wabe 0.6.9 → 0.6.10

package/src/authentication/Session.ts

@@ -0,0 +1,529 @@
+import jwt, { verify, type SignOptions } from 'jsonwebtoken'
+import crypto from 'node:crypto'
+import type { WabeContext } from '../server/interface'
+import type { User } from '../../generated/wabe'
+import type { WabeConfig } from '../server'
+import { contextWithRoot } from '../utils/export'
+import type { DevWabeTypes } from '../utils/helper'
+import {
+	encryptDeterministicToken,
+	decryptDeterministicToken,
+} from '../utils/crypto'
+
+const getJwtSecret = (context: WabeContext<DevWabeTypes>): string => {
+	const secret = context.wabe.config.authentication?.session?.jwtSecret
+	if (!secret) throw new Error('Authentication session requires jwtSecret')
+	return secret
+}
+
+const safeVerify = (
+	token: string,
+	secret: string,
+	options: Pick<SignOptions, 'audience' | 'issuer'> = {},
+) => {
+	try {
+		return !!verify(token, secret, options)
+	} catch {
+		return false
+	}
+}
+
+const getTokenSecret = (context: WabeContext<DevWabeTypes>): string =>
+	context.wabe.config.authentication?.session?.tokenSecret ??
+	getJwtSecret(context)
+
+const getTokenEncryptionKey = (context: WabeContext<DevWabeTypes>) =>
+	crypto.createHash('sha256').update(getTokenSecret(context)).digest()
+
+const getJwtVerifyOptions = (context: WabeContext<DevWabeTypes>) => {
+	const opts: Pick<SignOptions, 'audience' | 'issuer'> = {}
+	const audience = context.wabe.config.authentication?.session?.jwtAudience
+	const issuer = context.wabe.config.authentication?.session?.jwtIssuer
+	if (audience) opts.audience = audience
+	if (issuer) opts.issuer = issuer
+	return opts
+}
+
+export class Session {
+	private accessToken: string | undefined = undefined
+	private refreshToken: string | undefined = undefined
+
+	getAccessTokenExpireAt(config: WabeConfig<DevWabeTypes>) {
+		const customExpiresInMs =
+			config?.authentication?.session?.accessTokenExpiresInMs
+
+		if (!customExpiresInMs) return new Date(Date.now() + 1000 * 60 * 15) // 15 minutes in ms
+
+		return new Date(Date.now() + customExpiresInMs)
+	}
+
+	_getRefreshTokenExpiresInMs(config: WabeConfig<DevWabeTypes>) {
+		const customExpiresInMs =
+			config?.authentication?.session?.refreshTokenExpiresInMs
+
+		if (!customExpiresInMs) return 1000 * 60 * 60 * 24 * 7 // 7 days in ms
+
+		return customExpiresInMs
+	}
+
+	getRefreshTokenExpireAt(config: WabeConfig<DevWabeTypes>) {
+		const expiresInMs = this._getRefreshTokenExpiresInMs(config)
+
+		return new Date(Date.now() + expiresInMs)
+	}
+
+	async meFromAccessToken(
+		{ accessToken, csrfToken }: { accessToken: string; csrfToken: string },
+		context: WabeContext<DevWabeTypes>,
+	): Promise<{
+		sessionId: string | null
+		user: User | null
+		accessToken: string | null
+		refreshToken?: string | null
+	}> {
+		const verifyOptions = getJwtVerifyOptions(context)
+		if (!safeVerify(accessToken, getJwtSecret(context), verifyOptions)) {
+			return {
+				sessionId: null,
+				user: null,
+				accessToken: null,
+				refreshToken: null,
+			}
+		}
+
+		const encryptedAccessToken = encryptDeterministicToken(
+			accessToken,
+			getTokenEncryptionKey(context),
+		)
+
+		const sessions = await context.wabe.controllers.database.getObjects({
+			className: '_Session',
+			where: {
+				accessTokenEncrypted: { equalTo: encryptedAccessToken },
+				OR: [
+					{
+						accessTokenExpiresAt: {
+							greaterThanOrEqualTo: new Date(),
+						},
+					},
+					{
+						refreshTokenExpiresAt: {
+							greaterThanOrEqualTo: new Date(),
+						},
+					},
+				],
+			},
+			select: {
+				id: true,
+				user: true,
+				accessTokenExpiresAt: true,
+				refreshTokenExpiresAt: true,
+				refreshTokenEncrypted: true,
+			},
+			first: 1,
+			context,
+		})
+
+		if (sessions.length === 0)
+			return {
+				sessionId: null,
+				user: null,
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		const session = sessions[0]
+
+		if (!session || !session?.user)
+			return {
+				sessionId: null,
+				user: null,
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		// CSRF check only for cookie-based sessions (enabled by default unless explicitly disabled)
+		if (
+			context.wabe.config.authentication?.session?.cookieSession &&
+			context.wabe.config.security?.disableCSRFProtection !== true
+		) {
+			const [receivedHmacHex, receivedRandomValue] = csrfToken.split('.')
+
+			if (!receivedHmacHex || !receivedRandomValue)
+				return {
+					sessionId: null,
+					user: null,
+					accessToken: null,
+					refreshToken: null,
+				}
+
+			const currentSessionId = session.id
+
+			const message = `${currentSessionId.length}!${currentSessionId}!${receivedRandomValue?.length}!${receivedRandomValue}`
+
+			const csrfSecret =
+				context.wabe.config.authentication?.session?.csrfSecret ||
+				getJwtSecret(context)
+
+			const expectedHmac = crypto
+				.createHmac('sha256', csrfSecret)
+				.update(message)
+				.digest('hex')
+
+			const isValid = crypto.timingSafeEqual(
+				Buffer.from(receivedHmacHex || '', 'hex'),
+				Buffer.from(expectedHmac, 'hex'),
+			)
+
+			if (!isValid)
+				return {
+					sessionId: null,
+					user: null,
+					accessToken: null,
+					refreshToken: null,
+				}
+		}
+
+		// User check
+
+		const user = session.user
+
+		const userWithRole = await context.wabe.controllers.database.getObject({
+			className: 'User',
+			select: {
+				role: true,
+			},
+			context,
+			id: user.id,
+		})
+
+		// If access token is expired and refresh token is not expired
+		if (
+			new Date(session.accessTokenExpiresAt) < new Date() &&
+			new Date(session.refreshTokenExpiresAt) >= new Date() &&
+			session.refreshTokenEncrypted
+		) {
+			const decryptedRefreshToken = decryptDeterministicToken(
+				session.refreshTokenEncrypted as string,
+				getTokenEncryptionKey(context),
+			)
+
+			if (!decryptedRefreshToken)
+				return {
+					sessionId: null,
+					user: null,
+					accessToken: null,
+					refreshToken: null,
+				}
+
+			const { accessToken: newAccessToken, refreshToken: newRefreshToken } =
+				await this.refresh(accessToken, decryptedRefreshToken, context)
+
+			return {
+				sessionId: session.id,
+				user: {
+					...user,
+					role: userWithRole?.role,
+				},
+				accessToken: newAccessToken,
+				refreshToken: newRefreshToken,
+			}
+		}
+
+		return {
+			sessionId: session.id,
+			user: {
+				...user,
+				role: userWithRole?.role,
+			},
+			accessToken,
+			refreshToken: decryptDeterministicToken(
+				session.refreshTokenEncrypted as string,
+				getTokenEncryptionKey(context),
+			),
+		}
+	}
+
+	async create(userId: string, context: WabeContext<DevWabeTypes>) {
+		const jwtTokenFields =
+			context.wabe.config.authentication?.session?.jwtTokenFields
+
+		const nowSeconds = Math.floor(Date.now() / 1000)
+
+		const result = jwtTokenFields
+			? await context.wabe.controllers.database.getObject({
+					className: 'User',
+					select: jwtTokenFields,
+					context,
+					id: userId,
+				})
+			: undefined
+
+		const secretKey = getJwtSecret(context)
+
+		const signOptions: SignOptions = { jwtid: crypto.randomUUID() }
+		const audience = context.wabe.config.authentication?.session?.jwtAudience
+		const issuer = context.wabe.config.authentication?.session?.jwtIssuer
+		if (audience) signOptions.audience = audience
+		if (issuer) signOptions.issuer = issuer
+
+		this.accessToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(
+					this.getAccessTokenExpireAt(context.wabe.config).getTime() / 1000,
+				),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		this.refreshToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(
+					this.getRefreshTokenExpireAt(context.wabe.config).getTime() / 1000,
+				),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		const accessTokenEncrypted = encryptDeterministicToken(
+			this.accessToken,
+			getTokenEncryptionKey(context),
+		)
+		const refreshTokenEncrypted = encryptDeterministicToken(
+			this.refreshToken,
+			getTokenEncryptionKey(context),
+		)
+
+		const res = await context.wabe.controllers.database.createObject({
+			className: '_Session',
+			context: contextWithRoot(context),
+			data: {
+				accessTokenEncrypted,
+				accessTokenExpiresAt: this.getAccessTokenExpireAt(context.wabe.config),
+				refreshTokenEncrypted,
+				refreshTokenExpiresAt: this.getRefreshTokenExpireAt(
+					context.wabe.config,
+				),
+				user: userId,
+			},
+			select: { id: true },
+		})
+
+		if (!res) throw new Error('Session not created')
+
+		const sessionId = res.id
+		const randomValue = crypto.randomBytes(16).toString('hex')
+		const message = `${sessionId.length}!${sessionId}!${randomValue.length}!${randomValue}`
+
+		const csrfSecret =
+			context.wabe.config.authentication?.session?.csrfSecret || secretKey
+
+		const hmac = crypto
+			.createHmac('sha256', csrfSecret)
+			.update(message)
+			.digest('hex')
+
+		const csrfToken = `${hmac}.${randomValue}`
+
+		return {
+			accessToken: this.accessToken,
+			refreshToken: this.refreshToken,
+			csrfToken,
+			sessionId: res.id,
+		}
+	}
+
+	async refresh(
+		accessToken: string,
+		refreshToken: string,
+		context: WabeContext<DevWabeTypes>,
+	) {
+		const secretKey = getJwtSecret(context)
+
+		const verifyOptions = getJwtVerifyOptions(context)
+
+		if (!safeVerify(accessToken, secretKey, verifyOptions))
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		if (!safeVerify(refreshToken, secretKey, verifyOptions))
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		const accessTokenEncrypted = encryptDeterministicToken(
+			accessToken,
+			getTokenEncryptionKey(context),
+		)
+		const incomingRefreshTokenEncrypted = encryptDeterministicToken(
+			refreshToken,
+			getTokenEncryptionKey(context),
+		)
+
+		const session = await context.wabe.controllers.database.getObjects({
+			className: '_Session',
+			where: {
+				accessTokenEncrypted: { equalTo: accessTokenEncrypted },
+				refreshTokenEncrypted: { equalTo: incomingRefreshTokenEncrypted },
+			},
+			select: {
+				id: true,
+				user: {
+					id: true,
+					role: {
+						id: true,
+						name: true,
+					},
+				},
+				refreshTokenEncrypted: true,
+				refreshTokenExpiresAt: true,
+			},
+			context: contextWithRoot(context),
+		})
+
+		if (!session.length)
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		if (!session[0]) throw new Error('Session not found')
+
+		const {
+			refreshTokenExpiresAt,
+			user,
+			refreshTokenEncrypted: storedRefreshTokenEncrypted,
+			id,
+		} = session[0]
+
+		if (new Date(refreshTokenExpiresAt) < new Date(Date.now()))
+			throw new Error('Refresh token expired')
+
+		const decryptedRefreshToken =
+			decryptDeterministicToken(
+				storedRefreshTokenEncrypted,
+				getTokenEncryptionKey(context),
+			) || refreshToken
+
+		if (!decryptedRefreshToken || decryptedRefreshToken !== refreshToken)
+			throw new Error('Invalid refresh token')
+
+		// Always rotate tokens on refresh
+		const userId = user?.id
+
+		if (!userId)
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		const jwtTokenFields =
+			context.wabe.config.authentication?.session?.jwtTokenFields
+
+		const result = jwtTokenFields
+			? await context.wabe.controllers.database.getObject({
+					className: 'User',
+					select: jwtTokenFields,
+					context,
+					id: userId,
+				})
+			: undefined
+
+		const nowSeconds = Math.floor(Date.now() / 1000)
+
+		const signOptions: SignOptions = { jwtid: crypto.randomUUID() }
+		const audience = context.wabe.config.authentication?.session?.jwtAudience
+		const issuer = context.wabe.config.authentication?.session?.jwtIssuer
+		if (audience) signOptions.audience = audience
+		if (issuer) signOptions.issuer = issuer
+
+		const newAccessToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(
+					this.getAccessTokenExpireAt(context.wabe.config).getTime() / 1000,
+				),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		const newRefreshToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(
+					this.getRefreshTokenExpireAt(context.wabe.config).getTime() / 1000,
+				),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		const newAccessTokenEncrypted = encryptDeterministicToken(
+			newAccessToken,
+			getTokenEncryptionKey(context),
+		)
+		const newRefreshTokenEncrypted = encryptDeterministicToken(
+			newRefreshToken,
+			getTokenEncryptionKey(context),
+		)
+
+		await context.wabe.controllers.database.updateObject({
+			className: '_Session',
+			context: contextWithRoot(context),
+			id,
+			data: {
+				accessTokenEncrypted: newAccessTokenEncrypted,
+				accessTokenExpiresAt: this.getAccessTokenExpireAt(context.wabe.config),
+				refreshTokenEncrypted: newRefreshTokenEncrypted,
+				refreshTokenExpiresAt: this.getRefreshTokenExpireAt(
+					context.wabe.config,
+				),
+			},
+			select: {},
+		})
+
+		return {
+			accessToken: newAccessToken,
+			refreshToken: newRefreshToken,
+		}
+	}
+
+	async delete(context: WabeContext<DevWabeTypes>) {
+		if (!context.sessionId) return
+
+		await context.wabe.controllers.database.deleteObject({
+			className: '_Session',
+			context: contextWithRoot(context),
+			id: context.sessionId,
+			select: {},
+		})
+	}
+
+	_isRefreshTokenExpired(
+		userRefreshTokenExpiresAt: Date,
+		refreshTokenAgeInMs: number,
+	) {
+		const refreshTokenEmittedAt =
+			userRefreshTokenExpiresAt.getTime() - refreshTokenAgeInMs
+		const numberOfMsSinceRefreshTokenEmitted =
+			Date.now() - refreshTokenEmittedAt
+
+		return numberOfMsSinceRefreshTokenEmitted >= 0.75 * refreshTokenAgeInMs
+	}
+}