s3db.js 11.3.1 → 12.0.0

package/src/plugins/api/middlewares/validator.js

@@ -0,0 +1,185 @@
+/**
+ * Validation Middleware - Schema validation for resource operations
+ *
+ * Uses s3db.js resource schemas to validate request data
+ */
+
+import { validationError } from '../utils/response-formatter.js';
+
+/**
+ * Create validation middleware for a resource
+ * @param {Object} resource - s3db.js Resource instance
+ * @param {Object} options - Validation options
+ * @param {boolean} options.validateOnInsert - Validate on POST (default: true)
+ * @param {boolean} options.validateOnUpdate - Validate on PUT/PATCH (default: true)
+ * @param {boolean} options.partial - Allow partial validation for PATCH (default: true)
+ * @returns {Function} Hono middleware
+ */
+export function createValidationMiddleware(resource, options = {}) {
+  const {
+    validateOnInsert = true,
+    validateOnUpdate = true,
+    partial = true
+  } = options;
+
+  const schema = resource.schema;
+
+  return async (c, next) => {
+    const method = c.req.method;
+    const shouldValidate =
+      (method === 'POST' && validateOnInsert) ||
+      ((method === 'PUT' || method === 'PATCH') && validateOnUpdate);
+
+    if (!shouldValidate) {
+      return await next();
+    }
+
+    // Get request body
+    let data;
+    try {
+      data = await c.req.json();
+    } catch (err) {
+      const response = validationError([
+        { field: 'body', message: 'Invalid JSON in request body' }
+      ]);
+      return c.json(response, response._status);
+    }
+
+    // For PATCH, allow partial data
+    const isPartial = method === 'PATCH' && partial;
+
+    // Validate using resource schema
+    const validationResult = schema.validate(data, {
+      partial: isPartial,
+      strict: !isPartial
+    });
+
+    if (!validationResult.valid) {
+      const errors = validationResult.errors.map(err => ({
+        field: err.field || err.attribute || 'unknown',
+        message: err.message,
+        expected: err.expected,
+        actual: err.actual
+      }));
+
+      const response = validationError(errors);
+      return c.json(response, response._status);
+    }
+
+    // Store validated data in context (optional)
+    c.set('validatedData', validationResult.data || data);
+
+    await next();
+  };
+}
+
+/**
+ * Create validation middleware that validates query parameters
+ * @param {Object} schema - Validation schema for query params
+ * @returns {Function} Hono middleware
+ */
+export function createQueryValidation(schema = {}) {
+  return async (c, next) => {
+    const query = c.req.query();
+    const errors = [];
+
+    // Validate each query parameter
+    for (const [key, rules] of Object.entries(schema)) {
+      const value = query[key];
+
+      // Check required
+      if (rules.required && !value) {
+        errors.push({
+          field: key,
+          message: `Query parameter '${key}' is required`
+        });
+        continue;
+      }
+
+      if (!value) continue;
+
+      // Check type
+      if (rules.type) {
+        if (rules.type === 'number' && isNaN(Number(value))) {
+          errors.push({
+            field: key,
+            message: `Query parameter '${key}' must be a number`,
+            actual: value
+          });
+        }
+
+        if (rules.type === 'boolean' && !['true', 'false', '1', '0'].includes(value.toLowerCase())) {
+          errors.push({
+            field: key,
+            message: `Query parameter '${key}' must be a boolean`,
+            actual: value
+          });
+        }
+      }
+
+      // Check min/max for numbers
+      if (rules.type === 'number') {
+        const num = Number(value);
+
+        if (rules.min !== undefined && num < rules.min) {
+          errors.push({
+            field: key,
+            message: `Query parameter '${key}' must be at least ${rules.min}`,
+            actual: num
+          });
+        }
+
+        if (rules.max !== undefined && num > rules.max) {
+          errors.push({
+            field: key,
+            message: `Query parameter '${key}' must be at most ${rules.max}`,
+            actual: num
+          });
+        }
+      }
+
+      // Check enum values
+      if (rules.enum && !rules.enum.includes(value)) {
+        errors.push({
+          field: key,
+          message: `Query parameter '${key}' must be one of: ${rules.enum.join(', ')}`,
+          actual: value
+        });
+      }
+    }
+
+    if (errors.length > 0) {
+      const response = validationError(errors);
+      return c.json(response, response._status);
+    }
+
+    await next();
+  };
+}
+
+/**
+ * Standard query parameters validation for list endpoints
+ */
+export const listQueryValidation = createQueryValidation({
+  limit: {
+    type: 'number',
+    min: 1,
+    max: 1000
+  },
+  offset: {
+    type: 'number',
+    min: 0
+  },
+  partition: {
+    type: 'string'
+  },
+  partitionValues: {
+    type: 'string' // JSON string
+  }
+});
+
+export default {
+  createValidationMiddleware,
+  createQueryValidation,
+  listQueryValidation
+};

package/src/plugins/api/routes/auth-routes.js

@@ -0,0 +1,241 @@
+/**
+ * Authentication Routes - Login, register, and token management endpoints
+ *
+ * Provides user authentication endpoints for the API
+ */
+
+import { Hono } from 'hono';
+import { asyncHandler } from '../utils/error-handler.js';
+import * as formatter from '../utils/response-formatter.js';
+import { createToken } from '../auth/jwt-auth.js';
+import { generateApiKey } from '../auth/api-key-auth.js';
+import { encrypt } from '../../../concerns/crypto.js';
+import tryFn from '../../../concerns/try-fn.js';
+
+/**
+ * Create authentication routes
+ * @param {Object} usersResource - s3db.js users resource
+ * @param {Object} config - Auth configuration
+ * @returns {Hono} Hono app with auth routes
+ */
+export function createAuthRoutes(usersResource, config = {}) {
+  const app = new Hono();
+  const {
+    jwtSecret,
+    jwtExpiresIn = '7d',
+    passphrase = 'secret',
+    allowRegistration = true
+  } = config;
+
+  // POST /auth/register - Register new user
+  if (allowRegistration) {
+    app.post('/register', asyncHandler(async (c) => {
+      const data = await c.req.json();
+      const { username, password, email, role = 'user' } = data;
+
+      // Validate input
+      if (!username || !password) {
+        const response = formatter.validationError([
+          { field: 'username', message: 'Username is required' },
+          { field: 'password', message: 'Password is required' }
+        ]);
+        return c.json(response, response._status);
+      }
+
+      if (password.length < 8) {
+        const response = formatter.validationError([
+          { field: 'password', message: 'Password must be at least 8 characters' }
+        ]);
+        return c.json(response, response._status);
+      }
+
+      // Check if username already exists
+      const existing = await usersResource.query({ username });
+      if (existing && existing.length > 0) {
+        const response = formatter.error('Username already exists', {
+          status: 409,
+          code: 'CONFLICT'
+        });
+        return c.json(response, response._status);
+      }
+
+      // Create user
+      const user = await usersResource.insert({
+        username,
+        password, // Will be auto-encrypted by schema (secret field)
+        email,
+        role,
+        active: true,
+        apiKey: generateApiKey(),
+        createdAt: new Date().toISOString()
+      });
+
+      // Generate JWT token
+      let token = null;
+      if (jwtSecret) {
+        token = createToken(
+          { userId: user.id, username: user.username, role: user.role },
+          jwtSecret,
+          jwtExpiresIn
+        );
+      }
+
+      // Remove sensitive data from response
+      const { password: _, ...userWithoutPassword } = user;
+
+      const response = formatter.created({
+        user: userWithoutPassword,
+        token
+      }, `/auth/users/${user.id}`);
+
+      return c.json(response, response._status);
+    }));
+  }
+
+  // POST /auth/login - Login with username/password
+  app.post('/login', asyncHandler(async (c) => {
+    const data = await c.req.json();
+    const { username, password } = data;
+
+    // Validate input
+    if (!username || !password) {
+      const response = formatter.unauthorized('Username and password are required');
+      return c.json(response, response._status);
+    }
+
+    // Find user
+    const users = await usersResource.query({ username });
+    if (!users || users.length === 0) {
+      const response = formatter.unauthorized('Invalid credentials');
+      return c.json(response, response._status);
+    }
+
+    const user = users[0];
+
+    if (!user.active) {
+      const response = formatter.unauthorized('User account is inactive');
+      return c.json(response, response._status);
+    }
+
+    // Verify password (decrypt and compare)
+    // Note: In production, use proper password hashing (bcrypt, argon2)
+    const [ok, err, decrypted] = await tryFn(() =>
+      user.password // Password is already decrypted by autoDecrypt
+    );
+
+    // For secret fields, we need to manually decrypt if autoDecrypt is off
+    // But by default autoDecrypt is true, so user.password should be plain text here
+    // Let's just compare directly since schema handles encryption/decryption
+    const isValid = user.password === password;
+
+    if (!isValid) {
+      const response = formatter.unauthorized('Invalid credentials');
+      return c.json(response, response._status);
+    }
+
+    // Update last login
+    await usersResource.update(user.id, {
+      lastLoginAt: new Date().toISOString()
+    });
+
+    // Generate JWT token
+    let token = null;
+    if (jwtSecret) {
+      token = createToken(
+        { userId: user.id, username: user.username, role: user.role },
+        jwtSecret,
+        jwtExpiresIn
+      );
+    }
+
+    // Remove sensitive data from response
+    const { password: _, ...userWithoutPassword } = user;
+
+    const response = formatter.success({
+      user: userWithoutPassword,
+      token,
+      expiresIn: jwtExpiresIn
+    });
+
+    return c.json(response, response._status);
+  }));
+
+  // POST /auth/token/refresh - Refresh JWT token
+  if (jwtSecret) {
+    app.post('/token/refresh', asyncHandler(async (c) => {
+      const user = c.get('user');
+
+      if (!user) {
+        const response = formatter.unauthorized('Authentication required');
+        return c.json(response, response._status);
+      }
+
+      // Generate new token
+      const token = createToken(
+        { userId: user.id, username: user.username, role: user.role },
+        jwtSecret,
+        jwtExpiresIn
+      );
+
+      const response = formatter.success({
+        token,
+        expiresIn: jwtExpiresIn
+      });
+
+      return c.json(response, response._status);
+    }));
+  }
+
+  // GET /auth/me - Get current user info
+  app.get('/me', asyncHandler(async (c) => {
+    const user = c.get('user');
+
+    if (!user) {
+      const response = formatter.unauthorized('Authentication required');
+      return c.json(response, response._status);
+    }
+
+    // If user is from JWT payload (no password field), return as is
+    if (!user.password) {
+      const response = formatter.success(user);
+      return c.json(response, response._status);
+    }
+
+    // Remove sensitive data
+    const { password: _, ...userWithoutPassword } = user;
+
+    const response = formatter.success(userWithoutPassword);
+    return c.json(response, response._status);
+  }));
+
+  // POST /auth/api-key/regenerate - Regenerate API key
+  app.post('/api-key/regenerate', asyncHandler(async (c) => {
+    const user = c.get('user');
+
+    if (!user) {
+      const response = formatter.unauthorized('Authentication required');
+      return c.json(response, response._status);
+    }
+
+    // Generate new API key
+    const newApiKey = generateApiKey();
+
+    // Update user
+    await usersResource.update(user.id, {
+      apiKey: newApiKey
+    });
+
+    const response = formatter.success({
+      apiKey: newApiKey,
+      message: 'API key regenerated successfully'
+    });
+
+    return c.json(response, response._status);
+  }));
+
+  return app;
+}
+
+export default {
+  createAuthRoutes
+};