@xeplr/auth 1.0.0 → 1.0.2

package/lib/adminRouter.js

@@ -1,6 +1,8 @@
 var express = require('express');
 var { generateId } = require('./authHelper');
 var { clearUserAccess, clearAccessRules } = require('./accessService');
+var authMiddleware = require('./authMiddleware');
+var hooks = require('./hooks');
 var User = require('../models/User');
 var Role = require('../models/Role');
 var Api = require('../models/Api');
@@ -12,8 +14,6 @@ var ApisRolesMapping = require('../models/ApisRolesMapping');
 var UiPagesRolesMapping = require('../models/UiPagesRolesMapping');
 var UiElementsRolesMapping = require('../models/UiElementsRolesMapping');
 var MenuRolesMapping = require('../models/MenuRolesMapping');
-var Tenant = require('../models/Tenant');
-var UserTenantsMapping = require('../models/UserTenantsMapping');
 
 // Group field names per type
 var GROUP_FIELDS = {
@@ -33,12 +33,15 @@ function isModuleGroup(group) {
 function createAdminRouter() {
   var router = express.Router();
 
+  // Every admin route requires a valid JWT — populates req.user (with roles).
+  router.use(authMiddleware);
+
   // ─── Users with their roles ───
   router.get('/users', async function(req, res) {
     try {
       var users = await User.query()
         .select('id', 'email', 'name', 'isActive', 'isActivated')
-        .withGraphFetched('[roles, tenants]');
+        .withGraphFetched('roles');
       res.json(users);
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -97,6 +100,7 @@ function createAdminRouter() {
       }
 
       await clearUserAccess(userId);
+      await hooks.fire('userRolesMapping', assign ? 'create' : 'delete', userId);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -143,6 +147,7 @@ function createAdminRouter() {
       }
 
       await clearAccessRules();
+      await hooks.fire(type + 'RolesMapping', assign ? 'create' : 'delete', itemId);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -162,10 +167,10 @@ function createAdminRouter() {
       var createdBy = req.user ? req.user.id : null;
 
       var types = [
-        { Model: Api, MappingModel: ApisRolesMapping, fk: 'apiId', groupField: 'apiGroup' },
-        { Model: UiPage, MappingModel: UiPagesRolesMapping, fk: 'uiPageId', groupField: 'uiPagesGroup' },
-        { Model: UiElement, MappingModel: UiElementsRolesMapping, fk: 'uiElementId', groupField: 'uiElementsGroup' },
-        { Model: Menu, MappingModel: MenuRolesMapping, fk: 'menuId', groupField: 'menuGroup' }
+        { type: 'apis', Model: Api, MappingModel: ApisRolesMapping, fk: 'apiId', groupField: 'apiGroup' },
+        { type: 'pages', Model: UiPage, MappingModel: UiPagesRolesMapping, fk: 'uiPageId', groupField: 'uiPagesGroup' },
+        { type: 'elements', Model: UiElement, MappingModel: UiElementsRolesMapping, fk: 'uiElementId', groupField: 'uiElementsGroup' },
+        { type: 'menus', Model: Menu, MappingModel: MenuRolesMapping, fk: 'menuId', groupField: 'menuGroup' }
       ];
 
       var promises = types.map(async function(cfg) {
@@ -187,6 +192,8 @@ function createAdminRouter() {
           } else {
             await cfg.MappingModel.query().delete().where(itemWhere);
           }
+
+          await hooks.fire(cfg.type + 'RolesMapping', assign ? 'create' : 'delete', items[i].id);
         }
       });
 
@@ -215,10 +222,12 @@ function createAdminRouter() {
 
       if (id) {
         await Role.query().findById(id).patch({ name: name });
+        await hooks.fire('roles', 'update', id);
         res.json({ id: id });
       } else {
         var newId = generateId();
         await Role.query().insert({ id: newId, name: name });
+        await hooks.fire('roles', 'create', newId);
         res.json({ id: newId });
       }
     } catch (err) {
@@ -232,6 +241,7 @@ function createAdminRouter() {
       if (!id) return res.status(400).json({ error: 'id is required' });
       await Role.query().deleteById(id);
       await clearAccessRules();
+      await hooks.fire('roles', 'delete', id);
       res.json({ ok: true });
     } catch (err) {
       res.status(500).json({ error: 'Something went wrong' });
@@ -271,11 +281,13 @@ function createAdminRouter() {
 
         if (id) {
           await cfg.Model.query().findById(id).patch(data);
+          await hooks.fire(typeKey, 'update', id);
           res.json({ id: id });
         } else {
           var newId = generateId();
           data.id = newId;
           await cfg.Model.query().insert(data);
+          await hooks.fire(typeKey, 'create', newId);
           res.json({ id: newId });
         }
       } catch (err) {
@@ -289,6 +301,7 @@ function createAdminRouter() {
         if (!id) return res.status(400).json({ error: 'id is required' });
         await cfg.Model.query().deleteById(id);
         await clearAccessRules();
+        await hooks.fire(typeKey, 'delete', id);
         res.json({ ok: true });
       } catch (err) {
         res.status(500).json({ error: 'Something went wrong' });
@@ -296,91 +309,6 @@ function createAdminRouter() {
     });
   });
 
-  // ─── Tenants (Super Admin only) ───
-
-  function requireSuperAdmin(req, res, next) {
-    if (!req.user || !req.user.roles || req.user.roles.indexOf('Super Admin') === -1) {
-      return res.status(403).json({ error: 'Super Admin access required' });
-    }
-    next();
-  }
-
-  router.get('/tenants', requireSuperAdmin, async function(req, res) {
-    try {
-      var level = req.query.level ? parseInt(req.query.level) : null;
-      var query = Tenant.query().select('id', 'name', 'code', 'level', 'parentId', 'description');
-      if (level) query = query.where('level', level);
-      var tenants = await query;
-      res.json(tenants);
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
-  router.post('/tenants', requireSuperAdmin, async function(req, res) {
-    try {
-      var { id, name, code, level, parentId, description } = req.body;
-      if (!name) return res.status(400).json({ error: 'name is required' });
-
-      var data = { name: name };
-      if (code !== undefined) data.code = code;
-      if (level !== undefined) data.level = level;
-      if (parentId !== undefined) data.parentId = parentId;
-      if (description !== undefined) data.description = description;
-
-      if (id) {
-        await Tenant.query().findById(id).patch(data);
-        res.json({ id: id });
-      } else {
-        var newId = generateId();
-        data.id = newId;
-        await Tenant.query().insert(data);
-        res.json({ id: newId });
-      }
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
-  router.post('/tenants/delete', requireSuperAdmin, async function(req, res) {
-    try {
-      var { id } = req.body;
-      if (!id) return res.status(400).json({ error: 'id is required' });
-      await Tenant.query().findById(id).patch({ isActive: false });
-      res.json({ ok: true });
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
-  // Assign/unassign tenant to a user (via mapping table)
-  // Access controlled via Access Matrix (tenants:edit group), not hardcoded to Super Admin
-  router.post('/tenants/assign-user', async function(req, res) {
-    try {
-      var { userId, tenantId, assign } = req.body;
-      if (!userId || !tenantId) return res.status(400).json({ error: 'userId and tenantId are required' });
-
-      if (assign === false) {
-        await UserTenantsMapping.query().delete().where({ userId: userId, tenantId: tenantId });
-      } else {
-        var existing = await UserTenantsMapping.query().findOne({ userId: userId, tenantId: tenantId });
-        if (!existing) {
-          await UserTenantsMapping.query().insert({
-            id: generateId(),
-            userId: userId,
-            tenantId: tenantId,
-            recordCreatedBy: req.user ? req.user.id : null
-          });
-        }
-      }
-
-      await clearUserAccess(userId);
-      res.json({ ok: true });
-    } catch (err) {
-      res.status(500).json({ error: 'Something went wrong' });
-    }
-  });
-
   return router;
 }
 

package/lib/authHelper.js

@@ -16,7 +16,7 @@ function configure(config) {
 }
 
 function getSecret() {
-  return _config.jwtSecret || process.env.JWT_SECRET || 'change_me_in_production';
+  return _config.jwtSecret || process.env.AUTH_JWT_SECRET || 'change_me_in_production';
 }
 
 function generateId() {
@@ -35,10 +35,13 @@ async function comparePassword(password, hash) {
 }
 
 function generateAccessToken(user) {
+  // Caller is responsible for providing `roles` as an array of role names
+  // (see authService.login → withGraphFetched('roles'))
   const payload = {
     id: user.id,
     email: user.email,
-    name: user.name
+    name: user.name,
+    roles: Array.isArray(user.roles) ? user.roles : []
   };
   const expiresIn = _config.accessTokenExpiresIn || '15m';
   return jwt.sign(payload, getSecret(), { expiresIn });
@@ -52,6 +55,24 @@ function verifyToken(token) {
   return jwt.verify(token, getSecret());
 }
 
+// Verify the SIGNATURE but ignore expiry — the middleware decides on expiry
+// itself (so it can apply the tolerance window). Returns { decoded, signatureValid }.
+function decodeVerified(token) {
+  try {
+    return { decoded: jwt.verify(token, getSecret(), { ignoreExpiration: true }), signatureValid: true };
+  } catch (err) {
+    return { decoded: null, signatureValid: false };
+  }
+}
+
+// Grace window (seconds) during which an expired access token is still honored
+// and slid to a fresh one. 0 = strict (reject on expiry) = default / back-compat.
+function getToleranceSeconds() {
+  var t = _config.accessTokenToleranceSeconds;
+  if (t === undefined || t === null) t = parseInt(process.env.AUTH_ACCESS_TOKEN_TOLERANCE_SECONDS || '0', 10);
+  return (Number.isFinite(t) && t > 0) ? t : 0;
+}
+
 module.exports = {
   configure,
   generateId,
@@ -59,5 +80,7 @@ module.exports = {
   comparePassword,
   generateAccessToken,
   generateRefreshToken,
-  verifyToken
+  verifyToken,
+  decodeVerified,
+  getToleranceSeconds
 };

package/lib/authMiddleware.js

@@ -1,27 +1,53 @@
-const { verifyToken } = require('./authHelper');
-const { validateAccessToken } = require('./sessionService');
+const { decodeVerified, getToleranceSeconds } = require('./authHelper');
+const { validateAccessToken, slideAccessToken } = require('./sessionService');
+const { decide } = require('./tokenDecision');
 
+// The ONE place token logic lives. Order (from tokenDecision): signature →
+// revocation → expiry. Tolerance (ACCESS_TOKEN_TOLERANCE_SECONDS, default 0)
+// turns on the sliding refresh: an expired-but-recent token is served AND a
+// fresh token is attached to the response (X-New-Token), set BEFORE the handler
+// runs so it rides every response path. With tolerance 0 this is exactly the
+// old behavior (reject on expiry).
 async function authMiddleware(req, res, next) {
   const authHeader = req.headers.authorization;
-
   if (!authHeader || !authHeader.startsWith('Bearer ')) {
     return res.status(401).json({ error: 'No token provided' });
   }
-
   const token = authHeader.split(' ')[1];
 
-  // Step 1: Verify JWT signature + expiry
-  let decoded;
-  try {
-    decoded = verifyToken(token);
-  } catch (err) {
+  // Verify signature, ignore expiry (we decide on expiry ourselves).
+  const { decoded, signatureValid } = decodeVerified(token);
+
+  // Session liveness = the whitelist entry still exists (a logout deletes it).
+  // The entry outlives the token by `tolerance`, so it's present during grace.
+  const session = signatureValid ? await validateAccessToken(token) : null;
+
+  const decision = decide({
+    exp: decoded && decoded.exp,
+    now: Math.floor(Date.now() / 1000),
+    toleranceSeconds: getToleranceSeconds(),
+    sessionLive: !!session,
+    signatureValid: signatureValid
+  });
+
+  if (decision.action === 'reject') {
+    if (req.log) req.log.debug('auth reject: ' + decision.reason);
     return res.status(401).json({ error: 'Invalid or expired token' });
   }
 
-  // Step 2: Check Redis whitelist (token not revoked)
-  const session = await validateAccessToken(token);
-  if (!session) {
-    return res.status(401).json({ error: 'Session expired or revoked' });
+  if (decision.action === 'slide') {
+    // Serve the request but hand back a fresh token. Header set BEFORE next()
+    // → present on every response. A slide failure must not block a live
+    // session — fall through and serve with the (still-tolerated) old token.
+    try {
+      const newToken = await slideAccessToken(token, decoded);
+      if (newToken) {
+        res.setHeader('X-New-Token', newToken);
+        res.setHeader('Access-Control-Expose-Headers', 'X-New-Token');
+      }
+    } catch (err) {
+      if (req.log) req.log.error('slide failed: ' + err.message);
+    }
   }
 
   req.user = decoded;

package/lib/authRouter.js

@@ -1,10 +1,19 @@
 const express = require('express');
-const { register, activate, login, forgotPassword, resetPassword } = require('./authService');
+const FileUploader = require('@xeplr/utils/lib/fileUploader');
+const { register, activate, previewInvite, acceptInvite, login, forgotPassword, resetPassword, requestPhoneOtp, verifyPhoneOtp, getProfile, updateProfile, setProfilePic, changePassword } = require('./authService');
 const { getUserAccess } = require('./accessService');
 const { getSession, rotateSession, destroySession } = require('./sessionService');
+const { issueTicket } = require('./ticketService');
 const authMiddleware = require('./authMiddleware');
 const User = require('../models/User');
 
+// Avatar uploads — local disk by default (FileUploader's own default:
+// process.env.UPLOAD_DIR or ./uploads). Auth only persists the resulting
+// path on the user; serving it back over HTTP is the consuming app's concern
+// (same as any other uploaded asset), so wire a static route to the same
+// directory wherever it makes sense for your deployment.
+const avatarUploader = new FileUploader({ allowedTypes: ['image/*'], maxSize: 2 * 1024 * 1024 });
+
 function logError(req, err) {
   if (req.log) req.log.error(err.message, { stack: err.stack });
 }
@@ -39,7 +48,10 @@ function createAuthRouter(options = {}) {
         return res.status(400).json({ error: 'Activation token is required' });
       }
 
-      var result = await activate(token);
+      // Carried in the activation LINK and handed straight back — see
+      // authService.register. If a workflow is waiting on this person, this is
+      // the key that releases it.
+      var result = await activate(token, { workflowKey: req.query.workflowKey });
       res.json({ message: 'Account activated successfully', user: result });
     } catch (err) {
       logError(req, err);
@@ -47,6 +59,32 @@ function createAuthRouter(options = {}) {
     }
   });
 
+  router.get('/invite-preview', async function(req, res) {
+    try {
+      var token = req.query.token;
+      if (!token) return res.status(400).json({ error: 'Token is required' });
+      var info = await previewInvite(token);
+      res.json(info);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/invite-accept', async function(req, res) {
+    try {
+      const { token, name, password } = req.body;
+      if (!token || !password) {
+        return res.status(400).json({ error: 'Token and password are required' });
+      }
+      const result = await acceptInvite({ token, name, password });
+      res.json({ message: 'Invite accepted', user: result });
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
   router.post('/login', async function(req, res) {
     try {
       const { email, password } = req.body;
@@ -115,12 +153,20 @@ function createAuthRouter(options = {}) {
         return res.status(401).json({ error: 'Invalid or expired refresh token' });
       }
 
-      const user = await User.query().findById(session.userId);
+      const user = await User.query().findById(session.userId).withGraphFetched('roles');
       if (!user || !user.isActive) {
         return res.status(401).json({ error: 'Account not found or deactivated' });
       }
 
-      const result = await rotateSession(refreshToken, user);
+      // Pack role names so refreshed tokens carry the same role claims as login.
+      const tokenUser = {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        roles: (user.roles || []).map(function(r) { return r.name; })
+      };
+
+      const result = await rotateSession(refreshToken, tokenUser);
       if (!result) {
         return res.status(401).json({ error: 'Invalid or expired refresh token' });
       }
@@ -172,17 +218,103 @@ function createAuthRouter(options = {}) {
     }
   });
 
-  // Get tenants for the current logged-in user
-  router.get('/my-tenants', authMiddleware, async function(req, res) {
+  router.get('/profile', authMiddleware, async function(req, res) {
     try {
-      var user = await User.query().findById(req.user.id).withGraphFetched('tenants');
-      var tenants = (user && user.tenants) ? user.tenants : [];
-      res.json(tenants.map(function(t) {
-        return { id: t.id, name: t.name, code: t.code, description: t.description };
-      }));
+      const profile = await getProfile(req.user.id);
+      res.json(profile);
     } catch (err) {
       logError(req, err);
-      res.status(500).json({ error: 'Something went wrong' });
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.put('/profile', authMiddleware, async function(req, res) {
+    try {
+      const profile = await updateProfile(req.user.id, req.body);
+      res.json(profile);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/profile/avatar', authMiddleware, ...avatarUploader.single('avatar'), async function(req, res) {
+    try {
+      if (!req.file) return res.status(400).json({ error: 'avatar file is required' });
+      // Store just the generated filename — never the server's filesystem
+      // path (leaks server layout, and isn't meaningful once you swap disk
+      // storage for S3/etc). The app knows its own UPLOAD_DIR and however
+      // it serves it; it builds the actual URL from this filename.
+      const profile = await setProfilePic(req.user.id, req.file.filename);
+      res.json(profile);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/change-password', authMiddleware, async function(req, res) {
+    try {
+      const { oldPassword, newPassword } = req.body;
+      if (!oldPassword || !newPassword) {
+        return res.status(400).json({ error: 'oldPassword and newPassword are required' });
+      }
+      await changePassword(req.user.id, { oldPassword, newPassword });
+      res.json({ message: 'Password changed. Please log in again.' });
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  // Additive phone verification — like email activation, but for a phone
+  // number attached to an already-authenticated account. Body: { phoneNumber }
+  // optional (omit to re-send to the number already on file).
+  router.post('/request-phone-otp', authMiddleware, async function(req, res) {
+    try {
+      const result = await requestPhoneOtp(req.user.id, req.body.phoneNumber);
+      res.json(result);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/verify-phone-otp', authMiddleware, async function(req, res) {
+    try {
+      if (!req.body.code) return res.status(400).json({ error: 'code is required' });
+      const result = await verifyPhoneOtp(req.user.id, req.body.code);
+      res.json(result);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  // ── SSE ticket ────────────────────────────────────────────────────────
+  //
+  // Mints a short-lived, single-use ticket so a browser can open an
+  // EventSource without leaking the primary session token in the URL.
+  //
+  // Body (optional):
+  //   { scopes: [...] }   — client-requested scopes. If omitted, defaults
+  //                         to the user's own namespace (['user:me:*']).
+  //                         Whatever is minted here is what the SSE server
+  //                         will enforce at subscribe time.
+  //
+  // NOTE the scopes are advisory intent — the SSE handler owns the final
+  // authorization check (see xeplr-base-apis/lib/sse.js#createHandler).
+  router.post('/sse-ticket', authMiddleware, async function(req, res) {
+    try {
+      var requested = (req.body && Array.isArray(req.body.scopes)) ? req.body.scopes : ['user:me:*'];
+      var { ticket, expiresIn } = await issueTicket({
+        userId: req.user.id,
+        scopes: requested
+      });
+      res.json({ ticket: ticket, expiresIn: expiresIn });
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Failed to mint SSE ticket' });
     }
   });