gramobase 1.0.0

package/dist/auth/index.cjs

@@ -0,0 +1,226 @@
+'use strict';
+
+var crypto = require('crypto');
+var jwt = require('jsonwebtoken');
+var bcrypt = require('bcryptjs');
+var zod = require('zod');
+var fs = require('fs');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var jwt__namespace = /*#__PURE__*/_interopNamespace(jwt);
+var bcrypt__namespace = /*#__PURE__*/_interopNamespace(bcrypt);
+
+// gramobase — Telegram as your free, infinite backend
+
+zod.z.object({
+  email: zod.z.string().email(),
+  passwordHash: zod.z.string(),
+  roles: zod.z.array(zod.z.string()).default(["user"]),
+  metadata: zod.z.record(zod.z.unknown()).optional(),
+  createdAt: zod.z.string(),
+  updatedAt: zod.z.string()
+});
+function resolveJwtSecret(configSecret) {
+  if (configSecret) return configSecret;
+  if (process.env["JWT_SECRET"]) return process.env["JWT_SECRET"];
+  const secretFile = "./jwt_secret.txt";
+  if (fs.existsSync(secretFile)) return fs.readFileSync(secretFile, "utf-8").trim();
+  const ephemeral = crypto.randomBytes(32).toString("hex");
+  console.warn(
+    "[gramobase Auth] WARNING: No JWT_SECRET provided. Using an ephemeral random secret. Tokens will be invalidated on restart. Set JWT_SECRET env variable for production!"
+  );
+  return ephemeral;
+}
+function validatePasswordStrength(password) {
+  if (password.length < 8) {
+    throw new Error("[Auth] Password must be at least 8 characters long");
+  }
+}
+var GramoBaseAuth = class {
+  constructor(users, config) {
+    this.users = users;
+    this.config = config;
+    this.resolvedSecret = resolveJwtSecret(config.jwtSecret);
+  }
+  users;
+  config;
+  DEFAULT_ROUNDS = 12;
+  resolvedSecret;
+  // ─── Registration ─────────────────────────────────────────────────────
+  async register(email, password, roles = ["user"], metadata) {
+    if (!email || typeof email !== "string") {
+      throw new Error("[Auth] Invalid email");
+    }
+    validatePasswordStrength(password);
+    const existing = await this.users.findOne({ email: { $eq: email } });
+    if (existing) throw new Error("[Auth] Email already registered");
+    const passwordHash = await bcrypt__namespace.hash(
+      password,
+      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS
+    );
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const doc = await this.users.insertOne({
+      email,
+      passwordHash,
+      roles,
+      metadata,
+      createdAt: now,
+      updatedAt: now
+    });
+    const user = doc;
+    const session = this.createSession(user);
+    await this.config.onSignIn?.(user);
+    return { user, session };
+  }
+  // ─── Login ────────────────────────────────────────────────────────────
+  async login(email, password) {
+    const doc = await this.users.findOne({ email: { $eq: email } });
+    if (!doc) {
+      await bcrypt__namespace.compare(password, "$2a$12$invalidhashtopreventtimingattacks");
+      throw new Error("[Auth] Invalid credentials");
+    }
+    const user = doc;
+    const valid = await bcrypt__namespace.compare(password, user.passwordHash);
+    if (!valid) throw new Error("[Auth] Invalid credentials");
+    const session = this.createSession(user);
+    await this.config.onSignIn?.(user);
+    return { user, session };
+  }
+  // ─── Token verification ───────────────────────────────────────────────
+  verifyToken(token) {
+    try {
+      const payload = jwt__namespace.verify(token, this.resolvedSecret, {
+        algorithms: ["HS256"]
+      });
+      return payload;
+    } catch {
+      throw new Error("[Auth] Invalid or expired token");
+    }
+  }
+  // ─── Role-based access ────────────────────────────────────────────────
+  requireRole(session, role) {
+    if (!session.roles.includes(role) && !session.roles.includes("admin")) {
+      throw new Error(`[Auth] Requires role: ${role}`);
+    }
+  }
+  requireAnyRole(session, roles) {
+    const hasRole = roles.some(
+      (r) => session.roles.includes(r) || session.roles.includes("admin")
+    );
+    if (!hasRole) {
+      throw new Error(`[Auth] Requires one of roles: ${roles.join(", ")}`);
+    }
+  }
+  // ─── Password management ──────────────────────────────────────────────
+  async changePassword(userId, oldPassword, newPassword) {
+    const doc = await this.users.findById(userId);
+    if (!doc) throw new Error("[Auth] User not found");
+    const user = doc;
+    const valid = await bcrypt__namespace.compare(oldPassword, user.passwordHash);
+    if (!valid) throw new Error("[Auth] Old password incorrect");
+    validatePasswordStrength(newPassword);
+    const newHash = await bcrypt__namespace.hash(
+      newPassword,
+      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS
+    );
+    await this.users.findByIdAndUpdate(userId, {
+      $set: { passwordHash: newHash, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  async resetPassword(userId, newPassword) {
+    validatePasswordStrength(newPassword);
+    const newHash = await bcrypt__namespace.hash(
+      newPassword,
+      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS
+    );
+    await this.users.findByIdAndUpdate(userId, {
+      $set: { passwordHash: newHash, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  // ─── User management ─────────────────────────────────────────────────
+  async getUserById(id) {
+    const doc = await this.users.findById(id);
+    return doc ? doc : null;
+  }
+  async getUserByEmail(email) {
+    const doc = await this.users.findOne({ email: { $eq: email } });
+    return doc ? doc : null;
+  }
+  async updateRoles(userId, roles) {
+    await this.users.findByIdAndUpdate(userId, {
+      $set: { roles, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  async deleteUser(userId) {
+    await this.users.deleteById(userId);
+    await this.config.onSignOut?.(userId);
+  }
+  // ─── Session helpers ──────────────────────────────────────────────────
+  createSession(user) {
+    const expiresIn = this.config.jwtExpiresIn ?? "7d";
+    const payload = {
+      sub: user._id,
+      userId: user._id,
+      roles: user.roles,
+      expiresAt: Date.now() + this.parseExpiry(expiresIn)
+    };
+    const token = jwt__namespace.sign(payload, this.resolvedSecret, {
+      expiresIn,
+      algorithm: "HS256"
+    });
+    return { ...payload, token };
+  }
+  parseExpiry(s) {
+    const n = parseInt(s);
+    if (s.endsWith("d")) return n * 864e5;
+    if (s.endsWith("h")) return n * 36e5;
+    if (s.endsWith("m")) return n * 6e4;
+    return n * 1e3;
+  }
+  // ─── Middleware factory (Express/Fastify compatible) ──────────────────
+  middleware() {
+    return (req, res, next) => {
+      const auth = req.headers["authorization"];
+      if (!auth?.startsWith("Bearer ")) {
+        return res.status(401).json({ error: "Missing token" });
+      }
+      try {
+        req.session = this.verifyToken(auth.slice(7));
+        next();
+      } catch {
+        res.status(401).json({ error: "Unauthorized" });
+      }
+    };
+  }
+  requireRoleMiddleware(role) {
+    return (req, res, next) => {
+      try {
+        this.requireRole(req.session, role);
+        next();
+      } catch {
+        res.status(403).json({ error: "Forbidden" });
+      }
+    };
+  }
+};
+
+exports.GramoBaseAuth = GramoBaseAuth;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/GramoBaseAuth.ts"],"names":["z","existsSync","readFileSync","randomBytes","bcrypt","jwt"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQmBA,MAAE,MAAA,CAAO;AAAA,EAC1B,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM;AAAA,EACxB,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,KAAA,EAAOA,KAAA,CAAE,KAAA,CAAMA,KAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,MAAM,CAAC,CAAA;AAAA,EAC3C,UAAUA,KAAA,CAAE,MAAA,CAAOA,MAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACzC,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAWA,MAAE,MAAA;AACf,CAAC;AAeD,SAAS,iBAAiB,YAAA,EAA+B;AACvD,EAAA,IAAI,cAAc,OAAO,YAAA;AACzB,EAAA,IAAI,QAAQ,GAAA,CAAI,YAAY,GAAG,OAAO,OAAA,CAAQ,IAAI,YAAY,CAAA;AAC9D,EAAA,MAAM,UAAA,GAAa,kBAAA;AACnB,EAAA,IAAIC,aAAA,CAAW,UAAU,CAAA,EAAG,OAAOC,gBAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC1E,EAAA,MAAM,SAAA,GAAYC,kBAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAChD,EAAA,OAAA,CAAQ,IAAA;AAAA,IACN;AAAA,GAEF;AACA,EAAA,OAAO,SAAA;AACT;AAMA,SAAS,yBAAyB,QAAA,EAAwB;AACxD,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,EACtE;AAEF;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,WAAA,CACU,OACA,MAAA,EACR;AAFQ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAGR,IAAA,IAAA,CAAK,cAAA,GAAiB,gBAAA,CAAiB,MAAA,CAAO,SAAS,CAAA;AAAA,EACzD;AAAA,EALU,KAAA;AAAA,EACA,MAAA;AAAA,EALO,cAAA,GAAiB,EAAA;AAAA,EACjB,cAAA;AAAA;AAAA,EAYjB,MAAM,SACJ,KAAA,EACA,QAAA,EACA,QAAkB,CAAC,MAAM,GACzB,QAAA,EAC2C;AAE3C,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AAGA,IAAA,wBAAA,CAAyB,QAAQ,CAAA;AAEjC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,GAAA,EAAK,KAAA,EAAM,EAAU,CAAA;AAC1E,IAAA,IAAI,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,iCAAiC,CAAA;AAE/D,IAAA,MAAM,eAAe,MAAaC,iBAAA,CAAA,IAAA;AAAA,MAChC,QAAA;AAAA,MACA,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK;AAAA,KACnC;AAEA,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU;AAAA,MACrC,KAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA,EAAW,GAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,IAAA,GAAO,GAAA;AACb,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACvC,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,GAAW,IAAI,CAAA;AAEjC,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,KAAA,CAAM,KAAA,EAAe,QAAA,EAA6D;AACtF,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,GAAA,EAAK,KAAA,EAAM,EAAU,CAAA;AACrE,IAAA,IAAI,CAAC,GAAA,EAAK;AAER,MAAA,MAAaA,iBAAA,CAAA,OAAA,CAAQ,UAAU,0CAA0C,CAAA;AACzE,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA;AACb,IAAA,MAAM,KAAA,GAAQ,MAAaA,iBAAA,CAAA,OAAA,CAAQ,QAAA,EAAU,KAAK,YAAY,CAAA;AAC9D,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAExD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACvC,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,GAAW,IAAI,CAAA;AAEjC,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA,EAIA,YAAY,KAAA,EAAwB;AAClC,IAAA,IAAI;AAEF,MAAA,MAAM,OAAA,GAAcC,cAAA,CAAA,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,cAAA,EAAgB;AAAA,QACrD,UAAA,EAAY,CAAC,OAAO;AAAA,OACrB,CAAA;AACD,MAAA,OAAO,OAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAAA,EACF;AAAA;AAAA,EAIA,WAAA,CAAY,SAAkB,IAAA,EAAoB;AAChD,IAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,IAAK,CAAC,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,EAAG;AACrE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAE,CAAA;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,SAAkB,KAAA,EAAuB;AACtD,IAAA,MAAM,UAAU,KAAA,CAAM,IAAA;AAAA,MACpB,CAAC,CAAA,KAAM,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA,IAAK,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,OAAO;AAAA,KACpE;AACA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,cAAA,CACJ,MAAA,EACA,WAAA,EACA,WAAA,EACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,SAAS,MAAM,CAAA;AAC5C,IAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,uBAAuB,CAAA;AAEjD,IAAA,MAAM,IAAA,GAAO,GAAA;AACb,IAAA,MAAM,KAAA,GAAQ,MAAaD,iBAAA,CAAA,OAAA,CAAQ,WAAA,EAAa,KAAK,YAAY,CAAA;AACjE,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAG3D,IAAA,wBAAA,CAAyB,WAAW,CAAA;AAEpC,IAAA,MAAM,UAAU,MAAaA,iBAAA,CAAA,IAAA;AAAA,MAC3B,WAAA;AAAA,MACA,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK;AAAA,KACnC;AAEA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ;AAAA,MACzC,IAAA,EAAM,EAAE,YAAA,EAAc,OAAA,EAAS,4BAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAE,KACpE,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,aAAA,CAAc,MAAA,EAAgB,WAAA,EAAoC;AACtE,IAAA,wBAAA,CAAyB,WAAW,CAAA;AACpC,IAAA,MAAM,UAAU,MAAaA,iBAAA,CAAA,IAAA;AAAA,MAC3B,WAAA;AAAA,MACA,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK;AAAA,KACnC;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ;AAAA,MACzC,IAAA,EAAM,EAAE,YAAA,EAAc,OAAA,EAAS,4BAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAE,KACpE,CAAA;AAAA,EACH;AAAA;AAAA,EAIA,MAAM,YAAY,EAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,SAAS,EAAE,CAAA;AACxC,IAAA,OAAO,MAAO,GAAA,GAA0B,IAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,eAAe,KAAA,EAAqC;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,GAAA,EAAK,KAAA,EAAM,EAAU,CAAA;AACrE,IAAA,OAAO,MAAO,GAAA,GAA0B,IAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAA,CAAY,MAAA,EAAgB,KAAA,EAAgC;AAChE,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ;AAAA,MACzC,IAAA,EAAM,EAAE,KAAA,EAAO,SAAA,EAAA,qBAAe,IAAA,EAAK,EAAE,aAAY;AAAE,KACpD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,MAAA,EAA+B;AAC9C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAClC,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,GAAY,MAAM,CAAA;AAAA,EACtC;AAAA;AAAA,EAIQ,cAAc,IAAA,EAAqB;AACzC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA;AAC9C,IAAA,MAAM,OAAA,GAAoD;AAAA,MACxD,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,QAAQ,IAAA,CAAK,GAAA;AAAA,MACb,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,YAAY,SAAS;AAAA,KACpD;AAIA,IAAA,MAAM,KAAA,GAAaC,cAAA,CAAA,IAAA,CAAa,OAAA,EAAS,IAAA,CAAK,cAAA,EAAgB;AAAA,MAC5D,SAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AACD,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,KAAA,EAAM;AAAA,EAC7B;AAAA,EAEQ,YAAY,CAAA,EAAmB;AACrC,IAAA,MAAM,CAAA,GAAI,SAAS,CAAC,CAAA;AACpB,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,SAAU,CAAA,GAAI,KAAA;AAChC,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,SAAU,CAAA,GAAI,IAAA;AAChC,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,SAAU,CAAA,GAAI,GAAA;AAChC,IAAA,OAAO,CAAA,GAAI,GAAA;AAAA,EACb;AAAA;AAAA,EAIA,UAAA,GAAa;AACX,IAAA,OAAO,CAAC,GAAA,EAAU,GAAA,EAAU,IAAA,KAAc;AACxC,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACxC,MAAA,IAAI,CAAC,IAAA,EAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AAChC,QAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iBAAiB,CAAA;AAAA,MACxD;AACA,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,UAAU,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA;AAC5C,QAAA,IAAA,EAAK;AAAA,MACP,CAAA,CAAA,MAAQ;AAEN,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,CAAA;AAAA,MAChD;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEA,sBAAsB,IAAA,EAAc;AAClC,IAAA,OAAO,CAAC,GAAA,EAAU,GAAA,EAAU,IAAA,KAAc;AACxC,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,OAAA,EAAS,IAAI,CAAA;AAClC,QAAA,IAAA,EAAK;AAAA,MACP,CAAA,CAAA,MAAQ;AACN,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,MAC7C;AAAA,IACF,CAAA;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import { randomUUID, randomBytes } from 'crypto';\nimport * as jwt from 'jsonwebtoken';\nimport * as bcrypt from 'bcryptjs';\nimport { z } from 'zod';\nimport { AuthConfig, User, Session } from '../types/index.js';\nimport { Collection } from '../orm/Collection.js';\nimport { existsSync, readFileSync } from 'fs';\n\nconst UserSchema = z.object({\n  email: z.string().email(),\n  passwordHash: z.string(),\n  roles: z.array(z.string()).default(['user']),\n  metadata: z.record(z.unknown()).optional(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\n\n// TODO(security): Consider adding OAuth 2.0 provider support (e.g., Google, GitHub).\n// TODO(security): Consider adding MFA (TOTP/WebAuthn) for high-security deployments.\n// TODO(security): Consider adding pwned-password checking via haveibeenpwned.com API.\n\n/**\n * Resolve JWT secret with multi-tiered fallback:\n * 1. Explicit config value\n * 2. Environment variable\n * 3. Local jwt_secret.txt file\n * 4. Ephemeral random generation with warning (NOT suitable for multi-instance prod)\n *\n * MUST NOT hardcode or use default literal fallbacks.\n */\nfunction resolveJwtSecret(configSecret?: string): string {\n  if (configSecret) return configSecret;\n  if (process.env['JWT_SECRET']) return process.env['JWT_SECRET'];\n  const secretFile = './jwt_secret.txt';\n  if (existsSync(secretFile)) return readFileSync(secretFile, 'utf-8').trim();\n  const ephemeral = randomBytes(32).toString('hex');\n  console.warn(\n    '[gramobase Auth] WARNING: No JWT_SECRET provided. Using an ephemeral random secret. ' +\n    'Tokens will be invalidated on restart. Set JWT_SECRET env variable for production!'\n  );\n  return ephemeral;\n}\n\n/**\n * Validate password strength (min 8 chars, no maximum).\n * Does not require specific character types — users choose their own strong passwords.\n */\nfunction validatePasswordStrength(password: string): void {\n  if (password.length < 8) {\n    throw new Error('[Auth] Password must be at least 8 characters long');\n  }\n  // TODO(security): Consider rejecting known breached passwords via HaveIBeenPwned API.\n}\n\nexport class GramoBaseAuth {\n  private readonly DEFAULT_ROUNDS = 12;\n  private readonly resolvedSecret: string;\n\n  constructor(\n    private users: Collection<typeof UserSchema>,\n    private config: AuthConfig\n  ) {\n    // Resolve secret at construction time; fail safely if no secret available\n    this.resolvedSecret = resolveJwtSecret(config.jwtSecret);\n  }\n\n  // ─── Registration ─────────────────────────────────────────────────────\n\n  async register(\n    email: string,\n    password: string,\n    roles: string[] = ['user'],\n    metadata?: Record<string, unknown>\n  ): Promise<{ user: User; session: Session }> {\n    // Validate email format (basic — Zod schema handles full validation)\n    if (!email || typeof email !== 'string') {\n      throw new Error('[Auth] Invalid email');\n    }\n\n    // Validate password strength\n    validatePasswordStrength(password);\n\n    const existing = await this.users.findOne({ email: { $eq: email } } as any);\n    if (existing) throw new Error('[Auth] Email already registered');\n\n    const passwordHash = await bcrypt.hash(\n      password,\n      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS\n    );\n\n    const now = new Date().toISOString();\n    const doc = await this.users.insertOne({\n      email,\n      passwordHash,\n      roles,\n      metadata,\n      createdAt: now,\n      updatedAt: now,\n    });\n\n    const user = doc as unknown as User;\n    const session = this.createSession(user);\n    await this.config.onSignIn?.(user);\n\n    return { user, session };\n  }\n\n  // ─── Login ────────────────────────────────────────────────────────────\n\n  async login(email: string, password: string): Promise<{ user: User; session: Session }> {\n    const doc = await this.users.findOne({ email: { $eq: email } } as any);\n    if (!doc) {\n      // Use constant-time comparison to avoid timing attacks on email existence\n      await bcrypt.compare(password, '$2a$12$invalidhashtopreventtimingattacks');\n      throw new Error('[Auth] Invalid credentials');\n    }\n\n    const user = doc as unknown as User;\n    const valid = await bcrypt.compare(password, user.passwordHash);\n    if (!valid) throw new Error('[Auth] Invalid credentials');\n\n    const session = this.createSession(user);\n    await this.config.onSignIn?.(user);\n\n    return { user, session };\n  }\n\n  // ─── Token verification ───────────────────────────────────────────────\n\n  verifyToken(token: string): Session {\n    try {\n      // Hardcode algorithm to prevent algorithm confusion attacks; reject 'none'\n      const payload = jwt.verify(token, this.resolvedSecret, {\n        algorithms: ['HS256'],\n      }) as Session;\n      return payload;\n    } catch {\n      throw new Error('[Auth] Invalid or expired token');\n    }\n  }\n\n  // ─── Role-based access ────────────────────────────────────────────────\n\n  requireRole(session: Session, role: string): void {\n    if (!session.roles.includes(role) && !session.roles.includes('admin')) {\n      throw new Error(`[Auth] Requires role: ${role}`);\n    }\n  }\n\n  requireAnyRole(session: Session, roles: string[]): void {\n    const hasRole = roles.some(\n      (r) => session.roles.includes(r) || session.roles.includes('admin')\n    );\n    if (!hasRole) {\n      throw new Error(`[Auth] Requires one of roles: ${roles.join(', ')}`);\n    }\n  }\n\n  // ─── Password management ──────────────────────────────────────────────\n\n  async changePassword(\n    userId: string,\n    oldPassword: string,\n    newPassword: string\n  ): Promise<void> {\n    const doc = await this.users.findById(userId);\n    if (!doc) throw new Error('[Auth] User not found');\n\n    const user = doc as unknown as User;\n    const valid = await bcrypt.compare(oldPassword, user.passwordHash);\n    if (!valid) throw new Error('[Auth] Old password incorrect');\n\n    // Validate new password strength\n    validatePasswordStrength(newPassword);\n\n    const newHash = await bcrypt.hash(\n      newPassword,\n      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS\n    );\n\n    await this.users.findByIdAndUpdate(userId, {\n      $set: { passwordHash: newHash, updatedAt: new Date().toISOString() } as any,\n    });\n  }\n\n  async resetPassword(userId: string, newPassword: string): Promise<void> {\n    validatePasswordStrength(newPassword);\n    const newHash = await bcrypt.hash(\n      newPassword,\n      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS\n    );\n    await this.users.findByIdAndUpdate(userId, {\n      $set: { passwordHash: newHash, updatedAt: new Date().toISOString() } as any,\n    });\n  }\n\n  // ─── User management ─────────────────────────────────────────────────\n\n  async getUserById(id: string): Promise<User | null> {\n    const doc = await this.users.findById(id);\n    return doc ? (doc as unknown as User) : null;\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    const doc = await this.users.findOne({ email: { $eq: email } } as any);\n    return doc ? (doc as unknown as User) : null;\n  }\n\n  async updateRoles(userId: string, roles: string[]): Promise<void> {\n    await this.users.findByIdAndUpdate(userId, {\n      $set: { roles, updatedAt: new Date().toISOString() } as any,\n    });\n  }\n\n  async deleteUser(userId: string): Promise<void> {\n    await this.users.deleteById(userId);\n    await this.config.onSignOut?.(userId);\n  }\n\n  // ─── Session helpers ──────────────────────────────────────────────────\n\n  private createSession(user: User): Session {\n    const expiresIn = this.config.jwtExpiresIn ?? '7d';\n    const payload: Omit<Session, 'token'> & { sub: string } = {\n      sub: user._id,\n      userId: user._id,\n      roles: user.roles,\n      expiresAt: Date.now() + this.parseExpiry(expiresIn),\n    };\n\n    // Sign with hardcoded HS256 algorithm; 'none' algorithm is never used\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const token = (jwt.sign as any)(payload, this.resolvedSecret, {\n      expiresIn,\n      algorithm: 'HS256',\n    }) as string;\n    return { ...payload, token };\n  }\n\n  private parseExpiry(s: string): number {\n    const n = parseInt(s);\n    if (s.endsWith('d')) return n * 86400_000;\n    if (s.endsWith('h')) return n * 3600_000;\n    if (s.endsWith('m')) return n * 60_000;\n    return n * 1000;\n  }\n\n  // ─── Middleware factory (Express/Fastify compatible) ──────────────────\n\n  middleware() {\n    return (req: any, res: any, next: any) => {\n      const auth = req.headers['authorization'] as string | undefined;\n      if (!auth?.startsWith('Bearer ')) {\n        return res.status(401).json({ error: 'Missing token' });\n      }\n      try {\n        req.session = this.verifyToken(auth.slice(7));\n        next();\n      } catch {\n        // Do NOT expose error details to client; log internally if needed\n        res.status(401).json({ error: 'Unauthorized' });\n      }\n    };\n  }\n\n  requireRoleMiddleware(role: string) {\n    return (req: any, res: any, next: any) => {\n      try {\n        this.requireRole(req.session, role);\n        next();\n      } catch {\n        res.status(403).json({ error: 'Forbidden' });\n      }\n    };\n  }\n}\n"]}

package/dist/auth/index.d.cts

@@ -0,0 +1,5 @@
+import 'zod';
+import '../BotWorkerPool-9ndHQt2g.cjs';
+export { G as GramoBaseAuth } from '../GramoBaseAuth-CHNn2_e5.cjs';
+import 'node-telegram-bot-api';
+import 'eventemitter3';

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+import 'zod';
+import '../BotWorkerPool-9ndHQt2g.js';
+export { G as GramoBaseAuth } from '../GramoBaseAuth-00fg0u_b.js';
+import 'node-telegram-bot-api';
+import 'eventemitter3';

package/dist/auth/index.js

@@ -0,0 +1,203 @@
+import { randomBytes } from 'crypto';
+import * as jwt from 'jsonwebtoken';
+import * as bcrypt from 'bcryptjs';
+import { z } from 'zod';
+import { existsSync, readFileSync } from 'fs';
+
+// gramobase — Telegram as your free, infinite backend
+
+z.object({
+  email: z.string().email(),
+  passwordHash: z.string(),
+  roles: z.array(z.string()).default(["user"]),
+  metadata: z.record(z.unknown()).optional(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+function resolveJwtSecret(configSecret) {
+  if (configSecret) return configSecret;
+  if (process.env["JWT_SECRET"]) return process.env["JWT_SECRET"];
+  const secretFile = "./jwt_secret.txt";
+  if (existsSync(secretFile)) return readFileSync(secretFile, "utf-8").trim();
+  const ephemeral = randomBytes(32).toString("hex");
+  console.warn(
+    "[gramobase Auth] WARNING: No JWT_SECRET provided. Using an ephemeral random secret. Tokens will be invalidated on restart. Set JWT_SECRET env variable for production!"
+  );
+  return ephemeral;
+}
+function validatePasswordStrength(password) {
+  if (password.length < 8) {
+    throw new Error("[Auth] Password must be at least 8 characters long");
+  }
+}
+var GramoBaseAuth = class {
+  constructor(users, config) {
+    this.users = users;
+    this.config = config;
+    this.resolvedSecret = resolveJwtSecret(config.jwtSecret);
+  }
+  users;
+  config;
+  DEFAULT_ROUNDS = 12;
+  resolvedSecret;
+  // ─── Registration ─────────────────────────────────────────────────────
+  async register(email, password, roles = ["user"], metadata) {
+    if (!email || typeof email !== "string") {
+      throw new Error("[Auth] Invalid email");
+    }
+    validatePasswordStrength(password);
+    const existing = await this.users.findOne({ email: { $eq: email } });
+    if (existing) throw new Error("[Auth] Email already registered");
+    const passwordHash = await bcrypt.hash(
+      password,
+      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS
+    );
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const doc = await this.users.insertOne({
+      email,
+      passwordHash,
+      roles,
+      metadata,
+      createdAt: now,
+      updatedAt: now
+    });
+    const user = doc;
+    const session = this.createSession(user);
+    await this.config.onSignIn?.(user);
+    return { user, session };
+  }
+  // ─── Login ────────────────────────────────────────────────────────────
+  async login(email, password) {
+    const doc = await this.users.findOne({ email: { $eq: email } });
+    if (!doc) {
+      await bcrypt.compare(password, "$2a$12$invalidhashtopreventtimingattacks");
+      throw new Error("[Auth] Invalid credentials");
+    }
+    const user = doc;
+    const valid = await bcrypt.compare(password, user.passwordHash);
+    if (!valid) throw new Error("[Auth] Invalid credentials");
+    const session = this.createSession(user);
+    await this.config.onSignIn?.(user);
+    return { user, session };
+  }
+  // ─── Token verification ───────────────────────────────────────────────
+  verifyToken(token) {
+    try {
+      const payload = jwt.verify(token, this.resolvedSecret, {
+        algorithms: ["HS256"]
+      });
+      return payload;
+    } catch {
+      throw new Error("[Auth] Invalid or expired token");
+    }
+  }
+  // ─── Role-based access ────────────────────────────────────────────────
+  requireRole(session, role) {
+    if (!session.roles.includes(role) && !session.roles.includes("admin")) {
+      throw new Error(`[Auth] Requires role: ${role}`);
+    }
+  }
+  requireAnyRole(session, roles) {
+    const hasRole = roles.some(
+      (r) => session.roles.includes(r) || session.roles.includes("admin")
+    );
+    if (!hasRole) {
+      throw new Error(`[Auth] Requires one of roles: ${roles.join(", ")}`);
+    }
+  }
+  // ─── Password management ──────────────────────────────────────────────
+  async changePassword(userId, oldPassword, newPassword) {
+    const doc = await this.users.findById(userId);
+    if (!doc) throw new Error("[Auth] User not found");
+    const user = doc;
+    const valid = await bcrypt.compare(oldPassword, user.passwordHash);
+    if (!valid) throw new Error("[Auth] Old password incorrect");
+    validatePasswordStrength(newPassword);
+    const newHash = await bcrypt.hash(
+      newPassword,
+      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS
+    );
+    await this.users.findByIdAndUpdate(userId, {
+      $set: { passwordHash: newHash, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  async resetPassword(userId, newPassword) {
+    validatePasswordStrength(newPassword);
+    const newHash = await bcrypt.hash(
+      newPassword,
+      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS
+    );
+    await this.users.findByIdAndUpdate(userId, {
+      $set: { passwordHash: newHash, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  // ─── User management ─────────────────────────────────────────────────
+  async getUserById(id) {
+    const doc = await this.users.findById(id);
+    return doc ? doc : null;
+  }
+  async getUserByEmail(email) {
+    const doc = await this.users.findOne({ email: { $eq: email } });
+    return doc ? doc : null;
+  }
+  async updateRoles(userId, roles) {
+    await this.users.findByIdAndUpdate(userId, {
+      $set: { roles, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  async deleteUser(userId) {
+    await this.users.deleteById(userId);
+    await this.config.onSignOut?.(userId);
+  }
+  // ─── Session helpers ──────────────────────────────────────────────────
+  createSession(user) {
+    const expiresIn = this.config.jwtExpiresIn ?? "7d";
+    const payload = {
+      sub: user._id,
+      userId: user._id,
+      roles: user.roles,
+      expiresAt: Date.now() + this.parseExpiry(expiresIn)
+    };
+    const token = jwt.sign(payload, this.resolvedSecret, {
+      expiresIn,
+      algorithm: "HS256"
+    });
+    return { ...payload, token };
+  }
+  parseExpiry(s) {
+    const n = parseInt(s);
+    if (s.endsWith("d")) return n * 864e5;
+    if (s.endsWith("h")) return n * 36e5;
+    if (s.endsWith("m")) return n * 6e4;
+    return n * 1e3;
+  }
+  // ─── Middleware factory (Express/Fastify compatible) ──────────────────
+  middleware() {
+    return (req, res, next) => {
+      const auth = req.headers["authorization"];
+      if (!auth?.startsWith("Bearer ")) {
+        return res.status(401).json({ error: "Missing token" });
+      }
+      try {
+        req.session = this.verifyToken(auth.slice(7));
+        next();
+      } catch {
+        res.status(401).json({ error: "Unauthorized" });
+      }
+    };
+  }
+  requireRoleMiddleware(role) {
+    return (req, res, next) => {
+      try {
+        this.requireRole(req.session, role);
+        next();
+      } catch {
+        res.status(403).json({ error: "Forbidden" });
+      }
+    };
+  }
+};
+
+export { GramoBaseAuth };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/GramoBaseAuth.ts"],"names":[],"mappings":";;;;;;;;AAQmB,EAAE,MAAA,CAAO;AAAA,EAC1B,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,EAAM;AAAA,EACxB,YAAA,EAAc,EAAE,MAAA,EAAO;AAAA,EACvB,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,MAAM,CAAC,CAAA;AAAA,EAC3C,UAAU,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA,EAAS;AAAA,EACzC,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,SAAA,EAAW,EAAE,MAAA;AACf,CAAC;AAeD,SAAS,iBAAiB,YAAA,EAA+B;AACvD,EAAA,IAAI,cAAc,OAAO,YAAA;AACzB,EAAA,IAAI,QAAQ,GAAA,CAAI,YAAY,GAAG,OAAO,OAAA,CAAQ,IAAI,YAAY,CAAA;AAC9D,EAAA,MAAM,UAAA,GAAa,kBAAA;AACnB,EAAA,IAAI,UAAA,CAAW,UAAU,CAAA,EAAG,OAAO,aAAa,UAAA,EAAY,OAAO,EAAE,IAAA,EAAK;AAC1E,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAChD,EAAA,OAAA,CAAQ,IAAA;AAAA,IACN;AAAA,GAEF;AACA,EAAA,OAAO,SAAA;AACT;AAMA,SAAS,yBAAyB,QAAA,EAAwB;AACxD,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,EACtE;AAEF;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAIzB,WAAA,CACU,OACA,MAAA,EACR;AAFQ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAGR,IAAA,IAAA,CAAK,cAAA,GAAiB,gBAAA,CAAiB,MAAA,CAAO,SAAS,CAAA;AAAA,EACzD;AAAA,EALU,KAAA;AAAA,EACA,MAAA;AAAA,EALO,cAAA,GAAiB,EAAA;AAAA,EACjB,cAAA;AAAA;AAAA,EAYjB,MAAM,SACJ,KAAA,EACA,QAAA,EACA,QAAkB,CAAC,MAAM,GACzB,QAAA,EAC2C;AAE3C,IAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACvC,MAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,IACxC;AAGA,IAAA,wBAAA,CAAyB,QAAQ,CAAA;AAEjC,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,GAAA,EAAK,KAAA,EAAM,EAAU,CAAA;AAC1E,IAAA,IAAI,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,iCAAiC,CAAA;AAE/D,IAAA,MAAM,eAAe,MAAa,MAAA,CAAA,IAAA;AAAA,MAChC,QAAA;AAAA,MACA,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK;AAAA,KACnC;AAEA,IAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAU;AAAA,MACrC,KAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA,EAAW,GAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,IAAA,GAAO,GAAA;AACb,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACvC,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,GAAW,IAAI,CAAA;AAEjC,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA,EAIA,MAAM,KAAA,CAAM,KAAA,EAAe,QAAA,EAA6D;AACtF,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,GAAA,EAAK,KAAA,EAAM,EAAU,CAAA;AACrE,IAAA,IAAI,CAAC,GAAA,EAAK;AAER,MAAA,MAAa,MAAA,CAAA,OAAA,CAAQ,UAAU,0CAA0C,CAAA;AACzE,MAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,IAC9C;AAEA,IAAA,MAAM,IAAA,GAAO,GAAA;AACb,IAAA,MAAM,KAAA,GAAQ,MAAa,MAAA,CAAA,OAAA,CAAQ,QAAA,EAAU,KAAK,YAAY,CAAA;AAC9D,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAExD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA;AACvC,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,GAAW,IAAI,CAAA;AAEjC,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA,EAIA,YAAY,KAAA,EAAwB;AAClC,IAAA,IAAI;AAEF,MAAA,MAAM,OAAA,GAAc,GAAA,CAAA,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,cAAA,EAAgB;AAAA,QACrD,UAAA,EAAY,CAAC,OAAO;AAAA,OACrB,CAAA;AACD,MAAA,OAAO,OAAA;AAAA,IACT,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAAA,EACF;AAAA;AAAA,EAIA,WAAA,CAAY,SAAkB,IAAA,EAAoB;AAChD,IAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,IAAI,CAAA,IAAK,CAAC,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA,EAAG;AACrE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAE,CAAA;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,cAAA,CAAe,SAAkB,KAAA,EAAuB;AACtD,IAAA,MAAM,UAAU,KAAA,CAAM,IAAA;AAAA,MACpB,CAAC,CAAA,KAAM,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,CAAC,CAAA,IAAK,OAAA,CAAQ,KAAA,CAAM,QAAA,CAAS,OAAO;AAAA,KACpE;AACA,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,MAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,IACrE;AAAA,EACF;AAAA;AAAA,EAIA,MAAM,cAAA,CACJ,MAAA,EACA,WAAA,EACA,WAAA,EACe;AACf,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,SAAS,MAAM,CAAA;AAC5C,IAAA,IAAI,CAAC,GAAA,EAAK,MAAM,IAAI,MAAM,uBAAuB,CAAA;AAEjD,IAAA,MAAM,IAAA,GAAO,GAAA;AACb,IAAA,MAAM,KAAA,GAAQ,MAAa,MAAA,CAAA,OAAA,CAAQ,WAAA,EAAa,KAAK,YAAY,CAAA;AACjE,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAG3D,IAAA,wBAAA,CAAyB,WAAW,CAAA;AAEpC,IAAA,MAAM,UAAU,MAAa,MAAA,CAAA,IAAA;AAAA,MAC3B,WAAA;AAAA,MACA,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK;AAAA,KACnC;AAEA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ;AAAA,MACzC,IAAA,EAAM,EAAE,YAAA,EAAc,OAAA,EAAS,4BAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAE,KACpE,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,aAAA,CAAc,MAAA,EAAgB,WAAA,EAAoC;AACtE,IAAA,wBAAA,CAAyB,WAAW,CAAA;AACpC,IAAA,MAAM,UAAU,MAAa,MAAA,CAAA,IAAA;AAAA,MAC3B,WAAA;AAAA,MACA,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK;AAAA,KACnC;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ;AAAA,MACzC,IAAA,EAAM,EAAE,YAAA,EAAc,OAAA,EAAS,4BAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAE,KACpE,CAAA;AAAA,EACH;AAAA;AAAA,EAIA,MAAM,YAAY,EAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,SAAS,EAAE,CAAA;AACxC,IAAA,OAAO,MAAO,GAAA,GAA0B,IAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,eAAe,KAAA,EAAqC;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,EAAE,KAAA,EAAO,EAAE,GAAA,EAAK,KAAA,EAAM,EAAU,CAAA;AACrE,IAAA,OAAO,MAAO,GAAA,GAA0B,IAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,WAAA,CAAY,MAAA,EAAgB,KAAA,EAAgC;AAChE,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,iBAAA,CAAkB,MAAA,EAAQ;AAAA,MACzC,IAAA,EAAM,EAAE,KAAA,EAAO,SAAA,EAAA,qBAAe,IAAA,EAAK,EAAE,aAAY;AAAE,KACpD,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,MAAA,EAA+B;AAC9C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAClC,IAAA,MAAM,IAAA,CAAK,MAAA,CAAO,SAAA,GAAY,MAAM,CAAA;AAAA,EACtC;AAAA;AAAA,EAIQ,cAAc,IAAA,EAAqB;AACzC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,IAAA;AAC9C,IAAA,MAAM,OAAA,GAAoD;AAAA,MACxD,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,QAAQ,IAAA,CAAK,GAAA;AAAA,MACb,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,WAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,YAAY,SAAS;AAAA,KACpD;AAIA,IAAA,MAAM,KAAA,GAAa,GAAA,CAAA,IAAA,CAAa,OAAA,EAAS,IAAA,CAAK,cAAA,EAAgB;AAAA,MAC5D,SAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AACD,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,KAAA,EAAM;AAAA,EAC7B;AAAA,EAEQ,YAAY,CAAA,EAAmB;AACrC,IAAA,MAAM,CAAA,GAAI,SAAS,CAAC,CAAA;AACpB,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,SAAU,CAAA,GAAI,KAAA;AAChC,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,SAAU,CAAA,GAAI,IAAA;AAChC,IAAA,IAAI,CAAA,CAAE,QAAA,CAAS,GAAG,CAAA,SAAU,CAAA,GAAI,GAAA;AAChC,IAAA,OAAO,CAAA,GAAI,GAAA;AAAA,EACb;AAAA;AAAA,EAIA,UAAA,GAAa;AACX,IAAA,OAAO,CAAC,GAAA,EAAU,GAAA,EAAU,IAAA,KAAc;AACxC,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACxC,MAAA,IAAI,CAAC,IAAA,EAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AAChC,QAAA,OAAO,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iBAAiB,CAAA;AAAA,MACxD;AACA,MAAA,IAAI;AACF,QAAA,GAAA,CAAI,UAAU,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA;AAC5C,QAAA,IAAA,EAAK;AAAA,MACP,CAAA,CAAA,MAAQ;AAEN,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,CAAA;AAAA,MAChD;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEA,sBAAsB,IAAA,EAAc;AAClC,IAAA,OAAO,CAAC,GAAA,EAAU,GAAA,EAAU,IAAA,KAAc;AACxC,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,OAAA,EAAS,IAAI,CAAA;AAClC,QAAA,IAAA,EAAK;AAAA,MACP,CAAA,CAAA,MAAQ;AACN,QAAA,GAAA,CAAI,OAAO,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAAA,MAC7C;AAAA,IACF,CAAA;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import { randomUUID, randomBytes } from 'crypto';\nimport * as jwt from 'jsonwebtoken';\nimport * as bcrypt from 'bcryptjs';\nimport { z } from 'zod';\nimport { AuthConfig, User, Session } from '../types/index.js';\nimport { Collection } from '../orm/Collection.js';\nimport { existsSync, readFileSync } from 'fs';\n\nconst UserSchema = z.object({\n  email: z.string().email(),\n  passwordHash: z.string(),\n  roles: z.array(z.string()).default(['user']),\n  metadata: z.record(z.unknown()).optional(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\n\n// TODO(security): Consider adding OAuth 2.0 provider support (e.g., Google, GitHub).\n// TODO(security): Consider adding MFA (TOTP/WebAuthn) for high-security deployments.\n// TODO(security): Consider adding pwned-password checking via haveibeenpwned.com API.\n\n/**\n * Resolve JWT secret with multi-tiered fallback:\n * 1. Explicit config value\n * 2. Environment variable\n * 3. Local jwt_secret.txt file\n * 4. Ephemeral random generation with warning (NOT suitable for multi-instance prod)\n *\n * MUST NOT hardcode or use default literal fallbacks.\n */\nfunction resolveJwtSecret(configSecret?: string): string {\n  if (configSecret) return configSecret;\n  if (process.env['JWT_SECRET']) return process.env['JWT_SECRET'];\n  const secretFile = './jwt_secret.txt';\n  if (existsSync(secretFile)) return readFileSync(secretFile, 'utf-8').trim();\n  const ephemeral = randomBytes(32).toString('hex');\n  console.warn(\n    '[gramobase Auth] WARNING: No JWT_SECRET provided. Using an ephemeral random secret. ' +\n    'Tokens will be invalidated on restart. Set JWT_SECRET env variable for production!'\n  );\n  return ephemeral;\n}\n\n/**\n * Validate password strength (min 8 chars, no maximum).\n * Does not require specific character types — users choose their own strong passwords.\n */\nfunction validatePasswordStrength(password: string): void {\n  if (password.length < 8) {\n    throw new Error('[Auth] Password must be at least 8 characters long');\n  }\n  // TODO(security): Consider rejecting known breached passwords via HaveIBeenPwned API.\n}\n\nexport class GramoBaseAuth {\n  private readonly DEFAULT_ROUNDS = 12;\n  private readonly resolvedSecret: string;\n\n  constructor(\n    private users: Collection<typeof UserSchema>,\n    private config: AuthConfig\n  ) {\n    // Resolve secret at construction time; fail safely if no secret available\n    this.resolvedSecret = resolveJwtSecret(config.jwtSecret);\n  }\n\n  // ─── Registration ─────────────────────────────────────────────────────\n\n  async register(\n    email: string,\n    password: string,\n    roles: string[] = ['user'],\n    metadata?: Record<string, unknown>\n  ): Promise<{ user: User; session: Session }> {\n    // Validate email format (basic — Zod schema handles full validation)\n    if (!email || typeof email !== 'string') {\n      throw new Error('[Auth] Invalid email');\n    }\n\n    // Validate password strength\n    validatePasswordStrength(password);\n\n    const existing = await this.users.findOne({ email: { $eq: email } } as any);\n    if (existing) throw new Error('[Auth] Email already registered');\n\n    const passwordHash = await bcrypt.hash(\n      password,\n      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS\n    );\n\n    const now = new Date().toISOString();\n    const doc = await this.users.insertOne({\n      email,\n      passwordHash,\n      roles,\n      metadata,\n      createdAt: now,\n      updatedAt: now,\n    });\n\n    const user = doc as unknown as User;\n    const session = this.createSession(user);\n    await this.config.onSignIn?.(user);\n\n    return { user, session };\n  }\n\n  // ─── Login ────────────────────────────────────────────────────────────\n\n  async login(email: string, password: string): Promise<{ user: User; session: Session }> {\n    const doc = await this.users.findOne({ email: { $eq: email } } as any);\n    if (!doc) {\n      // Use constant-time comparison to avoid timing attacks on email existence\n      await bcrypt.compare(password, '$2a$12$invalidhashtopreventtimingattacks');\n      throw new Error('[Auth] Invalid credentials');\n    }\n\n    const user = doc as unknown as User;\n    const valid = await bcrypt.compare(password, user.passwordHash);\n    if (!valid) throw new Error('[Auth] Invalid credentials');\n\n    const session = this.createSession(user);\n    await this.config.onSignIn?.(user);\n\n    return { user, session };\n  }\n\n  // ─── Token verification ───────────────────────────────────────────────\n\n  verifyToken(token: string): Session {\n    try {\n      // Hardcode algorithm to prevent algorithm confusion attacks; reject 'none'\n      const payload = jwt.verify(token, this.resolvedSecret, {\n        algorithms: ['HS256'],\n      }) as Session;\n      return payload;\n    } catch {\n      throw new Error('[Auth] Invalid or expired token');\n    }\n  }\n\n  // ─── Role-based access ────────────────────────────────────────────────\n\n  requireRole(session: Session, role: string): void {\n    if (!session.roles.includes(role) && !session.roles.includes('admin')) {\n      throw new Error(`[Auth] Requires role: ${role}`);\n    }\n  }\n\n  requireAnyRole(session: Session, roles: string[]): void {\n    const hasRole = roles.some(\n      (r) => session.roles.includes(r) || session.roles.includes('admin')\n    );\n    if (!hasRole) {\n      throw new Error(`[Auth] Requires one of roles: ${roles.join(', ')}`);\n    }\n  }\n\n  // ─── Password management ──────────────────────────────────────────────\n\n  async changePassword(\n    userId: string,\n    oldPassword: string,\n    newPassword: string\n  ): Promise<void> {\n    const doc = await this.users.findById(userId);\n    if (!doc) throw new Error('[Auth] User not found');\n\n    const user = doc as unknown as User;\n    const valid = await bcrypt.compare(oldPassword, user.passwordHash);\n    if (!valid) throw new Error('[Auth] Old password incorrect');\n\n    // Validate new password strength\n    validatePasswordStrength(newPassword);\n\n    const newHash = await bcrypt.hash(\n      newPassword,\n      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS\n    );\n\n    await this.users.findByIdAndUpdate(userId, {\n      $set: { passwordHash: newHash, updatedAt: new Date().toISOString() } as any,\n    });\n  }\n\n  async resetPassword(userId: string, newPassword: string): Promise<void> {\n    validatePasswordStrength(newPassword);\n    const newHash = await bcrypt.hash(\n      newPassword,\n      this.config.bcryptRounds ?? this.DEFAULT_ROUNDS\n    );\n    await this.users.findByIdAndUpdate(userId, {\n      $set: { passwordHash: newHash, updatedAt: new Date().toISOString() } as any,\n    });\n  }\n\n  // ─── User management ─────────────────────────────────────────────────\n\n  async getUserById(id: string): Promise<User | null> {\n    const doc = await this.users.findById(id);\n    return doc ? (doc as unknown as User) : null;\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    const doc = await this.users.findOne({ email: { $eq: email } } as any);\n    return doc ? (doc as unknown as User) : null;\n  }\n\n  async updateRoles(userId: string, roles: string[]): Promise<void> {\n    await this.users.findByIdAndUpdate(userId, {\n      $set: { roles, updatedAt: new Date().toISOString() } as any,\n    });\n  }\n\n  async deleteUser(userId: string): Promise<void> {\n    await this.users.deleteById(userId);\n    await this.config.onSignOut?.(userId);\n  }\n\n  // ─── Session helpers ──────────────────────────────────────────────────\n\n  private createSession(user: User): Session {\n    const expiresIn = this.config.jwtExpiresIn ?? '7d';\n    const payload: Omit<Session, 'token'> & { sub: string } = {\n      sub: user._id,\n      userId: user._id,\n      roles: user.roles,\n      expiresAt: Date.now() + this.parseExpiry(expiresIn),\n    };\n\n    // Sign with hardcoded HS256 algorithm; 'none' algorithm is never used\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const token = (jwt.sign as any)(payload, this.resolvedSecret, {\n      expiresIn,\n      algorithm: 'HS256',\n    }) as string;\n    return { ...payload, token };\n  }\n\n  private parseExpiry(s: string): number {\n    const n = parseInt(s);\n    if (s.endsWith('d')) return n * 86400_000;\n    if (s.endsWith('h')) return n * 3600_000;\n    if (s.endsWith('m')) return n * 60_000;\n    return n * 1000;\n  }\n\n  // ─── Middleware factory (Express/Fastify compatible) ──────────────────\n\n  middleware() {\n    return (req: any, res: any, next: any) => {\n      const auth = req.headers['authorization'] as string | undefined;\n      if (!auth?.startsWith('Bearer ')) {\n        return res.status(401).json({ error: 'Missing token' });\n      }\n      try {\n        req.session = this.verifyToken(auth.slice(7));\n        next();\n      } catch {\n        // Do NOT expose error details to client; log internally if needed\n        res.status(401).json({ error: 'Unauthorized' });\n      }\n    };\n  }\n\n  requireRoleMiddleware(role: string) {\n    return (req: any, res: any, next: any) => {\n      try {\n        this.requireRole(req.session, role);\n        next();\n      } catch {\n        res.status(403).json({ error: 'Forbidden' });\n      }\n    };\n  }\n}\n"]}