@xeplr/auth 1.0.0

package/lib/adminRouter.js

@@ -0,0 +1,387 @@
+var express = require('express');
+var { generateId } = require('./authHelper');
+var { clearUserAccess, clearAccessRules } = require('./accessService');
+var User = require('../models/User');
+var Role = require('../models/Role');
+var Api = require('../models/Api');
+var UiPage = require('../models/UiPage');
+var UiElement = require('../models/UiElement');
+var Menu = require('../models/Menu');
+var UserRolesMapping = require('../models/UserRolesMapping');
+var ApisRolesMapping = require('../models/ApisRolesMapping');
+var UiPagesRolesMapping = require('../models/UiPagesRolesMapping');
+var UiElementsRolesMapping = require('../models/UiElementsRolesMapping');
+var MenuRolesMapping = require('../models/MenuRolesMapping');
+var Tenant = require('../models/Tenant');
+var UserTenantsMapping = require('../models/UserTenantsMapping');
+
+// Group field names per type
+var GROUP_FIELDS = {
+  apis: 'apiGroup',
+  pages: 'uiPagesGroup',
+  elements: 'uiElementsGroup',
+  menus: 'menuGroup'
+};
+
+// Checks if a group value follows the module:action convention
+function isModuleGroup(group) {
+  if (!group) return false;
+  var parts = group.split(':');
+  return parts.length === 2 && parts[0] && parts[1];
+}
+
+function createAdminRouter() {
+  var router = express.Router();
+
+  // ─── Users with their roles ───
+  router.get('/users', async function(req, res) {
+    try {
+      var users = await User.query()
+        .select('id', 'email', 'name', 'isActive', 'isActivated')
+        .withGraphFetched('[roles, tenants]');
+      res.json(users);
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Roles ───
+  router.get('/roles', async function(req, res) {
+    try {
+      var roles = await Role.query().select('id', 'name');
+      res.json(roles);
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Access items (apis, pages, elements, menus) with role mappings ───
+  router.get('/access-items', async function(req, res) {
+    try {
+      var [apis, pages, elements, menus] = await Promise.all([
+        Api.query().select('id', 'name', 'apiGroup', 'isPublic').withGraphFetched('roles'),
+        UiPage.query().select('id', 'name', 'uiPagesGroup', 'isPublic').withGraphFetched('roles'),
+        UiElement.query().select('id', 'name', 'uiElementsGroup').withGraphFetched('roles'),
+        Menu.query().select('id', 'name', 'menuGroup', 'isPublic').withGraphFetched('roles')
+      ]);
+      res.json({ apis, pages, elements, menus });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Toggle user-role mapping ───
+  router.post('/user-role', async function(req, res) {
+    try {
+      var { userId, roleId, assign } = req.body;
+
+      if (!userId || !roleId) {
+        return res.status(400).json({ error: 'userId and roleId are required' });
+      }
+
+      if (assign) {
+        var existing = await UserRolesMapping.query()
+          .findOne({ userId: userId, roleId: roleId });
+        if (!existing) {
+          await UserRolesMapping.query().insert({
+            id: generateId(),
+            userId: userId,
+            roleId: roleId,
+            recordCreatedBy: req.user ? req.user.id : null
+          });
+        }
+      } else {
+        await UserRolesMapping.query()
+          .delete()
+          .where({ userId: userId, roleId: roleId });
+      }
+
+      await clearUserAccess(userId);
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Toggle access-role mapping (single item) ───
+  router.post('/access-role', async function(req, res) {
+    try {
+      var { type, itemId, roleId, assign } = req.body;
+
+      if (!type || !itemId || !roleId) {
+        return res.status(400).json({ error: 'type, itemId, and roleId are required' });
+      }
+
+      var config = {
+        apis: { Model: ApisRolesMapping, fk: 'apiId' },
+        pages: { Model: UiPagesRolesMapping, fk: 'uiPageId' },
+        elements: { Model: UiElementsRolesMapping, fk: 'uiElementId' },
+        menus: { Model: MenuRolesMapping, fk: 'menuId' }
+      };
+
+      var mapping = config[type];
+      if (!mapping) {
+        return res.status(400).json({ error: 'Invalid type. Use: apis, pages, elements, menus' });
+      }
+
+      var where = { roleId: roleId };
+      where[mapping.fk] = itemId;
+
+      if (assign) {
+        var existing = await mapping.Model.query().findOne(where);
+        if (!existing) {
+          var row = {
+            id: generateId(),
+            roleId: roleId,
+            recordCreatedBy: req.user ? req.user.id : null
+          };
+          row[mapping.fk] = itemId;
+          await mapping.Model.query().insert(row);
+        }
+      } else {
+        await mapping.Model.query().delete().where(where);
+      }
+
+      await clearAccessRules();
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Toggle module:action for a role (bulk — toggles all items with that group across all types) ───
+  router.post('/module-role', async function(req, res) {
+    try {
+      var { module: moduleName, action, roleId, assign } = req.body;
+
+      if (!moduleName || !action || !roleId) {
+        return res.status(400).json({ error: 'module, action, and roleId are required' });
+      }
+
+      var groupValue = moduleName + ':' + action;
+      var createdBy = req.user ? req.user.id : null;
+
+      var types = [
+        { Model: Api, MappingModel: ApisRolesMapping, fk: 'apiId', groupField: 'apiGroup' },
+        { Model: UiPage, MappingModel: UiPagesRolesMapping, fk: 'uiPageId', groupField: 'uiPagesGroup' },
+        { Model: UiElement, MappingModel: UiElementsRolesMapping, fk: 'uiElementId', groupField: 'uiElementsGroup' },
+        { Model: Menu, MappingModel: MenuRolesMapping, fk: 'menuId', groupField: 'menuGroup' }
+      ];
+
+      var promises = types.map(async function(cfg) {
+        var where = {};
+        where[cfg.groupField] = groupValue;
+        var items = await cfg.Model.query().select('id').where(where);
+
+        for (var i = 0; i < items.length; i++) {
+          var itemWhere = { roleId: roleId };
+          itemWhere[cfg.fk] = items[i].id;
+
+          if (assign) {
+            var existing = await cfg.MappingModel.query().findOne(itemWhere);
+            if (!existing) {
+              var row = { id: generateId(), roleId: roleId, recordCreatedBy: createdBy };
+              row[cfg.fk] = items[i].id;
+              await cfg.MappingModel.query().insert(row);
+            }
+          } else {
+            await cfg.MappingModel.query().delete().where(itemWhere);
+          }
+        }
+      });
+
+      await Promise.all(promises);
+      await clearAccessRules();
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Master CRUD: Roles ───
+  router.get('/master/roles', async function(req, res) {
+    try {
+      var items = await Role.query().select('id', 'name');
+      res.json(items);
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/master/roles', async function(req, res) {
+    try {
+      var { id, name } = req.body;
+      if (!name) return res.status(400).json({ error: 'name is required' });
+
+      if (id) {
+        await Role.query().findById(id).patch({ name: name });
+        res.json({ id: id });
+      } else {
+        var newId = generateId();
+        await Role.query().insert({ id: newId, name: name });
+        res.json({ id: newId });
+      }
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/master/roles/delete', async function(req, res) {
+    try {
+      var { id } = req.body;
+      if (!id) return res.status(400).json({ error: 'id is required' });
+      await Role.query().deleteById(id);
+      await clearAccessRules();
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // ─── Master CRUD factory for APIs, Pages, Elements, Menus ───
+  var masterTypes = {
+    apis:     { Model: Api, fields: ['name', 'apiGroup', 'isPublic'] },
+    pages:    { Model: UiPage, fields: ['name', 'uiPagesGroup', 'isPublic'] },
+    elements: { Model: UiElement, fields: ['name', 'uiElementsGroup'] },
+    menus:    { Model: Menu, fields: ['name', 'menuGroup', 'isPublic'] }
+  };
+
+  Object.keys(masterTypes).forEach(function(typeKey) {
+    var cfg = masterTypes[typeKey];
+
+    router.get('/master/' + typeKey, async function(req, res) {
+      try {
+        var selectFields = ['id'].concat(cfg.fields);
+        var items = await cfg.Model.query().select(selectFields);
+        res.json(items);
+      } catch (err) {
+        res.status(500).json({ error: 'Something went wrong' });
+      }
+    });
+
+    router.post('/master/' + typeKey, async function(req, res) {
+      try {
+        var id = req.body.id;
+        var data = {};
+        cfg.fields.forEach(function(f) {
+          if (req.body[f] !== undefined) data[f] = req.body[f];
+        });
+
+        if (!data.name) return res.status(400).json({ error: 'name is required' });
+
+        if (id) {
+          await cfg.Model.query().findById(id).patch(data);
+          res.json({ id: id });
+        } else {
+          var newId = generateId();
+          data.id = newId;
+          await cfg.Model.query().insert(data);
+          res.json({ id: newId });
+        }
+      } catch (err) {
+        res.status(500).json({ error: 'Something went wrong' });
+      }
+    });
+
+    router.post('/master/' + typeKey + '/delete', async function(req, res) {
+      try {
+        var id = req.body.id;
+        if (!id) return res.status(400).json({ error: 'id is required' });
+        await cfg.Model.query().deleteById(id);
+        await clearAccessRules();
+        res.json({ ok: true });
+      } catch (err) {
+        res.status(500).json({ error: 'Something went wrong' });
+      }
+    });
+  });
+
+  // ─── Tenants (Super Admin only) ───
+
+  function requireSuperAdmin(req, res, next) {
+    if (!req.user || !req.user.roles || req.user.roles.indexOf('Super Admin') === -1) {
+      return res.status(403).json({ error: 'Super Admin access required' });
+    }
+    next();
+  }
+
+  router.get('/tenants', requireSuperAdmin, async function(req, res) {
+    try {
+      var level = req.query.level ? parseInt(req.query.level) : null;
+      var query = Tenant.query().select('id', 'name', 'code', 'level', 'parentId', 'description');
+      if (level) query = query.where('level', level);
+      var tenants = await query;
+      res.json(tenants);
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/tenants', requireSuperAdmin, async function(req, res) {
+    try {
+      var { id, name, code, level, parentId, description } = req.body;
+      if (!name) return res.status(400).json({ error: 'name is required' });
+
+      var data = { name: name };
+      if (code !== undefined) data.code = code;
+      if (level !== undefined) data.level = level;
+      if (parentId !== undefined) data.parentId = parentId;
+      if (description !== undefined) data.description = description;
+
+      if (id) {
+        await Tenant.query().findById(id).patch(data);
+        res.json({ id: id });
+      } else {
+        var newId = generateId();
+        data.id = newId;
+        await Tenant.query().insert(data);
+        res.json({ id: newId });
+      }
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/tenants/delete', requireSuperAdmin, async function(req, res) {
+    try {
+      var { id } = req.body;
+      if (!id) return res.status(400).json({ error: 'id is required' });
+      await Tenant.query().findById(id).patch({ isActive: false });
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // Assign/unassign tenant to a user (via mapping table)
+  // Access controlled via Access Matrix (tenants:edit group), not hardcoded to Super Admin
+  router.post('/tenants/assign-user', async function(req, res) {
+    try {
+      var { userId, tenantId, assign } = req.body;
+      if (!userId || !tenantId) return res.status(400).json({ error: 'userId and tenantId are required' });
+
+      if (assign === false) {
+        await UserTenantsMapping.query().delete().where({ userId: userId, tenantId: tenantId });
+      } else {
+        var existing = await UserTenantsMapping.query().findOne({ userId: userId, tenantId: tenantId });
+        if (!existing) {
+          await UserTenantsMapping.query().insert({
+            id: generateId(),
+            userId: userId,
+            tenantId: tenantId,
+            recordCreatedBy: req.user ? req.user.id : null
+          });
+        }
+      }
+
+      await clearUserAccess(userId);
+      res.json({ ok: true });
+    } catch (err) {
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  return router;
+}
+
+module.exports = createAdminRouter;

package/lib/authHelper.js

@@ -0,0 +1,63 @@
+const crypto = require('crypto');
+const bcrypt = require('bcrypt');
+const jwt = require('jsonwebtoken');
+
+let _config = {};
+
+/**
+ * Configure auth helper.
+ * @param {object} config
+ * @param {string} config.jwtSecret
+ * @param {string} [config.jwtExpiresIn='24h']
+ * @param {number} [config.saltRounds=10]
+ */
+function configure(config) {
+  _config = { ..._config, ...config };
+}
+
+function getSecret() {
+  return _config.jwtSecret || process.env.JWT_SECRET || 'change_me_in_production';
+}
+
+function generateId() {
+  return crypto.randomBytes(12).toString('hex').substring(0, 25);
+}
+
+async function hashPassword(password) {
+  const rounds = _config.saltRounds || 10;
+  const salt = await bcrypt.genSalt(rounds);
+  const hash = await bcrypt.hash(password, salt);
+  return { hash, salt };
+}
+
+async function comparePassword(password, hash) {
+  return bcrypt.compare(password, hash);
+}
+
+function generateAccessToken(user) {
+  const payload = {
+    id: user.id,
+    email: user.email,
+    name: user.name
+  };
+  const expiresIn = _config.accessTokenExpiresIn || '15m';
+  return jwt.sign(payload, getSecret(), { expiresIn });
+}
+
+function generateRefreshToken() {
+  return crypto.randomBytes(40).toString('hex');
+}
+
+function verifyToken(token) {
+  return jwt.verify(token, getSecret());
+}
+
+module.exports = {
+  configure,
+  generateId,
+  hashPassword,
+  comparePassword,
+  generateAccessToken,
+  generateRefreshToken,
+  verifyToken
+};

package/lib/authMiddleware.js

@@ -0,0 +1,31 @@
+const { verifyToken } = require('./authHelper');
+const { validateAccessToken } = require('./sessionService');
+
+async function authMiddleware(req, res, next) {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'No token provided' });
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  // Step 1: Verify JWT signature + expiry
+  let decoded;
+  try {
+    decoded = verifyToken(token);
+  } catch (err) {
+    return res.status(401).json({ error: 'Invalid or expired token' });
+  }
+
+  // Step 2: Check Redis whitelist (token not revoked)
+  const session = await validateAccessToken(token);
+  if (!session) {
+    return res.status(401).json({ error: 'Session expired or revoked' });
+  }
+
+  req.user = decoded;
+  next();
+}
+
+module.exports = authMiddleware;

package/lib/authRouter.js

@@ -0,0 +1,192 @@
+const express = require('express');
+const { register, activate, login, forgotPassword, resetPassword } = require('./authService');
+const { getUserAccess } = require('./accessService');
+const { getSession, rotateSession, destroySession } = require('./sessionService');
+const authMiddleware = require('./authMiddleware');
+const User = require('../models/User');
+
+function logError(req, err) {
+  if (req.log) req.log.error(err.message, { stack: err.stack });
+}
+
+function createAuthRouter(options = {}) {
+  const router = express.Router();
+  const resetBaseUrl = options.resetBaseUrl || null;
+
+  router.post('/register', async function(req, res) {
+    try {
+      const { email, phoneNumber, name, password } = req.body;
+
+      if (!email || !password) {
+        return res.status(400).json({ error: 'Email and password are required' });
+      }
+
+      const user = await register({ email, phoneNumber, name, password });
+      res.status(201).json({ message: 'Registration successful. Account pending activation.', user });
+    } catch (err) {
+      logError(req, err);
+      if (err.message === 'Email already registered') {
+        return res.status(409).json({ error: err.message });
+      }
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.get('/activate', async function(req, res) {
+    try {
+      var token = req.query.token;
+      if (!token) {
+        return res.status(400).json({ error: 'Activation token is required' });
+      }
+
+      var result = await activate(token);
+      res.json({ message: 'Account activated successfully', user: result });
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/login', async function(req, res) {
+    try {
+      const { email, password } = req.body;
+
+      if (!email || !password) {
+        return res.status(400).json({ error: 'Email and password are required' });
+      }
+
+      const result = await login({ email, password });
+      res.json(result);
+    } catch (err) {
+      logError(req, err);
+      if (err.message === 'NOT_ACTIVATED') {
+        return res.status(403).json({ error: 'Please wait, someone will activate you.' });
+      }
+      if (err.message === 'Invalid email or password' || err.message === 'Account is deactivated') {
+        return res.status(401).json({ error: err.message });
+      }
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/forgot-password', async function(req, res) {
+    try {
+      const { email } = req.body;
+
+      if (!email) {
+        return res.status(400).json({ error: 'Email is required' });
+      }
+
+      const baseUrl = resetBaseUrl || req.protocol + '://' + req.get('host');
+      await forgotPassword({ email }, baseUrl);
+      res.json({ message: 'If that email exists, a reset link has been sent.' });
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/reset-password', async function(req, res) {
+    try {
+      const { token, newPassword } = req.body;
+
+      if (!token || !newPassword) {
+        return res.status(400).json({ error: 'Token and new password are required' });
+      }
+
+      await resetPassword({ token, newPassword });
+      res.json({ message: 'Password reset successful.' });
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/refresh', async function(req, res) {
+    try {
+      const { refreshToken } = req.body;
+
+      if (!refreshToken) {
+        return res.status(400).json({ error: 'Refresh token is required' });
+      }
+
+      const session = await getSession(refreshToken);
+      if (!session || !session.userId) {
+        return res.status(401).json({ error: 'Invalid or expired refresh token' });
+      }
+
+      const user = await User.query().findById(session.userId);
+      if (!user || !user.isActive) {
+        return res.status(401).json({ error: 'Account not found or deactivated' });
+      }
+
+      const result = await rotateSession(refreshToken, user);
+      if (!result) {
+        return res.status(401).json({ error: 'Invalid or expired refresh token' });
+      }
+
+      const access = await getUserAccess(user.id);
+
+      res.json({
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken,
+        user: {
+          id: user.id,
+          email: user.email,
+          name: user.name,
+          isActivated: user.isActivated
+        },
+        access
+      });
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.post('/logout', async function(req, res) {
+    try {
+      const { refreshToken } = req.body;
+
+      if (refreshToken) {
+        await destroySession(refreshToken);
+      }
+
+      res.json({ message: 'Logged out successfully' });
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  router.get('/me', authMiddleware, async function(req, res) {
+    try {
+      const access = await getUserAccess(req.user.id);
+      res.json({
+        user: req.user,
+        access
+      });
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  // Get tenants for the current logged-in user
+  router.get('/my-tenants', authMiddleware, async function(req, res) {
+    try {
+      var user = await User.query().findById(req.user.id).withGraphFetched('tenants');
+      var tenants = (user && user.tenants) ? user.tenants : [];
+      res.json(tenants.map(function(t) {
+        return { id: t.id, name: t.name, code: t.code, description: t.description };
+      }));
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Something went wrong' });
+    }
+  });
+
+  return router;
+}
+
+module.exports = createAuthRouter;