myaidev-method 0.2.8 → 0.2.10

package/src/server/auth/services/AuthService.ts

@@ -0,0 +1,408 @@
+import { Context, Effect, Layer } from "effect";
+import {
+  AuthError,
+  DatabaseError,
+  Session,
+  User,
+  ValidationError,
+} from "../../../shared/types.js";
+import { PasswordService } from "./PasswordService.js";
+import { TokenService } from "./TokenService.js";
+import { UserRepository } from "./UserRepository.js";
+import { SessionRepository } from "./SessionRepository.js";
+import { AuditLogService } from "./AuditLogService.js";
+import { UserManagementService } from "../../user-management/UserManagementService.js";
+
+const MAX_FAILED_ATTEMPTS = 5;
+const LOCKOUT_DURATION_MS = 15 * 60 * 1000; // 15 minutes
+
+export interface AuthServiceDeps {
+  readonly register: (
+    username: string,
+    email: string,
+    password: string,
+    ipAddress?: string | null,
+    userAgent?: string | null
+  ) => Effect.Effect<User, AuthError | ValidationError | DatabaseError>;
+  readonly login: (
+    email: string,
+    password: string,
+    ipAddress?: string | null,
+    userAgent?: string | null
+  ) => Effect.Effect<
+    { user: User; token: string; session: Session },
+    AuthError | DatabaseError
+  >;
+  readonly logout: (
+    sessionId: string,
+    userId: string
+  ) => Effect.Effect<void, DatabaseError>;
+  readonly verifyToken: (
+    token: string
+  ) => Effect.Effect<{ user: User; session: Session }, AuthError | DatabaseError>;
+}
+
+export class AuthService extends Context.Tag("AuthService")<
+  AuthService,
+  AuthServiceDeps
+>() {
+  static Live = Layer.effect(
+    this,
+    Effect.gen(function* () {
+      const passwordService = yield* PasswordService;
+      const tokenService = yield* TokenService;
+      const userRepo = yield* UserRepository;
+      const sessionRepo = yield* SessionRepository;
+      const auditLog = yield* AuditLogService;
+      const userManagement = yield* UserManagementService;
+
+      const sanitizeLinuxUsername = (username: string): string => {
+        // Convert to lowercase, replace non-alphanumeric with underscore
+        let sanitized = username
+          .toLowerCase()
+          .replace(/[^a-z0-9_]/g, "_")
+          .replace(/^[0-9_]+/, "") // Cannot start with number or underscore
+          .slice(0, 32); // Max length for Linux usernames
+
+        // Ensure it starts with a letter
+        if (!/^[a-z]/.test(sanitized)) {
+          sanitized = "user_" + sanitized;
+        }
+
+        return sanitized;
+      };
+
+      const generateUniqueLinuxUsername = (
+        baseUsername: string
+      ): Effect.Effect<string, DatabaseError> =>
+        Effect.gen(function* () {
+          let linuxUsername = sanitizeLinuxUsername(baseUsername);
+          let counter = 0;
+
+          // Keep trying until we find a unique username
+          while (true) {
+            const existingUser = yield* userRepo.findByUsername(linuxUsername);
+            if (!existingUser) {
+              return linuxUsername;
+            }
+
+            counter++;
+            const suffix = `_${counter}`;
+            const maxBase = 32 - suffix.length;
+            linuxUsername =
+              sanitizeLinuxUsername(baseUsername).slice(0, maxBase) + suffix;
+          }
+        });
+
+      const validateEmail = (email: string): Effect.Effect<void, ValidationError> =>
+        Effect.gen(function* () {
+          const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+          if (!emailRegex.test(email)) {
+            return yield* Effect.fail(
+              new ValidationError("email", "Invalid email format")
+            );
+          }
+        });
+
+      const validateUsername = (
+        username: string
+      ): Effect.Effect<void, ValidationError> =>
+        Effect.gen(function* () {
+          if (username.length < 3) {
+            return yield* Effect.fail(
+              new ValidationError(
+                "username",
+                "Username must be at least 3 characters long"
+              )
+            );
+          }
+
+          if (username.length > 32) {
+            return yield* Effect.fail(
+              new ValidationError(
+                "username",
+                "Username must be at most 32 characters long"
+              )
+            );
+          }
+
+          if (!/^[a-zA-Z0-9_]+$/.test(username)) {
+            return yield* Effect.fail(
+              new ValidationError(
+                "username",
+                "Username can only contain letters, numbers, and underscores"
+              )
+            );
+          }
+        });
+
+      const isAccountLocked = (user: User): boolean => {
+        if (user.failedLoginAttempts < MAX_FAILED_ATTEMPTS) {
+          return false;
+        }
+
+        // Check if lockout period has expired
+        const now = Date.now();
+        const lockoutExpiry = user.updatedAt + LOCKOUT_DURATION_MS;
+        return now < lockoutExpiry;
+      };
+
+      const register: AuthServiceDeps["register"] = (
+        username,
+        email,
+        password,
+        ipAddress = null,
+        userAgent = null
+      ) =>
+        Effect.gen(function* () {
+          // Validate inputs
+          yield* validateUsername(username);
+          yield* validateEmail(email);
+          yield* passwordService.validatePasswordStrength(password);
+
+          // Check if user already exists
+          const existingEmail = yield* userRepo.findByEmail(email);
+          if (existingEmail) {
+            return yield* Effect.fail(
+              new ValidationError("email", "Email already registered")
+            );
+          }
+
+          const existingUsername = yield* userRepo.findByUsername(username);
+          if (existingUsername) {
+            return yield* Effect.fail(
+              new ValidationError("username", "Username already taken")
+            );
+          }
+
+          // Hash password
+          const passwordHash = yield* passwordService.hash(password);
+
+          // Generate unique Linux username
+          const linuxUsername = yield* generateUniqueLinuxUsername(username);
+
+          // Create user in database
+          const user = yield* userRepo.create({
+            username,
+            email,
+            passwordHash,
+            linuxUsername,
+          });
+
+          // Create Linux user with home directory and Claude config
+          // This runs in the background and doesn't block registration
+          // If it fails, user can still authenticate but won't have Linux access
+          yield* userManagement
+            .createUser({
+              username: linuxUsername,
+              email,
+              shell: "/bin/rbash", // Restricted bash for security
+              diskQuotaMB: 2048, // 2GB default quota
+            })
+            .pipe(
+              Effect.catchAll((error) => {
+                // Log the error but don't fail registration
+                console.error(
+                  `Failed to create Linux user for ${linuxUsername}:`,
+                  error
+                );
+                return Effect.succeed(void 0);
+              })
+            );
+
+          // Log audit event
+          yield* auditLog.log({
+            userId: user.id,
+            action: "USER_REGISTERED",
+            resourceType: "user",
+            resourceId: user.id,
+            ipAddress: ipAddress ?? null,
+            userAgent: userAgent ?? null,
+          });
+
+          return user;
+        });
+
+      const login: AuthServiceDeps["login"] = (
+        email,
+        password,
+        ipAddress = null,
+        userAgent = null
+      ) =>
+        Effect.gen(function* () {
+          // Find user by email
+          const user = yield* userRepo.findByEmail(email);
+          if (!user) {
+            return yield* Effect.fail(
+              new AuthError("INVALID_CREDENTIALS", "Invalid email or password")
+            );
+          }
+
+          // Check if account is locked
+          if (isAccountLocked(user)) {
+            yield* auditLog.log({
+              userId: user.id,
+              action: "LOGIN_FAILED",
+              resourceType: "user",
+              resourceId: user.id,
+              ipAddress: ipAddress ?? null,
+              userAgent: userAgent ?? null,
+              details: "Account locked due to too many failed attempts",
+            });
+
+            return yield* Effect.fail(
+              new AuthError(
+                "ACCOUNT_LOCKED",
+                "Account is locked due to too many failed login attempts. Please try again in 15 minutes."
+              )
+            );
+          }
+
+          // Verify password
+          if (!user.passwordHash) {
+            return yield* Effect.fail(
+              new AuthError(
+                "INVALID_CREDENTIALS",
+                "Invalid email or password"
+              )
+            );
+          }
+
+          const isPasswordValid = yield* passwordService.verify(
+            password,
+            user.passwordHash
+          );
+
+          if (!isPasswordValid) {
+            // Increment failed login attempts
+            yield* userRepo.incrementFailedLogins(user.id);
+
+            yield* auditLog.log({
+              userId: user.id,
+              action: "LOGIN_FAILED",
+              resourceType: "user",
+              resourceId: user.id,
+              ipAddress: ipAddress ?? null,
+              userAgent: userAgent ?? null,
+              details: "Invalid password",
+            });
+
+            return yield* Effect.fail(
+              new AuthError("INVALID_CREDENTIALS", "Invalid email or password")
+            );
+          }
+
+          // Reset failed login attempts on successful login
+          yield* userRepo.resetFailedLogins(user.id);
+
+          // Update last login time
+          const updatedUser = yield* userRepo.update(user.id, {
+            lastLoginAt: Date.now(),
+          });
+
+          // Generate a unique placeholder token to avoid constraint violations
+          const expiresAt = Date.now() + 7 * 24 * 60 * 60 * 1000; // 7 days
+          const placeholderToken = `placeholder_${user.id}_${Date.now()}_${Math.random()}`;
+          const placeholderHash = yield* tokenService.hashToken(placeholderToken);
+
+          // Create session with placeholder hash
+          const session = yield* sessionRepo.create({
+            userId: user.id,
+            tokenHash: placeholderHash,
+            ipAddress: ipAddress ?? null,
+            userAgent: userAgent ?? null,
+            expiresAt,
+          });
+
+          // Generate JWT token with the session ID
+          const token = yield* tokenService.generateToken({
+            sub: user.id,
+            username: user.username,
+            email: user.email,
+            jti: session.id,
+          });
+
+          // Update the session with the actual token hash
+          const actualTokenHash = yield* tokenService.hashToken(token);
+          const finalSession = yield* sessionRepo.updateTokenHash(session.id, actualTokenHash);
+
+          // Log audit event
+          yield* auditLog.log({
+            userId: user.id,
+            action: "USER_LOGIN",
+            resourceType: "session",
+            resourceId: finalSession.id,
+            ipAddress: ipAddress ?? null,
+            userAgent: userAgent ?? null,
+          });
+
+          return { user: updatedUser, token, session: finalSession };
+        });
+
+      const logout: AuthServiceDeps["logout"] = (sessionId, userId) =>
+        Effect.gen(function* () {
+          // Revoke session
+          yield* sessionRepo.revoke(sessionId);
+
+          // Log audit event
+          yield* auditLog.log({
+            userId,
+            action: "USER_LOGOUT",
+            resourceType: "session",
+            resourceId: sessionId,
+            ipAddress: null,
+            userAgent: null,
+          });
+        });
+
+      const verifyToken: AuthServiceDeps["verifyToken"] = (token) =>
+        Effect.gen(function* () {
+          // Verify JWT
+          const payload = yield* tokenService.verifyToken(token);
+
+          // Hash token to find session
+          const tokenHash = yield* tokenService.hashToken(token);
+          const session = yield* sessionRepo.findByTokenHash(tokenHash);
+
+          if (!session) {
+            return yield* Effect.fail(
+              new AuthError("INVALID_TOKEN", "Session not found")
+            );
+          }
+
+          // Check if session is expired
+          if (session.expiresAt < Date.now()) {
+            return yield* Effect.fail(
+              new AuthError("TOKEN_EXPIRED", "Session has expired")
+            );
+          }
+
+          // Check if session is revoked
+          if (session.isRevoked) {
+            return yield* Effect.fail(
+              new AuthError("SESSION_REVOKED", "Session has been revoked")
+            );
+          }
+
+          // Find user
+          const user = yield* userRepo.findById(payload.sub);
+          if (!user) {
+            return yield* Effect.fail(
+              new AuthError("USER_NOT_FOUND", "User not found")
+            );
+          }
+
+          // Check if user is active
+          if (!user.isActive) {
+            return yield* Effect.fail(
+              new AuthError("USER_INACTIVE", "User account is inactive")
+            );
+          }
+
+          return { user, session };
+        });
+
+      return { register, login, logout, verifyToken };
+    })
+  );
+}