alp-node-auth 9.3.0 → 11.0.0

package/src/index.ts

@@ -1,45 +1,42 @@
-/* eslint-disable max-lines */
-import type { IncomingMessage } from 'node:http';
-import { promisify } from 'node:util';
-import type { Context } from 'alp-node';
-import type { ContextState, NodeApplication } from 'alp-types';
-import jsonwebtoken from 'jsonwebtoken';
-import { Logger } from 'nightingale-logger';
-import type MongoUsersManager from './MongoUsersManager';
+import type { IncomingMessage } from "node:http";
+import { promisify } from "node:util";
+import type { Context, ContextState, NodeApplication } from "alp-node";
+import jsonwebtoken from "jsonwebtoken";
+import { Logger } from "nightingale-logger";
+import type MongoUsersManager from "./MongoUsersManager";
 import type {
   AuthController as AuthControllerType,
   AuthHooks,
-} from './createAuthController';
-import { createAuthController } from './createAuthController';
-import type { AuthRoutes as AuthRoutesType } from './createRoutes';
-import { createRoutes } from './createRoutes';
-import type { Strategies } from './services/authentification/AuthenticationService';
-import { AuthenticationService } from './services/authentification/AuthenticationService';
-import type { AllowedStrategyKeys } from './services/authentification/types';
-import UserAccountsService from './services/user/UserAccountsService';
-import type { AccountService } from './services/user/types';
-import type { User, UserSanitized } from './types';
+} from "./createAuthController";
+import { createAuthController } from "./createAuthController";
+import type { AuthRoutes as AuthRoutesType } from "./createRoutes";
+import { createRoutes } from "./createRoutes";
+import type { Strategies } from "./services/authentification/AuthenticationService";
+import { AuthenticationService } from "./services/authentification/AuthenticationService";
+import type { AllowedStrategyKeys } from "./services/authentification/types";
+import UserAccountsService from "./services/user/UserAccountsService";
+import type { AccountService } from "./services/user/types";
+import type { User, UserSanitized } from "./types";
 import {
-  getTokenFromRequest,
-  COOKIE_NAME_TOKEN,
   COOKIE_NAME_STATE,
-} from './utils/cookies';
-import { createFindLoggedInUser } from './utils/createFindLoggedInUser';
+  COOKIE_NAME_TOKEN,
+  getTokenFromRequest,
+} from "./utils/cookies";
+import { createFindLoggedInUser } from "./utils/createFindLoggedInUser";
 
-export { default as MongoUsersManager } from './MongoUsersManager';
-export { default as UserAccountGoogleService } from './services/user/UserAccountGoogleService';
-export { default as UserAccountSlackService } from './services/user/UserAccountSlackService';
-export { authSocketIO } from './authSocketIO';
-export { createAuthApolloContext } from './authApolloContext';
-export { STATUSES } from './services/user/UserAccountsService';
+export { default as MongoUsersManager } from "./MongoUsersManager";
+export { default as UserAccountGoogleService } from "./services/user/UserAccountGoogleService";
+export { default as UserAccountSlackService } from "./services/user/UserAccountSlackService";
+export { authSocketIO } from "./authSocketIO";
+export { createAuthApolloContext } from "./authApolloContext";
+export { STATUSES } from "./services/user/UserAccountsService";
 
-export * from './types';
+export type * from "./types";
 
-declare module 'alp-types' {
-  // eslint-disable-next-line @typescript-eslint/no-shadow
+declare module "alp-node" {
   interface ContextState {
     loggedInUserId:
-      | NonNullable<ContextState['loggedInUser']>['_id']
+      | NonNullable<ContextState["loggedInUser"]>["_id"]
       | null
       | undefined;
     loggedInUser: User | null | undefined;
@@ -47,7 +44,7 @@ declare module 'alp-types' {
 
   interface ContextSanitizedState {
     loggedInUserId:
-      | NonNullable<ContextSanitizedState['loggedInUser']>['_id']
+      | NonNullable<ContextSanitizedState["loggedInUser"]>["_id"]
       | null
       | undefined;
     loggedInUser: UserSanitized | null | undefined;
@@ -55,23 +52,23 @@ declare module 'alp-types' {
 
   interface BaseContext {
     setLoggedIn: (
-      loggedInUserId: NonNullable<ContextState['loggedInUserId']>,
-      loggedInUser: NonNullable<ContextState['loggedInUser']>,
+      loggedInUserId: NonNullable<ContextState["loggedInUserId"]>,
+      loggedInUser: NonNullable<ContextState["loggedInUser"]>,
     ) => Promise<void>;
     logout: () => void;
   }
 }
 
-const logger = new Logger('alp:auth');
+const logger = new Logger("alp:auth");
 
 const signPromisified: any = promisify(jsonwebtoken.sign);
 
 export type AuthController = AuthControllerType;
 export type AuthRoutes = AuthRoutesType;
-export { AuthenticationService } from './services/authentification/AuthenticationService';
+export { AuthenticationService } from "./services/authentification/AuthenticationService";
 
 export default function init<
-  StrategyKeys extends AllowedStrategyKeys = 'google',
+  StrategyKeys extends AllowedStrategyKeys = "google",
   U extends User = User,
   USanitized extends UserSanitized = UserSanitized,
 >({
@@ -112,14 +109,14 @@ export default function init<
       authHooks,
     });
 
-    app.context.setLoggedIn = async function (
+    app.context.setLoggedIn = async function setLoggedIn(
       this: Context,
-      loggedInUserId: NonNullable<ContextState['loggedInUser']>['_id'],
-      loggedInUser: NonNullable<ContextState['loggedInUser']>,
+      loggedInUserId: NonNullable<ContextState["loggedInUser"]>["_id"],
+      loggedInUser: NonNullable<ContextState["loggedInUser"]>,
     ): Promise<void> {
-      logger.debug('setLoggedIn', { loggedInUser });
+      logger.debug("setLoggedIn", { loggedInUser });
       if (!loggedInUserId) {
-        throw new Error('Illegal value for setLoggedIn');
+        throw new Error("Illegal value for setLoggedIn");
       }
 
       this.state.loggedInUserId = loggedInUserId;
@@ -128,12 +125,12 @@ export default function init<
       const token = await signPromisified(
         { loggedInUserId, time: Date.now() },
         this.config
-          .get<Map<string, unknown>>('authentication')
-          .get('secretKey'),
+          .get<Map<string, unknown>>("authentication")
+          .get("secretKey"),
         {
-          algorithm: 'HS512',
-          audience: jwtAudience || this.request.headers['user-agent'],
-          expiresIn: '30 days',
+          algorithm: "HS512",
+          audience: jwtAudience || this.request.headers["user-agent"],
+          expiresIn: "30 days",
         },
       );
 
@@ -143,10 +140,9 @@ export default function init<
         return date.getTime();
       };
 
-      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
       this.cookies.set(COOKIE_NAME_TOKEN, token, {
         httpOnly: true,
-        secure: this.config.get('allowHttps'),
+        secure: this.config.get("allowHttps"),
       });
 
       this.cookies.set(
@@ -154,22 +150,20 @@ export default function init<
         JSON.stringify({ loggedInUserId, expiresIn: calcExpiresTime() }),
         {
           httpOnly: false,
-          secure: this.config.get('allowHttps'),
+          secure: this.config.get("allowHttps"),
         },
       );
     };
 
-    app.context.logout = function (this: Context): void {
+    app.context.logout = function logout(this: Context): void {
       delete this.state.loggedInUserId;
       delete this.state.loggedInUser;
-      this.cookies.set(COOKIE_NAME_TOKEN, '', { expires: new Date(1) });
-      this.cookies.set(COOKIE_NAME_STATE, '', { expires: new Date(1) });
+      this.cookies.set(COOKIE_NAME_TOKEN, "", { expires: new Date(1) });
+      this.cookies.set(COOKIE_NAME_STATE, "", { expires: new Date(1) });
     };
 
     const findLoggedInUser = createFindLoggedInUser(
-      app.config
-        .get<Map<string, unknown>>('authentication')
-        .get('secretKey') as string,
+      app.config.get<{ secretKey: string }>("authentication").secretKey,
       usersManager,
       logger,
     );
@@ -181,7 +175,7 @@ export default function init<
       ): ReturnType<typeof findLoggedInUser> => {
         const token = getTokenFromRequest(req);
         return findLoggedInUser(
-          jwtAudience || req.headers['user-agent'],
+          jwtAudience || req.headers["user-agent"],
           token,
         );
       },
@@ -191,11 +185,11 @@ export default function init<
         next: () => Promise<T> | T,
       ): Promise<T> => {
         const token = ctx.cookies.get(COOKIE_NAME_TOKEN);
-        const userAgent = ctx.request.headers['user-agent'];
-        logger.debug('middleware', { token });
+        const userAgent = ctx.request.headers["user-agent"];
+        logger.debug("middleware", { token });
 
         const setState = (
-          loggedInUserId: U['_id'] | null | undefined,
+          loggedInUserId: U["_id"] | null | undefined,
           loggedInUser: U | null | undefined,
         ): void => {
           ctx.state.loggedInUserId = loggedInUserId;
@@ -209,12 +203,12 @@ export default function init<
           jwtAudience || userAgent,
           token,
         );
-        logger.debug('middleware', { loggedInUserId });
+        logger.debug("middleware", { loggedInUserId });
 
         if (loggedInUserId == null || loggedInUser == null) {
           if (token) {
-            ctx.cookies.set(COOKIE_NAME_TOKEN, '', { expires: new Date(1) });
-            ctx.cookies.set(COOKIE_NAME_STATE, '', { expires: new Date(1) });
+            ctx.cookies.set(COOKIE_NAME_TOKEN, "", { expires: new Date(1) });
+            ctx.cookies.set(COOKIE_NAME_STATE, "", { expires: new Date(1) });
           }
           setState(null, null);
           return next();

package/src/services/authentification/AuthenticationService.ts

@@ -1,18 +1,17 @@
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable camelcase, max-lines */
-import { EventEmitter } from 'node:events';
-import 'alp-router';
-import type { Context, NodeConfig } from 'alp-types';
-import { Logger } from 'nightingale-logger';
-import type { Strategy as Oauth2Strategy } from '../../../strategies/strategies.d';
-import type { AccountId, User, Account, UserSanitized } from '../../types';
-import { randomHex } from '../../utils/generators';
-import type UserAccountsService from '../user/UserAccountsService';
-import type { AllowedStrategyKeys, Tokens } from './types';
-
-const logger = new Logger('alp:auth:authentication');
+/* eslint-disable camelcase */
+import { EventEmitter } from "node:events";
+import type { Context, NodeConfig } from "alp-node";
+import { Logger } from "nightingale-logger";
+import type { Strategy as Oauth2Strategy } from "../../../strategies/strategies.d";
+import type { Account, AccountId, User, UserSanitized } from "../../types";
+import { randomHex } from "../../utils/generators";
+import type UserAccountsService from "../user/UserAccountsService";
+import type { AllowedStrategyKeys, Tokens } from "./types";
+
+const logger = new Logger("alp:auth:authentication");
 
 export interface GenerateAuthUrlOptions {
   accessType?: string;
@@ -73,13 +72,13 @@ export class AuthenticationService<
   }
 
   generateAuthUrl<T extends StrategyKeys>(strategy: T, params: any): string {
-    logger.debug('generateAuthUrl', { strategy, params });
+    logger.debug("generateAuthUrl", { strategy, params });
     const strategyInstance = this.strategies[strategy];
     switch (strategyInstance.type) {
-      case 'oauth2':
+      case "oauth2":
         return strategyInstance.oauth2.authorizationCode.authorizeURL(params);
       default:
-        throw new Error('Invalid strategy');
+        throw new Error("Invalid strategy");
     }
   }
 
@@ -87,10 +86,10 @@ export class AuthenticationService<
     strategy: StrategyKeys,
     options: GetTokensOptions,
   ): Promise<Tokens> {
-    logger.debug('getTokens', { strategy, options });
+    logger.debug("getTokens", { strategy, options });
     const strategyInstance = this.strategies[strategy];
     switch (strategyInstance.type) {
-      case 'oauth2': {
+      case "oauth2": {
         const result = await strategyInstance.oauth2.authorizationCode.getToken(
           {
             code: options.code,
@@ -117,7 +116,7 @@ export class AuthenticationService<
       }
 
       default:
-        throw new Error('Invalid stategy');
+        throw new Error("Invalid stategy");
     }
   }
 
@@ -125,13 +124,13 @@ export class AuthenticationService<
     strategy: StrategyKeys,
     tokensParam: { refreshToken: string },
   ): Promise<Tokens> {
-    logger.debug('refreshToken', { strategy });
+    logger.debug("refreshToken", { strategy });
     if (!tokensParam.refreshToken) {
-      throw new Error('Missing refresh token');
+      throw new Error("Missing refresh token");
     }
     const strategyInstance = this.strategies[strategy];
     switch (strategyInstance.type) {
-      case 'oauth2': {
+      case "oauth2": {
         const token = strategyInstance.oauth2.clientCredentials.createToken({
           refresh_token: tokensParam.refreshToken,
         });
@@ -152,15 +151,15 @@ export class AuthenticationService<
       }
 
       default:
-        throw new Error('Invalid stategy');
+        throw new Error("Invalid stategy");
     }
   }
 
   redirectUri(ctx: Context, strategy: string): string {
-    const host = `http${this.config.get('allowHttps') ? 's' : ''}://${
+    const host = `http${this.config.get("allowHttps") ? "s" : ""}://${
       ctx.request.host
     }`;
-    return `${host}${ctx.urlGenerator('authResponse', {
+    return `${host}${ctx.urlGenerator("authResponse", {
       strategy,
     })}`;
   }
@@ -181,18 +180,18 @@ export class AuthenticationService<
     },
     params?: any,
   ): Promise<void> {
-    logger.debug('redirectAuthUrl', { strategy, scopeKey, refreshToken });
+    logger.debug("redirectAuthUrl", { strategy, scopeKey, refreshToken });
     const state = await randomHex(8);
-    const isLoginAccess = !scopeKey || scopeKey === 'login';
+    const isLoginAccess = !scopeKey || scopeKey === "login";
     const scope = this.userAccountsService.getScope(
       strategy,
-      scopeKey || 'login',
+      scopeKey || "login",
       user,
       accountId,
     );
 
     if (!scope) {
-      throw new Error('Invalid empty scope');
+      throw new Error("Invalid empty scope");
     }
 
     ctx.cookies.set(
@@ -205,18 +204,18 @@ export class AuthenticationService<
       {
         maxAge: 10 * 60 * 1000,
         httpOnly: true,
-        secure: this.config.get('allowHttps'),
+        secure: this.config.get("allowHttps"),
       },
     );
     const redirectUri = this.generateAuthUrl(strategy, {
       redirect_uri: this.redirectUri(ctx, strategy),
       scope,
       state,
-      access_type: refreshToken ? 'offline' : 'online',
+      access_type: refreshToken ? "offline" : "online",
       ...params,
     });
 
-    return ctx.redirect(redirectUri);
+    ctx.redirect(redirectUri);
   }
 
   async accessResponse<StrategyKey extends StrategyKeys>(
@@ -225,30 +224,29 @@ export class AuthenticationService<
     isLoggedIn: boolean,
     hooks: AccessResponseHooks<StrategyKeys, U>,
   ): Promise<U> {
-    if (ctx.query.error) {
-      const error: any = new Error(ctx.query.error);
-      error.status = 403;
-      error.expose = true;
-      throw error;
+    const errorParam = ctx.params.queryParam("error").notEmpty();
+    if (errorParam.isValid()) {
+      ctx.throw(403, errorParam.value);
     }
 
-    const code = ctx.query.code;
-    const state = ctx.query.state;
-    const cookieName = `auth_${strategy}_${state as string}`;
-    let cookie = ctx.cookies.get(cookieName);
-    ctx.cookies.set(cookieName, '', { expires: new Date(1) });
+    const code = ctx.validParams.queryParam("code").notEmpty().value;
+    const state = ctx.validParams.queryParam("state").notEmpty().value;
+
+    const cookieName = `auth_${strategy}_${state}`;
+    const cookie = ctx.cookies.get(cookieName);
+    ctx.cookies.set(cookieName, "", { expires: new Date(1) });
     if (!cookie) {
-      throw new Error('No cookie for this state');
+      throw new Error("No cookie for this state");
     }
 
-    cookie = JSON.parse(cookie);
-    if (!cookie?.scope) {
-      throw new Error('Unexpected cookie value');
+    const parsedCookie = JSON.parse(cookie);
+    if (!parsedCookie?.scope) {
+      throw new Error("Unexpected cookie value");
     }
 
-    if (!cookie.isLoginAccess) {
+    if (!parsedCookie.isLoginAccess) {
       if (!isLoggedIn) {
-        throw new Error('You are not connected');
+        throw new Error("You are not connected");
       }
     }
 
@@ -257,12 +255,12 @@ export class AuthenticationService<
       redirectUri: this.redirectUri(ctx, strategy),
     });
 
-    if (cookie.isLoginAccess) {
+    if (parsedCookie.isLoginAccess) {
       const user = await this.userAccountsService.findOrCreateFromStrategy(
         strategy,
         tokens,
-        cookie.scope,
-        cookie.scopeKey,
+        parsedCookie.scope,
+        parsedCookie.scopeKey,
       );
 
       if (hooks.afterLoginSuccess) {
@@ -277,12 +275,17 @@ export class AuthenticationService<
       loggedInUser,
       strategy,
       tokens,
-      cookie.scope,
-      cookie.scopeKey,
+      parsedCookie.scope,
+      parsedCookie.scopeKey,
     );
 
     if (hooks.afterScopeUpdate) {
-      await hooks.afterScopeUpdate(strategy, cookie.scopeKey, account, user);
+      await hooks.afterScopeUpdate(
+        strategy,
+        parsedCookie.scopeKey,
+        account,
+        user,
+      );
     }
 
     return loggedInUser;

package/src/services/authentification/types.ts

@@ -1,6 +1,11 @@
-import type { GoogleParams, SlackParams } from 'alp-types';
+export type GoogleParams =
+  | "access_type"
+  | "include_granted_scopes"
+  | "login_hint"
+  | "prompt";
+export type SlackParams = "client_id" | "team";
 
-export type AllowedStrategyKeys = 'google' | 'slack';
+export type AllowedStrategyKeys = "google" | "slack";
 
 export interface AllowedMapParamsStrategy {
   google: GoogleParams;

package/src/services/user/UserAccountGoogleService.ts

@@ -1,24 +1,24 @@
-/* eslint-disable @typescript-eslint/class-methods-use-this */
 /* eslint-disable @typescript-eslint/no-unsafe-argument */
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
-import type { Tokens } from '../authentification/types';
-import type { AccountService, FullName } from './types';
+import type { Tokens } from "../authentification/types";
+import type { AccountService, FullName } from "./types";
 
-export default class UserAccountGoogleService<ScopeKeys extends 'login'>
+export default class UserAccountGoogleService<ScopeKeys extends "login">
   implements AccountService<ScopeKeys>
 {
   scopeKeyToScope: Record<ScopeKeys, string>;
 
-  constructor(scopeKeyToScope: Record<Exclude<'login', ScopeKeys>, string>) {
+  constructor(scopeKeyToScope: Record<Exclude<"login", ScopeKeys>, string>) {
     this.scopeKeyToScope = {
       ...scopeKeyToScope,
-      login: 'openid profile email',
+      login: "openid profile email",
     };
   }
 
-  providerKey = 'google';
+  providerKey = "google";
 
   getProfile(tokens: Tokens): Promise<any> {
+    // eslint-disable-next-line n/no-unsupported-features/node-builtins
     return fetch(
       `https://www.googleapis.com/oauth2/v1/userinfo?access_token=${tokens.accessToken}`,
     ).then((response) => response.json());
@@ -59,8 +59,8 @@ export default class UserAccountGoogleService<ScopeKeys extends 'login'>
 
   getScope(oldScope: string[] | undefined, newScope: string): string[] {
     return !oldScope
-      ? newScope.split(' ')
-      : [...oldScope, ...newScope.split(' ')].filter(
+      ? newScope.split(" ")
+      : [...oldScope, ...newScope.split(" ")].filter(
           (item, i, ar) => ar.indexOf(item) === i,
         );
   }

package/src/services/user/UserAccountSlackService.ts

@@ -1,25 +1,25 @@
-/* eslint-disable @typescript-eslint/class-methods-use-this */
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
-import type { Tokens } from '../authentification/types';
-import type { AccountService, FullName } from './types';
+import type { Tokens } from "../authentification/types";
+import type { AccountService, FullName } from "./types";
 
 // https://api.slack.com/methods/users.identity
 
-export default class UserAccountSlackService<ScopeKeys extends 'login'>
+export default class UserAccountSlackService<ScopeKeys extends "login">
   implements AccountService<ScopeKeys>
 {
   scopeKeyToScope: Record<ScopeKeys, string>;
 
-  constructor(scopeKeyToScope: Record<Exclude<'login', ScopeKeys>, string>) {
+  constructor(scopeKeyToScope: Record<Exclude<"login", ScopeKeys>, string>) {
     this.scopeKeyToScope = {
       ...scopeKeyToScope,
-      login: 'identity.basic identity.email identity.avatar',
+      login: "identity.basic identity.email identity.avatar",
     };
   }
 
-  providerKey = 'google';
+  providerKey = "google";
 
   getProfile(tokens: Tokens): Promise<any> {
+    // eslint-disable-next-line n/no-unsupported-features/node-builtins
     return fetch(
       `https://slack.com/api/users.identity?token=${tokens.accessToken}`,
     ).then((response) => response.json());
@@ -56,8 +56,8 @@ export default class UserAccountSlackService<ScopeKeys extends 'login'>
 
   getScope(oldScope: string[] | undefined, newScope: string): string[] {
     return !oldScope
-      ? newScope.split(' ')
-      : [...oldScope, ...newScope.split(' ')].filter(
+      ? newScope.split(" ")
+      : [...oldScope, ...newScope.split(" ")].filter(
           (item, i, ar) => ar.indexOf(item) === i,
         );
   }