pico-auth 0.0.2

package/dist/pico-auth.d.ts

@@ -0,0 +1,18 @@
+declare module "core/auth" {
+    /**
+     * When mfaToken is provided
+     */
+    export const authenticate: (login: string, password: string, mfaToken: string, impersonateEntity: string, userProvider: any, impersonateProvider: any) => Promise<any>;
+    /**
+     * Will prepare user for MFA activation. Next step is to call verify with token generated in MFA app by the user.
+     */
+    export const mfaRegister: (appName: string, login: string, userProvider: any) => Promise<unknown>;
+    /**
+     * Will return true and fully initialize MFA for user when token verification was ok. Otherwise will result false;
+     */
+    export const mfaVerify: (login: string, mfaToken: string, userProvider: any) => Promise<boolean>;
+    export const mfaEnabled: (login: string, userProvider: any) => Promise<any>;
+}
+declare module "pico-auth" {
+    export { mfaRegister, mfaVerify, mfaEnabled, authenticate } from "core/auth";
+}

package/dist/pico-auth.esm.js

@@ -0,0 +1,141 @@
+const speakeasy = require('speakeasy');
+const qrcode = require('qrcode');
+const md5 = require("md5");
+const jwt = require('jsonwebtoken');
+/**
+ * When mfaToken is provided
+ */
+const authenticate = async (login, password, mfaToken, impersonateEntity, userProvider, impersonateProvider) => {
+    var _a, _b, _c;
+    let user = await userProvider.getUser(login);
+    if ((_a = user.mfa) === null || _a === void 0 ? void 0 : _a.enabled) {
+        // Validate the token against the user's saved secret
+        const validated = speakeasy.totp.verify({
+            secret: (_c = (_b = user.mfa) === null || _b === void 0 ? void 0 : _b.secret) === null || _c === void 0 ? void 0 : _c.actual,
+            encoding: 'base32',
+            mfaToken,
+            window: 1, // Adjust window size if tokens have a margin of error
+        });
+        if (!validated)
+            throw new Error(`Failed authentication attempt ${login}`);
+    }
+    if (md5(password || '') == user.password) {
+        // check if impersonate mode - this is not yet implemented fully just copy pasta from GRM project
+        const target = impersonateEntity; // either target user login or @organizationId
+        const originalUser = user;
+        if (target) {
+            // impersonate flow
+            let mayImpersonate = false;
+            // check mode - when starts with @ we try to impersonate only to organization, otherwise we impersonate to another user
+            if (target.startsWith("@")) {
+                // only organization impersonation
+                // check requesting user has global admin
+                // mayImpersonate = mayImpersonate || user.roles.map(role=>role.toUpperCase()).includes(UserManager.CONST.ROLES.GRM_ADMIN);
+                mayImpersonate = mayImpersonate || impersonateProvider.canImpersonate(user, target);
+                // mayImpersonate = true;
+                // todo check org exists                    
+                if (!mayImpersonate) {
+                    throw new Error(`Failed impersonate attempt. From: ${originalUser.id} into ${target}`);
+                }
+                // switch original user organization_id
+                impersonateProvider.impersonate(user, target);
+                // await userManager.impersonateOrganization(user, target.substring(1).trim());
+                // const organization = await commons.dbApi.adminApi.organization();
+                // user.organization_id = parseInt(target.substring(1).trim()); // skip "@" at the beginning
+                // user.organization = organization;
+            }
+            else {
+                // full user impersonation
+                // load target user
+                const targetUser = await userProvider.getUser(target);
+                // check requesting user has target user's org admin role                
+                // mayImpersonate = mayImpersonate || (user.organization_id == targetUser.organization_id && user.roles.map(role=>role.toUpperCase()).includes(UserManager.CONST.ROLES.ORG_ADMIN))
+                // check requesting user has global admin
+                // mayImpersonate = mayImpersonate || user.roles.map(role=>role.toUpperCase()).includes(UserManager.CONST.ROLES.GRM_ADMIN);
+                mayImpersonate = mayImpersonate || impersonateProvider.canImpersonate(user, target);
+                if (!mayImpersonate) {
+                    throw new Error(`Failed impersonate attempt. From: ${originalUser.id} into ${target}`);
+                }
+                // allowed to impersonate so "switch" user to target user
+                user = targetUser;
+            }
+            console.info(`Impersonate success. From: ${originalUser.login} into ${target}`);
+        }
+        let jwtSecretKey = process.env.JWT_SECRET_KEY;
+        let data = {
+            time: Date.now(),
+            user: user
+        };
+        const token = jwt.sign(data, jwtSecretKey, { expiresIn: process.env.JWT_EXPIRY_TIME });
+        console.log(`Successful login: ${user.id}`);
+        return token;
+    }
+    else {
+        throw new Error(`Failed authentication attempt ${login}`);
+    }
+};
+/**
+ * Will prepare user for MFA activation. Next step is to call verify with token generated in MFA app by the user.
+ */
+const mfaRegister = async (appName, login, userProvider) => {
+    return new Promise(async (resolve, _reject) => {
+        let user = await userProvider.getUser(login);
+        const secret = speakeasy.generateSecret({
+            name: `${appName} (${login})`,
+        });
+        if (!user.mfa)
+            user.mfa = {
+                secret: {
+                    temp: undefined,
+                    actual: undefined,
+                    enabled: true
+                }
+            };
+        user.mfa.secret.temp = secret.base32;
+        user.mfa.secret.actual = undefined;
+        await userProvider.putUser(user);
+        qrcode.toDataURL(secret.otpauth_url, (err, data) => {
+            if (err) {
+                throw new Error('Error generating QR code');
+            }
+            else {
+                // Send the QR code URL and the secret
+                resolve({
+                    qr_code: data,
+                    secret: secret.base32
+                });
+            }
+        });
+    });
+};
+/**
+ * Will return true and fully initialize MFA for user when token verification was ok. Otherwise will result false;
+ */
+const mfaVerify = async (login, mfaToken, userProvider) => {
+    var _a, _b, _c, _d;
+    const token = mfaToken;
+    // load user
+    let user = await userProvider.getUser(login);
+    // Verify the token using the saved secret
+    const verified = speakeasy.totp.verify({
+        secret: (_b = (_a = user.mfa) === null || _a === void 0 ? void 0 : _a.secret) === null || _b === void 0 ? void 0 : _b.temp,
+        encoding: 'base32',
+        token,
+    });
+    if (verified) {
+        user.mfa.secret.actual = (_d = (_c = user.mfa) === null || _c === void 0 ? void 0 : _c.secret) === null || _d === void 0 ? void 0 : _d.temp;
+        await userProvider.putUser(user);
+        return true;
+    }
+    else {
+        console.log(`Failed mfa verification for ${login}`);
+        return false;
+    }
+};
+const mfaEnabled = async (login, userProvider) => {
+    var _a;
+    let user = await userProvider.getUser(login);
+    return (_a = user.mfa) === null || _a === void 0 ? void 0 : _a.enabled;
+};
+
+export { authenticate, mfaEnabled, mfaRegister, mfaVerify };

package/dist/pico-auth.esm.min.js

@@ -0,0 +1 @@
+const speakeasy=require("speakeasy"),qrcode=require("qrcode"),md5=require("md5"),jwt=require("jsonwebtoken"),authenticate=async(e,t,a,r,o,i)=>{var n,s,c;let l=await o.getUser(e);if(null===(n=l.mfa)||void 0===n?void 0:n.enabled){if(!speakeasy.totp.verify({secret:null===(c=null===(s=l.mfa)||void 0===s?void 0:s.secret)||void 0===c?void 0:c.actual,encoding:"base32",mfaToken:a,window:1}))throw new Error(`Failed authentication attempt ${e}`)}if(md5(t||"")==l.password){const e=r,t=l;if(e){let a=!1;if(e.startsWith("@")){if(a=a||i.canImpersonate(l,e),!a)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);i.impersonate(l,e)}else{const r=await o.getUser(e);if(a=a||i.canImpersonate(l,e),!a)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);l=r}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let a=process.env.JWT_SECRET_KEY,n={time:Date.now(),user:l};const s=jwt.sign(n,a,{expiresIn:process.env.JWT_EXPIRY_TIME});return console.log(`Successful login: ${l.id}`),s}throw new Error(`Failed authentication attempt ${e}`)},mfaRegister=async(e,t,a)=>new Promise((async(r,o)=>{let i=await a.getUser(t);const n=speakeasy.generateSecret({name:`${e} (${t})`});i.mfa||(i.mfa={secret:{temp:void 0,actual:void 0,enabled:!0}}),i.mfa.secret.temp=n.base32,i.mfa.secret.actual=void 0,await a.putUser(i),qrcode.toDataURL(n.otpauth_url,((e,t)=>{if(e)throw new Error("Error generating QR code");r({qr_code:t,secret:n.base32})}))})),mfaVerify=async(e,t,a)=>{var r,o,i,n;const s=t;let c=await a.getUser(e);return speakeasy.totp.verify({secret:null===(o=null===(r=c.mfa)||void 0===r?void 0:r.secret)||void 0===o?void 0:o.temp,encoding:"base32",token:s})?(c.mfa.secret.actual=null===(n=null===(i=c.mfa)||void 0===i?void 0:i.secret)||void 0===n?void 0:n.temp,await a.putUser(c),!0):(console.log(`Failed mfa verification for ${e}`),!1)},mfaEnabled=async(e,t)=>{var a;return null===(a=(await t.getUser(e)).mfa)||void 0===a?void 0:a.enabled};export{authenticate,mfaEnabled,mfaRegister,mfaVerify};

package/dist/pico-auth.umd.js

@@ -0,0 +1,154 @@
+(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
+    typeof define === 'function' && define.amd ? define(['exports'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.picoAuth = {}));
+})(this, (function (exports) { 'use strict';
+
+    const speakeasy = require('speakeasy');
+    const qrcode = require('qrcode');
+    const md5 = require("md5");
+    const jwt = require('jsonwebtoken');
+    /**
+     * When mfaToken is provided
+     */
+    const authenticate = async (login, password, mfaToken, impersonateEntity, userProvider, impersonateProvider) => {
+        var _a, _b, _c;
+        let user = await userProvider.getUser(login);
+        if ((_a = user.mfa) === null || _a === void 0 ? void 0 : _a.enabled) {
+            // Validate the token against the user's saved secret
+            const validated = speakeasy.totp.verify({
+                secret: (_c = (_b = user.mfa) === null || _b === void 0 ? void 0 : _b.secret) === null || _c === void 0 ? void 0 : _c.actual,
+                encoding: 'base32',
+                mfaToken,
+                window: 1, // Adjust window size if tokens have a margin of error
+            });
+            if (!validated)
+                throw new Error(`Failed authentication attempt ${login}`);
+        }
+        if (md5(password || '') == user.password) {
+            // check if impersonate mode - this is not yet implemented fully just copy pasta from GRM project
+            const target = impersonateEntity; // either target user login or @organizationId
+            const originalUser = user;
+            if (target) {
+                // impersonate flow
+                let mayImpersonate = false;
+                // check mode - when starts with @ we try to impersonate only to organization, otherwise we impersonate to another user
+                if (target.startsWith("@")) {
+                    // only organization impersonation
+                    // check requesting user has global admin
+                    // mayImpersonate = mayImpersonate || user.roles.map(role=>role.toUpperCase()).includes(UserManager.CONST.ROLES.GRM_ADMIN);
+                    mayImpersonate = mayImpersonate || impersonateProvider.canImpersonate(user, target);
+                    // mayImpersonate = true;
+                    // todo check org exists                    
+                    if (!mayImpersonate) {
+                        throw new Error(`Failed impersonate attempt. From: ${originalUser.id} into ${target}`);
+                    }
+                    // switch original user organization_id
+                    impersonateProvider.impersonate(user, target);
+                    // await userManager.impersonateOrganization(user, target.substring(1).trim());
+                    // const organization = await commons.dbApi.adminApi.organization();
+                    // user.organization_id = parseInt(target.substring(1).trim()); // skip "@" at the beginning
+                    // user.organization = organization;
+                }
+                else {
+                    // full user impersonation
+                    // load target user
+                    const targetUser = await userProvider.getUser(target);
+                    // check requesting user has target user's org admin role                
+                    // mayImpersonate = mayImpersonate || (user.organization_id == targetUser.organization_id && user.roles.map(role=>role.toUpperCase()).includes(UserManager.CONST.ROLES.ORG_ADMIN))
+                    // check requesting user has global admin
+                    // mayImpersonate = mayImpersonate || user.roles.map(role=>role.toUpperCase()).includes(UserManager.CONST.ROLES.GRM_ADMIN);
+                    mayImpersonate = mayImpersonate || impersonateProvider.canImpersonate(user, target);
+                    if (!mayImpersonate) {
+                        throw new Error(`Failed impersonate attempt. From: ${originalUser.id} into ${target}`);
+                    }
+                    // allowed to impersonate so "switch" user to target user
+                    user = targetUser;
+                }
+                console.info(`Impersonate success. From: ${originalUser.login} into ${target}`);
+            }
+            let jwtSecretKey = process.env.JWT_SECRET_KEY;
+            let data = {
+                time: Date.now(),
+                user: user
+            };
+            const token = jwt.sign(data, jwtSecretKey, { expiresIn: process.env.JWT_EXPIRY_TIME });
+            console.log(`Successful login: ${user.id}`);
+            return token;
+        }
+        else {
+            throw new Error(`Failed authentication attempt ${login}`);
+        }
+    };
+    /**
+     * Will prepare user for MFA activation. Next step is to call verify with token generated in MFA app by the user.
+     */
+    const mfaRegister = async (appName, login, userProvider) => {
+        return new Promise(async (resolve, _reject) => {
+            let user = await userProvider.getUser(login);
+            const secret = speakeasy.generateSecret({
+                name: `${appName} (${login})`,
+            });
+            if (!user.mfa)
+                user.mfa = {
+                    secret: {
+                        temp: undefined,
+                        actual: undefined,
+                        enabled: true
+                    }
+                };
+            user.mfa.secret.temp = secret.base32;
+            user.mfa.secret.actual = undefined;
+            await userProvider.putUser(user);
+            qrcode.toDataURL(secret.otpauth_url, (err, data) => {
+                if (err) {
+                    throw new Error('Error generating QR code');
+                }
+                else {
+                    // Send the QR code URL and the secret
+                    resolve({
+                        qr_code: data,
+                        secret: secret.base32
+                    });
+                }
+            });
+        });
+    };
+    /**
+     * Will return true and fully initialize MFA for user when token verification was ok. Otherwise will result false;
+     */
+    const mfaVerify = async (login, mfaToken, userProvider) => {
+        var _a, _b, _c, _d;
+        const token = mfaToken;
+        // load user
+        let user = await userProvider.getUser(login);
+        // Verify the token using the saved secret
+        const verified = speakeasy.totp.verify({
+            secret: (_b = (_a = user.mfa) === null || _a === void 0 ? void 0 : _a.secret) === null || _b === void 0 ? void 0 : _b.temp,
+            encoding: 'base32',
+            token,
+        });
+        if (verified) {
+            user.mfa.secret.actual = (_d = (_c = user.mfa) === null || _c === void 0 ? void 0 : _c.secret) === null || _d === void 0 ? void 0 : _d.temp;
+            await userProvider.putUser(user);
+            return true;
+        }
+        else {
+            console.log(`Failed mfa verification for ${login}`);
+            return false;
+        }
+    };
+    const mfaEnabled = async (login, userProvider) => {
+        var _a;
+        let user = await userProvider.getUser(login);
+        return (_a = user.mfa) === null || _a === void 0 ? void 0 : _a.enabled;
+    };
+
+    exports.authenticate = authenticate;
+    exports.mfaEnabled = mfaEnabled;
+    exports.mfaRegister = mfaRegister;
+    exports.mfaVerify = mfaVerify;
+
+    Object.defineProperty(exports, '__esModule', { value: true });
+
+}));

package/dist/pico-auth.umd.min.js

@@ -0,0 +1 @@
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globalThis:e||self).picoAuth={})}(this,(function(e){"use strict";const t=require("speakeasy"),o=require("qrcode"),a=require("md5"),r=require("jsonwebtoken");e.authenticate=async(e,o,i,n,s,c)=>{var l,d,f;let u=await s.getUser(e);if(null===(l=u.mfa)||void 0===l?void 0:l.enabled){if(!t.totp.verify({secret:null===(f=null===(d=u.mfa)||void 0===d?void 0:d.secret)||void 0===f?void 0:f.actual,encoding:"base32",mfaToken:i,window:1}))throw new Error(`Failed authentication attempt ${e}`)}if(a(o||"")==u.password){const e=n,t=u;if(e){let o=!1;if(e.startsWith("@")){if(o=o||c.canImpersonate(u,e),!o)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);c.impersonate(u,e)}else{const a=await s.getUser(e);if(o=o||c.canImpersonate(u,e),!o)throw new Error(`Failed impersonate attempt. From: ${t.id} into ${e}`);u=a}console.info(`Impersonate success. From: ${t.login} into ${e}`)}let o=process.env.JWT_SECRET_KEY,a={time:Date.now(),user:u};const i=r.sign(a,o,{expiresIn:process.env.JWT_EXPIRY_TIME});return console.log(`Successful login: ${u.id}`),i}throw new Error(`Failed authentication attempt ${e}`)},e.mfaEnabled=async(e,t)=>{var o;return null===(o=(await t.getUser(e)).mfa)||void 0===o?void 0:o.enabled},e.mfaRegister=async(e,a,r)=>new Promise((async(i,n)=>{let s=await r.getUser(a);const c=t.generateSecret({name:`${e} (${a})`});s.mfa||(s.mfa={secret:{temp:void 0,actual:void 0,enabled:!0}}),s.mfa.secret.temp=c.base32,s.mfa.secret.actual=void 0,await r.putUser(s),o.toDataURL(c.otpauth_url,((e,t)=>{if(e)throw new Error("Error generating QR code");i({qr_code:t,secret:c.base32})}))})),e.mfaVerify=async(e,o,a)=>{var r,i,n,s;const c=o;let l=await a.getUser(e);return t.totp.verify({secret:null===(i=null===(r=l.mfa)||void 0===r?void 0:r.secret)||void 0===i?void 0:i.temp,encoding:"base32",token:c})?(l.mfa.secret.actual=null===(s=null===(n=l.mfa)||void 0===n?void 0:n.secret)||void 0===s?void 0:s.temp,await a.putUser(l),!0):(console.log(`Failed mfa verification for ${e}`),!1)},Object.defineProperty(e,"__esModule",{value:!0})}));

package/package.json

@@ -0,0 +1,101 @@
+{
+  "name": "pico-auth",
+  "version": "0.0.2",
+  "description": "Minimal auth with user/pass, impersonation and mfa authentication",
+  "main": "dist/pico-auth.umd.js",
+  "types": "dist/pico-auth.d.ts",
+  "module": "dist/pico-auth.esm.min.js",
+  "homepage": "https://github.com/alkeicam/pico-auth",
+  "bugs": {
+    "url": "https://github.com/alkeicam/pico-auth/issues"
+  },
+  "keywords": [
+    "impersonate",
+    "auth",
+    "mfa"
+  ],
+  "exports": {
+    ".": {
+      "require": {
+        "types": "./dist/pico-auth.d.ts",
+        "default": "./dist/pico-auth.umd.min.js"
+      },
+      "import": {
+        "types": "./dist/pico-auth.d.ts",
+        "default": "./dist/pico-auth.esm.min.js"
+      }
+    }
+  },
+  "scripts": {
+    "clean": "rimraf dist/*",
+    "docs": "typedoc --entryPointStrategy expand ./src && touch docs/.nojekyll",
+    "build": "date && npm run clean && npm run build:js -s && npm run build:minjs -s && npm run build:types -s",
+    "build:js": "rollup -c rollup.config.js",
+    "build:minjs": "npm run build:minjs:esm -s && npm run build:minjs:umd -s",
+    "build:minjs:umd": "terser dist/pico-auth.umd.js --compress --mangle > dist/pico-auth.umd.min.js",
+    "build:minjs:esm": "terser dist/pico-auth.esm.js --compress --mangle > dist/pico-auth.esm.min.js",
+    "build:types": "tsc -t esnext --moduleResolution node -d --emitDeclarationOnly --outFile dist/pico-auth.d.ts src/pico-auth.ts",
+    "test": "env TS_NODE_PROJECT=\"tsconfig-test.json\" mocha -r ts-node/register --require source-map-support/register --recursive **/test/**/*.test.ts",
+    "coverage": "nyc --reporter html --reporter text npm test",
+    "release-minor": "npm install && npm update && npm run build && npm run coverage && npm version minor && git push origin && git push origin --tags && npm publish"
+  },
+  "files": [
+    "dist"
+  ],
+  "author": "Al Keicam",
+  "license": "MIT",
+  "dependencies": {
+    "md5": "^2.3.0",
+    "speakeasy": "2.0.0",
+    "qrcode": "1.5.4",
+    "jsonwebtoken": "^8.5.1"
+  },
+  "devDependencies": {
+    "@rollup/plugin-typescript": "^6.1.0",
+    "@rollup/plugin-node-resolve": "15.2.3",
+    "@rollup/plugin-commonjs": "28.0.1",
+    "@types/chai": "4.2.14",
+    "@types/chai-as-promised": "7.1.3",
+    "@types/mocha": "8.0.3",
+    "@types/node": "20.5.0",
+    "@types/sinon": "9.0.8",
+    "@typescript-eslint/eslint-plugin": "4.6.1",
+    "@typescript-eslint/parser": "4.6.1",
+    "chai": "^3.5.0",
+    "chai-as-promised": "^6.0.0",
+    "eslint": "7.12.1",
+    "mocha": "^8.4.0",
+    "nyc": "14.1.x",
+    "prettier": "^2.8.8",
+    "pretty-quick": "^3.1.3",
+    "rollup": "^2.79.1",
+    "sinon": "^9.2.4",
+    "terser": "^5.19.2",
+    "ts-node": "10.8.2",
+    "tslib": "^2.6.2",
+    "typedoc": "^0.25.1",
+    "typescript": "^5.1.6",
+    "source-map-support": "^0.5.21",
+    "rimraf": "^5.0.5",
+    "shell-exec": "1.1.2"
+  },
+  "nyc": {
+    "check-coverage": true,
+    "branches": 100,
+    "lines": 100,
+    "functions": 100,
+    "statements": 100,
+    "extension": [
+      ".ts",
+      ".tsx"
+    ],
+    "exclude": [
+      "**/*.d.ts",
+      "**/*.js",
+      "**/*.notest.ts",
+      "**/*.mock.ts",
+      "**/*.test.ts"
+    ],
+    "all": true
+  }
+}

package/readme.MD

@@ -0,0 +1,3 @@
+
+
+# Pico Auth