cca-auth-module 0.2.1 → 0.2.21

package/dist/index.mjs

@@ -139,6 +139,7 @@ import { jwtDecode } from "jwt-decode";
 import * as yup from "yup";
 import { UserRole } from "cca-entities";
 import bcrypt from "bcrypt";
+import crypto from "crypto";
 var schemas = {
   id: yup.string().uuid("Invalid user ID format"),
   email: yup.string().email("Invalid email format").max(255, "Email cannot exceed 255 characters"),
@@ -151,8 +152,9 @@ var schemas = {
 };
 var validateEmail = /* @__PURE__ */ __name(async (email, repository) => {
   try {
-    await schemas.email.validate(email?.trim().toLowerCase());
-    const user = await repository.findByEmail(email);
+    const normalizedEmail = email?.trim().toLowerCase();
+    await schemas.email.validate(normalizedEmail);
+    const user = await repository.findByEmail(normalizedEmail);
     if (!user) {
       throw new NotFoundError(
         "The email address or password is incorrect. Please retry"
@@ -174,8 +176,9 @@ var validatePassword = /* @__PURE__ */ __name(async (password) => {
 }, "validatePassword");
 var validateEmailUniqueness = /* @__PURE__ */ __name(async (repository, email, excludeUserId) => {
   try {
-    await schemas.email.validate(email?.trim().toLowerCase());
-    const existingUser = await repository.findByEmail(email);
+    const normalizedEmail = email?.trim().toLowerCase();
+    await schemas.email.validate(normalizedEmail);
+    const existingUser = await repository.findByEmail(normalizedEmail);
     if (!existingUser) return;
     if (existingUser.id === excludeUserId) return;
     throw new ValidationError(`Email ${email} is already in use.`);
@@ -220,7 +223,14 @@ var validateAdminSecret = /* @__PURE__ */ __name(async (secretPassword) => {
     if (!config.adminSecretPassword) {
       throw new ValidationError("ADMIN_SECRET_PASSWORD not found in config");
     }
-    if (parseInt(secretPassword) !== parseInt(config.adminSecretPassword)) {
+    const provided = secretPassword.trim();
+    const expected = config.adminSecretPassword.trim();
+    if (provided.length !== expected.length) {
+      throw new ValidationError("Invalid admin password");
+    }
+    const providedBuf = Buffer.from(provided);
+    const expectedBuf = Buffer.from(expected);
+    if (!crypto.timingSafeEqual(providedBuf, expectedBuf)) {
       throw new ValidationError("Invalid admin password");
     }
   } catch (error) {
@@ -250,8 +260,9 @@ var _LoginUseCase = class _LoginUseCase {
     if (!account) {
       throw new NotFoundError(`${isAdmin ? "Admin" : "User"} account not found or inactive`);
     }
-    const accessToken = this.jwtService.generateAccessToken(account, auth.role);
-    const expiresAt = jwtDecode(accessToken).exp;
+    const accessToken = this.jwtService.generateAccessToken(account, auth.role, false);
+    const decoded = jwtDecode(accessToken);
+    const expiresAt = decoded.exp ?? 0;
     return { id: account.id, accessToken, expiresAt, enabled: auth.twoFactorEnabled };
   }
 };
@@ -267,11 +278,17 @@ var _LogoutUseCase = class _LogoutUseCase {
   async initialize() {
     await validateRepository2(this.repository, (repo) => repo.getAll());
   }
-  async execute(authId) {
+  async execute(userId) {
     try {
-      await this.repository.logout(authId);
+      if (!userId) {
+        throw new NotFoundError("User ID is required");
+      }
+      await this.repository.logout(userId);
     } catch (error) {
-      new NotFoundError("Auth not found");
+      if (error instanceof NotFoundError) {
+        throw error;
+      }
+      throw new NotFoundError("Auth not found");
     }
   }
 };
@@ -443,7 +460,11 @@ var _RegisterUseCase = class _RegisterUseCase {
     const authEntity = mapper.map(dto, RegisterDTO, AuthEntity3);
     const userOrAdminEntity = isAdmin ? mapper.map(dto, RegisterDTO, AdminEntity2) : mapper.map(dto, RegisterDTO, UserEntity2);
     userOrAdminEntity.updatedAt = void 0;
-    authEntity.user = userOrAdminEntity;
+    if (isAdmin) {
+      authEntity.admin = userOrAdminEntity;
+    } else {
+      authEntity.user = userOrAdminEntity;
+    }
     authEntity.password = hashedPassword;
     authEntity.refreshToken = "";
     return authEntity;
@@ -464,18 +485,23 @@ var _RefreshTokenUseCase = class _RefreshTokenUseCase {
   }
   async execute(refreshToken) {
     try {
+      if (!refreshToken) return null;
       const decoded = await this.service.verifyRefreshToken(refreshToken);
       if (!decoded.userId) return null;
-      const authEntity = await this.repository.findByUseAdminId(decoded.userId);
+      const authEntity = await this.repository.findByUserOrAdminId(decoded.userId);
       if (!authEntity) return null;
+      if (!authEntity.refreshToken || authEntity.refreshToken !== refreshToken) return null;
       const account = authEntity.user ?? authEntity.admin;
       if (!account) return null;
-      const accessToken = this.service.generateAccessToken(account, authEntity.role);
+      const accessToken = this.service.generateAccessToken(
+        account,
+        authEntity.role,
+        !!authEntity.twoFactorEnabled
+      );
       const newRefreshToken = this.service.generateRefreshToken(account);
       await this.repository.update(authEntity.id, { refreshToken: newRefreshToken });
       return { accessToken, refreshToken: newRefreshToken };
     } catch (error) {
-      console.error("Refresh token failed:", error);
       return null;
     }
   }
@@ -541,6 +567,9 @@ var _TwoFactorEnableUseCase = class _TwoFactorEnableUseCase {
     if (!token) {
       throw new TwoFactorError("Token is required");
     }
+    if (!userId) {
+      throw new TwoFactorError("User ID is required");
+    }
     const auth = await this.authRepository.findByUserOrAdminId(userId);
     if (!auth || !auth.twoFactorSecret) {
       throw new TwoFactorError("Please set up two-factor authentication first");
@@ -623,7 +652,7 @@ var _TwoFactorVerifyUseCase = class _TwoFactorVerifyUseCase {
     if (!account) throw new NotFoundError("User or Admin account not found for AuthEntity");
     account.lastLoginAt = /* @__PURE__ */ new Date();
     account.isActive = true;
-    await this.authRepository.update(auth.id, auth);
+    await this.authRepository.saveAccount(account);
   }
   async updateUserRefreshToken(auth, refreshToken) {
     auth.refreshToken = refreshToken;
@@ -633,7 +662,7 @@ var _TwoFactorVerifyUseCase = class _TwoFactorVerifyUseCase {
     const account = auth.user ?? auth.admin;
     if (!account) throw new NotFoundError("User or Admin account not found for AuthEntity");
     return {
-      accessToken: this.jwtService.generateAccessToken(account, auth.role),
+      accessToken: this.jwtService.generateAccessToken(account, auth.role, true),
       refreshToken: this.jwtService.generateRefreshToken(account)
     };
   }
@@ -655,7 +684,6 @@ var _TwoFactorDisableUseCase = class _TwoFactorDisableUseCase {
       this.twoFactorService.initialize(),
       validateRepository7(this.authRepository, (repo) => repo.getAll())
     ]);
-    4;
     this.isInitialized = true;
   }
   async execute(userId, dto) {
@@ -663,6 +691,12 @@ var _TwoFactorDisableUseCase = class _TwoFactorDisableUseCase {
       await this.initialize();
     }
     const { token } = dto;
+    if (!token) {
+      throw new TwoFactorError("Token is required");
+    }
+    if (!userId) {
+      throw new TwoFactorError("User ID is required");
+    }
     const user = await this.authRepository.findByUserOrAdminId(userId);
     if (!user || !user.twoFactorSecret || !user.twoFactorEnabled) {
       throw new TwoFactorError("Two-factor authentication is not enabled");
@@ -738,11 +772,13 @@ var _AuthController = class _AuthController {
         }
         const result = await this.loginUseCase.execute(loginDTO, adminPassword);
         const adminLoginData = {
-          message: result,
+          accessToken: result.accessToken,
+          userId: result.id,
+          expiresAt: result.expiresAt,
           auth: this.createAuthData(
             true,
-            false,
-            AUTH_STATUS.BASIC_AUTH,
+            result.enabled ?? false,
+            result.enabled ?? false ? AUTH_STATUS.PENDING_VERIFICATION : AUTH_STATUS.BASIC_AUTH,
             false
           )
         };
@@ -753,7 +789,8 @@ var _AuthController = class _AuthController {
     }, "adminLogin");
     this.logout = /* @__PURE__ */ __name(async (req, res, next) => {
       try {
-        await this.logoutUseCase.execute(req.body.id);
+        const userId = req.auth?.userId ?? req.body.id;
+        await this.logoutUseCase.execute(userId);
         const logoutData = {
           auth: this.createAuthData(
             false,
@@ -814,10 +851,10 @@ var _AuthController = class _AuthController {
     }, "refreshToken");
     this.setup2FA = /* @__PURE__ */ __name(async (req, res, next) => {
       try {
-        if (!req.auth?.id) {
+        if (!req.auth?.userId) {
           throw new ForbiddenError("User authentication required");
         }
-        const result = await this.twoFactorSetupUseCase.execute(req.auth.id);
+        const result = await this.twoFactorSetupUseCase.execute(req.auth.userId);
         const setupData = {
           qrCode: result.qrCodeUrl,
           auth: this.createAuthData(true, false, AUTH_STATUS.NEEDS_SETUP)
@@ -833,7 +870,10 @@ var _AuthController = class _AuthController {
     }, "setup2FA");
     this.enable2FA = /* @__PURE__ */ __name(async (req, res, next) => {
       try {
-        const dto = { ...req.body, userId: req.auth?.id };
+        if (!req.auth?.userId) {
+          throw new ForbiddenError("User authentication required");
+        }
+        const dto = { ...req.body, userId: req.auth?.userId };
         await this.twoFactorEnableUseCase.execute(dto);
         const enableData = {
           enabledAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -850,16 +890,22 @@ var _AuthController = class _AuthController {
     }, "enable2FA");
     this.verify2FA = /* @__PURE__ */ __name(async (req, res, next) => {
       try {
-        const dto = req.body;
+        if (!req.auth?.userId) {
+          throw new ForbiddenError("User authentication required");
+        }
+        const dto = { ...req.body, userId: req.auth.userId };
         const result = await this.twoFactorVerifyUseCase.execute(dto);
+        if (!result) {
+          throw new Error("Two-factor verification failed");
+        }
         const verifyData = {
-          token: result?.token,
-          refreshToken: result?.refreshToken,
+          token: result.token,
+          refreshToken: result.refreshToken,
           user: {
-            id: result?.data?.id,
-            email: result?.data?.email,
-            name: result?.data?.name,
-            role: result?.data?.role
+            id: result.data?.id,
+            email: result.data?.email,
+            name: result.data?.name,
+            role: result.data?.role
           },
           auth: this.createAuthData(true, true, AUTH_STATUS.FULL_AUTH, true)
         };
@@ -874,7 +920,10 @@ var _AuthController = class _AuthController {
     }, "verify2FA");
     this.disable2FA = /* @__PURE__ */ __name(async (req, res, next) => {
       try {
-        const userId = req.auth.id;
+        const userId = req.auth?.userId;
+        if (!userId) {
+          throw new ForbiddenError("User authentication required");
+        }
         const dto = req.body;
         await this.twoFactorDisableUseCase.execute(userId, dto);
         const disableData = {
@@ -938,11 +987,14 @@ var _RequireComplete2FA = class _RequireComplete2FA {
         return res.status(401).json({ message: "Authentication required" });
       }
       const decoded = await this.jwtService.verifyAccessToken(token);
+      if (!decoded.userId) {
+        return res.status(401).json({ message: "Invalid token payload" });
+      }
       if (!decoded.twoFactorAuthenticated) {
         return res.status(403).json({
           message: "Two-factor authentication required",
           code: "REQUIRE_2FA",
-          userId: decoded.id
+          userId: decoded.userId
         });
       }
       req.auth = { ...decoded, twoFactorAuthenticated: true };
@@ -966,13 +1018,20 @@ var _AuthRepository = class _AuthRepository extends BaseRepository {
     return result;
   }
   async create(entity) {
-    return super.create(entity);
+    const now = /* @__PURE__ */ new Date();
+    const auth = this.repository.create({
+      ...entity,
+      createdAt: now,
+      updatedAt: now,
+      isDeleted: false
+    });
+    return this.repository.save(auth);
   }
   async findByUserOrAdminId(id) {
-    return await this.repository.createQueryBuilder("auth").leftJoinAndSelect("auth.user", "user").leftJoinAndSelect("auth.admin", "admin").addSelect("auth.twoFactorSecret").where("user.id = :id", { id }).orWhere("admin.id = :id", { id }).getOne();
+    return await this.repository.createQueryBuilder("auth").leftJoinAndSelect("auth.user", "user").leftJoinAndSelect("auth.admin", "admin").addSelect(["auth.twoFactorSecret", "auth.refreshToken"]).where("user.id = :id", { id }).orWhere("admin.id = :id", { id }).getOne();
   }
   async findByUseAdminId(userId, isAdmin = false) {
-    const query = this.repository.createQueryBuilder("auth").addSelect("auth.twoFactorSecret");
+    const query = this.repository.createQueryBuilder("auth").addSelect(["auth.twoFactorSecret", "auth.refreshToken"]);
     if (isAdmin) {
       query.leftJoinAndSelect("auth.admin", "admin").where("admin.id = :userId", { userId });
     } else {
@@ -989,6 +1048,7 @@ var _AuthRepository = class _AuthRepository extends BaseRepository {
     if (account) {
       auth.refreshToken = "";
       account.isActive = false;
+      await this.saveAccount(account);
     }
     await this.update(auth.id, auth);
   }
@@ -1023,6 +1083,9 @@ var _AuthRepository = class _AuthRepository extends BaseRepository {
     }
     return auth.twoFactorSecret;
   }
+  async saveAccount(account) {
+    await this.repository.manager.save(account);
+  }
 };
 __name(_AuthRepository, "AuthRepository");
 var AuthRepository = _AuthRepository;
@@ -1033,34 +1096,40 @@ import { validateRepository as validateRepository8 } from "cca-core";
 var _JwtAuthService = class _JwtAuthService {
   constructor(repository, config) {
     this.repository = repository;
-    this.loadConfig(config);
-  }
-  async loadConfig(config) {
-    const configData = await createConfigInstance();
-    this.jwtConfig = {
-      accessTokenSecret: configData.accessTokenSecret,
-      refreshTokenSecret: configData.refreshTokenSecret,
-      accessTokenExpiry: parseInt(configData.accessTokenExpiry, 10),
-      refreshTokenExpiry: parseInt(configData.refreshTokenExpiry, 10),
-      ...config
-    };
+    if (config) {
+      this.jwtConfig = {
+        accessTokenSecret: config.accessTokenSecret,
+        refreshTokenSecret: config.refreshTokenSecret,
+        accessTokenExpiry: config.accessTokenExpiry,
+        refreshTokenExpiry: config.refreshTokenExpiry
+      };
+    }
     this.validateConfiguration();
   }
   async initialize() {
     await validateRepository8(this.repository, (repo) => repo.getAll());
+    this.validateConfiguration();
   }
   validateConfiguration() {
     if (!this.jwtConfig?.accessTokenSecret || !this.jwtConfig?.refreshTokenSecret) {
       throw new JwtError("JWT secrets required in config");
     }
+    if (this.jwtConfig.accessTokenExpiry == null || this.jwtConfig.refreshTokenExpiry == null) {
+      throw new JwtError("JWT expirations required in config");
+    }
   }
   verifyJwtConfig() {
     if (!this.jwtConfig) throw new JwtError("JWT config not loaded");
   }
-  generateAccessToken(user, role) {
+  generateAccessToken(user, role, twoFactorAuthenticated = false) {
     this.verifyJwtConfig();
     return jwt.sign(
-      { userId: user.id, email: user.email, role },
+      {
+        userId: user.id,
+        email: user.email,
+        role,
+        twoFactorAuthenticated
+      },
       this.jwtConfig.accessTokenSecret,
       { expiresIn: this.jwtConfig.accessTokenExpiry }
     );
@@ -1075,11 +1144,8 @@ var _JwtAuthService = class _JwtAuthService {
   }
   async verifyToken(token, secret) {
     try {
-      console.log("Verifying token:", token);
-      console.log("Using secret:", secret);
       return jwt.verify(token, secret);
     } catch (error) {
-      console.error("Error verifying token:", error);
       throw new UnauthorizedError();
     }
   }
@@ -1102,9 +1168,11 @@ var _TwoFactorService = class _TwoFactorService {
   constructor(config) {
     this.initialized = false;
     this.config = config;
+    const parsedTokenWindow = Number.parseInt(config.tokenWindow, 10);
+    const parsedSecretLength = Number.parseInt(config.secretLength, 10);
     this.twoFactorConfig = {
-      tokenWindow: parseInt(config.tokenWindow) ?? 1,
-      secretLength: parseInt(config.secretLength) ?? 20,
+      tokenWindow: Number.isFinite(parsedTokenWindow) ? parsedTokenWindow : 1,
+      secretLength: Number.isFinite(parsedSecretLength) ? parsedSecretLength : 20,
       qrCodeOptions: {
         errorCorrectionLevel: "M",
         margin: 4,
@@ -1193,25 +1261,35 @@ async function createAuthContainer(database) {
     database.getRepository(AuthEntity5)
   );
   container.registerRepository("AuthRepository", authRepository);
-  const jwtAuthService = new JwtAuthService(authRepository);
-  container.registerService("JwtAuthService", jwtAuthService);
   const configData = await createConfigInstance();
+  const parseExpiry = /* @__PURE__ */ __name((value) => {
+    const numeric = Number(value);
+    return Number.isFinite(numeric) ? numeric : value;
+  }, "parseExpiry");
+  const jwtConfig = {
+    accessTokenSecret: configData.accessTokenSecret,
+    refreshTokenSecret: configData.refreshTokenSecret,
+    accessTokenExpiry: parseExpiry(configData.accessTokenExpiry),
+    refreshTokenExpiry: parseExpiry(configData.refreshTokenExpiry)
+  };
+  const configuredJwtAuthService = new JwtAuthService(authRepository, jwtConfig);
+  container.registerService("JwtAuthService", configuredJwtAuthService);
   const twoFactorService = new TwoFactorService(configData);
   container.registerService("TwoFactorService", twoFactorService);
-  const requireComplete2FA = new RequireComplete2FA(jwtAuthService);
-  const loginUseCase = new LoginUseCase(authRepository, jwtAuthService);
+  const requireComplete2FA = new RequireComplete2FA(configuredJwtAuthService);
+  const loginUseCase = new LoginUseCase(authRepository, configuredJwtAuthService);
   const logoutUseCase = new LogoutUseCase(authRepository);
   const registerUseCase = new RegisterUseCase(authRepository);
   const refreshTokenUseCase = new RefreshTokenUseCase(
     authRepository,
-    jwtAuthService
+    configuredJwtAuthService
   );
   const twoFactorSetupUseCase = new TwoFactorSetupUseCase(twoFactorService, authRepository);
   const twoFactorEnableUseCase = new TwoFactorEnableUseCase(twoFactorService, authRepository);
   const twoFactorVerifyUseCase = new TwoFactorVerifyUseCase(
     twoFactorService,
     authRepository,
-    jwtAuthService
+    configuredJwtAuthService
   );
   const twoFactorDisableUseCase = new TwoFactorDisableUseCase(twoFactorService, authRepository);
   container.registerService("LoginUseCase", loginUseCase);