exp-node-server 1.1.7 → 2.0.0

package/templates/prisma/src/app/passport-js/index.ts

@@ -0,0 +1,87 @@
+import type { Express, NextFunction, Request, Response } from 'express';
+import { Router } from 'express';
+import passport from 'passport';
+import { configs } from '../configs/index.js';
+import { logger } from '../lib/logger.js';
+import { rateLimiters } from '../middlewares/rate_limiter.js';
+import manageResponse from '../utils/manage_response.js';
+import { getReturnTo } from './oauth-state.js';
+import { enabledSocialProviders, type SocialProvider } from './providers.js';
+import { createSocialLoginCode, SocialLoginError } from './social-account.js';
+
+for (const provider of enabledSocialProviders) {
+  passport.use(provider.name, provider.createStrategy());
+}
+
+/** Mounts passport on the app. Logins are stateless, no session is needed. */
+export const setupPassport = (app: Express) => {
+  app.use(passport.initialize());
+};
+
+/** Sends the browser back to the front-end with `?code=` or `?error=`. */
+const redirectToFrontEnd = (res: Response, params: Record<string, string | undefined>) => {
+  const url = new URL(configs.social.redirect_url);
+  for (const [key, value] of Object.entries(params)) {
+    if (value) url.searchParams.set(key, value);
+  }
+  res.redirect(url.toString());
+};
+
+/** Maps a failed handshake to a short error code the front-end can show. */
+const errorCode = (req: Request, err: unknown, info: unknown): string => {
+  if (err instanceof SocialLoginError) return err.code;
+  if (req.query.error === 'access_denied' || req.query.denied) return 'access_denied';
+  const message = err instanceof Error ? err.message : (info as { message?: string })?.message;
+  if (message === 'invalid_state') return 'invalid_state';
+  if (err) logger.error({ err }, 'Social login failed');
+  return 'social_login_failed';
+};
+
+const callback =
+  ({ name }: SocialProvider) =>
+  (req: Request, res: Response, next: NextFunction) => {
+    passport.authenticate(
+      name,
+      { session: false },
+      async (err: unknown, user: Express.User | false, info: unknown) => {
+        const returnTo = getReturnTo(res);
+        if (err || !user) {
+          return redirectToFrontEnd(res, { error: errorCode(req, err, info), returnTo });
+        }
+        try {
+          const code = await createSocialLoginCode(user.accountId);
+          redirectToFrontEnd(res, { code, returnTo });
+        } catch (e) {
+          next(e);
+        }
+      },
+    )(req, res, next);
+  };
+
+/**
+ * `GET /providers` lists the enabled providers (for rendering login buttons),
+ * `GET /<provider>?returnTo=/path` starts a login, `GET /<provider>/callback` finishes it.
+ */
+export const socialAuthRouter = Router();
+
+socialAuthRouter.get('/providers', (_req, res) => {
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Social login providers fetched successfully',
+    data: enabledSocialProviders.map(({ name, label }) => ({
+      name,
+      label,
+      url: `/api/auth/social/${name}`,
+    })),
+  });
+});
+
+for (const provider of enabledSocialProviders) {
+  socialAuthRouter.get(
+    `/${provider.name}`,
+    rateLimiters.social,
+    passport.authenticate(provider.name, { session: false }),
+  );
+  socialAuthRouter.get(`/${provider.name}/callback`, callback(provider));
+}

package/templates/prisma/src/app/passport-js/oauth-state.ts

@@ -0,0 +1,150 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  hkdfSync,
+  randomBytes,
+  timingSafeEqual,
+} from 'node:crypto';
+import type { CookieOptions, Request, Response } from 'express';
+import { configs } from '../configs/index.js';
+
+/**
+ * Stateless OAuth handshake storage. Instead of a server-side session, the data a
+ * provider round trip needs (CSRF state, PKCE verifier, OAuth 1.0a request token)
+ * lives in a short-lived, encrypted, httpOnly cookie scoped to the social routes.
+ * Works across instances and restarts, and nothing accumulates in memory.
+ */
+
+const STATE_TTL_MS = 10 * 60 * 1000;
+
+// separate key for this purpose, derived from the access token secret
+const key = Buffer.from(hkdfSync('sha256', configs.jwt.access_token, '', 'oauth-state-cookie', 32));
+
+const cookieOptions: CookieOptions = {
+  httpOnly: true,
+  secure: configs.is_production,
+  // the provider sends the user back with a top-level GET, which `lax` allows
+  sameSite: 'lax',
+  path: '/api/auth/social',
+};
+
+const cookieName = (provider: string) => `oauth_${provider}`;
+
+const seal = (data: object): string => {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const body = JSON.stringify({ ...data, exp: Date.now() + STATE_TTL_MS });
+  const encrypted = Buffer.concat([cipher.update(body, 'utf8'), cipher.final()]);
+  return Buffer.concat([iv, cipher.getAuthTag(), encrypted]).toString('base64url');
+};
+
+const unseal = <T>(value: unknown): T | undefined => {
+  if (typeof value !== 'string') return undefined;
+  try {
+    const raw = Buffer.from(value, 'base64url');
+    const decipher = createDecipheriv('aes-256-gcm', key, raw.subarray(0, 12));
+    decipher.setAuthTag(raw.subarray(12, 28));
+    const body = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);
+    const data = JSON.parse(body.toString('utf8'));
+    return data.exp > Date.now() ? data : undefined;
+  } catch {
+    return undefined; // tampered, wrong key or malformed
+  }
+};
+
+const res = (req: Request): Response => req.res!;
+
+/** Reads and clears the handshake cookie, so it can only be used once. */
+const take = <T>(req: Request, provider: string): T | undefined => {
+  res(req).clearCookie(cookieName(provider), cookieOptions);
+  return unseal<T>(req.cookies?.[cookieName(provider)]);
+};
+
+const put = (req: Request, provider: string, data: object) => {
+  res(req).cookie(cookieName(provider), seal(data), { ...cookieOptions, maxAge: STATE_TTL_MS });
+};
+
+const safeEqual = (a: string, b: string) => {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+};
+
+/**
+ * `?returnTo=` lets the front-end resume where the user was. Only same-site paths
+ * are kept (no `//host` or `\` tricks), so it can't become an open redirect.
+ */
+const readReturnTo = (req: Request): string | undefined => {
+  const value = req.query.returnTo;
+  if (typeof value !== 'string' || value.length > 512) return undefined;
+  return /^\/(?![/\\])[^\\]*$/.test(value) ? value : undefined;
+};
+
+/** The `returnTo` saved when the login started, available in the callback. */
+export const getReturnTo = (res: Response): string | undefined => res.locals.oauthReturnTo;
+
+type OAuth2State = { handle: string; verifier?: string; returnTo?: string };
+
+/** passport-oauth2 state store: `state` parameter (CSRF) + PKCE verifier. */
+export class CookieStateStore {
+  constructor(private readonly provider: string) {}
+
+  store(
+    req: Request,
+    verifier: string | undefined,
+    _state: unknown,
+    _meta: unknown,
+    callback: (err: Error | null, handle?: string) => void,
+  ) {
+    const handle = randomBytes(24).toString('base64url');
+    put(req, this.provider, {
+      handle,
+      verifier,
+      returnTo: readReturnTo(req),
+    } satisfies OAuth2State);
+    callback(null, handle);
+  }
+
+  verify(
+    req: Request,
+    providedState: unknown,
+    callback: (err: Error | null, ok: string | boolean, info?: { message: string }) => void,
+  ) {
+    const saved = take<OAuth2State>(req, this.provider);
+    if (!saved || typeof providedState !== 'string' || !safeEqual(saved.handle, providedState)) {
+      return callback(null, false, { message: 'invalid_state' });
+    }
+    res(req).locals.oauthReturnTo = saved.returnTo;
+    // a string tells passport-oauth2 to send it as the PKCE `code_verifier`
+    callback(null, saved.verifier ?? true);
+  }
+}
+
+type OAuth1State = { token: string; tokenSecret: string; returnTo?: string };
+
+/** passport-oauth1 request token store (Twitter / X). */
+export class CookieRequestTokenStore {
+  constructor(private readonly provider: string) {}
+
+  get(req: Request, token: string, callback: (err: Error | null, tokenSecret?: string) => void) {
+    const saved = take<OAuth1State>(req, this.provider);
+    if (!saved || typeof token !== 'string' || !safeEqual(saved.token, token)) {
+      return callback(new Error('invalid_state'));
+    }
+    res(req).locals.oauthReturnTo = saved.returnTo;
+    callback(null, saved.tokenSecret);
+  }
+
+  set(req: Request, token: string, tokenSecret: string, callback: (err?: Error) => void) {
+    put(req, this.provider, {
+      token,
+      tokenSecret,
+      returnTo: readReturnTo(req),
+    } satisfies OAuth1State);
+    callback();
+  }
+
+  destroy(_req: Request, _token: string, callback: (err?: Error) => void) {
+    callback(); // already cleared by get()
+  }
+}

package/templates/prisma/src/app/passport-js/providers.ts

@@ -0,0 +1,263 @@
+import type { PROVIDER } from '@prisma/client';
+import type { Profile, Strategy } from 'passport';
+import { Strategy as FacebookStrategy } from 'passport-facebook';
+import { Strategy as GithubStrategy } from 'passport-github';
+import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
+import OAuth1Strategy, { InternalOAuthError as OAuth1Error } from 'passport-oauth1';
+import OAuth2Strategy, { InternalOAuthError } from 'passport-oauth2';
+import { configs } from '../configs/index.js';
+import { CookieRequestTokenStore, CookieStateStore } from './oauth-state.js';
+import { findOrCreateSocialAccount } from './social-account.js';
+
+type Done = (err: unknown, user?: Express.User | false) => void;
+
+export type SocialProviderName =
+  | 'google'
+  | 'facebook'
+  | 'github'
+  | 'twitter'
+  | 'linkedin'
+  | 'discord';
+
+export interface SocialProvider {
+  /** Passport strategy name, also used in the route: `/api/auth/social/<name>`. */
+  name: SocialProviderName;
+  /** Human readable name, e.g. for login buttons. */
+  label: string;
+  provider: PROVIDER;
+  enabled: boolean;
+  createStrategy: () => Strategy;
+}
+
+/** Shared verify callback: map the provider profile to one of our accounts. */
+const verify =
+  (provider: PROVIDER) =>
+  (_token: string, _tokenSecret: string, profile: Profile, done: Done): void => {
+    findOrCreateSocialAccount(profile, provider).then(
+      (user) => done(null, user),
+      (err) => done(err),
+    );
+  };
+
+/**
+ * Minimal OAuth 2.0 strategy for providers without a maintained passport package:
+ * fetches `profileURL` with the access token and maps the JSON to a passport profile.
+ */
+class JsonProfileStrategy extends OAuth2Strategy {
+  constructor(
+    name: string,
+    options: OAuth2Strategy.StrategyOptions,
+    private readonly profileURL: string,
+    private readonly toProfile: (json: Record<string, unknown>) => Profile,
+  ) {
+    super(options, verify(name.toUpperCase() as PROVIDER));
+    this.name = name;
+    this._oauth2.useAuthorizationHeaderforGET(true);
+  }
+
+  override userProfile(accessToken: string, done: (err?: unknown, profile?: Profile) => void) {
+    this._oauth2.get(this.profileURL, accessToken, (err, body) => {
+      if (err) return done(new InternalOAuthError('Failed to fetch user profile', err));
+      try {
+        done(null, this.toProfile(JSON.parse(String(body))));
+      } catch (e) {
+        done(e);
+      }
+    });
+  }
+}
+
+/**
+ * X (Twitter) login over OAuth 1.0a, which is what returns the user's email. Built on
+ * passport-oauth1 directly: the old passport-twitter package is unmaintained and
+ * pulls in a vulnerable XML parser.
+ */
+class TwitterStrategy extends OAuth1Strategy {
+  constructor(options: { consumerKey: string; consumerSecret: string; callbackURL: string }) {
+    super(
+      {
+        ...options,
+        requestTokenURL: 'https://api.twitter.com/oauth/request_token',
+        accessTokenURL: 'https://api.twitter.com/oauth/access_token',
+        userAuthorizationURL: 'https://api.twitter.com/oauth/authenticate',
+        // the request token lives in an encrypted cookie instead of a session
+        requestTokenStore: new CookieRequestTokenStore('twitter'),
+      },
+      verify('TWITTER'),
+    );
+    this.name = 'twitter';
+  }
+
+  override userProfile(
+    token: string,
+    tokenSecret: string,
+    _params: unknown,
+    done: (err?: unknown, profile?: Profile) => void,
+  ) {
+    const url =
+      'https://api.twitter.com/1.1/account/verify_credentials.json?include_email=true&skip_status=true';
+    this._oauth.get(url, token, tokenSecret, (err, body) => {
+      if (err) return done(new OAuth1Error('Failed to fetch user profile', err));
+      try {
+        const json = JSON.parse(String(body));
+        done(null, {
+          provider: 'twitter',
+          id: String(json.id_str),
+          displayName: str(json.name) ?? str(json.screen_name) ?? '',
+          // X only returns the email when it is verified
+          emails: json.email ? [{ value: String(json.email) }] : [],
+          photos: str(json.profile_image_url_https)
+            ? [{ value: json.profile_image_url_https }]
+            : [],
+        });
+      } catch (e) {
+        done(e);
+      }
+    });
+  }
+}
+
+/**
+ * `state` (login CSRF protection) and optional PKCE, kept in an encrypted cookie.
+ * Typed as `object` because the strategy typings don't all declare these options.
+ */
+const oauthState = (name: SocialProviderName, pkce = false): object => ({
+  store: new CookieStateStore(name),
+  state: true,
+  ...(pkce && { pkce: true }),
+});
+
+const str = (value: unknown) => (typeof value === 'string' && value ? value : undefined);
+
+const { google, facebook, github, twitter, linkedin, discord } = configs.social;
+
+// every OAuth 2.0 provider gets `state`; PKCE is enabled where the provider supports it
+export const socialProviders: SocialProvider[] = [
+  {
+    name: 'google',
+    label: 'Google',
+    provider: 'GOOGLE',
+    enabled: google.enabled,
+    createStrategy: () =>
+      new GoogleStrategy(
+        {
+          clientID: google.client_id,
+          clientSecret: google.client_secret,
+          callbackURL: google.callback_url,
+          scope: ['openid', 'email', 'profile'],
+          ...oauthState('google', true),
+        },
+        verify('GOOGLE'),
+      ),
+  },
+  {
+    name: 'facebook',
+    label: 'Facebook',
+    provider: 'FACEBOOK',
+    enabled: facebook.enabled,
+    createStrategy: () =>
+      new FacebookStrategy(
+        {
+          clientID: facebook.client_id,
+          clientSecret: facebook.client_secret,
+          callbackURL: facebook.callback_url,
+          scope: ['email', 'public_profile'],
+          profileFields: ['id', 'displayName', 'emails', 'photos'],
+          ...oauthState('facebook'),
+        },
+        verify('FACEBOOK'),
+      ),
+  },
+  {
+    name: 'github',
+    label: 'GitHub',
+    provider: 'GITHUB',
+    enabled: github.enabled,
+    createStrategy: () =>
+      new GithubStrategy(
+        {
+          clientID: github.client_id,
+          clientSecret: github.client_secret,
+          callbackURL: github.callback_url,
+          scope: ['user:email'],
+          ...oauthState('github'),
+        },
+        verify('GITHUB'),
+      ),
+  },
+  {
+    name: 'twitter',
+    label: 'X (Twitter)',
+    provider: 'TWITTER',
+    enabled: twitter.enabled,
+    createStrategy: () =>
+      new TwitterStrategy({
+        consumerKey: twitter.client_id,
+        consumerSecret: twitter.client_secret,
+        callbackURL: twitter.callback_url,
+      }),
+  },
+  {
+    // "Sign In with LinkedIn using OpenID Connect"
+    name: 'linkedin',
+    label: 'LinkedIn',
+    provider: 'LINKEDIN',
+    enabled: linkedin.enabled,
+    createStrategy: () =>
+      new JsonProfileStrategy(
+        'linkedin',
+        {
+          authorizationURL: 'https://www.linkedin.com/oauth/v2/authorization',
+          tokenURL: 'https://www.linkedin.com/oauth/v2/accessToken',
+          clientID: linkedin.client_id,
+          clientSecret: linkedin.client_secret,
+          callbackURL: linkedin.callback_url,
+          scope: ['openid', 'profile', 'email'],
+          ...oauthState('linkedin'),
+        },
+        'https://api.linkedin.com/v2/userinfo',
+        (json) => ({
+          provider: 'linkedin',
+          id: String(json.sub),
+          displayName: str(json.name) ?? '',
+          emails: json.email
+            ? [{ value: String(json.email), verified: json.email_verified === true } as never]
+            : [],
+          photos: str(json.picture) ? [{ value: String(json.picture) }] : [],
+        }),
+      ),
+  },
+  {
+    name: 'discord',
+    label: 'Discord',
+    provider: 'DISCORD',
+    enabled: discord.enabled,
+    createStrategy: () =>
+      new JsonProfileStrategy(
+        'discord',
+        {
+          authorizationURL: 'https://discord.com/oauth2/authorize',
+          tokenURL: 'https://discord.com/api/oauth2/token',
+          clientID: discord.client_id,
+          clientSecret: discord.client_secret,
+          callbackURL: discord.callback_url,
+          scope: ['identify', 'email'],
+          ...oauthState('discord'),
+        },
+        'https://discord.com/api/users/@me',
+        (json) => ({
+          provider: 'discord',
+          id: String(json.id),
+          displayName: str(json.global_name) ?? str(json.username) ?? '',
+          emails: json.email
+            ? [{ value: String(json.email), verified: json.verified === true } as never]
+            : [],
+          photos: str(json.avatar)
+            ? [{ value: `https://cdn.discordapp.com/avatars/${json.id}/${json.avatar}.png` }]
+            : [],
+        }),
+      ),
+  },
+];
+
+export const enabledSocialProviders = socialProviders.filter((p) => p.enabled);

package/templates/prisma/src/app/passport-js/social-account.ts

@@ -0,0 +1,147 @@
+import type { PROVIDER } from '@prisma/client';
+import { createHash, randomBytes } from 'node:crypto';
+import type { Profile } from 'passport';
+import { prisma } from '../lib/prisma.js';
+import type { TokenUser } from '../utils/JWT.js';
+
+/** How long the front-end has to exchange the code from the social login redirect. */
+export const SOCIAL_LOGIN_CODE_TTL_MS = 60 * 1000;
+
+/** A failed social login. `code` is sent to the front-end as `?error=<code>`. */
+export class SocialLoginError extends Error {
+  constructor(
+    public code: 'email_unverified' | 'account_disabled' | 'invalid_profile',
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+type ProfileEmail = { value: string; verified?: boolean | string; primary?: boolean };
+
+const isVerified = (e: ProfileEmail) => e.verified === true || e.verified === 'true';
+
+// Facebook and X only ever return confirmed addresses; the others say whether the
+// address is verified, and unverified ones are ignored
+const ONLY_RETURNS_VERIFIED_EMAILS: PROVIDER[] = ['FACEBOOK', 'TWITTER'];
+
+/** Picks an email we can trust, preferring the primary one. */
+const pickEmail = (profile: Profile, provider: PROVIDER): string | undefined => {
+  const emails = (profile.emails ?? []) as ProfileEmail[];
+  const trusted = ONLY_RETURNS_VERIFIED_EMAILS.includes(provider)
+    ? emails
+    : emails.filter(isVerified);
+  return (trusted.find((e) => e.primary) ?? trusted[0])?.value?.toLowerCase();
+};
+
+const userSelect = { id: true, email: true, role: true, isDeleted: true, tokenVersion: true };
+
+const toUser = (account: {
+  id: string;
+  email: string;
+  role: TokenUser['role'];
+  isDeleted: boolean;
+  tokenVersion: number;
+}): TokenUser => {
+  if (account.isDeleted) {
+    throw new SocialLoginError('account_disabled', 'Account is deleted');
+  }
+  return {
+    accountId: account.id,
+    email: account.email,
+    role: account.role,
+    tokenVersion: account.tokenVersion,
+  };
+};
+
+/**
+ * Finds or creates the account for a social login and returns the user for `req.user`.
+ *
+ * 1. A provider identity that was used before logs straight into its account.
+ * 2. Otherwise the provider's verified email links the identity to the account with
+ *    that email, or creates a new account.
+ */
+export const findOrCreateSocialAccount = async (
+  profile: Profile,
+  provider: PROVIDER,
+): Promise<TokenUser> => {
+  const providerUserId = profile.id ? String(profile.id) : '';
+  if (!providerUserId) {
+    throw new SocialLoginError('invalid_profile', 'The provider did not return a user id');
+  }
+
+  const linked = await prisma.socialAccount.findUnique({
+    where: { provider_providerUserId: { provider, providerUserId } },
+    select: { account: { select: userSelect } },
+  });
+  if (linked) return toUser(linked.account);
+
+  const email = pickEmail(profile, provider);
+  if (!email) {
+    throw new SocialLoginError(
+      'email_unverified',
+      `Your ${provider.toLowerCase()} account doesn't have a verified email address.`,
+    );
+  }
+
+  const link = { create: { provider, providerUserId } };
+  const existing = await prisma.account.findUnique({
+    where: { email },
+    select: { ...userSelect, isAccountVerified: true },
+  });
+
+  if (!existing) {
+    const account = await prisma.account.create({
+      data: {
+        email,
+        password: null,
+        provider,
+        isAccountVerified: true,
+        profile: {
+          create: {
+            fullName: profile.displayName || email.split('@')[0]!,
+            profilePhoto: profile.photos?.[0]?.value ?? null,
+          },
+        },
+        socialAccounts: link,
+      },
+      select: userSelect,
+    });
+    return toUser(account);
+  }
+
+  toUser(existing); // rejects deleted accounts before linking anything
+
+  const account = await prisma.account.update({
+    where: { id: existing.id },
+    data: {
+      socialAccounts: link,
+      // The provider just proved ownership of this email, but nobody ever proved the
+      // password on this unverified account belongs to the owner (it may have been
+      // registered by someone else). Verify the account and drop that password.
+      ...(!existing.isAccountVerified && {
+        isAccountVerified: true,
+        password: null,
+        lastOtp: null,
+        otpAttempts: 0,
+      }),
+    },
+    select: userSelect,
+  });
+  return toUser(account);
+};
+
+export const hashLoginCode = (code: string) => createHash('sha256').update(code).digest('hex');
+
+/** Creates the single-use code the front-end exchanges for an access token. */
+export const createSocialLoginCode = async (accountId: string): Promise<string> => {
+  const code = randomBytes(32).toString('base64url');
+  await prisma.socialLoginCode.create({
+    data: {
+      codeHash: hashLoginCode(code),
+      accountId,
+      expiresAt: new Date(Date.now() + SOCIAL_LOGIN_CODE_TTL_MS),
+    },
+  });
+  return code;
+};

package/templates/prisma/src/app/queues/boss.ts

@@ -0,0 +1,8 @@
+import { PgBoss } from 'pg-boss';
+import { configs } from '../configs/index.js';
+import { logger } from '../lib/logger.js';
+
+// pg-boss stores jobs in its own `pgboss` schema in the app's Postgres database
+export const boss = new PgBoss({ connectionString: configs.db_url });
+
+boss.on('error', (error) => logger.error(error, 'pg-boss error'));