@yimingliao/cms 0.0.26 → 0.0.28

package/dist/server/index.d.ts

@@ -629,15 +629,20 @@ interface CreateAuthUseCases {
     jwtService: ReturnType<typeof createJwtService>;
     argon2Service: ReturnType<typeof createArgon2Service>;
     cryptoService: ReturnType<typeof createCryptoService>;
+    cookieService: ReturnType<typeof createCookieService>;
     config: {
+        refreshTokenName: string;
+        refreshTokenTtl: number;
+        accessTokenName: string;
+        accessTokenSecret: string;
+        accessTokenTtl: number;
         resetPasswordSecret: string;
         resetPasswordTtl: number;
         verifyEmailSecret: string;
         verifyEmailTtl: number;
-        refreshTokenTtl: number;
     };
 }
-declare function createAuthUseCases({ prisma, adminQueryRepository, adminRefreshTokenCommandRepository, jwtService, argon2Service, cryptoService, config, }: CreateAuthUseCases): {
+declare function createAuthUseCases({ prisma, adminQueryRepository, adminRefreshTokenCommandRepository, jwtService, argon2Service, cryptoService, cookieService, config, }: CreateAuthUseCases): {
     verifyCredentials: ({ email, password, }: {
         email: string;
         password: string;
@@ -646,6 +651,22 @@ declare function createAuthUseCases({ prisma, adminQueryRepository, adminRefresh
         email: string;
         password: string;
     }) => Promise<Admin>;
+    createRefreshToken: ({ admin, deviceInfo, ip, }: {
+        admin: {
+            id: string;
+            email: string;
+        };
+        deviceInfo: DeviceInfo;
+        ip: string;
+    }) => Promise<string>;
+    refreshTokens: ({ admin, deviceInfo, ip, }: {
+        admin: {
+            id: string;
+            email: string;
+        };
+        deviceInfo: DeviceInfo;
+        ip: string;
+    }) => Promise<void>;
     signPasswordResetToken: ({ admin }: {
         admin: AdminSafe;
     }) => string;
@@ -659,13 +680,47 @@ declare function createAuthUseCases({ prisma, adminQueryRepository, adminRefresh
         token: string;
         admin: AdminSafe;
     }) => Promise<AdminSafe>;
-    createRefreshToken: ({ admin, deviceInfo, ip, }: {
-        admin: AdminSafe;
-        deviceInfo: DeviceInfo;
-        ip: string;
-    }) => Promise<string>;
 };
 
+interface CreateVerifyAccessTokenOptions {
+    adminQueryRepository: ReturnType<typeof createAdminQueryRepository>;
+    jwtService: ReturnType<typeof createJwtService>;
+    cryptoService: ReturnType<typeof createCryptoService>;
+    cookieService: ReturnType<typeof createCookieService>;
+    config: {
+        accessTokenName: string;
+        accessTokenSecret: string;
+    };
+}
+declare function createVerifyAccessToken({ adminQueryRepository, jwtService, cryptoService, cookieService, config, }: CreateVerifyAccessTokenOptions): () => Promise<{
+    admin: AdminFull;
+} | null>;
+
+interface CreateVerifyRefreshTokenOptions {
+    adminQueryRepository: ReturnType<typeof createAdminQueryRepository>;
+    adminRefreshTokenQueryRepository: ReturnType<typeof createAdminRefreshTokenQueryRepository>;
+    cryptoService: ReturnType<typeof createCryptoService>;
+    cookieService: ReturnType<typeof createCookieService>;
+    config: {
+        refreshTokenName: string;
+    };
+}
+declare function createVerifyRefreshToken({ adminQueryRepository, adminRefreshTokenQueryRepository, cryptoService, cookieService, config, }: CreateVerifyRefreshTokenOptions): () => Promise<{
+    adminRefreshToken: AdminRefreshToken;
+    admin: AdminFull;
+} | null>;
+
+interface CreateAuthMiddlewareOptions {
+    adminRefreshTokenCommandRepository: ReturnType<typeof createAdminRefreshTokenCommandRepository>;
+    authUseCases: ReturnType<typeof createAuthUseCases>;
+    verifyAccessToken: ReturnType<typeof createVerifyAccessToken>;
+    verifyRefreshToken: ReturnType<typeof createVerifyRefreshToken>;
+    headers: () => Promise<Headers>;
+}
+declare function createAuthMiddleware({ adminRefreshTokenCommandRepository, authUseCases, verifyAccessToken, verifyRefreshToken, headers, }: CreateAuthMiddlewareOptions): Promise<{
+    authenticate(): Promise<AdminFull>;
+}>;
+
 declare class ServerError extends Error {
     readonly i18nKey?: string;
     readonly statusCode?: number;
@@ -684,4 +739,4 @@ declare class ServerError extends Error {
     static internalServerError(): ServerError;
 }
 
-export { ADMIN_ORDER_BY, ORDER_BY, POST_ORDER_BY, type RawCacheKey, ServerError, createAdminCommandRepository, createAdminQueryRepository, createAdminRefreshTokenCommandRepository, createAdminRefreshTokenQueryRepository, createArgon2Service, createAuthUseCases, createCache, createCacheResult, createCookieService, createCryptoService, createExecuteAction, createExecuteApi, createFileCommandRepository, createFileQueryRepository, createFolderCommandRepository, createFolderQueryRepository, createIpRateLimiter, createJwtService, createPostCommandRepository, createPostQueryRepository, createSeoMetadataCommandRepository, normalizeCacheKey };
+export { ADMIN_ORDER_BY, ORDER_BY, POST_ORDER_BY, type RawCacheKey, ServerError, createAdminCommandRepository, createAdminQueryRepository, createAdminRefreshTokenCommandRepository, createAdminRefreshTokenQueryRepository, createArgon2Service, createAuthMiddleware, createAuthUseCases, createCache, createCacheResult, createCookieService, createCryptoService, createExecuteAction, createExecuteApi, createFileCommandRepository, createFileQueryRepository, createFolderCommandRepository, createFolderQueryRepository, createIpRateLimiter, createJwtService, createPostCommandRepository, createPostQueryRepository, createSeoMetadataCommandRepository, createVerifyAccessToken, createVerifyRefreshToken, normalizeCacheKey };

package/dist/server/index.js

@@ -1458,7 +1458,7 @@ var ServerError = class _ServerError extends Error {
   }
 };
 
-// src/server/interfaces/normalize-error.ts
+// src/server/interfaces/execution/normalize-error.ts
 var normalizeError = (error, translator) => {
   if (error instanceof ZodError) {
     const errors = error.issues.map((issue) => {
@@ -1488,7 +1488,7 @@ var normalizeError = (error, translator) => {
   };
 };
 
-// src/server/interfaces/execute-action/create-execute-action.ts
+// src/server/interfaces/execution/execute-action/create-execute-action.ts
 function createExecuteAction({
   initI18n,
   cacheResult,
@@ -1546,6 +1546,89 @@ function createExecuteApi({
   };
 }
 
+// src/server/interfaces/middlewares/auth/create-auth-middleware.ts
+async function createAuthMiddleware({
+  adminRefreshTokenCommandRepository,
+  authUseCases,
+  verifyAccessToken,
+  verifyRefreshToken,
+  headers: headers2
+}) {
+  const authMiddleware = {
+    async authenticate() {
+      const verifiedAccessToken = await verifyAccessToken();
+      if (verifiedAccessToken) return verifiedAccessToken.admin;
+      const verifiedRefreshToken = await verifyRefreshToken();
+      if (!verifiedRefreshToken) throw ServerError.unauthorized();
+      const { adminRefreshToken, admin } = verifiedRefreshToken;
+      await adminRefreshTokenCommandRepository.delete({
+        id: adminRefreshToken.id
+      });
+      await authUseCases.refreshTokens({
+        admin,
+        deviceInfo: adminRefreshToken.deviceInfo,
+        ip: (await headers2()).get("x-forwarded-for") || "unknown"
+      });
+      return admin;
+    }
+  };
+  return authMiddleware;
+}
+
+// src/server/interfaces/middlewares/auth/create-verify-access-token.ts
+function createVerifyAccessToken({
+  adminQueryRepository,
+  jwtService,
+  cryptoService,
+  cookieService,
+  config
+}) {
+  return async function verifyAccessToken() {
+    try {
+      const token = await cookieService.getSignedCookie({
+        name: config.accessTokenName
+      });
+      const payload = jwtService.verify({
+        token,
+        secret: cryptoService.hash(config.accessTokenSecret)
+      });
+      const admin = await adminQueryRepository.findFull({
+        id: payload["id"]
+      });
+      return admin ? { admin } : null;
+    } catch {
+      return null;
+    }
+  };
+}
+
+// src/server/interfaces/middlewares/auth/create-verify-refresh-token.ts
+function createVerifyRefreshToken({
+  adminQueryRepository,
+  adminRefreshTokenQueryRepository,
+  cryptoService,
+  cookieService,
+  config
+}) {
+  return async function verifyRefreshToken() {
+    try {
+      const token = await cookieService.getSignedCookie({
+        name: config.refreshTokenName
+      });
+      const adminRefreshToken = await adminRefreshTokenQueryRepository.findByToken({
+        tokenHash: cryptoService.hash(token)
+      });
+      if (!adminRefreshToken) return null;
+      const admin = await adminQueryRepository.findFull({
+        id: adminRefreshToken.adminId
+      });
+      return admin ? { adminRefreshToken, admin } : null;
+    } catch {
+      return null;
+    }
+  };
+}
+
 // src/server/applications/auth/create-auth-use-cases.ts
 function createAuthUseCases({
   prisma,
@@ -1554,6 +1637,7 @@ function createAuthUseCases({
   jwtService,
   argon2Service,
   cryptoService,
+  cookieService,
   config
 }) {
   async function verifyCredentials({
@@ -1577,6 +1661,45 @@ function createAuthUseCases({
     });
     return updatedAdmin;
   }
+  async function createRefreshToken({
+    admin,
+    deviceInfo,
+    ip
+  }) {
+    const token = cryptoService.generateToken();
+    const tokenHash = cryptoService.hash(token);
+    await adminRefreshTokenCommandRepository.create({
+      tokenHash,
+      ip,
+      deviceInfo,
+      expiresAt: new Date(Date.now() + config.refreshTokenTtl * 1e3),
+      adminId: admin.id,
+      email: admin.email
+    });
+    return token;
+  }
+  async function refreshTokens({
+    admin,
+    deviceInfo,
+    ip
+  }) {
+    const token = await createRefreshToken({ admin, deviceInfo, ip });
+    await cookieService.setSignedCookie({
+      name: config.refreshTokenName,
+      value: token,
+      expireSeconds: config.refreshTokenTtl
+    });
+    const accessToken = jwtService.sign({
+      payload: { id: admin.id },
+      secret: cryptoService.hash(config.accessTokenSecret),
+      expiresIn: config.accessTokenTtl
+    });
+    await cookieService.setSignedCookie({
+      name: config.accessTokenName,
+      value: accessToken,
+      expireSeconds: config.accessTokenTtl
+    });
+  }
   function signPasswordResetToken({ admin }) {
     const payload = { email: admin.email };
     const passwordResetToken = jwtService.sign({
@@ -1616,34 +1739,18 @@ function createAuthUseCases({
     });
     return updatedAdmin;
   }
-  async function createRefreshToken({
-    admin,
-    deviceInfo,
-    ip
-  }) {
-    const token = cryptoService.generateToken();
-    const tokenHash = cryptoService.hash(token);
-    await adminRefreshTokenCommandRepository.create({
-      tokenHash,
-      ip,
-      deviceInfo,
-      expiresAt: new Date(Date.now() + config.refreshTokenTtl * 1e3),
-      adminId: admin.id,
-      email: admin.email
-    });
-    return token;
-  }
   return {
     verifyCredentials,
     updatePassword,
+    createRefreshToken,
+    refreshTokens,
     // reset password
     signPasswordResetToken,
     verifyPasswordResetToken,
     // verify email
     signEmailVerificationToken,
-    verifyEmailAndUpdate,
-    createRefreshToken
+    verifyEmailAndUpdate
   };
 }
 
-export { ADMIN_ORDER_BY, ORDER_BY, POST_ORDER_BY, ServerError, createAdminCommandRepository, createAdminQueryRepository, createAdminRefreshTokenCommandRepository, createAdminRefreshTokenQueryRepository, createArgon2Service, createAuthUseCases, createCache, createCacheResult, createCookieService, createCryptoService, createExecuteAction, createExecuteApi, createFileCommandRepository, createFileQueryRepository, createFolderCommandRepository, createFolderQueryRepository, createIpRateLimiter, createJwtService, createPostCommandRepository, createPostQueryRepository, createSeoMetadataCommandRepository, normalizeCacheKey };
+export { ADMIN_ORDER_BY, ORDER_BY, POST_ORDER_BY, ServerError, createAdminCommandRepository, createAdminQueryRepository, createAdminRefreshTokenCommandRepository, createAdminRefreshTokenQueryRepository, createArgon2Service, createAuthMiddleware, createAuthUseCases, createCache, createCacheResult, createCookieService, createCryptoService, createExecuteAction, createExecuteApi, createFileCommandRepository, createFileQueryRepository, createFolderCommandRepository, createFolderQueryRepository, createIpRateLimiter, createJwtService, createPostCommandRepository, createPostQueryRepository, createSeoMetadataCommandRepository, createVerifyAccessToken, createVerifyRefreshToken, normalizeCacheKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yimingliao/cms",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "author": "Yiming Liao",
   "license": "MIT",
   "type": "module",