visionos-monorepo 0.1.0

package/server/src/features/accounts/accountStore.ts

@@ -0,0 +1,359 @@
+import { createHash, randomBytes } from "node:crypto";
+import {
+  MongoClient,
+  ObjectId,
+  type Collection,
+  type Db,
+  type Document,
+  type WithId
+} from "mongodb";
+import {
+  type AccountAuthResponse,
+  type AccountUser,
+  type LearnerIdentity,
+  type LearningProgress,
+  type LearningTrackId,
+  type UpsertLearningProgressRequest
+} from "../../../../shared/src/index.js";
+import { hashPassword, verifyPassword } from "./password.js";
+
+interface UserDocument extends Document {
+  name: string;
+  email: string;
+  passwordHash?: string;
+  passwordSalt?: string;
+  googleSubject?: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+interface SessionDocument extends Document {
+  tokenHash: string;
+  userId: ObjectId;
+  createdAt: string;
+}
+
+interface ProgressDocument extends Document {
+  userId: ObjectId;
+  trackId: LearningTrackId;
+  completedLessonIds: string[];
+  completedStepIds: string[];
+  currentLessonId?: string;
+  updatedAt: string;
+}
+
+interface GoogleProfile {
+  email: string;
+  name: string;
+  subject: string;
+}
+
+export interface AccountStore {
+  register(input: { email: string; name: string; password: string }): Promise<AccountAuthResponse>;
+  login(input: { email: string; password: string }): Promise<AccountAuthResponse>;
+  loginWithGoogle(profile: GoogleProfile): Promise<AccountAuthResponse>;
+  getUserFromToken(token: string): Promise<AccountUser | null>;
+  getProgress(userId: string): Promise<LearningProgress[]>;
+  upsertProgress(userId: string, input: UpsertLearningProgressRequest): Promise<LearningProgress>;
+}
+
+export class AccountStoreError extends Error {
+  constructor(
+    message: string,
+    readonly status = 400
+  ) {
+    super(message);
+    this.name = "AccountStoreError";
+  }
+}
+
+export class MongoAccountStore implements AccountStore {
+  private readonly client: MongoClient;
+  private dbPromise: Promise<Db> | null = null;
+
+  constructor(
+    mongoUri: string,
+    private readonly dbName: string
+  ) {
+    this.client = new MongoClient(mongoUri);
+  }
+
+  async register(input: { email: string; name: string; password: string }) {
+    const email = normalizeEmail(input.email);
+    const name = input.name.trim();
+    const password = input.password.trim();
+
+    if (!name) {
+      throw new AccountStoreError("Name is required to create an account.");
+    }
+
+    if (!isValidEmail(email)) {
+      throw new AccountStoreError("A valid email address is required.");
+    }
+
+    if (password.length < 8) {
+      throw new AccountStoreError("Password must be at least 8 characters.");
+    }
+
+    const users = await this.users();
+    const existing = await users.findOne({ email });
+
+    if (existing) {
+      throw new AccountStoreError("An account with this email already exists.", 409);
+    }
+
+    const now = new Date().toISOString();
+    const passwordRecord = await hashPassword(password);
+    const insertResult = await users.insertOne({
+      name,
+      email,
+      passwordHash: passwordRecord.hash,
+      passwordSalt: passwordRecord.salt,
+      createdAt: now,
+      updatedAt: now
+    });
+
+    return this.createAuthResponse({
+      _id: insertResult.insertedId,
+      name,
+      email,
+      passwordHash: passwordRecord.hash,
+      passwordSalt: passwordRecord.salt,
+      createdAt: now,
+      updatedAt: now
+    });
+  }
+
+  async login(input: { email: string; password: string }) {
+    const email = normalizeEmail(input.email);
+    const user = await (await this.users()).findOne({ email });
+
+    if (!user?.passwordHash || !user.passwordSalt) {
+      throw new AccountStoreError("Invalid email or password.", 401);
+    }
+
+    const passwordMatches = await verifyPassword(input.password, user.passwordSalt, user.passwordHash);
+
+    if (!passwordMatches) {
+      throw new AccountStoreError("Invalid email or password.", 401);
+    }
+
+    return this.createAuthResponse(user);
+  }
+
+  async loginWithGoogle(profile: GoogleProfile) {
+    const email = normalizeEmail(profile.email);
+
+    if (!isValidEmail(email)) {
+      throw new AccountStoreError("Google did not return a valid email address.", 401);
+    }
+
+    const users = await this.users();
+    const now = new Date().toISOString();
+    const existing = await users.findOne({ email });
+
+    if (existing) {
+      await users.updateOne(
+        { _id: existing._id },
+        {
+          $set: {
+            googleSubject: existing.googleSubject ?? profile.subject,
+            name: existing.name || profile.name,
+            updatedAt: now
+          }
+        }
+      );
+
+      return this.createAuthResponse({
+        ...existing,
+        googleSubject: existing.googleSubject ?? profile.subject,
+        name: existing.name || profile.name,
+        updatedAt: now
+      });
+    }
+
+    const user: UserDocument = {
+      name: profile.name,
+      email,
+      googleSubject: profile.subject,
+      createdAt: now,
+      updatedAt: now
+    };
+    const insertResult = await users.insertOne(user);
+
+    return this.createAuthResponse({
+      ...user,
+      _id: insertResult.insertedId
+    });
+  }
+
+  async getUserFromToken(token: string) {
+    const tokenHash = hashToken(token);
+    const session = await (await this.sessions()).findOne({ tokenHash });
+
+    if (!session) {
+      return null;
+    }
+
+    const user = await (await this.users()).findOne({ _id: session.userId });
+
+    return user ? serializeUser(user) : null;
+  }
+
+  async getProgress(userId: string) {
+    const records = await (await this.progress())
+      .find({ userId: toObjectId(userId) })
+      .sort({ updatedAt: -1 })
+      .toArray();
+
+    return records.map(serializeProgress);
+  }
+
+  async upsertProgress(userId: string, input: UpsertLearningProgressRequest) {
+    const now = new Date().toISOString();
+    const progress = await this.progress();
+
+    // Fetch the existing record to merge completed lessons/steps and prevent data loss
+    const existing = await progress.findOne({
+      userId: toObjectId(userId),
+      trackId: input.trackId
+    });
+
+    const completedLessonIds = Array.from(
+      new Set([...(existing?.completedLessonIds ?? []), ...(input.completedLessonIds ?? [])])
+    );
+
+    const completedStepIds = Array.from(
+      new Set([...(existing?.completedStepIds ?? []), ...(input.completedStepIds ?? [])])
+    );
+
+    const update = {
+      $set: {
+        completedLessonIds,
+        completedStepIds,
+        currentLessonId: input.currentLessonId ?? existing?.currentLessonId,
+        updatedAt: now
+      },
+      $setOnInsert: {
+        userId: toObjectId(userId),
+        trackId: input.trackId
+      }
+    };
+
+    const result = await progress.findOneAndUpdate(
+      {
+        userId: toObjectId(userId),
+        trackId: input.trackId
+      },
+      update,
+      {
+        returnDocument: "after",
+        upsert: true
+      }
+    );
+
+    if (!result) {
+      throw new AccountStoreError("Unable to save learning progress.", 500);
+    }
+
+    return serializeProgress(result);
+  }
+
+  private async createAuthResponse(user: WithId<UserDocument>): Promise<AccountAuthResponse> {
+    const token = randomBytes(32).toString("base64url");
+    await (await this.sessions()).insertOne({
+      tokenHash: hashToken(token),
+      userId: user._id,
+      createdAt: new Date().toISOString()
+    });
+
+    return {
+      token,
+      user: serializeUser(user)
+    };
+  }
+
+  private async db() {
+    if (!this.dbPromise) {
+      this.dbPromise = this.client.connect().then(async (client) => {
+        const db = client.db(this.dbName);
+        await Promise.all([
+          db.collection<UserDocument>("users").createIndex({ email: 1 }, { unique: true }),
+          db.collection<UserDocument>("users").createIndex({ googleSubject: 1 }, { sparse: true }),
+          db.collection<SessionDocument>("accountSessions").createIndex({ tokenHash: 1 }, { unique: true }),
+          db.collection<ProgressDocument>("progress").createIndex({ userId: 1, trackId: 1 }, { unique: true })
+        ]);
+
+        return db;
+      });
+    }
+
+    return this.dbPromise;
+  }
+
+  private async users(): Promise<Collection<UserDocument>> {
+    return (await this.db()).collection<UserDocument>("users");
+  }
+
+  private async sessions(): Promise<Collection<SessionDocument>> {
+    return (await this.db()).collection<SessionDocument>("accountSessions");
+  }
+
+  private async progress(): Promise<Collection<ProgressDocument>> {
+    return (await this.db()).collection<ProgressDocument>("progress");
+  }
+}
+
+export function createAccountStore(mongoUri?: string, dbName = "visionos") {
+  return mongoUri ? new MongoAccountStore(mongoUri, dbName) : null;
+}
+
+export function bearerTokenFromHeader(header: string | undefined) {
+  if (!header?.startsWith("Bearer ")) {
+    return null;
+  }
+
+  const token = header.slice("Bearer ".length).trim();
+
+  return token || null;
+}
+
+function normalizeEmail(email: string) {
+  return email.trim().toLowerCase();
+}
+
+function isValidEmail(email: string) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+
+function hashToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+function serializeUser(user: WithId<UserDocument>): AccountUser {
+  return {
+    userId: user._id.toHexString(),
+    name: user.name,
+    email: user.email,
+    createdAt: user.createdAt
+  };
+}
+
+function serializeProgress(progress: WithId<ProgressDocument>): LearningProgress {
+  return {
+    userId: progress.userId.toHexString(),
+    trackId: progress.trackId,
+    completedLessonIds: progress.completedLessonIds,
+    completedStepIds: progress.completedStepIds,
+    currentLessonId: progress.currentLessonId,
+    updatedAt: progress.updatedAt
+  };
+}
+
+function toObjectId(value: string) {
+  if (!ObjectId.isValid(value)) {
+    throw new AccountStoreError("Invalid account identifier.", 400);
+  }
+
+  return new ObjectId(value);
+}

package/server/src/features/accounts/contentStore.ts

@@ -0,0 +1,264 @@
+import { MongoClient, ObjectId, type Collection, type Db, type Document, type WithId } from "mongodb";
+import {
+  type LearningTrack,
+  type LearningLesson,
+  type LearningTrackId,
+  LEARNING_TRACKS,
+  BEGINNER_LESSONS
+} from "../../../../shared/src/index.js";
+
+interface TrackDocument extends Document {
+  id: string;
+  label: string;
+  description: string;
+  creatorId: ObjectId;
+  createdAt: string;
+  updatedAt: string;
+}
+
+interface LessonDocument extends Document {
+  id: string;
+  trackId: string;
+  title: string;
+  difficulty: string;
+  summary: string;
+  estimatedMinutes: number;
+  steps: Array<{
+    id: string;
+    title: string;
+    objective: string;
+    command: string;
+    explanation: string;
+    validationType?: "syntax" | "file-exists" | "file-contains";
+    validationPath?: string;
+    validationContent?: string;
+  }>;
+  creatorId: ObjectId;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface ContentStore {
+  listTracks(): Promise<LearningTrack[]>;
+  listLessons(trackId: string): Promise<LearningLesson[]>;
+  createTrack(creatorId: string, data: { id: string; label: string; description: string }): Promise<LearningTrack>;
+  updateTrack(creatorId: string, trackId: string, data: { label: string; description: string }): Promise<LearningTrack>;
+  createLesson(creatorId: string, data: Omit<LearningLesson, "creatorId" | "createdAt">): Promise<LearningLesson>;
+  updateLesson(creatorId: string, lessonId: string, data: Partial<Omit<LearningLesson, "creatorId" | "createdAt">>): Promise<LearningLesson>;
+}
+
+export class MongoContentStore implements ContentStore {
+  private readonly client: MongoClient;
+  private dbPromise: Promise<Db> | null = null;
+
+  constructor(
+    mongoUri: string,
+    private readonly dbName: string
+  ) {
+    this.client = new MongoClient(mongoUri);
+  }
+
+  async listTracks(): Promise<LearningTrack[]> {
+    const tracksCollection = await this.tracks();
+    const dbTracks = await tracksCollection.find().toArray();
+    const serializedDbTracks = dbTracks.map(serializeTrack);
+
+    // Merge static and dynamic tracks
+    const allTracksMap = new Map<string, LearningTrack>();
+    for (const track of LEARNING_TRACKS) {
+      allTracksMap.set(track.id, track);
+    }
+    for (const track of serializedDbTracks) {
+      allTracksMap.set(track.id, track);
+    }
+
+    return Array.from(allTracksMap.values());
+  }
+
+  async listLessons(trackId: string): Promise<LearningLesson[]> {
+    const lessonsCollection = await this.lessons();
+    const dbLessons = await lessonsCollection.find({ trackId }).toArray();
+    const serializedDbLessons = dbLessons.map(serializeLesson);
+
+    // Merge static and dynamic lessons
+    const allLessonsMap = new Map<string, LearningLesson>();
+    for (const lesson of BEGINNER_LESSONS) {
+      if (lesson.trackId === trackId) {
+        allLessonsMap.set(lesson.id, lesson);
+      }
+    }
+    for (const lesson of serializedDbLessons) {
+      allLessonsMap.set(lesson.id, lesson);
+    }
+
+    return Array.from(allLessonsMap.values());
+  }
+
+  async createTrack(creatorId: string, data: { id: string; label: string; description: string }): Promise<LearningTrack> {
+    const tracksCollection = await this.tracks();
+    const existing = await tracksCollection.findOne({ id: data.id });
+    if (existing || LEARNING_TRACKS.some(t => t.id === data.id)) {
+      throw new Error(`Track with ID '${data.id}' already exists.`);
+    }
+
+    const now = new Date().toISOString();
+    const doc: TrackDocument = {
+      id: data.id,
+      label: data.label,
+      description: data.description,
+      creatorId: new ObjectId(creatorId),
+      createdAt: now,
+      updatedAt: now
+    };
+
+    await tracksCollection.insertOne(doc);
+    return serializeTrack(doc as WithId<TrackDocument>);
+  }
+
+  async updateTrack(creatorId: string, trackId: string, data: { label: string; description: string }): Promise<LearningTrack> {
+    const tracksCollection = await this.tracks();
+    const track = await tracksCollection.findOne({ id: trackId });
+
+    if (!track) {
+      throw new Error(`Track not found or is static and cannot be modified.`);
+    }
+
+    if (track.creatorId.toHexString() !== creatorId) {
+      throw new Error("You do not have permission to edit this track.");
+    }
+
+    const now = new Date().toISOString();
+    const result = await tracksCollection.findOneAndUpdate(
+      { id: trackId },
+      {
+        $set: {
+          label: data.label,
+          description: data.description,
+          updatedAt: now
+        }
+      },
+      { returnDocument: "after" }
+    );
+
+    if (!result) {
+      throw new Error("Track not found during update.");
+    }
+
+    return serializeTrack(result);
+  }
+
+  async createLesson(creatorId: string, data: Omit<LearningLesson, "creatorId" | "createdAt">): Promise<LearningLesson> {
+    const lessonsCollection = await this.lessons();
+    const existing = await lessonsCollection.findOne({ id: data.id });
+    if (existing || BEGINNER_LESSONS.some(l => l.id === data.id)) {
+      throw new Error(`Lesson with ID '${data.id}' already exists.`);
+    }
+
+    // Verify track ownership
+    const tracksCollection = await this.tracks();
+    const track = await tracksCollection.findOne({ id: data.trackId });
+    if (track && track.creatorId.toHexString() !== creatorId) {
+      throw new Error("You do not have permission to add lessons to this track.");
+    }
+
+    const now = new Date().toISOString();
+    const doc: LessonDocument = {
+      id: data.id,
+      trackId: data.trackId,
+      title: data.title,
+      difficulty: data.difficulty,
+      summary: data.summary,
+      estimatedMinutes: data.estimatedMinutes,
+      steps: data.steps,
+      creatorId: new ObjectId(creatorId),
+      createdAt: now,
+      updatedAt: now
+    };
+
+    await lessonsCollection.insertOne(doc);
+    return serializeLesson(doc as WithId<LessonDocument>);
+  }
+
+  async updateLesson(creatorId: string, lessonId: string, data: Partial<Omit<LearningLesson, "creatorId" | "createdAt">>): Promise<LearningLesson> {
+    const lessonsCollection = await this.lessons();
+    const lesson = await lessonsCollection.findOne({ id: lessonId });
+
+    if (!lesson) {
+      throw new Error(`Lesson not found or is static and cannot be modified.`);
+    }
+
+    if (lesson.creatorId.toHexString() !== creatorId) {
+      throw new Error("You do not have permission to edit this lesson.");
+    }
+
+    const now = new Date().toISOString();
+    const updatePayload: Partial<LessonDocument> = {
+      updatedAt: now
+    };
+
+    if (data.title !== undefined) updatePayload.title = data.title;
+    if (data.difficulty !== undefined) updatePayload.difficulty = data.difficulty;
+    if (data.summary !== undefined) updatePayload.summary = data.summary;
+    if (data.estimatedMinutes !== undefined) updatePayload.estimatedMinutes = data.estimatedMinutes;
+    if (data.steps !== undefined) updatePayload.steps = data.steps;
+
+    const result = await lessonsCollection.findOneAndUpdate(
+      { id: lessonId },
+      { $set: updatePayload },
+      { returnDocument: "after" }
+    );
+
+    if (!result) {
+      throw new Error("Lesson not found during update.");
+    }
+
+    return serializeLesson(result);
+  }
+
+  private async db() {
+    if (!this.dbPromise) {
+      this.dbPromise = this.client.connect().then(async (client) => {
+        const db = client.db(this.dbName);
+        await Promise.all([
+          db.collection<TrackDocument>("tracks").createIndex({ id: 1 }, { unique: true }),
+          db.collection<LessonDocument>("lessons").createIndex({ id: 1 }, { unique: true }),
+          db.collection<LessonDocument>("lessons").createIndex({ trackId: 1 })
+        ]);
+        return db;
+      });
+    }
+    return this.dbPromise;
+  }
+
+  private async tracks(): Promise<Collection<TrackDocument>> {
+    return (await this.db()).collection<TrackDocument>("tracks");
+  }
+
+  private async lessons(): Promise<Collection<LessonDocument>> {
+    return (await this.db()).collection<LessonDocument>("lessons");
+  }
+}
+
+function serializeTrack(doc: WithId<TrackDocument> | TrackDocument): LearningTrack {
+  return {
+    id: doc.id,
+    label: doc.label,
+    description: doc.description,
+    creatorId: doc.creatorId.toHexString(),
+    createdAt: doc.createdAt
+  };
+}
+
+function serializeLesson(doc: WithId<LessonDocument> | LessonDocument): LearningLesson {
+  return {
+    id: doc.id,
+    trackId: doc.trackId,
+    title: doc.title,
+    difficulty: doc.difficulty as any,
+    summary: doc.summary,
+    estimatedMinutes: doc.estimatedMinutes,
+    steps: doc.steps,
+    creatorId: doc.creatorId.toHexString(),
+    createdAt: doc.createdAt
+  };
+}

package/server/src/features/accounts/password.ts

@@ -0,0 +1,26 @@
+import { randomBytes, scrypt as scryptCallback, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+
+const scrypt = promisify(scryptCallback);
+const keyLength = 64;
+
+export async function hashPassword(password: string) {
+  const salt = randomBytes(16).toString("hex");
+  const hash = (await scrypt(password, salt, keyLength)) as Buffer;
+
+  return {
+    hash: hash.toString("hex"),
+    salt
+  };
+}
+
+export async function verifyPassword(password: string, salt: string, expectedHash: string) {
+  const hash = (await scrypt(password, salt, keyLength)) as Buffer;
+  const expected = Buffer.from(expectedHash, "hex");
+
+  if (hash.length !== expected.length) {
+    return false;
+  }
+
+  return timingSafeEqual(hash, expected);
+}