@unchainedshop/core-users 4.3.5 → 4.5.0

package/src/module/configureUsersWebAuthnModule.ts

@@ -1,234 +0,0 @@
-import { ModuleInput } from '@unchainedshop/mongodb';
-import { createLogger } from '@unchainedshop/logger';
-import { WebAuthnCredentialsCreationRequestsCollection } from '../db/WebAuthnCredentialsCreationRequestsCollection.js';
-
-import type {
-  Fido2Lib as Fido2LibType,
-  PublicKeyCredentialCreationOptions,
-  PublicKeyCredentialRequestOptions,
-} from 'fido2-lib';
-
-const logger = createLogger('unchained:core-users');
-
-const { ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_NAME = 'Unchained' } = process.env;
-
-type SerializedOptions<T> = Omit<T, 'challenge' | 'requestId'> & {
-  challenge: string;
-  requestId: number;
-};
-
-let Fido2Lib: typeof Fido2LibType;
-try {
-  const fido2LibPackage = await import('fido2-lib');
-  Fido2Lib = fido2LibPackage.Fido2Lib;
-} catch {
-  logger.warn(`optional peer npm package 'fido2-lib' not installed, WebAuthn will not work`);
-}
-
-let setupMDSPromise;
-const setupMDSCollection = async () => {
-  try {
-    const tocResult = await fetch('https://mds.fidoalliance.org');
-    const tocBase64 = await tocResult.text();
-    const mc = Fido2Lib.createMdsCollection('FIDO MDS v3');
-    // eslint-disable-next-line
-    // @ts-ignore
-    const tocObj = await mc.addToc(tocBase64);
-    return tocObj.entries;
-  } catch (e) {
-    logger.error(e);
-    return [];
-  }
-};
-
-const fetchMDS = async () => {
-  if (setupMDSPromise) return setupMDSPromise;
-  setupMDSPromise = setupMDSCollection();
-  return setupMDSPromise;
-};
-
-export function toArrayBuffer(buffer) {
-  return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
-}
-
-export function buf2hex(buffer) {
-  // buffer is an ArrayBuffer
-  return Array.prototype.map
-    .call(new Uint8Array(buffer), (x) => `00${x.toString(16)}`.slice(-2))
-    .join('');
-}
-
-export const configureUsersWebAuthnModule = async ({ db }: ModuleInput<any>) => {
-  const WebAuthnCredentialsCreationRequests = await WebAuthnCredentialsCreationRequestsCollection(db);
-
-  const thisDomain = new URL(ROOT_URL).hostname;
-  const f2l =
-    Fido2Lib &&
-    new Fido2Lib({
-      rpId: thisDomain,
-      rpName: EMAIL_WEBSITE_NAME,
-      rpIcon:
-        'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAARCSURBVHgB7Ve9UxNbFL8fm7yA4ktegHnlMk98dMbOMnR2D6pnGTqtCH+BWFoBpZXQaaelFbGzEztHHF26DKizzijDx+Zef+fu3vXuJgsxztjonQnZOZw993d+5zOM/epHslFO1a/KS/UbuvTnETsKQ/YDh3+XNi72yuVlzVgbL1YhCaOTk2ssDAI24hHDKsrpfxZkufwCj6t0OUAEBMkrlR6wHzjDMVCd872yemeete7gczeKoh2wQTICsyi0DrTWVc55eHqwu8OGPEMCMNSby5hS89H7Nx0Se9NXVvF1J69O7MDwJsKzgfCcmSP9SQhvxcV6S5cnummCHYVH4kJ9DE9NfHx1+HGLxKo0sSOkvIXHSnyz7mjOySufdLmUN3Vp4slZiSoyXk7NrhHVQui1fGzhzTq+QsZ5U07NtowQ3oH2FavDhXjS2389w7W+lrDgI2+2yfaZAEpT/y5LopjztnEkf1F6GXsc38TvWKO9g91NfO3EBGgjpxzooTosCISvXQjAm7zc1Fyvm7IChRHQM+uVcxGBAbstI84bVcqyUE3lAMyVWkrky0UsuGUYRqeni4zQk1cAk15ELxMYy07OqElKqo5ieVWWymsDAbhKGa9Qatag8P5omcQiUEot9nmb1c9cFkm5FJPJWqWp2UYegKkCMf7XHjRaeGwgs+9T1iPTA8ibkM/h5ev4XwVJthEd7D7kF+ozANRI9B9RlpO+lUO/IcZqz0jGPr8PUUFU7k185mwFZUIwBAuGUqWUob8nxCqLQ0H6qbeOnNmQGftOBVHO9QEw+ozZRKLE8y0wxDxFLISIE6n7KsDfjUS8kBoludZbCYBvl8XNaCMPLAOASsde5vYAlFPbeqWV+q/Pq5xR6HRS6zkWzPzIlXdmGKWXFaM/V06zwAGQaVppSJ3yzk7DAqpcb7UQD/q8cuRoxb75dtlxm5Zb3mzALEj7O7I/zWRUBRurHcO7G9Sw5MXJT+rLh+dmRlSqe6iOm1aOC/5nBELr2yTDOw3YO4Z+x3icq7iB01BMXm4j4dbIO+rtVi6nr7xLBg0tIjN20mGGbBPdVs+8J07mvcjzkbnbGf14tNNeYcb4wJVMH358jpo2zSf1lgCM1V4m6CsFXiUG9Iref9txe4kQXgVT9jqXejNZaEKAvFu4D5ikStBjus3bJcPxdjALNE8OduetHep+yIsXGQcZf9wTxyusGwSFS2mCvmaMcn6Lj9d9OV77BGN7iOuCYQFeqcMPT43+peln2IraFH/EdsvuALDTTTthvE0tIRnvsc/x/8/diIq2HnsSFoKEhXUAWM6zYA5VwoDtaLiV7O85XypFy+hVnbRlhCXoo9zZHWkpGWY3/L613D25PZFzeVVxvZqs6ywSYKZ7/ro+2g8TOu6eSBXAGfWIio2z2n871GY8OgN06BcSfitQuZr1CxuQ3Zh/6qkk0/P3GeV8BeBCYUHc/WHIAAAAAElFTkSuQmCC',
-      challengeSize: 128,
-      attestation: 'none',
-    });
-
-  return {
-    findMDSMetadataForAAGUID: async (aaguid: string) => {
-      const mdsCollection = await fetchMDS();
-      const foundEntry = mdsCollection.find((entry) => {
-        return entry.aaguid === aaguid;
-      });
-      return foundEntry?.metadataStatement;
-    },
-
-    createCredentialCreationOptions: async (
-      origin: string,
-      username: string,
-      extensionOptions?: any,
-    ) => {
-      if (!f2l) return null;
-
-      const registrationOptions = await f2l.attestationOptions(extensionOptions);
-      // Convert challenge to base64 without using Buffer
-      const challenge = btoa(String.fromCharCode(...new Uint8Array(registrationOptions.challenge)));
-      const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
-        _id: new Date().getTime(),
-        challenge,
-        origin,
-        factor: (registrationOptions as any).factor || 'either',
-        username,
-      });
-
-      return {
-        ...registrationOptions,
-        challenge,
-        requestId: insertedId,
-      } as SerializedOptions<PublicKeyCredentialCreationOptions>;
-    },
-
-    createCredentialRequestOptions: async (origin: string, username: string, extensionOptions?: any) => {
-      if (!f2l) return null;
-
-      const loginOptions = await f2l.assertionOptions(extensionOptions);
-      // Convert challenge to base64 without using Buffer
-      const challenge = btoa(String.fromCharCode(...new Uint8Array(loginOptions.challenge)));
-      const { insertedId } = await WebAuthnCredentialsCreationRequests.insertOne({
-        _id: new Date().getTime(),
-        challenge,
-        origin,
-        factor: (loginOptions as any).factor || 'either',
-        username,
-      });
-
-      return {
-        ...loginOptions,
-        challenge,
-        requestId: insertedId,
-      } as SerializedOptions<PublicKeyCredentialRequestOptions>;
-    },
-
-    verifyCredentialCreation: async (username: string, credentials: any) => {
-      if (!f2l) return null;
-
-      const request = await WebAuthnCredentialsCreationRequests.findOne(
-        {
-          username,
-        },
-        { sort: { _id: -1 } },
-      );
-      if (!request) return null;
-
-      const attestationExpectations = {
-        challenge: request.challenge,
-        origin: request.origin,
-        factor: request.factor,
-      };
-
-      const id = Buffer.from(credentials.id, 'base64');
-      const attestationObject = Buffer.from(credentials.response.attestationObject, 'base64');
-      const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
-
-      const attestationResponse = {
-        id: toArrayBuffer(id),
-        response: {
-          attestationObject: toArrayBuffer(attestationObject),
-          clientDataJSON: toArrayBuffer(clientDataJSON),
-        },
-      };
-
-      const registrationOptions = await f2l.attestationResult(
-        attestationResponse,
-        attestationExpectations,
-      );
-
-      const publicKey = registrationOptions?.authnrData?.get('credentialPublicKeyPem');
-      const aaguidArrayBuffer = registrationOptions?.authnrData?.get('aaguid'); // ArrayBuffer Uint8...
-      const counter = registrationOptions?.authnrData?.get('counter');
-
-      const aaguidConcatenated = buf2hex(aaguidArrayBuffer);
-      const aaguid = `${aaguidConcatenated.slice(0, 8)}-${aaguidConcatenated.slice(
-        8,
-        12,
-      )}-${aaguidConcatenated.slice(12, 16)}-${aaguidConcatenated.slice(
-        16,
-        20,
-      )}-${aaguidConcatenated.slice(20)}`;
-
-      return { publicKey, counter, id: credentials.id, aaguid, created: new Date() };
-    },
-
-    verifyCredentialRequest: async (userPublicKeys: any[], username: string, credentials: any) => {
-      if (!f2l) return null;
-
-      const request = await WebAuthnCredentialsCreationRequests.findOne(
-        {
-          _id: credentials.requestId,
-        },
-        { sort: { _id: -1 } },
-      );
-      if (!request) return null;
-
-      const id = Buffer.from(credentials.id, 'base64');
-      const authenticatorData = Buffer.from(credentials.response.authenticatorData, 'base64');
-      const signature = Buffer.from(credentials.response.signature, 'base64');
-      const userHandle = Buffer.from(credentials.response.userHandle, 'base64');
-      const clientDataJSON = Buffer.from(credentials.response.clientDataJSON, 'base64');
-
-      const { publicKey, counter } =
-        userPublicKeys.find((publicCredentials) => {
-          return credentials.id === publicCredentials.id;
-        }) || {};
-
-      if (!publicKey) return null;
-
-      const assertionExpectations = {
-        challenge: request.challenge,
-        origin: request.origin,
-        factor: request.factor,
-        prevCounter: counter,
-        publicKey,
-        userHandle: toArrayBuffer(Buffer.from(username)),
-      };
-
-      const assertionResponse = {
-        id: toArrayBuffer(id),
-        response: {
-          authenticatorData: toArrayBuffer(authenticatorData),
-          clientDataJSON: toArrayBuffer(clientDataJSON),
-          signature: toArrayBuffer(signature),
-          userHandle: toArrayBuffer(userHandle),
-        },
-      };
-
-      const loginResult = await f2l.assertionResult(assertionResponse, assertionExpectations);
-      return { userHandle: loginResult?.authnrData?.get('userHandle') };
-    },
-    deleteUserWebAuthnCredentials: async (username: string) => {
-      const { deletedCount } = await WebAuthnCredentialsCreationRequests.deleteMany({
-        username,
-      });
-      return deletedCount;
-    },
-  };
-};

package/src/module/pbkdf2.ts

@@ -1,46 +0,0 @@
-// https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
-const PBKDF2_ITERATIONS = 300000; // Iterations, > 210'000
-const PBKDF2_KEY_LENGTH = 256; // Bytes
-const PBKDF2_SALT_LENGTH = 16; // Bytes
-
-export function generateSalt(saltLength = PBKDF2_SALT_LENGTH) {
-  const array = new Uint8Array(saltLength);
-  crypto.getRandomValues(array);
-  // Convert to hex string without using Buffer
-  return Array.from(array)
-    .map((b) => b.toString(16).padStart(2, '0'))
-    .join('');
-}
-
-export async function getDerivedKey(
-  salt: string,
-  password: string,
-  iterations = PBKDF2_ITERATIONS,
-  keyLength = PBKDF2_KEY_LENGTH,
-) {
-  const textEncoder = new TextEncoder();
-  const passwordBuffer = textEncoder.encode(password);
-  const importedKey = await crypto.subtle.importKey('raw', passwordBuffer, 'PBKDF2', false, [
-    'deriveBits',
-  ]);
-
-  const bits = await crypto.subtle.deriveBits(
-    {
-      name: 'PBKDF2',
-      hash: 'SHA-512',
-      salt: textEncoder.encode(salt),
-      iterations,
-    },
-    importedKey,
-    keyLength,
-  );
-  // Convert ArrayBuffer to hex string without using Buffer
-  return Array.from(new Uint8Array(bits))
-    .map((b) => b.toString(16).padStart(2, '0'))
-    .join('');
-}
-
-export async function compare(password: string, hash: string, salt: string) {
-  const comparableHash = await getDerivedKey(salt, password);
-  return comparableHash === hash;
-}

package/src/module/removeConfidentialServiceHashes.test.ts

@@ -1,12 +0,0 @@
-import { describe, it } from 'node:test';
-import assert from 'node:assert';
-import { removeConfidentialServiceHashes } from './configureUsersModule.js';
-import user from '../../tests/mock/user-mock.js';
-import { User } from '../db/UsersCollection.js';
-
-describe('removeConfidentialServiceHashes', () => {
-  it('Should remove sensitive user credentials ', () => {
-    assert.notStrictEqual(user.services, undefined);
-    assert.strictEqual(removeConfidentialServiceHashes(user as unknown as User)?.services, undefined);
-  });
-});

package/src/users-index.ts

@@ -1,5 +0,0 @@
-export * from './db/UsersCollection.js';
-export * from './db/WebAuthnCredentialsCreationRequestsCollection.js';
-export * from './module/configureUsersModule.js';
-export * from './module/configureUsersWebAuthnModule.js';
-export * from './users-settings.js';

package/src/users-settings.ts

@@ -1,99 +0,0 @@
-import { insensitiveTrimmedRegexOperator, mongodb } from '@unchainedshop/mongodb';
-import { User } from './db/UsersCollection.js';
-export interface UserRegistrationData extends Partial<User> {
-  email?: string;
-  password: string | null;
-  webAuthnPublicKeyCredentials?: any;
-}
-
-export enum UserAccountAction {
-  RESET_PASSWORD = 'reset-password',
-  VERIFY_EMAIL = 'verify-email',
-  ENROLL_ACCOUNT = 'enroll-account',
-  PASSWORD_RESETTED = 'password-resetted',
-  EMAIL_VERIFIED = 'email-verified',
-}
-export interface UserSettings {
-  mergeUserCartsOnLogin: boolean;
-  autoMessagingAfterUserCreation: boolean;
-  earliestValidTokenDate: (
-    type: UserAccountAction.VERIFY_EMAIL | UserAccountAction.RESET_PASSWORD,
-  ) => Date;
-  validateEmail: (email: string) => Promise<boolean>;
-  validateUsername: (username: string) => Promise<boolean>;
-  validateNewUser: (user: UserRegistrationData) => Promise<UserRegistrationData>;
-  validatePassword: (password: string) => Promise<boolean>;
-  configureSettings: (options: UserSettingsOptions, db: mongodb.Db) => void;
-}
-
-export type UserSettingsOptions = Omit<Partial<UserSettings>, 'configureSettings'>;
-
-const defaultAutoMessagingAfterUserCreation = true;
-const defaultMergeUserCartsOnLogin = true;
-
-const defaultEarliestValidTokenDate = () => {
-  // 1 hour ago
-  return new Date(new Date().getTime() - 1000 * 60 * 60);
-};
-
-const defaultValidateNewUser = async (user: UserRegistrationData) => {
-  return {
-    ...user,
-    username: user.username?.trim().toLowerCase(),
-    email: user.email?.trim().toLowerCase(),
-    password: user.password ?? null,
-  };
-};
-
-const defaultValidatePassword = async (password: string) => {
-  return password?.length >= 8;
-};
-
-export const userSettings: UserSettings = {
-  autoMessagingAfterUserCreation: defaultAutoMessagingAfterUserCreation,
-  mergeUserCartsOnLogin: defaultMergeUserCartsOnLogin,
-  earliestValidTokenDate: defaultEarliestValidTokenDate,
-  validateNewUser: defaultValidateNewUser,
-  validateEmail: () => Promise.resolve(true),
-  validateUsername: () => Promise.resolve(true),
-  validatePassword: () => Promise.resolve(true),
-
-  configureSettings: (
-    {
-      mergeUserCartsOnLogin,
-      autoMessagingAfterUserCreation,
-      earliestValidTokenDate,
-      validateEmail,
-      validateUsername,
-      validateNewUser,
-      validatePassword,
-    },
-    db: mongodb.Db,
-  ) => {
-    const defaultValidateEmail = async (rawEmail: string) => {
-      if (!rawEmail?.includes?.('@')) return false;
-      const emailAlreadyExists = await db
-        .collection('users')
-        .countDocuments({ 'emails.address': insensitiveTrimmedRegexOperator(rawEmail) }, { limit: 1 });
-      if (emailAlreadyExists) return false;
-      return true;
-    };
-    const defaultValidateUsername = async (rawUsername: string) => {
-      if (rawUsername?.length < 3) return false;
-      const usernameAlreadyExists = await db
-        .collection('users')
-        .countDocuments({ username: insensitiveTrimmedRegexOperator(rawUsername) }, { limit: 1 });
-      if (usernameAlreadyExists) return false;
-      return true;
-    };
-
-    userSettings.mergeUserCartsOnLogin = mergeUserCartsOnLogin ?? defaultMergeUserCartsOnLogin;
-    userSettings.autoMessagingAfterUserCreation =
-      autoMessagingAfterUserCreation ?? defaultAutoMessagingAfterUserCreation;
-    userSettings.earliestValidTokenDate = earliestValidTokenDate || defaultEarliestValidTokenDate;
-    userSettings.validateEmail = validateEmail || defaultValidateEmail;
-    userSettings.validateUsername = validateUsername || defaultValidateUsername;
-    userSettings.validateNewUser = validateNewUser || defaultValidateNewUser;
-    userSettings.validatePassword = validatePassword || defaultValidatePassword;
-  },
-};

package/tests/mock/user-mock.ts

@@ -1,72 +0,0 @@
-export default {
-  _id: 'PKve0k9fLCUzn2EUi',
-  guest: false,
-  initialPassword: false,
-  lastBillingAddress: null,
-  profile: {
-    address: {
-      firstName: null,
-      lastName: null,
-      company: null,
-      addressLine: null,
-      addressLine2: null,
-      postalCode: null,
-      regionCode: null,
-      city: null,
-      countryCode: null,
-    },
-    birthday: new Date('2022-11-21T21:00:00.000Z'),
-    displayName: null,
-    gender: null,
-    phoneMobile: null,
-  },
-  roles: ['admin'],
-  services: {
-    password: {
-      bcrypt: '$2a$10$EM5ILD3UtmiP/JJzDvhL3ennDpMEYXfFCCPZ6AiSk3ZM1aPUSjoI2',
-      reset: [
-        {
-          token:
-            '637dfa08a1a48aba26437de983a6cef32fef369252c97791b81712b2283a1173308efade2666d24dab6aa4',
-          address: 'admin@unchained.local',
-          when: new Date('2022-11-26T19:37:30.170Z'),
-          reason: 'reset',
-        },
-      ],
-    },
-    token: {
-      secret: 'secret',
-    },
-    webAuthn: [],
-    web3: [
-      {
-        address: '0xF5F72AE7fa1fa990ebaF163208Ed7aD6a3f42DEA',
-        nonce: '463693',
-      },
-    ],
-    'two-factor': {
-      secret: {
-        base32: 'JF2HO5SAN4YFE7LLKR4FMRSXN47ESVCE',
-      },
-    },
-  },
-  createdAt: new Date('2022-10-20T17:14:48.834Z'),
-  updatedAt: new Date('2022-11-26T19:17:57.131Z'),
-  username: 'admin',
-  emails: [
-    {
-      address: 'admin@unchained.local',
-      verified: false,
-    },
-  ],
-  lastLogin: {
-    timestamp: new Date('2022-11-28T16:28:53.202Z'),
-    remoteAddress: '::ffff:127.0.0.1',
-    remotePort: 42978,
-    userAgent:
-      'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36',
-    locale: 'de-CH',
-    countryCode: 'CH',
-  },
-  updated: new Date('2022-11-30T11:02:19.624Z'),
-};

package/tsconfig.json

@@ -1,10 +0,0 @@
-{
-  "extends": "../shared/base.tsconfig.json",
-  "compilerOptions": {
-    "declarationDir": "./lib",
-    "rootDir": "./src",
-    "outDir": "./lib",
-    
-  },
-  "exclude": ["**/*.test.ts", "**/*.test.js", "tests", "lib"]
-}