create-authenik8-app 2.4.12 → 2.4.13

package/templates/fullstack/apps/api/src/auth/auth.service.ts

@@ -0,0 +1,257 @@
+import bcrypt from "bcryptjs";
+import type { Request } from "express";
+import type { User } from "@prisma/client";
+import { z } from "zod";
+import type { OAuthProvider, RegisterInput } from "@authenik8/contracts";
+import { env } from "../config/env.js";
+import { prisma } from "../config/prisma.js";
+import { AppError } from "../utils/http.js";
+import { hashToken, randomToken } from "../utils/crypto.js";
+import { openSealedValue, sealValue } from "../utils/sealed-value.js";
+import { getAuthenik8, redis } from "./authenik8.js";
+import { presentUser } from "../modules/users/user.presenter.js";
+import { sendPasswordResetEmail, sendVerificationEmail } from "../config/mailer.js";
+
+const genericCredentials = new AppError(401, "INVALID_CREDENTIALS", "Email or password is incorrect");
+const requestMetadataSchema = z.object({
+  userAgent: z.string().trim().min(1).max(300),
+  ipAddress: z.string().trim().min(1).max(64),
+});
+const oauthExchangeSessionSchema = z.strictObject({
+  accessToken: z.string().min(1).max(8192),
+  refreshToken: z.string().min(1).max(4096),
+  user: z.strictObject({
+    id: z.string().uuid(),
+    email: z.string().email().max(254),
+    name: z.string().min(1).max(80),
+    role: z.enum(["USER", "ADMIN"]),
+    status: z.enum(["ACTIVE", "SUSPENDED"]),
+    verified: z.boolean(),
+    createdAt: z.string().datetime(),
+  }),
+});
+
+function sessionMetadata(req: Request) {
+  return requestMetadataSchema.parse({
+    userAgent: (req.get("user-agent") ?? "Unknown device").slice(0, 300),
+    ipAddress: (req.ip ?? "unknown").slice(0, 64),
+  });
+}
+
+export async function issueSession(user: User, req: Request) {
+  const tokens = await getAuthenik8().issueTokens({ userId: user.id, email: user.email, role: user.role });
+  const accessToken = await tokens.accessToken;
+  const refreshToken = tokens.refreshToken;
+  const accessPayload = await getAuthenik8().verifyToken(accessToken);
+  if (!accessPayload?.sessionId) {
+    throw new AppError(500, "SESSION_ISSUE_FAILED", "Unable to create an authenticated session");
+  }
+
+  await prisma.session.create({
+    data: {
+      userId: user.id,
+      coreSessionId: accessPayload.sessionId,
+      refreshHash: hashToken(refreshToken),
+      ...sessionMetadata(req),
+      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+    },
+  });
+
+  return { accessToken, refreshToken, user: presentUser(user) };
+}
+
+export async function register(input: RegisterInput) {
+  const existing = await prisma.user.findUnique({ where: { email: input.email } });
+  if (existing) return { message: "Check your inbox to continue" };
+
+  const rawToken = randomToken();
+  await prisma.user.create({
+    data: {
+      email: input.email,
+      name: input.name,
+      passwordHash: await bcrypt.hash(input.password, 12),
+      verificationTokens: {
+        create: { tokenHash: hashToken(rawToken), expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) },
+      },
+    },
+  });
+  await sendVerificationEmail(input.email, rawToken);
+
+  return {
+    message: "Check your inbox to continue",
+    ...(env.NODE_ENV === "development" ? { devVerificationToken: rawToken } : {}),
+  };
+}
+
+export async function login(input: { email: string; password: string }, req: Request) {
+  const user = await prisma.user.findUnique({ where: { email: input.email } });
+  if (!user?.passwordHash || user.status !== "ACTIVE") throw genericCredentials;
+  if (!(await bcrypt.compare(input.password, user.passwordHash))) throw genericCredentials;
+  return issueSession(user, req);
+}
+
+export async function rotateSession(refreshToken: string | undefined) {
+  if (!refreshToken) throw new AppError(401, "REFRESH_REQUIRED", "Refresh session is missing");
+  const session = await prisma.session.findUnique({
+    where: { refreshHash: hashToken(refreshToken) },
+    include: { user: true },
+  });
+  if (!session || session.revokedAt || session.expiresAt <= new Date() || session.user.status !== "ACTIVE") {
+    throw new AppError(401, "REFRESH_REJECTED", "Refresh session is invalid or expired");
+  }
+
+  try {
+    const rotated = await getAuthenik8().refreshToken(refreshToken);
+    await prisma.session.update({
+      where: { id: session.id },
+      data: { refreshHash: hashToken(rotated.refreshToken), lastUsedAt: new Date() },
+    });
+    return { accessToken: rotated.accessToken as string, refreshToken: rotated.refreshToken as string, user: presentUser(session.user) };
+  } catch {
+    await prisma.session.update({ where: { id: session.id }, data: { revokedAt: new Date() } });
+    throw new AppError(401, "REFRESH_REJECTED", "Refresh session is invalid or expired");
+  }
+}
+
+export async function revokeRefreshToken(refreshToken: string | undefined) {
+  if (!refreshToken) return;
+  const session = await prisma.session.findUnique({ where: { refreshHash: hashToken(refreshToken) } });
+  if (!session) return;
+  await prisma.session.update({ where: { id: session.id }, data: { revokedAt: new Date() } });
+  await getAuthenik8().revokeSession(session.userId, session.coreSessionId);
+}
+
+export async function requestPasswordReset(email: string) {
+  const user = await prisma.user.findUnique({ where: { email } });
+  if (!user?.passwordHash) return { message: "If that account exists, a reset link has been sent" };
+
+  const rawToken = randomToken();
+  await prisma.passwordResetToken.create({
+    data: { userId: user.id, tokenHash: hashToken(rawToken), expiresAt: new Date(Date.now() + 30 * 60 * 1000) },
+  });
+  await sendPasswordResetEmail(user.email, rawToken);
+  return {
+    message: "If that account exists, a reset link has been sent",
+    ...(env.NODE_ENV === "development" ? { devResetToken: rawToken } : {}),
+  };
+}
+
+export async function resetPassword(token: string, password: string) {
+  const reset = await prisma.passwordResetToken.findUnique({ where: { tokenHash: hashToken(token) } });
+  if (!reset || reset.usedAt || reset.expiresAt <= new Date()) {
+    throw new AppError(400, "RESET_TOKEN_INVALID", "This reset link is invalid or expired");
+  }
+  const now = new Date();
+  await prisma.$transaction([
+    prisma.passwordResetToken.update({ where: { id: reset.id }, data: { usedAt: now } }),
+    prisma.user.update({ where: { id: reset.userId }, data: { passwordHash: await bcrypt.hash(password, 12), passwordUpdatedAt: now } }),
+    prisma.session.updateMany({ where: { userId: reset.userId, revokedAt: null }, data: { revokedAt: now } }),
+  ]);
+  await getAuthenik8().revokeAllSessions(reset.userId);
+}
+
+export async function verifyEmail(token: string) {
+  const verification = await prisma.emailVerificationToken.findUnique({ where: { tokenHash: hashToken(token) } });
+  if (!verification || verification.usedAt || verification.expiresAt <= new Date()) {
+    throw new AppError(400, "VERIFICATION_INVALID", "This verification link is invalid or expired");
+  }
+  const now = new Date();
+  await prisma.$transaction([
+    prisma.emailVerificationToken.update({ where: { id: verification.id }, data: { usedAt: now } }),
+    prisma.user.update({ where: { id: verification.userId }, data: { emailVerifiedAt: now } }),
+  ]);
+}
+
+export async function resendVerification(userId: string) {
+  const user = await prisma.user.findUniqueOrThrow({ where: { id: userId } });
+  if (user.emailVerifiedAt) return { message: "Email is already verified" };
+  const rawToken = randomToken();
+  await prisma.emailVerificationToken.create({
+    data: { userId, tokenHash: hashToken(rawToken), expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) },
+  });
+  await sendVerificationEmail(user.email, rawToken);
+  return {
+    message: "Verification email sent",
+    ...(env.NODE_ENV === "development" ? { devVerificationToken: rawToken } : {}),
+  };
+}
+
+export function oauthProvider(name: OAuthProvider) {
+  const provider = getAuthenik8().oauth?.[name];
+  if (!provider) throw new AppError(404, "PROVIDER_NOT_CONFIGURED", "OAuth provider is not configured");
+  return { name, provider };
+}
+
+export async function createLinkIntent(userId: string, provider: OAuthProvider) {
+  oauthProvider(provider);
+  const ticket = randomToken();
+  await redis.setex(`oauth:link:${ticket}`, 120, userId);
+  return `/api/auth/oauth/${provider}/link?ticket=${ticket}`;
+}
+
+export async function consumeLinkIntent(ticket: string | undefined) {
+  if (!ticket) throw new AppError(400, "LINK_TICKET_INVALID", "Account-link request is missing");
+  const key = `oauth:link:${ticket}`;
+  const userId = await redis.get(key);
+  if (!userId) throw new AppError(400, "LINK_TICKET_INVALID", "Account-link request is invalid or expired");
+  await redis.del(key);
+  return userId;
+}
+
+export async function completeOAuthCallback(provider: OAuthProvider, result: Awaited<ReturnType<ReturnType<typeof oauthProvider>["provider"]["handleCallback"]>>, req: Request) {
+  const profile = result.profile;
+  if (profile.email_verified !== true && profile.email_verified !== "true") {
+    throw new AppError(403, "OAUTH_EMAIL_UNVERIFIED", "OAuth provider email must be verified");
+  }
+
+  if (result.mode === "link" && result.userId) {
+    const claimed = await prisma.oAuthAccount.findUnique({
+      where: { provider_providerAccountId: { provider, providerAccountId: profile.providerId } },
+    });
+    if (claimed && claimed.userId !== result.userId) throw new AppError(409, "PROVIDER_ALREADY_LINKED", "Provider account is linked to another user");
+    await prisma.oAuthAccount.upsert({
+      where: { userId_provider: { userId: result.userId, provider } },
+      update: { providerAccountId: profile.providerId, providerEmail: profile.email },
+      create: { userId: result.userId, provider, providerAccountId: profile.providerId, providerEmail: profile.email },
+    });
+    return { linked: true as const, provider };
+  }
+
+  const account = await prisma.oAuthAccount.findUnique({
+    where: { provider_providerAccountId: { provider, providerAccountId: profile.providerId } },
+    include: { user: true },
+  });
+  let user = account?.user;
+  if (!user) {
+    user = await prisma.user.upsert({
+      where: { email: profile.email.toLowerCase() },
+      update: { emailVerifiedAt: new Date() },
+      create: { email: profile.email.toLowerCase(), name: profile.name ?? "New user", emailVerifiedAt: new Date() },
+    });
+    await prisma.oAuthAccount.upsert({
+      where: { userId_provider: { userId: user.id, provider } },
+      update: { providerAccountId: profile.providerId, providerEmail: profile.email },
+      create: { userId: user.id, provider, providerAccountId: profile.providerId, providerEmail: profile.email },
+    });
+  }
+  if (user.status !== "ACTIVE") throw new AppError(403, "ACCOUNT_SUSPENDED", "Account access is unavailable");
+
+  const session = await issueSession(user, req);
+  const code = randomToken();
+  await redis.setex(
+    `oauth:exchange:${code}`,
+    60,
+    sealValue(JSON.stringify(session), env.REFRESH_SECRET),
+  );
+  return { linked: false as const, code };
+}
+
+export async function exchangeOAuthCode(code: string) {
+  const key = `oauth:exchange:${code}`;
+  const value = await redis.get(key);
+  if (!value) throw new AppError(400, "OAUTH_CODE_INVALID", "OAuth exchange is invalid or expired");
+  await redis.del(key);
+  const payload = openSealedValue(value, env.REFRESH_SECRET);
+  if (!payload) throw new AppError(400, "OAUTH_CODE_INVALID", "OAuth exchange is invalid or expired");
+  return oauthExchangeSessionSchema.parse(JSON.parse(payload));
+}

package/templates/fullstack/apps/api/src/auth/authenik8.ts

@@ -0,0 +1,67 @@
+import { createAuthenik8 } from "authenik8-core";
+import { Redis } from "ioredis";
+import { env } from "../config/env.js";
+
+export const redis = new Redis(env.REDIS_URL, {
+  maxRetriesPerRequest: 2,
+  enableReadyCheck: true,
+});
+
+type AuthInstance = Awaited<ReturnType<typeof createAuthenik8>>;
+let instance: AuthInstance | undefined;
+
+function oauthConfig() {
+  return {
+    ...(env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET && env.GOOGLE_REDIRECT_URI
+      ? { google: { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET, redirectUri: env.GOOGLE_REDIRECT_URI } }
+      : {}),
+    ...(env.GITHUB_CLIENT_ID && env.GITHUB_CLIENT_SECRET && env.GITHUB_REDIRECT_URI
+      ? { github: { clientId: env.GITHUB_CLIENT_ID, clientSecret: env.GITHUB_CLIENT_SECRET, redirectUri: env.GITHUB_REDIRECT_URI } }
+      : {}),
+  };
+}
+
+export async function initAuthenik8(): Promise<AuthInstance> {
+  if (instance) return instance;
+  const oauth = oauthConfig();
+  const signingKeys = JSON.parse(env.AUTHENIK8_SIGNING_JWKS) as Array<{
+    kid: string;
+    d?: string;
+    [key: string]: unknown;
+  }>;
+  const activeKey = signingKeys.find((key) => key.kid === env.AUTHENIK8_ACTIVE_KID);
+  if (!activeKey?.d) {
+    throw new Error("AUTHENIK8_ACTIVE_KID must select a private signing JWK");
+  }
+  const agentRegistry = JSON.parse(env.AUTHENIK8_AGENTS) as Record<string, string[]>;
+  const agent = Object.keys(agentRegistry).length
+    ? {
+        resolveAgent: async (agentId: string) => {
+          const scopes = Object.prototype.hasOwnProperty.call(agentRegistry, agentId)
+            ? agentRegistry[agentId]
+            : undefined;
+          return scopes ? { agentId, scopes, active: true } : null;
+        },
+      }
+    : undefined;
+  instance = await createAuthenik8({
+    jwt: {
+      keys: signingKeys,
+      activeKid: env.AUTHENIK8_ACTIVE_KID,
+      issuer: env.AUTHENIK8_ISSUER,
+      audience: env.AUTHENIK8_AUDIENCE,
+    },
+    refreshSecret: env.REFRESH_SECRET,
+    agent,
+    jwtExpiry: "15m",
+    redis,
+    oauth: Object.keys(oauth).length ? oauth : undefined,
+    trustProxyHeaders: env.TRUST_PROXY,
+  });
+  return instance;
+}
+
+export function getAuthenik8(): AuthInstance {
+  if (!instance) throw new Error("Authenik8 has not been initialized");
+  return instance;
+}

package/templates/fullstack/apps/api/src/auth/cookies.ts

@@ -0,0 +1,36 @@
+import type { CookieOptions, Request, Response } from "express";
+import { z } from "zod";
+import { env } from "../config/env.js";
+import { openSealedValue, sealValue } from "../utils/sealed-value.js";
+
+export const refreshCookieName = "authenik8_refresh";
+const refreshTokenSchema = z.string().min(1).max(4096);
+
+export function refreshCookieOptions(): CookieOptions {
+  return {
+    httpOnly: true,
+    secure: env.COOKIE_SECURE || env.NODE_ENV === "production",
+    sameSite: "strict",
+    path: "/api",
+    maxAge: 7 * 24 * 60 * 60 * 1000,
+  };
+}
+
+export function setRefreshCookie(res: Response, token: string) {
+  const sealedToken = sealValue(refreshTokenSchema.parse(token), env.REFRESH_SECRET);
+  // The bearer token is AES-256-GCM encrypted before it reaches cookie storage.
+  // codeql[js/clear-text-storage-of-sensitive-data]
+  res.cookie(refreshCookieName, sealedToken, refreshCookieOptions());
+}
+
+export function readRefreshCookie(req: Request): string | undefined {
+  const sealedToken = req.cookies?.[refreshCookieName];
+  const token = openSealedValue(sealedToken, env.REFRESH_SECRET);
+  const result = refreshTokenSchema.safeParse(token);
+  return result.success ? result.data : undefined;
+}
+
+export function clearRefreshCookie(res: Response) {
+  const { maxAge: _maxAge, ...options } = refreshCookieOptions();
+  res.clearCookie(refreshCookieName, options);
+}

package/templates/fullstack/apps/api/src/config/env.ts

@@ -0,0 +1,72 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import dotenv from "dotenv";
+import { z } from "zod";
+
+const rootEnv = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../../../.env");
+dotenv.config({ path: process.env.AUTHENIK8_ENV_FILE ?? rootEnv });
+
+const booleanString = z.enum(["true", "false"]).transform((value) => value === "true");
+const signingJwks = z.string().min(1).superRefine((value, context) => {
+  try {
+    const keys = JSON.parse(value) as Array<Record<string, unknown>>;
+    if (!Array.isArray(keys) || !keys.length || keys.some((key) =>
+      key.kty !== "EC" || key.crv !== "P-256" || key.alg !== "ES256" ||
+      typeof key.kid !== "string" || typeof key.x !== "string" || typeof key.y !== "string"
+    )) {
+      throw new Error("invalid key");
+    }
+  } catch {
+    context.addIssue({ code: "custom", message: "must be a JSON array of ES256 P-256 JWKs" });
+  }
+});
+const agentRegistry = z.string().default("{}").superRefine((value, context) => {
+  try {
+    const agents = JSON.parse(value) as Record<string, unknown>;
+    const valid = agents && typeof agents === "object" && !Array.isArray(agents) &&
+      Object.entries(agents).every(([agentId, scopes]) =>
+        /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(agentId) &&
+        Array.isArray(scopes) && scopes.length > 0 && scopes.length <= 64 &&
+        scopes.every((scope) =>
+          typeof scope === "string" && scope.length <= 128 &&
+          /^[a-z][a-z0-9._/-]*(?::[a-z][a-z0-9._/-]*)+$/.test(scope)
+        )
+      );
+    if (!valid) throw new Error("invalid agent registry");
+  } catch {
+    context.addIssue({ code: "custom", message: "must map agent IDs to resource:action scope arrays" });
+  }
+});
+
+const schema = z.object({
+  NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
+  PORT: z.coerce.number().int().positive().default(3000),
+  WEB_ORIGIN: z.string().url().default("http://localhost:5173"),
+  DATABASE_URL: z.string().min(1),
+  REDIS_URL: z.string().min(1).default("redis://localhost:6379"),
+  AUTHENIK8_SIGNING_JWKS: signingJwks,
+  AUTHENIK8_ACTIVE_KID: z.string().min(1),
+  AUTHENIK8_ISSUER: z.string().url(),
+  AUTHENIK8_AUDIENCE: z.string().min(1),
+  AUTHENIK8_AGENTS: agentRegistry,
+  REFRESH_SECRET: z.string().min(32),
+  COOKIE_SECURE: booleanString.default(false),
+  TRUST_PROXY: booleanString.default(false),
+  LOG_LEVEL: z.string().default("info"),
+  EMAIL_FROM: z.string().default("Authenik8 <auth@example.com>"),
+  RESEND_API_KEY: z.string().optional(),
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
+  GOOGLE_REDIRECT_URI: z.string().url().optional().or(z.literal("")),
+  GITHUB_CLIENT_ID: z.string().optional(),
+  GITHUB_CLIENT_SECRET: z.string().optional(),
+  GITHUB_REDIRECT_URI: z.string().url().optional().or(z.literal("")),
+});
+
+const result = schema.safeParse(process.env);
+if (!result.success) {
+  console.error("Invalid environment configuration", result.error.flatten().fieldErrors);
+  throw new Error("Environment validation failed");
+}
+
+export const env = result.data;

package/templates/fullstack/apps/api/src/config/logger.ts

@@ -0,0 +1,17 @@
+import pino from "pino";
+import { env } from "./env.js";
+
+export const logger = pino({
+  level: env.LOG_LEVEL,
+  redact: {
+    paths: [
+      "req.headers.authorization",
+      "req.headers.cookie",
+      "password",
+      "passwordHash",
+      "accessToken",
+      "refreshToken",
+    ],
+    censor: "[REDACTED]",
+  },
+});

package/templates/fullstack/apps/api/src/config/mailer.ts

@@ -0,0 +1,32 @@
+import { env } from "./env.js";
+import { logger } from "./logger.js";
+
+async function sendEmail(to: string, subject: string, html: string) {
+  if (!env.RESEND_API_KEY) {
+    if (env.NODE_ENV === "production") throw new Error("RESEND_API_KEY is required for production email delivery");
+    logger.info({ to, subject }, "Development email generated");
+    return;
+  }
+
+  const response = await fetch("https://api.resend.com/emails", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${env.RESEND_API_KEY}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ from: env.EMAIL_FROM, to: [to], subject, html }),
+  });
+  if (!response.ok) throw new Error(`Email delivery failed with status ${response.status}`);
+}
+
+export function sendVerificationEmail(to: string, token: string) {
+  const url = new URL("/verify-email", env.WEB_ORIGIN);
+  url.searchParams.set("token", token);
+  return sendEmail(to, "Verify your email", `<p>Confirm your Authenik8 account:</p><p><a href="${url}">Verify email</a></p>`);
+}
+
+export function sendPasswordResetEmail(to: string, token: string) {
+  const url = new URL("/reset-password", env.WEB_ORIGIN);
+  url.searchParams.set("token", token);
+  return sendEmail(to, "Reset your password", `<p>A password reset was requested:</p><p><a href="${url}">Reset password</a></p><p>This link expires in 30 minutes.</p>`);
+}

package/templates/fullstack/apps/api/src/config/origins.ts

@@ -0,0 +1,27 @@
+import { env } from "./env.js";
+
+const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+function toUrl(value: string): URL | undefined {
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}
+
+export function isAllowedOrigin(origin: string | undefined): boolean {
+  if (!origin) return false;
+  if (origin === env.WEB_ORIGIN) return true;
+  if (env.NODE_ENV === "production") return false;
+
+  const configured = toUrl(env.WEB_ORIGIN);
+  const candidate = toUrl(origin);
+  return Boolean(
+    configured
+    && candidate
+    && configured.protocol === candidate.protocol
+    && loopbackHosts.has(configured.hostname)
+    && loopbackHosts.has(candidate.hostname),
+  );
+}

package/templates/fullstack/apps/api/src/config/prisma.ts

@@ -0,0 +1,9 @@
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "@prisma/client";
+import { env } from "./env.js";
+
+const globalForPrisma = globalThis as unknown as { prisma?: PrismaClient };
+
+const adapter = new PrismaPg({ connectionString: env.DATABASE_URL });
+export const prisma = globalForPrisma.prisma ?? new PrismaClient({ adapter });
+if (process.env.NODE_ENV !== "production") globalForPrisma.prisma = prisma;

package/templates/fullstack/apps/api/src/middleware/authenticate.ts

@@ -0,0 +1,35 @@
+import type { RequestHandler } from "express";
+import { prisma } from "../config/prisma.js";
+import { getAuthenik8 } from "../auth/authenik8.js";
+
+export const authenticate: RequestHandler = (req, res, next) =>
+  getAuthenik8().requireAuth(req, res, async () => {
+    const payload = req.user;
+    if (!payload?.userId) {
+      return res.status(401).json({
+        error: { code: "UNAUTHENTICATED", message: "Authentication required" },
+        requestId: req.id,
+      });
+    }
+
+    const user = await prisma.user.findUnique({ where: { id: payload.userId } });
+    if (!user || user.status !== "ACTIVE") {
+      return res.status(401).json({
+        error: { code: "SESSION_INVALID", message: "This session is no longer active" },
+        requestId: req.id,
+      });
+    }
+
+    req.user = { userId: user.id, email: user.email, name: user.name, role: user.role };
+    next();
+  });
+
+export const requireAdmin: RequestHandler = (req, res, next) => {
+  if (req.user?.role !== "ADMIN") {
+    return res.status(403).json({
+      error: { code: "FORBIDDEN", message: "Administrator access required" },
+      requestId: req.id,
+    });
+  }
+  next();
+};

package/templates/fullstack/apps/api/src/middleware/csrf.ts

@@ -0,0 +1,60 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { csrfTokenSchema } from "@authenik8/contracts";
+import type { CookieOptions, Request, RequestHandler, Response } from "express";
+import { env } from "../config/env.js";
+
+export const csrfCookieName = "authenik8_csrf";
+
+function csrfCookieOptions(): CookieOptions {
+  return {
+    httpOnly: true,
+    secure: env.COOKIE_SECURE || env.NODE_ENV === "production",
+    sameSite: "strict",
+    path: "/api",
+    maxAge: 2 * 60 * 60 * 1000,
+  };
+}
+
+function signature(nonce: string): string {
+  return createHmac("sha256", env.REFRESH_SECRET)
+    .update("authenik8:csrf:v1:")
+    .update(nonce)
+    .digest("base64url");
+}
+
+function safeEqual(left: string, right: string): boolean {
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+function isAuthenticToken(value: unknown): value is string {
+  const parsed = csrfTokenSchema.safeParse(value);
+  if (!parsed.success) return false;
+  const [nonce, providedSignature] = parsed.data.split(".");
+  return safeEqual(providedSignature!, signature(nonce!));
+}
+
+export function issueCsrfToken(req: Request, res: Response): string {
+  const existingToken = req.cookies?.authenik8_csrf;
+  if (isAuthenticToken(existingToken)) return existingToken;
+
+  const nonce = randomBytes(32).toString("base64url");
+  const token = csrfTokenSchema.parse(`${nonce}.${signature(nonce)}`);
+  res.cookie(csrfCookieName, token, csrfCookieOptions());
+  return token;
+}
+
+export const requireCsrf: RequestHandler = (req, res, next) => {
+  const cookieToken = req.cookies?.authenik8_csrf;
+  const headerToken = req.get("x-csrf-token");
+  if (isAuthenticToken(cookieToken) && csrfTokenSchema.safeParse(headerToken).success && safeEqual(cookieToken, headerToken!)) {
+    next();
+    return;
+  }
+
+  res.status(403).json({
+    error: { code: "CSRF_REJECTED", message: "Request verification failed" },
+    requestId: req.id,
+  });
+};

package/templates/fullstack/apps/api/src/middleware/origin.ts

@@ -0,0 +1,12 @@
+import type { RequestHandler } from "express";
+import { isAllowedOrigin } from "../config/origins.js";
+
+export const requireAllowedOrigin: RequestHandler = (req, res, next) => {
+  if (!isAllowedOrigin(req.get("origin"))) {
+    return res.status(403).json({
+      error: { code: "ORIGIN_REJECTED", message: "Request origin is not allowed" },
+      requestId: req.id,
+    });
+  }
+  next();
+};

package/templates/fullstack/apps/api/src/middleware/request-id.ts

@@ -0,0 +1,9 @@
+import { randomUUID } from "node:crypto";
+import type { RequestHandler } from "express";
+
+export const requestId: RequestHandler = (req, res, next) => {
+  const incoming = req.get("x-request-id");
+  req.id = incoming && incoming.length <= 128 ? incoming : randomUUID();
+  res.setHeader("x-request-id", req.id);
+  next();
+};

package/templates/fullstack/apps/api/src/modules/admin/admin.controller.ts

@@ -0,0 +1,17 @@
+import { asyncHandler } from "../../utils/http.js";
+import { identifierSchema, pageSchema } from "@authenik8/contracts";
+import { listAuditEvents, listUsers, revokeAllSessions, updateUser } from "./admin.service.js";
+
+export const listUsersController = asyncHandler(async (req, res) => {
+  res.json(await listUsers(pageSchema.parse(req.query.page)));
+});
+export const updateUserController = asyncHandler(async (req, res) => {
+  res.json({ user: await updateUser(req.user!.userId, identifierSchema.parse(req.params.id), req.body, req.ip ?? "unknown") });
+});
+export const revokeUserSessionsController = asyncHandler(async (req, res) => {
+  await revokeAllSessions(req.user!.userId, identifierSchema.parse(req.params.id), req.ip ?? "unknown");
+  res.json({ message: "Sessions revoked" });
+});
+export const auditController = asyncHandler(async (_req, res) => {
+  res.json({ events: await listAuditEvents() });
+});