create-nexwire 4.2.5 → 4.4.0

package/fastify/src/middlewares/auth-middleware.ts

@@ -0,0 +1,134 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { cookie, HttpStatusCodes, jwt, resolveAuthProvider } from "@/framework/facade.js";
+
+function unauthorized(reply: FastifyReply, message = "Unauthorized") {
+  return reply.code(HttpStatusCodes.UNAUTHORIZED).send({ message });
+}
+
+/**
+ * Why: Resolves the access token into a request auth context.
+ * When: Protected route groups run this as a scoped `preHandler` hook.
+ * Where: `modules/<name>/routes/*.ts` via `addHook("preHandler", authMiddleware)`.
+ * How: Verifies the access token, falls back to a rotating refresh token when
+ *      needed, and exposes the resolved context as `request.auth`.
+ */
+export async function authMiddleware(request: FastifyRequest, reply: FastifyReply) {
+  const provider = await resolveAuthProvider();
+  if (!provider) {
+    console.warn(
+      "[auth-middleware] auth provider not available; skipping auth. Register one in src/providers/ or restore src/modules/auth."
+    );
+    return;
+  }
+
+  const accessToken = await cookie.getAuth(request);
+
+  if (accessToken) {
+    const accessPayload: any = await jwt.verifyToken(accessToken, "access");
+
+    if (accessPayload) {
+      const user = await provider.getUserById((accessPayload as any)?.id);
+
+      if (!user) {
+        cookie.deleteAuth(reply);
+        cookie.deleteRefresh(reply);
+        return unauthorized(reply);
+      }
+
+      let authCtx: any;
+      if (provider.getAuthContext) {
+        authCtx = await provider.getAuthContext(user, accessPayload);
+      } else {
+        authCtx = {
+          ...(accessPayload || {}),
+          id: (user as any).id,
+          email: (user as any).email,
+          roleId: (user as any).role?.id ?? (user as any).roleId ?? null,
+          role: (user as any).role?.name ?? (user as any).role ?? null,
+          ...(user as any)
+        };
+      }
+      request.auth = authCtx;
+      return;
+    }
+  }
+
+  const refreshToken = await cookie.getRefresh(request);
+
+  if (!refreshToken) {
+    cookie.deleteAuth(reply);
+    cookie.deleteRefresh(reply);
+    return unauthorized(reply);
+  }
+
+  const refreshPayload: any = await jwt.verifyToken(refreshToken, "refresh");
+
+  if (!refreshPayload?.jti) {
+    cookie.deleteAuth(reply);
+    cookie.deleteRefresh(reply);
+    return unauthorized(reply, "Invalid token");
+  }
+
+  const storedToken = await provider.findRefreshToken((refreshPayload as any)?.jti);
+
+  if (!storedToken || (storedToken as any).revoked) {
+    cookie.deleteAuth(reply);
+    cookie.deleteRefresh(reply);
+    return unauthorized(reply, "Invalid token");
+  }
+
+  const expiresAt = (storedToken as any).expiresAt;
+  if (expiresAt) {
+    const exp = expiresAt instanceof Date ? expiresAt.getTime() : new Date(expiresAt).getTime();
+    if (!Number.isNaN(exp) && exp < Date.now()) {
+      if (provider.deleteRefreshToken) await provider.deleteRefreshToken((storedToken as any).id);
+      else if (provider.revokeRefreshToken) await provider.revokeRefreshToken((storedToken as any).id);
+      cookie.deleteAuth(reply);
+      cookie.deleteRefresh(reply);
+      return unauthorized(reply, "Invalid token");
+    }
+  }
+
+  const user = await provider.getUserById((refreshPayload as any)?.id);
+
+  if (!user) {
+    cookie.deleteAuth(reply);
+    cookie.deleteRefresh(reply);
+    return unauthorized(reply);
+  }
+
+  let baseCtx: any;
+  if (provider.getAuthContext) {
+    baseCtx = await provider.getAuthContext(user, refreshPayload);
+  } else {
+    baseCtx = {
+      ...(refreshPayload || {}),
+      id: (user as any).id,
+      email: (user as any).email,
+      roleId: (user as any).role?.id ?? (user as any).roleId ?? null,
+      role: (user as any).role?.name ?? (user as any).role ?? null,
+      ...(user as any)
+    };
+  }
+
+  const newAccessToken = await jwt.generateToken(
+    {
+      id: (user as any).id,
+      email: (user as any).email,
+      roleId: baseCtx?.roleId ?? (user as any).role?.id ?? (user as any).roleId ?? null,
+      role: baseCtx?.role ?? (user as any).role?.name ?? (user as any).role ?? null
+    },
+    "access"
+  );
+
+  await cookie.setAuth(reply, newAccessToken.token);
+  request.auth = {
+    ...(baseCtx || {}),
+    id: (user as any).id,
+    email: (user as any).email,
+    roleId: baseCtx?.roleId ?? (user as any).role?.id ?? (user as any).roleId ?? null,
+    role: baseCtx?.role ?? (user as any).role?.name ?? (user as any).role ?? null,
+    type: "access",
+    ...(user as any)
+  };
+}

package/fastify/src/middlewares/role-middleware.ts

@@ -0,0 +1,19 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { HttpStatusCodes } from "@/framework/facade.js";
+
+/**
+ * Why: Restricts a route (or route group) to users holding one of the roles.
+ * When: Declared after `authMiddleware` in a route's `preHandler` list.
+ * Where: `modules/<name>/routes/*.ts`.
+ * How: Reads `request.auth`, which `authMiddleware` populates.
+ */
+export function requireRole(...allowedRoles: string[]) {
+  return async (request: FastifyRequest, reply: FastifyReply) => {
+    const auth = request.auth;
+    if (!auth) return reply.code(HttpStatusCodes.UNAUTHORIZED).send({ message: "Unauthorized" });
+
+    if (!allowedRoles.includes(auth.role?.name)) {
+      return reply.code(HttpStatusCodes.FORBIDDEN).send({ message: "Forbidden: Insufficient permissions" });
+    }
+  };
+}

package/fastify/src/modules/auth/__tests__/forgetpass.test.ts

@@ -0,0 +1,200 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    transaction: vi.fn()
+  },
+  dispatchEvent: vi.fn(),
+  urls: { url: vi.fn((p: string) => `https://app.test${p}`) }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  makeResetToken: vi.fn(() => "plain-token-123"),
+  hashResetToken: vi.fn((t: string) => `hashed:${t}`)
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  users: { __table: "users", id: "users.id", email: "users.email" },
+  passwordResetTokens: {
+    __table: "passwordResetTokens",
+    email: "passwordResetTokens.email",
+    token: "passwordResetTokens.token",
+    expiresAt: "passwordResetTokens.expiresAt",
+    createdAt: "passwordResetTokens.createdAt"
+  }
+}));
+
+import { db, dispatchEvent, urls } from "@/framework/facade.js";
+import { hashResetToken, makeResetToken } from "@/modules/auth/helpers/auth.js";
+import { forgotPasswordService } from "@/modules/auth/services/forgetpassword.js";
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane"
+};
+
+const body = { email: "user@example.com" };
+
+/**
+ * Build a fake tx whose calls we can inspect.
+ *   - user: what query.users.findFirst returns (null = no user)
+ */
+function buildTx({ user = fakeUser as unknown | null } = {}) {
+  const deleteCalls: { table: unknown; where: unknown }[] = [];
+  let currentDeleteTable: unknown;
+
+  const txDeleteWhere = vi.fn((where: unknown) => {
+    deleteCalls.push({ table: currentDeleteTable, where });
+    return Promise.resolve(undefined);
+  });
+  const txDelete = vi.fn((table: unknown) => {
+    currentDeleteTable = table;
+    return { where: txDeleteWhere };
+  });
+
+  const insertCalls: { table: unknown; values: unknown }[] = [];
+  let currentInsertTable: unknown;
+
+  const txInsertValues = vi.fn((values: unknown) => {
+    insertCalls.push({ table: currentInsertTable, values });
+    return Promise.resolve(undefined);
+  });
+  const txInsert = vi.fn((table: unknown) => {
+    currentInsertTable = table;
+    return { values: txInsertValues };
+  });
+
+  const txFindFirst = vi.fn((_args: unknown) => Promise.resolve(user));
+
+  return {
+    tx: {
+      delete: txDelete,
+      insert: txInsert,
+      query: { users: { findFirst: txFindFirst } }
+    },
+    txDelete,
+    txDeleteWhere,
+    txInsert,
+    txInsertValues,
+    txFindFirst,
+    deleteCalls,
+    insertCalls
+  };
+}
+
+describe("forgotPasswordService.forgotPassword", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns 'sent' and does nothing else when the user does not exist", async () => {
+    const { tx, txDelete, txInsert, txFindFirst } = buildTx({ user: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    const result = await forgotPasswordService.forgotPassword(body);
+
+    expect(result).toEqual({
+      kind: "sent",
+      message: "Reset link has been sent"
+    });
+
+    // Only the housekeeping delete ran — no insert, no email
+    expect(txDelete).toHaveBeenCalledTimes(1);
+    expect(txFindFirst).toHaveBeenCalledTimes(1);
+    expect(txInsert).not.toHaveBeenCalled();
+    expect(dispatchEvent).not.toHaveBeenCalled();
+    expect(urls.url).not.toHaveBeenCalled();
+  });
+
+  it("issues a fresh token, stores its HASH, and dispatches the mail event", async () => {
+    const { tx, txInsertValues } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    const result = await forgotPasswordService.forgotPassword(body);
+
+    expect(result).toEqual({
+      kind: "sent",
+      message: "Reset link has been sent"
+    });
+
+    // Plain token generated and hashed
+    expect(makeResetToken).toHaveBeenCalledTimes(1);
+    expect(hashResetToken).toHaveBeenCalledWith("plain-token-123");
+
+    // Inserted token is the HASH, never the plain one
+    expect(txInsertValues).toHaveBeenCalledTimes(1);
+    const inserted = txInsertValues.mock.calls[0][0] as any;
+    expect(inserted).toMatchObject({
+      email: "user@example.com",
+      token: "hashed:plain-token-123"
+    });
+    expect(inserted.token).not.toBe("plain-token-123");
+    expect(inserted.expiresAt).toBeInstanceOf(Date);
+    expect(inserted.createdAt).toBeInstanceOf(Date);
+
+    // ~15 min TTL between createdAt and expiresAt
+    const ttl = inserted.expiresAt.getTime() - inserted.createdAt.getTime();
+    expect(ttl).toBe(15 * 60 * 1000);
+
+    // Reset URL contains the PLAIN token (the user has to receive it)
+    expect(urls.url).toHaveBeenCalledWith("/reset-password?token=plain-token-123&email=user%40example.com");
+
+    // Mail dispatched with the reset URL
+    expect(dispatchEvent).toHaveBeenCalledWith(
+      "user:forget-password",
+      {
+        email: "user@example.com",
+        name: "Jane",
+        resetUrl: "https://app.test/reset-password?token=plain-token-123&email=user%40example.com"
+      },
+      { queue: "mail" }
+    );
+  });
+
+  it("revokes any existing tokens for the email before inserting a new one", async () => {
+    const { tx, txDelete, deleteCalls } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    await forgotPasswordService.forgotPassword(body);
+
+    // Two deletes: expired cleanup + revoke existing
+    expect(txDelete).toHaveBeenCalledTimes(2);
+    expect(deleteCalls).toHaveLength(2);
+
+    // Both target passwordResetTokens
+    expect((deleteCalls[0].table as any).__table).toBe("passwordResetTokens");
+    expect((deleteCalls[1].table as any).__table).toBe("passwordResetTokens");
+  });
+
+  it("sends the same message whether or not the user exists (no enumeration)", async () => {
+    const missing = buildTx({ user: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(missing.tx));
+    const r1 = await forgotPasswordService.forgotPassword(body);
+
+    vi.clearAllMocks();
+
+    const exists = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(exists.tx));
+    const r2 = await forgotPasswordService.forgotPassword(body);
+
+    expect(r1).toEqual(r2);
+  });
+
+  it("does not dispatch the email if the transaction fails", async () => {
+    vi.mocked(db.transaction).mockRejectedValueOnce(new Error("db down"));
+
+    await expect(forgotPasswordService.forgotPassword(body)).rejects.toThrow("db down");
+
+    expect(dispatchEvent).not.toHaveBeenCalled();
+    expect(urls.url).not.toHaveBeenCalled();
+  });
+
+  it("propagates a dispatch failure (token is already stored)", async () => {
+    const { tx } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    vi.mocked(dispatchEvent).mockRejectedValueOnce(new Error("queue down"));
+
+    // Current behavior: dispatch failure aborts the request.
+    // The token IS in the DB — the user can retry "forgot password".
+    await expect(forgotPasswordService.forgotPassword(body)).rejects.toThrow("queue down");
+  });
+});

package/fastify/src/modules/auth/__tests__/login.test.ts

@@ -0,0 +1,171 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/config/index.js", () => ({
+  authConfig: { requireEmailVerification: false }
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: { query: { users: { findFirst: vi.fn() } } },
+  password: { verifyPassword: vi.fn() }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  issueTokens: vi.fn(),
+  revokeCurrentRefreshToken: vi.fn(),
+  sanitizeUser: vi.fn((u: any) => ({ id: u.id, email: u.email, name: u.name }))
+}));
+
+import { authConfig } from "@/config/index.js";
+import { db, password } from "@/framework/facade.js";
+import { issueTokens, revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+import { loginService } from "@/modules/auth/services/login.js";
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane",
+  password: "hashed-pw",
+  emailVerifiedAt: new Date()
+};
+
+const body = { email: "user@example.com", password: "pw" };
+
+/** Minimal fake req/res. The service just passes them through. */
+function makeReqRes() {
+  const req = {} as FastifyRequest;
+  const res = {} as FastifyReply;
+  return { req, res };
+}
+
+describe("loginService.login (fastify)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(authConfig).requireEmailVerification = false;
+  });
+
+  it("returns invalid_credentials when the user does not exist (no hash attempt)", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result).toEqual({
+      kind: "invalid_credentials",
+      message: "Invalid credentials"
+    });
+    expect(password.verifyPassword).not.toHaveBeenCalled();
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+  });
+
+  it("returns invalid_credentials when the password is wrong", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(false);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result).toEqual({
+      kind: "invalid_credentials",
+      message: "Invalid credentials"
+    });
+    expect(password.verifyPassword).toHaveBeenCalledWith("pw", "hashed-pw");
+    expect(issueTokens).not.toHaveBeenCalled();
+  });
+
+  it("returns email_not_verified when verification is required and the email is not verified", async () => {
+    vi.mocked(authConfig).requireEmailVerification = true;
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce({
+      ...fakeUser,
+      emailVerifiedAt: null
+    } as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result).toEqual({
+      kind: "email_not_verified",
+      message: "Please verify your email before logging in"
+    });
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+  });
+
+  it("does NOT check email verification when the feature is disabled", async () => {
+    vi.mocked(authConfig).requireEmailVerification = false;
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce({
+      ...fakeUser,
+      emailVerifiedAt: null
+    } as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result.kind).toBe("logged_in");
+  });
+
+  it("logs in successfully and passes req/res through to the helpers", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "access-123",
+      refreshToken: "refresh-456"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, {
+      ...body,
+      remember: true
+    });
+
+    // The Fastify contract: request and reply are forwarded as-is.
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(req);
+    expect(issueTokens).toHaveBeenCalledWith(req, res, fakeUser, {
+      remember: true
+    });
+
+    expect(result).toEqual({
+      kind: "logged_in",
+      message: "User logged in successfully",
+      data: {
+        user: { id: 1, email: "user@example.com", name: "Jane" },
+        access_token: "access-123",
+        refresh_token: "refresh-456",
+        token_type: "Bearer"
+      }
+    });
+  });
+
+  it("coerces a missing remember flag to false", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    await loginService.login(req, res, body);
+
+    expect(issueTokens).toHaveBeenCalledWith(req, res, fakeUser, {
+      remember: false
+    });
+  });
+
+  it("does not issue tokens when credentials are invalid", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+    const { req, res } = makeReqRes();
+
+    await loginService.login(req, res, body);
+
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+    expect(issueTokens).not.toHaveBeenCalled();
+  });
+});

package/fastify/src/modules/auth/__tests__/logout.test.ts

@@ -0,0 +1,60 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  cookie: {
+    deleteAuth: vi.fn(),
+    deleteRefresh: vi.fn()
+  },
+  logger: {
+    error: vi.fn()
+  }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  revokeCurrentRefreshToken: vi.fn()
+}));
+
+import { cookie, logger } from "@/framework/facade.js";
+import { revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+import { logoutService } from "@/modules/auth/services/logout.js";
+
+function makeReqRes() {
+  const req = {} as FastifyRequest;
+  const res = {} as FastifyReply;
+  return { req, res };
+}
+
+describe("logoutService.logout (fastify)", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("revokes the refresh token and clears cookies", async () => {
+    const { req, res } = makeReqRes();
+
+    const result = await logoutService.logout(req, res);
+
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(req);
+    expect(cookie.deleteAuth).toHaveBeenCalledWith(res);
+    expect(cookie.deleteRefresh).toHaveBeenCalledWith(res);
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out successfully"
+    });
+  });
+
+  it("still clears cookies and returns success if revoke throws", async () => {
+    const err = new Error("db down");
+    vi.mocked(revokeCurrentRefreshToken).mockRejectedValueOnce(err);
+
+    const { req, res } = makeReqRes();
+    const result = await logoutService.logout(req, res);
+
+    expect(cookie.deleteAuth).toHaveBeenCalledWith(res);
+    expect(cookie.deleteRefresh).toHaveBeenCalledWith(res);
+    expect(logger.error).toHaveBeenCalledWith("failed to revoke refresh token on logout", { err });
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out successfully"
+    });
+  });
+});

package/fastify/src/modules/auth/__tests__/logoutalldevices.test.ts

@@ -0,0 +1,49 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("drizzle-orm", () => ({
+  eq: vi.fn((col: unknown, val: unknown) => ({ op: "eq", col, val }))
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    delete: vi.fn(() => ({ where: vi.fn() }))
+  }
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  refreshTokens: { __table: "refreshTokens", userId: "refreshTokens.userId" }
+}));
+
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { refreshTokens } from "@/modules/auth/database/models/user.js";
+import { logoutAllDevicesService } from "@/modules/auth/services/logoutalldevices.js";
+
+describe("logoutAllDevicesService.logoutAllDevices", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("deletes refresh tokens for the given user", async () => {
+    await logoutAllDevicesService.logoutAllDevices(42);
+
+    expect(db.delete).toHaveBeenCalledWith(refreshTokens);
+
+    // The where-clause targets refreshTokens.userId with the userId value
+    expect(eq).toHaveBeenCalledWith(refreshTokens.userId, 42);
+
+    const whereArg = (db.delete as any).mock.results[0].value.where.mock.calls[0][0] as any;
+    expect(whereArg).toEqual({
+      op: "eq",
+      col: "refreshTokens.userId",
+      val: 42
+    });
+  });
+
+  it("returns logged_out", async () => {
+    const result = await logoutAllDevicesService.logoutAllDevices(42);
+
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out from all devices successfully"
+    });
+  });
+});