adonia 0.1.0

package/registry/auth/stubs/models/user.ts

@@ -0,0 +1,99 @@
+import { DateTime } from 'luxon'
+import hash from '@adonisjs/core/services/hash'
+import { compose } from '@adonisjs/core/helpers'
+import { BaseModel, column, computed } from '@adonisjs/lucid/orm'
+import { withAuthFinder } from '@adonisjs/auth/mixins/lucid'
+import { DbAccessTokensProvider } from '@adonisjs/auth/access_tokens'
+import { ModelsTypes } from '#modules/types'
+import encryption from '@adonisjs/core/services/encryption'
+import env from '#start/env'
+import { defaultAuthOptions } from '../../options.ts'
+
+interface IUserModel extends ModelsTypes.IUserModel {}
+
+const AuthFinder = withAuthFinder(() => hash.use('scrypt'), {
+  uids: ['email'],
+  passwordColumnName: 'password',
+})
+
+export default class User
+  extends compose(BaseModel, AuthFinder)
+  implements ModelsTypes.ModularModel<IUserModel>
+{
+  static accessTokens = DbAccessTokensProvider.forModel(User)
+
+  nameSpace = 'user'
+
+  @column({ isPrimary: true, serializeAs: null })
+  declare id: number
+
+  @column()
+  declare authMethod: 'github' | 'google' | 'email'
+
+  @column()
+  declare email: string
+
+  @column()
+  declare pendingEmail: string | null
+
+  @column()
+  declare firstName: string
+
+  @column()
+  declare lastName: string
+
+  @column({ serializeAs: null })
+  declare avatarKey: string | null
+
+  @column({ serializeAs: null })
+  declare password: string | null
+
+  @column({ serializeAs: null })
+  declare emailVerificationToken: string | null
+
+  @column()
+  declare creemCustomerId: string | null
+
+  @column()
+  declare emailMarketing: boolean
+
+  @column()
+  declare emailProductUpdates: boolean
+
+  @column()
+  declare emailSecurityAlerts: boolean
+
+  @column()
+  declare emailWeeklyDigest: boolean
+
+  @computed()
+  get name() {
+    return this.firstName + ' ' + this.lastName
+  }
+
+  @column.dateTime({ autoCreate: true })
+  declare createdAt: DateTime
+
+  @column.dateTime({ autoCreate: true, autoUpdate: true })
+  declare updatedAt: DateTime | null
+
+  @column.dateTime()
+  declare emailVerifiedAt: DateTime | null
+
+  @computed()
+  get avatar() {
+    return this.avatarKey ? `${env.get('AVATAR_URL')}/${this.avatarKey}` : ''
+  }
+
+  verifyEmail() {
+    this.emailVerifiedAt = DateTime.now()
+    this.emailVerificationToken = null
+  }
+
+  generateVerificationToken() {
+    this.emailVerificationToken = encryption.encrypt(
+      this.email,
+      defaultAuthOptions.verificationTtl
+    )
+  }
+}

package/registry/auth/stubs/providers/vine_provider.ts

@@ -0,0 +1,43 @@
+/**
+ * Registers Vine macros used by auth validators: unique, exists,
+ * validToken, validPassword.
+ *
+ * Copy into providers/ and register in adonisrc.ts providers, after
+ * `@adonisjs/core/providers/vinejs_provider`:
+ *
+ *   () => import('#providers/vine_provider'),
+ */
+import type { ApplicationService } from '@adonisjs/core/types'
+import { VineString } from '@vinejs/vine'
+import { uniqueRule } from '#validators/rules/unique'
+import { existsRule } from '#validators/rules/exists'
+import { validTokenRule } from '#validators/rules/valid_token'
+import { validPasswordRule } from '#validators/rules/valid_password'
+
+export default class VineMacrosProvider {
+  constructor(protected app: ApplicationService) {}
+
+  boot() {
+    VineString.macro(
+      'unique',
+      function (this: VineString, options: { table: string; column: string }) {
+        return this.use(uniqueRule(options))
+      }
+    )
+    VineString.macro(
+      'exists',
+      function (this: VineString, options: { table: string; column: string }) {
+        return this.use(existsRule(options))
+      }
+    )
+    VineString.macro(
+      'validToken',
+      function (this: VineString, options: { table: string; column: string }) {
+        return this.use(validTokenRule(options))
+      }
+    )
+    VineString.macro('validPassword', function (this: VineString) {
+      return this.use(validPasswordRule())
+    })
+  }
+}

package/registry/auth/stubs/routes/auth.ts

@@ -0,0 +1,36 @@
+/**
+ * Example auth routes. Requires controllers (and typically validators)
+ * installed via `adonia add auth --with-controllers --with-validators`
+ * or `--with-stubs`.
+ *
+ * Copy Vine provider (`providers/vine_provider.ts`) and register it in
+ * adonisrc.ts. Logout needs named auth middleware from start/kernel.ts.
+ *
+ * Sensitive routes should use authLimiter (5/min). Install @adonisjs/limiter,
+ * copy stubs/start/limiter.ts, then uncomment `.use(authLimiter)` below.
+ */
+import router from '@adonisjs/core/services/router'
+// import { middleware } from '#start/kernel'
+// import { authLimiter } from '#start/limiter'
+
+const AuthController = () => import('#controllers/auth_controller')
+
+router
+  .group(() => {
+    router.post('register', [AuthController, 'register'])
+    // .use(authLimiter)
+    router.post('login', [AuthController, 'login'])
+    // .use(authLimiter)
+    router.post('logout', [AuthController, 'logout'])
+    // .use(middleware.auth())
+    router.post('activate', [AuthController, 'activate'])
+    router.post('activate/request', [AuthController, 'sendAccountActivationEmail'])
+    // .use(authLimiter)
+    router.post('password/forgot', [AuthController, 'requestPasswordReset'])
+    // .use(authLimiter)
+    router.post('password/validate', [AuthController, 'validatePasswordReset'])
+    router.post('password/reset', [AuthController, 'updatePassword'])
+    // .use(authLimiter)
+  })
+  .prefix('/api/v1/auth')
+  .as('adonia.auth')

package/registry/auth/stubs/start/limiter.ts

@@ -0,0 +1,17 @@
+/**
+ * Host example rate limiters.
+ *
+ * Peer: @adonisjs/limiter (not installed by `adonia add`).
+ * After `node ace add @adonisjs/limiter`, uncomment `.use(authLimiter)`
+ * on sensitive auth routes and `.use(accountLimiter)` on the account
+ * group in start/routes/account.ts.
+ */
+import limiter from '@adonisjs/limiter/services/main'
+
+export const authLimiter = limiter.define('auth', () => {
+  return limiter.allowRequests(5).every('1 minute')
+})
+
+export const accountLimiter = limiter.define('account', () => {
+  return limiter.allowRequests(60).every('1 minute')
+})

package/registry/auth/stubs/validators/auth.ts

@@ -0,0 +1,48 @@
+import vine from '@vinejs/vine'
+
+export const registerValidator = vine.compile(
+  vine.object({
+    email: vine.string().email().normalizeEmail().unique({ table: 'users', column: 'email' }),
+    password: vine.string().validPassword().confirmed(),
+    firstName: vine.string().trim().maxLength(80).optional(),
+    lastName: vine.string().trim().maxLength(80).optional(),
+  })
+)
+
+export const loginValidator = vine.compile(
+  vine.object({
+    email: vine.string().email().normalizeEmail(),
+    password: vine.string(),
+  })
+)
+
+export const activateValidator = vine.compile(
+  vine.object({
+    token: vine.string(),
+  })
+)
+
+export const resendActivationValidator = vine.compile(
+  vine.object({
+    email: vine.string().email().normalizeEmail().exists({ table: 'users', column: 'email' }),
+  })
+)
+
+export const requestPasswordResetValidator = vine.compile(
+  vine.object({
+    email: vine.string().email().normalizeEmail().exists({ table: 'users', column: 'email' }),
+  })
+)
+
+export const validatePasswordResetValidator = vine.compile(
+  vine.object({
+    token: vine.string().validToken({ table: 'password_resets', column: 'token' }),
+  })
+)
+
+export const updatePasswordValidator = vine.compile(
+  vine.object({
+    token: vine.string().validToken({ table: 'password_resets', column: 'token' }),
+    password: vine.string().validPassword().confirmed(),
+  })
+)

package/registry/auth/stubs/validators/rules/exists.ts

@@ -0,0 +1,21 @@
+import vine from '@vinejs/vine'
+import type { FieldContext } from '@vinejs/vine/types'
+
+type Options = {
+  table: string
+  column: string
+}
+
+async function exists(value: unknown, options: Options, field: FieldContext) {
+  if (typeof value !== 'string') {
+    return
+  }
+
+  const db = (await import('@adonisjs/lucid/services/db')).default
+  const row = await db.from(options.table).where(options.column, value).first()
+  if (!row) {
+    field.report('The selected {{ field }} is invalid', 'exists', field)
+  }
+}
+
+export const existsRule = vine.createRule(exists)

package/registry/auth/stubs/validators/rules/unique.ts

@@ -0,0 +1,21 @@
+import vine from '@vinejs/vine'
+import type { FieldContext } from '@vinejs/vine/types'
+
+type Options = {
+  table: string
+  column: string
+}
+
+async function unique(value: unknown, options: Options, field: FieldContext) {
+  if (typeof value !== 'string') {
+    return
+  }
+
+  const db = (await import('@adonisjs/lucid/services/db')).default
+  const row = await db.from(options.table).where(options.column, value).first()
+  if (row) {
+    field.report('The {{ field }} has already been taken', 'unique', field)
+  }
+}
+
+export const uniqueRule = vine.createRule(unique)

package/registry/auth/stubs/validators/rules/valid_password.ts

@@ -0,0 +1,20 @@
+import vine from '@vinejs/vine'
+import type { FieldContext } from '@vinejs/vine/types'
+
+function validPassword(value: unknown, _options: undefined, field: FieldContext) {
+  if (typeof value !== 'string') {
+    return
+  }
+
+  const ok =
+    value.length >= 8 && /[A-Z]/.test(value) && /[a-z]/.test(value) && /[0-9]/.test(value)
+  if (!ok) {
+    field.report(
+      'The {{ field }} must be at least 8 characters and contain uppercase, lowercase, and a number',
+      'validPassword',
+      field
+    )
+  }
+}
+
+export const validPasswordRule = vine.createRule(validPassword)

package/registry/auth/stubs/validators/rules/valid_token.ts

@@ -0,0 +1,27 @@
+import vine from '@vinejs/vine'
+import type { FieldContext } from '@vinejs/vine/types'
+
+type Options = {
+  table: string
+  column: string
+}
+
+async function validToken(value: unknown, options: Options, field: FieldContext) {
+  if (typeof value !== 'string') {
+    return
+  }
+
+  const db = (await import('@adonisjs/lucid/services/db')).default
+  const row = await db.from(options.table).where(options.column, value).first()
+  if (!row) {
+    field.report('The {{ field }} is invalid', 'validToken', field)
+    return
+  }
+
+  const expiresAt = (row as { expires_at?: string | Date | null }).expires_at
+  if (expiresAt && new Date(expiresAt).getTime() < Date.now()) {
+    field.report('The {{ field }} has expired', 'validToken', field)
+  }
+}
+
+export const validTokenRule = vine.createRule(validToken)

package/registry/auth/stubs/validators/vine.d.ts

@@ -0,0 +1,10 @@
+declare module '@vinejs/vine' {
+  interface VineString {
+    unique(options: { table: string; column: string }): this
+    exists(options: { table: string; column: string }): this
+    validToken(options: { table: string; column: string }): this
+    validPassword(): this
+  }
+}
+
+export {}

package/registry/auth/tests/auth_service.spec.ts

@@ -0,0 +1,145 @@
+import { test } from '@japa/runner'
+import assert from 'node:assert/strict'
+import encryption from '@adonisjs/core/services/encryption'
+import { AuthService } from '#modules/auth/service'
+import { MemoryUserStore } from '#modules/auth/tests/fakes/memory_user_store'
+import { MemoryPasswordResetStore } from '#modules/auth/tests/fakes/memory_password_reset_store'
+import { MemorySessionManager } from '#modules/auth/tests/fakes/memory_session_manager'
+
+function makeAuth() {
+  const users = new MemoryUserStore()
+  const passwordResets = new MemoryPasswordResetStore(users)
+  const service = new AuthService(users, passwordResets)
+  const emissions: Array<{ event: string; payload: any }> = []
+  ;(service as any).emitSafe = async (event: string, payload: any) => {
+    emissions.push({ event, payload })
+  }
+  return { service, users, passwordResets, emissions }
+}
+
+test.group('AuthService - register and activate', () => {
+  test('register issues a verification token', async () => {
+    const { service, users } = makeAuth()
+    const user = await service.registerUser({
+      email: 'a@test.com',
+      password: 'secret',
+      firstName: 'A',
+    })
+    assert.ok(user.emailVerificationToken)
+    assert.equal(users.users.get(user.id)?.emailVerificationToken, user.emailVerificationToken)
+  })
+
+  test('activate with a valid token verifies the user', async () => {
+    const { service } = makeAuth()
+    const registered = await service.registerUser({
+      email: 'a@test.com',
+      password: 'secret',
+    })
+    const token = registered.emailVerificationToken!
+    const verified = await service.activateUserAccount(token)
+    assert.ok(verified.emailVerifiedAt)
+    assert.equal(verified.emailVerificationToken, null)
+  })
+
+  test('activate with an expired token throws E_INVALID_TOKEN', async () => {
+    const { service, users } = makeAuth()
+    const registered = await service.registerUser({
+      email: 'a@test.com',
+      password: 'secret',
+    })
+    const expired = encryption.encrypt(registered.email, '-1 hours')
+    const stored = users.users.get(registered.id)!
+    stored.emailVerificationToken = expired
+    users.users.set(stored.id, stored)
+
+    await assert.rejects(
+      () => service.activateUserAccount(expired),
+      (err: any) => {
+        assert.equal(err.code, 'E_INVALID_TOKEN')
+        return true
+      }
+    )
+  })
+})
+
+test.group('AuthService - loginByEmail', () => {
+  test('login for an unverified user throws and has no side effects', async () => {
+    const { service, users, emissions } = makeAuth()
+    const registered = await service.registerUser({
+      email: 'a@test.com',
+      password: 'secret',
+    })
+    const savesBefore = users.saves.length
+    emissions.length = 0
+
+    const session = new MemorySessionManager()
+    await assert.rejects(
+      () => service.loginByEmail({ email: 'a@test.com', password: 'secret' }, session),
+      (err: any) => {
+        assert.equal(err.code, 'E_ACCOUNT_UNVERIFIED')
+        return true
+      }
+    )
+
+    assert.equal(users.saves.length, savesBefore)
+    assert.equal(emissions.length, 0)
+    assert.equal(session.logins.length, 0)
+    assert.equal(registered.emailVerifiedAt, null)
+  })
+
+  test('login returns user and session result', async () => {
+    const { service } = makeAuth()
+    const registered = await service.registerUser({
+      email: 'a@test.com',
+      password: 'secret',
+    })
+    await service.activateUserAccount(registered.emailVerificationToken!)
+
+    const session = new MemorySessionManager()
+    session.result = { token: 'tok', expiresAt: new Date('2030-01-01') }
+    const result = await service.loginByEmail({ email: 'a@test.com', password: 'secret' }, session)
+
+    assert.equal(result.user.email, 'a@test.com')
+    assert.equal(result.session.token, 'tok')
+  })
+})
+
+test.group('AuthService - password reset', () => {
+  test('request creates one row and deletes older rows', async () => {
+    const { service, users, passwordResets } = makeAuth()
+    const user = await users.createEmailUser({ email: 'a@test.com', password: 'secret' })
+    await service.requestPasswordReset('a@test.com')
+    await service.requestPasswordReset('a@test.com')
+    assert.equal(passwordResets.rows.size, 1)
+    assert.equal([...passwordResets.rows.values()][0].userId, user.id)
+    assert.equal(passwordResets.createCalls.length, 2)
+  })
+
+  test('validate rotates the token', async () => {
+    const { service, users, passwordResets } = makeAuth()
+    await users.createEmailUser({ email: 'a@test.com', password: 'secret' })
+    await service.requestPasswordReset('a@test.com')
+    const original = [...passwordResets.byToken.keys()][0]
+    const refreshed = await service.validatePasswordResetToken(original)
+    assert.notEqual(refreshed.token, original)
+    assert.equal(await passwordResets.findByToken(original), null)
+  })
+
+  test('update succeeds once and the token is dead afterward', async () => {
+    const { service, users, passwordResets } = makeAuth()
+    await users.createEmailUser({ email: 'a@test.com', password: 'secret' })
+    await service.requestPasswordReset('a@test.com')
+    const token = [...passwordResets.byToken.keys()][0]
+
+    await service.updatePassword({ token, password: 'new-pass' })
+    assert.equal(await users.verifyPassword(1, 'new-pass'), true)
+
+    await assert.rejects(
+      () => service.updatePassword({ token, password: 'another' }),
+      (err: any) => {
+        assert.equal(err.code, 'E_INVALID_TOKEN')
+        return true
+      }
+    )
+  })
+})

package/registry/auth/tests/auth_update_password.spec.ts

@@ -0,0 +1,99 @@
+import { test } from '@japa/runner'
+import assert from 'node:assert/strict'
+import { AuthService } from '#modules/auth/service'
+import type { User, UserStore } from '#modules/contracts/index'
+import type {
+  AuthPasswordReset,
+  PasswordResetStore,
+  TokenDuration,
+} from '#modules/auth/contracts/index'
+
+function makeUser(overrides: Partial<User> = {}): User {
+  return {
+    id: 1,
+    email: 'user@test.com',
+    pendingEmail: null,
+    authMethod: 'email',
+    firstName: 'Test',
+    lastName: 'User',
+    avatarKey: null,
+    emailVerifiedAt: new Date(),
+    emailVerificationToken: null,
+    ...overrides,
+  }
+}
+
+function makeUserStore(overrides: Partial<UserStore> = {}): UserStore {
+  return {
+    createEmailUser: async () => makeUser(),
+    findOrFail: async () => makeUser(),
+    findByEmail: async () => null,
+    findByEmailOrFail: async () => makeUser(),
+    findByVerificationToken: async () => null,
+    verifyCredentials: async () => makeUser(),
+    verifyPassword: async () => true,
+    save: async (u) => u,
+    updatePassword: async (u) => u,
+    delete: async () => {},
+    ...overrides,
+  }
+}
+
+function makePasswordResetStore(seed?: AuthPasswordReset): PasswordResetStore {
+  const tokens = new Map<string, AuthPasswordReset>()
+  if (seed) {
+    tokens.set(seed.token, seed)
+  }
+
+  return {
+    async createForUser(userId: number, _duration: TokenDuration) {
+      const row: AuthPasswordReset = {
+        id: 1,
+        userId,
+        token: 'fresh',
+        isExpired: false,
+      }
+      tokens.set(row.token, row)
+      return row
+    },
+    async findByToken(token: string) {
+      return tokens.get(token) ?? null
+    },
+    async deleteForUser(userId: number) {
+      for (const [key, row] of tokens) {
+        if (row.userId === userId) {
+          tokens.delete(key)
+        }
+      }
+    },
+    async refreshToken(reset: AuthPasswordReset, _duration: TokenDuration) {
+      return reset
+    },
+    async findUserByReset(reset: AuthPasswordReset) {
+      return makeUser({ id: reset.userId })
+    },
+  }
+}
+
+test.group('AuthService - updatePassword token reuse', () => {
+  test('second updatePassword with same token throws E_INVALID_TOKEN', async () => {
+    const reset: AuthPasswordReset = {
+      id: 1,
+      userId: 1,
+      token: 'reuse-me',
+      isExpired: false,
+    }
+    const passwordResets = makePasswordResetStore(reset)
+    const service = new AuthService(makeUserStore(), passwordResets)
+
+    await service.updatePassword({ token: 'reuse-me', password: 'new-pass-1' })
+
+    await assert.rejects(
+      () => service.updatePassword({ token: 'reuse-me', password: 'new-pass-2' }),
+      (err: any) => {
+        assert.equal(err.code, 'E_INVALID_TOKEN')
+        return true
+      }
+    )
+  })
+})

package/registry/auth/tests/fakes/index.ts

@@ -0,0 +1,3 @@
+export { MemoryUserStore } from './memory_user_store.ts'
+export { MemoryPasswordResetStore } from './memory_password_reset_store.ts'
+export { MemorySessionManager } from './memory_session_manager.ts'

package/registry/auth/tests/fakes/memory_password_reset_store.ts

@@ -0,0 +1,71 @@
+import type { User } from '#modules/contracts/index'
+import type {
+  AuthPasswordReset,
+  PasswordResetStore,
+  TokenDuration,
+} from '#modules/auth/contracts/index'
+import type { MemoryUserStore } from './memory_user_store.ts'
+
+/**
+ * In-memory PasswordResetStore. createForUser deletes prior rows for the user.
+ */
+export class MemoryPasswordResetStore implements PasswordResetStore {
+  rows = new Map<number, AuthPasswordReset>()
+  byToken = new Map<string, AuthPasswordReset>()
+  nextId = 1
+  createCalls: number[] = []
+
+  constructor(private users?: MemoryUserStore) {}
+
+  async createForUser(userId: number, _duration: TokenDuration): Promise<AuthPasswordReset> {
+    this.createCalls.push(userId)
+    await this.deleteForUser(userId)
+    const row: AuthPasswordReset = {
+      id: this.nextId++,
+      userId,
+      token: `reset-${userId}-${this.nextId}`,
+      isExpired: false,
+    }
+    this.rows.set(row.id, row)
+    this.byToken.set(row.token, row)
+    return { ...row }
+  }
+
+  async findByToken(token: string): Promise<AuthPasswordReset | null> {
+    const row = this.byToken.get(token)
+    return row ? { ...row } : null
+  }
+
+  async deleteForUser(userId: number): Promise<void> {
+    for (const [id, row] of this.rows) {
+      if (row.userId === userId) {
+        this.rows.delete(id)
+        this.byToken.delete(row.token)
+      }
+    }
+  }
+
+  async refreshToken(
+    reset: AuthPasswordReset,
+    _duration: TokenDuration
+  ): Promise<AuthPasswordReset> {
+    const existing = this.rows.get(reset.id)
+    if (!existing) throw new Error('reset not found')
+    this.byToken.delete(existing.token)
+    const refreshed: AuthPasswordReset = {
+      ...existing,
+      token: `refreshed-${existing.id}`,
+      isExpired: false,
+    }
+    this.rows.set(refreshed.id, refreshed)
+    this.byToken.set(refreshed.token, refreshed)
+    return { ...refreshed }
+  }
+
+  async findUserByReset(reset: AuthPasswordReset): Promise<User> {
+    if (!this.users) {
+      throw new Error('MemoryPasswordResetStore requires a MemoryUserStore for findUserByReset')
+    }
+    return this.users.findOrFail(reset.userId)
+  }
+}