@webda/core 2.0.0-beta.1 → 2.0.0

package/lib/services/authentication.js

@@ -1,43 +1,28 @@
-"use strict";
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Authentication = exports.AuthenticationParameters = void 0;
-const bcrypt = require("bcryptjs");
-const crypto = require("crypto");
-const service_1 = require("../services/service");
-const httpcontext_1 = require("../utils/httpcontext");
-class AuthenticationParameters extends service_1.ServiceParameters {
+import bcrypt from "bcryptjs";
+import { Inject, Route, Service, ServiceParameters } from "../services/service.js";
+import { HttpContext } from "../utils/httpcontext.js";
+export class AuthenticationParameters extends ServiceParameters {
     constructor(params) {
-        var _a, _b, _c, _d, _e, _f;
-        var _g, _h;
+        var _a, _b;
         super(params);
-        (_a = this.identStore) !== null && _a !== void 0 ? _a : (this.identStore = "idents");
-        (_b = this.userStore) !== null && _b !== void 0 ? _b : (this.userStore = "users");
-        (_c = this.url) !== null && _c !== void 0 ? _c : (this.url = "/auth");
-        (_d = this.password) !== null && _d !== void 0 ? _d : (this.password = {
+        this.identStore ?? (this.identStore = "idents");
+        this.userStore ?? (this.userStore = "users");
+        this.url ?? (this.url = "/auth");
+        this.password ?? (this.password = {
             regexp: ".{8,}"
         });
         if (this.email) {
-            (_e = (_g = this.email).delay) !== null && _e !== void 0 ? _e : (_g.delay = 3600000 * 4);
-            (_f = (_h = this.email).failedLoginBeforeDelay) !== null && _f !== void 0 ? _f : (_h.failedLoginBeforeDelay = 3);
+            (_a = this.email).delay ?? (_a.delay = 3600000 * 4);
+            (_b = this.email).failedLoginBeforeDelay ?? (_b.failedLoginBeforeDelay = 3);
         }
     }
 }
-exports.AuthenticationParameters = AuthenticationParameters;
 /**
  * This class is known as the Authentication module
  * It handles OAuth for several providers for now (Facebook, Google, Amazon, GitHub and Twitter)
@@ -61,7 +46,7 @@ exports.AuthenticationParameters = AuthenticationParameters;
  * @category CoreServices
  * @WebdaModda
  */
-class Authentication extends service_1.Service {
+class Authentication extends Service {
     constructor() {
         super(...arguments);
         this.providers = new Set();
@@ -86,132 +71,6 @@ class Authentication extends service_1.Service {
     getIdentStore() {
         return this._identsStore;
     }
-    /**
-     * @override
-     */
-    initRoutes() {
-        // ROUTES
-        let url = this.parameters.url;
-        // List authentication configured
-        this.addRoute(url, ["GET", "DELETE"], this._listAuthentications, {
-            get: {
-                description: "Retrieve the list of available authentication",
-                summary: "Get available auths",
-                operationId: `getAuthenticationMethods`,
-                responses: {
-                    "200": {
-                        description: "List of authentication"
-                    }
-                }
-            },
-            delete: {
-                description: "Logout current user",
-                summary: "Logout",
-                operationId: `logout`,
-                responses: {
-                    "200": {}
-                }
-            }
-        });
-        // Get the current user
-        this.addRoute(url + "/me", ["GET"], this._getMe, {
-            get: {
-                description: "Retrieve the current user from the session",
-                summary: "Get current user",
-                operationId: "getCurrentUser"
-            }
-        });
-        if (this.parameters.email) {
-            this.addProvider("email");
-            // Add static for email for now, if set before it should have priority
-            this.addRoute(url + "/email", ["POST"], this._handleEmail, {
-                post: {
-                    description: "Authenticate with an email and password",
-                    summary: "Authenticate with email",
-                    operationId: `authWithEmail`
-                }
-            });
-            this.addRoute(url + "/email/callback{?email,token,user}", ["GET"], this._handleEmailCallback, {
-                hidden: true
-            });
-            this.addRoute(url + "/email/passwordRecovery", ["POST"], this._passwordRecovery, {
-                post: {
-                    schemas: {
-                        input: {
-                            type: "object",
-                            properties: {
-                                token: {
-                                    type: "string"
-                                },
-                                expire: {
-                                    type: "number"
-                                },
-                                password: {
-                                    type: "string"
-                                },
-                                login: {
-                                    type: "string"
-                                }
-                            }
-                        }
-                    },
-                    description: "Reinit the password if we have the right token, expire",
-                    summary: "Reinit password",
-                    operationId: "reinitPassword",
-                    responses: {
-                        "204": {
-                            description: ""
-                        },
-                        "403": {
-                            description: "Wrong Token"
-                        }
-                    }
-                }
-            });
-            this.addRoute(url + "/email/{email}/recover", ["GET"], this._passwordRecoveryEmail, {
-                get: {
-                    description: "The password reset process will be start",
-                    summary: "Start password recovery",
-                    operationId: "startEmailRecovery",
-                    responses: {
-                        "204": {
-                            description: ""
-                        },
-                        "404": {
-                            description: "Email does not exist"
-                        },
-                        "429": {
-                            description: "Recovery has been initiated in the last 4 hours"
-                        }
-                    }
-                }
-            });
-            this.addRoute(url + "/email/{email}/validate", ["GET"], this._sendEmailValidation, {
-                get: {
-                    description: "The email validation process will be start",
-                    summary: "Restart email validation",
-                    operationId: "startEmailRecovery",
-                    responses: {
-                        "204": {
-                            description: ""
-                        },
-                        "409": {
-                            description: "Email already verified for another user"
-                        },
-                        "412": {
-                            description: "Email already verified for current user"
-                        },
-                        "429": {
-                            description: "Validation has been initiated in the last 4 hours"
-                        }
-                    }
-                }
-            });
-        }
-    }
-    getUrl() {
-        return this.parameters.url;
-    }
     setIdents(identStore) {
         this._identsStore = identStore;
     }
@@ -230,6 +89,10 @@ class Authentication extends service_1.Service {
         if (this.parameters.email && this.getMailMan() === undefined) {
             throw Error("email authentication requires a Mailer service");
         }
+        // Add email provider
+        if (this.parameters.email) {
+            this.addProvider("email");
+        }
     }
     /**
      * Add a provider to the oauth scheme
@@ -238,6 +101,16 @@ class Authentication extends service_1.Service {
     addProvider(name) {
         this.providers.add(name);
     }
+    /**
+     * Ensure email is enabled for all emails routes
+     * @override
+     */
+    getUrl(url, methods) {
+        if (url.startsWith("./emails") && !this.parameters.email) {
+            return undefined;
+        }
+        return super.getUrl(url, methods);
+    }
     /**
      * Send or resend an email to validate the email address
      *
@@ -246,54 +119,50 @@ class Authentication extends service_1.Service {
      * @throws 412 if the email is already validated
      * @throws 429 if a validation email has been sent recently
      */
-    _sendEmailValidation(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let identKey = ctx.parameters.email + "_email";
-            let ident = yield this._identsStore.get(identKey);
-            if (!ident) {
-                yield this._identsStore.save({
-                    uuid: `${ctx.parameters.email}_email`,
-                    _lastValidationEmail: Date.now(),
-                    _type: "email"
-                });
+    async _sendEmailValidation(ctx) {
+        let identKey = ctx.parameters.email + "_email";
+        let ident = await this._identsStore.get(identKey);
+        if (!ident) {
+            await this._identsStore.save({
+                uuid: `${ctx.parameters.email}_email`,
+                _lastValidationEmail: Date.now(),
+                _type: "email"
+            });
+        }
+        else {
+            // If the ident is linked to someone else - might want to remove it
+            if (ident.getUser() !== ctx.getCurrentUserId()) {
+                throw 409;
             }
-            else {
-                // If the ident is linked to someone else - might want to remove it
-                if (ident.getUser() !== ctx.getCurrentUserId()) {
-                    throw 409;
-                }
-                // If the email is already validated
-                if (ident._validation) {
-                    throw 412;
-                }
-                //
-                if (ident._lastValidationEmail >= Date.now() - this.parameters.email.delay) {
-                    throw 429;
-                }
-                yield this._identsStore.patch({
-                    _lastValidationEmail: Date.now(),
-                    uuid: identKey
-                });
+            // If the email is already validated
+            if (ident._validation) {
+                throw 412;
             }
-            yield this.sendValidationEmail(ctx, ctx.parameters.email);
-        });
+            //
+            if (ident._lastValidationEmail >= Date.now() - this.parameters.email.delay) {
+                throw 429;
+            }
+            await this._identsStore.patch({
+                _lastValidationEmail: Date.now(),
+                uuid: identKey
+            });
+        }
+        await this.sendValidationEmail(ctx, ctx.parameters.email);
     }
     /**
      * Return current user
      * @param ctx
      */
-    _getMe(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let user = yield ctx.getCurrentUser();
-            if (user === undefined) {
-                throw 404;
-            }
-            yield this.emitSync("Authentication.GetMe", {
-                context: ctx,
-                user
-            });
-            ctx.write(user);
+    async _getMe(ctx) {
+        let user = await ctx.getCurrentUser();
+        if (user === undefined) {
+            throw 404;
+        }
+        await this.emitSync("Authentication.GetMe", {
+            context: ctx,
+            user
         });
+        ctx.write(user);
     }
     /**
      * Handle both list of available authentication
@@ -302,233 +171,223 @@ class Authentication extends service_1.Service {
      * @param ctx
      * @returns
      */
-    _listAuthentications(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (ctx.getHttpContext().getMethod() === "DELETE") {
-                yield this.logout(ctx);
-                ctx.write("GoodBye");
-                return;
-            }
-            ctx.write(Array.from(this.providers));
-        });
+    async _listAuthentications(ctx) {
+        if (ctx.getHttpContext().getMethod() === "DELETE") {
+            await this.logout(ctx);
+            ctx.write("GoodBye");
+            return;
+        }
+        ctx.write(Array.from(this.providers));
     }
-    onIdentLogin(ctx, provider, identId, profile, tokens = undefined) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // Auto postifx with provider name
-            const postfix = `_${provider}`;
-            if (!identId.endsWith(postfix)) {
-                identId += postfix;
-            }
-            let ident = yield this._identsStore.get(identId);
-            // Ident is known
+    async onIdentLogin(ctx, provider, identId, profile, tokens = undefined) {
+        // Auto postifx with provider name
+        const postfix = `_${provider}`;
+        if (!identId.endsWith(postfix)) {
+            identId += postfix;
+        }
+        let ident = await this._identsStore.get(identId);
+        // Ident is known
+        if (ident) {
+            await this.login(ctx, ident.getUser(), ident);
+            await this._identsStore.patch({
+                _lastUsed: new Date(),
+                __tokens: tokens,
+                uuid: ident.uuid
+            });
+            // Redirect to?
+            return;
+        }
+        let user;
+        if (profile.email) {
+            ident = await this._identsStore.get(`${profile.email}_email`);
+        }
+        // If already login
+        if (ctx.getCurrentUserId()) {
+            user = await ctx.getCurrentUser();
+        }
+        else {
+            // If an email in profile try to find the ident
             if (ident) {
-                yield this.login(ctx, ident.getUser(), ident);
-                yield this._identsStore.patch({
-                    _lastUsed: new Date(),
-                    __tokens: tokens,
-                    uuid: ident.uuid
-                });
-                // Redirect to?
-                return;
-            }
-            let user;
-            if (profile.email) {
-                ident = yield this._identsStore.get(`${profile.email}_email`);
+                user = await this._usersStore.get(ident.getUser());
             }
-            // If already login
-            if (ctx.getCurrentUserId()) {
-                user = yield ctx.getCurrentUser();
-            }
-            else {
-                // If an email in profile try to find the ident
-                if (ident) {
-                    user = yield this._usersStore.get(ident.getUser());
-                }
-                if (!user) {
-                    // If no user, register a new user automatically
-                    user = yield this.registerUser(ctx, profile, identId);
-                    yield this._usersStore.save(user);
-                }
-            }
-            if (profile.email && !ident) {
-                // Save additional email
-                ident = this._identsStore.initModel({
-                    uuid: `${profile.email}_email`,
-                    provider: "email"
-                });
-                ident.setUser(user.getUuid());
-                yield ident.save();
+            if (!user) {
+                // If no user, register a new user automatically
+                user = await this.registerUser(ctx, profile, identId);
+                await this._usersStore.save(user);
             }
-            // Work directly on ident argument
+        }
+        if (profile.email && !ident) {
+            // Save additional email
             ident = this._identsStore.initModel({
-                uuid: identId,
-                profile,
-                __tokens: tokens,
-                provider
+                uuid: `${profile.email}_email`,
+                provider: "email"
             });
-            ident.setUser(user.uuid);
-            ident._lastUsed = new Date();
-            ident.setType(provider);
-            yield ident.save();
-            ident.__new = true;
-            yield this.login(ctx, user, ident);
+            ident.setUser(user.getUuid());
+            await ident.save();
+        }
+        // Work directly on ident argument
+        ident = this._identsStore.initModel({
+            uuid: identId,
+            profile,
+            __tokens: tokens,
+            provider
         });
+        ident.setUser(user.uuid);
+        ident._lastUsed = new Date();
+        ident.setType(provider);
+        await ident.save();
+        ident.__new = true;
+        await this.login(ctx, user, ident);
     }
     /**
      * Create a new User with the link ident
      * @param ident
      */
-    createUserWithIdent(provider, identId, profile = {}) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (yield this._identsStore.exists(`${identId}_${provider}`)) {
-                throw new Error("Ident is already known");
-            }
-            let ctx = yield this._webda.newContext(new httpcontext_1.HttpContext("fake", "GET", "/"));
-            // Pretend we logged in with the ident
-            yield this.onIdentLogin(ctx, provider, identId, profile);
-        });
-    }
-    registerUser(ctx, data, identId, user = this._usersStore.initModel()) {
-        return __awaiter(this, void 0, void 0, function* () {
-            user.email = data.email;
-            user.locale = ctx.getLocale();
-            yield this.emitSync("Authentication.Register", {
-                user: user,
-                data: data,
-                context: ctx,
-                identId
-            });
-            return user;
+    async createUserWithIdent(provider, identId, profile = {}) {
+        if (await this._identsStore.exists(`${identId}_${provider}`)) {
+            throw new Error("Ident is already known");
+        }
+        let ctx = await this._webda.newContext(new HttpContext("fake", "GET", "/"));
+        // Pretend we logged in with the ident
+        await this.onIdentLogin(ctx, provider, identId, profile);
+    }
+    async registerUser(ctx, data, identId, user = this._usersStore.initModel()) {
+        user.email = data.email;
+        user.locale = ctx.getLocale();
+        await this.emitSync("Authentication.Register", {
+            user: user,
+            data: data,
+            context: ctx,
+            identId
         });
+        return user;
     }
-    getPasswordRecoveryInfos(uuid, interval = this.parameters.email.delay) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var expire = Date.now() + interval;
-            let user;
-            if (typeof uuid === "string") {
-                user = yield this._usersStore.get(uuid);
-            }
-            else {
-                user = uuid;
-            }
-            if (!user) {
-                return undefined;
-            }
-            return {
-                expire: expire,
-                // Might want to add more alea not coming from the db to avoid exploitation of stolen db
-                token: this.hashInfo(user.uuid + expire + user.getPassword()),
-                login: user.uuid
-            };
-        });
+    async getPasswordRecoveryInfos(uuid, interval = this.parameters.email.delay) {
+        const expire = Date.now() + interval;
+        let user;
+        if (typeof uuid === "string") {
+            user = await this._usersStore.get(uuid);
+        }
+        else {
+            user = uuid;
+        }
+        if (!user) {
+            return undefined;
+        }
+        return {
+            expire: expire,
+            // Might want to add more alea not coming from the db to avoid exploitation of stolen db
+            token: await this.cryptoService.hmac(user.uuid + expire + user.getPassword()),
+            login: user.uuid
+        };
     }
-    _passwordRecoveryEmail(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let email = ctx.parameter("email");
-            let ident = yield this._identsStore.get(email + "_email");
-            if (!ident) {
-                throw 404;
-            }
-            let user = yield this._usersStore.get(ident.getUser());
-            // Dont allow to do too many request
-            if (!user.lastPasswordRecoveryBefore(Date.now() - this.parameters.email.delay)) {
-                throw 429;
-            }
-            yield this._usersStore.patch({
-                _lastPasswordRecovery: Date.now(),
-                uuid: user.uuid
-            });
-            yield this.sendRecoveryEmail(ctx, user, email);
+    /**
+     * Manage password recovery
+     * @param ctx
+     */
+    async _passwordRecoveryEmail(ctx) {
+        let email = ctx.parameter("email");
+        let ident = await this._identsStore.get(email + "_email");
+        if (!ident) {
+            throw 404;
+        }
+        let user = await this._usersStore.get(ident.getUser());
+        // Dont allow to do too many request
+        if (!user.lastPasswordRecoveryBefore(Date.now() - this.parameters.email.delay)) {
+            throw 429;
+        }
+        await this._usersStore.patch({
+            _lastPasswordRecovery: Date.now(),
+            uuid: user.uuid
         });
+        await this.sendRecoveryEmail(ctx, user, email);
     }
-    _verifyPassword(password, user) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this._passwordVerifier) {
-                if (!(yield this._passwordVerifier.validate(password, user))) {
-                    throw 400;
-                }
-                return;
-            }
-            let regexp = new RegExp(this.parameters.password.regexp);
-            if (regexp.exec(password) === null) {
+    async _verifyPassword(password, user) {
+        if (this._passwordVerifier) {
+            if (!(await this._passwordVerifier.validate(password, user))) {
                 throw 400;
             }
+            return;
+        }
+        let regexp = new RegExp(this.parameters.password.regexp);
+        if (regexp.exec(password) === null) {
+            throw 400;
+        }
+    }
+    async _passwordRecovery(ctx) {
+        let body = await ctx.getRequestBody();
+        if (body.password === undefined ||
+            body.login === undefined ||
+            body.token === undefined ||
+            body.expire === undefined) {
+            throw 400;
+        }
+        let user = await this._usersStore.get(body.login.toLowerCase());
+        if (!user) {
+            throw 403;
+        }
+        if (!(await this.cryptoService.hmacVerify(body.login.toLowerCase() + body.expire + user.getPassword(), body.token))) {
+            throw 403;
+        }
+        if (body.expire < Date.now()) {
+            throw 410;
+        }
+        await this._verifyPassword(body.password, user);
+        let password = this.hashPassword(body.password);
+        await this._usersStore.patch({
+            __password: password,
+            uuid: body.login.toLowerCase()
+        });
+        await this.emitSync("Authentication.PasswordUpdate", {
+            user,
+            password,
+            context: ctx
         });
     }
-    _passwordRecovery(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let body = yield ctx.getRequestBody();
-            if (body.password === undefined ||
-                body.login === undefined ||
-                body.token === undefined ||
-                body.expire === undefined) {
-                throw 400;
-            }
-            let user = yield this._usersStore.get(body.login.toLowerCase());
-            if (!user) {
-                throw 403;
-            }
-            if (body.token !== this.hashInfo(body.login.toLowerCase() + body.expire + user.getPassword())) {
-                throw 403;
-            }
-            if (body.expire < Date.now()) {
-                throw 410;
-            }
-            yield this._verifyPassword(body.password, user);
-            let password = this.hashPassword(body.password);
-            yield this._usersStore.patch({
-                __password: password,
-                uuid: body.login.toLowerCase()
+    /**
+     * Callback to validate an email address
+     * @param ctx
+     * @returns
+     */
+    async _handleEmailCallback(ctx) {
+        if (!ctx.parameter("token")) {
+            throw 400;
+        }
+        if (!(await this.cryptoService.hmacVerify(`${ctx.parameter("email")}_${ctx.parameter("user")}`, ctx.parameter("token")))) {
+            ctx.writeHead(302, {
+                Location: this.parameters.failureRedirect + "?reason=badToken"
             });
-            yield this.emitSync("Authentication.PasswordUpdate", {
-                user,
-                password,
-                context: ctx
+            return;
+        }
+        if (ctx.parameter("user") !== ctx.getCurrentUserId() &&
+            ctx.getCurrentUserId() !== "" &&
+            ctx.getCurrentUserId() !== undefined) {
+            ctx.writeHead(302, {
+                Location: this.parameters.failureRedirect + "?reason=badUser"
             });
-        });
-    }
-    _handleEmailCallback(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!ctx.parameter("token")) {
-                throw 400;
-            }
-            let validation = ctx.parameter("token");
-            if (validation !== this.generateEmailValidationToken(ctx.parameter("user"), ctx.parameter("email"))) {
-                ctx.writeHead(302, {
-                    Location: this.parameters.failureRedirect + "?reason=badToken"
-                });
-                return;
-            }
-            if (ctx.parameter("user") !== ctx.getCurrentUserId() &&
-                ctx.getCurrentUserId() !== "" &&
-                ctx.getCurrentUserId() !== undefined) {
-                ctx.writeHead(302, {
-                    Location: this.parameters.failureRedirect + "?reason=badUser"
-                });
-                return;
-            }
-            if (!ctx.parameter("user")) {
-                ctx.writeHead(302, {
-                    Location: `${this.parameters.registerRedirect}?token=${ctx.parameter("token")}&email=${ctx.parameter("email")}`
-                });
-                return;
-            }
-            var uuid = ctx.parameter("email") + "_email";
-            let ident = yield this._identsStore.get(uuid);
-            // Would mean the ident got delete in the mean time... hyper low likely hood
-            if (ident === undefined) {
-                ident = this._identsStore.initModel({
-                    uuid
-                });
-            }
-            ident._type = "email";
-            ident._validation = new Date();
-            ident.setUser(ctx.parameter("user"));
-            yield ident.save();
+            return;
+        }
+        if (!ctx.parameter("user")) {
             ctx.writeHead(302, {
-                Location: this.parameters.successRedirect + "?validation=email",
-                "X-Webda-Authentication": "success"
+                Location: `${this.parameters.registerRedirect}?token=${ctx.parameter("token")}&email=${ctx.parameter("email")}`
+            });
+            return;
+        }
+        const uuid = ctx.parameter("email") + "_email";
+        let ident = await this._identsStore.get(uuid);
+        // Would mean the ident got delete in the mean time... hyper low likely hood
+        if (ident === undefined) {
+            ident = this._identsStore.initModel({
+                uuid
             });
+        }
+        ident._type = "email";
+        ident._validation = new Date();
+        ident.setUser(ctx.parameter("user"));
+        await ident.save();
+        ctx.writeHead(302, {
+            Location: this.parameters.successRedirect + "?validation=email",
+            "X-Webda-Authentication": "success"
         });
     }
     /**
@@ -539,19 +398,17 @@ class Authentication extends service_1.Service {
      * @param email
      * @returns
      */
-    sendRecoveryEmail(ctx, user, email) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let infos = yield this.getPasswordRecoveryInfos(user);
-            var mailer = this.getMailMan();
-            let locale = user.locale || ctx.getLocale();
-            let mailOptions = {
-                to: email,
-                locale: locale,
-                template: "EMAIL_RECOVERY",
-                replacements: Object.assign(Object.assign({}, this.parameters.email), { infos, to: email, context: ctx })
-            };
-            return mailer.send(mailOptions);
-        });
+    async sendRecoveryEmail(ctx, user, email) {
+        let infos = await this.getPasswordRecoveryInfos(user);
+        const mailer = this.getMailMan();
+        let locale = user.locale || ctx.getLocale();
+        let mailOptions = {
+            to: email,
+            locale: locale,
+            template: "EMAIL_RECOVERY",
+            replacements: { ...this.parameters.email, infos, to: email, context: ctx }
+        };
+        return mailer.send(mailOptions);
     }
     /**
      * Send an email to validate the user email by sending a unique link to
@@ -561,33 +418,26 @@ class Authentication extends service_1.Service {
      * @param email
      * @returns
      */
-    sendValidationEmail(ctx, email) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var mailer = this.getMailMan();
-            let replacements = Object.assign(Object.assign({}, this.parameters.email), { context: ctx, url: ctx
-                    .getHttpContext()
-                    .getAbsoluteUrl(`${this.parameters.url}/email/callback?email=${email}&token=${this.generateEmailValidationToken(ctx.getCurrentUserId(), email)}`) });
-            let userId = ctx.getCurrentUserId();
-            if (userId && userId.length > 0) {
-                replacements.url += "&user=" + userId;
-            }
-            let mailOptions = {
-                to: email,
-                locale: ctx.getLocale(),
-                template: "EMAIL_REGISTER",
-                replacements: replacements
-            };
-            return mailer.send(mailOptions);
-        });
-    }
-    /**
-     * Create a SHA256 of the info
-     *
-     * @param info to hash
-     */
-    hashInfo(info) {
-        var hash = crypto.createHash("sha256");
-        return hash.update(info).digest("hex");
+    async sendValidationEmail(ctx, email) {
+        const mailer = this.getMailMan();
+        let replacements = {
+            ...this.parameters.email,
+            context: ctx,
+            url: ctx
+                .getHttpContext()
+                .getAbsoluteUrl(`${this.parameters.url}/email/callback?email=${email}&token=${await this.generateEmailValidationToken(ctx.getCurrentUserId(), email)}`)
+        };
+        let userId = ctx.getCurrentUserId();
+        if (userId && userId.length > 0) {
+            replacements.url += "&user=" + userId;
+        }
+        let mailOptions = {
+            to: email,
+            locale: ctx.getLocale(),
+            template: "EMAIL_REGISTER",
+            replacements: replacements
+        };
+        return mailer.send(mailOptions);
     }
     /**
      * Check the password match the stored hash
@@ -608,13 +458,11 @@ class Authentication extends service_1.Service {
     /**
      * Logout user
      */
-    logout(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.emitSync("Authentication.Logout", {
-                context: ctx
-            });
-            ctx.getSession().destroy();
+    async logout(ctx) {
+        await this.emitSync("Authentication.Logout", {
+            context: ctx
         });
+        ctx.newSession();
     }
     /**
      * Login a user
@@ -624,25 +472,23 @@ class Authentication extends service_1.Service {
      * @param ident
      * @returns
      */
-    login(ctx, user, ident) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var event = {
-                context: ctx,
-                userId: "",
-                identId: ident.uuid,
-                ident
-            };
-            if (typeof user == "object") {
-                event.userId = user.uuid;
-                event.user = user;
-            }
-            else {
-                event.userId = user;
-            }
-            event.context = ctx;
-            ctx.getSession().login(event.userId, event.identId);
-            return this.emitSync("Authentication.Login", event);
-        });
+    async login(ctx, user, ident) {
+        const event = {
+            context: ctx,
+            userId: "",
+            identId: ident.uuid,
+            ident
+        };
+        if (typeof user == "object") {
+            event.userId = user.uuid;
+            event.user = user;
+        }
+        else {
+            event.userId = user;
+        }
+        event.context = ctx;
+        ctx.getSession().login(event.userId, event.identId);
+        return this.emitSync("Authentication.Login", event);
     }
     getMailMan() {
         return this.getService(this.parameters.email.mailer ? this.parameters.email.mailer : "Mailer");
@@ -653,40 +499,37 @@ class Authentication extends service_1.Service {
      * @param ctx
      * @param ident
      */
-    handleLogin(ctx, ident) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            let updates = {};
-            let user = yield this._usersStore.get(ident.getUser());
-            // Check password
-            if (this.checkPassword(user.getPassword(), (yield ctx.getRequestBody()).password)) {
-                if (ident._failedLogin > 0) {
-                    ident._failedLogin = 0;
-                }
-                updates._lastUsed = new Date();
-                updates._failedLogin = 0;
-                updates.uuid = ident.uuid;
-                yield this._identsStore.patch(updates);
-                yield this.login(ctx, ident.getUser(), ident);
-                ctx.write(user);
-            }
-            else {
-                yield this.emitSync("Authentication.LoginFailed", {
-                    user,
-                    context: ctx
-                });
-                (_a = ident._failedLogin) !== null && _a !== void 0 ? _a : (ident._failedLogin = 0);
-                updates._failedLogin = ident._failedLogin + 1;
-                updates._lastFailedLogin = new Date();
-                updates.uuid = ident.uuid;
-                // Swalow exeception issue to double check !
-                yield this._identsStore.patch(updates);
-                // Allows to auto redirect user to a oauth if needed
-                if (!ctx.isEnded()) {
-                    throw 403;
-                }
+    async handleLogin(ctx, ident) {
+        let updates = {};
+        let user = await this._usersStore.get(ident.getUser());
+        // Check password
+        if (this.checkPassword(user.getPassword(), (await ctx.getRequestBody()).password)) {
+            if (ident._failedLogin > 0) {
+                ident._failedLogin = 0;
+            }
+            updates._lastUsed = new Date();
+            updates._failedLogin = 0;
+            updates.uuid = ident.uuid;
+            await this._identsStore.patch(updates);
+            await this.login(ctx, ident.getUser(), ident);
+            ctx.write(user);
+        }
+        else {
+            await this.emitSync("Authentication.LoginFailed", {
+                user,
+                context: ctx
+            });
+            ident._failedLogin ?? (ident._failedLogin = 0);
+            updates._failedLogin = ident._failedLogin + 1;
+            updates._lastFailedLogin = new Date();
+            updates.uuid = ident.uuid;
+            // Swalow exeception issue to double check !
+            await this._identsStore.patch(updates);
+            // Allows to auto redirect user to a oauth if needed
+            if (!ctx.isEnded()) {
+                throw 403;
             }
-        });
+        }
     }
     /**
      * Handle the POST /auth/email
@@ -694,95 +537,220 @@ class Authentication extends service_1.Service {
      * @param ctx
      * @returns
      */
-    _handleEmail(ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // If called while logged in reject
-            if (ctx.getCurrentUserId() !== undefined) {
-                throw 410;
+    async _handleEmail(ctx) {
+        // If called while logged in reject
+        if (ctx.getCurrentUserId() !== undefined) {
+            throw 410;
+        }
+        let body = await ctx.getRequestBody();
+        if (body.login === undefined) {
+            throw 400;
+        }
+        const mailConfig = this.parameters.email;
+        const uuid = body.login.toLowerCase() + "_email";
+        let ident = await this._identsStore.get(uuid);
+        if (ident !== undefined && ident.getUser() !== undefined) {
+            // Register on an known user
+            if (!body.register) {
+                await this.handleLogin(ctx, ident);
+                return;
             }
-            let body = yield ctx.getRequestBody();
-            if (body.login === undefined) {
-                throw 400;
+            // If register on a validate email
+            if (ident._validation !== undefined) {
+                throw 409;
             }
-            var mailConfig = this.parameters.email;
-            var uuid = body.login.toLowerCase() + "_email";
-            let ident = yield this._identsStore.get(uuid);
-            if (ident !== undefined && ident.getUser() !== undefined) {
-                // Register on an known user
-                if (!body.register) {
-                    yield this.handleLogin(ctx, ident);
-                    return;
+        }
+        // TODO Handle add of email on authenticated user
+        const email = body.login.toLowerCase();
+        // Read the form
+        if (body.register) {
+            let validation = undefined;
+            // Need to check email before creation
+            if (!mailConfig.postValidation) {
+                if (body.token && (await this.cryptoService.hmacVerify(`${email}_${ctx.getCurrentUserId()}`, body.token))) {
+                    validation = new Date();
                 }
-                // If register on a validate email
-                if (ident._validation !== undefined) {
-                    throw 409;
+                else {
+                    ctx.write({});
+                    // token is undefined send an email
+                    return this.sendValidationEmail(ctx, email);
                 }
             }
-            // TODO Handle add of email on authenticated user
-            var email = body.login.toLowerCase();
-            // Read the form
-            if (body.register) {
-                var validation = undefined;
-                // Need to check email before creation
-                if (!mailConfig.postValidation) {
-                    if (body.token == this.generateEmailValidationToken(ctx.getCurrentUserId(), email)) {
-                        validation = new Date();
-                    }
-                    else {
-                        ctx.write({});
-                        // token is undefined send an email
-                        return this.sendValidationEmail(ctx, email);
-                    }
-                }
-                if (!body.password) {
-                    throw 400;
-                }
-                // Store with a _
-                let __password = this.hashPassword(body.password);
-                yield this._verifyPassword(body.password);
-                // Remove useless attributes
-                delete body.password;
-                delete body.register;
-                delete body.token;
-                let user = yield this.registerUser(ctx, {}, uuid, Object.assign(Object.assign({}, body), { __password }));
-                yield this.emitSync("Authentication.PasswordCreate", {
-                    user,
-                    password: __password,
-                    context: ctx
-                });
-                user = yield this._usersStore.save(user);
-                var newIdent = this._identsStore.initModel({
-                    uuid: uuid,
-                    _type: "email",
-                    email: email
-                });
-                newIdent.setUser(user.uuid);
-                if (validation) {
-                    newIdent._validation = validation;
-                }
-                else if (!mailConfig.skipEmailValidation) {
-                    newIdent._lastValidationEmail = Date.now();
-                }
-                ident = yield newIdent.save();
-                yield this.login(ctx, user, ident);
-                ctx.write(user);
-                if (!validation && !mailConfig.skipEmailValidation) {
-                    yield this.sendValidationEmail(ctx, email);
-                }
-                return;
+            if (!body.password) {
+                throw 400;
             }
-            throw 404;
-        });
+            // Store with a _
+            let __password = this.hashPassword(body.password);
+            await this._verifyPassword(body.password);
+            // Remove useless attributes
+            delete body.password;
+            delete body.register;
+            delete body.token;
+            let user = await this.registerUser(ctx, {}, uuid, { ...body, __password });
+            await this.emitSync("Authentication.PasswordCreate", {
+                user,
+                password: __password,
+                context: ctx
+            });
+            user = await this._usersStore.save(user);
+            const newIdent = this._identsStore.initModel({
+                uuid: uuid,
+                _type: "email",
+                email: email
+            });
+            newIdent.setUser(user.uuid);
+            if (validation) {
+                newIdent._validation = validation;
+            }
+            else if (!mailConfig.skipEmailValidation) {
+                newIdent._lastValidationEmail = Date.now();
+            }
+            ident = await newIdent.save();
+            await this.login(ctx, user, ident);
+            ctx.write(user);
+            if (!validation && !mailConfig.skipEmailValidation) {
+                await this.sendValidationEmail(ctx, email);
+            }
+            return;
+        }
+        throw 404;
     }
-    generateEmailValidationToken(user, email) {
-        return this.hashInfo(email + "_" + this._webda.getSecret() + user);
+    async generateEmailValidationToken(user, email) {
+        return this.cryptoService.hmac(email + "_" + user);
     }
 }
 __decorate([
-    (0, service_1.Inject)("identStore", "idents")
+    Inject("identStore", "idents")
 ], Authentication.prototype, "_identsStore", void 0);
 __decorate([
-    (0, service_1.Inject)("userStore", "users")
+    Inject("userStore", "users")
 ], Authentication.prototype, "_usersStore", void 0);
-exports.Authentication = Authentication;
+__decorate([
+    Inject("CryptoService")
+], Authentication.prototype, "cryptoService", void 0);
+__decorate([
+    Route("./email/{email}/validate", ["GET"], false, {
+        get: {
+            description: "The email validation process will be start",
+            summary: "Restart email validation",
+            operationId: "startEmailRecovery",
+            responses: {
+                "204": {
+                    description: ""
+                },
+                "409": {
+                    description: "Email already verified for another user"
+                },
+                "412": {
+                    description: "Email already verified for current user"
+                },
+                "429": {
+                    description: "Validation has been initiated in the last 4 hours"
+                }
+            }
+        }
+    })
+], Authentication.prototype, "_sendEmailValidation", null);
+__decorate([
+    Route("./me", ["GET"], false, {
+        get: {
+            description: "Retrieve the current user from the session",
+            summary: "Get current user",
+            operationId: "getCurrentUser"
+        }
+    })
+], Authentication.prototype, "_getMe", null);
+__decorate([
+    Route(".", ["GET", "DELETE"], false, {
+        get: {
+            description: "Retrieve the list of available authentication",
+            summary: "Get available auths",
+            operationId: `getAuthenticationMethods`,
+            responses: {
+                "200": {
+                    description: "List of authentication"
+                }
+            }
+        },
+        delete: {
+            description: "Logout current user",
+            summary: "Logout",
+            operationId: `logout`,
+            responses: {
+                "200": {}
+            }
+        }
+    })
+], Authentication.prototype, "_listAuthentications", null);
+__decorate([
+    Route("./email/{email}/recover", ["GET"], false, {
+        get: {
+            description: "The password reset process will be start",
+            summary: "Start password recovery",
+            operationId: "startEmailRecovery",
+            responses: {
+                "204": {
+                    description: ""
+                },
+                "404": {
+                    description: "Email does not exist"
+                },
+                "429": {
+                    description: "Recovery has been initiated in the last 4 hours"
+                }
+            }
+        }
+    })
+], Authentication.prototype, "_passwordRecoveryEmail", null);
+__decorate([
+    Route("./email/passwordRecovery", ["POST"], false, {
+        post: {
+            schemas: {
+                input: {
+                    type: "object",
+                    properties: {
+                        token: {
+                            type: "string"
+                        },
+                        expire: {
+                            type: "number"
+                        },
+                        password: {
+                            type: "string"
+                        },
+                        login: {
+                            type: "string"
+                        }
+                    }
+                }
+            },
+            description: "Reinit the password if we have the right token, expire",
+            summary: "Reinit password",
+            operationId: "reinitPassword",
+            responses: {
+                "204": {
+                    description: ""
+                },
+                "403": {
+                    description: "Wrong Token"
+                }
+            }
+        }
+    })
+], Authentication.prototype, "_passwordRecovery", null);
+__decorate([
+    Route("./email/callback{?email,token,user}", ["GET"], false, {
+        hidden: true
+    })
+], Authentication.prototype, "_handleEmailCallback", null);
+__decorate([
+    Route("./email", ["POST"], false, {
+        post: {
+            description: "Authenticate with an email and password",
+            summary: "Authenticate with email",
+            operationId: `authWithEmail`
+        }
+    })
+], Authentication.prototype, "_handleEmail", null);
+export { Authentication };
 //# sourceMappingURL=authentication.js.map