create-windy 0.1.0

package/template/apps/server/src/auth/routes.ts

@@ -0,0 +1,237 @@
+import type { RequestGuardContext } from "../guards.js";
+import { readRequestSessionToken } from "./actor-resolver.js";
+import { registerLoginRoutes } from "./login-routes.js";
+import { registerOwnSessionRoutes } from "./own-session-routes.js";
+import type { AuthRequestMetadata, AuthService } from "./service.js";
+
+export interface AuthRouteApp {
+  get(path: string, handler: (context: unknown) => unknown): unknown;
+  post(path: string, handler: (context: unknown) => unknown): unknown;
+}
+
+export interface AuthRouteOptions {
+  sessionCookieName?: string;
+  secureCookie?: boolean;
+}
+
+export const passwordManagementRoute = {
+  method: "POST",
+  path: "/api/auth/users/:id/password",
+  registrationPath: "/auth/users/:id/password",
+} as const;
+
+type AuthRouteContext = {
+  body?: unknown;
+  guardContext: RequestGuardContext;
+  params?: Record<string, string | undefined>;
+  request: Request;
+};
+
+export function registerAuthSessionRoute(app: Pick<AuthRouteApp, "get">) {
+  app.get("/auth/session", (rawContext) => {
+    const context = rawContext as AuthRouteContext;
+    if (context.guardContext.actor.type === "anonymous") {
+      return json({ error: "UNAUTHORIZED" }, 401, {
+        "cache-control": "no-store",
+      });
+    }
+    return json({ actor: context.guardContext.actor }, 200, {
+      "cache-control": "no-store",
+    });
+  });
+
+  return app;
+}
+
+export function registerAuthRoutes(
+  app: AuthRouteApp,
+  authService: AuthService,
+  options: AuthRouteOptions = {},
+) {
+  const cookieName = options.sessionCookieName || "windy.sid";
+
+  registerLoginRoutes(app, authService, options);
+  registerOwnSessionRoutes(app, authService, options);
+
+  app.post("/auth/logout", async (rawContext) => {
+    const context = rawContext as AuthRouteContext;
+    const token = readRequestSessionToken(context.request, cookieName);
+    const revoked = await authService.logout(
+      token,
+      context.guardContext.actor,
+      requestMetadata(context),
+    );
+    return json(
+      revoked
+        ? { success: true }
+        : { error: "INVALID_SESSION", message: "会话无效或已经退出" },
+      revoked ? 200 : 401,
+      {
+        "set-cookie": expiredSessionCookie(
+          cookieName,
+          options.secureCookie ?? true,
+        ),
+        "cache-control": "no-store",
+      },
+    );
+  });
+
+  app.post("/auth/password/change", async (rawContext) => {
+    const context = rawContext as AuthRouteContext;
+    if (context.guardContext.actor.type !== "user") {
+      return json({ error: "UNAUTHORIZED" }, 401);
+    }
+    const body = readOwnPasswordBody(context.body);
+    const result = await authService.changeOwnPassword(
+      body.currentPassword,
+      body.newPassword,
+      context.guardContext.actor,
+      requestMetadata(context),
+    );
+    if (result.ok) {
+      return json(
+        {
+          success: true,
+          userId: result.userId,
+          revokedSessions: result.revokedSessions,
+          reauthenticationRequired: true,
+        },
+        200,
+        {
+          "set-cookie": expiredSessionCookie(
+            cookieName,
+            options.secureCookie ?? true,
+          ),
+          "cache-control": "no-store",
+        },
+      );
+    }
+    const statuses = {
+      USER_NOT_FOUND: 404,
+      INVALID_CURRENT_PASSWORD: 400,
+      INVALID_PASSWORD: 400,
+      PASSWORD_UNCHANGED: 400,
+    } as const;
+    const messages = {
+      USER_NOT_FOUND: "当前账号不存在",
+      INVALID_CURRENT_PASSWORD: "当前密码错误",
+      INVALID_PASSWORD: "新密码必须为 12-128 个字符",
+      PASSWORD_UNCHANGED: "新密码不能与当前密码相同",
+    } as const;
+    return json(
+      { error: result.code, message: messages[result.code] },
+      statuses[result.code],
+    );
+  });
+
+  app.post("/auth/sessions/:id/revoke", async (rawContext) => {
+    const context = rawContext as AuthRouteContext;
+    if (context.guardContext.actor.type === "anonymous") {
+      return json({ error: "UNAUTHORIZED" }, 401);
+    }
+    const sessionId = context.params?.id || "";
+    const result = await authService.revokeSession(
+      sessionId,
+      context.guardContext.actor,
+      requestMetadata(context),
+      readRequestSessionToken(context.request, cookieName),
+    );
+    if (result.ok) {
+      return json(
+        {
+          success: true,
+          sessionId: result.sessionId,
+          currentSessionRevoked: result.currentSessionRevoked,
+        },
+        200,
+        result.currentSessionRevoked
+          ? {
+              "set-cookie": expiredSessionCookie(
+                cookieName,
+                options.secureCookie ?? true,
+              ),
+              "cache-control": "no-store",
+            }
+          : { "cache-control": "no-store" },
+      );
+    }
+    return result.code === "FORBIDDEN"
+      ? json({ error: "FORBIDDEN" }, 403)
+      : json({ error: "SESSION_NOT_FOUND" }, 404);
+  });
+
+  app.post(passwordManagementRoute.registrationPath, async (rawContext) => {
+    const context = rawContext as AuthRouteContext;
+    if (context.guardContext.actor.type === "anonymous") {
+      return json({ error: "UNAUTHORIZED" }, 401);
+    }
+    const body = readPasswordBody(context.body);
+    const result = await authService.updatePassword(
+      context.params?.id || "",
+      body.password,
+      context.guardContext.actor,
+      requestMetadata(context),
+    );
+    if (result.ok) {
+      return json({ success: true, userId: result.userId });
+    }
+    const statuses = {
+      FORBIDDEN: 403,
+      USER_NOT_FOUND: 404,
+      INVALID_PASSWORD: 400,
+    } as const;
+    return json({ error: result.code }, statuses[result.code]);
+  });
+
+  return app;
+}
+
+function readPasswordBody(body: unknown): { password: string } {
+  const input =
+    body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  return {
+    password: typeof input.password === "string" ? input.password : "",
+  };
+}
+
+function readOwnPasswordBody(body: unknown): {
+  currentPassword: string;
+  newPassword: string;
+} {
+  const input =
+    body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  return {
+    currentPassword:
+      typeof input.currentPassword === "string" ? input.currentPassword : "",
+    newPassword: typeof input.newPassword === "string" ? input.newPassword : "",
+  };
+}
+
+function requestMetadata(context: AuthRouteContext): AuthRequestMetadata {
+  return {
+    ip: context.guardContext.clientIp,
+    userAgent: context.request.headers.get("user-agent") || undefined,
+    requestId: context.guardContext.requestId,
+  };
+}
+
+function expiredSessionCookie(name: string, secure: boolean): string {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Strict",
+    secure ? "Secure" : undefined,
+    "Max-Age=0",
+  ]
+    .filter(Boolean)
+    .join("; ");
+}
+
+function json(
+  body: unknown,
+  status = 200,
+  headers: Record<string, string> = {},
+): Response {
+  return Response.json(body, { status, headers });
+}

package/template/apps/server/src/auth/runtime.ts

@@ -0,0 +1,20 @@
+import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
+import { InMemoryAuthRepository, type AuthRepository } from "./repository.js";
+import { AuthService } from "./service.js";
+
+interface AuthRuntimeInput {
+  repository?: AuthRepository;
+  sessionTtlSeconds: number;
+  auditWriter: AuditEventWriter["write"];
+  auditReader?: AuditEventReader;
+}
+
+export function createAuthRuntime(input: AuthRuntimeInput) {
+  const authRepository = input.repository ?? new InMemoryAuthRepository();
+  const authService = new AuthService(authRepository, {
+    sessionTtlSeconds: input.sessionTtlSeconds,
+    auditWriter: { write: input.auditWriter },
+    auditReader: input.auditReader,
+  });
+  return { authRepository, authService };
+}

package/template/apps/server/src/auth/service.ts

@@ -0,0 +1,329 @@
+import { randomBytes } from "node:crypto";
+import { randomUUIDv7 } from "bun";
+import type { AuditEvent } from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
+import { hashSessionToken } from "./actor-resolver.js";
+import {
+  AuthenticationProviderRegistry,
+  LocalArgon2AuthenticationAdapter,
+} from "./authentication-provider.js";
+import { argon2PasswordHasher, type PasswordHasher } from "./password.js";
+import type { AuthRepository, AuthSessionRecord } from "./repository.js";
+import {
+  CredentialService,
+  type OwnPasswordChangeResult,
+  type PasswordUpdateResult,
+} from "./credential-service.js";
+import { OwnSessionService } from "./session-service.js";
+
+export interface AuthRequestMetadata {
+  ip?: string;
+  userAgent?: string;
+  requestId?: string;
+}
+
+export type LoginResult =
+  | {
+      ok: true;
+      token: string;
+      session: AuthSessionRecord;
+      user: {
+        id: string;
+        username: string;
+        displayName: string;
+        credentialState: "active" | "must-change-password";
+      };
+    }
+  | { ok: false; code: "INVALID_CREDENTIALS" };
+
+export type RevokeResult =
+  | { ok: true; sessionId: string; currentSessionRevoked: boolean }
+  | { ok: false; code: "SESSION_NOT_FOUND" | "FORBIDDEN" };
+
+export interface AuthServiceOptions {
+  sessionTtlSeconds?: number;
+  now?: () => Date;
+  tokenFactory?: () => string;
+  passwordHasher?: PasswordHasher;
+  authenticationProviders?: AuthenticationProviderRegistry;
+  auditWriter: AuditEventWriter;
+  auditReader?: AuditEventReader;
+}
+
+export class AuthService {
+  private readonly sessionTtlSeconds: number;
+  private readonly now: () => Date;
+  private readonly tokenFactory: () => string;
+  private readonly passwordHasher: PasswordHasher;
+  private readonly credentials: CredentialService;
+  private readonly ownSessions: OwnSessionService;
+  private readonly authenticationProviders: AuthenticationProviderRegistry;
+
+  constructor(
+    private readonly repository: AuthRepository,
+    private readonly options: AuthServiceOptions,
+  ) {
+    this.sessionTtlSeconds = options.sessionTtlSeconds || 60 * 60 * 8;
+    this.now = options.now || (() => new Date());
+    this.tokenFactory =
+      options.tokenFactory || (() => randomBytes(32).toString("base64url"));
+    this.passwordHasher = options.passwordHasher || argon2PasswordHasher;
+    this.authenticationProviders =
+      options.authenticationProviders ||
+      new AuthenticationProviderRegistry(
+        [new LocalArgon2AuthenticationAdapter(repository, this.passwordHasher)],
+        "local",
+      );
+    this.credentials = new CredentialService(
+      repository,
+      this.passwordHasher,
+      options.auditWriter,
+      this.now,
+    );
+    this.ownSessions = new OwnSessionService(
+      repository,
+      options.auditReader,
+      this.now,
+    );
+  }
+
+  async login(
+    username: string,
+    password: string,
+    metadata: AuthRequestMetadata = {},
+  ): Promise<LoginResult> {
+    const provider = this.authenticationProviders.defaultProvider();
+    const authentication = await provider.authenticate({
+      method: "password",
+      username,
+      password,
+    });
+    const candidate = authentication.user;
+    if (
+      authentication.status !== "authenticated" ||
+      candidate?.status !== "active"
+    ) {
+      const reason =
+        candidate && candidate.status !== "active"
+          ? "inactive-user"
+          : authentication.status === "challenge-required"
+            ? "challenge-required"
+            : authentication.status === "rejected"
+              ? authentication.reason
+              : "inactive-user";
+      await this.recordAuthEvent({
+        action: "auth.login",
+        outcome: "failure",
+        actor: candidate
+          ? { id: candidate.id, name: candidate.displayName }
+          : { id: "anonymous", name: "匿名访问" },
+        target: candidate
+          ? { type: "user", id: candidate.id }
+          : { type: "auth" },
+        metadata: {
+          provider: provider.key,
+          reason,
+        },
+        request: metadata,
+      });
+      return { ok: false, code: "INVALID_CREDENTIALS" };
+    }
+
+    const user = authentication.user;
+
+    const issuedAt = this.now();
+    const token = this.tokenFactory();
+    const session: AuthSessionRecord = {
+      id: randomUUIDv7(),
+      userId: user.id,
+      tokenHash: hashSessionToken(token),
+      status: "active",
+      issuedAt,
+      expiresAt: new Date(issuedAt.getTime() + this.sessionTtlSeconds * 1_000),
+      ip: metadata.ip,
+      userAgent: metadata.userAgent,
+    };
+    await this.repository.createSession(session);
+    await this.recordAuthEvent({
+      action: "auth.login",
+      outcome: "success",
+      actor: { id: user.id, name: user.displayName },
+      target: { type: "session", id: session.id },
+      metadata: { provider: provider.key },
+      request: metadata,
+    });
+    return {
+      ok: true,
+      token,
+      session,
+      user: {
+        id: user.id,
+        username: user.username,
+        displayName: user.displayName,
+        credentialState: user.credentialState,
+      },
+    };
+  }
+
+  async logout(
+    token: string | undefined,
+    actor: RequestActor,
+    metadata: AuthRequestMetadata = {},
+  ): Promise<boolean> {
+    const session = token
+      ? await this.repository.findSessionByTokenHash(hashSessionToken(token))
+      : undefined;
+    const revoked = session
+      ? await this.repository.revokeSession(session.id, this.now())
+      : false;
+    await this.recordAuthEvent({
+      action: "auth.logout",
+      outcome: revoked ? "success" : "failure",
+      actor: { id: actor.id, name: actor.name },
+      target: { type: "session", id: session?.id },
+      metadata: revoked ? undefined : { reason: "invalid-session" },
+      request: metadata,
+    });
+    return revoked;
+  }
+
+  async updatePassword(
+    userId: string,
+    password: string,
+    actor: RequestActor,
+    metadata: AuthRequestMetadata = {},
+  ): Promise<PasswordUpdateResult> {
+    return this.credentials.resetPassword(userId, password, actor, metadata);
+  }
+
+  changeOwnPassword(
+    currentPassword: string,
+    newPassword: string,
+    actor: RequestActor,
+    metadata: AuthRequestMetadata = {},
+  ): Promise<OwnPasswordChangeResult> {
+    return this.credentials.changeOwnPassword(
+      currentPassword,
+      newPassword,
+      actor,
+      metadata,
+    );
+  }
+
+  async revokeSession(
+    sessionId: string,
+    actor: RequestActor,
+    metadata: AuthRequestMetadata = {},
+    currentToken?: string,
+  ): Promise<RevokeResult> {
+    const session = await this.repository.findSessionById(sessionId);
+    if (!session) {
+      await this.recordRevokeFailure(
+        actor,
+        sessionId,
+        "session-not-found",
+        metadata,
+      );
+      return { ok: false, code: "SESSION_NOT_FOUND" };
+    }
+    const canManage = actor.permissionKeys.includes("system.user.manage");
+    if (actor.id !== session.userId && !canManage) {
+      await this.recordRevokeFailure(
+        actor,
+        sessionId,
+        "missing-permission",
+        metadata,
+      );
+      return { ok: false, code: "FORBIDDEN" };
+    }
+    const revoked = await this.repository.revokeSession(sessionId, this.now());
+    await this.recordAuthEvent({
+      action: "auth.session.revoke",
+      outcome: revoked ? "success" : "failure",
+      actor: { id: actor.id, name: actor.name },
+      target: { type: "session", id: sessionId },
+      metadata: revoked ? undefined : { reason: "inactive-session" },
+      request: metadata,
+    });
+    const currentSessionRevoked =
+      revoked &&
+      (await this.ownSessions.isCurrent(sessionId, actor, currentToken));
+    return revoked
+      ? { ok: true, sessionId, currentSessionRevoked }
+      : { ok: false, code: "SESSION_NOT_FOUND" };
+  }
+
+  listOwnSessions(actor: RequestActor, token: string | undefined) {
+    return this.ownSessions.list(actor, token);
+  }
+
+  listOwnLoginEvents(actor: RequestActor) {
+    return this.ownSessions.listLoginEvents(actor);
+  }
+
+  async revokeOwnSessions(
+    actor: RequestActor,
+    token: string | undefined,
+    includeCurrent: boolean,
+    metadata: AuthRequestMetadata = {},
+  ) {
+    const result = await this.ownSessions.revokeAll(
+      actor,
+      token,
+      includeCurrent,
+    );
+    await this.recordAuthEvent({
+      action: "auth.session.revoke",
+      outcome: "success",
+      actor: { id: actor.id, name: actor.name },
+      target: { type: "user", id: actor.id },
+      metadata: { scope: "all-own", includeCurrent, ...result },
+      request: metadata,
+    });
+    return result;
+  }
+
+  private recordRevokeFailure(
+    actor: RequestActor,
+    sessionId: string,
+    reason: string,
+    request: AuthRequestMetadata,
+  ): Promise<void> {
+    return this.recordAuthEvent({
+      action: "auth.session.revoke",
+      outcome: "denied",
+      actor: { id: actor.id, name: actor.name },
+      target: { type: "session", id: sessionId },
+      metadata: { reason },
+      request,
+    });
+  }
+
+  private recordAuthEvent(input: {
+    action: AuditEvent["action"];
+    outcome: AuditEvent["outcome"];
+    actor: { id: string; name: string };
+    target: AuditEvent["target"];
+    metadata?: Record<string, unknown>;
+    request: AuthRequestMetadata;
+  }): Promise<void> {
+    const event: AuditEvent = {
+      id: randomUUIDv7(),
+      action: input.action,
+      outcome: input.outcome,
+      actor: {
+        id: input.actor.id,
+        type: "user",
+        name: input.actor.name,
+        ip: input.request.ip,
+        userAgent: input.request.userAgent,
+      },
+      target: input.target,
+      requestId: input.request.requestId,
+      metadata: input.metadata,
+      occurredAt: this.now().toISOString(),
+    };
+    return Promise.resolve(this.options.auditWriter.write(event, "critical"));
+  }
+}

package/template/apps/server/src/auth/session-service.ts

@@ -0,0 +1,123 @@
+import type { AuditEventReader } from "../runtime.js";
+import type { RequestActor } from "../guards.js";
+import { hashSessionToken } from "./actor-resolver.js";
+import type { AuthRepository, AuthSessionRecord } from "./repository.js";
+
+export interface OwnSessionView {
+  id: string;
+  current: boolean;
+  ip?: string;
+  userAgent?: string;
+  issuedAt: string;
+  lastSeenAt?: string;
+  expiresAt: string;
+}
+
+export interface OwnLoginEventView {
+  id: string;
+  outcome: "attempted" | "success" | "failure" | "denied";
+  occurredAt: string;
+  ip?: string;
+  userAgent?: string;
+  reason?: string;
+}
+
+export interface RevokeOwnSessionsResult {
+  revokedSessions: number;
+  currentSessionRevoked: boolean;
+  currentSessionRetained: boolean;
+}
+
+export class OwnSessionService {
+  constructor(
+    private readonly repository: AuthRepository,
+    private readonly auditReader: AuditEventReader | undefined,
+    private readonly now: () => Date,
+  ) {}
+
+  async list(
+    actor: RequestActor,
+    token: string | undefined,
+  ): Promise<OwnSessionView[]> {
+    const current = await this.currentSession(actor, token);
+    const sessions = await this.repository.listUserSessions(
+      actor.id,
+      this.now(),
+    );
+    return sessions.map((session) => ({
+      id: session.id,
+      current: session.id === current?.id,
+      ip: session.ip,
+      userAgent: session.userAgent,
+      issuedAt: session.issuedAt.toISOString(),
+      lastSeenAt: session.lastSeenAt?.toISOString(),
+      expiresAt: session.expiresAt.toISOString(),
+    }));
+  }
+
+  async revokeAll(
+    actor: RequestActor,
+    token: string | undefined,
+    includeCurrent: boolean,
+  ): Promise<RevokeOwnSessionsResult> {
+    const current = await this.currentSession(actor, token);
+    const currentSessionRetained = Boolean(!includeCurrent && current);
+    const revokedSessions = await this.repository.revokeUserSessions(
+      actor.id,
+      this.now(),
+      currentSessionRetained ? current?.id : undefined,
+    );
+    return {
+      revokedSessions,
+      currentSessionRevoked: Boolean(includeCurrent && current),
+      currentSessionRetained,
+    };
+  }
+
+  async isCurrent(
+    sessionId: string,
+    actor: RequestActor,
+    token: string | undefined,
+  ): Promise<boolean> {
+    return (await this.currentSession(actor, token))?.id === sessionId;
+  }
+
+  async listLoginEvents(actor: RequestActor): Promise<{
+    items: OwnLoginEventView[];
+    total: number;
+  }> {
+    if (!this.auditReader) return { items: [], total: 0 };
+    const result = await this.auditReader.list({
+      page: 1,
+      pageSize: 20,
+      actorId: actor.id,
+      action: "auth.login",
+      includeScheduler: false,
+    });
+    return {
+      total: result.total,
+      items: result.items.map((event) => ({
+        id: event.id,
+        outcome: event.outcome,
+        occurredAt: event.occurredAt,
+        ip: event.actor.ip,
+        userAgent: event.actor.userAgent,
+        reason:
+          typeof event.metadata?.reason === "string"
+            ? event.metadata.reason
+            : undefined,
+      })),
+    };
+  }
+
+  private async currentSession(
+    actor: RequestActor,
+    token: string | undefined,
+  ): Promise<AuthSessionRecord | undefined> {
+    if (!token) return undefined;
+    const session = await this.repository.findSessionByTokenHash(
+      hashSessionToken(token),
+    );
+    return session?.userId === actor.id ? session : undefined;
+  }
+}