create-fluxstack 1.12.1 → 1.14.0

package/app/server/auth/guards/TokenGuard.ts

@@ -0,0 +1,202 @@
+/**
+ * FluxStack Auth - Token Guard
+ *
+ * Guard baseado em Bearer token (header Authorization).
+ * Para APIs consumidas por mobile apps, CLIs, integrações.
+ *
+ * Fluxo:
+ * 1. Client envia: Authorization: Bearer <token>
+ * 2. Guard busca user pelo token no provider
+ * 3. Se válido, user está autenticado
+ *
+ * Tokens são armazenados no cache com referência ao userId.
+ */
+
+import type {
+  Guard,
+  Authenticatable,
+  UserProvider,
+  RequestContext,
+} from '../contracts'
+import type { CacheDriver } from '@server/cache/contracts'
+
+interface StoredToken {
+  userId: string | number
+  createdAt: number
+  expiresAt: number | null
+}
+
+export class TokenGuard implements Guard {
+  readonly name: string
+  private provider: UserProvider
+  private cache: CacheDriver
+  private request: RequestContext | null = null
+  private tokenTtl: number
+
+  /** Cache do usuário para a request atual */
+  private resolvedUser: Authenticatable | null | undefined = undefined
+
+  constructor(
+    name: string,
+    provider: UserProvider,
+    cache: CacheDriver,
+    tokenTtlSeconds: number = 86400 // 24h default
+  ) {
+    this.name = name
+    this.provider = provider
+    this.cache = cache
+    this.tokenTtl = tokenTtlSeconds
+  }
+
+  setRequest(context: RequestContext): void {
+    this.request = context
+    this.resolvedUser = undefined
+  }
+
+  async user(): Promise<Authenticatable | null> {
+    if (this.resolvedUser !== undefined) {
+      return this.resolvedUser
+    }
+
+    this.resolvedUser = null
+
+    if (!this.request) return null
+
+    // 1. Extrair token do header Authorization
+    const token = this.getBearerToken()
+    if (!token) return null
+
+    // 2. Buscar token no cache
+    const tokenData = await this.cache.get<StoredToken>(`auth_token:${this.hashToken(token)}`)
+    if (!tokenData) return null
+
+    // 3. Verificar expiração
+    if (tokenData.expiresAt && Date.now() > tokenData.expiresAt) {
+      await this.cache.delete(`auth_token:${this.hashToken(token)}`)
+      return null
+    }
+
+    // 4. Buscar usuário
+    const user = await this.provider.retrieveById(tokenData.userId)
+    if (user) {
+      this.resolvedUser = user
+    }
+
+    return this.resolvedUser
+  }
+
+  async id(): Promise<string | number | null> {
+    const user = await this.user()
+    return user?.getAuthId() ?? null
+  }
+
+  async check(): Promise<boolean> {
+    return (await this.user()) !== null
+  }
+
+  async guest(): Promise<boolean> {
+    return (await this.user()) === null
+  }
+
+  async attempt(credentials: Record<string, unknown>): Promise<Authenticatable | null> {
+    // 1. Buscar user
+    const user = await this.provider.retrieveByCredentials(credentials)
+    if (!user) return null
+
+    // 2. Validar password
+    const valid = await this.provider.validateCredentials(user, credentials)
+    if (!valid) return null
+
+    // 3. Gerar e armazenar token
+    await this.login(user)
+
+    return user
+  }
+
+  async login(user: Authenticatable): Promise<void> {
+    // Gerar token
+    const token = this.generateToken()
+    const hashedToken = this.hashToken(token)
+
+    // Armazenar no cache
+    const tokenData: StoredToken = {
+      userId: user.getAuthId(),
+      createdAt: Date.now(),
+      expiresAt: this.tokenTtl > 0 ? Date.now() + (this.tokenTtl * 1000) : null,
+    }
+    await this.cache.set(`auth_token:${hashedToken}`, tokenData, this.tokenTtl || undefined)
+
+    // Armazenar lista de tokens do user (para revogação em massa)
+    const userTokensKey = `user_tokens:${user.getAuthId()}`
+    const existingTokens = await this.cache.get<string[]>(userTokensKey) ?? []
+    existingTokens.push(hashedToken)
+    await this.cache.set(userTokensKey, existingTokens)
+
+    // Cache do user
+    this.resolvedUser = user
+
+    // Salvar token plain-text temporariamente para a response poder retorná-lo
+    ;(this as any)._lastGeneratedToken = token
+  }
+
+  async logout(): Promise<void> {
+    if (!this.request) return
+
+    const token = this.getBearerToken()
+    if (token) {
+      await this.cache.delete(`auth_token:${this.hashToken(token)}`)
+    }
+
+    this.resolvedUser = null
+  }
+
+  async validate(credentials: Record<string, unknown>): Promise<boolean> {
+    const user = await this.provider.retrieveByCredentials(credentials)
+    if (!user) return false
+    return this.provider.validateCredentials(user, credentials)
+  }
+
+  /**
+   * Revoga todos os tokens de um usuário.
+   */
+  async revokeAllTokens(userId: string | number): Promise<void> {
+    const userTokensKey = `user_tokens:${userId}`
+    const tokens = await this.cache.get<string[]>(userTokensKey) ?? []
+
+    for (const hashedToken of tokens) {
+      await this.cache.delete(`auth_token:${hashedToken}`)
+    }
+    await this.cache.delete(userTokensKey)
+  }
+
+  /** Retorna o último token gerado (para a response após login) */
+  getLastGeneratedToken(): string | null {
+    return (this as any)._lastGeneratedToken ?? null
+  }
+
+  /** Extrai Bearer token do header Authorization */
+  private getBearerToken(): string | null {
+    if (!this.request) return null
+
+    const authHeader = this.request.headers['authorization'] ?? this.request.headers['Authorization']
+    if (!authHeader?.startsWith('Bearer ')) return null
+
+    return authHeader.slice(7)
+  }
+
+  /** Gera um token criptograficamente seguro */
+  private generateToken(): string {
+    const bytes = new Uint8Array(32)
+    crypto.getRandomValues(bytes)
+    return Array.from(bytes)
+      .map(b => b.toString(16).padStart(2, '0'))
+      .join('')
+  }
+
+  /** Hash do token para armazenamento (nunca guardar plain-text) */
+  private hashToken(token: string): string {
+    const hasher = new Bun.CryptoHasher('sha256')
+    hasher.update(token)
+    return hasher.digest('hex')
+  }
+}

package/app/server/auth/index.ts

@@ -0,0 +1,174 @@
+/**
+ * FluxStack Auth System
+ *
+ * Sistema de autenticação modular inspirado no Laravel.
+ * Guard + Provider pattern com session e token support.
+ *
+ * ```ts
+ * import { auth, guest, initAuth, getAuthManager } from '@server/auth'
+ *
+ * // Inicializar (no boot da app)
+ * initAuth()
+ *
+ * // Proteger rotas
+ * app.use(auth()).get('/me', ({ user }) => user.toJSON())
+ * app.use(guest()).post('/login', loginHandler)
+ *
+ * // Usar auth manager diretamente
+ * const manager = getAuthManager()
+ * const guard = manager.guard('session')
+ * const user = await guard.attempt({ email, password })
+ * ```
+ */
+
+// Contracts
+export type {
+  Authenticatable,
+  Guard,
+  UserProvider,
+  RequestContext,
+  CookieOptions,
+  GuardConfig,
+  GuardFactory,
+} from './contracts'
+
+// Auth Manager
+export { AuthManager } from './AuthManager'
+export type { AuthManagerConfig, ProviderConfig } from './AuthManager'
+
+// Hash
+export { HashManager, Hash, getHashManager, setHashManager } from './HashManager'
+export type { HashAlgorithm, HashOptions } from './HashManager'
+
+// Rate Limiter
+export { RateLimiter } from './RateLimiter'
+
+// Guards
+export { SessionGuard } from './guards/SessionGuard'
+export { TokenGuard } from './guards/TokenGuard'
+
+// Providers
+export { InMemoryUserProvider, InMemoryUser } from './providers/InMemoryProvider'
+
+// Sessions
+export { SessionManager } from './sessions/SessionManager'
+export type { SessionData, SessionConfig } from './sessions/SessionManager'
+
+// Middleware
+export { auth, guest, authOptional } from './middleware'
+
+// ===== Boot =====
+
+import { AuthManager } from './AuthManager'
+import { HashManager, setHashManager } from './HashManager'
+import { RateLimiter } from './RateLimiter'
+import { SessionManager } from './sessions/SessionManager'
+import { InMemoryUserProvider } from './providers/InMemoryProvider'
+import { setAuthManagerForMiddleware, buildRequestContext } from './middleware'
+import { cacheManager } from '@server/cache'
+import { authConfig } from '@config/system/auth.config'
+import { sessionConfig } from '@config/system/session.config'
+
+let authManagerInstance: AuthManager | null = null
+let rateLimiterInstance: RateLimiter | null = null
+let sessionManagerInstance: SessionManager | null = null
+
+/**
+ * Inicializa o sistema de auth.
+ * Deve ser chamado uma vez no boot da aplicação.
+ */
+export function initAuth(): {
+  authManager: AuthManager
+  rateLimiter: RateLimiter
+  sessionManager: SessionManager
+} {
+  // 1. Configurar Hash
+  const hashManager = new HashManager({
+    algorithm: authConfig.passwords.hashAlgorithm as 'bcrypt' | 'argon2id',
+    bcryptRounds: authConfig.passwords.bcryptRounds,
+  })
+  setHashManager(hashManager)
+
+  // 2. Criar Session Manager
+  const cache = cacheManager.driver()
+  sessionManagerInstance = new SessionManager(cache, {
+    lifetime: sessionConfig.lifetime,
+    cookieName: sessionConfig.cookieName,
+    httpOnly: sessionConfig.httpOnly,
+    secure: sessionConfig.secure,
+    sameSite: sessionConfig.sameSite as 'strict' | 'lax' | 'none',
+    path: sessionConfig.path,
+    domain: sessionConfig.domain || undefined,
+  })
+
+  // 3. Criar Rate Limiter
+  rateLimiterInstance = new RateLimiter(cache)
+
+  // 4. Criar Auth Manager
+  authManagerInstance = new AuthManager(
+    {
+      defaults: {
+        guard: authConfig.defaults.guard ?? 'session',
+        provider: authConfig.defaults.provider ?? 'memory',
+      },
+      guards: {
+        session: {
+          driver: 'session',
+          provider: 'memory',
+        },
+        token: {
+          driver: 'token',
+          provider: 'memory',
+          tokenTtl: authConfig.token.ttl,
+        },
+      },
+      providers: {
+        memory: {
+          driver: 'memory',
+        },
+      },
+    },
+    sessionManagerInstance
+  )
+
+  // 5. Registrar InMemoryProvider como default
+  const inMemoryProvider = new InMemoryUserProvider()
+  authManagerInstance.registerProvider('memory', inMemoryProvider)
+
+  // 6. Conectar middleware
+  setAuthManagerForMiddleware(authManagerInstance)
+
+  console.log(`🔐 Auth system initialized (guard: ${authConfig.defaults.guard}, hash: ${authConfig.passwords.hashAlgorithm})`)
+
+  return {
+    authManager: authManagerInstance,
+    rateLimiter: rateLimiterInstance,
+    sessionManager: sessionManagerInstance,
+  }
+}
+
+/** Retorna o AuthManager (deve ser chamado após initAuth) */
+export function getAuthManager(): AuthManager {
+  if (!authManagerInstance) {
+    throw new Error('Auth not initialized. Call initAuth() first.')
+  }
+  return authManagerInstance
+}
+
+/** Retorna o RateLimiter (deve ser chamado após initAuth) */
+export function getRateLimiter(): RateLimiter {
+  if (!rateLimiterInstance) {
+    throw new Error('Auth not initialized. Call initAuth() first.')
+  }
+  return rateLimiterInstance
+}
+
+/** Retorna o SessionManager (deve ser chamado após initAuth) */
+export function getSessionManager(): SessionManager {
+  if (!sessionManagerInstance) {
+    throw new Error('Auth not initialized. Call initAuth() first.')
+  }
+  return sessionManagerInstance
+}
+
+export { buildRequestContext }

package/app/server/auth/middleware.ts

@@ -0,0 +1,163 @@
+/**
+ * FluxStack Auth - Elysia Middleware
+ *
+ * Middlewares prontos para proteger rotas:
+ *
+ * ```ts
+ * // Rota protegida (requer login)
+ * app.use(auth()).get('/me', ({ user }) => user.toJSON())
+ *
+ * // Rota de guest (requer NÃO estar logado)
+ * app.use(guest()).post('/login', loginHandler)
+ *
+ * // Guard específico
+ * app.use(auth('api')).get('/api/data', handler)
+ * ```
+ */
+
+import { Elysia } from 'elysia'
+import type { AuthManager } from './AuthManager'
+import type { Authenticatable, RequestContext } from './contracts'
+
+/** Referência ao AuthManager (setado no boot) */
+let authManagerRef: AuthManager | null = null
+
+export function setAuthManagerForMiddleware(manager: AuthManager): void {
+  authManagerRef = manager
+}
+
+/**
+ * Extrai RequestContext do context do Elysia.
+ */
+function buildRequestContext(ctx: any): RequestContext {
+  const headers: Record<string, string | undefined> = {}
+  if (ctx.headers) {
+    for (const [key, value] of Object.entries(ctx.headers)) {
+      headers[key] = value as string | undefined
+    }
+  }
+
+  return {
+    headers,
+    cookie: ctx.cookie ?? {},
+    setCookie: (name: string, value: string, options?: any) => {
+      if (ctx.cookie) {
+        ctx.cookie[name].set({
+          value,
+          ...options,
+        })
+      }
+    },
+    removeCookie: (name: string) => {
+      if (ctx.cookie) {
+        ctx.cookie[name].set({
+          value: '',
+          maxAge: 0,
+          path: '/',
+        })
+      }
+    },
+    ip: ctx.request?.headers?.get('x-forwarded-for')
+      ?? ctx.request?.headers?.get('x-real-ip')
+      ?? ctx.server?.requestIP?.(ctx.request)?.address
+      ?? '127.0.0.1',
+  }
+}
+
+/**
+ * Middleware que requer autenticação.
+ * Injeta `user` (Authenticatable) no context do Elysia.
+ *
+ * Retorna 401 se não autenticado.
+ */
+export function auth(guardName?: string) {
+  return new Elysia({ name: `auth-guard${guardName ? `-${guardName}` : ''}` })
+    .derive(async (ctx) => {
+      if (!authManagerRef) {
+        throw new Error('Auth system not initialized. Did you forget to call initAuth()?')
+      }
+
+      const requestContext = buildRequestContext(ctx)
+      const guard = authManagerRef.freshGuard(guardName, requestContext)
+
+      const user = await guard.user()
+
+      return {
+        user: user as Authenticatable | null,
+        auth: guard,
+      }
+    })
+    .onBeforeHandle(async (ctx) => {
+      if (!(ctx as any).user) {
+        (ctx as any).set.status = 401
+        return {
+          success: false,
+          error: 'Unauthenticated',
+          message: 'You must be logged in to access this resource.',
+        }
+      }
+    })
+    .as('scoped')
+}
+
+/**
+ * Middleware que requer NÃO estar autenticado.
+ * Útil para rotas de login/register.
+ *
+ * Retorna 409 se já autenticado.
+ */
+export function guest(guardName?: string) {
+  return new Elysia({ name: `guest-guard${guardName ? `-${guardName}` : ''}` })
+    .derive(async (ctx) => {
+      if (!authManagerRef) {
+        throw new Error('Auth system not initialized. Did you forget to call initAuth()?')
+      }
+
+      const requestContext = buildRequestContext(ctx)
+      const guard = authManagerRef.freshGuard(guardName, requestContext)
+
+      const user = await guard.user()
+
+      return {
+        user: user as Authenticatable | null,
+        auth: guard,
+      }
+    })
+    .onBeforeHandle(async (ctx) => {
+      if ((ctx as any).user) {
+        (ctx as any).set.status = 409
+        return {
+          success: false,
+          error: 'AlreadyAuthenticated',
+          message: 'You are already logged in.',
+        }
+      }
+    })
+    .as('scoped')
+}
+
+/**
+ * Middleware que resolve auth opcionalmente (não bloqueia).
+ * Útil para rotas que funcionam com ou sem login.
+ */
+export function authOptional(guardName?: string) {
+  return new Elysia({ name: `auth-optional${guardName ? `-${guardName}` : ''}` })
+    .derive(async (ctx) => {
+      if (!authManagerRef) {
+        return { user: null, auth: null }
+      }
+
+      const requestContext = buildRequestContext(ctx)
+      const guard = authManagerRef.freshGuard(guardName, requestContext)
+
+      const user = await guard.user()
+
+      return {
+        user: user as Authenticatable | null,
+        auth: guard,
+      }
+    })
+    .as('scoped')
+}
+
+export { buildRequestContext }

package/app/server/auth/providers/InMemoryProvider.ts

@@ -0,0 +1,162 @@
+/**
+ * FluxStack Auth - In-Memory User Provider
+ *
+ * Provider que armazena usuários em memória.
+ * Ideal para desenvolvimento, demos e testes.
+ *
+ * Para produção, implemente UserProvider com seu ORM:
+ * ```ts
+ * class DrizzleUserProvider implements UserProvider {
+ *   async retrieveById(id) {
+ *     return db.select().from(users).where(eq(users.id, id)).get()
+ *   }
+ *   // ...
+ * }
+ * ```
+ */
+
+import type { Authenticatable, UserProvider } from '../contracts'
+import { Hash } from '../HashManager'
+
+// ===== In-Memory User Model =====
+
+export class InMemoryUser implements Authenticatable {
+  id: number
+  name: string
+  email: string
+  passwordHash: string
+  rememberToken: string | null = null
+  createdAt: Date
+
+  constructor(data: {
+    id: number
+    name: string
+    email: string
+    passwordHash: string
+    createdAt?: Date
+  }) {
+    this.id = data.id
+    this.name = data.name
+    this.email = data.email
+    this.passwordHash = data.passwordHash
+    this.createdAt = data.createdAt ?? new Date()
+  }
+
+  getAuthId(): number {
+    return this.id
+  }
+
+  getAuthIdField(): string {
+    return 'id'
+  }
+
+  getAuthPassword(): string {
+    return this.passwordHash
+  }
+
+  getRememberToken(): string | null {
+    return this.rememberToken
+  }
+
+  setRememberToken(token: string | null): void {
+    this.rememberToken = token
+  }
+
+  toJSON(): Record<string, unknown> {
+    return {
+      id: this.id,
+      name: this.name,
+      email: this.email,
+      createdAt: this.createdAt.toISOString(),
+    }
+  }
+}
+
+// ===== Provider =====
+
+export class InMemoryUserProvider implements UserProvider {
+  private users: InMemoryUser[] = []
+  private nextId = 1
+
+  async retrieveById(id: string | number): Promise<Authenticatable | null> {
+    return this.users.find(u => u.id === Number(id)) ?? null
+  }
+
+  async retrieveByCredentials(credentials: Record<string, unknown>): Promise<Authenticatable | null> {
+    // Buscar por qualquer campo EXCETO password
+    const { password: _, ...searchFields } = credentials
+
+    return this.users.find(user => {
+      return Object.entries(searchFields).every(([key, value]) => {
+        return (user as any)[key] === value
+      })
+    }) ?? null
+  }
+
+  async validateCredentials(user: Authenticatable, credentials: Record<string, unknown>): Promise<boolean> {
+    const password = credentials.password as string | undefined
+    if (!password) return false
+
+    const valid = await Hash.check(password, user.getAuthPassword())
+
+    // Rehash transparente se necessário
+    if (valid && Hash.needsRehash(user.getAuthPassword())) {
+      const newHash = await Hash.make(password)
+      // Atualizar hash in-memory
+      const memUser = user as InMemoryUser
+      memUser.passwordHash = newHash
+    }
+
+    return valid
+  }
+
+  async retrieveByToken(id: string | number, token: string): Promise<Authenticatable | null> {
+    const user = this.users.find(u => u.id === Number(id))
+    if (!user) return null
+    if (user.getRememberToken() !== token) return null
+    return user
+  }
+
+  async updateRememberToken(user: Authenticatable, token: string | null): Promise<void> {
+    user.setRememberToken(token)
+  }
+
+  async createUser(data: Record<string, unknown>): Promise<Authenticatable> {
+    const name = data.name as string
+    const email = data.email as string
+    const password = data.password as string
+
+    if (!name || !email || !password) {
+      throw new Error('Name, email and password are required')
+    }
+
+    // Verificar email duplicado
+    const existing = this.users.find(u => u.email === email)
+    if (existing) {
+      throw new Error('Email already in use')
+    }
+
+    const passwordHash = await Hash.make(password)
+
+    const user = new InMemoryUser({
+      id: this.nextId++,
+      name,
+      email,
+      passwordHash,
+    })
+
+    this.users.push(user)
+    return user
+  }
+
+  /** Para testes: reset completo */
+  reset(): void {
+    this.users = []
+    this.nextId = 1
+  }
+
+  /** Para testes: retorna todos os usuários */
+  getAll(): InMemoryUser[] {
+    return [...this.users]
+  }
+}