ajo-kit-auth 0.1.0

package/src/session.ts

@@ -0,0 +1,150 @@
+import { createHash, randomBytes } from 'node:crypto'
+import { sql } from 'ajo-kit/database'
+import { db } from './store'
+
+const minute = 60 * 1000
+const day = 24 * 60 * 60 * 1000
+const idle = 30 * minute
+const pace = 5 * minute
+
+type Row = {
+	id: string
+	user: number
+	expiry: string
+	last: string | null
+	created: string
+}
+
+function stamp(now = Date.now()): string {
+	return new Date(now).toISOString()
+}
+
+function time(value: string | null): number {
+	const parsed = value ? Date.parse(value) : Number.NaN
+
+	return Number.isFinite(parsed) ? parsed : 0
+}
+
+function age(session: Row, now: number): number {
+	return now - time(session.last ?? session.created)
+}
+
+function expired(session: Row, now: number): boolean {
+	return time(session.expiry) <= now || age(session, now) > idle
+}
+
+function stale(session: Row, now: number): boolean {
+	return age(session, now) > pace
+}
+
+function cutoff(now = Date.now()): string {
+	return stamp(now - idle)
+}
+
+function drop(id: string) {
+	return db()
+		.deleteFrom('sessions')
+		.where('id', '=', id)
+		.execute()
+}
+
+function mark(id: string, last = stamp()) {
+	return db()
+		.updateTable('sessions')
+		.set({ last })
+		.where('id', '=', id)
+		.execute()
+}
+
+/** Generates a random plaintext credential value. */
+export function generate(): string {
+	return randomBytes(32).toString('base64url')
+}
+
+/** Hashes a plaintext session credential for database storage. */
+export function hash(plain: string): string {
+	return createHash('sha256').update(plain).digest('hex')
+}
+
+/** Creates a cookie session and returns its plaintext credential. */
+export const create = async (
+	user: number,
+	remember = false,
+	ip?: string,
+	agent?: string
+) => {
+
+	const plain = generate()
+	const id = hash(plain)
+	const lifetime = remember ? 365 : 30
+	const now = Date.now()
+	const expiry = stamp(now + lifetime * day)
+	const last = stamp(now)
+
+	await db().insertInto('sessions').values({
+		id,
+		user,
+		expiry,
+		ip: ip ?? null,
+		agent: agent ?? null,
+		last
+	}).execute()
+
+	return plain
+}
+
+/**
+ * Resolves a session credential, enforcing expiry and throttled activity touch.
+ *
+ * Pass `activity = false` for background checks that must not renew activity.
+ */
+export const validate = async (plain: string, activity = true) => {
+
+	const id = hash(plain)
+
+	const session = await db()
+		.selectFrom('sessions')
+		.select(['id', 'user', 'expiry', 'last', 'created'])
+		.where('id', '=', id)
+		.executeTakeFirst() as Row | undefined
+
+	if (!session) return null
+
+	const now = Date.now()
+
+	if (expired(session, now)) {
+		await drop(id)
+		return null
+	}
+
+	if (activity && stale(session, now)) {
+		const last = stamp(now)
+
+		await mark(id, last)
+
+		return { ...session, last }
+	}
+
+	return session
+}
+
+/** Deletes the session matching a plaintext credential. */
+export const remove = (plain: string) =>
+	drop(hash(plain))
+
+/** Updates the last-seen timestamp for a session credential. */
+export const touch = (plain: string) =>
+	mark(hash(plain))
+
+/** Deletes sessions past their absolute or idle timeout. */
+export const prune = () => {
+	const now = Date.now()
+
+	return db()
+		.deleteFrom('sessions')
+		.where(eb => eb.or([
+			eb('expiry', '<=', stamp(now)),
+			sql<boolean>`unixepoch(coalesce(last, created)) <= unixepoch(${cutoff(now)})`,
+		]))
+		.execute()
+}

package/src/store.ts

@@ -0,0 +1,13 @@
+import type { Kysely } from 'ajo-kit/database'
+import type { Auth } from './types'
+
+let accessor: (() => Kysely<Auth>) | null = null
+
+/** Sets the Kysely accessor used by auth helpers. */
+export const configure = (fn: () => Kysely<any>) => { accessor = fn }
+
+/** Returns the configured auth Kysely instance or throws if missing. */
+export const db = () => {
+	if (!accessor) throw new Error('Auth database not configured. Call configure() from ajo-kit-auth.')
+	return accessor()
+}

package/src/token.ts

@@ -0,0 +1,77 @@
+import { createHash } from 'node:crypto'
+import { db } from './store'
+import { generate } from './session'
+import type { Ability } from './ability.client'
+
+const hash = (plain: string) => createHash('sha256').update(plain).digest('hex')
+
+/** Creates an API token and returns its plaintext credential once. */
+export async function create(
+	user: number,
+	name: string,
+	abilities: Ability[],
+	ttl: number | null = 90 * 24 * 60 * 60 * 1000 // 90 días default
+) {
+
+	const plain = generate()
+	const id = hash(plain)
+	const expiry = ttl ? new Date(Date.now() + ttl).toISOString() : null
+
+	await db().insertInto('tokens').values({
+		id,
+		user,
+		name,
+		abilities: JSON.stringify(abilities),
+		last: null,
+		expiry
+	}).execute()
+
+	return plain
+}
+
+/** Resolves a plaintext API token to its stored bearer identity. */
+export async function validate(plain: string) {
+
+	const id = hash(plain)
+
+	const token = await db()
+		.selectFrom('tokens')
+		.select(['id', 'user', 'abilities', 'expiry'])
+		.where('id', '=', id)
+		.executeTakeFirst()
+
+	if (!token) return null
+
+	if (token.expiry && new Date(token.expiry) < new Date()) {
+		await db().deleteFrom('tokens').where('id', '=', id).execute()
+		return null
+	}
+
+	await db().updateTable('tokens')
+		.set({ last: new Date().toISOString() })
+		.where('id', '=', id)
+		.execute()
+
+	return { ...token, abilities: JSON.parse(token.abilities) as Ability[] }
+}
+
+/** Deletes the API token matching a plaintext credential. */
+export const revoke = (plain: string) =>
+	db().deleteFrom('tokens').where('id', '=', hash(plain)).execute()
+
+/** Deletes every API token owned by a user. */
+export const purge = (user: number) =>
+	db().deleteFrom('tokens').where('user', '=', user).execute()
+
+/** Lists stored API tokens for a user without plaintext secrets. */
+export const list = (user: number) =>
+	db().selectFrom('tokens')
+		.select(['id', 'name', 'abilities', 'last', 'expiry', 'created'])
+		.where('user', '=', user)
+		.execute()
+
+/** Deletes expired API tokens. */
+export const prune = () =>
+	db().deleteFrom('tokens')
+		.where('expiry', '<', new Date().toISOString())
+		.execute()

package/src/types.ts

@@ -0,0 +1,78 @@
+import type { Generated, Selectable, Insertable } from 'ajo-kit/database'
+
+/** users table shape. */
+export interface Users {
+	id: Generated<number>
+	name: Generated<string>
+	email: string
+	password: string | null
+	verified: string | null
+	created: Generated<string>
+	updated: string | null
+}
+
+/** sessions table shape. */
+export interface Sessions {
+	id: string
+	user: number
+	expiry: string
+	ip: string | null
+	agent: string | null
+	last: string | null
+	created: Generated<string>
+}
+
+/** roles table shape. */
+export interface Roles {
+	id: number
+	name: string
+	abilities: string
+}
+
+/** members table shape linking users to roles. */
+export interface Members {
+	user: number
+	role: number
+}
+
+/** tokens table shape for bearer API tokens. */
+export interface Tokens {
+	id: string
+	user: number
+	name: string
+	abilities: string
+	last: string | null
+	expiry: string | null
+	created: Generated<string>
+}
+
+/** resets table shape for password reset tokens. */
+export interface Resets {
+	id: string
+	user: number
+	expiry: string
+	created: Generated<string>
+}
+
+// Schema parcial — solo las tablas de auth
+
+/** Database schema fragment owned by ajo-kit-auth. */
+export interface Auth {
+	users: Users
+	sessions: Sessions
+	roles: Roles
+	members: Members
+	tokens: Tokens
+	resets: Resets
+}
+
+/** Selected auth user row. */
+export type User = Selectable<Users>
+/** Insertable auth user row. */
+export type New = Insertable<Users>
+/** Selected auth session row. */
+export type Session = Selectable<Sessions>
+/** Selected auth token row. */
+export type Token = Selectable<Tokens>
+/** Built-in role names used by the demo auth schema. */
+export type Role = 'admin' | 'user'

package/src/verify.ts

@@ -0,0 +1,44 @@
+import { createHmac, timingSafeEqual } from 'node:crypto'
+import * as secret from './secret'
+
+const hours = 24
+
+/** Signs a user id into a time-limited email verification signature. */
+export function sign(user: number): string {
+
+	const expiry = Date.now() + hours * 60 * 60 * 1000
+	const data = `${user}:${expiry}`
+	const sig = createHmac('sha256', secret.value()).update(data).digest('hex')
+
+	return Buffer.from(`${data}:${sig}`).toString('base64url')
+}
+
+/** Validates an email verification signature and returns its user id. */
+export function validate(signature: string): number | null {
+
+	const key = secret.value()
+
+	try {
+
+		const decoded = Buffer.from(signature, 'base64url').toString()
+		const [user, expiry, sig] = decoded.split(':')
+
+		if (Date.now() > Number(expiry)) return null
+
+		const expected = createHmac('sha256', key).update(`${user}:${expiry}`).digest('hex')
+		const actual = Buffer.from(sig, 'hex')
+		const wanted = Buffer.from(expected, 'hex')
+
+		if (!timingSafeEqual(actual, wanted)) return null
+
+		return Number(user)
+
+	} catch {
+		return null
+	}
+}
+
+/** Builds an absolute email verification URL for a user. */
+export function url(user: number, base: string): string {
+	return `${base}/verify/${sign(user)}`
+}

package/src/wares.ts

@@ -0,0 +1,101 @@
+import type { Middleware, Request } from 'ajo-kit'
+import { Forbidden, api } from 'ajo-kit'
+import { read, clear } from './cookie'
+import { validate } from './session'
+import { validate as bearer } from './token'
+import { verify as valid } from './csrf'
+import { db } from './store'
+import { grants } from './account'
+import { merge } from './ability.client'
+
+async function resolve(id: number) {
+
+	const user = await db()
+		.selectFrom('users')
+		.select(['id', 'name', 'email', 'verified'])
+		.where('id', '=', id)
+		.executeTakeFirst()
+
+	if (!user) return null
+
+	const roles = await grants(user.id)
+
+	return {
+		...user,
+		roles: roles.map(r => r.name),
+		abilities: merge(...roles.map(r => r.abilities)),
+	}
+}
+
+type Resolve = typeof resolve
+
+const reset = (req: Request) => {
+	delete req.user
+	delete req.session
+	delete req.token
+}
+
+/** Authenticates requests from bearer API tokens or session cookies. */
+export function session(lookup?: Resolve): Middleware {
+
+	const find = lookup ?? resolve
+
+	return async (req, res, next) => {
+
+		reset(req)
+
+		// 1. Explicit bearer token for API/Mobile/CLI
+
+		const auth = req.headers.authorization
+
+		if (api(req) && auth?.startsWith('Bearer ')) {
+
+			const authz = await bearer(auth.slice(7))
+
+			if (authz) {
+				const user = await find(authz.user)
+				if (user) {
+					req.user = user
+					req.token = { id: authz.id, abilities: authz.abilities }
+				}
+			}
+
+			return next()
+		}
+
+		// 2. Cookie session (SPA/Web)
+
+		const cookie = read(req)
+
+		if (cookie) {
+
+			const valid = await validate(cookie, req.headers.accept !== 'text/event-stream')
+
+			if (valid) {
+				const user = await find(valid.user)
+				if (user) {
+					req.user = user
+					req.session = { id: valid.id }
+					return next()
+				}
+			}
+
+			clear(res)
+			return next()
+		}
+
+		next()
+	}
+}
+
+/** Rejects unsafe cookie-auth requests without CSRF proof. */
+export const csrf: Middleware = (req, _, next) => {
+
+	if (req.token) return next()
+	if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next()
+	if (api(req) && !req.user) return next()
+
+	if (!valid(req)) throw new Forbidden('Invalid CSRF token')
+
+	next()
+}