myaidev-method 0.2.7 → 0.2.9

package/src/server/auth/services/example.ts

@@ -0,0 +1,346 @@
+/**
+ * Example usage of authentication services
+ *
+ * This file demonstrates how to use all authentication services together
+ * following Effect-TS patterns from the ccviewer codebase.
+ */
+
+import { Effect, Layer } from "effect";
+import { DatabaseService } from "../../database/db.js";
+import {
+  PasswordService,
+  TokenService,
+  UserRepository,
+  SessionRepository,
+  AuditLogService,
+  type CreateUserData,
+} from "./index.js";
+
+// Example: Complete user registration flow
+export const registerUser = (
+  username: string,
+  email: string,
+  password: string,
+  linuxUsername: string,
+  ipAddress: string | null,
+  userAgent: string | null
+) =>
+  Effect.gen(function* (_) {
+    // Get services
+    const passwordService = yield* _(PasswordService);
+    const userRepo = yield* _(UserRepository);
+    const auditLog = yield* _(AuditLogService);
+
+    // Validate password strength
+    yield* _(passwordService.validatePasswordStrength(password));
+
+    // Hash the password
+    const passwordHash = yield* _(passwordService.hash(password));
+
+    // Create user data
+    const userData: CreateUserData = {
+      username,
+      email,
+      passwordHash,
+      linuxUsername,
+    };
+
+    // Create user in database
+    const user = yield* _(userRepo.create(userData));
+
+    // Log the registration
+    yield* _(
+      auditLog.log({
+        userId: user.id,
+        action: "USER_REGISTERED",
+        ipAddress,
+        userAgent,
+        details: JSON.stringify({ username, email }),
+      })
+    );
+
+    return user;
+  });
+
+// Example: Complete login flow
+export const loginUser = (
+  email: string,
+  password: string,
+  ipAddress: string | null,
+  userAgent: string | null
+) =>
+  Effect.gen(function* (_) {
+    // Get services
+    const passwordService = yield* _(PasswordService);
+    const tokenService = yield* _(TokenService);
+    const userRepo = yield* _(UserRepository);
+    const sessionRepo = yield* _(SessionRepository);
+    const auditLog = yield* _(AuditLogService);
+
+    // Find user by email
+    const user = yield* _(userRepo.findByEmail(email));
+
+    if (!user) {
+      // Log failed login attempt
+      yield* _(
+        auditLog.log({
+          userId: null,
+          action: "LOGIN_FAILED",
+          ipAddress,
+          userAgent,
+          details: JSON.stringify({ email, reason: "User not found" }),
+        })
+      );
+      return yield* _(
+        Effect.fail(new Error("Invalid email or password"))
+      );
+    }
+
+    // Check if user is active
+    if (!user.isActive) {
+      yield* _(
+        auditLog.log({
+          userId: user.id,
+          action: "LOGIN_FAILED",
+          ipAddress,
+          userAgent,
+          details: JSON.stringify({ reason: "Account inactive" }),
+        })
+      );
+      return yield* _(Effect.fail(new Error("Account is inactive")));
+    }
+
+    // Check if password hash exists
+    if (!user.passwordHash) {
+      yield* _(
+        auditLog.log({
+          userId: user.id,
+          action: "LOGIN_FAILED",
+          ipAddress,
+          userAgent,
+          details: JSON.stringify({ reason: "No password set" }),
+        })
+      );
+      return yield* _(Effect.fail(new Error("Invalid email or password")));
+    }
+
+    // Verify password
+    const isValid = yield* _(
+      passwordService.verify(password, user.passwordHash)
+    );
+
+    if (!isValid) {
+      // Increment failed login attempts
+      yield* _(userRepo.incrementFailedLogins(user.id));
+
+      yield* _(
+        auditLog.log({
+          userId: user.id,
+          action: "LOGIN_FAILED",
+          ipAddress,
+          userAgent,
+          details: JSON.stringify({ reason: "Invalid password" }),
+        })
+      );
+      return yield* _(Effect.fail(new Error("Invalid email or password")));
+    }
+
+    // Reset failed login attempts on successful login
+    yield* _(userRepo.resetFailedLogins(user.id));
+
+    // Generate JWT token
+    const tokenPayload = {
+      sub: user.id,
+      username: user.username,
+      email: user.email,
+      jti: "", // Will be set to session ID
+    };
+
+    const token = yield* _(tokenService.generateToken(tokenPayload));
+
+    // Hash the token for storage
+    const tokenHash = yield* _(tokenService.hashToken(token));
+
+    // Verify token to get the actual payload with jti
+    const verifiedPayload = yield* _(tokenService.verifyToken(token));
+
+    // Create session
+    const session = yield* _(
+      sessionRepo.create({
+        userId: user.id,
+        tokenHash,
+        ipAddress,
+        userAgent,
+        expiresAt: verifiedPayload.exp * 1000, // Convert to milliseconds
+      })
+    );
+
+    // Update last login timestamp
+    yield* _(
+      userRepo.update(user.id, {
+        lastLoginAt: Date.now(),
+      })
+    );
+
+    // Log successful login
+    yield* _(
+      auditLog.log({
+        userId: user.id,
+        action: "USER_LOGIN",
+        resourceType: "session",
+        resourceId: session.id,
+        ipAddress,
+        userAgent,
+      })
+    );
+
+    return { user, token, session };
+  });
+
+// Example: Verify and validate a token
+export const verifyToken = (token: string) =>
+  Effect.gen(function* (_) {
+    const tokenService = yield* _(TokenService);
+    const sessionRepo = yield* _(SessionRepository);
+    const userRepo = yield* _(UserRepository);
+
+    // Verify token signature and expiration
+    const payload = yield* _(tokenService.verifyToken(token));
+
+    // Hash the token to look up session
+    const tokenHash = yield* _(tokenService.hashToken(token));
+
+    // Find session by token hash
+    const session = yield* _(sessionRepo.findByTokenHash(tokenHash));
+
+    if (!session) {
+      return yield* _(Effect.fail(new Error("Session not found")));
+    }
+
+    // Check if session is revoked
+    if (session.isRevoked) {
+      return yield* _(Effect.fail(new Error("Session has been revoked")));
+    }
+
+    // Check if session is expired
+    if (session.expiresAt < Date.now()) {
+      return yield* _(Effect.fail(new Error("Session has expired")));
+    }
+
+    // Get user
+    const user = yield* _(userRepo.findById(payload.sub));
+
+    if (!user) {
+      return yield* _(Effect.fail(new Error("User not found")));
+    }
+
+    if (!user.isActive) {
+      return yield* _(Effect.fail(new Error("User account is inactive")));
+    }
+
+    return { user, session, payload };
+  });
+
+// Example: Logout user
+export const logoutUser = (token: string) =>
+  Effect.gen(function* (_) {
+    const tokenService = yield* _(TokenService);
+    const sessionRepo = yield* _(SessionRepository);
+    const auditLog = yield* _(AuditLogService);
+
+    // Verify token
+    const payload = yield* _(tokenService.verifyToken(token));
+
+    // Hash token to find session
+    const tokenHash = yield* _(tokenService.hashToken(token));
+
+    // Find session
+    const session = yield* _(sessionRepo.findByTokenHash(tokenHash));
+
+    if (!session) {
+      return yield* _(Effect.fail(new Error("Session not found")));
+    }
+
+    // Revoke session
+    yield* _(sessionRepo.revoke(session.id));
+
+    // Log logout
+    yield* _(
+      auditLog.log({
+        userId: payload.sub,
+        action: "USER_LOGOUT",
+        resourceType: "session",
+        resourceId: session.id,
+      })
+    );
+
+    return { success: true };
+  });
+
+// Example: Create the complete authentication layer
+export const AuthenticationLayer = Layer.mergeAll(
+  PasswordService.Live,
+  TokenService.Live,
+  UserRepository.Live,
+  SessionRepository.Live,
+  AuditLogService.Live
+);
+
+// Example: Run a complete authentication flow with all dependencies
+export const runAuthExample = () => {
+  const program = Effect.gen(function* (_) {
+    // Register a new user
+    const user = yield* _(
+      registerUser(
+        "johndoe",
+        "john@example.com",
+        "SecurePass123",
+        "john-doe",
+        "127.0.0.1",
+        "Mozilla/5.0"
+      )
+    );
+
+    console.log("User registered:", user);
+
+    // Login the user
+    const loginResult = yield* _(
+      loginUser(
+        "john@example.com",
+        "SecurePass123",
+        "127.0.0.1",
+        "Mozilla/5.0"
+      )
+    );
+
+    console.log("Login successful:", loginResult);
+
+    // Verify the token
+    const verifyResult = yield* _(verifyToken(loginResult.token));
+
+    console.log("Token verified:", verifyResult);
+
+    // Logout the user
+    const logoutResult = yield* _(logoutUser(loginResult.token));
+
+    console.log("Logout successful:", logoutResult);
+  });
+
+  // Create database configuration
+  const dbConfig = {
+    path: "./auth-example.db",
+  };
+
+  // Combine all layers - properly merging DatabaseService with AuthenticationLayer
+  const AppLayer = DatabaseService.Live(dbConfig).pipe(
+    Layer.provideMerge(AuthenticationLayer)
+  );
+
+  // Run the program with all dependencies provided
+  // Effect-TS Layer type inference limitation
+  // @ts-ignore
+  return Effect.runPromise(Effect.provide(program, AppLayer));
+};
+
+// Uncomment to run the example:
+// runAuthExample().catch(console.error);

package/src/server/auth/services/index.ts

@@ -0,0 +1,6 @@
+// Export all authentication services
+export * from "./PasswordService.js";
+export * from "./TokenService.js";
+export * from "./UserRepository.js";
+export * from "./SessionRepository.js";
+export * from "./AuditLogService.js";

package/src/server/database/db.ts

@@ -0,0 +1,161 @@
+import Database from "better-sqlite3";
+import { Context, Effect, Layer } from "effect";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+export class DatabaseError {
+  readonly _tag = "DatabaseError";
+  constructor(readonly message: string, readonly cause?: unknown) {}
+}
+
+export interface DatabaseConfig {
+  readonly path: string;
+  readonly readOnly?: boolean;
+  readonly fileMustExist?: boolean;
+  readonly timeout?: number;
+  readonly verbose?: boolean;
+}
+
+export class DatabaseService extends Context.Tag("DatabaseService")<
+  DatabaseService,
+  {
+    readonly db: Database.Database;
+    readonly run: <T = Database.RunResult>(
+      sql: string,
+      params?: unknown[]
+    ) => Effect.Effect<T, DatabaseError>;
+    readonly get: <T = unknown>(
+      sql: string,
+      params?: unknown[]
+    ) => Effect.Effect<T | undefined, DatabaseError>;
+    readonly all: <T = unknown>(
+      sql: string,
+      params?: unknown[]
+    ) => Effect.Effect<T[], DatabaseError>;
+    readonly exec: (sql: string) => Effect.Effect<void, DatabaseError>;
+    readonly close: () => Effect.Effect<void, DatabaseError>;
+  }
+>() {
+  static Live = (config: DatabaseConfig) =>
+    Layer.effect(
+      this,
+      Effect.gen(function* (_) {
+        const db = yield* _(
+          Effect.try({
+            try: () => {
+              const options: {
+                readonly?: boolean;
+                fileMustExist?: boolean;
+                timeout?: number;
+                verbose?: (message?: unknown) => void;
+              } = {};
+
+              if (config.readOnly !== undefined) {
+                options.readonly = config.readOnly;
+              }
+              if (config.fileMustExist !== undefined) {
+                options.fileMustExist = config.fileMustExist;
+              }
+              if (config.timeout !== undefined) {
+                options.timeout = config.timeout;
+              }
+              if (config.verbose) {
+                options.verbose = (message?: unknown) => console.log(message);
+              }
+
+              return new Database(config.path, options);
+            },
+            catch: (error) =>
+              new DatabaseError("Failed to open database", error),
+          })
+        );
+
+        yield* _(
+          Effect.try({
+            try: () => {
+              db.pragma("journal_mode = WAL");
+              db.pragma("foreign_keys = ON");
+              db.pragma("synchronous = NORMAL");
+            },
+            catch: (error) =>
+              new DatabaseError("Failed to set pragmas", error),
+          })
+        );
+
+        const schemaPath = join(__dirname, "schema.sql");
+        const schema = yield* _(
+          Effect.try({
+            try: () => readFileSync(schemaPath, "utf-8"),
+            catch: (error) =>
+              new DatabaseError("Failed to read schema file", error),
+          })
+        );
+
+        yield* _(
+          Effect.try({
+            try: () => db.exec(schema),
+            catch: (error) =>
+              new DatabaseError("Failed to initialize schema", error),
+          })
+        );
+
+        const run = <T = Database.RunResult>(
+          sql: string,
+          params?: unknown[]
+        ): Effect.Effect<T, DatabaseError> =>
+          Effect.try({
+            try: () => {
+              const stmt = db.prepare(sql);
+              return stmt.run(...(params ?? [])) as T;
+            },
+            catch: (error) => new DatabaseError("Query execution failed", error),
+          });
+
+        const get = <T = unknown>(
+          sql: string,
+          params?: unknown[]
+        ): Effect.Effect<T | undefined, DatabaseError> =>
+          Effect.try({
+            try: () => {
+              const stmt = db.prepare(sql);
+              return stmt.get(...(params ?? [])) as T | undefined;
+            },
+            catch: (error) => new DatabaseError("Query execution failed", error),
+          });
+
+        const all = <T = unknown>(
+          sql: string,
+          params?: unknown[]
+        ): Effect.Effect<T[], DatabaseError> =>
+          Effect.try({
+            try: () => {
+              const stmt = db.prepare(sql);
+              return stmt.all(...(params ?? [])) as T[];
+            },
+            catch: (error) => new DatabaseError("Query execution failed", error),
+          });
+
+        const exec = (sql: string): Effect.Effect<void, DatabaseError> =>
+          Effect.try({
+            try: () => {
+              db.exec(sql);
+            },
+            catch: (error) => new DatabaseError("Exec failed", error),
+          });
+
+        const close = (): Effect.Effect<void, DatabaseError> =>
+          Effect.try({
+            try: () => {
+              db.close();
+            },
+            catch: (error) => new DatabaseError("Close failed", error),
+          });
+
+        return { db, run, get, all, exec, close };
+      })
+    );
+}

package/src/server/database/schema.sql

@@ -0,0 +1,95 @@
+-- Users table
+CREATE TABLE IF NOT EXISTS users (
+  id TEXT PRIMARY KEY,
+  username TEXT UNIQUE NOT NULL,
+  email TEXT UNIQUE NOT NULL,
+  password_hash TEXT,
+  linux_username TEXT UNIQUE NOT NULL,
+  created_at INTEGER DEFAULT (strftime('%s','now')),
+  updated_at INTEGER DEFAULT (strftime('%s','now')),
+  is_active INTEGER DEFAULT 1,
+  email_verified INTEGER DEFAULT 0,
+  failed_login_attempts INTEGER DEFAULT 0,
+  last_login_at INTEGER,
+  CONSTRAINT username_format CHECK (length(username) >= 3 AND length(username) <= 32),
+  CONSTRAINT email_format CHECK (email LIKE '%_@__%.__%')
+);
+
+-- Index for faster user lookups
+CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
+CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
+CREATE INDEX IF NOT EXISTS idx_users_linux_username ON users(linux_username);
+
+-- OAuth2 providers table
+CREATE TABLE IF NOT EXISTS oauth2_providers (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  provider_user_id TEXT NOT NULL,
+  provider_email TEXT,
+  access_token TEXT,
+  refresh_token TEXT,
+  token_expires_at INTEGER,
+  created_at INTEGER DEFAULT (strftime('%s','now')),
+  updated_at INTEGER DEFAULT (strftime('%s','now')),
+  UNIQUE(provider, provider_user_id),
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+-- Index for OAuth lookups
+CREATE INDEX IF NOT EXISTS idx_oauth2_user_id ON oauth2_providers(user_id);
+CREATE INDEX IF NOT EXISTS idx_oauth2_provider_lookup ON oauth2_providers(provider, provider_user_id);
+
+-- Sessions table
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  ip_address TEXT,
+  user_agent TEXT,
+  created_at INTEGER DEFAULT (strftime('%s','now')),
+  expires_at INTEGER NOT NULL,
+  is_revoked INTEGER DEFAULT 0,
+  revoked_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+
+-- Index for session lookups
+CREATE INDEX IF NOT EXISTS idx_sessions_token_hash ON sessions(token_hash);
+CREATE INDEX IF NOT EXISTS idx_sessions_user_id ON sessions(user_id);
+CREATE INDEX IF NOT EXISTS idx_sessions_expires_at ON sessions(expires_at);
+
+-- Audit log table
+CREATE TABLE IF NOT EXISTS audit_logs (
+  id TEXT PRIMARY KEY,
+  user_id TEXT,
+  action TEXT NOT NULL,
+  resource_type TEXT,
+  resource_id TEXT,
+  ip_address TEXT,
+  user_agent TEXT,
+  details TEXT,
+  created_at INTEGER DEFAULT (strftime('%s','now')),
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL
+);
+
+-- Index for audit log queries
+CREATE INDEX IF NOT EXISTS idx_audit_logs_user_id ON audit_logs(user_id);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_action ON audit_logs(action);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_created_at ON audit_logs(created_at);
+
+-- Trigger to update updated_at timestamp for users
+CREATE TRIGGER IF NOT EXISTS update_users_timestamp
+AFTER UPDATE ON users
+FOR EACH ROW
+BEGIN
+  UPDATE users SET updated_at = strftime('%s','now') WHERE id = NEW.id;
+END;
+
+-- Trigger to update updated_at timestamp for oauth2_providers
+CREATE TRIGGER IF NOT EXISTS update_oauth2_providers_timestamp
+AFTER UPDATE ON oauth2_providers
+FOR EACH ROW
+BEGIN
+  UPDATE oauth2_providers SET updated_at = strftime('%s','now') WHERE id = NEW.id;
+END;

package/src/server/hono/app.ts

@@ -0,0 +1,41 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+import type { User, Session } from "@shared/types.js";
+
+export type HonoContext = {
+  Variables: {
+    user?: User;
+    session?: Session;
+  };
+};
+
+export const createApp = () => {
+  const app = new Hono<HonoContext>();
+
+  app.use("*", logger());
+
+  app.use(
+    "*",
+    cors({
+      origin: (origin) => {
+        if (process.env["NODE_ENV"] === "development") {
+          return origin;
+        }
+        const allowedOrigins = process.env["ALLOWED_ORIGINS"]?.split(",") ?? [];
+        return allowedOrigins.includes(origin) ? origin : allowedOrigins[0];
+      },
+      credentials: true,
+    })
+  );
+
+  app.get("/health", (c) => {
+    return c.json({
+      status: "healthy",
+      timestamp: new Date().toISOString(),
+      uptime: process.uptime(),
+    });
+  });
+
+  return app;
+};