maxibase 0.0.0-stage → 1.0.0

package/layers/base/app/utils/files.ts

@@ -0,0 +1,95 @@
+export async function uploadFiles(
+  files: File[],
+  path: string,
+  isPrivate: boolean,
+  onProgress?: (progress: number) => void,
+) {
+  let totalSize = files.reduce((sum, f) => sum + f.size, 0)
+
+  onProgress?.(1)
+  let urls: string[] = []
+  if (totalSize <= getChunkSize()) {
+    const formData = new FormData()
+    files.forEach((file) => formData.append('file', file))
+    formData.append('path', path)
+    formData.append('isPrivate', String(isPrivate))
+    urls = await postFiles(formData)
+  } else {
+    let uploadedSize = 0
+    for (const file of files) {
+      if (file.size <= getChunkSize()) {
+        const formData = new FormData()
+        formData.append('file', file)
+        formData.append('path', path)
+        formData.append('isPrivate', String(isPrivate))
+        urls.push(...(await postFiles(formData)))
+        uploadedSize += file.size
+        const progress = (uploadedSize / totalSize) * 100
+        onProgress?.(Math.round(progress))
+      } else {
+        const onChunkProgress = (chunkUploaded: number) => {
+          uploadedSize += chunkUploaded
+          const progress = (uploadedSize / totalSize) * 100
+          onProgress?.(Math.round(progress))
+        }
+        const url = await uploadInChunks(file, path, isPrivate, onChunkProgress)
+        if (url) urls.push(url)
+      }
+    }
+  }
+  onProgress?.(100)
+  return urls
+}
+
+async function postFiles(body: FormData): Promise<string[]> {
+  const urls = await $fetch('/api/files', { method: 'POST', body })
+  return urls.filter((url): url is string => !!url)
+}
+
+export async function uploadInChunks(
+  file: File,
+  path: string,
+  isPrivate: boolean,
+  onProgress?: (progress: number) => void,
+) {
+  let uploadId
+  let parts: any[] = []
+  const chunkSize = getChunkSize()
+  const totalChunks = Math.ceil(file.size / chunkSize)
+  let result: any
+
+  for (let i = 0; i < totalChunks; i++) {
+    const start = i * chunkSize
+    const formData = new FormData()
+    formData.append('chunk', file.slice(start, start + chunkSize))
+    formData.append('type', file.type)
+    formData.append('uploadId', uploadId || '')
+    formData.append('parts', JSON.stringify(parts))
+    formData.append('chunkIndex', String(i))
+    formData.append('totalChunks', String(totalChunks))
+    formData.append('filename', file.name)
+    formData.append('path', path)
+    formData.append('isPrivate', String(isPrivate))
+
+    result = await $fetch('/api/files/chunk', { method: 'POST', body: formData })
+    if (i + 1 < totalChunks) {
+      uploadId = result.uploadId
+      parts = result.parts
+    }
+    onProgress?.(Math.min(chunkSize, file.size - start)) // bytes added by this chunk
+  }
+
+  return result
+}
+
+export function getChunkSize() {
+  const config = useRuntimeConfig()
+  return (Number(config.public.files.chunkSize) || 1) * 1024 * 1024 // 1MB
+}
+
+export function deleteFiles(path: string, isPrivate?: boolean) {
+  return $fetch('/api/files', {
+    method: 'DELETE',
+    body: { path, isPrivate },
+  })
+}

package/layers/base/app/utils/image.ts

@@ -0,0 +1,33 @@
+export async function formatImage(
+  file: File,
+  maxHeight?: number,
+  format: string = 'webp',
+  quality: number = 0.8,
+): Promise<File> {
+  if (file.type === 'image/svg+xml') return file
+
+  const bitmap = await createImageBitmap(file, { imageOrientation: 'from-image' })
+
+  try {
+    const ratio = maxHeight ? Math.min(1, maxHeight / bitmap.height) : 1
+    if (ratio === 1 && file.type === `image/${format}`) return file
+
+    const canvas = document.createElement('canvas')
+    canvas.width = Math.round(bitmap.width * ratio)
+    canvas.height = Math.round(bitmap.height * ratio)
+    const ctx = canvas.getContext('2d')
+    if (!ctx) throw new Error('no canvas')
+
+    ctx.drawImage(bitmap, 0, 0, canvas.width, canvas.height)
+    const blob = await new Promise<Blob | null>((resolve) =>
+      canvas.toBlob(resolve, `image/${format}`, quality),
+    )
+    if (!blob) throw new Error('blob failed')
+
+    return new File([blob], `${file.name.replace(/\.[^./\\]+$/, '')}.${blob.type.split('/')[1]}`, {
+      type: blob.type,
+    })
+  } finally {
+    bitmap.close()
+  }
+}

package/layers/base/nuxt.config.ts

@@ -0,0 +1,146 @@
+// https://nuxt.com/docs/api/configuration/nuxt-config
+import { existsSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+const authTypes = { path: fileURLToPath(new URL('./shared/types/auth.d.ts', import.meta.url)) }
+
+export default defineNuxtConfig({
+  routeRules: {
+    '/images/auth/**': { headers: { 'cache-control': 'public, max-age=31536000, immutable' } },
+  },
+  runtimeConfig: {
+    public: {
+      anonymousSignup: false,
+      password: {
+        min: 16,
+        max: 64,
+      },
+      refreshToken: {
+        rotateAfter: 60 * 60 * 24, // 1 day
+      },
+      recentAuth: {
+        maxAge: 300, // 5 minutes
+      },
+      oauth: {
+        microsoft: false,
+      },
+      files: {
+        url: '/files',
+        chunkSize: 5, // in MB
+      },
+    },
+    session: {
+      maxAge: 3600, // 1 hour
+      password: '',
+      unique: false,
+    },
+    oauth: {
+      microsoft: {
+        clientId: '',
+        clientSecret: '',
+        tenant: 'common',
+      },
+    },
+    refreshToken: {
+      maxAge: 60 * 60 * 24 * 30, // 30 days
+    },
+    autoSignup: false,
+    forceMfa: false,
+    db: '',
+    smtp: {
+      host: '',
+      port: 465,
+      user: '',
+      pass: '',
+      from: '',
+    },
+    filesPublicFolder: 'files/public',
+    filesPrivateFolder: 'files/private',
+    s3: {
+      redirect: true,
+      endpoint: '',
+      region: 'us-east-1',
+      publicBucket: '',
+      privateBucket: '',
+      accessKeyId: '',
+      secretAccessKey: '',
+    },
+    backup: {
+      dumpArgs: '-F c',
+      retentionDays: 30,
+      agePublicKey: '', // age public key to encrypt backups
+    },
+    logs: {
+      retentionDays: 90,
+    },
+    rateLimit: {
+      enabled: true,
+      banMultiplier: 5, // banned after limit × multiplier requests in one window
+      banSeconds: 3600,
+      // Number of reverse proxies in front of the app. Set to 0 when directly exposed, else
+      // clients can spoof x-forwarded-for and bypass every limit below.
+      trustedProxies: 1,
+    },
+  },
+  nitro: {
+    experimental: {
+      tasks: true,
+    },
+    scheduledTasks: {
+      '0 3 * * *': 'backup',
+      '0 2 1 * *': 'clean',
+    },
+    storage: {
+      auth: {
+        driver: 'memory',
+      },
+    },
+    serverAssets: [
+      { baseName: 'base', dir: fileURLToPath(new URL('../../server/assets', import.meta.url)) },
+    ],
+  },
+  i18n: {
+    locales: [{ code: 'en' }, { code: 'fr' }],
+    defaultLocale: 'en',
+    translationDir: 'locales',
+    localeCookie: 'user-locale',
+  },
+  auth: {
+    webAuthn: true,
+  },
+  compatibilityDate: '2025-07-15',
+  devtools: { enabled: true },
+  modules: [
+    '@nuxt/hints',
+    '@nuxt/icon',
+    'nuxt-auth-utils',
+    '@pinia/nuxt',
+    'nuxt-i18n-micro',
+    (_, nuxt) => {
+      // #database/{name} is the project's server/database/{name}.ts, else the layer's default
+      for (const name of ['db', 'relations', 'access']) {
+        const own = `${nuxt.options.serverDir}/database/${name}`
+        nuxt.options.alias[`#database/${name}`] = existsSync(`${own}.ts`)
+          ? own
+          : fileURLToPath(new URL(`./server/database/defaults/${name}`, import.meta.url))
+      }
+    },
+  ],
+  pinia: {
+    storesDirs: ['stores'],
+  },
+  vite: {
+    optimizeDeps: {
+      include: ['qrcode'],
+    },
+  },
+  hooks: {
+    'prepare:types': ({ references, sharedReferences }) => {
+      references.push(authTypes)
+      sharedReferences.push(authTypes)
+    },
+    'nitro:prepare:types': ({ references }) => {
+      references.push(authTypes)
+    },
+  },
+})

package/layers/base/public/images/auth/microsoft.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="21" height="21" viewBox="0 0 21 21"><title>MS-SymbolLockup</title><rect x="1" y="1" width="9" height="9" fill="#f25022"/><rect x="1" y="11" width="9" height="9" fill="#00a4ef"/><rect x="11" y="1" width="9" height="9" fill="#7fba00"/><rect x="11" y="11" width="9" height="9" fill="#ffb900"/></svg>

package/layers/base/public/robots.txt

@@ -0,0 +1,2 @@
+User-Agent: *
+Disallow: /

package/layers/base/server/api/admin/logs.get.ts

@@ -0,0 +1,49 @@
+import z from 'zod'
+
+const querySchema = z.object({
+  from: z.iso.datetime(),
+  to: z.iso.datetime(),
+  search: z.string().optional(),
+  type: z.enum(logTypeValues).optional().catch(undefined),
+  limit: z.coerce.number().int().positive().max(2000).default(200),
+})
+
+export default defineEventHandler(async (event) => {
+  const query = getQuery(event)
+  const { from, to, search, type, limit } = querySchema.parse(query)
+  const text = prepareStringForSearch(search)
+
+  const rows = await db.query.logs.findMany({
+    where: {
+      time: {
+        gte: new Date(from),
+        lte: new Date(to),
+      },
+      type: type ? { eq: type } : undefined,
+      OR: text
+        ? [
+            { summary: { ilike: text } },
+            { origin: { ilike: text } },
+            { auth: { email: { ilike: text } } },
+          ]
+        : undefined,
+    },
+    orderBy: {
+      time: 'desc',
+    },
+    limit: limit + 1,
+    with: {
+      auth: {
+        columns: {
+          email: true,
+        },
+      },
+    },
+  })
+
+  return {
+    logs: rows.slice(0, limit),
+    hasMore: rows.length > limit,
+    limit,
+  }
+})

package/layers/base/server/api/auth/anonymous.post.ts

@@ -0,0 +1,31 @@
+import { auth } from '#server/database/schema'
+
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const session = await getUserSession(event)
+  if (session?.user || !config.public.anonymousSignup) {
+    throw createError({
+      status: 403,
+      message: 'Anonymous signup not allowed',
+    })
+  }
+  if (config.forceMfa) {
+    throw createError({
+      status: 403,
+      message: 'Anonymous signup not allowed when MFA is required',
+    })
+  }
+
+  const insertedUsers = await db.insert(auth).values({}).returning()
+
+  if (!insertedUsers[0]) {
+    throw createError({
+      status: 500,
+      message: 'Anonymous user creation failed',
+    })
+  }
+
+  const user = insertedUsers[0]
+
+  return setSession(event, user)
+})

package/layers/base/server/api/auth/email/get.post.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod'
+import { generateOTP, type OTP } from '../otp/get.post'
+
+const bodySchema = z.object({
+  email: emailSchema,
+  locale: z.string().optional(),
+})
+
+export function emailChangeKey(userId: string, email: string) {
+  return `change:${userId}:${email.trim().toLowerCase()}`
+}
+
+export default defineEventHandler(async (event) => {
+  await requireUserSession(event)
+  const { email, locale = 'en' } = await readValidatedBody(event, bodySchema.parse)
+  const user = await getAuth(event)
+
+  if (user.email === email) {
+    throw createError({ status: 400, message: 'This is already your email address.' })
+  }
+
+  const storage = useStorage('auth')
+  const key = emailChangeKey(user.id, email)
+  const record = await storage.getItem<OTP>(key)
+  if (record && Date.now() < record.sentAt + 60000) {
+    throw createError({ status: 400, message: 'Wait a minute before requesting a new code.' })
+  }
+
+  const otp = generateOTP()
+  await storage.setItem(key, {
+    otp: await hashPassword(otp),
+    attempts: 0,
+    sentAt: Date.now(),
+  })
+
+  try {
+    return await sendEmailTemplate('emailChange', locale, { otp }, email)
+  } catch (error) {
+    await storage.removeItem(key)
+    throw createError({
+      status: 502,
+      message: 'Could not send the email. Please try again.',
+      cause: error,
+    })
+  }
+})

package/layers/base/server/api/auth/email/verify.post.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod'
+import { eq } from 'drizzle-orm'
+import { auth } from '#server/database/schema'
+import { verifyOTP } from '../otp/verify.post'
+import { emailChangeKey } from './get.post'
+
+const bodySchema = z.object({
+  email: emailSchema,
+  otp: z.string().length(6),
+  locale: z.string().optional(),
+})
+
+export default defineEventHandler(async (event) => {
+  const { email, otp, locale = 'en' } = await readValidatedBody(event, bodySchema.parse)
+  await requireRecentAuth(event)
+  const user = await getAuth(event)
+  const previousEmail = user.email
+
+  await verifyOTP(emailChangeKey(user.id, email), otp)
+
+  const updated = await db
+    .update(auth)
+    .set({ email })
+    .where(eq(auth.id, user.id))
+    .returning()
+    .catch((error: any) => {
+      // 23505: unique violation
+      if (error?.cause?.code === '23505' || error?.code === '23505') {
+        throw createError({ status: 409, message: 'This email address is already in use.' })
+      }
+      throw error
+    })
+
+  if (!updated[0]) {
+    throw createError({ status: 500, message: 'User update failed' })
+  }
+
+  await log('Email changed', { from: previousEmail, to: email }, undefined, 'security', event)
+
+  if (previousEmail) {
+    await sendEmailTemplate('emailChanged', locale, { email }, previousEmail).catch(() => {})
+  }
+
+  await revokeAllUserTokens(user.id)
+  await setSession(event, updated[0])
+})

package/layers/base/server/api/auth/index.get.ts

@@ -0,0 +1,10 @@
+export default defineEventHandler(async (event) => {
+  await requireUserSession(event)
+  const user = await getAuth(event, undefined, true)
+  return {
+    credentials: user.credentials!.map(({ id, name }) => ({ id, name })),
+    hasPassword: !!user.password,
+    hasTOTP: !!user.totp,
+    forceMfa: useRuntimeConfig().forceMfa,
+  }
+})

package/layers/base/server/api/auth/index.post.ts

@@ -0,0 +1,19 @@
+import { eq } from 'drizzle-orm/sql/expressions/conditions'
+import { z } from 'zod'
+import { auth } from '#server/database/schema'
+
+export default defineEventHandler(async (event) => {
+  const { password } = await readValidatedBody(
+    event,
+    z.object({
+      password: passwordSchema(),
+    }).parse,
+  )
+  const session = await requireRecentAuth(event)
+  await db
+    .update(auth)
+    .set({
+      password: await hashPassword(password),
+    })
+    .where(eq(auth.id, session.user.id))
+})

package/layers/base/server/api/auth/options.post.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod'
+
+const bodySchema = z.object({
+  email: emailSchema,
+})
+
+export default defineEventHandler(async (event) => {
+  const { email } = await readValidatedBody(event, bodySchema.parse)
+
+  try {
+    const user = await getAuth(event, email, true)
+    return {
+      hasOTP: true,
+      hasPassword: !!user.password,
+      hasTOTP: !!user.totp,
+      hasPasskey: user.credentials!.length > 0,
+    }
+  } catch {
+    return {
+      hasOTP: true,
+      hasPassword: false,
+      hasTOTP: false,
+      hasPasskey: false,
+    }
+  }
+})

package/layers/base/server/api/auth/otp/get.post.ts

@@ -0,0 +1,74 @@
+import { z } from 'zod'
+import crypto from 'crypto'
+
+const bodySchema = z.object({
+  email: emailSchema,
+  locale: z.string().optional(),
+  goto: z.string().optional(),
+  path: z.string().optional(),
+})
+
+export interface OTP {
+  otp: string
+  token?: string // magic link only, absent on flows that issue no link
+  attempts: number
+  sentAt: number
+}
+
+export default defineEventHandler(async (event) => {
+  const {
+    email,
+    locale = 'en',
+    goto,
+    path = 'signin',
+  } = await readValidatedBody(event, bodySchema.parse)
+  if (!email || typeof email !== 'string') {
+    throw createError({
+      status: 400,
+      message: 'Email is required',
+    })
+  }
+
+  const storage = useStorage('auth')
+  const record = await storage.getItem<OTP>(email)
+  if (record && Date.now() < record.sentAt! + 60000) {
+    throw createError({ status: 400, message: 'Wait a minute before requesting a new OTP.' })
+  }
+
+  const baseUrl = useRuntimeConfig().public.url.replace(/\/+$/, '')
+  const magicLinkPath = safePath(path.startsWith('/') ? path : `/${path}`, '/signin')
+  const linkGoto = goto ? safePath(goto, '') : ''
+
+  const otp = generateOTP()
+  const token = crypto.randomBytes(32).toString('base64url')
+  await storage.setItem(email, {
+    otp: await hashPassword(otp),
+    attempts: 0,
+    sentAt: Date.now(),
+    token: await hashPassword(token),
+  })
+
+  try {
+    return await sendEmailTemplate(
+      'otp',
+      locale,
+      {
+        otp,
+        magicLink: `${baseUrl}${magicLinkPath}?email=${encodeURIComponent(email)}&token=${token}${linkGoto ? `&goto=${encodeURIComponent(linkGoto)}` : ''}`,
+      },
+      email,
+    )
+  } catch (error) {
+    await storage.removeItem(email)
+    throw createError({
+      status: 502,
+      message: 'Could not send the email. Please try again.',
+      cause: error,
+    })
+  }
+})
+
+export function generateOTP(length = 6): string {
+  const otp = crypto.randomInt(Math.pow(10, length - 1), Math.pow(10, length))
+  return otp.toString()
+}

package/layers/base/server/api/auth/otp/verify.post.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod'
+import type { OTP } from './get.post'
+
+const bodySchema = z.object({
+  email: emailSchema,
+  otp: z.string().length(6).or(z.string().min(32)),
+})
+
+export default defineEventHandler(async (event) => {
+  const { email, otp } = await readValidatedBody(event, bodySchema.parse)
+  if (!email || !otp) {
+    throw createError({
+      status: 400,
+      message: 'Email and OTP are required',
+    })
+  }
+  await verifyOTP(email, otp)
+
+  const session = await getUserSession(event)
+  if (session?.user?.isAnonymous) {
+    let user: any = await getAuth(event, email).catch(() => null)
+    if (!user) {
+      user = {
+        id: session.user.id,
+        email,
+      }
+      await setAuth(user)
+    }
+    return await setSession(event, user)
+  }
+
+  const user = await getAuth(event, email).catch((error) => {
+    const config = useRuntimeConfig()
+
+    if (error.statusCode === 404 && config.autoSignup) {
+      return createAuth({ email })
+    }
+    throw error
+  })
+  if (user.totp) {
+    throw createError({
+      status: 401,
+      message: 'TOTP required',
+    })
+  }
+  await setSession(event, user)
+})
+
+const MAX_OTP_ATTEMPTS = 3
+
+export async function verifyOTP(email: string, otp: string): Promise<void> {
+  const storage = useStorage('auth')
+  const record = await storage.getItem<OTP>(email)
+  if (!record) {
+    throw createError({ status: 400, message: 'Request a new OTP.' })
+  }
+  if (Date.now() > record.sentAt! + 5 * 60 * 1000 || record.attempts >= MAX_OTP_ATTEMPTS) {
+    await storage.removeItem(email)
+    throw createError({ status: 400, message: 'Request a new OTP.' })
+  }
+
+  const hash = otp.length > 6 ? record.token : record.otp
+  if (hash && (await verifyPassword(hash, otp))) {
+    await storage.removeItem(email)
+  } else {
+    record.attempts++
+    await storage.setItem(email, record)
+    throw createError({ status: 400, message: 'Invalid OTP.' })
+  }
+}