@wasp.sh/wasp-cli-darwin-x64-unknown 0.20.0

package/data/Generator/templates/server/src/auth/providers/oauth/handler.ts

@@ -0,0 +1,130 @@
+import { Router } from 'express'
+
+import { defineHandler, redirect } from 'wasp/server/utils'
+import { rethrowPossibleAuthError } from 'wasp/auth/utils'
+import {
+  type UserSignupFields,
+  type ProviderConfig,
+} from 'wasp/auth/providers/types'
+import {
+  type OAuthType,
+  type OAuthStateFor,
+  type OAuthStateWithCodeFor,
+  generateAndStoreOAuthState,
+  validateAndGetOAuthState,
+} from '../oauth/state.js'
+import { finishOAuthFlowAndGetRedirectUri } from '../oauth/user.js'
+import {
+  callbackPath,
+  loginPath,
+  handleOAuthErrorAndGetRedirectUri,
+} from 'wasp/server/auth'
+import { OAuthData } from 'wasp/server/auth'
+import { onBeforeOAuthRedirectHook } from '../../hooks.js'
+
+export function createOAuthProviderRouter<OT extends OAuthType, Tokens extends OAuthData['tokens'] = never>({
+  provider,
+  oAuthType,
+  userSignupFields,
+  getAuthorizationUrl,
+  getProviderTokens,
+  getProviderInfo,
+}: {
+  provider: ProviderConfig
+  /*
+    - OAuth state is used to validate the callback to ensure the user
+      that requested the login is the same that is completing it.
+    - It includes "state" and an optional "codeVerifier" for PKCE.
+  */
+  oAuthType: OT
+  userSignupFields: UserSignupFields | undefined
+  /*
+    The function that returns the URL to redirect the user to the
+    provider's login page.
+  */
+  getAuthorizationUrl: (
+    oAuthState: OAuthStateFor<OT>,
+  ) => Promise<URL>
+  /*
+    The function that returns the access token and refresh token from the
+    provider's callback.
+  */
+  getProviderTokens: (
+    oAuthState: OAuthStateWithCodeFor<OT>,
+  ) => Promise<Tokens>
+  /*
+    The function that returns the user's profile and ID using the access
+    token.
+  */
+  getProviderInfo: (tokens: Tokens) => Promise<{
+    providerUserId: string
+    providerProfile: unknown
+  }>
+}): Router {
+  const router = Router()
+
+  router.get(
+    `/${loginPath}`,
+    defineHandler(async (req, res) => {
+      const oAuthState = generateAndStoreOAuthState({
+        oAuthType,
+        provider,
+        res,
+      })
+      const redirectUrl = await getAuthorizationUrl(oAuthState)
+      const { url: redirectUrlAfterHook } = await onBeforeOAuthRedirectHook({
+        req,
+        url: redirectUrl,
+        oauth: { uniqueRequestId: oAuthState.state }
+      })
+      redirect(res, redirectUrlAfterHook.toString())
+    }),
+  )
+
+  router.get(
+    `/${callbackPath}`,
+    defineHandler(async (req, res) => {
+      try {
+        const oAuthState = validateAndGetOAuthState({
+          oAuthType,
+          provider,
+          req,
+        })
+        const tokens = await getProviderTokens(oAuthState)
+
+        const { providerProfile, providerUserId } = await getProviderInfo(tokens)
+        try {
+          const redirectUri = await finishOAuthFlowAndGetRedirectUri({
+            provider,
+            providerProfile,
+            providerUserId,
+            userSignupFields,
+            req,
+            oauth: {
+              uniqueRequestId: oAuthState.state,
+              // OAuth params are built as a discriminated union
+              // of provider names and their respective tokens.
+              // We are using a generic ProviderConfig and tokens type
+              // is inferred from the getProviderTokens function.
+              // Instead of building complex TS machinery to ensure that
+              // the providerName and tokens match, we are using any here.
+              providerName: provider.id as any,
+              tokens,
+            },
+          })
+          // Redirect to the client with the one time code
+          redirect(res, redirectUri.toString())
+        } catch (e) {
+          rethrowPossibleAuthError(e)
+        }
+      } catch (e) {
+        console.error(e)
+        const redirectUri = handleOAuthErrorAndGetRedirectUri(e)
+        // Redirect to the client with the error
+        redirect(res, redirectUri.toString())
+      }
+    }),
+  )
+
+  return router
+}

package/data/Generator/templates/server/src/auth/providers/oauth/oneTimeCode.ts

@@ -0,0 +1,39 @@
+import { Router } from "express";
+
+import { HttpError } from 'wasp/server';
+import { defineHandler } from 'wasp/server/utils';
+import { findAuthWithUserBy } from 'wasp/auth/utils'
+import { createSession } from 'wasp/auth/session'
+import { exchangeCodeForTokenPath, tokenStore } from "wasp/server/auth";
+
+export function setupOneTimeCodeRoute(router: Router) {
+  router.post(
+    `/${exchangeCodeForTokenPath}`,
+    defineHandler(async (req, res) => {
+      const { code } = req.body;
+
+      if (code === undefined) {
+        throw new HttpError(400, "Unable to login with the OAuth provider. The code is missing.");
+      }
+
+      if (tokenStore.isUsed(code)) {
+        throw new HttpError(400, "Unable to login with the OAuth provider. The code has already been used.");
+      }
+
+      const { id: authId } = await tokenStore.verifyToken(code);
+      const auth = await findAuthWithUserBy({ id: authId })
+
+      if (auth === null) {
+        throw new HttpError(400, "Unable to login with the OAuth provider. The code is invalid.");
+      }
+
+      const session = await createSession(auth.id);
+
+      tokenStore.markUsed(code);
+
+      res.json({
+        sessionId: session.id,
+      });
+    })
+  );
+}

package/data/Generator/templates/server/src/auth/providers/oauth/state.ts

@@ -0,0 +1,144 @@
+import {
+  Response as ExpressResponse,
+  Request as ExpressRequest,
+} from 'express';
+import * as arctic from 'arctic';
+
+import type { ProviderConfig } from 'wasp/auth/providers/types';
+
+import { setOAuthCookieValue, getOAuthCookieValue } from './cookies.js';
+
+export type OAuthStateFor<
+  OT extends OAuthType
+> = OAuthStateForOAuthType[OT];
+
+export type OAuthStateWithCodeFor<OT extends OAuthType> = OAuthStateFor<OT> & OAuthCode
+
+export type OAuthType = keyof OAuthStateForOAuthType;
+
+export type OAuthStateFieldName = keyof OAuthState | keyof OAuthStateWithPKCE;
+
+type OAuthStateForOAuthType = {
+  OAuth2: OAuthState,
+  OAuth2WithPKCE: OAuthStateWithPKCE,
+};
+
+type OAuthState = {
+  state: string;
+};
+
+type OAuthStateWithPKCE = {
+  state: string;
+  codeVerifier: string;
+};
+
+/**
+ * When the OAuth flow is completed, the OAuth provider will redirect the user back to the app
+ * with a code. This code is then exchanged for an access token.
+ */
+type OAuthCode = {
+  code: string;
+};
+
+export function generateAndStoreOAuthState<OT extends OAuthType>({
+  oAuthType,
+  provider,
+  res,
+}: {
+  oAuthType: OT,
+  provider: ProviderConfig,
+  res: ExpressResponse
+}): OAuthStateFor<OT> {
+  const state: OAuthStateFor<OT> = {
+    ...generateState(),
+    ...(oAuthType === 'OAuth2WithPKCE' && generateCodeVerifier()),
+  };
+
+  storeOAuthState(provider, res, state);
+
+  return state;
+}
+
+export function validateAndGetOAuthState<OT extends OAuthType>({
+  oAuthType,
+  provider,
+  req,
+}: {
+  oAuthType: OT,
+  provider: ProviderConfig,
+  req: ExpressRequest
+}): OAuthStateWithCodeFor<OT> {
+  const state: OAuthStateWithCodeFor<OT> = {
+    ...getCode(req),
+    ...getState(req),
+    ...(oAuthType === 'OAuth2WithPKCE' && getCodeVerifier(provider, req)),
+  };
+
+  validateOAuthState(provider, req, state);
+
+  return state;
+}
+
+function storeOAuthState(
+  provider: ProviderConfig,
+  res: ExpressResponse,
+  state: OAuthStateFor<OAuthType>
+): void {
+  let key: keyof typeof state;
+  for (key in state) {
+    setOAuthCookieValue(provider, res, key, state[key]);
+  }
+}
+
+function validateOAuthState(
+  provider: ProviderConfig,
+  req: ExpressRequest,
+  state: OAuthStateWithCodeFor<OAuthType>
+): void {
+  if (typeof state.code !== 'string') {
+    throw new Error('Invalid code');
+  }
+
+  const storedState = getOAuthCookieValue(provider, req, 'state');
+  if (!state.state || !storedState || storedState !== state.state) {
+    throw new Error('Invalid state');
+  }
+
+  if (isOAuthStateWithPKCE(state) && !state.codeVerifier) {
+    throw new Error('Missing code verifier');
+  }
+}
+
+function generateState(): { state: string } {
+  return { state: arctic.generateState() };
+}
+
+function generateCodeVerifier(): { codeVerifier: string } {
+  return { codeVerifier: arctic.generateCodeVerifier() };
+}
+
+function getCode(req: ExpressRequest): { code: string } {
+  return { code: `${req.query.code}` };
+}
+
+function getState(req: ExpressRequest): { state: string } {
+  return { state:  `${req.query.state}` };
+}
+
+function getCodeVerifier(
+  provider: ProviderConfig,
+  req: ExpressRequest
+): { codeVerifier: string } {
+  const codeVerifier = getOAuthCookieValue(
+    provider,
+    req,
+    'codeVerifier'
+  );
+  return { codeVerifier };
+}
+
+function isOAuthStateWithPKCE(
+  state: OAuthState | OAuthStateWithPKCE
+): state is OAuthStateWithPKCE {
+  return 'codeVerifier' in state;
+}

package/data/Generator/templates/server/src/auth/providers/oauth/types.ts

@@ -0,0 +1,7 @@
+{{={= =}=}}
+
+import type { Prisma } from "@prisma/client"
+
+export type UserFieldsFromOAuthSignup = Prisma.{= userEntityName =}CreateInput
+
+export type UserDefinedConfigFn = () => { [key: string]: any }

package/data/Generator/templates/server/src/auth/providers/oauth/user.ts

@@ -0,0 +1,139 @@
+{{={= =}=}}
+import { Request as ExpressRequest } from 'express'
+import {
+  type ProviderId,
+  createUser,
+  sanitizeAndSerializeProviderData,
+  validateAndGetUserFields,
+  createProviderId,
+  findAuthWithUserBy,
+} from 'wasp/auth/utils'
+import { type {= authEntityUpper =} } from 'wasp/entities'
+import { prisma } from 'wasp/server'
+import { type UserSignupFields, type ProviderConfig } from 'wasp/auth/providers/types'
+import { type OAuthData } from 'wasp/server/auth'
+import { getRedirectUriForOneTimeCode, tokenStore } from 'wasp/server/auth'
+import {
+  onBeforeSignupHook,
+  onAfterSignupHook,
+  onBeforeLoginHook,
+  onAfterLoginHook,
+} from '../../hooks.js'
+
+export async function finishOAuthFlowAndGetRedirectUri({
+  provider,
+  providerProfile,
+  providerUserId,
+  userSignupFields,
+  req,
+  oauth
+}: {
+  provider: ProviderConfig;
+  providerProfile: unknown;
+  providerUserId: string;
+  userSignupFields: UserSignupFields | undefined;
+  req: ExpressRequest;
+  oauth: OAuthData;
+}): Promise<URL> {
+  const providerId = createProviderId(provider.id, providerUserId);
+
+  const authId = await getAuthIdFromProviderDetails({
+    providerId,
+    providerProfile,
+    userSignupFields,
+    req,
+    oauth,
+  });
+
+  const oneTimeCode = await tokenStore.createToken(authId)
+
+  return getRedirectUriForOneTimeCode(oneTimeCode)
+}
+
+// We need a user id to create the auth token, so we either find an existing user
+// or create a new one if none exists for this provider.
+async function getAuthIdFromProviderDetails({
+  providerId,
+  providerProfile,
+  userSignupFields,
+  req,
+  oauth,
+}: {
+  providerId: ProviderId;
+  providerProfile: any;
+  userSignupFields: UserSignupFields | undefined;
+  req: ExpressRequest;
+  oauth: OAuthData;
+}): Promise<{= authEntityUpper =}['id']> {
+  const existingAuthIdentity = await prisma.{= authIdentityEntityLower =}.findUnique({
+    where: {
+      providerName_providerUserId: providerId,
+    },
+    include: {
+      {= authFieldOnAuthIdentityEntityName =}: {
+        include: {
+          {= userFieldOnAuthEntityName =}: true
+        }
+      }
+    }
+  })
+
+  if (existingAuthIdentity) {
+    const authId = existingAuthIdentity.{= authFieldOnAuthIdentityEntityName =}.id
+
+    // NOTE: Fetching the user to pass it to the login hooks - it's a bit wasteful
+    // but we wanted to keep the onAfterLoginHook params consistent for all auth providers.
+    const auth = await findAuthWithUserBy({ id: authId })
+
+    if (auth === null) {
+        throw new Error('Auth entity not found while trying to log in with OAuth')
+    }
+
+    // NOTE: We are calling login hooks here even though we didn't log in the user yet.
+    // It's because we have access to the OAuth tokens here and we want to pass them to the hooks.
+    // We could have stored the tokens temporarily and called the hooks after the session is created,
+    // but this keeps the implementation simpler.
+    // The downside of this approach is that we can't provide the session to the login hooks, but this is
+    // an okay trade-off because OAuth tokens are more valuable to users than the session ID.
+    await onBeforeLoginHook({
+      req,
+      providerId,
+      user: auth.user,
+    })
+
+    // NOTE: check the comment above onBeforeLoginHook for the explanation why we call onAfterLoginHook here.
+    await onAfterLoginHook({
+      req,
+      providerId,
+      oauth,
+      user: auth.user,
+    })
+
+    return authId
+  } else {
+    const userFields = await validateAndGetUserFields(
+      { profile: providerProfile },
+      userSignupFields,
+    )
+
+    // For now, we don't have any extra data for the oauth providers, so we just pass an empty object.
+    const providerData = await sanitizeAndSerializeProviderData({})
+  
+    await onBeforeSignupHook({ req, providerId })
+    const user = await createUser(
+      providerId,
+      providerData,
+      // Using any here because we want to avoid TypeScript errors and
+      // rely on Prisma to validate the data.
+      userFields as any,
+    )
+    await onAfterSignupHook({
+      req,
+      providerId,
+      user,
+      oauth,
+    })
+
+    return user.auth.id
+  }
+}

package/data/Generator/templates/server/src/auth/providers/username/login.ts

@@ -0,0 +1,64 @@
+{{={= =}=}}
+import { createInvalidCredentialsError } from 'wasp/auth/utils'
+import { defineHandler } from 'wasp/server/utils'
+import { verifyPassword } from 'wasp/auth/password'
+
+import {
+  createProviderId,
+  findAuthIdentity,
+  findAuthWithUserBy,
+  getProviderDataWithPassword,
+} from 'wasp/auth/utils'
+import { createSession } from 'wasp/auth/session'
+import { ensureValidUsername, ensurePasswordIsPresent } from 'wasp/auth/validation'
+import { onBeforeLoginHook, onAfterLoginHook } from '../../hooks.js';
+
+export default defineHandler(async (req, res) => {
+  const fields = req.body ?? {}
+  ensureValidArgs(fields)
+
+  const providerId = createProviderId('username', fields.username)
+  const authIdentity = await findAuthIdentity(providerId)
+  if (!authIdentity) {
+    throw createInvalidCredentialsError()
+  }
+
+  try {
+    const providerData = getProviderDataWithPassword<'username'>(authIdentity.providerData)
+
+    await verifyPassword(providerData.hashedPassword, fields.password)
+  } catch(e) {
+    throw createInvalidCredentialsError()
+  }
+
+  const auth = await findAuthWithUserBy({
+    id: authIdentity.authId
+  })
+
+  if (auth === null) {
+    throw createInvalidCredentialsError()
+  }
+
+  await onBeforeLoginHook({
+      req,
+      providerId,
+      user: auth.user,
+  })
+
+  const session = await createSession(auth.id)
+
+  await onAfterLoginHook({
+    req,
+    providerId,
+    user: auth.user,
+  })
+
+  res.json({
+      sessionId: session.id,
+  })
+})
+
+function ensureValidArgs(args: object): void {
+  ensureValidUsername(args);
+  ensurePasswordIsPresent(args);
+}

package/data/Generator/templates/server/src/auth/providers/username/signup.ts

@@ -0,0 +1,59 @@
+{{={= =}=}}
+import { defineHandler } from 'wasp/server/utils'
+import {
+  createProviderId,
+  createUser,
+  rethrowPossibleAuthError,
+  sanitizeAndSerializeProviderData,
+} from 'wasp/auth/utils'
+import {
+  ensureValidUsername,
+  ensurePasswordIsPresent,
+  ensureValidPassword,
+} from 'wasp/auth/validation'
+import { validateAndGetUserFields } from 'wasp/auth/utils'
+import type { UserSignupFields } from 'wasp/auth/providers/types'
+import { onBeforeSignupHook, onAfterSignupHook } from '../../hooks.js';
+
+export function getSignupRoute({
+  userSignupFields,
+}: {
+  userSignupFields?: UserSignupFields;
+}) {
+  return defineHandler(async function signup(req, res) {
+    const fields = req.body ?? {}
+    ensureValidArgs(fields)
+
+    const userFields = await validateAndGetUserFields(
+      fields,
+      userSignupFields,
+    );
+
+    const providerId = createProviderId('username', fields.username)
+    const providerData = await sanitizeAndSerializeProviderData<'username'>({
+      hashedPassword: fields.password,
+    })
+
+    try {
+      await onBeforeSignupHook({ req, providerId })
+      const user = await createUser(
+        providerId,
+        providerData,
+        // Using any here because we want to avoid TypeScript errors and
+        // rely on Prisma to validate the data.
+        userFields as any
+      )
+      await onAfterSignupHook({ req, providerId, user })
+    } catch (e: unknown) {
+      rethrowPossibleAuthError(e)
+    }
+
+    res.json({ success: true })
+  })
+}
+
+function ensureValidArgs(args: object): void {
+  ensureValidUsername(args)
+  ensurePasswordIsPresent(args)
+  ensureValidPassword(args)
+}