@unchainedshop/core-users 2.12.2 → 3.0.0-alpha2

package/src/module/configureUsersWebAuthnModule.ts

@@ -0,0 +1,201 @@
+/// <reference lib="dom" />
+import { ModuleInput } from '@unchainedshop/types/core.js';
+import {
+  Fido2Lib,
+  PublicKeyCredentialCreationOptions,
+  PublicKeyCredentialRequestOptions,
+} from 'fido2-lib';
+import { createLogger } from '@unchainedshop/logger';
+import { WebAuthnCredentialsCreationRequestsCollection } from '../db/WebAuthnCredentialsCreationRequestsCollection.js';
+
+const logger = createLogger('unchained:core-users');
+
+const { ROOT_URL, EMAIL_WEBSITE_NAME } = process.env;
+
+type SerializedOptions<T> = Omit<T, 'challenge' | 'requestId'> & {
+  challenge: string;
+  requestId: number;
+};
+
+let setupMDSPromise;
+const setupMDSCollection = async () => {
+  try {
+    const tocResult = await fetch('https://mds.fidoalliance.org');
+    const tocBase64 = await tocResult.text();
+    const mc = (Fido2Lib as any).createMdsCollection('FIDO MDS v3'); // createMdsCollection exists but not typed in official package!
+    const tocObj = await mc.addToc(tocBase64);
+    return tocObj.entries;
+  } catch (e) {
+    logger.error(e);
+    return [];
+  }
+};
+
+const fetchMDS = async () => {
+  if (setupMDSPromise) return setupMDSPromise;
+  setupMDSPromise = setupMDSCollection();
+  return setupMDSPromise;
+};
+
+export function toArrayBuffer(buffer) {
+  return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
+}
+
+export function buf2hex(buffer) {
+  // buffer is an ArrayBuffer
+  return Array.prototype.map
+    .call(new Uint8Array(buffer), (x) => `00${x.toString(16)}`.slice(-2))
+    .join('');
+}
+
+export const configureUsersWebAuthnModule = async ({ db }: ModuleInput<any>) => {
+  const WebAuthnCredentialsCreationRequests = await WebAuthnCredentialsCreationRequestsCollection(db);
+
+  const thisDomain = new URL(ROOT_URL).hostname;
+
+  const f2l = new Fido2Lib({
+    rpId: thisDomain,
+    rpName: EMAIL_WEBSITE_NAME,
+    rpIcon:
+      'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7Ve9UxNbFL8fm7yA4ktegHnlMk98dMbOMnR2D6pnGTqtCH+BWFoBpZXQaaelFbGzEztHHF26DKizzijDx+Zef+fu3vXuJgsxztjonQnZOZw993d+5zOM/epHslFO1a/KS/UbuvTnETsKQ/YDh3+XNi72yuVlzVgbL1YhCaOTk2ssDAI24hHDKsrpfxZkufwCj6t0OUAEBMkrlR6wHzjDMVCd872yemeete7gczeKoh2wQTICsyi0DrTWVc55eHqwu8OGPEMCMNSby5hS89H7Nx0Se9NXVvF1J69O7MDwJsKzgfCcmSP9SQhvxcV6S5cnummCHYVH4kJ9DE9NfHx1+HGLxKo0sSOkvIXHSnyz7mjOySufdLmUN3Vp4slZiSoyXk7NrhHVQui1fGzhzTq+QsZ5U07NtowQ3oH2FavDhXjS2389w7W+lrDgI2+2yfaZAEpT/y5LopjztnEkf1F6GXsc38TvWKO9g91NfO3EBGgjpxzooTosCISvXQjAm7zc1Fyvm7IChRHQM+uVcxGBAbstI84bVcqyUE3lAMyVWkrky0UsuGUYRqeni4zQk1cAk15ELxMYy07OqElKqo5ieVWWymsDAbhKGa9Qatag8P5omcQiUEot9nmb1c9cFkm5FJPJWqWp2UYegKkCMf7XHjRaeGwgs+9T1iPTA8ibkM/h5ev4XwVJthEd7D7kF+ozANRI9B9RlpO+lUO/IcZqz0jGPr8PUUFU7k185mwFZUIwBAuGUqWUob8nxCqLQ0H6qbeOnNmQGftOBVHO9QEw+ozZRKLE8y0wxDxFLISIE6n7KsDfjUS8kBoludZbCYBvl8XNaCMPLAOASsde5vYAlFPbeqWV+q/Pq5xR6HRS6zkWzPzIlXdmGKWXFaM/V06zwAGQaVppSJ3yzk7DAqpcb7UQD/q8cuRoxb75dtlxm5Zb3mzALEj7O7I/zWRUBRurHcO7G9Sw5MXJT+rLh+dmRlSqe6iOm1aOC/5nBELr2yTDOw3YO4Z+x3icq7iB01BMXm4j4dbIO+rtVi6nr7xLBg0tIjN20mGGbBPdVs+8J07mvcjzkbnbGf14tNNeYcb4wJVMH358jpo2zSf1lgCM1V4m6CsFXiUG9Iref9txe4kQXgVT9jqXejNZaEKAvFu4D5ikStBjus3bJcPxdjALNE8OduetHep+yIsXGQcZf9wTxyusGwSFS2mCvmaMcn6Lj9d9OV77BGN7iOuCYQFeqcMPT43+peln2IraFH/EdsvuALDTTTthvE0tIRnvsc/x/8/diIq2HnsSFoKEhXUAWM6zYA5VwoDtaLiV7O85XypFy+hVnbRlhCXoo9zZHWkpGWY3/L613D25PZFzeVVxvZqs6ywSYKZ7/ro+2g8TOu6eSBXAGfWIio2z2n871GY8OgN06BcSfitQuZr1CxuQ3Zh/6qkk0/P3GeV8BeBCYUHc/WHIAAAAAElFTkSuQmCC',
+    challengeSize: 128,
+    attestation: 'none',
+  });
+
+  return {
+    findMDSMetadataForAAGUID: async (aaguid) => {
+      const mdsCollection = await fetchMDS();
+      const foundEntry = mdsCollection.find((entry) => {
+        return entry.aaguid === aaguid;
+      });
+      return foundEntry?.metadataStatement;
+    },
+
+    createCredentialCreationOptions: async (origin, username, extensionOptions) => {
+      const registrationOptions = await f2l.attestationOptions(extensionOptions);
+      const challenge = Buffer.from(registrationOptions.challenge).toString('base64');
+      const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
+        _id: new Date().getTime(),
+        challenge,
+        origin,
+        factor: (registrationOptions as any).factor || 'either',
+        username,
+      });
+
+      return {
+        ...registrationOptions,
+        challenge,
+        requestId: insertedId,
+      } as SerializedOptions<PublicKeyCredentialCreationOptions>;
+    },
+
+    createCredentialRequestOptions: async (origin, username, extensionOptions) => {
+      const loginOptions = await f2l.assertionOptions(extensionOptions);
+      const challenge = Buffer.from(loginOptions.challenge).toString('base64');
+      const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
+        _id: new Date().getTime(),
+        challenge,
+        origin,
+        factor: (loginOptions as any).factor || 'either',
+        username,
+      });
+
+      return {
+        ...loginOptions,
+        challenge,
+        requestId: insertedId,
+      } as SerializedOptions<PublicKeyCredentialRequestOptions>;
+    },
+
+    verifyCredentialCreation: async (username, credentials) => {
+      const request = await WebAuthnCredentialsCreationRequests.findOne(
+        {
+          username,
+        },
+        { sort: { _id: -1 } },
+      );
+
+      const attestationExpectations = {
+        challenge: request.challenge,
+        origin: request.origin,
+        factor: request.factor,
+      };
+
+      const id = Buffer.from(credentials.id, 'base64');
+      const attestationObject = Buffer.from(credentials.response.attestationObject, 'base64');
+      const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
+
+      const attestationResponse = {
+        id: toArrayBuffer(id),
+        response: {
+          attestationObject: toArrayBuffer(attestationObject),
+          clientDataJSON: toArrayBuffer(clientDataJSON),
+        },
+      };
+
+      const registrationOptions = await f2l.attestationResult(
+        attestationResponse,
+        attestationExpectations,
+      );
+
+      const publicKey = registrationOptions?.authnrData?.get('credentialPublicKeyPem');
+      const aaguidArrayBuffer = registrationOptions?.authnrData?.get('aaguid'); // ArrayBuffer Uint8...
+      const counter = registrationOptions?.authnrData?.get('counter');
+
+      const aaguidConcatenated = buf2hex(aaguidArrayBuffer);
+      const aaguid = `${aaguidConcatenated.slice(0, 8)}-${aaguidConcatenated.slice(
+        8,
+        12,
+      )}-${aaguidConcatenated.slice(12, 16)}-${aaguidConcatenated.slice(
+        16,
+        20,
+      )}-${aaguidConcatenated.slice(20)}`;
+
+      return { publicKey, counter, id: credentials.id, aaguid, created: new Date() };
+    },
+
+    verifyCredentialRequest: async (userPublicKeys, username, credentials) => {
+      const request = await WebAuthnCredentialsCreationRequests.findOne(
+        {
+          _id: credentials.requestId,
+        },
+        { sort: { _id: -1 } },
+      );
+
+      const id = Buffer.from(credentials.id, 'base64');
+      const authenticatorData = Buffer.from(credentials.response.authenticatorData, 'base64');
+      const signature = Buffer.from(credentials.response.signature, 'base64');
+      const userHandle = Buffer.from(credentials.response.userHandle, 'base64');
+      const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
+
+      const { publicKey, counter } =
+        userPublicKeys.find((publicCredentials) => {
+          return credentials.id === publicCredentials.id;
+        }) || {};
+
+      if (!publicKey) throw new Error('WebAuthn not setup');
+
+      const assertionExpectations = {
+        challenge: request.challenge,
+        origin: request.origin,
+        factor: request.factor,
+        prevCounter: counter,
+        publicKey,
+        userHandle: toArrayBuffer(Buffer.from(username)),
+      };
+
+      const assertionResponse = {
+        id: toArrayBuffer(id),
+        response: {
+          authenticatorData: toArrayBuffer(authenticatorData),
+          clientDataJSON: toArrayBuffer(clientDataJSON),
+          signature: toArrayBuffer(signature),
+          userHandle: toArrayBuffer(userHandle),
+        },
+      };
+
+      const loginResult = await f2l.assertionResult(assertionResponse, assertionExpectations);
+      return { userHandle: loginResult?.authnrData?.get('userHandle') };
+    },
+  };
+};

package/src/module/pbkdf2.ts

@@ -0,0 +1,39 @@
+// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
+const PBKDF2_ITERATIONS = 300000; // Iterations, > 210'000
+const PBKDF2_KEY_LENGTH = 256; // Bytes
+const PBKDF2_SALT_LENGTH = 16; // Bytes
+
+export function generateSalt(saltLength = PBKDF2_SALT_LENGTH) {
+  const array = new Uint32Array(saltLength);
+  return Buffer.from(crypto.getRandomValues(array)).toString('hex');
+}
+
+export async function getDerivedKey(
+  salt: string,
+  password: string,
+  iterations = PBKDF2_ITERATIONS,
+  keyLength = PBKDF2_KEY_LENGTH,
+) {
+  const textEncoder = new TextEncoder();
+  const passwordBuffer = textEncoder.encode(password);
+  const importedKey = await crypto.subtle.importKey('raw', passwordBuffer, 'PBKDF2', false, [
+    'deriveBits',
+  ]);
+
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: 'PBKDF2',
+      hash: 'SHA-512',
+      salt: textEncoder.encode(salt),
+      iterations,
+    },
+    importedKey,
+    keyLength,
+  );
+  return Buffer.from(bits).toString('hex');
+}
+
+export async function compare(password: string, hash: string, salt: string) {
+  const comparableHash = await getDerivedKey(salt, password);
+  return comparableHash === hash;
+}

package/src/module/sha256.ts

@@ -0,0 +1,5 @@
+export const hash = async (message) => {
+  const bytes = new TextEncoder().encode(message);
+  const hashBuffer = await crypto.subtle.digest('SHA-256', bytes);
+  return Buffer.from(hashBuffer).toString('hex');
+};

package/src/services/migrateUserDataService.ts

@@ -0,0 +1,31 @@
+import { MigrateUserDataService } from '@unchainedshop/types/user.js';
+import { userSettings } from '../users-settings.js';
+
+export const migrateUserDataService: MigrateUserDataService = async (
+  userIdBeforeLogin,
+  userId,
+  unchainedAPI,
+) => {
+  const user = await unchainedAPI.modules.users.findUserById(userId);
+  const userBeforeLogin = await unchainedAPI.modules.users.findUserById(userIdBeforeLogin);
+
+  await unchainedAPI.services.orders.migrateOrderCarts(
+    {
+      fromUserId: userIdBeforeLogin,
+      toUserId: userId,
+      shouldMerge: userSettings.mergeUserCartsOnLogin,
+      countryContext: userBeforeLogin.lastLogin?.countryCode || user.lastLogin?.countryCode,
+    },
+    unchainedAPI,
+  );
+
+  await unchainedAPI.services.bookmarks.migrateBookmarks(
+    {
+      fromUserId: userIdBeforeLogin,
+      toUserId: userId,
+      shouldMerge: userSettings.mergeUserCartsOnLogin,
+      countryContext: userBeforeLogin.lastLogin?.countryCode || user.lastLogin?.countryCode,
+    },
+    unchainedAPI,
+  );
+};

package/src/services/userServices.ts

@@ -1,10 +1,11 @@
-import { UserServices } from '@unchainedshop/types/user.js';
 import { getUserCountryService } from './getUserCountryService.js';
 import { getUserLanguageService } from './getUserLanguageService.js';
 import { updateUserAvatarAfterUploadService } from './updateUserAvatarAfterUploadService.js';
+import { migrateUserDataService } from './migrateUserDataService.js';
 
-export const userServices: UserServices = {
+export const userServices = {
   getUserCountry: getUserCountryService,
   getUserLanguage: getUserLanguageService,
   updateUserAvatarAfterUpload: updateUserAvatarAfterUploadService,
+  migrateUserData: migrateUserDataService,
 };

package/src/users-index.ts

@@ -1,3 +1,4 @@
 export { configureUsersModule } from './module/configureUsersModule.js';
 
 export { userServices } from './services/userServices.js';
+export { userSettings } from './users-settings.js';

package/src/users-settings.ts

@@ -0,0 +1,71 @@
+import { User, UserSettings, UserSettingsOptions } from '@unchainedshop/types/user.js';
+import { Schemas } from '@unchainedshop/utils';
+import { mongodb } from '@unchainedshop/mongodb';
+
+export const userSettings: UserSettings = {
+  autoMessagingAfterUserCreation: null,
+  mergeUserCartsOnLogin: null,
+  validateEmail: null,
+  validateUsername: null,
+  validateNewUser: null,
+  validatePassword: null,
+
+  configureSettings: (
+    {
+      mergeUserCartsOnLogin,
+      autoMessagingAfterUserCreation,
+      validateEmail,
+      validateUsername,
+      validateNewUser,
+      validatePassword,
+    }: UserSettingsOptions,
+    db: mongodb.Db,
+  ) => {
+    const defaultAutoMessagingAfterUserCreation = true;
+    const defaultMergeUserCartsOnLogin = true;
+
+    const defaultValidateEmail = async (rawEmail: string) => {
+      const email = rawEmail.toLowerCase().trim();
+      if (!email?.includes?.('@')) return false;
+      const emailAlreadyExists = await db
+        .collection('users')
+        .countDocuments({ 'emails.address': { $regex: email, $options: 'i' } }, { limit: 1 });
+      if (emailAlreadyExists) return false;
+      return true;
+    };
+    const defaultValidateUsername = async (rawUsername: string) => {
+      const username = rawUsername.toLowerCase().trim();
+      if (username?.length < 3) return false;
+      const usernameAlreadyExists = await db
+        .collection('users')
+        .countDocuments({ username: { $regex: username, $options: 'i' } }, { limit: 1 });
+      if (usernameAlreadyExists) return false;
+      return true;
+    };
+    const defaultValidateNewUser = async (user: User) => {
+      const customSchema = Schemas.User.omit(
+        '_id',
+        'created',
+        'roles',
+        'emails',
+        'services',
+        'username',
+        'initialPassword',
+      );
+      customSchema.validate(user);
+      return Schemas.User.clean(user) as User;
+    };
+
+    const defaultValidatePassword = async (password: string) => {
+      return password?.length >= 8;
+    };
+
+    userSettings.mergeUserCartsOnLogin = mergeUserCartsOnLogin ?? defaultMergeUserCartsOnLogin;
+    userSettings.autoMessagingAfterUserCreation =
+      autoMessagingAfterUserCreation ?? defaultAutoMessagingAfterUserCreation;
+    userSettings.validateEmail = validateEmail || defaultValidateEmail;
+    userSettings.validateUsername = validateUsername || defaultValidateUsername;
+    userSettings.validateNewUser = validateNewUser || defaultValidateNewUser;
+    userSettings.validatePassword = validatePassword || defaultValidatePassword;
+  },
+};

package/tests/mock/user-mock.ts

@@ -37,14 +37,6 @@ export default {
     token: {
       secret: 'secret',
     },
-    resume: {
-      loginTokens: [
-        {
-          hashedToken: '12eK1jAbw9kcP5u/sha4M5T2pKVVQol1aAbITYGmtCI=',
-          when: new Date('2022-11-27T10:36:00.313Z'),
-        },
-      ],
-    },
     webAuthn: [],
     web3: [
       {