@webda/core 4.0.0-beta.2 → 4.0.0-beta.4

package/lib/services/token.service.js

@@ -0,0 +1,182 @@
+import { createHash, randomBytes } from "node:crypto";
+import { getUuid } from "@webda/utils";
+import * as WebdaError from "../errors/errors.js";
+import { Service } from "./service.js";
+import { ServiceParameters } from "./serviceparameters.js";
+import { useCrypto } from "./cryptoservice.service.js";
+import { RefreshToken } from "../models/refreshtoken.model.js";
+import { Session } from "../session/session.js";
+const ACCESS_AUDIENCE = "webda-access";
+/** Raised for unknown, expired, revoked or reused tokens (403 TOKEN_INVALID) */
+export class TokenInvalid extends WebdaError.HttpError {
+    /** @param message - error message */
+    constructor(message = "Invalid token") {
+        super(message, 403);
+    }
+}
+/** TokenService parameters */
+export class TokenServiceParameters extends ServiceParameters {
+    /**
+     * Access token lifetime in seconds
+     * @default 900
+     */
+    accessTtl;
+    /**
+     * Refresh token lifetime in seconds
+     * @default 2592000
+     */
+    refreshTtl;
+    /**
+     * @param params - raw parameters
+     * @returns this
+     */
+    load(params = {}) {
+        super.load(params);
+        this.accessTtl ??= 900;
+        this.refreshTtl ??= 2592000;
+        return this;
+    }
+}
+/**
+ * Issues access tokens (JWT) and rotating refresh tokens
+ * @WebdaModda TokenService
+ */
+export class TokenService extends Service {
+    /**
+     * @param token - raw refresh token
+     * @returns SHA-256 hex
+     */
+    hash(token) {
+        return createHash("sha256").update(token).digest("hex");
+    }
+    /**
+     * Issue an access + refresh token pair for a logged session
+     *
+     * Roles are not persisted: refreshed access tokens carry no roles until they are re-derived.
+     * @param session - logged session (must not be anonymous nor pending MFA)
+     * @param family - existing family when rotating
+     * @returns the tokens
+     */
+    async issue(session, family = getUuid("base64")) {
+        if (!session.isLogged()) {
+            throw new TokenInvalid("Session is not fully authenticated");
+        }
+        const refreshToken = randomBytes(32).toString("base64url");
+        await RefreshToken.create({
+            hash: this.hash(refreshToken),
+            userId: session.userId,
+            identId: session.identUsed,
+            provider: session.provider,
+            amr: session.amr ?? [],
+            mfa: session.mfa ?? "none",
+            family,
+            expiresAt: Date.now() + this.parameters.refreshTtl * 1000
+        });
+        session.refreshFamily = family;
+        // A refreshed session is re-authenticated by its (unrevoked) refresh token
+        session.authAt ??= Date.now();
+        const claims = {
+            sub: session.userId,
+            ident: session.identUsed,
+            provider: session.provider,
+            amr: session.amr ?? [],
+            roles: session.roles,
+            fam: family,
+            mfa: session.mfa ?? "none",
+            authAt: session.authAt
+        };
+        const accessToken = await useCrypto().jwtSign(claims, {
+            audience: ACCESS_AUDIENCE,
+            expiresIn: this.parameters.accessTtl
+        });
+        return { accessToken, refreshToken, expiresIn: this.parameters.accessTtl };
+    }
+    /**
+     * @param token - access token
+     * @returns claims, or undefined when invalid/expired
+     */
+    async verifyAccess(token) {
+        try {
+            return await useCrypto().jwtVerify(token, { audience: ACCESS_AUDIENCE });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Exchange a refresh token (rotation with reuse detection)
+     *
+     * The token is only ever looked up by its hash, so an access token or any
+     * arbitrary string simply does not match a stored record.
+     * @param refreshToken - raw refresh token
+     * @returns new tokens and the rebuilt session
+     */
+    async refresh(refreshToken) {
+        if (typeof refreshToken !== "string" || !refreshToken) {
+            throw new TokenInvalid();
+        }
+        const ref = RefreshToken.ref({ hash: this.hash(refreshToken) });
+        if (!(await ref.exists())) {
+            throw new TokenInvalid();
+        }
+        const stored = await ref.get();
+        if (stored.revokedAt || stored.expiresAt < Date.now()) {
+            throw new TokenInvalid();
+        }
+        if (stored.rotatedAt) {
+            await this.revokeFamily(stored.family);
+            throw new TokenInvalid("Refresh token reused");
+        }
+        // Compare-and-set: only one caller can move rotatedAt from undefined to a value
+        try {
+            await ref.patch({ rotatedAt: Date.now() }, "rotatedAt", undefined);
+        }
+        catch (err) {
+            if (!this.isConditionFailure(err)) {
+                throw err;
+            }
+            // Lost the race: treat as reuse and kill the family
+            await this.revokeFamily(stored.family);
+            throw new TokenInvalid("Refresh token reused");
+        }
+        const session = new Session();
+        session.login(stored.userId, stored.identId, {
+            provider: stored.provider,
+            amr: stored.amr,
+            mfa: stored.mfa ?? "none"
+        });
+        const tokens = await this.issue(session, stored.family);
+        // A revocation may have run between our read and the issue: its scan would have missed the new record
+        for await (const _ of RefreshToken.iterate("family = ? AND revokedAt IS NOT NULL LIMIT 1", [stored.family])) {
+            await RefreshToken.ref({ hash: this.hash(tokens.refreshToken) }).patch({
+                revokedAt: Date.now()
+            });
+            throw new TokenInvalid("Refresh token revoked");
+        }
+        return { ...tokens, session };
+    }
+    /**
+     * @param err - error thrown by a conditional write
+     * @returns true if the error is a failed write condition
+     */
+    isConditionFailure(err) {
+        return /condition/i.test(`${err?.name} ${err?.message}`);
+    }
+    /**
+     * @param family - family to revoke
+     */
+    async revokeFamily(family) {
+        for await (const token of RefreshToken.iterate("family = ? AND revokedAt IS NULL", [family])) {
+            await token.ref().patch({ revokedAt: Date.now() });
+        }
+    }
+    /**
+     * @param userId - user whose tokens are revoked
+     */
+    async revokeUser(userId) {
+        for await (const token of RefreshToken.iterate("userId = ? AND revokedAt IS NULL", [userId])) {
+            await token.ref().patch({ revokedAt: Date.now() });
+        }
+    }
+}
+//# sourceMappingURL=token.service.js.map

package/lib/services/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,UAAU,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAY,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,gFAAgF;AAChF,MAAM,OAAO,YAAa,SAAQ,UAAU,CAAC,SAAS;IACpD,qCAAqC;IACrC,YAAY,OAAO,GAAW,eAAe;QAC3C,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;CACF;AAsBD,8BAA8B;AAC9B,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAC3D;;;OAGG;IACH,SAAS,CAAS;IAClB;;;OAGG;IACH,UAAU,CAAS;IAEnB;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC;QACvB,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,YAAwE,SAAQ,OAAU;IACrG;;;OAGG;IACO,IAAI,CAAC,KAAa;QAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,MAAM,GAAW,OAAO,CAAC,QAAQ,CAAC;QAC9D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CAAC,oCAAoC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;YAC1B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI;SACnD,CAAC,CAAC;QACV,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;QAC/B,2EAA2E;QAC3E,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,OAAO,CAAC,MAAM;YACnB,KAAK,EAAE,OAAO,CAAC,SAAS;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;YACpD,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAS,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAiB,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,EAAE,WAAkB,EAAE,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,oDAAoD;YACpD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE;YAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,sGAAsG;QACtG,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,8CAA8C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5G,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAS,CAAC,CAAC,KAAK,CAAC;gBAC5E,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACf,CAAC,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;;OAGG;IACO,kBAAkB,CAAC,GAAQ;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAS,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;CACF"}

package/lib/{utils → session}/cookie.d.ts

@@ -1,11 +1,12 @@
-import { type SerializeOptions } from "cookie";
-import { JWTOptions } from "../services/cryptoservice.js";
-import { WebContext } from "./context.js";
-import { HttpContext } from "./httpcontext.js";
+import { type SerializeOptions as CookieSerializeOptions } from "cookie";
+import type { JWTOptions } from "../services/icryptoservice.js";
+import type { HttpContext } from "../contexts/httpcontext.js";
+import { IWebContext } from "../contexts/icontext.js";
+import { Duration } from "@webda/utils";
 /**
  * Cookie Options
  */
-export declare class CookieOptions implements Omit<SerializeOptions, "domain"> {
+export declare class CookieOptions implements Omit<CookieSerializeOptions, "domain"> {
     /**
      * @default lax
      */
@@ -18,11 +19,20 @@ export declare class CookieOptions implements Omit<SerializeOptions, "domain"> {
      * When provided a domain is setting the cookie to be available to all subdomains
      */
     domain?: string | true;
+    /**
+     * Duration storage
+     */
+    _maxAge?: Duration;
     /**
      * @minimum 1
-     * @default 86400 * 7
+     * @default 7d
+     */
+    set maxAge(value: string | number);
+    /**
+     * Get the max age in seconds, defaulting to 7 days
+     * @returns the result number
      */
-    maxAge?: number;
+    get maxAge(): number;
     /**
      * @default /
      */
@@ -34,6 +44,7 @@ export declare class CookieOptions implements Omit<SerializeOptions, "domain"> {
     /**
      * If not set will be true if https request and false otherwise
      * If defined it will be set to the value
+     * @default undefined
      */
     secure?: boolean;
     /**
@@ -42,8 +53,8 @@ export declare class CookieOptions implements Omit<SerializeOptions, "domain"> {
     name?: string;
     /**
      * Load with default value
-     * @param options
-     * @param httpContext
+     * @param options - the options
+     * @param httpContext - the HTTP context
      */
     constructor(options: Partial<CookieOptions>, httpContext?: HttpContext);
 }
@@ -69,20 +80,22 @@ export declare class SecureCookie {
      * It manages the split of the cookie to 4096 if required
      *
      * @param name cookie name
-     * @param options
-     * @param context
-     * @returns
+     * @param options - the options
+     * @param context - the execution context
+     * @param session - the session object
+     * @returns the result
      */
-    static load(name: string, context: WebContext, options?: JWTOptions): Promise<any>;
+    static load(name: string, session: object, context: IWebContext, options?: JWTOptions): Promise<any>;
     /**
      * Send a cookie, split it if required
      *
-     * @param name
-     * @param context
-     * @param data
-     * @param options
+     * @param name - the name to use
+     * @param context - the execution context
+     * @param data - the data to process
+     * @param options - the options
+     * @param cookieOptions - the cookie options
      */
-    static save(name: string, context: WebContext, data: any, options?: JWTOptions, cookieOptions?: Partial<CookieOptions>): Promise<void>;
+    static save(name: string, context: IWebContext, data: any, options?: JWTOptions, cookieOptions?: Partial<CookieOptions>): Promise<void>;
     /**
      * Will send the cookie to context and split it
      * if needed as max length for cookies are 4096
@@ -93,6 +106,6 @@ export declare class SecureCookie {
      * @param value of the cookie
      * @param params for the cookie
      */
-    static sendCookie(ctx: WebContext, name: string, value: string, params: CookieOptions): void;
+    static sendCookie(ctx: IWebContext, name: string, value: string, params: CookieOptions): void;
 }
 //# sourceMappingURL=cookie.d.ts.map

package/lib/session/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,IAAI,sBAAsB,EAAgC,MAAM,QAAQ,CAAC;AACvG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAgB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGpE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAQxC;;GAEG;AACH,qBAAa,aAAc,YAAW,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC;IAC1E;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACrC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;OAEG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB;;;OAGG;IACH,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAEhC;IACD;;;OAGG;IACH,IAAI,MAAM,IAAK,MAAM,CAEpB;IACD;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,YAAY,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,EAAE,WAAW,EAarE;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAY;IACvB;;;;;;;;;;OAUG;IACH,OAAa,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,UAAU,gBAgC1F;IAED;;;;;;;;OAQG;IACH,OAAa,IAAI,CACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,GAAG,EACT,OAAO,CAAC,EAAE,UAAU,EACpB,aAAa,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,iBAIvC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,QAgBrF;CACF"}

package/lib/{utils → session}/cookie.js

@@ -1,4 +1,8 @@
 import { serialize as cookieSerialize } from "cookie";
+import { isWebContext } from "../contexts/icontext.js";
+import { useCrypto } from "../services/cryptoservice.service.js";
+import { useLog } from "../loggers/hooks.js";
+import { Duration } from "@webda/utils";
 /**
  * Cookie cannot be more than 4096, so we split them by this constant
  * @hidden
@@ -8,23 +12,71 @@ const SPLIT = 4096;
  * Cookie Options
  */
 export class CookieOptions {
+    /**
+     * @default lax
+     */
+    sameSite;
+    /**
+     * if true domain will be set to the request hostname
+     * if undefined no domain will be output (browser will use the current domain and only this one)
+     * if a string is provided it will be used as the domain
+     *
+     * When provided a domain is setting the cookie to be available to all subdomains
+     */
+    domain;
+    /**
+     * Duration storage
+     */
+    _maxAge;
+    /**
+     * @minimum 1
+     * @default 7d
+     */
+    set maxAge(value) {
+        this._maxAge = new Duration(value);
+    }
+    /**
+     * Get the max age in seconds, defaulting to 7 days
+     * @returns the result number
+     */
+    get maxAge() {
+        return this._maxAge?.toSeconds() ?? 86400 * 7;
+    }
+    /**
+     * @default /
+     */
+    path;
+    /**
+     * @default true
+     */
+    httpOnly;
+    /**
+     * If not set will be true if https request and false otherwise
+     * If defined it will be set to the value
+     * @default undefined
+     */
+    secure;
+    /**
+     * Name of the cookie
+     */
+    name;
     /**
      * Load with default value
-     * @param options
-     * @param httpContext
+     * @param options - the options
+     * @param httpContext - the HTTP context
      */
     constructor(options, httpContext) {
         Object.assign(this, options);
-        this.httpOnly ?? (this.httpOnly = true);
-        this.path ?? (this.path = "/");
-        this.maxAge ?? (this.maxAge = 86400 * 7);
-        this.sameSite ?? (this.sameSite = "lax");
-        this.name ?? (this.name = "webda");
+        this.httpOnly ??= true;
+        this.path ??= "/";
+        this.maxAge ??= 86400 * 7;
+        this.sameSite ??= "lax";
+        this.name ??= "webda";
         if (httpContext) {
             if (this.domain === true) {
                 this.domain = httpContext.getHostName();
             }
-            this.secure ?? (this.secure = httpContext.getProtocol() === "https:");
+            this.secure ??= httpContext.getProtocol() === "https:";
         }
     }
 }
@@ -50,17 +102,17 @@ export class SecureCookie {
      * It manages the split of the cookie to 4096 if required
      *
      * @param name cookie name
-     * @param options
-     * @param context
-     * @returns
+     * @param options - the options
+     * @param context - the execution context
+     * @param session - the session object
+     * @returns the result
      */
-    static async load(name, context, options) {
+    static async load(name, session, context, options) {
         let cookies = {};
         let raw = "";
-        const session = await context.newSession();
-        name ?? (name = "webda");
+        name ??= "webda";
         // No http context
-        if (!context.getHttpContext()) {
+        if (!isWebContext(context)) {
             return session;
         }
         cookies = context.getHttpContext().getCookies();
@@ -78,23 +130,24 @@ export class SecureCookie {
             return session;
         }
         try {
-            return Object.assign(session, await context.getWebda().getCrypto().jwtVerify(raw, options));
+            return Object.assign(session, await useCrypto().jwtVerify(raw, options));
         }
         catch (err) {
-            context.log("WARN", "Ignoring bad cookie", `'${raw}'`, "from", context.getHttpContext());
+            useLog("WARN", "Ignoring bad cookie", `'${raw}'`, "from", context.getHttpContext());
             return session;
         }
     }
     /**
      * Send a cookie, split it if required
      *
-     * @param name
-     * @param context
-     * @param data
-     * @param options
+     * @param name - the name to use
+     * @param context - the execution context
+     * @param data - the data to process
+     * @param options - the options
+     * @param cookieOptions - the cookie options
      */
     static async save(name, context, data, options, cookieOptions) {
-        const value = await context.getWebda().getCrypto().jwtSign(Object.assign({}, data), options);
+        const value = await useCrypto().jwtSign(Object.assign({}, data), options);
         this.sendCookie(context, name, value, new CookieOptions(cookieOptions, context.getHttpContext()));
     }
     /**
@@ -109,7 +162,7 @@ export class SecureCookie {
      */
     static sendCookie(ctx, name, value, params) {
         let j = 1;
-        name ?? (name = "webda");
+        name ??= "webda";
         let cookieName = name;
         let limit;
         const mapLength = cookieSerialize(name, "", params).length;

package/lib/session/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/session/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmD,SAAS,IAAI,eAAe,EAAE,MAAM,QAAQ,CAAC;AAGvG,OAAO,EAAE,YAAY,EAAe,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC;;;GAGG;AACH,MAAM,KAAK,GAAG,IAAI,CAAC;AAEnB;;GAEG;AACH,MAAM,OAAO,aAAa;IACxB;;OAEG;IACH,QAAQ,CAA6B;IACrC;;;;;;OAMG;IACH,MAAM,CAAiB;IAEvB;;OAEG;IACH,OAAO,CAAY;IACnB;;;OAGG;IACH,IAAI,MAAM,CAAC,KAAsB;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD;;;OAGG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC;IAChD,CAAC;IACD;;OAEG;IACH,IAAI,CAAU;IACd;;OAEG;IACH,QAAQ,CAAW;IACnB;;;;OAIG;IACH,MAAM,CAAW;IACjB;;OAEG;IACH,IAAI,CAAU;IAEd;;;;OAIG;IACH,YAAY,OAA+B,EAAE,WAAyB;QACpE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC;QAClB,IAAI,CAAC,MAAM,KAAK,KAAK,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC;QACxB,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;QACtB,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAY;IACvB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAoB,EAAE,OAAoB;QACzF,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,OAAO,CAAC;QAEjB,kBAAkB;QAClB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,IAAI,UAAU,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC3B,UAAU,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YACpF,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,IAAY,EACZ,OAAoB,EACpB,IAAS,EACT,OAAoB,EACpB,aAAsC;QAEtC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,GAAgB,EAAE,IAAY,EAAE,KAAa,EAAE,MAAqB;QACpF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,KAAK,OAAO,CAAC;QACjB,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,IAAI,KAAK,CAAC;QACV,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,EAA0B,MAAM,CAAC,CAAC,MAAM,CAAC;QACnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAI,CAAC;YACnC,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACV,UAAU,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,EAAE,CAAC;YACV,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC,EAAE,CAAC;YACJ,CAAC,IAAI,KAAK,CAAC;QACb,CAAC;IACH,CAAC;CACF"}

package/lib/session/manager.model.d.ts

@@ -0,0 +1,87 @@
+import type { CryptoService } from "../services/cryptoservice.service.js";
+import { JWTOptions } from "../services/icryptoservice.js";
+import { Service } from "../services/service.js";
+import { CookieOptions } from "./cookie.js";
+import { Context } from "../contexts/icontext.js";
+import { ServiceParameters } from "../services/serviceparameters.js";
+import { Session } from "./session.js";
+import { type ModelClass, type Repository, UuidModel } from "@webda/models";
+/**
+ * Manage load and save of sessions
+ */
+export declare abstract class SessionManager<T extends ServiceParameters = ServiceParameters> extends Service<T> {
+    /**
+     * Load a session based on context
+     * @param context
+     */
+    abstract load(context: Context): Promise<Session>;
+    /**
+     * Save the session within the context
+     * @param context
+     * @param session
+     */
+    abstract save(context: Context, session: Session): Promise<void>;
+    /**
+     * Build a stateless session from an access token (any transport)
+     * @param context - the context
+     * @param token - access token
+     * @returns the session, anonymous when the token is invalid
+     */
+    loadFromToken(context: Context, token: string): Promise<Session>;
+    /**
+     * Whether the user of an authenticated session changed their password after the session was authenticated
+     *
+     * Costs one user read (through the registered user resolver) per load of a session carrying `authAt`. A failing
+     * read counts as outdated: the session is then anonymous for that request.
+     * @param session - loaded session
+     * @returns true when the session must be treated as anonymous
+     */
+    protected isOutdated(session: Session): Promise<boolean>;
+}
+/** Persistent session data stored in a model with a TTL */
+export declare class SessionModel extends UuidModel {
+    ttl: number;
+    session: any;
+    /** Create a new SessionModel
+     * @param data - the session data
+     */
+    constructor(data: any);
+}
+/** Parameters for the cookie-based session manager */
+export declare class CookieSessionParameters extends ServiceParameters {
+    /**
+     * Options for issue JWT token
+     */
+    jwt?: JWTOptions;
+    /**
+     * Cookie configuration for session
+     */
+    cookie?: CookieOptions;
+    /**
+     * Load parameters and initialize cookie options
+     * @param params - the service parameters
+     * @returns this for chaining
+     */
+    load(params?: any): this;
+}
+/**
+ * SessionManager that store info in a cookie
+ *
+ * If SessionStore service exists, only uuid is in the cookie
+ * the rest of data is stored within the session store
+ *
+ * @WebdaModda
+ */
+export declare class CookieSessionManager<T extends CookieSessionParameters = CookieSessionParameters> extends SessionManager<T> {
+    cryptoService: CryptoService;
+    sessionModel: Repository<ModelClass<SessionModel>>;
+    /**
+     * @override
+     */
+    load(context: Context): Promise<Session>;
+    /**
+     * @override
+     */
+    save(context: Context, session: Session): Promise<void>;
+}
+//# sourceMappingURL=manager.model.d.ts.map

package/lib/session/manager.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;IAED;;;;;;;OAOG;IACH,UAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY7D;CACF;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBAgC5C;CACF"}