adonia 0.1.0

package/registry/auth/service.ts

@@ -0,0 +1,150 @@
+/**
+ * AuthService
+ *
+ * Domain auth use-cases. Depends on shared UserStore + auth-only contracts.
+ * Returns DTOs / void; controllers build HTTP envelopes and call ctx.respond.
+ */
+import encryption from '@adonisjs/core/services/encryption'
+import ApiService from '#modules/api/service'
+import ApiException from '#modules/api/exception'
+import { exceptions } from '#constants/exceptions'
+import type { RegisterUserInput, User, UserStore } from '#modules/contracts/index'
+import type {
+  AuthPasswordReset,
+  LoginCredentials,
+  LoginResult,
+  PasswordResetStore,
+  SessionManager,
+  UpdatePasswordInput,
+} from '#modules/auth/contracts/index'
+import { defaultAuthOptions, type AuthOptions } from '#modules/auth/options'
+import '#modules/auth/events'
+
+export class AuthService extends ApiService {
+  namespace = 'auth'
+
+  constructor(
+    private users: UserStore,
+    private passwordResets: PasswordResetStore,
+    private options: AuthOptions = defaultAuthOptions
+  ) {
+    super()
+  }
+
+  private accountUnverifiedException() {
+    return ApiException.from(exceptions.ACCOUNT_UNVERIFIED)
+  }
+
+  private invalidTokenException() {
+    return ApiException.from(exceptions.INVALID_TOKEN)
+  }
+
+  private tokensMatch(incoming: string, stored: string): boolean {
+    const storedToken = encryption.decrypt(stored)
+    return encryption.decrypt(incoming) === storedToken && storedToken != null
+  }
+
+  private issueVerificationToken(user: User, email = user.email): User {
+    return {
+      ...user,
+      emailVerificationToken: encryption.encrypt(email, this.options.verificationTtl),
+    }
+  }
+
+  private markVerified(user: User): User {
+    return {
+      ...user,
+      emailVerifiedAt: new Date(),
+      emailVerificationToken: null,
+    }
+  }
+
+  public async registerUser(data: RegisterUserInput): Promise<User> {
+    let user = await this.users.createEmailUser(data)
+    user = await this.users.save(this.issueVerificationToken(user))
+    this.emitSafe('Auth:RegisterUser', user)
+    return user
+  }
+
+  public async createNewVerificationToken(user: User): Promise<User> {
+    const updated = await this.users.save(this.issueVerificationToken(user))
+    this.emitSafe('Auth:CreateNewVerificationToken', updated)
+    return updated
+  }
+
+  /**
+   * Authenticates and opens a session. Throws E_ACCOUNT_UNVERIFIED with no
+   * side effects when the account is unverified — hosts that want a resend
+   * call createNewVerificationToken behind their own rate limit.
+   */
+  public async loginByEmail(
+    data: LoginCredentials,
+    session: SessionManager
+  ): Promise<LoginResult> {
+    const user = await this.users.verifyCredentials(data.email, data.password)
+    if (user.emailVerifiedAt === null) {
+      throw this.accountUnverifiedException()
+    }
+    const sessionResult = await session.login(user)
+    this.emitSafe('Auth:Login', { user })
+    return { user, session: sessionResult }
+  }
+
+  public async activateUserAccount(token: string): Promise<User> {
+    const user = await this.users.findByVerificationToken(token)
+    if (!user) {
+      throw this.invalidTokenException()
+    }
+    if (!user.emailVerificationToken || !this.tokensMatch(token, user.emailVerificationToken)) {
+      throw this.invalidTokenException()
+    }
+    const verified = await this.users.save(this.markVerified(user))
+    this.emitSafe('Auth:ActivateUserAccount', verified)
+    return verified
+  }
+
+  public async requestPasswordReset(email: string): Promise<void> {
+    const user = await this.users.findByEmailOrFail(email)
+    const reset = await this.passwordResets.createForUser(
+      user.id,
+      this.options.passwordResetTtl
+    )
+    this.emitSafe('Auth:RequestPasswordReset', {
+      user,
+      token: reset.token,
+    })
+  }
+
+  public async validatePasswordResetToken(token: string): Promise<AuthPasswordReset> {
+    const passwordReset = await this.passwordResets.findByToken(token)
+    if (!passwordReset || passwordReset.isExpired) {
+      throw this.invalidTokenException()
+    }
+    return this.passwordResets.refreshToken(
+      passwordReset,
+      this.options.passwordResetValidateTtl
+    )
+  }
+
+  public async updatePassword(
+    data: UpdatePasswordInput,
+    session?: SessionManager
+  ): Promise<void> {
+    const passwordReset = await this.passwordResets.findByToken(data.token)
+    if (!passwordReset || passwordReset.isExpired) {
+      throw this.invalidTokenException()
+    }
+    const user = await this.passwordResets.findUserByReset(passwordReset)
+    if (session) {
+      await session.logout()
+    }
+    await this.users.updatePassword(user, data.password)
+    await this.passwordResets.deleteForUser(user.id)
+    this.emitSafe('Auth:ResetPassword', { user })
+  }
+
+  public async logout(session: SessionManager): Promise<void> {
+    await session.logout()
+    this.emitSafe('Auth:Logout', null)
+  }
+}

package/registry/auth/stubs/adapters/auth.ts

@@ -0,0 +1,21 @@
+/**
+ * Host Lucid factory for auth. Copied to app/adapters/auth.ts.
+ * Import as `#adapters/auth`.
+ */
+import { AuthService } from '#modules/auth/service'
+import { LucidUserStore } from './lucid_user_store.ts'
+import { LucidPasswordResetStore } from './lucid_password_reset_store.ts'
+import { defaultAuthOptions, type AuthOptions } from '#modules/auth/options'
+
+export { LucidUserStore } from './lucid_user_store.ts'
+export { LucidPasswordResetStore } from './lucid_password_reset_store.ts'
+export { LucidAccessTokenSession } from './lucid_access_token_session.ts'
+export { toUser } from './map_user.ts'
+
+export function createAuthService(options: AuthOptions = defaultAuthOptions) {
+  return new AuthService(
+    new LucidUserStore(),
+    new LucidPasswordResetStore(options.passwordResetTokenBytes),
+    options
+  )
+}

package/registry/auth/stubs/adapters/lucid_access_token_session.ts

@@ -0,0 +1,33 @@
+/**
+ * SessionManager using Adonis access tokens.
+ * Copied to app/adapters/lucid_access_token_session.ts.
+ *
+ * Controllers construct this per request and pass it into AuthService.
+ */
+import type { HttpContext } from '@adonisjs/core/http'
+import UserModel from '#models/user'
+import type { User } from '#modules/contracts/index'
+import type {
+  SessionManager,
+  SessionResult,
+} from '#modules/auth/contracts/index'
+
+export class LucidAccessTokenSession implements SessionManager {
+  constructor(private ctx: HttpContext) {}
+
+  async login(user: User): Promise<SessionResult> {
+    const model = await UserModel.findOrFail(user.id)
+    const token = await UserModel.accessTokens.create(model)
+    return {
+      token: token.value!.release(),
+      expiresAt: token.expiresAt ?? undefined,
+    }
+  }
+
+  async logout(): Promise<void> {
+    const user = this.ctx.auth.getUserOrFail()
+    if ('currentAccessToken' in user && user.currentAccessToken) {
+      await UserModel.accessTokens.delete(user, user.currentAccessToken.identifier)
+    }
+  }
+}

package/registry/auth/stubs/adapters/lucid_password_reset_store.ts

@@ -0,0 +1,68 @@
+/**
+ * Lucid PasswordResetStore. Copied to app/adapters/lucid_password_reset_store.ts.
+ * Expects PasswordReset at #models/password_reset with userId, token, expiresAt,
+ * and a belongsTo user relation.
+ */
+import { DateTime } from 'luxon'
+import string from '@adonisjs/core/helpers/string'
+import encryption from '@adonisjs/core/services/encryption'
+import PasswordReset from '#models/password_reset'
+import { toUser } from './map_user.ts'
+import { defaultAuthOptions } from '#modules/auth/options'
+import type { User } from '#modules/contracts/index'
+import type {
+  AuthPasswordReset,
+  PasswordResetStore,
+  TokenDuration,
+} from '#modules/auth/contracts/index'
+
+export class LucidPasswordResetStore implements PasswordResetStore {
+  constructor(private tokenBytes = defaultAuthOptions.passwordResetTokenBytes) {}
+
+  private toAuthPasswordReset(row: PasswordReset): AuthPasswordReset {
+    return {
+      id: row.id,
+      userId: row.userId,
+      token: row.token,
+      isExpired: row.expiresAt.toMillis() < DateTime.now().toMillis(),
+    }
+  }
+
+  private applyToken(row: PasswordReset, duration: TokenDuration) {
+    row.token = encryption.encrypt(string.generateRandom(this.tokenBytes))
+    row.expiresAt = DateTime.now().plus(duration)
+  }
+
+  async createForUser(userId: number, duration: TokenDuration): Promise<AuthPasswordReset> {
+    await this.deleteForUser(userId)
+    const row = new PasswordReset()
+    row.userId = userId
+    this.applyToken(row, duration)
+    await row.save()
+    return this.toAuthPasswordReset(row)
+  }
+
+  async findByToken(token: string): Promise<AuthPasswordReset | null> {
+    const row = await PasswordReset.findBy('token', token)
+    return row ? this.toAuthPasswordReset(row) : null
+  }
+
+  async deleteForUser(userId: number): Promise<void> {
+    await PasswordReset.query().where('user_id', userId).delete()
+  }
+
+  async refreshToken(
+    reset: AuthPasswordReset,
+    duration: TokenDuration
+  ): Promise<AuthPasswordReset> {
+    const row = await PasswordReset.findOrFail(reset.id)
+    this.applyToken(row, duration)
+    await row.save()
+    return this.toAuthPasswordReset(row)
+  }
+
+  async findUserByReset(reset: AuthPasswordReset): Promise<User> {
+    const row = await PasswordReset.query().where('id', reset.id).preload('user').firstOrFail()
+    return toUser(row.user)
+  }
+}

package/registry/auth/stubs/adapters/lucid_user_store.ts

@@ -0,0 +1,86 @@
+/**
+ * Shared Lucid UserStore. Copied to app/adapters/lucid_user_store.ts.
+ * Import as `#adapters/lucid_user_store`. Auth and account both use this file.
+ *
+ * Expects a User model at #models/user with email, password, authMethod,
+ * firstName, lastName, avatarKey, emailVerifiedAt, and emailVerificationToken.
+ */
+import { DateTime } from 'luxon'
+import hash from '@adonisjs/core/services/hash'
+import UserModel from '#models/user'
+import { toUser } from './map_user.ts'
+import type { RegisterUserInput, User, UserStore } from '#modules/contracts/index'
+
+export class LucidUserStore implements UserStore {
+  async createEmailUser(data: RegisterUserInput): Promise<User> {
+    const user = await UserModel.create({
+      email: data.email,
+      password: data.password,
+      firstName: data.firstName ?? data.fullName?.split(' ')[0] ?? '',
+      lastName: data.lastName ?? data.fullName?.split(' ').slice(1).join(' ') ?? '',
+      authMethod: 'email',
+    })
+    return toUser(user)
+  }
+
+  async findOrFail(id: number): Promise<User> {
+    const user = await UserModel.findOrFail(id)
+    return toUser(user)
+  }
+
+  async findByEmail(email: string): Promise<User | null> {
+    const user = await UserModel.findBy('email', email)
+    return user ? toUser(user) : null
+  }
+
+  async findByEmailOrFail(email: string): Promise<User> {
+    const user = await UserModel.findByOrFail('email', email)
+    return toUser(user)
+  }
+
+  async findByVerificationToken(token: string): Promise<User | null> {
+    const user = await UserModel.findBy('emailVerificationToken', token)
+    return user ? toUser(user) : null
+  }
+
+  async verifyCredentials(email: string, password: string): Promise<User> {
+    const user = await UserModel.verifyCredentials(email, password)
+    return toUser(user)
+  }
+
+  async verifyPassword(userId: number, password: string): Promise<boolean> {
+    const user = await UserModel.findOrFail(userId)
+    if (!user.password) {
+      return false
+    }
+    return hash.verify(user.password, password)
+  }
+
+  async save(dto: User): Promise<User> {
+    const user = await UserModel.findOrFail(dto.id)
+    user.email = dto.email
+    user.pendingEmail = dto.pendingEmail
+    user.authMethod = dto.authMethod
+    user.firstName = dto.firstName
+    user.lastName = dto.lastName
+    user.avatarKey = dto.avatarKey
+    user.emailVerificationToken = dto.emailVerificationToken
+    user.emailVerifiedAt = dto.emailVerifiedAt
+      ? DateTime.fromJSDate(dto.emailVerifiedAt)
+      : null
+    await user.save()
+    return toUser(user)
+  }
+
+  async updatePassword(dto: User, password: string): Promise<User> {
+    const user = await UserModel.findOrFail(dto.id)
+    user.password = password
+    await user.save()
+    return toUser(user)
+  }
+
+  async delete(userId: number): Promise<void> {
+    const user = await UserModel.findOrFail(userId)
+    await user.delete()
+  }
+}

package/registry/auth/stubs/adapters/map_user.ts

@@ -0,0 +1,19 @@
+import type UserModel from '#models/user'
+import type { User } from '#modules/contracts/index'
+
+/**
+ * Map a Lucid User row to the portable User DTO.
+ */
+export function toUser(user: UserModel): User {
+  return {
+    id: user.id,
+    email: user.email,
+    pendingEmail: user.pendingEmail ?? null,
+    authMethod: user.authMethod,
+    firstName: user.firstName,
+    lastName: user.lastName,
+    avatarKey: user.avatarKey ?? null,
+    emailVerifiedAt: user.emailVerifiedAt ? user.emailVerifiedAt.toJSDate() : null,
+    emailVerificationToken: user.emailVerificationToken,
+  }
+}

package/registry/auth/stubs/controllers/auth_controller.ts

@@ -0,0 +1,126 @@
+/**
+ * Example auth controller. Copy into app/controllers and register routes.
+ * Not registered by the starter.
+ *
+ * Copy Vine provider (`providers/vine_provider.ts`) and register it in
+ * adonisrc.ts so unique/exists/validToken/validPassword macros load.
+ * Logout needs named auth middleware from start/kernel.ts.
+ */
+import type { HttpContext } from '@adonisjs/core/http'
+import {
+  createAuthService,
+  LucidAccessTokenSession,
+  LucidUserStore,
+} from '#adapters/auth'
+import { responseCodes } from '#constants/responseCodes'
+import {
+  loginValidator,
+  registerValidator,
+  activateValidator,
+  requestPasswordResetValidator,
+  updatePasswordValidator,
+  validatePasswordResetValidator,
+  resendActivationValidator,
+} from '../validators/auth.ts'
+
+const auth = createAuthService()
+
+export default class AuthController {
+  async register(ctx: HttpContext) {
+    const data = await ctx.request.validateUsing(registerValidator)
+    const user = await auth.registerUser(data)
+    return ctx.response.created(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_REGISTER.code,
+        data: user,
+      })
+    )
+  }
+
+  async login(ctx: HttpContext) {
+    const credentials = await ctx.request.validateUsing(loginValidator)
+    const session = new LucidAccessTokenSession(ctx)
+    const { user, session: sessionResult } = await auth.loginByEmail(credentials, session)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_LOGIN.code,
+        data: { user, token: sessionResult.token ?? null },
+      })
+    )
+  }
+
+  async logout(ctx: HttpContext) {
+    const session = new LucidAccessTokenSession(ctx)
+    await auth.logout(session)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_LOGOUT.code,
+        data: null,
+      })
+    )
+  }
+
+  async activate(ctx: HttpContext) {
+    const { token } = await ctx.request.validateUsing(activateValidator)
+    const user = await auth.activateUserAccount(token)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_ACTIVATE_ACCOUNT.code,
+        data: user,
+      })
+    )
+  }
+
+  async sendAccountActivationEmail(ctx: HttpContext) {
+    const { email } = await ctx.request.validateUsing(resendActivationValidator)
+    const user = await new LucidUserStore().findByEmailOrFail(email)
+    await auth.createNewVerificationToken(user)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_ACTIVATE_ACCOUNT_REQUEST.code,
+        data: null,
+      })
+    )
+  }
+
+  async requestPasswordReset(ctx: HttpContext) {
+    const { email } = await ctx.request.validateUsing(requestPasswordResetValidator)
+    await auth.requestPasswordReset(email)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_RESET_PASSWORD_REQUEST.code,
+        data: null,
+      })
+    )
+  }
+
+  async validatePasswordReset(ctx: HttpContext) {
+    const { token } = await ctx.request.validateUsing(validatePasswordResetValidator)
+    const reset = await auth.validatePasswordResetToken(token)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_VALIDATE_PASSWORD_RESET.code,
+        data: reset,
+      })
+    )
+  }
+
+  async updatePassword(ctx: HttpContext) {
+    const data = await ctx.request.validateUsing(updatePasswordValidator)
+    await auth.updatePassword(data)
+    return ctx.response.ok(
+      await ctx.respond({
+        success: true,
+        message: responseCodes.AUTH_UPDATE_PASSWORD.code,
+        data: null,
+      })
+    )
+  }
+}

package/registry/auth/stubs/migrations/add_pending_email_to_users_table.ts

@@ -0,0 +1,17 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'users'
+
+  async up() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.string('pending_email', 254).nullable()
+    })
+  }
+
+  async down() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('pending_email')
+    })
+  }
+}

package/registry/auth/stubs/migrations/create_password_resets_table.ts

@@ -0,0 +1,27 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'password_resets'
+
+  async up() {
+    this.schema.createTable(this.tableName, (table) => {
+      table.increments('id').primary()
+      table
+        .integer('user_id')
+        .unsigned()
+        .unique()
+        .notNullable()
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE')
+      table.string('token').notNullable().index()
+      table.timestamp('created_at')
+      table.timestamp('updated_at')
+      table.timestamp('expires_at', { useTz: true })
+    })
+  }
+
+  async down() {
+    this.schema.dropTable(this.tableName)
+  }
+}

package/registry/auth/stubs/migrations/create_users_table.ts

@@ -0,0 +1,31 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'users'
+
+  async up() {
+    this.schema.createTable(this.tableName, (table) => {
+      table.increments('id').notNullable()
+      table.string('auth_method').notNullable()
+      table.string('email', 254).notNullable().unique()
+      table.string('first_name').notNullable()
+      table.string('last_name').notNullable()
+      table.string('avatar_key').nullable()
+      table.string('password').nullable()
+      table.string('email_verification_token').nullable()
+      table.string('creem_customer_id').unique().nullable()
+      table.boolean('email_marketing').defaultTo(false)
+      table.boolean('email_product_updates').defaultTo(false)
+      table.boolean('email_security_alerts').defaultTo(true)
+      table.boolean('email_weekly_digest').defaultTo(false)
+
+      table.timestamp('created_at').notNullable()
+      table.timestamp('updated_at').nullable()
+      table.timestamp('email_verified_at').nullable()
+    })
+  }
+
+  async down() {
+    this.schema.dropTable(this.tableName)
+  }
+}

package/registry/auth/stubs/models/password_reset.ts

@@ -0,0 +1,29 @@
+import { DateTime } from 'luxon'
+import { BaseModel, belongsTo, column } from '@adonisjs/lucid/orm'
+import type { BelongsTo } from '@adonisjs/lucid/types/relations'
+import User from '#models/user'
+
+export default class PasswordReset extends BaseModel {
+  static table = 'password_resets'
+
+  @column({ isPrimary: true })
+  declare id: number
+
+  @column()
+  declare userId: number
+
+  @column()
+  declare token: string
+
+  @column.dateTime({ autoCreate: true })
+  declare createdAt: DateTime
+
+  @column.dateTime({ autoCreate: true, autoUpdate: true })
+  declare updatedAt: DateTime
+
+  @column.dateTime()
+  declare expiresAt: DateTime
+
+  @belongsTo(() => User)
+  declare user: BelongsTo<typeof User>
+}