style="background-color:#22a6a7;padding:12px 10px 10px 10px;min-height:50px;"
-        >
-          <img
-            src="http://www.hatiolab.com/assets/img/icon-mail.png"
-            style="float:left;margin:0 10px 0 40px"
-          />
-          <span style="display:block;color:#fff;font-size:20px"
-            >Hi ${name}!</span
-          >
-          <span style="display:block;color:#fff;font-size:34px;font-weight:bold"
-            >Unlock Account</span
-          >
-        </div>
-        <!--title end-->
-
-        <!--body begin-->
-        <p style="padding:10px 20px;line-height:1.5;font-size:16px">
-          Click the button below to unlock account and reset password.
-          <br />
-          <a
-            href="${resetUrl}"
-            style="display:inline-block;margin:10px 5px 5px 0;border-radius:7px;background-color:#22a6a7;padding:7px 15px;color:#fff;font-size:18px;text-decoration:none;text-transform:capitalize;"
-            >unlock account</a
-          >
-        </p>
-        <!--body end-->
-
-        <!--footer begin-->
-        <div
-          style="background-color:#3d5874;padding:7px 20px 5px 20px;font-size:12px;color:#efefef"
-        >
-          © Hatio, Lab. Inc. All rights reserved.
-        </div>
-        <!--footer end-->
-      </div>
-    </body>
-  </html>
-  `
-}

package/server/templates/invitation-email.ts

@@ -1,66 +0,0 @@
-export function getInvitationEmailForm({ email, acceptUrl }) {
-  return `
-  <html lang="en">
-    <head>
-      <meta charset="utf-8" />
-      
-      <title>Invitation from Operato</title>
-      <meta name="description" content="Invitation" />
-      <meta name="author" content="hatiolab" />
-      <meta name="google" content="notranslate"/>
-    </head>
-
-    <body>
-      <div style="background-color:#f6f6f6">
-        <!--header begin-->
-        <div style="background-color:#fff;padding:0 10px;border-top: 2px solid #394e64;">
-          <a href="#" target="_blank"
-            ><img
-              src="http://www.hatiolab.com/assets/img/logo-operato.png"
-              style="max-height:50px"
-          /></a>
-        </div>
-        <!--header end-->
-
-        <!--title begin-->
-        <div
-          style="background-color:#22a6a7;padding:12px 10px 10px 10px;min-height:50px;"
-        >
-          <img
-            src="http://www.hatiolab.com/assets/img/icon-mail.png"
-            style="float:left;margin:0 10px 0 40px"
-          />
-          <span style="display:block;color:#fff;font-size:20px"
-            >Hi ${email}!</span
-          >
-          <span style="display:block;color:#fff;font-size:34px;font-weight:bold"
-            >Verify your email</span
-          >
-        </div>
-        <!--title end-->
-
-        <!--body begin-->
-        <p style="padding:10px 20px;line-height:1.5;font-size:16px">
-          You're invited from Operato. 
-          Simply click the button below to verify your email address.
-          <br />
-          <a
-            href="${acceptUrl}"
-            style="display:inline-block;margin:10px 5px 5px 0;border-radius:7px;background-color:#22a6a7;padding:7px 15px;color:#fff;font-size:18px;text-decoration:none;text-transform:capitalize;"
-            >Verify</a
-          >
-        </p>
-        <!--body end-->
-
-        <!--footer begin-->
-        <div
-          style="background-color:#3d5874;padding:7px 20px 5px 20px;font-size:12px;color:#efefef"
-        >
-          © Hatio, Lab. Inc. All rights reserved.
-        </div>
-        <!--footer end-->
-      </div>
-    </body>
-  </html>
-  `
-}