s3db.js 13.6.1 → 14.0.2

package/src/plugins/identity/drivers/password-driver.js

@@ -0,0 +1,122 @@
+import { AuthDriver } from './auth-driver.interface.js';
+import { tryFn } from '../../../concerns/try-fn.js';
+import { PluginError } from '../../../errors.js';
+
+export class PasswordAuthDriver extends AuthDriver {
+  constructor(options = {}) {
+    super('password', ['password']);
+    this.options = options;
+    this.usersResource = null;
+    this.passwordHelper = null;
+    this.identifierField = options.identifierField || 'email';
+    this.caseInsensitive = options.caseInsensitive !== false;
+  }
+
+  async initialize(context) {
+    this.usersResource = context.resources?.users;
+    this.passwordHelper = context.helpers?.password;
+
+    if (!this.usersResource) {
+      throw new PluginError('PasswordAuthDriver requires users resource', {
+        pluginName: 'IdentityPlugin',
+        operation: 'initializePasswordDriver',
+        statusCode: 500,
+        retriable: false,
+        suggestion: 'Pass users resource via IdentityPlugin({ resources: { users: ... } }) before enabling password driver.'
+      });
+    }
+
+    if (!this.passwordHelper || typeof this.passwordHelper.verify !== 'function') {
+      throw new PluginError('PasswordAuthDriver requires password helper with verify(password, hash)', {
+        pluginName: 'IdentityPlugin',
+        operation: 'initializePasswordDriver',
+        statusCode: 500,
+        retriable: false,
+        suggestion: 'Ensure IdentityPlugin password helper is registered or provide a custom helper with verify(password, hash).'
+      });
+    }
+  }
+
+  supportsGrant(grantType) {
+    return grantType === 'password';
+  }
+
+  async authenticate(request = {}) {
+    const identifier = request[this.identifierField] || request.email || request.username;
+    const password = request.password;
+
+    if (!identifier || !password) {
+      return {
+        success: false,
+        error: 'missing_credentials',
+        statusCode: 400
+      };
+    }
+
+    const normalizedIdentifier = this._normalizeIdentifier(identifier);
+
+    let user = request.user || null;
+
+    if (!user) {
+      const queryFilter = { [this.identifierField]: normalizedIdentifier };
+      if (request.tenantId) {
+        queryFilter.tenantId = request.tenantId;
+      }
+
+      const [ok, err, users] = await tryFn(() => this.usersResource.query(queryFilter));
+
+      if (!ok) {
+        return {
+          success: false,
+          error: err?.message || 'lookup_failed',
+          statusCode: 500
+        };
+      }
+
+      if (!users || users.length === 0) {
+        return {
+          success: false,
+          error: 'invalid_credentials',
+          statusCode: 401
+        };
+      }
+
+      user = users[0];
+    }
+
+    const passwordHash = user.password;
+
+    if (!passwordHash) {
+      return {
+        success: false,
+        error: 'password_not_set',
+        statusCode: 401
+      };
+    }
+
+    const validPassword = await this.passwordHelper.verify(password, passwordHash);
+    if (!validPassword) {
+      return {
+        success: false,
+        error: 'invalid_credentials',
+        statusCode: 401
+      };
+    }
+
+    return {
+      success: true,
+      user
+    };
+  }
+
+  _normalizeIdentifier(value) {
+    if (value == null) return value;
+    if (!this.caseInsensitive) {
+      return typeof value === 'string' ? value.trim() : value;
+    }
+    if (typeof value !== 'string') {
+      return value;
+    }
+    return value.trim().toLowerCase();
+  }
+}

package/src/plugins/identity/email-service.js

@@ -7,6 +7,8 @@
  * Email Service class
  * @class
  */
+import { PluginError } from '../../errors.js';
+
 export class EmailService {
   /**
    * Create Email Service instance
@@ -81,7 +83,14 @@ export class EmailService {
       this.initialized = true;
     } catch (error) {
       console.error('[EmailService] Failed to initialize:', error);
-      throw new Error(`Failed to initialize email service: ${error.message}`);
+      throw new PluginError(`Failed to initialize email service: ${error.message}`, {
+        pluginName: 'IdentityPlugin',
+        operation: 'emailInitialize',
+        statusCode: 502,
+        retriable: true,
+        suggestion: 'Verify SMTP credentials/host settings or disable email service when not configured.',
+        original: error
+      });
     }
   }
 
@@ -112,7 +121,13 @@ export class EmailService {
     const { to, subject, html, text, from, replyTo } = options;
 
     if (!to || !subject || !html) {
-      throw new Error('Email requires to, subject, and html fields');
+      throw new PluginError('Email requires to, subject, and html fields', {
+        pluginName: 'IdentityPlugin',
+        operation: 'sendEmail',
+        statusCode: 400,
+        retriable: false,
+        suggestion: 'Pass recipient (to), subject, and html body when calling emailService.sendEmail().'
+      });
     }
 
     try {