@veap/auth 0.0.0-stage → 0.1.1

package/dist/session/auth.service.js

@@ -0,0 +1,207 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { CACHE_PROVIDER, eventBus, Inject, Injectable, } from "@veap/kernel";
+import { authValidators, performFullUserAugmentation, } from "../common/logic.js";
+import { PASSWORD_HASHER } from "../crypto/contracts.js";
+import { UserService } from "../users/user.service.js";
+import { loginSchema, registerSchema } from "../validation/index.js";
+import { EmailVerificationService } from "../verification/verification.service.js";
+import { SessionService } from "./session.service.js";
+let AuthService = class AuthService {
+    userService;
+    sessionService;
+    emailVerificationService;
+    hasher;
+    cache;
+    failedAttempts = new Map();
+    constructor(userService, sessionService, emailVerificationService, hasher, cache) {
+        this.userService = userService;
+        this.sessionService = sessionService;
+        this.emailVerificationService = emailVerificationService;
+        this.hasher = hasher;
+        this.cache = cache;
+    }
+    async isRateLimited(key) {
+        if (this.cache) {
+            const attempts = await this.cache.get(`rl:${key}`);
+            return (attempts ?? 0) >= 5;
+        }
+        const record = this.failedAttempts.get(key);
+        if (!record)
+            return false;
+        if (Date.now() > record.expiresAt) {
+            this.failedAttempts.delete(key);
+            return false;
+        }
+        return record.count >= 5;
+    }
+    async recordFailedAttempt(key) {
+        if (this.cache) {
+            const attempts = (await this.cache.get(`rl:${key}`)) ?? 0;
+            await this.cache.set(`rl:${key}`, attempts + 1, 15 * 60);
+            return;
+        }
+        const record = this.failedAttempts.get(key);
+        if (!record || Date.now() > record.expiresAt) {
+            this.failedAttempts.set(key, {
+                count: 1,
+                expiresAt: Date.now() + 15 * 60 * 1000,
+            });
+        }
+        else {
+            record.count++;
+        }
+    }
+    async clearFailedAttempts(key) {
+        if (this.cache) {
+            await this.cache.delete(`rl:${key}`);
+            return;
+        }
+        this.failedAttempts.delete(key);
+    }
+    /**
+     * Sign In Logic
+     */
+    async signIn(data) {
+        const { email, password } = await loginSchema.parseAsync(data);
+        const normalizedEmail = email.toLowerCase().trim();
+        // Check rate limits for email and IP
+        const ip = await this.sessionService.getIPAddress();
+        const isEmailBlocked = await this.isRateLimited(`login:email:${normalizedEmail}`);
+        const isIpBlocked = ip ? await this.isRateLimited(`login:ip:${ip}`) : false;
+        if (isEmailBlocked || isIpBlocked) {
+            return {
+                status: "ERROR",
+                message: "Too many failed login attempts. Please try again in 15 minutes.",
+            };
+        }
+        const user = await this.userService.getUserFromEmail(normalizedEmail);
+        if (!user) {
+            // Prevent timing attacks by running a dummy hash verification
+            await this.hasher.verify("$2b$10$abcdefghijklmnopqrstuuabcdefghijklmnopqrstuuabcdefghijk", password);
+            await this.recordFailedAttempt(`login:email:${normalizedEmail}`);
+            if (ip)
+                await this.recordFailedAttempt(`login:ip:${ip}`);
+            return { status: "ERROR", message: "Invalid email or password" };
+        }
+        const passwordHash = await this.userService.getUserPasswordHash(user.id);
+        if (!passwordHash || !(await this.hasher.verify(passwordHash, password))) {
+            await this.recordFailedAttempt(`login:email:${normalizedEmail}`);
+            if (ip)
+                await this.recordFailedAttempt(`login:ip:${ip}`);
+            return { status: "ERROR", message: "Invalid email or password" };
+        }
+        // Login succeeded - clear failed attempts
+        await this.clearFailedAttempts(`login:email:${normalizedEmail}`);
+        if (ip)
+            await this.clearFailedAttempts(`login:ip:${ip}`);
+        // Interception Layer
+        for (const validator of authValidators) {
+            const interception = await validator(user.id);
+            if (interception)
+                return interception;
+        }
+        const sessionFlags = {};
+        const sessionToken = await this.sessionService.generateSessionToken();
+        const session = await this.sessionService.createSession(sessionToken, user.id, sessionFlags);
+        await this.sessionService.setSessionTokenCookie(sessionToken, session.expiresAt);
+        const fullUser = await performFullUserAugmentation(user);
+        await eventBus.publish("system:auth:login", {
+            session,
+            user: fullUser,
+        });
+        await eventBus.publish("system:auth:session-created", {
+            session,
+            user: fullUser,
+        });
+        return {
+            status: "SUCCESS",
+            session: { ...session },
+            user: { ...fullUser },
+        };
+    }
+    /**
+     * Sign Up Logic
+     */
+    async signUp(data) {
+        const { email, password, username } = await registerSchema.parseAsync(data);
+        const normalizedEmail = email.toLowerCase().trim();
+        const existingUser = await this.userService.getUserFromEmail(normalizedEmail);
+        if (existingUser) {
+            return {
+                status: "ERROR",
+                message: "Email address is already registered",
+            };
+        }
+        const user = await this.userService.createUser(normalizedEmail, username, password);
+        const sessionFlags = {};
+        const sessionToken = await this.sessionService.generateSessionToken();
+        const session = await this.sessionService.createSession(sessionToken, user.id, sessionFlags);
+        await this.sessionService.setSessionTokenCookie(sessionToken, session.expiresAt);
+        await this.emailVerificationService.createEmailVerificationRequest(user.id, user.email);
+        const fullUser = await performFullUserAugmentation(user);
+        await eventBus.publish("system:auth:register", {
+            session,
+            user: fullUser,
+        });
+        await eventBus.publish("system:auth:session-created", {
+            session,
+            user: fullUser,
+        });
+        return {
+            status: "SUCCESS",
+            session: { ...session },
+            user: { ...fullUser },
+        };
+    }
+    /**
+     * Finalize Login Logic (used by MFA/Interceptions)
+     */
+    async finalizeLogin(userId, flags = {}) {
+        const user = await this.userService.getUserById(userId);
+        if (!user) {
+            return { status: "ERROR", message: "User not found" };
+        }
+        const sessionToken = await this.sessionService.generateSessionToken();
+        const session = await this.sessionService.createSession(sessionToken, user.id, flags);
+        await this.sessionService.setSessionTokenCookie(sessionToken, session.expiresAt);
+        const fullUser = await performFullUserAugmentation(user);
+        await eventBus.publish("system:auth:session-created", {
+            session,
+            user: fullUser,
+        });
+        return {
+            status: "SUCCESS",
+            session: { ...session },
+            user: { ...fullUser },
+        };
+    }
+    /**
+     * Sign Out Logic
+     */
+    async signOut() {
+        await this.sessionService.sessionSignOut();
+    }
+};
+AuthService = __decorate([
+    Injectable(),
+    __param(0, Inject(UserService)),
+    __param(1, Inject(SessionService)),
+    __param(2, Inject(EmailVerificationService)),
+    __param(3, Inject(PASSWORD_HASHER)),
+    __param(4, Inject(CACHE_PROVIDER)),
+    __metadata("design:paramtypes", [UserService,
+        SessionService,
+        EmailVerificationService, Object, Object])
+], AuthService);
+export { AuthService };

package/dist/session/contracts.d.ts

@@ -0,0 +1,33 @@
+import type { AuthSession, FullUser, Session, SessionFlags, UserSession } from "../common/index.js";
+export type { AuthSession, FullUser, Session, SessionFlags, UserSession };
+/** A session together with its owner, as loaded by `findWithUser`. */
+export interface SessionWithUser {
+    session: Session;
+    user: Record<string, any>;
+}
+export interface CreateSessionRecord {
+    id: string;
+    userId: string;
+    expiresAt: Date;
+    metadata?: Record<string, any>;
+}
+/**
+ * Session persistence port.
+ */
+export interface ISessionRepository {
+    create(record: CreateSessionRecord): Promise<Session>;
+    /**
+     * Returns the session with its owner eager-loaded.
+     * Returns `null` when either the session or its owner is missing.
+     */
+    findWithUser(id: string): Promise<SessionWithUser | null>;
+    findById(id: string): Promise<Session | null>;
+    findByUserId(userId: string): Promise<Session[]>;
+    updateMetadata(id: string, metadata: Record<string, any>): Promise<void>;
+    remove(id: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
+    /** Removes every session of a user except `currentSessionId`. */
+    removeOtherUserSessions(userId: string, currentSessionId: string): Promise<void>;
+}
+/** Injection token for the session repository port. */
+export declare const SESSION_REPOSITORY: unique symbol;

package/dist/session/contracts.js

@@ -0,0 +1,2 @@
+/** Injection token for the session repository port. */
+export const SESSION_REPOSITORY = Symbol.for("veap:auth:session-repository");

package/dist/session/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./auth.service.js";
+export * from "./contracts.js";
+export * from "./session.facade.js";
+export * from "./session.repository.js";
+export * from "./session.service.js";

package/dist/session/index.js

@@ -0,0 +1,5 @@
+export * from "./auth.service.js";
+export * from "./contracts.js";
+export * from "./session.facade.js";
+export * from "./session.repository.js";
+export * from "./session.service.js";

package/dist/session/session.facade.d.ts

@@ -0,0 +1,14 @@
+import type { AuthSession, SessionFlags, Session as SessionType, UserSession } from "../common/index.js";
+export declare function getIPAddress(): Promise<string | null>;
+export declare function validateSessionToken(token: string): Promise<AuthSession>;
+export declare const getCurrentSession: () => Promise<AuthSession>;
+export declare function invalidateSession(sessionId: string): Promise<void>;
+export declare function invalidateUserSessions(userId: string): Promise<void>;
+export declare function setSessionTokenCookie(token: string, expiresAt: Date): Promise<void>;
+export declare function deleteSessionTokenCookie(): Promise<void>;
+export declare function generateSessionToken(): Promise<string>;
+export declare function createSession(token: string, userId: string, flags: SessionFlags): Promise<SessionType>;
+export declare function updateSessionMetadata(flags: SessionFlags): Promise<void>;
+export declare function sessionSignOut(): Promise<void>;
+export declare function getUserSessions(userId: string, currentSessionId: string): Promise<UserSession[]>;
+export declare function invalidateOtherSessions(userId: string, currentSessionId: string): Promise<void>;

package/dist/session/session.facade.js

@@ -0,0 +1,75 @@
+"use server";
+import { app } from "@veap/kernel";
+import { cache } from "react";
+import { authContext, isAuthContextBound } from "../common/context.js";
+import { SessionService } from "./session.service.js";
+async function resolveSessionService() {
+    const g = globalThis;
+    if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
+        try {
+            await g.__VEAP_BOOTSTRAPPING_PROMISE__;
+        }
+        catch { }
+    }
+    if (isAuthContextBound()) {
+        return authContext().session;
+    }
+    return await app(SessionService);
+}
+export async function getIPAddress() {
+    const service = await resolveSessionService();
+    return service.getIPAddress();
+}
+export async function validateSessionToken(token) {
+    const service = await resolveSessionService();
+    return service.validateSessionToken(token);
+}
+export const getCurrentSession = cache(async () => {
+    try {
+        const service = await resolveSessionService();
+        return await service.getCurrentSession();
+    }
+    catch {
+        return { session: null, user: null };
+    }
+});
+export async function invalidateSession(sessionId) {
+    const service = await resolveSessionService();
+    return service.invalidateSession(sessionId);
+}
+export async function invalidateUserSessions(userId) {
+    const service = await resolveSessionService();
+    return service.invalidateUserSessions(userId);
+}
+export async function setSessionTokenCookie(token, expiresAt) {
+    const service = await resolveSessionService();
+    return service.setSessionTokenCookie(token, expiresAt);
+}
+export async function deleteSessionTokenCookie() {
+    const service = await resolveSessionService();
+    return service.deleteSessionTokenCookie();
+}
+export async function generateSessionToken() {
+    const service = await resolveSessionService();
+    return service.generateSessionToken();
+}
+export async function createSession(token, userId, flags) {
+    const service = await resolveSessionService();
+    return service.createSession(token, userId, flags);
+}
+export async function updateSessionMetadata(flags) {
+    const service = await resolveSessionService();
+    return service.updateSessionMetadata(flags);
+}
+export async function sessionSignOut() {
+    const service = await resolveSessionService();
+    return service.sessionSignOut();
+}
+export async function getUserSessions(userId, currentSessionId) {
+    const service = await resolveSessionService();
+    return service.getUserSessions(userId, currentSessionId);
+}
+export async function invalidateOtherSessions(userId, currentSessionId) {
+    const service = await resolveSessionService();
+    return service.invalidateOtherSessions(userId, currentSessionId);
+}

package/dist/session/session.repository.d.ts

@@ -0,0 +1,15 @@
+import type { Session as SessionEntity } from "../common/index.js";
+import type { CreateSessionRecord, ISessionRepository, SessionWithUser } from "./contracts.js";
+/**
+ * `ISessionRepository` adapter backed by the `Session` ActiveRecord model.
+ */
+export declare class ActiveRecordSessionRepository implements ISessionRepository {
+    create(record: CreateSessionRecord): Promise<SessionEntity>;
+    findWithUser(id: string): Promise<SessionWithUser | null>;
+    findById(id: string): Promise<SessionEntity | null>;
+    findByUserId(userId: string): Promise<SessionEntity[]>;
+    updateMetadata(id: string, metadata: Record<string, any>): Promise<void>;
+    remove(id: string): Promise<void>;
+    removeByUserId(userId: string): Promise<void>;
+    removeOtherUserSessions(userId: string, currentSessionId: string): Promise<void>;
+}

package/dist/session/session.repository.js

@@ -0,0 +1,55 @@
+import { Session } from "../models/Session.js";
+/**
+ * `ISessionRepository` adapter backed by the `Session` ActiveRecord model.
+ */
+export class ActiveRecordSessionRepository {
+    async create(record) {
+        const session = await Session.create({
+            id: record.id,
+            expiresAt: record.expiresAt,
+            userId: record.userId,
+            metadata: record.metadata ?? {},
+        });
+        return session.toJSON();
+    }
+    async findWithUser(id) {
+        const session = await Session.query().with("user").find(id);
+        if (!session)
+            return null;
+        const user = session.getRelation("user") || session.user;
+        if (!user)
+            return null;
+        return {
+            session: session.toJSON(),
+            user: (typeof user.toJSON === "function"
+                ? user.toJSON()
+                : user),
+        };
+    }
+    async findById(id) {
+        const session = await Session.find(id);
+        return session ? session.toJSON() : null;
+    }
+    async findByUserId(userId) {
+        const sessions = await Session.where("user_id", userId).get();
+        return sessions.map((session) => session.toJSON());
+    }
+    async updateMetadata(id, metadata) {
+        await Session.where("id", id).update({
+            metadata,
+            updatedAt: new Date(),
+        });
+    }
+    async remove(id) {
+        await Session.destroy(id);
+    }
+    async removeByUserId(userId) {
+        await Session.where("user_id", userId).delete();
+    }
+    async removeOtherUserSessions(userId, currentSessionId) {
+        await Session.where("user_id", userId)
+            .toKnex()
+            .where("id", "!=", currentSessionId)
+            .delete();
+    }
+}

package/dist/session/session.service.d.ts

@@ -0,0 +1,63 @@
+import { type ICookieStore, type IHttpRequestContext } from "@veap/kernel";
+import type { AuthSession, SessionFlags, Session as SessionType, UserSession } from "../common/index.js";
+import { type ITokenGenerator } from "../crypto/contracts.js";
+import { type ISessionRepository } from "./contracts.js";
+export declare class SessionService {
+    private readonly sessions;
+    private readonly tokens;
+    private readonly cookieStore;
+    private readonly requestContext;
+    constructor(sessions: ISessionRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, requestContext: IHttpRequestContext);
+    /**
+     * Returns the user's validated IP address, checking trusted proxy headers first.
+     */
+    getIPAddress(): Promise<string | null>;
+    /**
+     * Validates the session token.
+     */
+    validateSessionToken(token: string): Promise<AuthSession>;
+    /**
+     * Returns the current user session from cookies.
+     */
+    getCurrentSession(): Promise<AuthSession>;
+    /**
+     * Invalidates a single session.
+     */
+    invalidateSession(sessionId: string): Promise<void>;
+    /**
+     * Invalidates all user sessions.
+     */
+    invalidateUserSessions(userId: string): Promise<void>;
+    /**
+     * Sets the session token in a cookie.
+     */
+    setSessionTokenCookie(token: string, expiresAt: Date): Promise<void>;
+    /**
+     * Removes the session token cookie.
+     */
+    deleteSessionTokenCookie(): Promise<void>;
+    /**
+     * Generates a new random session token.
+     */
+    generateSessionToken(): Promise<string>;
+    /**
+     * Creates a new session in the database.
+     */
+    createSession(token: string, userId: string, flags: SessionFlags): Promise<SessionType>;
+    /**
+     * Updates the current session metadata.
+     */
+    updateSessionMetadata(flags: SessionFlags): Promise<void>;
+    /**
+     * Signs the user out and redirects to the sign-in page.
+     */
+    sessionSignOut(): Promise<void>;
+    /**
+     * Get all active sessions for a user.
+     */
+    getUserSessions(userId: string, currentSessionId: string): Promise<UserSession[]>;
+    /**
+     * Invalidate all sessions for a user except the specified current one.
+     */
+    invalidateOtherSessions(userId: string, currentSessionId: string): Promise<void>;
+}