@wasp.sh/wasp-cli-darwin-x64-unknown 0.20.0

package/data/Generator/templates/server/src/auth/providers/config/keycloak.ts

@@ -0,0 +1,67 @@
+{{={= =}=}}
+
+import type { ProviderConfig } from "wasp/auth/providers/types";
+import { keycloak } from "wasp/server/auth";
+import { env } from "wasp/server";
+import { mergeDefaultAndUserConfig } from "../oauth/config.js";
+import { createOAuthProviderRouter } from "../oauth/handler.js";
+
+{=# userSignupFields.isDefined =}
+{=& userSignupFields.importStatement =}
+const _waspUserSignupFields = {= userSignupFields.importIdentifier =}
+{=/ userSignupFields.isDefined =}
+{=^ userSignupFields.isDefined =}
+const _waspUserSignupFields = undefined
+{=/ userSignupFields.isDefined =}
+{=# configFn.isDefined =}
+{=& configFn.importStatement =}
+const _waspUserDefinedConfigFn = {= configFn.importIdentifier =}
+{=/ configFn.isDefined =}
+{=^ configFn.isDefined =}
+const _waspUserDefinedConfigFn = undefined
+{=/ configFn.isDefined =}
+
+const _waspConfig: ProviderConfig = {
+    id: keycloak.id,
+    displayName: keycloak.displayName,
+    createRouter(provider) {
+        const config = mergeDefaultAndUserConfig({
+            scopes: {=& requiredScopes =},
+        }, _waspUserDefinedConfigFn);
+
+        async function getKeycloakProfile(accessToken: string): Promise<{
+            providerProfile: unknown;
+            providerUserId: string;
+        }> {
+            const userInfoEndpoint = `${env.KEYCLOAK_REALM_URL}/protocol/openid-connect/userinfo`;
+            const response = await fetch(
+                userInfoEndpoint,
+                {
+                    headers: {
+                        Authorization: `Bearer ${accessToken}`,
+                    },
+                }
+            );
+            const providerProfile = (await response.json()) as {
+                sub?: string;
+            };
+        
+            if (!providerProfile.sub) {
+                throw new Error("Invalid profile");
+            }
+
+            return { providerProfile, providerUserId: providerProfile.sub };
+        }
+
+        return createOAuthProviderRouter({
+            provider,
+            oAuthType: 'OAuth2WithPKCE',
+            userSignupFields: _waspUserSignupFields,
+            getAuthorizationUrl: ({ state, codeVerifier }) => keycloak.oAuthClient.createAuthorizationURL(state, codeVerifier, config),
+            getProviderTokens: ({ code, codeVerifier }) => keycloak.oAuthClient.validateAuthorizationCode(code, codeVerifier),
+            getProviderInfo: ({ accessToken }) => getKeycloakProfile(accessToken),
+        });
+    },
+}
+
+export default _waspConfig;

package/data/Generator/templates/server/src/auth/providers/config/slack.ts

@@ -0,0 +1,65 @@
+{{={= =}=}}
+import type { ProviderConfig } from "wasp/auth/providers/types";
+import { slack } from "wasp/server/auth";
+import { mergeDefaultAndUserConfig } from "../oauth/config.js";
+import { createOAuthProviderRouter } from "../oauth/handler.js";
+
+{=# userSignupFields.isDefined =}
+{=& userSignupFields.importStatement =}
+const _waspUserSignupFields = {= userSignupFields.importIdentifier =}
+{=/ userSignupFields.isDefined =}
+{=^ userSignupFields.isDefined =}
+const _waspUserSignupFields = undefined
+{=/ userSignupFields.isDefined =}
+{=# configFn.isDefined =}
+{=& configFn.importStatement =}
+const _waspUserDefinedConfigFn = {= configFn.importIdentifier =}
+{=/ configFn.isDefined =}
+{=^ configFn.isDefined =}
+const _waspUserDefinedConfigFn = undefined
+{=/ configFn.isDefined =}
+
+const _waspConfig: ProviderConfig = {
+    id: slack.id,
+    displayName: slack.displayName,
+    createRouter(provider) {
+        const config = mergeDefaultAndUserConfig({
+            scopes: {=& requiredScopes =},
+        }, _waspUserDefinedConfigFn);
+
+        async function getSlackProfile(accessToken: string): Promise<{
+            providerProfile: unknown;
+            providerUserId: string;
+        }> {
+            const response = await fetch("https://slack.com/api/openid.connect.userInfo", {
+                headers: {
+                  Authorization: `Bearer ${accessToken}`,
+                },
+              });
+
+              const providerProfile = (await response.json()) as {
+                sub?: string;
+                email?: string;
+                name?: string;
+                picture?: string;
+            };
+            
+            if (!providerProfile.sub) {
+                throw new Error("Invalid profile");
+             }
+ 
+             return { providerProfile, providerUserId: providerProfile.sub };
+        }
+
+        return createOAuthProviderRouter({
+            provider,
+            oAuthType: 'OAuth2',
+            userSignupFields: _waspUserSignupFields,
+            getAuthorizationUrl: ({ state }) => slack.oAuthClient.createAuthorizationURL(state, config),
+            getProviderTokens: ({ code }) => slack.oAuthClient.validateAuthorizationCode(code),
+            getProviderInfo: ({ accessToken }) => getSlackProfile(accessToken),
+        });
+    },
+}
+
+export default _waspConfig;

package/data/Generator/templates/server/src/auth/providers/config/username.ts

@@ -0,0 +1,33 @@
+{{={= =}=}}
+
+import { Router } from "express";
+
+import login from "../username/login.js";
+import { getSignupRoute } from "../username/signup.js";
+import { ProviderConfig } from "wasp/auth/providers/types";
+
+{=# userSignupFields.isDefined =}
+{=& userSignupFields.importStatement =}
+const _waspUserSignupFields = {= userSignupFields.importIdentifier =}
+{=/ userSignupFields.isDefined =}
+{=^ userSignupFields.isDefined =}
+const _waspUserSignupFields = undefined
+{=/ userSignupFields.isDefined =}
+
+const config: ProviderConfig = {
+    id: "{= providerId =}",
+    displayName: "{= displayName =}",
+    createRouter() {
+        const router = Router();
+
+        router.post('/login', login);
+        const signupRoute = getSignupRoute({
+            userSignupFields: _waspUserSignupFields,
+        });
+        router.post('/signup', signupRoute);
+
+        return router;
+    },
+}
+
+export default config;

package/data/Generator/templates/server/src/auth/providers/email/login.ts

@@ -0,0 +1,66 @@
+import { Request, Response } from 'express';
+import { createInvalidCredentialsError } from 'wasp/auth/utils'
+import { verifyPassword } from 'wasp/auth/password'
+import {
+    createProviderId,
+    findAuthIdentity,
+    findAuthWithUserBy,
+    getProviderDataWithPassword,
+} from 'wasp/auth/utils'
+import { createSession } from 'wasp/auth/session'
+import { ensureValidEmail, ensurePasswordIsPresent } from 'wasp/auth/validation'
+import { onBeforeLoginHook, onAfterLoginHook } from '../../hooks.js';
+
+export function getLoginRoute() {
+    return async function login(
+        req: Request<{ email: string; password: string; }>,
+        res: Response,
+    ): Promise<void> {
+        const fields = req.body ?? {}
+        ensureValidArgs(fields)
+
+        const providerId = createProviderId("email", fields.email)
+        const authIdentity = await findAuthIdentity(providerId)
+        if (!authIdentity) {
+            throw createInvalidCredentialsError()
+        }
+        const providerData = getProviderDataWithPassword<'email'>(authIdentity.providerData)
+        if (!providerData.isEmailVerified) {
+            throw createInvalidCredentialsError()
+        }
+        try {
+            await verifyPassword(providerData.hashedPassword, fields.password);
+        } catch(e) {
+            throw createInvalidCredentialsError()
+        }
+    
+        const auth = await findAuthWithUserBy({ id: authIdentity.authId })
+
+        if (auth === null) {
+            throw createInvalidCredentialsError()
+        }
+        
+        await onBeforeLoginHook({
+            req,
+            providerId,
+            user: auth.user,
+        })
+        
+        const session = await createSession(auth.id)
+
+        await onAfterLoginHook({
+            req,
+            providerId,
+            user: auth.user,
+        })
+      
+        res.json({
+            sessionId: session.id,
+        })
+    };
+}
+
+function ensureValidArgs(args: object): void {
+    ensureValidEmail(args);
+    ensurePasswordIsPresent(args);
+}

package/data/Generator/templates/server/src/auth/providers/email/requestPasswordReset.ts

@@ -0,0 +1,74 @@
+import { Request, Response } from 'express';
+import {
+    createProviderId,
+    findAuthIdentity,
+    doFakeWork,
+    getProviderDataWithPassword,
+} from 'wasp/auth/utils';
+import {
+    createPasswordResetLink,
+    sendPasswordResetEmail,
+    isEmailResendAllowed,
+} from "wasp/server/auth/email/utils";
+import { ensureValidEmail } from 'wasp/auth/validation';
+import type { EmailFromField } from 'wasp/server/email/core/types';
+import { GetPasswordResetEmailContentFn } from 'wasp/server/auth/email';
+import { HttpError } from 'wasp/server';
+
+export function getRequestPasswordResetRoute({
+   fromField,
+   clientRoute,
+   getPasswordResetEmailContent,
+}: {
+    fromField: EmailFromField;
+    clientRoute: string;
+    getPasswordResetEmailContent: GetPasswordResetEmailContentFn;
+}) {
+    return async function requestPasswordReset(
+        req: Request<{ email: string; }>,
+        res: Response,
+    ): Promise<void> {
+        const args = req.body ?? {};
+        ensureValidEmail(args);
+
+        const authIdentity = await findAuthIdentity(
+            createProviderId("email", args.email),
+        );
+
+        /**
+         * By doing fake work, we make it harder to enumerate users by measuring
+         * the time it takes to respond. If we would respond immediately, an attacker
+         * could measure the time it takes to respond and figure out if the user exists.
+         */
+
+        if (!authIdentity) {
+            await doFakeWork();
+            res.json({ success: true });
+            return
+        }
+
+        const providerData = getProviderDataWithPassword<'email'>(authIdentity.providerData);
+        const { isResendAllowed, timeLeft } = isEmailResendAllowed(providerData, 'passwordResetSentAt');
+        if (!isResendAllowed) {
+            throw new HttpError(400, `Please wait ${timeLeft} secs before trying again.`);
+        }
+
+        const passwordResetLink = await createPasswordResetLink(args.email, clientRoute);
+        try {
+            const email = authIdentity.providerUserId
+            await sendPasswordResetEmail(
+                email,
+                {
+                    from: fromField,
+                    to: email,
+                    ...getPasswordResetEmailContent({ passwordResetLink }),
+                },
+            );
+        } catch (e: any) {
+            console.error("Failed to send password reset email:", e);
+            throw new HttpError(500, "Failed to send password reset email.");
+        }
+    
+        res.json({ success: true });
+    };
+}

package/data/Generator/templates/server/src/auth/providers/email/resetPassword.ts

@@ -0,0 +1,48 @@
+import { Request, Response } from 'express';
+import {
+    createProviderId,
+    findAuthIdentity,
+    updateAuthIdentityProviderData,
+    getProviderDataWithPassword,
+} from 'wasp/auth/utils';
+import { validateJWT } from 'wasp/auth/jwt'
+import { ensureTokenIsPresent, ensurePasswordIsPresent, ensureValidPassword } from 'wasp/auth/validation';
+import { HttpError } from 'wasp/server';
+
+export async function resetPassword(
+    req: Request<{ token: string; password: string; }>,
+    res: Response,
+): Promise<void> {
+    const args = req.body ?? {};
+    ensureValidArgs(args);
+
+    const { token, password } = args;
+    const { email } = await validateJWT<{ email: string }>(token)
+        .catch(() => {
+            throw new HttpError(400, "Password reset failed, invalid token");
+        });
+
+    const providerId = createProviderId('email', email);
+    const authIdentity = await findAuthIdentity(providerId);
+    if (!authIdentity) {
+        throw new HttpError(400, "Password reset failed, invalid token");
+    }
+
+    const providerData = getProviderDataWithPassword<'email'>(authIdentity.providerData);
+
+    await updateAuthIdentityProviderData(providerId, providerData, {
+        // The act of resetting the password verifies the email
+        isEmailVerified: true,
+        // The password will be hashed when saving the providerData
+        // in the DB
+        hashedPassword: password,
+    });
+
+    res.json({ success: true });
+};
+
+function ensureValidArgs(args: object): void {
+    ensureTokenIsPresent(args);
+    ensurePasswordIsPresent(args);
+    ensureValidPassword(args);
+}

package/data/Generator/templates/server/src/auth/providers/email/signup.ts

@@ -0,0 +1,165 @@
+import { Request, Response } from 'express'
+import type { UserSignupFields } from 'wasp/auth/providers/types'
+import {
+  createProviderId,
+  createUser,
+  deleteUserByAuthId,
+  doFakeWork,
+  findAuthIdentity,
+  getProviderDataWithPassword,
+  rethrowPossibleAuthError,
+  sanitizeAndSerializeProviderData,
+  validateAndGetUserFields,
+} from 'wasp/auth/utils'
+import {
+  ensurePasswordIsPresent,
+  ensureValidEmail,
+  ensureValidPassword,
+} from 'wasp/auth/validation'
+import { HttpError } from 'wasp/server'
+import { GetVerificationEmailContentFn } from 'wasp/server/auth/email'
+import {
+  createEmailVerificationLink,
+  isEmailResendAllowed,
+  sendEmailVerificationEmail,
+} from 'wasp/server/auth/email/utils'
+import { EmailFromField } from 'wasp/server/email/core/types'
+import { onAfterSignupHook, onBeforeSignupHook } from '../../hooks.js'
+
+export function getSignupRoute({
+  userSignupFields,
+  fromField,
+  clientRoute,
+  getVerificationEmailContent,
+  isEmailAutoVerified,
+}: {
+  userSignupFields?: UserSignupFields
+  fromField: EmailFromField
+  clientRoute: string
+  getVerificationEmailContent: GetVerificationEmailContentFn
+  isEmailAutoVerified: boolean
+}) {
+  return async function signup(
+    req: Request<{ email: string; password: string }>,
+    res: Response,
+  ): Promise<void> {
+    const fields = req.body
+    ensureValidArgs(fields)
+
+    const providerId = createProviderId('email', fields.email)
+    const existingAuthIdentity = await findAuthIdentity(providerId)
+
+    /**
+     *
+     * There are two cases to consider in the case of an existing user:
+     * - if we allow unverified login
+     * - if the user is already verified
+     *
+     * Let's see what happens when we **don't** allow unverified login:
+     *
+     * We are handling the case of an existing auth identity in two ways:
+     *
+     * 1. If the user already exists and is verified, we don't want
+     *   to leak that piece of info and instead we pretend that the user
+     *   was created successfully.
+     *    - This prevents the attacker from learning which emails already have
+     *        an account created.
+     *
+     * 2. If the user is not verified:
+     *   - We check when we last sent a verification email and if it was less than X seconds ago,
+     *     we don't send another one.
+     *   - If it was more than X seconds ago, we delete the user and create a new one.
+     *   - This prevents the attacker from creating an account with somebody
+     *     else's email address and therefore permanently making that email
+     *     address unavailable for later account creation (by real owner).
+     */
+    if (existingAuthIdentity) {
+      const providerData = getProviderDataWithPassword<'email'>(
+        existingAuthIdentity.providerData,
+      )
+
+      // TOOD: faking work makes sense if the time spent on faking the work matches the time
+      // it would take to send the email. Atm, the fake work takes obviously longer than sending
+      // the email!
+      if (providerData.isEmailVerified) {
+        await doFakeWork()
+        res.json({ success: true })
+        return
+      }
+
+      // TODO: we are still leaking information here since when we are faking work
+      // we are not checking if the email was sent or not!
+      const { isResendAllowed, timeLeft } = isEmailResendAllowed(
+        providerData,
+        'passwordResetSentAt',
+      )
+      if (!isResendAllowed) {
+        throw new HttpError(
+          400,
+          `Please wait ${timeLeft} secs before trying again.`,
+        )
+      }
+
+      try {
+        await deleteUserByAuthId(existingAuthIdentity.authId)
+      } catch (e: unknown) {
+        rethrowPossibleAuthError(e)
+      }
+    }
+
+    const userFields = await validateAndGetUserFields(fields, userSignupFields)
+
+    const newUserProviderData = await sanitizeAndSerializeProviderData<'email'>(
+      {
+        hashedPassword: fields.password,
+        isEmailVerified: isEmailAutoVerified ? true : false,
+        emailVerificationSentAt: null,
+        passwordResetSentAt: null,
+      },
+    )
+
+    try {
+      await onBeforeSignupHook({ req, providerId })
+      const user = await createUser(
+        providerId,
+        newUserProviderData,
+        // Using any here because we want to avoid TypeScript errors and
+        // rely on Prisma to validate the data.
+        userFields as any,
+      )
+      await onAfterSignupHook({ req, providerId, user })
+    } catch (e: unknown) {
+      rethrowPossibleAuthError(e)
+    }
+
+    // Wasp allows for auto-verification of emails in development mode to
+    // make writing e2e tests easier.
+    if (isEmailAutoVerified) {
+      res.json({ success: true })
+      return
+    }
+
+    const verificationLink = await createEmailVerificationLink(
+      fields.email,
+      clientRoute,
+    )
+    try {
+      await sendEmailVerificationEmail(fields.email, {
+        from: fromField,
+        to: fields.email,
+        ...getVerificationEmailContent({ verificationLink }),
+      })
+    } catch (e: unknown) {
+      console.error('Failed to send email verification email:', e)
+      throw new HttpError(500, 'Failed to send email verification email.')
+    }
+
+    res.json({ success: true })
+  }
+}
+
+function ensureValidArgs(args: object): void {
+  ensureValidEmail(args)
+  ensurePasswordIsPresent(args)
+  ensureValidPassword(args)
+}

package/data/Generator/templates/server/src/auth/providers/email/verifyEmail.ts

@@ -0,0 +1,42 @@
+import { Request, Response } from 'express';
+import { validateJWT } from 'wasp/auth/jwt';
+import {
+  createProviderId,
+  findAuthIdentity,
+  findAuthWithUserBy,
+  getProviderDataWithPassword,
+  updateAuthIdentityProviderData,
+} from 'wasp/auth/utils';
+import { HttpError } from 'wasp/server';
+import { onAfterEmailVerifiedHook } from '../../hooks.js';
+
+
+export async function verifyEmail(
+    req: Request<{ token: string }>,
+    res: Response,
+): Promise<void> {
+    const { token } = req.body;
+    const { email } = await validateJWT<{ email: string }>(token)
+        .catch(() => {
+            throw new HttpError(400, "Email verification failed, invalid token");
+        });
+
+    const providerId = createProviderId('email', email);
+    const authIdentity = await findAuthIdentity(providerId);
+    if (!authIdentity) {
+        throw new HttpError(400, "Email verification failed, invalid token");
+    }
+
+    const providerData = getProviderDataWithPassword<'email'>(authIdentity.providerData);
+
+    await updateAuthIdentityProviderData(providerId, providerData, {
+        isEmailVerified: true,
+    });
+
+    const auth = await findAuthWithUserBy({ id: authIdentity.authId })
+
+    await onAfterEmailVerifiedHook({ req, email, user: auth.user });
+
+    res.json({ success: true });
+};
+

package/data/Generator/templates/server/src/auth/providers/index.ts

@@ -0,0 +1,32 @@
+{{={= =}=}}
+import { Router } from "express";
+{=# isExternalAuthEnabled =}
+import { setupOneTimeCodeRoute } from "./oauth/oneTimeCode";
+{=/ isExternalAuthEnabled =}
+
+{=# providers =}
+{=& importStatement =}
+{=/ providers =}
+
+const providers = [
+  {=# providers =}
+  {= importIdentifier =},
+  {=/ providers =}
+];
+
+const router = Router();
+
+{=# isExternalAuthEnabled =}
+// Setting up a common route for all OAuth providers to exchange
+// one-time code for a session.
+setupOneTimeCodeRoute(router);
+{=/ isExternalAuthEnabled =}
+
+for (const provider of providers) {
+  const { createRouter } = provider;
+  const providerRouter = createRouter(provider);
+  router.use(`/${provider.id}`, providerRouter);
+  console.log(`🚀 "${provider.displayName}" auth initialized`);
+}
+
+export default router;

package/data/Generator/templates/server/src/auth/providers/oauth/config.ts

@@ -0,0 +1,19 @@
+export function mergeDefaultAndUserConfig<DefaultConfig extends object, UserConfig extends object>(
+  defaultConfig: DefaultConfig,
+  userConfigFn: () => UserConfig,
+): DefaultConfig & UserConfig;
+export function mergeDefaultAndUserConfig<DefaultConfig extends object, UserConfig extends object>(
+  defaultConfig: DefaultConfig
+): DefaultConfig;
+export function mergeDefaultAndUserConfig<DefaultConfig extends object, UserConfig extends object>(
+  defaultConfig: DefaultConfig,
+  userConfigFn?: () => UserConfig,
+): DefaultConfig {
+    if (!userConfigFn) {
+        return defaultConfig;
+    }
+    return {
+      ...defaultConfig,
+      ...userConfigFn(),
+    }
+}

package/data/Generator/templates/server/src/auth/providers/oauth/cookies.ts

@@ -0,0 +1,35 @@
+import {
+  Request as ExpressRequest,
+  Response as ExpressResponse,
+} from 'express';
+import { parseCookies } from 'oslo/cookie';
+
+import type { ProviderConfig } from 'wasp/auth/providers/types';
+import { config } from 'wasp/server';
+
+import type { OAuthStateFieldName } from './state';
+
+export function setOAuthCookieValue(
+  provider: ProviderConfig,
+  res: ExpressResponse,
+  fieldName: OAuthStateFieldName,
+  value: string,
+): void {
+  const cookieName = `${provider.id}_${fieldName}`;
+  res.cookie(cookieName, value, {
+    httpOnly: true,
+    secure: !config.isDevelopment,
+    path: "/",
+    maxAge: 60 * 60 * 1000, // 1 hour
+  });
+}
+
+export function getOAuthCookieValue(
+  provider: ProviderConfig,
+  req: ExpressRequest,
+  fieldName: OAuthStateFieldName,
+): string {
+  const cookieName = `${provider.id}_${fieldName}`;
+  const cookies = parseCookies(req.headers.cookie ?? "");
+  return cookies.get(cookieName);
+}