proteum 2.1.1 → 2.1.3-1

package/server/services/auth/router/index.ts

@@ -25,12 +25,6 @@ import UsersRequestService from './request';
 - TYPES
 ----------------------------------*/
 
-/*----------------------------------
-- CONFIG
-----------------------------------*/
-
-const LogPrefix = '[router][auth]';
-
 /*----------------------------------
 - SERVICE
 ----------------------------------*/
@@ -59,11 +53,32 @@ export default class AuthenticationRouterService<
         this.users = this.config.users;
     }
 
+    private traceRouteAuth(
+        request: TRequest,
+        route: TAnyRoute,
+        details: Record<string, any>,
+        minimumCapture: 'summary' | 'resolve' | 'deep' = 'resolve',
+    ) {
+        this.app.container.Trace.record(
+            request.id,
+            'auth.route',
+            {
+                routePath: route.path || '',
+                routeId: route.options.id || '',
+                authInput: route.options.auth ?? null,
+                tracking: route.options.authTracking ?? null,
+                redirectLogged: route.options.redirectLogged ?? null,
+                ...details,
+            },
+            minimumCapture,
+        );
+    }
+
     public async ready() {
         // Decode current user
         this.parent.on('request', async (request: TRequest) => {
             // TODO: Typings. (context.user ?)
-            const decoded = await this.users.decode(request.req, true);
+            const decoded = await this.users.decode(request.req, true, request.id);
 
             request.user = decoded || null;
         });
@@ -72,10 +87,48 @@ export default class AuthenticationRouterService<
         this.parent.on('resolved', async (route: TAnyRoute, request: TRequest, response: ServerResponse<TRouter>) => {
             if (route.options.auth !== undefined) {
                 const tracking = route.options.authTracking ?? null;
+                const strategy =
+                    route.options.auth === false
+                        ? 'guest-only'
+                        : route.options.auth === null
+                          ? 'authenticated'
+                          : typeof route.options.auth === 'object'
+                            ? 'conditions'
+                            : route.options.auth === true
+                              ? tracking !== null && this.users.config.rules
+                                  ? 'user-via-rules'
+                                  : 'user'
+                              : tracking !== null && this.users.config.rules
+                                ? 'role-via-rules'
+                                : 'role';
+
+                this.traceRouteAuth(
+                    request,
+                    route,
+                    {
+                        phase: 'start',
+                        strategy,
+                    },
+                    'resolve',
+                );
 
                 // Guest-only routes can still redirect authenticated users away.
                 if (route.options.auth === false) {
                     const currentUser = this.users.check(request, false, tracking);
+                    const redirected = Boolean(route.options.redirectLogged && currentUser);
+
+                    this.traceRouteAuth(
+                        request,
+                        route,
+                        {
+                            phase: 'result',
+                            strategy,
+                            outcome: redirected ? 'redirected' : 'allowed',
+                            userPresent: currentUser !== null,
+                            redirectTo: redirected ? route.options.redirectLogged : null,
+                        },
+                        'resolve',
+                    );
 
                     if (route.options.redirectLogged && currentUser) response.redirect(route.options.redirectLogged);
                     return;
@@ -83,11 +136,13 @@ export default class AuthenticationRouterService<
 
                 if (route.options.auth === null) {
                     this.users.check(request, null, tracking);
+                    this.traceRouteAuth(request, route, { phase: 'result', strategy, outcome: 'allowed' }, 'resolve');
                     return;
                 }
 
                 if (typeof route.options.auth === 'object') {
                     this.users.check(request, route.options.auth as TAuthCheckConditions, tracking);
+                    this.traceRouteAuth(request, route, { phase: 'result', strategy, outcome: 'allowed' }, 'resolve');
                     return;
                 }
 
@@ -95,10 +150,32 @@ export default class AuthenticationRouterService<
                 if (route.options.auth === true) {
                     if (tracking !== null && this.users.config.rules) {
                         this.users.check(request, { role: 'USER' }, tracking);
+                        this.traceRouteAuth(
+                            request,
+                            route,
+                            {
+                                phase: 'result',
+                                strategy,
+                                outcome: 'allowed',
+                                requiredRole: 'USER',
+                            },
+                            'resolve',
+                        );
                         return;
                     }
 
                     this.users.check(request, true);
+                    this.traceRouteAuth(
+                        request,
+                        route,
+                        {
+                            phase: 'result',
+                            strategy,
+                            outcome: 'allowed',
+                            requiredRole: 'USER',
+                        },
+                        'resolve',
+                    );
                     return;
                 }
 
@@ -106,10 +183,32 @@ export default class AuthenticationRouterService<
 
                 if (tracking !== null && this.users.config.rules) {
                     this.users.check(request, { role: requiredRole }, tracking);
+                    this.traceRouteAuth(
+                        request,
+                        route,
+                        {
+                            phase: 'result',
+                            strategy,
+                            outcome: 'allowed',
+                            requiredRole,
+                        },
+                        'resolve',
+                    );
                     return;
                 }
 
                 this.users.check(request, requiredRole);
+                this.traceRouteAuth(
+                    request,
+                    route,
+                    {
+                        phase: 'result',
+                        strategy,
+                        outcome: 'allowed',
+                        requiredRole,
+                    },
+                    'resolve',
+                );
             }
         });
     }

package/server/services/router/http/index.ts

@@ -17,13 +17,14 @@ import helmet from 'helmet'; // Diverses protections
 import compression from 'compression';
 import fileUpload from 'express-fileupload';
 import cookieParser from 'cookie-parser';
-import * as csp from 'express-csp-header';
 
 // Core
 import Container from '@server/app/container';
 import type CronManager from '@server/services/cron';
 import type CronTask from '@server/services/cron/CronTask';
+import type { TBasicUser } from '@server/services/auth';
 import type { TServerRouter } from '..';
+import type { TDevSessionStartResponse, TDevSessionUserSummary } from '@common/dev/session';
 import { serverHotReloadMessageType } from '@common/dev/serverHotReload';
 import { explainSectionNames } from '@common/dev/diagnostics';
 
@@ -53,6 +54,36 @@ export type Config = {
 
 export type Hooks = {};
 
+type TContentSecurityPolicyOptions = NonNullable<Parameters<typeof helmet.contentSecurityPolicy>[0]>;
+type TContentSecurityPolicyDirectives = NonNullable<TContentSecurityPolicyOptions['directives']>;
+type TDevSessionAuthService = {
+    config: {
+        jwt: {
+            expiration: number;
+        };
+    };
+    createSession: (session: { email: string }, request: { id: string; res: express.Response }) => string;
+    decodeSession: (session: { email: string }, req: express.Request) => Promise<TBasicUser | null>;
+};
+
+const createContentSecurityPolicy = (config: Config['csp']): TContentSecurityPolicyOptions => {
+    const directives: TContentSecurityPolicyDirectives = {
+        defaultSrc:
+            config.default && config.default.length > 0
+                ? [...config.default]
+                : helmet.contentSecurityPolicy.dangerouslyDisableDefaultSrc,
+        scriptSrc: ["'unsafe-inline'", "'self'", "'unsafe-eval'", ...config.scripts],
+    };
+
+    if (config.styles && config.styles.length > 0) directives.styleSrc = [...config.styles];
+    if (config.images && config.images.length > 0) directives.imgSrc = [...config.images];
+
+    return {
+        useDefaults: false,
+        directives,
+    };
+};
+
 /*----------------------------------
 - FUNCTION
 ----------------------------------*/
@@ -81,6 +112,32 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
         this.app.on('cleanup', () => this.cleanup());
     }
 
+    private resolveDevSessionAuthService(): TDevSessionAuthService {
+        const plugins = Object.values(this.router.config.plugins || {}) as Array<{ users?: unknown }>;
+
+        for (const plugin of plugins) {
+            const users = plugin?.users as Partial<TDevSessionAuthService> | undefined;
+            if (!users) continue;
+            if (typeof users.createSession !== 'function') continue;
+            if (typeof users.decodeSession !== 'function') continue;
+            if (typeof users.config?.jwt?.expiration !== 'number') continue;
+
+            return users as TDevSessionAuthService;
+        }
+
+        throw new Error('No auth router plugin with a compatible users service is registered.');
+    }
+
+    private summarizeDevSessionUser(user: TBasicUser): TDevSessionUserSummary {
+        return {
+            email: user.email,
+            name: user.name,
+            type: user.type,
+            roles: [...user.roles],
+            locale: user.locale ?? null,
+        };
+    }
+
     /*----------------------------------
     - HOOKS
     ----------------------------------*/
@@ -203,11 +260,7 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
 
         if (this.config.cors !== undefined) routes.use(cors(this.config.cors));
 
-        routes.use(
-            csp.expressCspHeader({
-                directives: { 'script-src': [csp.INLINE, csp.SELF, csp.UNSAFE_EVAL, ...this.config.csp.scripts] },
-            }),
-        );
+        routes.use(helmet.contentSecurityPolicy(createContentSecurityPolicy(this.config.csp)));
 
         this.registerDevTraceRoutes(routes);
         routes.use(routeRequest);
@@ -342,6 +395,55 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
             }
         });
 
+        routes.post('/__proteum/session/start', async (req, res) => {
+            const email = typeof req.body?.email === 'string' ? req.body.email.trim() : '';
+            const requiredRole = typeof req.body?.role === 'string' ? req.body.role.trim() : '';
+
+            if (!email) {
+                res.status(400).json({ error: 'Email is required.' });
+                return;
+            }
+
+            try {
+                const auth = this.resolveDevSessionAuthService();
+                const user = await auth.decodeSession({ email }, req);
+
+                if (!user) {
+                    res.status(404).json({ error: `No user could be resolved for "${email}".` });
+                    return;
+                }
+
+                if (requiredRole && !user.roles.includes(requiredRole)) {
+                    res.status(403).json({ error: `User "${email}" does not have required role "${requiredRole}".` });
+                    return;
+                }
+
+                const token = auth.createSession(
+                    { email },
+                    {
+                        id: `proteum-session:${Date.now()}`,
+                        res,
+                    },
+                );
+                const issuedAt = new Date().toISOString();
+                const expiresAt = new Date(Date.now() + auth.config.jwt.expiration).toISOString();
+                const response: TDevSessionStartResponse = {
+                    user: this.summarizeDevSessionUser(user),
+                    session: {
+                        token,
+                        cookieName: 'authorization',
+                        expiresInMs: auth.config.jwt.expiration,
+                        issuedAt,
+                        expiresAt,
+                    },
+                };
+
+                res.json(response);
+            } catch (error) {
+                res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+            }
+        });
+
         routes.post('/__proteum/cron/tasks/run', async (req, res) => {
             const cron = this.getCronManager();
             if (!cron) {

package/server/services/router/response/index.ts

@@ -338,6 +338,7 @@ export default class ServerResponse<
         // NOTE: On évite le filtrage sans masque spécifié (performances + risques erreurs)
         if (mask !== undefined) data = await jsonMask(data, mask);
 
+        this.app.container.Trace.setRequestResult(this.request.id, data);
         this.headers['Content-Type'] = 'application/json';
         this.data = (this.request.isVirtual ? data : JSON.stringify(data)) as TData;
         return this.end();