@tomei/sso 0.1.2 → 0.2.0

package/src/components/login-user/login-user.ts

@@ -0,0 +1,427 @@
+import { ObjectBase, IPerson, IAddress } from '@tomei/general';
+import { ISessionService } from '../../session/interfaces/session-service.interface';
+import { IUserInfo } from './interfaces/user-info.interface';
+import { IPasswordHashService } from '../password-hash/interfaces/password-hash-service.interface';
+import { UserRepository } from './user.repository';
+import { SystemRepository } from '../system/system.repository';
+import { SystemAccessRepository } from '../system-access/system-access.repository';
+import { LoginHistoryRepository } from '../login-history/login-history.repository';
+import { MailService } from '../../mail/mail.service';
+import { UserUserGroupRepository } from '../user-user-group/user-user-group.repository';
+import { PasswordHashService } from '../password-hash/password-hash.service';
+import { SessionService } from '../../session/session.service';
+import { UserGroupRepository } from '../user-group/user-group.repository';
+
+export class LoginUser extends ObjectBase implements IPerson {
+  FullName: string;
+  IDNo: string;
+  IDType: string;
+  Email: string;
+  ContactNo: string;
+  Password: string;
+  DefaultAddress: IAddress;
+  ObjectId: string;
+  ObjectName = 'User';
+  TableName = 'sso_users';
+  staffs: any;
+
+  private _OriginIP: string;
+  private _SessionService: ISessionService;
+  private _PasswordHashService = new PasswordHashService();
+  private _MailService = new MailService();
+  private static _Repository = new UserRepository();
+  private static _SystemRepository = new SystemRepository();
+  private static _SystemAccessRepository = new SystemAccessRepository();
+  private static _LoginHistoryRepository = new LoginHistoryRepository();
+  private static _UserUserGroupRepository = new UserUserGroupRepository();
+  private static _UserGroupRepository = new UserGroupRepository();
+
+  getDetails(): {
+    FullName: string;
+    IDNo: string;
+    IDType: string;
+    Email: string;
+    ContactNo: string;
+  } {
+    return {
+      FullName: this.FullName,
+      IDNo: this.IDNo,
+      IDType: this.IDType,
+      Email: this.Email,
+      ContactNo: this.ContactNo,
+    };
+  }
+
+  private constructor(
+    sessionService: ISessionService,
+    dbTransaction?: any,
+    userInfo?: IUserInfo,
+  ) {
+    super();
+    this._SessionService = sessionService;
+    // this._PasswordHashService = new PasswordHashService();
+    // this._MailService = new MailService();
+
+    if (dbTransaction) {
+      LoginUser._Repository = new UserRepository(dbTransaction);
+      LoginUser._SystemRepository = new SystemRepository(dbTransaction);
+      LoginUser._SystemAccessRepository = new SystemAccessRepository(
+        dbTransaction,
+      );
+      LoginUser._LoginHistoryRepository = new LoginHistoryRepository(
+        dbTransaction,
+      );
+      LoginUser._UserUserGroupRepository = new UserUserGroupRepository(
+        dbTransaction,
+      );
+      LoginUser._UserGroupRepository = new UserGroupRepository(dbTransaction);
+    }
+    // set all the class properties
+    if (userInfo) {
+      this.ObjectId = userInfo.ObjectId;
+      this.FullName = userInfo.FullName;
+      this.IDNo = userInfo.IDNo;
+      this.Email = userInfo.Email;
+      this.ContactNo = userInfo.ContactNo;
+      this.Password = userInfo.Password;
+      this.staffs = userInfo.staffs;
+    }
+  }
+
+  static async init(userId?: string, dbTransaction = null): Promise<LoginUser> {
+    const sessionService = await SessionService.init();
+
+    if (userId) {
+      if (dbTransaction) {
+        LoginUser._Repository = new UserRepository(dbTransaction);
+      }
+      const user = await LoginUser._Repository.findOne({
+        where: {
+          id: Number(userId),
+        },
+        include: {
+          staffs: true,
+          userSystemPrivileges: {
+            include: {
+              systemPrivilege: true,
+            },
+          },
+        },
+      });
+
+      if (user) {
+        const userInfo: IUserInfo = {
+          ObjectId: user.id,
+          FullName: user.staffs[0].name,
+          IDNo: user.staffs[0].idNo,
+          ContactNo: user.staffs[0].contactNo,
+          Email: user.staffs[0].email,
+          Password: user.password,
+          staffs: user.staffs[0],
+        };
+
+        return new LoginUser(sessionService, dbTransaction, userInfo);
+      } else {
+        throw new Error('User not found');
+      }
+    }
+    return new LoginUser(sessionService, dbTransaction);
+  }
+
+  async login(
+    systemCode: string,
+    email: string,
+    password: string,
+    ipAddress: string,
+  ): Promise<string> {
+    //validate email
+    if (this.Email !== email) {
+      throw new Error('Invalid credentials.');
+    }
+
+    //validate password
+    const isPasswordValid = await this._PasswordHashService.verify(
+      password,
+      this.Password,
+    );
+
+    if (!isPasswordValid) {
+      throw new Error('Invalid credentials.');
+    }
+
+    //validate system code
+    const system = await LoginUser._SystemRepository.findOne({
+      where: {
+        code: systemCode,
+      },
+    });
+
+    if (!system) {
+      throw new Error('Invalid system code.');
+    }
+
+    //validate system access
+    await this.checkSystemAccess(this.ObjectId, system.id);
+    // alert user if new login
+    await this.alertNewLogin(this.ObjectId, system.id, ipAddress);
+
+    // fetch user session if exists
+    const userSession = await this._SessionService.retrieveUserSession(
+      this.ObjectId,
+    );
+    let systemLogin = userSession.systemLogins.find(
+      (system) => system.code === systemCode,
+    );
+
+    // generate new session id
+    const { randomUUID } = require('crypto');
+    const sessionId = randomUUID();
+
+    if (systemLogin) {
+      systemLogin = systemLogin.sessionId = sessionId;
+      userSession.systemLogins.map((system) =>
+        system.code === systemCode ? systemLogin : system,
+      );
+    } else {
+      // if not, add new system login into the userSession
+      const newLogin = {
+        id: system.id.toString(),
+        code: system.code,
+        sessionId: sessionId,
+        privileges: await this.getPrivileges(system.code),
+      };
+      userSession.systemLogins.push(newLogin);
+    }
+    // then update userSession inside the redis storage with 1 day duration of time-to-live
+    this._SessionService.setUserSession(this.ObjectId, userSession);
+
+    // record new login history
+    await LoginUser._LoginHistoryRepository.create({
+      data: {
+        userId: this.ObjectId,
+        systemId: system.id,
+        originIp: ipAddress,
+        createdAt: new Date(),
+      },
+    });
+
+    return sessionId;
+  }
+
+  private async checkSystemAccess(
+    userId: string,
+    systemId: number,
+  ): Promise<void> {
+    const systemAccess = await LoginUser._SystemAccessRepository.findOne({
+      where: {
+        userId: userId,
+        systemId: systemId,
+      },
+    });
+
+    if (!systemAccess) {
+      throw new Error("User don't have access to the system.");
+    }
+  }
+
+  private async alertNewLogin(
+    userId: string,
+    systemId: string,
+    ipAddress: string,
+  ) {
+    const userLogins = await LoginUser._LoginHistoryRepository.findAll({
+      where: {
+        userId: userId,
+        systemId: systemId,
+      },
+    });
+
+    const gotPreviousLogins = userLogins?.length !== 0;
+    let ipFound = null;
+    if (gotPreviousLogins) {
+      ipFound = userLogins.find((item) => item.ipAddress === ipAddress);
+    }
+
+    if (gotPreviousLogins && !ipFound) {
+      await this._MailService.sendNewLoginAlertEmail({
+        IpAddress: ipAddress,
+        Email: this.Email,
+        Name: this.FullName,
+        LoginDate: new Date(),
+      });
+    }
+  }
+
+  async getPrivileges(systemCode: string): Promise<string[]> {
+    try {
+      const system = await LoginUser._SystemRepository.findOne({
+        where: {
+          code: systemCode,
+        },
+      });
+
+      if (!system) {
+        throw new Error('Invalid system code.');
+      }
+      // retrive user userGroups with system privileges
+      const userUserGroups = await this.getUserUserGroupFromDB(system.id);
+
+      // get all userGroup data from user userGroups
+      const userGroupData = userUserGroups.map((u) => u.userGroup);
+
+      // get all privileges from userGroup data
+      let privileges: string[] = [];
+      for (const userGroup of userGroupData) {
+        const groupSystemPrivileges = userGroup.groupSystemPrivileges.map(
+          (g) => g.systemPrivilege.code,
+        );
+        const groupRolePrivileges = userGroup.groupRolePrivileges.map(
+          (g) => g.systemPrivilege.code,
+        );
+
+        // if userGroup is not root, get all parent tree privileges
+        if (userGroup.groupLevel !== 0) {
+          // get all parent tree privileges
+          const parentTreePrivileges = await this.getPrivilegesFromUserGroup(
+            userGroup.parentCode,
+          );
+
+          privileges = [...privileges, ...parentTreePrivileges];
+        }
+
+        privileges = [
+          ...privileges,
+          ...groupSystemPrivileges,
+          ...groupRolePrivileges,
+        ];
+      }
+
+      // retrive all user personal privileges
+      const userPrivileges = await this.getUserPersonalPrivileges(system.id);
+
+      privileges = [...privileges, ...userPrivileges];
+      privileges = [...new Set(privileges)];
+      return privileges;
+    } catch (error) {
+      throw error;
+    }
+  }
+
+  private async getPrivilegesFromUserGroup(
+    groupCode: string,
+  ): Promise<string[]> {
+    try {
+      // Retrieve userGroup from the database based on groupCode
+      const userGroup = await this.getUserGroupFromDB(groupCode);
+      let privileges: string[] = [];
+
+      // Add privileges from the userGroup to the privileges array
+      privileges = [
+        ...privileges,
+        ...userGroup.groupSystemPrivileges.map((g) => g.systemPrivilege.code),
+        ...userGroup.groupRolePrivileges.map((g) => g.systemPrivilege.code),
+      ];
+
+      // Recursive call if conditions are not met and ParentGroupCode exists
+      const isContinue =
+        userGroup.groupLevel !== 0 &&
+        userGroup.allowInheritFromParentYN === 'Y';
+      if (isContinue) {
+        const recursivePrivileges = await this.getPrivilegesFromUserGroup(
+          userGroup.parentGroupCode,
+        );
+        privileges = privileges.concat(recursivePrivileges);
+      }
+
+      // return privileges array
+      return privileges;
+    } catch (error) {
+      throw error;
+    }
+  }
+
+  private async getUserGroupFromDB(groupCode: string): Promise<any> {
+    try {
+      const userGroup = await LoginUser._UserGroupRepository.findOne({
+        where: {
+          groupCode: groupCode,
+        },
+        include: {
+          groupSystemPrivileges: {
+            include: {
+              systemPrivilege: true,
+            },
+          },
+          groupRolePrivileges: {
+            include: {
+              systemPrivilege: true,
+            },
+          },
+        },
+      });
+      return userGroup;
+    } catch (error) {
+      throw error;
+    }
+  }
+
+  private async getUserUserGroupFromDB(systemCode: number) {
+    try {
+      return await LoginUser._UserUserGroupRepository.findAll({
+        where: {
+          userId: this.ObjectId,
+          systemId: systemCode,
+        },
+        include: {
+          userGroup: {
+            include: {
+              groupSystemPrivileges: {
+                include: {
+                  systemPrivilege: true,
+                },
+              },
+              groupRolePrivileges: {
+                include: {
+                  systemPrivilege: true,
+                },
+              },
+            },
+          },
+        },
+      });
+    } catch (error) {
+      throw error;
+    }
+  }
+
+  private async getUserPersonalPrivileges(systemId: number): Promise<string[]> {
+    try {
+      const userRole = await LoginUser._Repository.findOne({
+        where: {
+          id: this.ObjectId,
+        },
+        include: {
+          userSystemPrivileges: {
+            include: {
+              systemPrivilege: true,
+            },
+          },
+        },
+      });
+
+      //retrive all user systemPrevileges data from user roles
+      let userSystemPrivileges = userRole.userSystemPrivileges.map(
+        (u) => u.systemPrivilege,
+      );
+
+      userSystemPrivileges = userRole.userSystemPrivileges.filter(
+        (u) => u.systemPrivilege.systemId === systemId,
+      );
+
+      const userPrivileges: string[] = userSystemPrivileges.map((u) => u.code);
+      return userPrivileges;
+    } catch (error) {
+      throw error;
+    }
+  }
+}

package/src/components/login-user/user.repository.ts

@@ -0,0 +1,33 @@
+import prisma from '../../prisma-client/client';
+
+export class UserRepository {
+  private _prisma: any;
+
+  constructor(client?: any) {
+    if (client) {
+      this._prisma = client;
+    } else {
+      this._prisma = prisma;
+    }
+  }
+
+  public async create(data: any): Promise<any> {
+    return await this._prisma.user.create(data);
+  }
+
+  public async findAll(options: any): Promise<any[]> {
+    return await this._prisma.user.findMany(options);
+  }
+
+  public async findOne(options: any): Promise<any> {
+    return await this._prisma.user.findFirst(options);
+  }
+
+  public async update(where: any, data: any): Promise<any> {
+    return await this._prisma.user.update(where, data);
+  }
+
+  public async delete(where: any): Promise<any> {
+    return await this._prisma.user.delete(where);
+  }
+}

package/src/components/password-hash/index.ts

@@ -0,0 +1,2 @@
+export * from './interfaces';
+export * from './password-hash.service';

package/src/components/password-hash/interfaces/index.ts

@@ -0,0 +1 @@
+export * from './password-hash-service.interface';

package/src/components/password-hash/interfaces/password-hash-service.interface.ts

@@ -0,0 +1,4 @@
+export interface IPasswordHashService {
+  hashPassword(password: string): Promise<string>;
+  verify(password: string, hash: string): Promise<boolean>;
+}

package/src/components/password-hash/password-hash.service.ts

@@ -0,0 +1,14 @@
+import * as argon2 from 'argon2';
+import { IPasswordHashService } from './interfaces/password-hash-service.interface';
+
+export class PasswordHashService implements IPasswordHashService {
+  constructor() {}
+
+  async hashPassword(password: string): Promise<string> {
+    return await argon2.hash(password);
+  }
+
+  async verify(password: string, hash: string): Promise<boolean> {
+    return await argon2.verify(hash, password);
+  }
+}

package/src/components/system/index.ts

@@ -0,0 +1 @@
+export * from './system.repository';

package/src/components/system/system.repository.ts

@@ -0,0 +1,33 @@
+import prisma from '../../prisma-client/client';
+
+export class SystemRepository {
+  private _prisma: any;
+
+  constructor(client?: any) {
+    if (client) {
+      this._prisma = client;
+    } else {
+      this._prisma = prisma;
+    }
+  }
+
+  public async create(data: any): Promise<any> {
+    return await this._prisma.system.create(data);
+  }
+
+  public async findAll(options: any): Promise<any[]> {
+    return await this._prisma.system.findMany(options);
+  }
+
+  public async findOne(options: any): Promise<any> {
+    return await this._prisma.system.findFirst(options);
+  }
+
+  public async update(where: any, data: any): Promise<any> {
+    return await this._prisma.system.update(where, data);
+  }
+
+  public async delete(where: any): Promise<any> {
+    return await this._prisma.system.delete(where);
+  }
+}

package/src/components/system-access/index.ts

@@ -0,0 +1 @@
+export * from './system-access.repository';

package/src/components/system-access/system-access.repository.ts

@@ -0,0 +1,33 @@
+import prisma from '../../prisma-client/client';
+
+export class SystemAccessRepository {
+  private _prisma: any;
+
+  constructor(client?: any) {
+    if (client) {
+      this._prisma = client;
+    } else {
+      this._prisma = prisma;
+    }
+  }
+
+  public async create(data: any): Promise<any> {
+    return await this._prisma.systemAccess.create(data);
+  }
+
+  public async findAll(options: any): Promise<any[]> {
+    return await this._prisma.systemAccess.findMany(options);
+  }
+
+  public async findOne(options: any): Promise<any> {
+    return await this._prisma.systemAccess.findFirst(options);
+  }
+
+  public async update(where: any, data: any): Promise<any> {
+    return await this._prisma.systemAccess.update(where, data);
+  }
+
+  public async delete(where: any): Promise<any> {
+    return await this._prisma.systemAccess.delete(where);
+  }
+}

package/src/components/user-group/index.ts

@@ -0,0 +1 @@
+export * from './user-group.repository';

package/src/components/user-group/user-group.repository.ts

@@ -0,0 +1,33 @@
+import prisma from '../../prisma-client/client';
+
+export class UserGroupRepository {
+  private _prisma: any;
+
+  constructor(client?: any) {
+    if (client) {
+      this._prisma = client;
+    } else {
+      this._prisma = prisma;
+    }
+  }
+
+  public async create(data: any): Promise<any> {
+    return await this._prisma.userGroup.create(data);
+  }
+
+  public async findAll(options: any): Promise<any[]> {
+    return await this._prisma.userGroup.findMany(options);
+  }
+
+  public async findOne(options: any): Promise<any> {
+    return await this._prisma.userGroup.findFirst(options);
+  }
+
+  public async update(where: any, data: any): Promise<any> {
+    return await this._prisma.userGroup.update(where, data);
+  }
+
+  public async delete(where: any): Promise<any> {
+    return await this._prisma.userGroups.delete(where);
+  }
+}

package/src/components/user-user-group/index.ts

@@ -0,0 +1 @@
+export * from './user-user-group.repository';

package/src/components/user-user-group/user-user-group.repository.ts

@@ -0,0 +1,33 @@
+import prisma from '../../prisma-client/client';
+
+export class UserUserGroupRepository {
+  private _prisma: any;
+
+  constructor(client?: any) {
+    if (client) {
+      this._prisma = client;
+    } else {
+      this._prisma = prisma;
+    }
+  }
+
+  public async create(data: any): Promise<any> {
+    return await this._prisma.userUserGroup.create(data);
+  }
+
+  public async findAll(options: any): Promise<any[]> {
+    return await this._prisma.userUserGroup.findMany(options);
+  }
+
+  public async findOne(options: any): Promise<any> {
+    return await this._prisma.userUserGroup.findFirst(options);
+  }
+
+  public async update(where: any, data: any): Promise<any> {
+    return await this._prisma.userUserGroup.update(where, data);
+  }
+
+  public async delete(where: any): Promise<any> {
+    return await this._prisma.userUserGroup.delete(where);
+  }
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+require('dotenv').config();
+export * from './components';
+export * from './interfaces';
+export * from './redis-client';
+export * from './mail';
+export * from './prisma-client';
+export * from './session';

package/src/interfaces/index.ts

@@ -0,0 +1,2 @@
+export * from './system-login.interface';
+export * from './user-session.interface';

package/src/interfaces/system-login.interface.ts

@@ -0,0 +1,6 @@
+export interface ISystemLogin {
+  id: string;
+  code: string;
+  sessionId: string;
+  privileges: any[];
+}

package/src/interfaces/user-session.interface.ts

@@ -0,0 +1,5 @@
+import { ISystemLogin } from './system-login.interface';
+
+export interface IUserSession {
+  systemLogins: ISystemLogin[];
+}

package/src/mail/index.ts

@@ -0,0 +1,2 @@
+export * from './mail.service';
+export * from './mail';

package/src/mail/interfaces/index.ts

@@ -0,0 +1,2 @@
+export * from './send-mail.interface';
+export * from './send-new-login-alert.interface';

package/src/mail/interfaces/send-mail.interface.ts

@@ -0,0 +1,8 @@
+export interface ISendMailOptionsInterface {
+  to: string | string[];
+  cc?: string | string[];
+  bcc?: string | string[];
+  subject: string;
+  text?: string;
+  html: string;
+}

package/src/mail/interfaces/send-new-login-alert.interface.ts

@@ -0,0 +1,6 @@
+export interface ISendNewLoginAlertOptions {
+  IpAddress: string;
+  Email: string;
+  Name: string;
+  LoginDate: Date;
+}