create-nexwire 4.3.0 → 4.4.0

package/fastify/src/modules/auth/services/forgetpassword.ts

@@ -0,0 +1,66 @@
+import { and, eq, lt } from "drizzle-orm";
+import { db, dispatchEvent, urls } from "@/framework/facade.js";
+import { passwordResetTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashResetToken, makeResetToken } from "@/modules/auth/helpers/auth.js";
+import type { ForgotPasswordInput } from "@/modules/auth/types/auth.js";
+
+export type ForgotPasswordResult = {
+  kind: "sent";
+  message: string;
+};
+
+const TOKEN_TTL_MS = 15 * 60 * 1000;
+
+export const forgotPasswordService = {
+  forgotPassword: async (body: ForgotPasswordInput): Promise<ForgotPasswordResult> => {
+    const now = new Date();
+
+    // Cleanup + replace happen atomically so a crash mid-flow can't leave
+    // the user without a valid token.
+    const issued = await db.transaction(async (tx) => {
+      // 1. Drop this email's expired tokens (housekeeping, not critical)
+      await tx.delete(passwordResetTokens).where(and(eq(passwordResetTokens.email, body.email), lt(passwordResetTokens.expiresAt, now)));
+
+      const user = await tx.query.users.findFirst({
+        where: eq(users.email, body.email)
+      });
+
+      if (!user) return null;
+
+      // 2. Revoke any existing unexpired token for this email
+      await tx.delete(passwordResetTokens).where(eq(passwordResetTokens.email, body.email));
+
+      // 3. Issue a fresh one
+      const plainToken = makeResetToken();
+      const expiresAt = new Date(now.getTime() + TOKEN_TTL_MS);
+
+      await tx.insert(passwordResetTokens).values({
+        email: user.email,
+        token: hashResetToken(plainToken),
+        expiresAt,
+        createdAt: now
+      });
+
+      return { user, plainToken };
+    });
+
+    // Same response whether or not the user exists (no enumeration).
+    if (!issued) {
+      return { kind: "sent", message: "Reset link has been sent" };
+    }
+
+    const resetUrl = urls.url(`/reset-password?token=${issued.plainToken}&email=${encodeURIComponent(issued.user.email)}`);
+
+    await dispatchEvent(
+      "user:forget-password",
+      {
+        email: issued.user.email,
+        name: issued.user.name,
+        resetUrl
+      },
+      { queue: "mail" }
+    );
+
+    return { kind: "sent", message: "Reset link has been sent" };
+  }
+};

package/fastify/src/modules/auth/services/login.ts

@@ -0,0 +1,63 @@
+import { eq } from "drizzle-orm";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { authConfig } from "@/config/index.js";
+import { db, password } from "@/framework/facade.js";
+import { users } from "@/modules/auth/database/models/user.js";
+import { issueTokens, revokeCurrentRefreshToken, sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import type { LoginInput } from "@/modules/auth/types/auth.js";
+
+export type LoginResult =
+  | { kind: "invalid_credentials"; message: string }
+  | { kind: "email_not_verified"; message: string }
+  | {
+      kind: "logged_in";
+      message: string;
+      data: {
+        user: ReturnType<typeof sanitizeUser>;
+        access_token: string;
+        refresh_token: string;
+        token_type: "Bearer";
+      };
+    };
+
+export const loginService = {
+  login: async (req: FastifyRequest, reply: FastifyReply, body: LoginInput): Promise<LoginResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email),
+      with: { role: true }
+    });
+
+    // Generic message for both "user missing" and "wrong password" —
+    // never tell an attacker which one it was.
+    const passwordOk = user && (await password.verifyPassword(body.password, user.password));
+
+    if (!user || !passwordOk) {
+      return { kind: "invalid_credentials", message: "Invalid credentials" };
+    }
+
+    if (authConfig.requireEmailVerification && !user.emailVerifiedAt) {
+      return {
+        kind: "email_not_verified",
+        message: "Please verify your email before logging in"
+      };
+    }
+
+    // Rotate the current refresh token before issuing a new pair.
+    await revokeCurrentRefreshToken(req);
+
+    const tokens = await issueTokens(req, reply, user, {
+      remember: !!body.remember
+    });
+
+    return {
+      kind: "logged_in",
+      message: "User logged in successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        token_type: "Bearer"
+      }
+    };
+  }
+};

package/fastify/src/modules/auth/services/logout.ts

@@ -0,0 +1,25 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { cookie, logger } from "@/framework/facade.js";
+import { revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+
+export type LogoutResult = {
+  kind: "logged_out";
+  message: string;
+};
+
+export const logoutService = {
+  logout: async (req: FastifyRequest, reply: FastifyReply): Promise<LogoutResult> => {
+    try {
+      await revokeCurrentRefreshToken(req);
+    } catch (err) {
+      // Log and continue — the user is logging out either way.
+      // The server-side token will expire on its own.
+      logger.error("failed to revoke refresh token on logout", { err });
+    }
+
+    cookie.deleteAuth(reply);
+    cookie.deleteRefresh(reply);
+
+    return { kind: "logged_out", message: "Logged out successfully" };
+  }
+};

package/fastify/src/modules/auth/services/logoutalldevices.ts

@@ -0,0 +1,19 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { refreshTokens } from "@/modules/auth/database/models/user.js";
+
+export type LogoutAllDevicesResult = {
+  kind: "logged_out";
+  message: string;
+};
+
+export const logoutAllDevicesService = {
+  logoutAllDevices: async (userId: number): Promise<LogoutAllDevicesResult> => {
+    await db.delete(refreshTokens).where(eq(refreshTokens.userId, userId));
+
+    return {
+      kind: "logged_out",
+      message: "Logged out from all devices successfully"
+    };
+  }
+};

package/fastify/src/modules/auth/services/me.ts

@@ -0,0 +1,31 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { users } from "@/modules/auth/database/models/user.js";
+import { sanitizeUser } from "@/modules/auth/helpers/auth.js";
+
+export type MeResult =
+  | { kind: "not_found"; message: string }
+  | {
+      kind: "found";
+      message: string;
+      data: ReturnType<typeof sanitizeUser>;
+    };
+
+export const meService = {
+  me: async (userId: number): Promise<MeResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, userId),
+      with: { role: true }
+    });
+
+    if (!user) {
+      return { kind: "not_found", message: "User not found" };
+    }
+
+    return {
+      kind: "found",
+      message: "Authenticated user fetched successfully",
+      data: sanitizeUser(user)
+    };
+  }
+};

package/fastify/src/modules/auth/services/refreshtoken.ts

@@ -0,0 +1,110 @@
+import { and, eq } from "drizzle-orm";
+import { jwtConfig } from "@/config/index.js";
+import { db, jwt } from "@/framework/facade.js";
+import { refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import { sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import type { RefreshTokenInput } from "@/modules/auth/types/auth.js";
+
+export type RefreshTokenResult =
+  | { kind: "invalid_token"; message: string }
+  | { kind: "revoked"; message: string }
+  | { kind: "expired"; message: string }
+  | { kind: "user_not_found"; message: string }
+  | {
+      kind: "refreshed";
+      message: string;
+      data: {
+        user: ReturnType<typeof sanitizeUser>;
+        access_token: string;
+        refresh_token: string;
+        token_type: "Bearer";
+      };
+      cookies: {
+        accessToken: string;
+        refreshToken: string;
+        refreshExpiry?: number;
+      };
+    };
+
+export const refreshTokenService = {
+  refreshToken: async (body: RefreshTokenInput): Promise<RefreshTokenResult> => {
+    const payload = await jwt.verifyToken(body.refresh_token, "refresh");
+
+    if (!payload?.jti || typeof payload.jti !== "string") {
+      return { kind: "invalid_token", message: "Invalid refresh token" };
+    }
+
+    const userId = Number(payload.id);
+    if (!Number.isInteger(userId) || userId <= 0) {
+      return { kind: "invalid_token", message: "Invalid refresh token" };
+    }
+
+    const storedToken = await db.query.refreshTokens.findFirst({
+      where: eq(refreshTokens.jti, payload.jti)
+    });
+
+    if (!storedToken || storedToken.revoked === 1) {
+      return { kind: "revoked", message: "Refresh token revoked" };
+    }
+
+    if (storedToken.expiresAt.getTime() < Date.now()) {
+      await db.delete(refreshTokens).where(eq(refreshTokens.id, storedToken.id));
+      return { kind: "expired", message: "Refresh token expired" };
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, userId),
+      with: { role: true }
+    });
+
+    if (!user) {
+      return { kind: "user_not_found", message: "User not found" };
+    }
+
+    const remember = !!payload.remember;
+    const refreshExpiry = remember ? jwtConfig.refreshRememberExpirySeconds : undefined;
+
+    const tokenPayload = {
+      id: user.id,
+      email: user.email,
+      roleId: user.role?.id,
+      role: user.role?.name,
+      remember
+    };
+
+    const accessToken = await jwt.generateToken(tokenPayload, "access");
+    const newRefreshToken = await jwt.generateToken(tokenPayload, "refresh", refreshExpiry);
+
+    // Compare-and-swap: only rotate if the jti is still the one we read.
+    // Two concurrent requests with the same old token → exactly one wins.
+    const [rotated] = await db
+      .update(refreshTokens)
+      .set({
+        jti: newRefreshToken.jti,
+        expiresAt: new Date(newRefreshToken.exp * 1000),
+        revoked: 0
+      })
+      .where(and(eq(refreshTokens.id, storedToken.id), eq(refreshTokens.jti, payload.jti)))
+      .returning();
+
+    if (!rotated) {
+      return { kind: "revoked", message: "Refresh token revoked" };
+    }
+
+    return {
+      kind: "refreshed",
+      message: "Token refreshed successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: accessToken.token,
+        refresh_token: newRefreshToken.token,
+        token_type: "Bearer"
+      },
+      cookies: {
+        accessToken: accessToken.token,
+        refreshToken: newRefreshToken.token,
+        refreshExpiry
+      }
+    };
+  }
+};

package/fastify/src/modules/auth/services/register.ts

@@ -0,0 +1,141 @@
+import { eq } from "drizzle-orm";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { authConfig } from "@/config/index.js";
+import { db, dispatchEvent, password, urls } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+import { emailVerificationTokens, users } from "@/modules/auth/database/models/user.js";
+import {
+  hashEmailVerificationToken,
+  issueTokens,
+  makeEmailVerificationToken,
+  revokeCurrentRefreshToken,
+  sanitizeUser
+} from "@/modules/auth/helpers/auth.js";
+import type { RegisterInput } from "@/modules/auth/types/auth.js";
+
+export type RegisterResult =
+  | { kind: "email_exists"; message: string }
+  | { kind: "verification_required"; message: string }
+  | {
+      kind: "registered";
+      message: string;
+      data: {
+        user: ReturnType<typeof sanitizeUser>;
+        access_token: string;
+        refresh_token: string;
+        token_type: "Bearer";
+      };
+    };
+
+const VERIFY_TOKEN_TTL_MS = 24 * 60 * 60 * 1000;
+
+export const registerService = {
+  register: async (req: FastifyRequest, reply: FastifyReply, body: RegisterInput): Promise<RegisterResult> => {
+    const defaultRole = await db.query.roles.findFirst({
+      where: eq(roles.name, "user")
+    });
+
+    if (!defaultRole) {
+      throw new Error('Default role "user" not found — check your seeds');
+    }
+
+    const existingUser = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (existingUser) {
+      return { kind: "email_exists", message: "Email already exists" };
+    }
+
+    const hashedPassword = await password.hashPassword(body.password);
+    const now = new Date();
+
+    const created = await db.transaction(async (tx: any) => {
+      const [inserted] = await tx
+        .insert(users)
+        .values({
+          name: body.name,
+          email: body.email,
+          password: hashedPassword,
+          roleId: defaultRole.id
+        })
+        .returning({ id: users.id });
+
+      if (!inserted) throw new Error("Failed to insert user");
+
+      const user = await tx.query.users.findFirst({
+        where: eq(users.id, inserted.id),
+        with: { role: true }
+      });
+
+      if (!user) throw new Error("Inserted user not found");
+
+      let plainVerifyToken: string | null = null;
+
+      if (authConfig.requireEmailVerification) {
+        plainVerifyToken = makeEmailVerificationToken();
+        const expiresAt = new Date(now.getTime() + VERIFY_TOKEN_TTL_MS);
+
+        // One active verification token per email
+        await tx.delete(emailVerificationTokens).where(eq(emailVerificationTokens.email, user.email));
+
+        await tx.insert(emailVerificationTokens).values({
+          email: user.email,
+          token: hashEmailVerificationToken(plainVerifyToken),
+          expiresAt,
+          createdAt: now
+        });
+      }
+
+      return { user, plainVerifyToken };
+    });
+
+    // ---- Side effects AFTER commit ----
+
+    if (created.plainVerifyToken) {
+      const verifyUrl = urls.url(`/verify-email?token=${created.plainVerifyToken}&email=${encodeURIComponent(created.user.email)}`);
+
+      await dispatchEvent(
+        "user:verify-email",
+        {
+          email: created.user.email,
+          name: created.user.name,
+          verifyUrl
+        },
+        { queue: "mail" }
+      );
+
+      return {
+        kind: "verification_required",
+        message: "User registered successfully. Please verify your email before logging in."
+      };
+    }
+
+    await revokeCurrentRefreshToken(req);
+    const tokens = await issueTokens(req, reply, created.user, {
+      remember: !!body.remember
+    });
+
+    await dispatchEvent(
+      "user:signup",
+      {
+        userId: created.user.id,
+        email: created.user.email,
+        name: created.user.name
+        // NO password — see explanation below
+      },
+      { queue: "mail" }
+    );
+
+    return {
+      kind: "registered",
+      message: "User registered successfully",
+      data: {
+        user: sanitizeUser(created.user),
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        token_type: "Bearer"
+      }
+    };
+  }
+};

package/fastify/src/modules/auth/services/resetpassword.ts

@@ -0,0 +1,69 @@
+import { and, eq, gt } from "drizzle-orm";
+import { db, password } from "@/framework/facade.js";
+import { passwordResetTokens, refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashResetToken } from "@/modules/auth/helpers/auth.js";
+import type { ResetPasswordInput } from "@/modules/auth/types/auth.js";
+
+export type ResetPasswordResult = { kind: "invalid_token"; message: string } | { kind: "reset"; message: string };
+
+export const resetPasswordService = {
+  resetPassword: async (body: ResetPasswordInput): Promise<ResetPasswordResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) {
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired reset token"
+      };
+    }
+
+    const hashedPassword = await password.hashPassword(body.password);
+    const hashedToken = hashResetToken(body.token);
+    const now = new Date();
+
+    try {
+      const consumed = await db.transaction(async (tx) => {
+        // Consume the token atomically inside the transaction.
+        // If anything below fails, the delete rolls back and the
+        // user can retry with the same token.
+        const [row] = await tx
+          .delete(passwordResetTokens)
+          .where(
+            and(
+              eq(passwordResetTokens.email, body.email),
+              eq(passwordResetTokens.token, hashedToken),
+              gt(passwordResetTokens.expiresAt, now)
+            )
+          )
+          .returning();
+
+        if (!row) return false;
+
+        await tx.update(users).set({ password: hashedPassword, updatedAt: now }).where(eq(users.id, user.id));
+
+        await tx.update(refreshTokens).set({ revoked: 1 }).where(eq(refreshTokens.userId, user.id));
+
+        return true;
+      });
+
+      if (!consumed) {
+        return {
+          kind: "invalid_token",
+          message: "Invalid or expired reset token"
+        };
+      }
+
+      return { kind: "reset", message: "Password reset successfully" };
+    } catch (err) {
+      // Token was NOT consumed — the transaction rolled back, so the
+      // user can retry with the same token. Log so failures aren't silent.
+      // logger.error({ err, email: body.email }, "password reset failed");
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired reset token"
+      };
+    }
+  }
+};

package/fastify/src/modules/auth/services/verifyemail.ts

@@ -0,0 +1,77 @@
+import { and, eq, gt } from "drizzle-orm";
+import { authConfig } from "@/config/index.js";
+import { db } from "@/framework/facade.js";
+import { emailVerificationTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashEmailVerificationToken } from "@/modules/auth/helpers/auth.js";
+import type { VerifyEmailInput } from "@/modules/auth/types/auth.js";
+
+export type VerifyEmailResult =
+  | { kind: "not_required"; message: string }
+  | { kind: "invalid_token"; message: string }
+  | { kind: "verified"; message: string };
+
+export const verifyEmailService = {
+  verifyEmail: async (body: VerifyEmailInput): Promise<VerifyEmailResult> => {
+    if (!authConfig.requireEmailVerification) {
+      return {
+        kind: "not_required",
+        message: "Email verification is not required"
+      };
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) {
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired verification token"
+      };
+    }
+
+    const hashedToken = hashEmailVerificationToken(body.token);
+    const now = new Date();
+
+    try {
+      const verified = await db.transaction(async (tx) => {
+        // Consume the token atomically INSIDE the transaction.
+        // If the update below fails, the delete rolls back and the
+        // user can retry with the same token.
+        const [consumed] = await tx
+          .delete(emailVerificationTokens)
+          .where(
+            and(
+              eq(emailVerificationTokens.email, body.email),
+              eq(emailVerificationTokens.token, hashedToken),
+              gt(emailVerificationTokens.expiresAt, now)
+            )
+          )
+          .returning();
+
+        if (!consumed) return false;
+
+        await tx.update(users).set({ emailVerifiedAt: now, updatedAt: now }).where(eq(users.id, user.id));
+
+        return true;
+      });
+
+      if (!verified) {
+        return {
+          kind: "invalid_token",
+          message: "Invalid or expired verification token"
+        };
+      }
+
+      return { kind: "verified", message: "Email verified successfully" };
+    } catch (err) {
+      // Token was NOT consumed — the transaction rolled back, so the
+      // user can retry with the same token. Log so failures aren't silent.
+      // logger.error({ err, email: body.email }, "email verification failed");
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired verification token"
+      };
+    }
+  }
+};

package/fastify/src/modules/auth/types/auth.ts

@@ -0,0 +1,31 @@
+export type RegisterInput = {
+  name: string;
+  email: string;
+  password: string;
+  remember?: boolean;
+};
+
+export type LoginInput = {
+  email: string;
+  password: string;
+  remember?: boolean;
+};
+
+export type ForgotPasswordInput = {
+  email: string;
+};
+
+export type ResetPasswordInput = {
+  email: string;
+  token: string;
+  password: string;
+};
+
+export type VerifyEmailInput = {
+  email: string;
+  token: string;
+};
+
+export type RefreshTokenInput = {
+  refresh_token: string;
+};