create-windy 0.1.0

package/template/apps/server/src/auth/credential-routes.test.ts

@@ -0,0 +1,190 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { Elysia } from "elysia";
+import { restrictedRequestResponse } from "../request-restriction.js";
+import { createServerRuntime } from "../runtime.js";
+import { RepositoryActorResolver } from "./actor-resolver.js";
+import { argon2PasswordHasher } from "./password.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
+import { AuthService } from "./service.js";
+
+const initialPassword = "test-only-password";
+let passwordHash = "";
+
+beforeAll(async () => {
+  passwordHash = await argon2PasswordHasher.hash(initialPassword);
+});
+
+describe("credential lifecycle", () => {
+  test("管理员重置后强制改密，自助改密吊销包括当前会话在内的全部会话", async () => {
+    const fixture = createFixture();
+    const admin = await login(fixture.app, "admin", initialPassword);
+    const oldOperator = await login(fixture.app, "operator", initialPassword);
+    const reset = await fixture.app.handle(
+      authenticatedRequest(
+        "/api/auth/users/user_operator/password",
+        admin.token,
+        { password: "Operator-Initial-2026" },
+      ),
+    );
+    expect(reset.status).toBe(200);
+    await expect(
+      fixture.repository.findUserByReference("user_operator"),
+    ).resolves.toMatchObject({
+      credentialState: "must-change-password",
+      passwordChangedAt: undefined,
+    });
+    expect(
+      (
+        await fixture.runtime.createGuardContext(
+          bearerRequest("/api/foundation", oldOperator.token),
+        )
+      ).actor.type,
+    ).toBe("anonymous");
+
+    const firstLogin = await login(
+      fixture.app,
+      "operator",
+      "Operator-Initial-2026",
+    );
+    const secondLogin = await login(
+      fixture.app,
+      "operator",
+      "Operator-Initial-2026",
+    );
+    expect(firstLogin.user.credentialState).toBe("must-change-password");
+
+    const blocked = await fixture.app.handle(
+      bearerRequest("/api/protected", firstLogin.token),
+    );
+    expect(blocked.status).toBe(403);
+    await expect(blocked.json()).resolves.toMatchObject({
+      error: "PASSWORD_CHANGE_REQUIRED",
+    });
+    const session = await fixture.app.handle(
+      bearerRequest("/api/auth/session", firstLogin.token),
+    );
+    expect(session.status).toBe(200);
+
+    const wrongCurrent = await fixture.app.handle(
+      authenticatedRequest("/api/auth/password/change", firstLogin.token, {
+        currentPassword: "Wrong-Current-Password",
+        newPassword: "Operator-Final-2026",
+      }),
+    );
+    expect(wrongCurrent.status).toBe(400);
+    await expect(wrongCurrent.json()).resolves.toMatchObject({
+      error: "INVALID_CURRENT_PASSWORD",
+    });
+
+    const changed = await fixture.app.handle(
+      authenticatedRequest("/api/auth/password/change", firstLogin.token, {
+        currentPassword: "Operator-Initial-2026",
+        newPassword: "Operator-Final-2026",
+      }),
+    );
+    expect(changed.status).toBe(200);
+    expect(changed.headers.get("set-cookie")).toContain("Max-Age=0");
+    await expect(changed.json()).resolves.toMatchObject({
+      revokedSessions: 2,
+      reauthenticationRequired: true,
+    });
+    const updated =
+      await fixture.repository.findUserByReference("user_operator");
+    expect(updated?.credentialState).toBe("active");
+    expect(updated?.passwordChangedAt).toBeInstanceOf(Date);
+
+    for (const token of [firstLogin.token, secondLogin.token]) {
+      const expired = await fixture.app.handle(
+        bearerRequest("/api/auth/session", token),
+      );
+      expect(expired.status).toBe(401);
+    }
+    const finalLogin = await login(
+      fixture.app,
+      "operator",
+      "Operator-Final-2026",
+    );
+    expect(finalLogin.user.credentialState).toBe("active");
+    const allowed = await fixture.app.handle(
+      bearerRequest("/api/protected", finalLogin.token),
+    );
+    expect(allowed.status).toBe(200);
+  });
+});
+
+function createFixture() {
+  const repository = new InMemoryAuthRepository([
+    user("admin", true),
+    user("operator"),
+  ]);
+  const resolver = new RepositoryActorResolver(repository);
+  const runtime = createServerRuntime({}, { actorResolver: resolver });
+  const service = new AuthService(repository, {
+    auditWriter: { write: () => undefined },
+  });
+  const app = new Elysia({ prefix: "/api" })
+    .derive(async ({ request }) => ({
+      guardContext: await runtime.createGuardContext(request),
+    }))
+    .onBeforeHandle(({ request, guardContext }) =>
+      restrictedRequestResponse(runtime, guardContext, request),
+    )
+    .get("/protected", () => ({ success: true }));
+  registerAuthSessionRoute(app);
+  registerAuthRoutes(app, service, { secureCookie: false });
+  return { app, repository, runtime };
+}
+
+function user(username: string, administrator = false): AuthUserRecord {
+  return {
+    id: `user_${username}`,
+    username,
+    displayName: username === "admin" ? "管理员" : "操作员",
+    passwordHash,
+    credentialState: "active",
+    status: "active",
+    roleCodes: administrator ? ["developer"] : ["operator"],
+    permissionKeys: administrator ? ["system.user.manage"] : [],
+  };
+}
+
+async function login(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+  password: string,
+) {
+  const response = await app.handle(
+    jsonRequest("/api/auth/api/login", { username, password }),
+  );
+  expect(response.status).toBe(200);
+  return (await response.json()) as {
+    token: string;
+    user: { credentialState: "active" | "must-change-password" };
+  };
+}
+
+function authenticatedRequest(path: string, token: string, body: unknown) {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+function jsonRequest(path: string, body: unknown) {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+function bearerRequest(path: string, token: string) {
+  return new Request(`http://localhost${path}`, {
+    headers: { authorization: `Bearer ${token}` },
+  });
+}

package/template/apps/server/src/auth/credential-service.ts

@@ -0,0 +1,165 @@
+import { randomUUIDv7 } from "bun";
+import type { AuditEvent } from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { AuditEventWriter } from "../runtime.js";
+import type { PasswordHasher } from "./password.js";
+import type { AuthRepository } from "./repository.js";
+import type { AuthRequestMetadata } from "./service.js";
+
+export type PasswordUpdateResult =
+  | { ok: true; userId: string }
+  | {
+      ok: false;
+      code: "USER_NOT_FOUND" | "INVALID_PASSWORD" | "FORBIDDEN";
+    };
+
+export type OwnPasswordChangeResult =
+  | { ok: true; userId: string; revokedSessions: number }
+  | {
+      ok: false;
+      code:
+        | "USER_NOT_FOUND"
+        | "INVALID_CURRENT_PASSWORD"
+        | "INVALID_PASSWORD"
+        | "PASSWORD_UNCHANGED";
+    };
+
+export class CredentialService {
+  constructor(
+    private readonly repository: AuthRepository,
+    private readonly passwordHasher: PasswordHasher,
+    private readonly auditWriter: AuditEventWriter,
+    private readonly now: () => Date,
+  ) {}
+
+  async resetPassword(
+    userId: string,
+    password: string,
+    actor: RequestActor,
+    request: AuthRequestMetadata,
+  ): Promise<PasswordUpdateResult> {
+    if (!actor.permissionKeys.includes("system.user.manage")) {
+      await this.record(actor, userId, "denied", "missing-permission", request);
+      return { ok: false, code: "FORBIDDEN" };
+    }
+    const user = await this.repository.findUserByReference(userId);
+    if (!user) {
+      await this.record(actor, userId, "failure", "user-not-found", request);
+      return { ok: false, code: "USER_NOT_FOUND" };
+    }
+    const passwordHash = await this.hashPassword(password);
+    if (!passwordHash) {
+      await this.record(actor, userId, "failure", "invalid-password", request);
+      return { ok: false, code: "INVALID_PASSWORD" };
+    }
+    const changedAt = this.now();
+    await this.repository.updateUserPassword(
+      user.id,
+      { passwordHash, credentialState: "must-change-password" },
+      changedAt,
+      actor.id,
+    );
+    await this.repository.revokeUserSessions(user.id, changedAt);
+    await this.record(
+      actor,
+      user.id,
+      "success",
+      "administrator-reset",
+      request,
+    );
+    return { ok: true, userId: user.id };
+  }
+
+  async changeOwnPassword(
+    currentPassword: string,
+    newPassword: string,
+    actor: RequestActor,
+    request: AuthRequestMetadata,
+  ): Promise<OwnPasswordChangeResult> {
+    const user = await this.repository.findUserByReference(actor.id);
+    if (!user?.passwordHash) {
+      await this.record(actor, actor.id, "failure", "user-not-found", request);
+      return { ok: false, code: "USER_NOT_FOUND" };
+    }
+    const currentValid = await this.passwordHasher.verify(
+      user.passwordHash,
+      currentPassword,
+    );
+    if (!currentValid) {
+      await this.record(
+        actor,
+        user.id,
+        "failure",
+        "invalid-current-password",
+        request,
+      );
+      return { ok: false, code: "INVALID_CURRENT_PASSWORD" };
+    }
+    if (await this.passwordHasher.verify(user.passwordHash, newPassword)) {
+      await this.record(
+        actor,
+        user.id,
+        "failure",
+        "password-unchanged",
+        request,
+      );
+      return { ok: false, code: "PASSWORD_UNCHANGED" };
+    }
+    const passwordHash = await this.hashPassword(newPassword);
+    if (!passwordHash) {
+      await this.record(actor, user.id, "failure", "invalid-password", request);
+      return { ok: false, code: "INVALID_PASSWORD" };
+    }
+    const changedAt = this.now();
+    await this.repository.updateUserPassword(
+      user.id,
+      { passwordHash, credentialState: "active", passwordChangedAt: changedAt },
+      changedAt,
+      actor.id,
+    );
+    const revokedSessions = await this.repository.revokeUserSessions(
+      user.id,
+      changedAt,
+    );
+    await this.record(actor, user.id, "success", "self-service", request);
+    return { ok: true, userId: user.id, revokedSessions };
+  }
+
+  private async hashPassword(password: string): Promise<string | undefined> {
+    try {
+      return await this.passwordHasher.hash(password);
+    } catch {
+      return undefined;
+    }
+  }
+
+  private record(
+    actor: RequestActor,
+    userId: string,
+    outcome: AuditEvent["outcome"],
+    reason: string,
+    request: AuthRequestMetadata,
+  ): Promise<void> {
+    return Promise.resolve(
+      this.auditWriter.write(
+        {
+          id: randomUUIDv7(),
+          action: "auth.password.update",
+          outcome,
+          actor: {
+            id: actor.id,
+            type: actor.type === "service" ? "service" : "user",
+            name: actor.name,
+            ip: request.ip,
+            userAgent: request.userAgent,
+          },
+          target: { type: "user", id: userId },
+          requestId: request.requestId,
+          metadata: { reason },
+          occurredAt: this.now().toISOString(),
+        },
+        "critical",
+      ),
+    );
+  }
+}

package/template/apps/server/src/auth/development-bypass.ts

@@ -0,0 +1,22 @@
+export interface DevelopmentAuthBypass {
+  enabled: boolean;
+  token?: string;
+  allowDirectUserTokens: boolean;
+}
+
+export function readDevelopmentAuthBypass(
+  env: Record<string, string | undefined>,
+): DevelopmentAuthBypass {
+  const production = env.NODE_ENV?.toLowerCase() === "production";
+  const explicitlyEnabled = env.WINDY_DEV_AUTH_BYPASS === "1";
+  const configuredToken = env.WINDY_DEV_ADMIN_TOKEN?.trim();
+  const enabled =
+    !production && (explicitlyEnabled || Boolean(configuredToken));
+  return {
+    enabled,
+    token: enabled
+      ? configuredToken || (explicitlyEnabled ? "dev-admin-token" : undefined)
+      : undefined,
+    allowDirectUserTokens: enabled && explicitlyEnabled,
+  };
+}

package/template/apps/server/src/auth/drizzle-repository.ts

@@ -0,0 +1,315 @@
+import {
+  rolePermissions,
+  roles,
+  serverSessions,
+  userRoles,
+  users,
+} from "@windy/database";
+import { and, eq, gt, inArray, isNull, or } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RequestActor } from "../guards.js";
+import type { UserProfileUpdate } from "@windy/shared";
+import type {
+  AuthRepository,
+  AuthSessionRecord,
+  ActiveAuthSession,
+  AuthUserRecord,
+  PasswordCredentialUpdate,
+} from "./repository.js";
+import { buildActorScopeContexts } from "../data-access/context.js";
+import type { DataAccessRolePolicy } from "../data-access/context.js";
+import {
+  buildAuthorizationSnapshot,
+  selectAuthorizationRoleIds,
+} from "./authorization-snapshot.js";
+import {
+  listActiveSessions as listActiveSessionRows,
+  listUserSessions as listUserSessionRows,
+  revokeSession as revokeSessionRow,
+  revokeUserSessions as revokeUserSessionRows,
+} from "./drizzle-session-operations.js";
+
+export class DrizzleAuthRepository implements AuthRepository {
+  constructor(private readonly db: NodePgDatabase) {}
+
+  async findUserByUsername(
+    username: string,
+  ): Promise<AuthUserRecord | undefined> {
+    const [user] = await this.db
+      .select()
+      .from(users)
+      .where(eq(users.username, username))
+      .limit(1);
+    if (!user) {
+      return undefined;
+    }
+    const authorization = await this.readUserAuthorization(
+      user.id,
+      user.roleIds,
+    );
+    return {
+      id: user.id,
+      username: user.username,
+      displayName: user.displayName,
+      email: user.email || undefined,
+      phone: user.phone || undefined,
+      passwordHash: user.passwordHash || undefined,
+      credentialState: user.credentialState,
+      passwordChangedAt: user.passwordChangedAt || undefined,
+      status: user.status,
+      departmentId: user.departmentId || undefined,
+      ...authorization,
+    };
+  }
+
+  async findUserByReference(
+    reference: string,
+  ): Promise<AuthUserRecord | undefined> {
+    const [user] = await this.db
+      .select()
+      .from(users)
+      .where(or(eq(users.id, reference), eq(users.username, reference)))
+      .limit(1);
+    if (!user) {
+      return undefined;
+    }
+    const authorization = await this.readUserAuthorization(
+      user.id,
+      user.roleIds,
+    );
+    return {
+      id: user.id,
+      username: user.username,
+      displayName: user.displayName,
+      email: user.email || undefined,
+      phone: user.phone || undefined,
+      passwordHash: user.passwordHash || undefined,
+      credentialState: user.credentialState,
+      passwordChangedAt: user.passwordChangedAt || undefined,
+      status: user.status,
+      departmentId: user.departmentId || undefined,
+      ...authorization,
+    };
+  }
+
+  async createSession(session: AuthSessionRecord): Promise<void> {
+    await this.db.insert(serverSessions).values({
+      id: session.id,
+      userId: session.userId,
+      tokenHash: session.tokenHash,
+      status: session.status,
+      issuedAt: session.issuedAt,
+      expiresAt: session.expiresAt,
+      revokedAt: session.revokedAt,
+      lastSeenAt: session.lastSeenAt,
+      ip: session.ip,
+      userAgent: session.userAgent,
+    });
+  }
+
+  async findSessionById(id: string): Promise<AuthSessionRecord | undefined> {
+    const [session] = await this.db
+      .select()
+      .from(serverSessions)
+      .where(eq(serverSessions.id, id))
+      .limit(1);
+    return session ? toSessionRecord(session) : undefined;
+  }
+
+  async findSessionByTokenHash(
+    tokenHash: string,
+  ): Promise<AuthSessionRecord | undefined> {
+    const [session] = await this.db
+      .select()
+      .from(serverSessions)
+      .where(eq(serverSessions.tokenHash, tokenHash))
+      .limit(1);
+    return session ? toSessionRecord(session) : undefined;
+  }
+
+  async resolveSessionActor(
+    tokenHash: string,
+    now: Date,
+  ): Promise<RequestActor | undefined> {
+    const [row] = await this.db
+      .select({ session: serverSessions, user: users })
+      .from(serverSessions)
+      .innerJoin(users, eq(users.id, serverSessions.userId))
+      .where(
+        and(
+          eq(serverSessions.tokenHash, tokenHash),
+          eq(serverSessions.status, "active"),
+          isNull(serverSessions.revokedAt),
+          gt(serverSessions.expiresAt, now),
+          eq(users.status, "active"),
+        ),
+      )
+      .limit(1);
+    if (!row) {
+      return undefined;
+    }
+    await this.db
+      .update(serverSessions)
+      .set({ lastSeenAt: now })
+      .where(eq(serverSessions.id, row.session.id));
+    const authorization = await this.readUserAuthorization(
+      row.user.id,
+      row.user.roleIds,
+    );
+    return {
+      id: row.user.id,
+      type: "user",
+      name: row.user.displayName,
+      username: row.user.username,
+      displayName: row.user.displayName,
+      email: row.user.email || undefined,
+      phone: row.user.phone || undefined,
+      credentialState: row.user.credentialState,
+      passwordChangedAt: row.user.passwordChangedAt?.toISOString(),
+      ...authorization,
+      ...buildActorScopeContexts(
+        row.user.id,
+        row.user.departmentId || undefined,
+        authorization.dataAccessRoles,
+      ),
+    };
+  }
+
+  async updateUserPassword(
+    userId: string,
+    update: PasswordCredentialUpdate,
+    updatedAt: Date,
+    updatedBy: string,
+  ): Promise<boolean> {
+    const rows = await this.db
+      .update(users)
+      .set({
+        passwordHash: update.passwordHash,
+        credentialState: update.credentialState,
+        passwordChangedAt: update.passwordChangedAt || null,
+        updatedAt,
+        updatedBy,
+      })
+      .where(eq(users.id, userId))
+      .returning({ id: users.id });
+    return rows.length > 0;
+  }
+
+  async updateUserProfile(
+    userId: string,
+    input: UserProfileUpdate,
+    updatedAt: Date,
+    updatedBy: string,
+  ): Promise<AuthUserRecord | undefined> {
+    const rows = await this.db
+      .update(users)
+      .set({
+        displayName: input.displayName,
+        email: input.email || null,
+        phone: input.phone || null,
+        updatedAt,
+        updatedBy,
+      })
+      .where(eq(users.id, userId))
+      .returning({ id: users.id });
+    return rows.length > 0 ? this.findUserByReference(userId) : undefined;
+  }
+
+  async listActiveSessions(
+    now: Date,
+    activeSince: Date,
+  ): Promise<ActiveAuthSession[]> {
+    return listActiveSessionRows(this.db, now, activeSince);
+  }
+
+  async listUserSessions(
+    userId: string,
+    now: Date,
+  ): Promise<AuthSessionRecord[]> {
+    return listUserSessionRows(this.db, userId, now);
+  }
+
+  async revokeSession(id: string, revokedAt: Date): Promise<boolean> {
+    return revokeSessionRow(this.db, id, revokedAt);
+  }
+
+  async revokeUserSessions(
+    userId: string,
+    revokedAt: Date,
+    excludedSessionId?: string,
+  ): Promise<number> {
+    return revokeUserSessionRows(this.db, userId, revokedAt, excludedSessionId);
+  }
+
+  private async readUserAuthorization(
+    userId: string,
+    jsonRoleIds: unknown,
+  ): Promise<{
+    roleCodes: string[];
+    permissionKeys: string[];
+    dataAccessRoles: DataAccessRolePolicy[];
+  }> {
+    const relationRows = await this.db
+      .select()
+      .from(userRoles)
+      .where(eq(userRoles.userId, userId));
+    const roleIds = selectAuthorizationRoleIds(
+      jsonRoleIds,
+      relationRows.map(({ roleId }) => roleId),
+    );
+    if (roleIds.length === 0) {
+      return { roleCodes: [], permissionKeys: [], dataAccessRoles: [] };
+    }
+    const roleRows = await this.db
+      .select()
+      .from(roles)
+      .where(inArray(roles.id, roleIds));
+    const activeRoles = roleRows.filter((role) => role.status === "active");
+    const compatibilityPermissionRoleIds = activeRoles
+      .filter((role) => !Array.isArray(role.permissionKeys))
+      .map((role) => role.id);
+    const permissionRows =
+      compatibilityPermissionRoleIds.length === 0
+        ? []
+        : await this.db
+            .select()
+            .from(rolePermissions)
+            .where(
+              inArray(rolePermissions.roleId, compatibilityPermissionRoleIds),
+            );
+    return buildAuthorizationSnapshot(
+      activeRoles.map((role) => ({
+        id: role.id,
+        code: role.code,
+        status: role.status,
+        dataScope: role.dataScope as DataAccessRolePolicy["dataScope"],
+        departmentIds: readStringArray(role.departmentIds),
+        permissionKeys: role.permissionKeys,
+      })),
+      permissionRows,
+    );
+  }
+}
+
+function toSessionRecord(
+  row: typeof serverSessions.$inferSelect,
+): AuthSessionRecord {
+  return {
+    id: row.id,
+    userId: row.userId,
+    tokenHash: row.tokenHash,
+    status: row.status,
+    issuedAt: row.issuedAt,
+    expiresAt: row.expiresAt,
+    revokedAt: row.revokedAt || undefined,
+    lastSeenAt: row.lastSeenAt || undefined,
+    ip: row.ip || undefined,
+    userAgent: row.userAgent || undefined,
+  };
+}
+
+function readStringArray(value: unknown): string[] {
+  return Array.isArray(value)
+    ? value.filter((item): item is string => typeof item === "string")
+    : [];
+}