create-fluxstack 1.12.0 → 1.13.0

package/app/server/auth/index.ts

@@ -0,0 +1,174 @@
+/**
+ * FluxStack Auth System
+ *
+ * Sistema de autenticação modular inspirado no Laravel.
+ * Guard + Provider pattern com session e token support.
+ *
+ * ```ts
+ * import { auth, guest, initAuth, getAuthManager } from '@server/auth'
+ *
+ * // Inicializar (no boot da app)
+ * initAuth()
+ *
+ * // Proteger rotas
+ * app.use(auth()).get('/me', ({ user }) => user.toJSON())
+ * app.use(guest()).post('/login', loginHandler)
+ *
+ * // Usar auth manager diretamente
+ * const manager = getAuthManager()
+ * const guard = manager.guard('session')
+ * const user = await guard.attempt({ email, password })
+ * ```
+ */
+
+// Contracts
+export type {
+  Authenticatable,
+  Guard,
+  UserProvider,
+  RequestContext,
+  CookieOptions,
+  GuardConfig,
+  GuardFactory,
+} from './contracts'
+
+// Auth Manager
+export { AuthManager } from './AuthManager'
+export type { AuthManagerConfig, ProviderConfig } from './AuthManager'
+
+// Hash
+export { HashManager, Hash, getHashManager, setHashManager } from './HashManager'
+export type { HashAlgorithm, HashOptions } from './HashManager'
+
+// Rate Limiter
+export { RateLimiter } from './RateLimiter'
+
+// Guards
+export { SessionGuard } from './guards/SessionGuard'
+export { TokenGuard } from './guards/TokenGuard'
+
+// Providers
+export { InMemoryUserProvider, InMemoryUser } from './providers/InMemoryProvider'
+
+// Sessions
+export { SessionManager } from './sessions/SessionManager'
+export type { SessionData, SessionConfig } from './sessions/SessionManager'
+
+// Middleware
+export { auth, guest, authOptional } from './middleware'
+
+// ===== Boot =====
+
+import { AuthManager } from './AuthManager'
+import { HashManager, setHashManager } from './HashManager'
+import { RateLimiter } from './RateLimiter'
+import { SessionManager } from './sessions/SessionManager'
+import { InMemoryUserProvider } from './providers/InMemoryProvider'
+import { setAuthManagerForMiddleware, buildRequestContext } from './middleware'
+import { cacheManager } from '@server/cache'
+import { authConfig } from '@config/system/auth.config'
+import { sessionConfig } from '@config/system/session.config'
+
+let authManagerInstance: AuthManager | null = null
+let rateLimiterInstance: RateLimiter | null = null
+let sessionManagerInstance: SessionManager | null = null
+
+/**
+ * Inicializa o sistema de auth.
+ * Deve ser chamado uma vez no boot da aplicação.
+ */
+export function initAuth(): {
+  authManager: AuthManager
+  rateLimiter: RateLimiter
+  sessionManager: SessionManager
+} {
+  // 1. Configurar Hash
+  const hashManager = new HashManager({
+    algorithm: authConfig.passwords.hashAlgorithm as 'bcrypt' | 'argon2id',
+    bcryptRounds: authConfig.passwords.bcryptRounds,
+  })
+  setHashManager(hashManager)
+
+  // 2. Criar Session Manager
+  const cache = cacheManager.driver()
+  sessionManagerInstance = new SessionManager(cache, {
+    lifetime: sessionConfig.lifetime,
+    cookieName: sessionConfig.cookieName,
+    httpOnly: sessionConfig.httpOnly,
+    secure: sessionConfig.secure,
+    sameSite: sessionConfig.sameSite as 'strict' | 'lax' | 'none',
+    path: sessionConfig.path,
+    domain: sessionConfig.domain || undefined,
+  })
+
+  // 3. Criar Rate Limiter
+  rateLimiterInstance = new RateLimiter(cache)
+
+  // 4. Criar Auth Manager
+  authManagerInstance = new AuthManager(
+    {
+      defaults: {
+        guard: authConfig.defaults.guard ?? 'session',
+        provider: authConfig.defaults.provider ?? 'memory',
+      },
+      guards: {
+        session: {
+          driver: 'session',
+          provider: 'memory',
+        },
+        token: {
+          driver: 'token',
+          provider: 'memory',
+          tokenTtl: authConfig.token.ttl,
+        },
+      },
+      providers: {
+        memory: {
+          driver: 'memory',
+        },
+      },
+    },
+    sessionManagerInstance
+  )
+
+  // 5. Registrar InMemoryProvider como default
+  const inMemoryProvider = new InMemoryUserProvider()
+  authManagerInstance.registerProvider('memory', inMemoryProvider)
+
+  // 6. Conectar middleware
+  setAuthManagerForMiddleware(authManagerInstance)
+
+  console.log(`🔐 Auth system initialized (guard: ${authConfig.defaults.guard}, hash: ${authConfig.passwords.hashAlgorithm})`)
+
+  return {
+    authManager: authManagerInstance,
+    rateLimiter: rateLimiterInstance,
+    sessionManager: sessionManagerInstance,
+  }
+}
+
+/** Retorna o AuthManager (deve ser chamado após initAuth) */
+export function getAuthManager(): AuthManager {
+  if (!authManagerInstance) {
+    throw new Error('Auth not initialized. Call initAuth() first.')
+  }
+  return authManagerInstance
+}
+
+/** Retorna o RateLimiter (deve ser chamado após initAuth) */
+export function getRateLimiter(): RateLimiter {
+  if (!rateLimiterInstance) {
+    throw new Error('Auth not initialized. Call initAuth() first.')
+  }
+  return rateLimiterInstance
+}
+
+/** Retorna o SessionManager (deve ser chamado após initAuth) */
+export function getSessionManager(): SessionManager {
+  if (!sessionManagerInstance) {
+    throw new Error('Auth not initialized. Call initAuth() first.')
+  }
+  return sessionManagerInstance
+}
+
+export { buildRequestContext }

package/app/server/auth/middleware.ts

@@ -0,0 +1,163 @@
+/**
+ * FluxStack Auth - Elysia Middleware
+ *
+ * Middlewares prontos para proteger rotas:
+ *
+ * ```ts
+ * // Rota protegida (requer login)
+ * app.use(auth()).get('/me', ({ user }) => user.toJSON())
+ *
+ * // Rota de guest (requer NÃO estar logado)
+ * app.use(guest()).post('/login', loginHandler)
+ *
+ * // Guard específico
+ * app.use(auth('api')).get('/api/data', handler)
+ * ```
+ */
+
+import { Elysia } from 'elysia'
+import type { AuthManager } from './AuthManager'
+import type { Authenticatable, RequestContext } from './contracts'
+
+/** Referência ao AuthManager (setado no boot) */
+let authManagerRef: AuthManager | null = null
+
+export function setAuthManagerForMiddleware(manager: AuthManager): void {
+  authManagerRef = manager
+}
+
+/**
+ * Extrai RequestContext do context do Elysia.
+ */
+function buildRequestContext(ctx: any): RequestContext {
+  const headers: Record<string, string | undefined> = {}
+  if (ctx.headers) {
+    for (const [key, value] of Object.entries(ctx.headers)) {
+      headers[key] = value as string | undefined
+    }
+  }
+
+  return {
+    headers,
+    cookie: ctx.cookie ?? {},
+    setCookie: (name: string, value: string, options?: any) => {
+      if (ctx.cookie) {
+        ctx.cookie[name].set({
+          value,
+          ...options,
+        })
+      }
+    },
+    removeCookie: (name: string) => {
+      if (ctx.cookie) {
+        ctx.cookie[name].set({
+          value: '',
+          maxAge: 0,
+          path: '/',
+        })
+      }
+    },
+    ip: ctx.request?.headers?.get('x-forwarded-for')
+      ?? ctx.request?.headers?.get('x-real-ip')
+      ?? ctx.server?.requestIP?.(ctx.request)?.address
+      ?? '127.0.0.1',
+  }
+}
+
+/**
+ * Middleware que requer autenticação.
+ * Injeta `user` (Authenticatable) no context do Elysia.
+ *
+ * Retorna 401 se não autenticado.
+ */
+export function auth(guardName?: string) {
+  return new Elysia({ name: `auth-guard${guardName ? `-${guardName}` : ''}` })
+    .derive(async (ctx) => {
+      if (!authManagerRef) {
+        throw new Error('Auth system not initialized. Did you forget to call initAuth()?')
+      }
+
+      const requestContext = buildRequestContext(ctx)
+      const guard = authManagerRef.freshGuard(guardName, requestContext)
+
+      const user = await guard.user()
+
+      return {
+        user: user as Authenticatable | null,
+        auth: guard,
+      }
+    })
+    .onBeforeHandle(async (ctx) => {
+      if (!(ctx as any).user) {
+        (ctx as any).set.status = 401
+        return {
+          success: false,
+          error: 'Unauthenticated',
+          message: 'You must be logged in to access this resource.',
+        }
+      }
+    })
+    .as('scoped')
+}
+
+/**
+ * Middleware que requer NÃO estar autenticado.
+ * Útil para rotas de login/register.
+ *
+ * Retorna 409 se já autenticado.
+ */
+export function guest(guardName?: string) {
+  return new Elysia({ name: `guest-guard${guardName ? `-${guardName}` : ''}` })
+    .derive(async (ctx) => {
+      if (!authManagerRef) {
+        throw new Error('Auth system not initialized. Did you forget to call initAuth()?')
+      }
+
+      const requestContext = buildRequestContext(ctx)
+      const guard = authManagerRef.freshGuard(guardName, requestContext)
+
+      const user = await guard.user()
+
+      return {
+        user: user as Authenticatable | null,
+        auth: guard,
+      }
+    })
+    .onBeforeHandle(async (ctx) => {
+      if ((ctx as any).user) {
+        (ctx as any).set.status = 409
+        return {
+          success: false,
+          error: 'AlreadyAuthenticated',
+          message: 'You are already logged in.',
+        }
+      }
+    })
+    .as('scoped')
+}
+
+/**
+ * Middleware que resolve auth opcionalmente (não bloqueia).
+ * Útil para rotas que funcionam com ou sem login.
+ */
+export function authOptional(guardName?: string) {
+  return new Elysia({ name: `auth-optional${guardName ? `-${guardName}` : ''}` })
+    .derive(async (ctx) => {
+      if (!authManagerRef) {
+        return { user: null, auth: null }
+      }
+
+      const requestContext = buildRequestContext(ctx)
+      const guard = authManagerRef.freshGuard(guardName, requestContext)
+
+      const user = await guard.user()
+
+      return {
+        user: user as Authenticatable | null,
+        auth: guard,
+      }
+    })
+    .as('scoped')
+}
+
+export { buildRequestContext }

package/app/server/auth/providers/InMemoryProvider.ts

@@ -0,0 +1,162 @@
+/**
+ * FluxStack Auth - In-Memory User Provider
+ *
+ * Provider que armazena usuários em memória.
+ * Ideal para desenvolvimento, demos e testes.
+ *
+ * Para produção, implemente UserProvider com seu ORM:
+ * ```ts
+ * class DrizzleUserProvider implements UserProvider {
+ *   async retrieveById(id) {
+ *     return db.select().from(users).where(eq(users.id, id)).get()
+ *   }
+ *   // ...
+ * }
+ * ```
+ */
+
+import type { Authenticatable, UserProvider } from '../contracts'
+import { Hash } from '../HashManager'
+
+// ===== In-Memory User Model =====
+
+export class InMemoryUser implements Authenticatable {
+  id: number
+  name: string
+  email: string
+  passwordHash: string
+  rememberToken: string | null = null
+  createdAt: Date
+
+  constructor(data: {
+    id: number
+    name: string
+    email: string
+    passwordHash: string
+    createdAt?: Date
+  }) {
+    this.id = data.id
+    this.name = data.name
+    this.email = data.email
+    this.passwordHash = data.passwordHash
+    this.createdAt = data.createdAt ?? new Date()
+  }
+
+  getAuthId(): number {
+    return this.id
+  }
+
+  getAuthIdField(): string {
+    return 'id'
+  }
+
+  getAuthPassword(): string {
+    return this.passwordHash
+  }
+
+  getRememberToken(): string | null {
+    return this.rememberToken
+  }
+
+  setRememberToken(token: string | null): void {
+    this.rememberToken = token
+  }
+
+  toJSON(): Record<string, unknown> {
+    return {
+      id: this.id,
+      name: this.name,
+      email: this.email,
+      createdAt: this.createdAt.toISOString(),
+    }
+  }
+}
+
+// ===== Provider =====
+
+export class InMemoryUserProvider implements UserProvider {
+  private users: InMemoryUser[] = []
+  private nextId = 1
+
+  async retrieveById(id: string | number): Promise<Authenticatable | null> {
+    return this.users.find(u => u.id === Number(id)) ?? null
+  }
+
+  async retrieveByCredentials(credentials: Record<string, unknown>): Promise<Authenticatable | null> {
+    // Buscar por qualquer campo EXCETO password
+    const { password: _, ...searchFields } = credentials
+
+    return this.users.find(user => {
+      return Object.entries(searchFields).every(([key, value]) => {
+        return (user as any)[key] === value
+      })
+    }) ?? null
+  }
+
+  async validateCredentials(user: Authenticatable, credentials: Record<string, unknown>): Promise<boolean> {
+    const password = credentials.password as string | undefined
+    if (!password) return false
+
+    const valid = await Hash.check(password, user.getAuthPassword())
+
+    // Rehash transparente se necessário
+    if (valid && Hash.needsRehash(user.getAuthPassword())) {
+      const newHash = await Hash.make(password)
+      // Atualizar hash in-memory
+      const memUser = user as InMemoryUser
+      memUser.passwordHash = newHash
+    }
+
+    return valid
+  }
+
+  async retrieveByToken(id: string | number, token: string): Promise<Authenticatable | null> {
+    const user = this.users.find(u => u.id === Number(id))
+    if (!user) return null
+    if (user.getRememberToken() !== token) return null
+    return user
+  }
+
+  async updateRememberToken(user: Authenticatable, token: string | null): Promise<void> {
+    user.setRememberToken(token)
+  }
+
+  async createUser(data: Record<string, unknown>): Promise<Authenticatable> {
+    const name = data.name as string
+    const email = data.email as string
+    const password = data.password as string
+
+    if (!name || !email || !password) {
+      throw new Error('Name, email and password are required')
+    }
+
+    // Verificar email duplicado
+    const existing = this.users.find(u => u.email === email)
+    if (existing) {
+      throw new Error('Email already in use')
+    }
+
+    const passwordHash = await Hash.make(password)
+
+    const user = new InMemoryUser({
+      id: this.nextId++,
+      name,
+      email,
+      passwordHash,
+    })
+
+    this.users.push(user)
+    return user
+  }
+
+  /** Para testes: reset completo */
+  reset(): void {
+    this.users = []
+    this.nextId = 1
+  }
+
+  /** Para testes: retorna todos os usuários */
+  getAll(): InMemoryUser[] {
+    return [...this.users]
+  }
+}

package/app/server/auth/sessions/SessionManager.ts

@@ -0,0 +1,164 @@
+/**
+ * FluxStack Auth - Session Manager
+ *
+ * Gerencia sessões de usuários usando o cache system modular.
+ * Cada sessão é um registro no cache com TTL automático.
+ *
+ * ```ts
+ * const sessionId = await sessionManager.create({ userId: 1 })
+ * const data = await sessionManager.read(sessionId)
+ * await sessionManager.destroy(sessionId)
+ * ```
+ */
+
+import type { CacheDriver } from '@server/cache/contracts'
+import { cacheManager } from '@server/cache'
+
+export interface SessionData {
+  [key: string]: unknown
+}
+
+export interface SessionConfig {
+  /** Tempo de vida da sessão em segundos (default: 7200 = 2h) */
+  lifetime: number
+  /** Nome do cookie (default: 'fluxstack_session') */
+  cookieName: string
+  /** Cookie httpOnly (default: true) */
+  httpOnly: boolean
+  /** Cookie secure (default: false em dev, true em prod) */
+  secure: boolean
+  /** Cookie sameSite (default: 'lax') */
+  sameSite: 'strict' | 'lax' | 'none'
+  /** Cookie path (default: '/') */
+  path: string
+  /** Cookie domain (default: undefined = current domain) */
+  domain?: string
+}
+
+const DEFAULT_CONFIG: SessionConfig = {
+  lifetime: 7200,
+  cookieName: 'fluxstack_session',
+  httpOnly: true,
+  secure: false,
+  sameSite: 'lax',
+  path: '/',
+}
+
+export class SessionManager {
+  private cache: CacheDriver
+  private config: SessionConfig
+
+  constructor(cache?: CacheDriver, config?: Partial<SessionConfig>) {
+    this.cache = cache ?? cacheManager.driver()
+    this.config = { ...DEFAULT_CONFIG, ...config }
+  }
+
+  /**
+   * Cria uma nova sessão e retorna o ID.
+   */
+  async create(data: SessionData = {}): Promise<string> {
+    const sessionId = this.generateId()
+    await this.cache.set(
+      this.cacheKey(sessionId),
+      { ...data, _createdAt: Date.now() },
+      this.config.lifetime
+    )
+    return sessionId
+  }
+
+  /**
+   * Lê os dados de uma sessão.
+   */
+  async read(sessionId: string): Promise<SessionData | null> {
+    return this.cache.get<SessionData>(this.cacheKey(sessionId))
+  }
+
+  /**
+   * Atualiza os dados de uma sessão (merge com dados existentes).
+   */
+  async update(sessionId: string, data: SessionData): Promise<void> {
+    const existing = await this.read(sessionId)
+    if (!existing) return
+
+    await this.cache.set(
+      this.cacheKey(sessionId),
+      { ...existing, ...data },
+      this.config.lifetime
+    )
+  }
+
+  /**
+   * Define um valor específico na sessão.
+   */
+  async put(sessionId: string, key: string, value: unknown): Promise<void> {
+    const existing = await this.read(sessionId)
+    if (!existing) return
+
+    existing[key] = value
+    await this.cache.set(
+      this.cacheKey(sessionId),
+      existing,
+      this.config.lifetime
+    )
+  }
+
+  /**
+   * Remove um valor específico da sessão.
+   */
+  async forget(sessionId: string, key: string): Promise<void> {
+    const existing = await this.read(sessionId)
+    if (!existing) return
+
+    delete existing[key]
+    await this.cache.set(
+      this.cacheKey(sessionId),
+      existing,
+      this.config.lifetime
+    )
+  }
+
+  /**
+   * Destroi uma sessão.
+   */
+  async destroy(sessionId: string): Promise<void> {
+    await this.cache.delete(this.cacheKey(sessionId))
+  }
+
+  /**
+   * Regenera o ID da sessão (mantém os dados).
+   * Importante após login para prevenir session fixation.
+   */
+  async regenerate(oldSessionId: string): Promise<string> {
+    const data = await this.read(oldSessionId)
+    await this.destroy(oldSessionId)
+
+    const newSessionId = this.generateId()
+    if (data) {
+      await this.cache.set(
+        this.cacheKey(newSessionId),
+        data,
+        this.config.lifetime
+      )
+    }
+    return newSessionId
+  }
+
+  /** Retorna a configuração de sessão */
+  getConfig(): SessionConfig {
+    return this.config
+  }
+
+  /** Gera um session ID criptograficamente seguro */
+  private generateId(): string {
+    const bytes = new Uint8Array(32)
+    crypto.getRandomValues(bytes)
+    return Array.from(bytes)
+      .map(b => b.toString(16).padStart(2, '0'))
+      .join('')
+  }
+
+  /** Chave no cache para a sessão */
+  private cacheKey(sessionId: string): string {
+    return `session:${sessionId}`
+  }
+}