ui-syncup 0.3.13 → 0.4.0-beta.1

package/src/server/auth/session.ts

@@ -0,0 +1,392 @@
+/**
+ * Session management utilities
+ * 
+ * This module provides session management via better-auth.
+ * All session validation is now handled by better-auth's built-in
+ * session API, providing a single source of truth for auth state.
+ * 
+ * Security features:
+ * - better-auth handles session token generation
+ * - Session validation via better-auth API
+ * - Secure session deletion
+ * - Multi-device session support
+ * 
+ * @module server/auth/session
+ * 
+ * @deprecated createSession is deprecated - use better-auth's signIn.email instead.
+ * The createSession function is kept for backwards compatibility with
+ * legacy routes and tests. New code should use authClient.signIn.email.
+ */
+
+import { randomBytes } from 'crypto';
+import { db } from '@/lib/db';
+import { sessions } from '@/server/db/schema';
+import { eq } from 'drizzle-orm';
+
+/**
+ * Session configuration constants
+ */
+const SESSION_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000; // 7 days in milliseconds
+const SESSION_RENEWAL_THRESHOLD_MS = 24 * 60 * 60 * 1000; // Renew if < 24 hours remaining
+
+/**
+ * User data returned from session validation
+ */
+export interface SessionUser {
+  id: string;
+  email: string;
+  emailVerified: boolean;
+  name: string;
+  image?: string | null;
+  hasPassword?: boolean;
+  sessionId: string;
+}
+
+/**
+ * Generate a cryptographically secure random session token
+ * 
+ * @returns A random hex string (32 bytes = 64 hex characters)
+ */
+function generateSessionToken(): string {
+  return randomBytes(32).toString('hex');
+}
+
+/**
+ * Calculate session expiration timestamp
+ * 
+ * @returns Date object representing when the session expires
+ */
+function calculateExpiration(): Date {
+  return new Date(Date.now() + SESSION_LIFETIME_MS);
+}
+
+/**
+ * Check if a session should be renewed based on remaining lifetime
+ * 
+ * @param expiresAt - Current expiration timestamp
+ * @returns True if session should be renewed
+ */
+function shouldRenewSession(expiresAt: Date): boolean {
+  const now = Date.now();
+  const expiresAtMs = expiresAt.getTime();
+  const remainingMs = expiresAtMs - now;
+  
+  return remainingMs < SESSION_RENEWAL_THRESHOLD_MS;
+}
+
+/**
+ * Create a new session for a user
+ * 
+ * Generates a cryptographically random session token, stores it in the database
+ * with expiration timestamp, IP address, and user agent for audit purposes.
+ * 
+ * @param userId - User ID to create session for
+ * @param ipAddress - Client IP address (optional, for audit logging)
+ * @param userAgent - Client user agent (optional, for audit logging)
+ * @returns Promise resolving to the session token string
+ * @throws {Error} If session creation fails
+ * 
+ * @example
+ * ```typescript
+ * // Create session after successful authentication
+ * const sessionToken = await createSession(
+ *   user.id,
+ *   request.headers.get('x-forwarded-for') || '127.0.0.1',
+ *   request.headers.get('user-agent') || 'Unknown'
+ * );
+ * 
+ * // Set session cookie
+ * const response = NextResponse.json({ user });
+ * setSessionCookie(response, sessionToken);
+ * ```
+ */
+export async function createSession(
+  userId: string,
+  ipAddress?: string,
+  userAgent?: string
+): Promise<string> {
+  if (!userId || userId.length === 0) {
+    throw new Error('User ID is required');
+  }
+
+  // Generate cryptographically random session token (alphanumeric, 32 chars)
+  // better-auth uses randomString(32) which includes A-Z, a-z, 0-9
+  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+  let token = '';
+  // Use randomBytes to get random indices to avoid Math.random() bias if possible, 
+  // but for tests Math.random is sufficient. 
+  // However, let's be robust using randomBytes.
+  const bytes = randomBytes(32);
+  for (let i = 0; i < 32; i++) {
+    token += chars[bytes[i] % chars.length];
+  }
+  
+  // Calculate expiration
+  const expiresAt = calculateExpiration();
+
+  try {
+    // Store session in database
+    // Trim and validate optional fields
+    const trimmedIpAddress = ipAddress?.trim() || null;
+    const trimmedUserAgent = userAgent?.trim() || null;
+    
+    await db.insert(sessions).values({
+      userId,
+      token,
+      expiresAt,
+      ipAddress: trimmedIpAddress,
+      userAgent: trimmedUserAgent,
+    });
+
+    return token;
+  } catch (error) {
+    const baseMessage = error instanceof Error ? error.message : 'Unknown error';
+    const causeMessage =
+      error && typeof error === 'object' && 'cause' in error && error.cause instanceof Error
+        ? error.cause.message
+        : undefined;
+
+    throw new Error(
+      `Failed to create session: ${baseMessage}${causeMessage ? ` | Cause: ${causeMessage}` : ''}`
+    );
+  }
+}
+
+/**
+ * Get and validate the current session
+ * 
+ * This function supports both better-auth OAuth sessions and custom session tokens.
+ * It first tries to validate using better-auth's session API (for OAuth logins),
+ * then falls back to custom session token lookup (for email/password logins).
+ * 
+ * @param context - Optional context for logging (ipAddress, userAgent, requestId)
+ * @returns Promise resolving to SessionUser if valid, null otherwise
+ * 
+ * @example
+ * ```typescript
+ * // In a server component or API route
+ * const user = await getSession();
+ * if (!user) {
+ *   redirect('/sign-in');
+ * }
+ * 
+ * // User is authenticated
+ * console.log(user.email);
+ * ```
+ */
+export async function getSession(
+  context?: {
+    token?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    requestId?: string;
+  }
+): Promise<SessionUser | null> {
+  // Use better-auth's session validation for all auth methods
+  // Both OAuth and email/password now use better-auth sessions
+  try {
+    const { auth } = await import('@/lib/auth');
+    const { headers } = await import('next/headers');
+    
+    const headersList = await headers();
+    
+    // Create a new Headers object to avoid modifying the read-only headers
+    const requestHeaders = new Headers(headersList);
+    
+    // If a token is explicitly provided (e.g. in tests), set it as a cookie
+    if (context?.token) {
+      requestHeaders.set('Cookie', `better-auth.session_token=${context.token}`);
+    }
+    
+    // Convert Headers to plain object as better-auth might expect that for internal API calls
+    const headersObj: Record<string, string> = {
+      // Ensure Origin and Host are present for better-auth validation
+      'origin': process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000',
+      'host': 'localhost:3000',
+    };
+    
+    requestHeaders.forEach((value, key) => {
+      headersObj[key] = value;
+    });
+    
+    // Explicitly set the cookie again in the plain object to be sure
+    if (context?.token) {
+      headersObj['cookie'] = `better-auth.session_token=${context.token}`;
+      // Also trying upper case Cookie just in case
+      headersObj['Cookie'] = `better-auth.session_token=${context.token}`;
+    }
+    
+    const betterAuthSession = await auth.api.getSession({
+      headers: headersObj,
+    });
+    
+    if (betterAuthSession?.user) {
+      return {
+        id: betterAuthSession.user.id,
+        email: betterAuthSession.user.email,
+        emailVerified: betterAuthSession.user.emailVerified,
+        name: betterAuthSession.user.name,
+        image: betterAuthSession.user.image ?? null,
+        sessionId: betterAuthSession.session.id,
+        hasPassword: await (async () => {
+          try {
+             const dbUser = await db.query.users.findFirst({
+              where: (users, { eq }) => eq(users.id, betterAuthSession.user.id),
+              columns: { passwordHash: true },
+            });
+            return !!dbUser?.passwordHash;
+          } catch {
+            return false;
+          }
+        })(),
+      };
+    }
+    
+    // Fallback: Check for custom session token (used by admin setup wizard)
+    // This handles the case where admin account was created with createSession()
+    // which sets the session_token cookie, not better-auth.session_token
+    const { getSessionCookie } = await import('@/server/auth/cookies');
+    const customToken = await getSessionCookie();
+    
+    if (customToken) {
+      // Look up the session in our sessions table
+      const sessionRecord = await db.query.sessions.findFirst({
+        where: (s, { eq, and, gt }) => and(
+          eq(s.token, customToken),
+          gt(s.expiresAt, new Date())
+        ),
+      });
+      
+      if (sessionRecord) {
+        // Get the user data
+        const user = await db.query.users.findFirst({
+          where: (u, { eq }) => eq(u.id, sessionRecord.userId),
+        });
+        
+        if (user) {
+          return {
+            id: user.id,
+            email: user.email,
+            emailVerified: user.emailVerified,
+            name: user.name,
+            image: user.image ?? null,
+            sessionId: sessionRecord.id,
+            hasPassword: !!user.passwordHash,
+          };
+        }
+      }
+    }
+    
+    return null;
+  } catch (error) {
+    // Log session errors in development
+    if (process.env.NODE_ENV === 'development') {
+      console.error('[getSession] Error:', error);
+    }
+    return null;
+  }
+}
+
+/**
+ * Extend a session's expiration time (rolling renewal)
+ * 
+ * Updates the session's expiration timestamp to extend its lifetime.
+ * This is called automatically by getSession() when a session is close to expiring.
+ * 
+ * @param sessionId - Session ID to extend
+ * @returns Promise resolving when session is extended
+ * @throws {Error} If session extension fails
+ * 
+ * @example
+ * ```typescript
+ * // Manually extend a session
+ * await extendSession(sessionId);
+ * ```
+ */
+export async function extendSession(sessionId: string): Promise<void> {
+  if (!sessionId || sessionId.length === 0) {
+    throw new Error('Session ID is required');
+  }
+
+  const newExpiresAt = calculateExpiration();
+
+  try {
+    await db
+      .update(sessions)
+      .set({ expiresAt: newExpiresAt })
+      .where(eq(sessions.id, sessionId));
+  } catch (error) {
+    throw new Error(
+      `Failed to extend session: ${error instanceof Error ? error.message : 'Unknown error'}`
+    );
+  }
+}
+
+/**
+ * Delete a specific session
+ * 
+ * Removes a session from the database. This is used during sign-out
+ * to invalidate the current session.
+ * 
+ * @param sessionId - Session ID to delete
+ * @returns Promise resolving when session is deleted
+ * @throws {Error} If session deletion fails
+ * 
+ * @example
+ * ```typescript
+ * // Sign out current session
+ * const user = await getSession();
+ * if (user) {
+ *   await deleteSession(user.sessionId);
+ * }
+ * ```
+ */
+export async function deleteSession(sessionId: string): Promise<void> {
+  if (!sessionId || sessionId.length === 0) {
+    throw new Error('Session ID is required');
+  }
+
+  try {
+    await db
+      .delete(sessions)
+      .where(eq(sessions.id, sessionId));
+  } catch (error) {
+    throw new Error(
+      `Failed to delete session: ${error instanceof Error ? error.message : 'Unknown error'}`
+    );
+  }
+}
+
+/**
+ * Delete all sessions for a user
+ * 
+ * Removes all active sessions for a user from the database.
+ * This is used when a user changes their password or when
+ * security requires invalidating all sessions.
+ * 
+ * @param userId - User ID whose sessions should be deleted
+ * @returns Promise resolving when all sessions are deleted
+ * @throws {Error} If session deletion fails
+ * 
+ * @example
+ * ```typescript
+ * // Invalidate all sessions after password change
+ * await updateUserPassword(userId, newPasswordHash);
+ * await deleteAllUserSessions(userId);
+ * ```
+ */
+export async function deleteAllUserSessions(userId: string): Promise<void> {
+  if (!userId || userId.length === 0) {
+    throw new Error('User ID is required');
+  }
+
+  try {
+    await db
+      .delete(sessions)
+      .where(eq(sessions.userId, userId));
+  } catch (error) {
+    throw new Error(
+      `Failed to delete user sessions: ${error instanceof Error ? error.message : 'Unknown error'}`
+    );
+  }
+}

package/src/server/auth/token-encryption.ts

@@ -0,0 +1,201 @@
+/**
+ * Token Encryption Utilities
+ *
+ * Provides encryption and decryption for sensitive token data.
+ * Uses AES-256-GCM for authenticated encryption.
+ *
+ * @module server/auth/token-encryption
+ */
+
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+
+/**
+ * Encryption algorithm used for token encryption
+ */
+const ALGORITHM = "aes-256-gcm";
+
+/**
+ * Length of the initialization vector in bytes
+ */
+const IV_LENGTH = 12;
+
+/**
+ * Length of the authentication tag in bytes
+ */
+const AUTH_TAG_LENGTH = 16;
+
+/**
+ * Minimum key length in bytes (256 bits)
+ */
+const MIN_KEY_LENGTH = 32;
+
+/**
+ * Encrypts a token using AES-256-GCM
+ *
+ * The encrypted result includes:
+ * - IV (12 bytes): Random initialization vector
+ * - Ciphertext: The encrypted token
+ * - Auth Tag (16 bytes): Authentication tag for integrity verification
+ *
+ * @param token - The plaintext token to encrypt
+ * @param key - The encryption key (must be 32 bytes / 256 bits)
+ * @returns Base64-encoded encrypted token (IV + ciphertext + authTag)
+ * @throws Error if key is invalid or encryption fails
+ *
+ * @example
+ * ```ts
+ * const key = process.env.TOKEN_ENCRYPTION_KEY; // 32-byte key
+ * const encrypted = encryptToken("my-secret-token", key);
+ * ```
+ */
+export function encryptToken(token: string, key: string): string {
+  if (!token) {
+    throw new Error("Token cannot be empty");
+  }
+
+  if (!key || key.length < MIN_KEY_LENGTH) {
+    throw new Error(`Encryption key must be at least ${MIN_KEY_LENGTH} bytes`);
+  }
+
+  // Use only first 32 bytes of key
+  const keyBuffer = Buffer.from(key.slice(0, MIN_KEY_LENGTH), "utf-8");
+
+  // Generate random IV
+  const iv = randomBytes(IV_LENGTH);
+
+  // Create cipher
+  const cipher = createCipheriv(ALGORITHM, keyBuffer, iv);
+
+  // Encrypt the token
+  const encrypted = Buffer.concat([
+    cipher.update(token, "utf-8"),
+    cipher.final(),
+  ]);
+
+  // Get authentication tag
+  const authTag = cipher.getAuthTag();
+
+  // Combine IV + encrypted data + auth tag
+  const combined = Buffer.concat([iv, encrypted, authTag]);
+
+  return combined.toString("base64");
+}
+
+/**
+ * Decrypts a token encrypted with encryptToken
+ *
+ * @param encryptedToken - Base64-encoded encrypted token
+ * @param key - The encryption key (must match encryption key)
+ * @returns The decrypted plaintext token
+ * @throws Error if decryption fails or token is tampered with
+ *
+ * @example
+ * ```ts
+ * const key = process.env.TOKEN_ENCRYPTION_KEY;
+ * const decrypted = decryptToken(encryptedToken, key);
+ * ```
+ */
+export function decryptToken(encryptedToken: string, key: string): string {
+  if (!encryptedToken) {
+    throw new Error("Encrypted token cannot be empty");
+  }
+
+  if (!key || key.length < MIN_KEY_LENGTH) {
+    throw new Error(`Encryption key must be at least ${MIN_KEY_LENGTH} bytes`);
+  }
+
+  // Use only first 32 bytes of key
+  const keyBuffer = Buffer.from(key.slice(0, MIN_KEY_LENGTH), "utf-8");
+
+  // Decode the base64 token
+  const combined = Buffer.from(encryptedToken, "base64");
+
+  // Validate minimum length (IV + at least 1 byte + auth tag)
+  if (combined.length < IV_LENGTH + 1 + AUTH_TAG_LENGTH) {
+    throw new Error("Invalid encrypted token format");
+  }
+
+  // Extract IV, encrypted data, and auth tag
+  const iv = combined.subarray(0, IV_LENGTH);
+  const authTag = combined.subarray(combined.length - AUTH_TAG_LENGTH);
+  const encrypted = combined.subarray(IV_LENGTH, combined.length - AUTH_TAG_LENGTH);
+
+  // Create decipher
+  const decipher = createDecipheriv(ALGORITHM, keyBuffer, iv);
+  decipher.setAuthTag(authTag);
+
+  // Decrypt
+  try {
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final(),
+    ]);
+
+    return decrypted.toString("utf-8");
+  } catch (error) {
+    throw new Error("Failed to decrypt token: invalid key or tampered data");
+  }
+}
+
+/**
+ * Checks if token encryption is available
+ *
+ * @returns True if encryption key is configured
+ */
+export function isEncryptionAvailable(): boolean {
+  const key = process.env.TOKEN_ENCRYPTION_KEY;
+  return !!key && key.length >= MIN_KEY_LENGTH;
+}
+
+/**
+ * Safely encrypts a token if encryption is available
+ *
+ * @param token - The token to encrypt
+ * @returns Encrypted token if key available, original token otherwise
+ */
+export function safeEncryptToken(token: string): string {
+  const key = process.env.TOKEN_ENCRYPTION_KEY;
+  if (!key || key.length < MIN_KEY_LENGTH) {
+    return token;
+  }
+  return encryptToken(token, key);
+}
+
+/**
+ * Safely decrypts a token if it appears to be encrypted
+ *
+ * @param token - The potentially encrypted token
+ * @returns Decrypted token if encrypted, original token otherwise
+ */
+export function safeDecryptToken(token: string): string {
+  const key = process.env.TOKEN_ENCRYPTION_KEY;
+  if (!key || key.length < MIN_KEY_LENGTH) {
+    return token;
+  }
+
+  // Check if token looks like base64 (encrypted)
+  if (!isBase64(token)) {
+    return token;
+  }
+
+  try {
+    return decryptToken(token, key);
+  } catch {
+    // If decryption fails, return original (might not be encrypted)
+    return token;
+  }
+}
+
+/**
+ * Checks if a string appears to be base64 encoded
+ */
+function isBase64(str: string): boolean {
+  if (!str || str.length === 0) {
+    return false;
+  }
+  try {
+    return Buffer.from(str, "base64").toString("base64") === str;
+  } catch {
+    return false;
+  }
+}