bluera-knowledge 0.9.21

package/tests/fixtures/code-snippets/auth/jwt-auth.ts

@@ -0,0 +1,213 @@
+/**
+ * JWT Authentication Module
+ *
+ * This module provides JWT-based authentication for Express applications.
+ * It handles token generation, verification, and middleware for protected routes.
+ */
+
+import jwt from 'jsonwebtoken';
+import type { Request, Response, NextFunction } from 'express';
+import { createHash, randomBytes } from 'crypto';
+
+// Configuration
+const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';
+const REFRESH_SECRET = process.env.REFRESH_SECRET || 'your-refresh-secret';
+const ACCESS_TOKEN_EXPIRY = '15m';
+const REFRESH_TOKEN_EXPIRY = '7d';
+
+/**
+ * JWT Payload interface
+ */
+export interface JwtPayload {
+  userId: string;
+  email: string;
+  roles: string[];
+  iat?: number;
+  exp?: number;
+}
+
+/**
+ * Token pair returned after authentication
+ */
+export interface TokenPair {
+  accessToken: string;
+  refreshToken: string;
+  expiresIn: number;
+}
+
+/**
+ * Extend Express Request to include user information
+ */
+declare global {
+  namespace Express {
+    interface Request {
+      user?: JwtPayload;
+    }
+  }
+}
+
+/**
+ * Generates an access token for the given user
+ * @param user - User object containing id, email, and roles
+ * @returns JWT access token
+ */
+export function generateAccessToken(user: {
+  id: string;
+  email: string;
+  roles: string[];
+}): string {
+  const payload: JwtPayload = {
+    userId: user.id,
+    email: user.email,
+    roles: user.roles,
+  };
+
+  return jwt.sign(payload, JWT_SECRET, {
+    expiresIn: ACCESS_TOKEN_EXPIRY,
+    algorithm: 'HS256',
+  });
+}
+
+/**
+ * Generates a refresh token for the given user ID
+ * @param userId - User's unique identifier
+ * @returns JWT refresh token
+ */
+export function generateRefreshToken(userId: string): string {
+  const tokenId = randomBytes(16).toString('hex');
+
+  return jwt.sign(
+    { userId, tokenId },
+    REFRESH_SECRET,
+    { expiresIn: REFRESH_TOKEN_EXPIRY }
+  );
+}
+
+/**
+ * Generates both access and refresh tokens
+ * @param user - User object
+ * @returns Token pair with access token, refresh token, and expiry time
+ */
+export function generateTokenPair(user: {
+  id: string;
+  email: string;
+  roles: string[];
+}): TokenPair {
+  return {
+    accessToken: generateAccessToken(user),
+    refreshToken: generateRefreshToken(user.id),
+    expiresIn: 900, // 15 minutes in seconds
+  };
+}
+
+/**
+ * Verifies an access token and returns the payload
+ * @param token - JWT access token to verify
+ * @returns Decoded JWT payload
+ * @throws Error if token is invalid or expired
+ */
+export function verifyAccessToken(token: string): JwtPayload {
+  try {
+    return jwt.verify(token, JWT_SECRET) as JwtPayload;
+  } catch (error) {
+    if (error instanceof jwt.TokenExpiredError) {
+      throw new Error('Access token has expired');
+    }
+    if (error instanceof jwt.JsonWebTokenError) {
+      throw new Error('Invalid access token');
+    }
+    throw error;
+  }
+}
+
+/**
+ * Verifies a refresh token and returns the user ID
+ * @param token - JWT refresh token to verify
+ * @returns User ID from the token
+ */
+export function verifyRefreshToken(token: string): { userId: string; tokenId: string } {
+  try {
+    return jwt.verify(token, REFRESH_SECRET) as { userId: string; tokenId: string };
+  } catch (error) {
+    throw new Error('Invalid refresh token');
+  }
+}
+
+/**
+ * Express middleware to authenticate requests using JWT
+ * Extracts the token from the Authorization header (Bearer scheme)
+ */
+export function authenticateToken(
+  req: Request,
+  res: Response,
+  next: NextFunction
+): void {
+  const authHeader = req.headers['authorization'];
+  const token = authHeader && authHeader.split(' ')[1];
+
+  if (!token) {
+    res.status(401).json({
+      error: 'Access token required',
+      code: 'MISSING_TOKEN',
+    });
+    return;
+  }
+
+  try {
+    const payload = verifyAccessToken(token);
+    req.user = payload;
+    next();
+  } catch (error) {
+    res.status(403).json({
+      error: error instanceof Error ? error.message : 'Token verification failed',
+      code: 'INVALID_TOKEN',
+    });
+  }
+}
+
+/**
+ * Express middleware to check if user has required roles
+ * @param requiredRoles - Array of role names that are allowed
+ */
+export function requireRoles(...requiredRoles: string[]) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    if (!req.user) {
+      res.status(401).json({
+        error: 'Authentication required',
+        code: 'NOT_AUTHENTICATED',
+      });
+      return;
+    }
+
+    const hasRole = req.user.roles.some(role => requiredRoles.includes(role));
+
+    if (!hasRole) {
+      res.status(403).json({
+        error: 'Insufficient permissions',
+        code: 'FORBIDDEN',
+        requiredRoles,
+        userRoles: req.user.roles,
+      });
+      return;
+    }
+
+    next();
+  };
+}
+
+/**
+ * Hashes a password using SHA-256 with salt
+ * Note: In production, use bcrypt or argon2 instead
+ */
+export function hashPassword(password: string, salt: string): string {
+  return createHash('sha256')
+    .update(password + salt)
+    .digest('hex');
+}
+
+/**
+ * Generates a random salt for password hashing
+ */
+export function generateSalt(): string {
+  return randomBytes(16).toString('hex');
+}

package/tests/fixtures/code-snippets/auth/oauth-flow.ts

@@ -0,0 +1,245 @@
+/**
+ * OAuth 2.0 Authentication Flow Implementation
+ *
+ * This module handles OAuth authentication with various providers
+ * including Google, GitHub, and generic OAuth 2.0 servers.
+ */
+
+import { randomBytes, createHash } from 'crypto';
+
+// OAuth Configuration
+export interface OAuthConfig {
+  clientId: string;
+  clientSecret: string;
+  redirectUri: string;
+  authorizationUrl: string;
+  tokenUrl: string;
+  userInfoUrl: string;
+  scopes: string[];
+}
+
+// OAuth Provider Configurations
+export const PROVIDERS: Record<string, Partial<OAuthConfig>> = {
+  google: {
+    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+    userInfoUrl: 'https://www.googleapis.com/oauth2/v2/userinfo',
+    scopes: ['openid', 'email', 'profile'],
+  },
+  github: {
+    authorizationUrl: 'https://github.com/login/oauth/authorize',
+    tokenUrl: 'https://github.com/login/oauth/access_token',
+    userInfoUrl: 'https://api.github.com/user',
+    scopes: ['read:user', 'user:email'],
+  },
+};
+
+/**
+ * OAuth State Management
+ * Stores state tokens to prevent CSRF attacks
+ */
+const stateStore = new Map<string, { expiresAt: number; data: Record<string, unknown> }>();
+
+/**
+ * Generates a cryptographically secure state token
+ * Used to prevent CSRF attacks during OAuth flow
+ */
+export function generateState(data: Record<string, unknown> = {}): string {
+  const state = randomBytes(32).toString('hex');
+  const expiresAt = Date.now() + 10 * 60 * 1000; // 10 minutes
+
+  stateStore.set(state, { expiresAt, data });
+
+  // Clean up expired states
+  for (const [key, value] of stateStore.entries()) {
+    if (value.expiresAt < Date.now()) {
+      stateStore.delete(key);
+    }
+  }
+
+  return state;
+}
+
+/**
+ * Validates and consumes a state token
+ * @returns The data associated with the state, or null if invalid
+ */
+export function validateState(state: string): Record<string, unknown> | null {
+  const stored = stateStore.get(state);
+
+  if (!stored) {
+    return null;
+  }
+
+  if (stored.expiresAt < Date.now()) {
+    stateStore.delete(state);
+    return null;
+  }
+
+  stateStore.delete(state);
+  return stored.data;
+}
+
+/**
+ * PKCE Code Verifier and Challenge
+ * Implements Proof Key for Code Exchange for added security
+ */
+export interface PKCEPair {
+  codeVerifier: string;
+  codeChallenge: string;
+}
+
+/**
+ * Generates PKCE code verifier and challenge
+ * Required for public clients (SPAs, mobile apps)
+ */
+export function generatePKCE(): PKCEPair {
+  const codeVerifier = randomBytes(32)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+
+  const codeChallenge = createHash('sha256')
+    .update(codeVerifier)
+    .digest('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '');
+
+  return { codeVerifier, codeChallenge };
+}
+
+/**
+ * Builds the authorization URL for OAuth flow
+ */
+export function buildAuthorizationUrl(
+  config: OAuthConfig,
+  options: {
+    state?: string;
+    codeChallenge?: string;
+    prompt?: 'none' | 'consent' | 'select_account';
+  } = {}
+): string {
+  const url = new URL(config.authorizationUrl);
+
+  url.searchParams.set('client_id', config.clientId);
+  url.searchParams.set('redirect_uri', config.redirectUri);
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('scope', config.scopes.join(' '));
+
+  if (options.state) {
+    url.searchParams.set('state', options.state);
+  }
+
+  if (options.codeChallenge) {
+    url.searchParams.set('code_challenge', options.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+  }
+
+  if (options.prompt) {
+    url.searchParams.set('prompt', options.prompt);
+  }
+
+  return url.toString();
+}
+
+/**
+ * Token Response from OAuth provider
+ */
+export interface TokenResponse {
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+  refresh_token?: string;
+  scope?: string;
+  id_token?: string;
+}
+
+/**
+ * Exchanges authorization code for tokens
+ */
+export async function exchangeCodeForTokens(
+  config: OAuthConfig,
+  code: string,
+  codeVerifier?: string
+): Promise<TokenResponse> {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    client_id: config.clientId,
+    client_secret: config.clientSecret,
+    redirect_uri: config.redirectUri,
+    code,
+  });
+
+  if (codeVerifier) {
+    body.set('code_verifier', codeVerifier);
+  }
+
+  const response = await fetch(config.tokenUrl, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      'Accept': 'application/json',
+    },
+    body: body.toString(),
+  });
+
+  if (!response.ok) {
+    const error = await response.json();
+    throw new Error(`Token exchange failed: ${error.error_description || error.error}`);
+  }
+
+  return response.json();
+}
+
+/**
+ * Fetches user info from OAuth provider
+ */
+export async function fetchUserInfo(
+  config: OAuthConfig,
+  accessToken: string
+): Promise<Record<string, unknown>> {
+  const response = await fetch(config.userInfoUrl, {
+    headers: {
+      'Authorization': `Bearer ${accessToken}`,
+      'Accept': 'application/json',
+    },
+  });
+
+  if (!response.ok) {
+    throw new Error(`Failed to fetch user info: ${response.statusText}`);
+  }
+
+  return response.json();
+}
+
+/**
+ * Refreshes an access token using a refresh token
+ */
+export async function refreshAccessToken(
+  config: OAuthConfig,
+  refreshToken: string
+): Promise<TokenResponse> {
+  const body = new URLSearchParams({
+    grant_type: 'refresh_token',
+    client_id: config.clientId,
+    client_secret: config.clientSecret,
+    refresh_token: refreshToken,
+  });
+
+  const response = await fetch(config.tokenUrl, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      'Accept': 'application/json',
+    },
+    body: body.toString(),
+  });
+
+  if (!response.ok) {
+    throw new Error('Token refresh failed');
+  }
+
+  return response.json();
+}