@veap/auth 0.0.0-stage → 0.1.0

package/dist/session/session.service.js

@@ -0,0 +1,219 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { isIP } from "node:net";
+import { COOKIE_STORE, Inject, Injectable, REQUEST_CONTEXT, } from "@veap/kernel";
+import { addDays } from "date-fns";
+import { augmentSession } from "../common/augment";
+import { performFullUserAugmentation } from "../common/logic";
+import { TOKEN_GENERATOR } from "../crypto/contracts";
+import { SESSION_REPOSITORY } from "./contracts";
+let SessionService = class SessionService {
+    sessions;
+    tokens;
+    cookieStore;
+    requestContext;
+    constructor(sessions, tokens, cookieStore, requestContext) {
+        this.sessions = sessions;
+        this.tokens = tokens;
+        this.cookieStore = cookieStore;
+        this.requestContext = requestContext;
+    }
+    /**
+     * Returns the user's validated IP address, checking trusted proxy headers first.
+     */
+    async getIPAddress() {
+        const directHeaders = ["cf-connecting-ip", "x-real-ip", "x-client-ip"];
+        for (const header of directHeaders) {
+            const val = await this.requestContext.getHeader(header);
+            if (val && isIP(val.trim())) {
+                return val.trim();
+            }
+        }
+        const forwarded = await this.requestContext.getHeader("x-forwarded-for");
+        if (forwarded) {
+            const ips = forwarded.split(",").map((ip) => ip.trim());
+            for (const ip of ips) {
+                if (isIP(ip)) {
+                    return ip;
+                }
+            }
+        }
+        return null;
+    }
+    /**
+     * Validates the session token.
+     */
+    async validateSessionToken(token) {
+        const sessionId = this.tokens.hashToken(token);
+        const record = await this.sessions.findWithUser(sessionId);
+        if (!record) {
+            return { session: null, user: null };
+        }
+        const baseUserAttributes = record.user;
+        const baseSessionAttributes = record.session;
+        // STRICTLY remove non-serializable and sensitive fields (including camelCase recoveryCode)
+        const { password, recovery_code, recoveryCode, ...safeUserRest } = baseUserAttributes;
+        const safeUser = {
+            ...safeUserRest,
+            id: baseUserAttributes.id || safeUserRest.id,
+        };
+        const expiresAt = baseSessionAttributes.expiresAt ?? baseSessionAttributes.expires_at;
+        // Check if session is expired
+        if (new Date() > new Date(expiresAt)) {
+            await this.sessions.remove(sessionId);
+            return { session: null, user: null };
+        }
+        const metadata = baseSessionAttributes.metadata || {};
+        // Restore metadata into session object
+        const sessionWithFlags = {
+            ...baseSessionAttributes,
+            id: baseSessionAttributes.id,
+            userId: baseSessionAttributes.userId ?? baseSessionAttributes.user_id,
+            expiresAt,
+            metadata,
+            ...metadata,
+        };
+        // AUGMENT (EXTENSIBILITY POINTS)
+        const augmentedUser = await performFullUserAugmentation(safeUser, sessionWithFlags);
+        const augmentedSession = await augmentSession(sessionWithFlags);
+        // ENSURE PLAIN OBJECTS for Client Components
+        return {
+            session: augmentedSession ? { ...augmentedSession } : null,
+            user: augmentedUser ? { ...augmentedUser } : null,
+        };
+    }
+    /**
+     * Returns the current user session from cookies.
+     */
+    async getCurrentSession() {
+        const token = await this.cookieStore.get("session");
+        if (token === null) {
+            return { session: null, user: null };
+        }
+        return await this.validateSessionToken(token);
+    }
+    /**
+     * Invalidates a single session.
+     */
+    async invalidateSession(sessionId) {
+        await this.sessions.remove(sessionId);
+    }
+    /**
+     * Invalidates all user sessions.
+     */
+    async invalidateUserSessions(userId) {
+        await this.sessions.removeByUserId(userId);
+    }
+    /**
+     * Sets the session token in a cookie.
+     */
+    async setSessionTokenCookie(token, expiresAt) {
+        await this.cookieStore.set("session", token, {
+            httpOnly: true,
+            path: "/",
+            secure: process.env.NODE_ENV === "production",
+            sameSite: "lax",
+            expires: expiresAt,
+        });
+    }
+    /**
+     * Removes the session token cookie.
+     */
+    async deleteSessionTokenCookie() {
+        await this.cookieStore.delete("session");
+    }
+    /**
+     * Generates a new random session token.
+     */
+    async generateSessionToken() {
+        return this.tokens.generateSessionToken();
+    }
+    /**
+     * Creates a new session in the database.
+     */
+    async createSession(token, userId, flags) {
+        const sessionId = this.tokens.hashToken(token);
+        return await this.sessions.create({
+            id: sessionId,
+            expiresAt: new Date(addDays(new Date(), 7)),
+            userId,
+            metadata: flags,
+        });
+    }
+    /**
+     * Updates the current session metadata.
+     */
+    async updateSessionMetadata(flags) {
+        const { session } = await this.getCurrentSession();
+        if (!session)
+            return;
+        const current = await this.sessions.findById(session.id);
+        if (!current)
+            return;
+        const newMetadata = {
+            ...(current.metadata || {}),
+            ...flags,
+        };
+        await this.sessions.updateMetadata(session.id, newMetadata);
+    }
+    /**
+     * Signs the user out and redirects to the sign-in page.
+     */
+    async sessionSignOut() {
+        const { session } = await this.getCurrentSession();
+        if (session) {
+            await this.invalidateSession(session.id);
+            await this.deleteSessionTokenCookie();
+        }
+        await this.requestContext.redirect("/signin");
+    }
+    /**
+     * Get all active sessions for a user.
+     */
+    async getUserSessions(userId, currentSessionId) {
+        const sessions = await this.sessions.findByUserId(userId);
+        const augmentedSessions = await Promise.all(sessions.map(async (session) => {
+            const metadata = session.metadata || {};
+            const sessionWithFlags = {
+                ...session,
+                id: session.id,
+                userId: session.userId ?? session.user_id,
+                expiresAt: session.expiresAt ?? session.expires_at,
+                metadata,
+                ...metadata,
+            };
+            // Run augmenters
+            const augmented = await augmentSession(sessionWithFlags);
+            return {
+                ...augmented,
+                isCurrent: augmented.id === currentSessionId,
+            };
+        }));
+        return augmentedSessions;
+    }
+    /**
+     * Invalidate all sessions for a user except the specified current one.
+     */
+    async invalidateOtherSessions(userId, currentSessionId) {
+        await this.sessions.removeOtherUserSessions(userId, currentSessionId);
+    }
+};
+SessionService = __decorate([
+    Injectable(),
+    __param(0, Inject(SESSION_REPOSITORY)),
+    __param(1, Inject(TOKEN_GENERATOR)),
+    __param(2, Inject(COOKIE_STORE)),
+    __param(3, Inject(REQUEST_CONTEXT)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object])
+], SessionService);
+export { SessionService };

package/dist/users/contracts.d.ts

@@ -0,0 +1,32 @@
+import type { FullUser, User } from "../common";
+export type { FullUser, User };
+export interface CreateUserRecord {
+    email: string;
+    name: string;
+    password?: string | null;
+    image?: string | null;
+    emailVerifiedAt?: Date | null;
+    recoveryCode: Uint8Array;
+}
+export interface UpdateUserRecord {
+    name?: string;
+    email?: string;
+    image?: string | null;
+    password?: string;
+    emailVerifiedAt?: Date | null;
+}
+/**
+ * User persistence port.
+ */
+export interface IUserRepository {
+    create(record: CreateUserRecord): Promise<User>;
+    findById(id: string): Promise<User | null>;
+    findByEmail(email: string): Promise<User | null>;
+    findPasswordHash(id: string): Promise<string | null | undefined>;
+    findRecoveryCode(id: string): Promise<Uint8Array | null | undefined>;
+    update(id: string, changes: UpdateUserRecord): Promise<void>;
+    setRecoveryCode(id: string, encrypted: Uint8Array): Promise<void>;
+    setEmailVerifiedIfEmailMatches(id: string, email: string): Promise<boolean>;
+}
+/** Injection token for the user repository port. */
+export declare const USER_REPOSITORY: unique symbol;

package/dist/users/contracts.js

@@ -0,0 +1,2 @@
+/** Injection token for the user repository port. */
+export const USER_REPOSITORY = Symbol.for("veap:auth:user-repository");

package/dist/users/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./contracts";
+export * from "./user.facade";
+export * from "./user.repository";
+export * from "./user.service";

package/dist/users/index.js

@@ -0,0 +1,4 @@
+export * from "./contracts";
+export * from "./user.facade";
+export * from "./user.repository";
+export * from "./user.service";

package/dist/users/user.facade.d.ts

@@ -0,0 +1,14 @@
+import type { User } from "../common";
+export declare function verifyUsernameInput(username: string): Promise<boolean>;
+export declare function createUser(email: string, username: string, password: string): Promise<User>;
+export declare function createOAuthUser(email: string, name: string, image?: string): Promise<User>;
+export declare function getUserById(userId: string): Promise<User | null>;
+export declare function getUserRecoverCode(userId: string): Promise<string>;
+export declare function resetUserRecoveryCode(userId: string): Promise<string>;
+export declare function updateUserPassword(userId: string, password: string): Promise<void>;
+export declare function updateUserName(userId: string, name: string): Promise<void>;
+export declare function updateUserAwatar(userId: string, image: string): Promise<void>;
+export declare function updateUserEmailAndSetEmailAsVerified(userId: string, email: string): Promise<void>;
+export declare function setUserAsEmailVerifiedIfEmailMatches(userId: string, email: string): Promise<boolean>;
+export declare function getUserPasswordHash(userId: string): Promise<string | null>;
+export declare function getUserFromEmail(email: string): Promise<User | null>;

package/dist/users/user.facade.js

@@ -0,0 +1,62 @@
+"use server";
+import { app } from "@veap/kernel";
+import { authContext, isAuthContextBound } from "../common/context";
+import { UserService } from "./user.service";
+async function resolveUserService() {
+    if (isAuthContextBound()) {
+        return authContext().user;
+    }
+    return await app(UserService);
+}
+export async function verifyUsernameInput(username) {
+    const service = await resolveUserService();
+    return service.verifyUsernameInput(username);
+}
+export async function createUser(email, username, password) {
+    const service = await resolveUserService();
+    return service.createUser(email, username, password);
+}
+export async function createOAuthUser(email, name, image) {
+    const service = await resolveUserService();
+    return service.createOAuthUser(email, name, image);
+}
+export async function getUserById(userId) {
+    const service = await resolveUserService();
+    return service.getUserById(userId);
+}
+export async function getUserRecoverCode(userId) {
+    const service = await resolveUserService();
+    return service.getUserRecoverCode(userId);
+}
+export async function resetUserRecoveryCode(userId) {
+    const service = await resolveUserService();
+    return service.resetUserRecoveryCode(userId);
+}
+export async function updateUserPassword(userId, password) {
+    const service = await resolveUserService();
+    return service.updateUserPassword(userId, password);
+}
+export async function updateUserName(userId, name) {
+    const service = await resolveUserService();
+    return service.updateUserName(userId, name);
+}
+export async function updateUserAwatar(userId, image) {
+    const service = await resolveUserService();
+    return service.updateUserAwatar(userId, image);
+}
+export async function updateUserEmailAndSetEmailAsVerified(userId, email) {
+    const service = await resolveUserService();
+    return service.updateUserEmailAndSetEmailAsVerified(userId, email);
+}
+export async function setUserAsEmailVerifiedIfEmailMatches(userId, email) {
+    const service = await resolveUserService();
+    return service.setUserAsEmailVerifiedIfEmailMatches(userId, email);
+}
+export async function getUserPasswordHash(userId) {
+    const service = await resolveUserService();
+    return service.getUserPasswordHash(userId);
+}
+export async function getUserFromEmail(email) {
+    const service = await resolveUserService();
+    return service.getUserFromEmail(email);
+}

package/dist/users/user.repository.d.ts

@@ -0,0 +1,15 @@
+import type { User as UserEntity } from "../common";
+import type { CreateUserRecord, IUserRepository, UpdateUserRecord } from "./contracts";
+/**
+ * `IUserRepository` adapter backed by the `User` ActiveRecord model.
+ */
+export declare class ActiveRecordUserRepository implements IUserRepository {
+    create(record: CreateUserRecord): Promise<UserEntity>;
+    findById(id: string): Promise<UserEntity | null>;
+    findByEmail(email: string): Promise<UserEntity | null>;
+    findPasswordHash(id: string): Promise<string | null | undefined>;
+    findRecoveryCode(id: string): Promise<Uint8Array | null | undefined>;
+    update(id: string, changes: UpdateUserRecord): Promise<void>;
+    setRecoveryCode(id: string, encrypted: Uint8Array): Promise<void>;
+    setEmailVerifiedIfEmailMatches(id: string, email: string): Promise<boolean>;
+}

package/dist/users/user.repository.js

@@ -0,0 +1,55 @@
+import { User } from "../models/User";
+/**
+ * `IUserRepository` adapter backed by the `User` ActiveRecord model.
+ */
+export class ActiveRecordUserRepository {
+    async create(record) {
+        const user = await User.create({
+            email: record.email,
+            name: record.name,
+            password: record.password ?? null,
+            image: record.image ?? null,
+            emailVerifiedAt: record.emailVerifiedAt ?? null,
+            recovery_code: record.recoveryCode,
+        });
+        return user.toJSON();
+    }
+    async findById(id) {
+        const user = await User.find(id);
+        return user ? user.toJSON() : null;
+    }
+    async findByEmail(email) {
+        const user = await User.where("email", email).first();
+        return user ? user.toJSON() : null;
+    }
+    async findPasswordHash(id) {
+        const user = await User.find(id);
+        if (!user)
+            return undefined;
+        return user.password ?? null;
+    }
+    async findRecoveryCode(id) {
+        const user = await User.find(id);
+        if (!user)
+            return undefined;
+        return user.recovery_code ?? null;
+    }
+    async update(id, changes) {
+        if (Object.keys(changes).length === 0)
+            return;
+        await User.where("id", id).update(changes);
+    }
+    async setRecoveryCode(id, encrypted) {
+        const user = await User.find(id);
+        if (!user)
+            return;
+        user.setAttribute("recovery_code", Buffer.from(encrypted));
+        await user.save();
+    }
+    async setEmailVerifiedIfEmailMatches(id, email) {
+        const updated = await User.where({ id, email }).update({
+            emailVerifiedAt: new Date(),
+        });
+        return updated > 0;
+    }
+}

package/dist/users/user.service.d.ts

@@ -0,0 +1,68 @@
+import { type IPasswordHasher, type ISecretCipher, type ITokenGenerator } from "../crypto/contracts";
+import type { User } from "../common";
+import { type IRoleRepository } from "../rbac/contracts";
+import { type IUserRepository } from "./contracts";
+export declare class UserService {
+    private readonly users;
+    private readonly roles;
+    private readonly hasher;
+    private readonly tokens;
+    private readonly cipher;
+    constructor(users: IUserRepository, roles: IRoleRepository, hasher: IPasswordHasher, tokens: ITokenGenerator, cipher: ISecretCipher);
+    /**
+     * Validates the username input.
+     */
+    verifyUsernameInput(username: string): Promise<boolean>;
+    /**
+     * Creates a new user with an initial recovery code and default 'user' role.
+     */
+    createUser(email: string, username: string, password: string): Promise<User>;
+    /**
+     * Creates a new user from an OAuth provider.
+     */
+    createOAuthUser(email: string, name: string, image?: string): Promise<User>;
+    /**
+     * Returns a user by ID.
+     */
+    getUserById(userId: string): Promise<User | null>;
+    /**
+     * Decrypts and returns the user's recovery code.
+     */
+    getUserRecoverCode(userId: string): Promise<string>;
+    /**
+     * Generates and sets a new recovery code for the user.
+     */
+    resetUserRecoveryCode(userId: string): Promise<string>;
+    /**
+     * Updates the user's password.
+     */
+    updateUserPassword(userId: string, password: string): Promise<void>;
+    /**
+     * Updates the user's name.
+     */
+    updateUserName(userId: string, name: string): Promise<void>;
+    /**
+     * Updates the user's image.
+     */
+    updateUserAwatar(userId: string, image: string): Promise<void>;
+    /**
+     * Updates the user's email and marks it as verified.
+     */
+    updateUserEmailAndSetEmailAsVerified(userId: string, email: string): Promise<void>;
+    /**
+     * Sets the user as email verified if the provided email matches.
+     */
+    setUserAsEmailVerifiedIfEmailMatches(userId: string, email: string): Promise<boolean>;
+    /**
+     * Returns the user's password hash.
+     */
+    getUserPasswordHash(userId: string): Promise<string | null>;
+    /**
+     * Returns a user by email.
+     */
+    getUserFromEmail(email: string): Promise<User | null>;
+    /**
+     * Ensures the default 'user' role exists and assigns it.
+     */
+    private assignDefaultRole;
+}

package/dist/users/user.service.js

@@ -0,0 +1,183 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { AppError, Inject, Injectable } from "@veap/kernel";
+import { sendRecoveryCode } from "@veap/mail";
+import { PASSWORD_HASHER, SECRET_CIPHER, TOKEN_GENERATOR, } from "../crypto/contracts";
+import { ROLE_REPOSITORY } from "../rbac/contracts";
+import { USER_REPOSITORY } from "./contracts";
+const DEFAULT_ROLE = "user";
+let UserService = class UserService {
+    users;
+    roles;
+    hasher;
+    tokens;
+    cipher;
+    constructor(users, roles, hasher, tokens, cipher) {
+        this.users = users;
+        this.roles = roles;
+        this.hasher = hasher;
+        this.tokens = tokens;
+        this.cipher = cipher;
+    }
+    /**
+     * Validates the username input.
+     */
+    async verifyUsernameInput(username) {
+        return (username.length > 3 &&
+            username.length < 32 &&
+            username.trim() === username);
+    }
+    /**
+     * Creates a new user with an initial recovery code and default 'user' role.
+     */
+    async createUser(email, username, password) {
+        const passwordHash = await this.hasher.hash(password);
+        const recoveryCode = this.tokens.generateRecoveryCode();
+        const user = await this.users.create({
+            email,
+            name: username,
+            password: passwordHash,
+            recoveryCode: this.cipher.encrypt(recoveryCode),
+        });
+        await this.assignDefaultRole(user.id);
+        try {
+            await sendRecoveryCode(user.email, recoveryCode);
+        }
+        catch (error) {
+            console.warn(`[veap:auth] Failed to send recovery code email to ${user.email}:`, error?.message || error);
+        }
+        return user;
+    }
+    /**
+     * Creates a new user from an OAuth provider.
+     */
+    async createOAuthUser(email, name, image) {
+        const recoveryCode = this.tokens.generateRecoveryCode();
+        const user = await this.users.create({
+            email,
+            name,
+            image,
+            emailVerifiedAt: new Date(),
+            recoveryCode: this.cipher.encrypt(recoveryCode),
+        });
+        await this.assignDefaultRole(user.id);
+        return user;
+    }
+    /**
+     * Returns a user by ID.
+     */
+    async getUserById(userId) {
+        return await this.users.findById(userId);
+    }
+    /**
+     * Decrypts and returns the user's recovery code.
+     */
+    async getUserRecoverCode(userId) {
+        const stored = await this.users.findRecoveryCode(userId);
+        if (!stored) {
+            throw AppError.BadRequest("Recovery code not found for user");
+        }
+        return this.cipher.decryptToString(stored);
+    }
+    /**
+     * Generates and sets a new recovery code for the user.
+     */
+    async resetUserRecoveryCode(userId) {
+        const user = await this.users.findById(userId);
+        if (!user) {
+            throw AppError.BadRequest("User not found");
+        }
+        const recoveryCode = this.tokens.generateRecoveryCode();
+        await this.users.setRecoveryCode(userId, this.cipher.encrypt(recoveryCode));
+        try {
+            await sendRecoveryCode(user.email, recoveryCode);
+        }
+        catch (error) {
+            console.warn(`[veap:auth] Failed to send recovery code email to ${user.email}:`, error?.message || error);
+        }
+        return recoveryCode;
+    }
+    /**
+     * Updates the user's password.
+     */
+    async updateUserPassword(userId, password) {
+        const passwordHash = await this.hasher.hash(password);
+        await this.users.update(userId, { password: passwordHash });
+    }
+    /**
+     * Updates the user's name.
+     */
+    async updateUserName(userId, name) {
+        await this.users.update(userId, { name });
+    }
+    /**
+     * Updates the user's image.
+     */
+    async updateUserAwatar(userId, image) {
+        await this.users.update(userId, { image });
+    }
+    /**
+     * Updates the user's email and marks it as verified.
+     */
+    async updateUserEmailAndSetEmailAsVerified(userId, email) {
+        await this.users.update(userId, {
+            email,
+            emailVerifiedAt: new Date(),
+        });
+    }
+    /**
+     * Sets the user as email verified if the provided email matches.
+     */
+    async setUserAsEmailVerifiedIfEmailMatches(userId, email) {
+        return await this.users.setEmailVerifiedIfEmailMatches(userId, email);
+    }
+    /**
+     * Returns the user's password hash.
+     */
+    async getUserPasswordHash(userId) {
+        const hash = await this.users.findPasswordHash(userId);
+        if (hash === undefined) {
+            throw AppError.BadRequest("User not found");
+        }
+        return hash;
+    }
+    /**
+     * Returns a user by email.
+     */
+    async getUserFromEmail(email) {
+        return await this.users.findByEmail(email);
+    }
+    /**
+     * Ensures the default 'user' role exists and assigns it.
+     */
+    async assignDefaultRole(userId) {
+        let role = await this.roles.findByName(DEFAULT_ROLE);
+        if (!role) {
+            role = await this.roles.create({
+                name: DEFAULT_ROLE,
+                description: "Default user role",
+            });
+        }
+        await this.roles.assignToUser(userId, role.id);
+    }
+};
+UserService = __decorate([
+    Injectable(),
+    __param(0, Inject(USER_REPOSITORY)),
+    __param(1, Inject(ROLE_REPOSITORY)),
+    __param(2, Inject(PASSWORD_HASHER)),
+    __param(3, Inject(TOKEN_GENERATOR)),
+    __param(4, Inject(SECRET_CIPHER)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object])
+], UserService);
+export { UserService };