wabe 0.6.9 → 0.6.10

package/src/authentication/providers/EmailPasswordSRP.ts

@@ -0,0 +1,184 @@
+import type {
+	AuthenticationEventsOptions,
+	OnVerifyChallengeOptions,
+	ProviderInterface,
+	SecondaryProviderInterface,
+} from '../interface'
+import { contextWithRoot } from '../../utils/export'
+import type { DevWabeTypes } from '../../utils/helper'
+import { createSRPServer, type Ephemeral, type Session } from 'js-srp6a'
+
+// 🛡 Valeurs factices pour mitigation des timing attacks
+const DUMMY_SALT = 'deadbeefdeadbeefdeadbeefdeadbeef'
+const DUMMY_VERIFIER =
+	'94c8f9b69f44fa0453a8a65129a7865ea2d70b21e645cf185d6fd42a679e524c394d4f02bba2032b10517be8c80f0f58e94302cb57cce7ce1e0a21906b6d22020b84a473d8ef58ea1f53e5204f8b83f05dc334b781fda309ad7cb8fa5c91dc81f64c114b671688b22e0f693a9c97ad2f43e6f1954c83d73e81e3dc8a963b7cbce'
+
+type EmailPasswordSRPInterface = {
+	clientPublic: string
+	email: string
+	salt?: string
+	verifier?: string
+}
+
+export class EmailPasswordSRP
+	implements ProviderInterface<DevWabeTypes, EmailPasswordSRPInterface>
+{
+	async onSignIn({
+		input,
+		context,
+	}: AuthenticationEventsOptions<DevWabeTypes, EmailPasswordSRPInterface>) {
+		const server = createSRPServer('SHA-256', 3072)
+
+		const users = await context.wabe.controllers.database.getObjects({
+			className: 'User',
+			context: contextWithRoot(context),
+			where: {
+				email: { equalTo: input.email },
+			},
+			select: {
+				authentication: true,
+				role: true,
+				secondFA: true,
+				email: true,
+				id: true,
+				provider: true,
+				isOauth: true,
+				createdAt: true,
+				updatedAt: true,
+			},
+			first: 1,
+		})
+
+		const user = users[0]
+
+		const salt = user?.authentication?.emailPasswordSRP?.salt ?? DUMMY_SALT
+		const verifier =
+			user?.authentication?.emailPasswordSRP?.verifier ?? DUMMY_VERIFIER
+
+		let ephemeral: Ephemeral
+		try {
+			ephemeral = await server.generateEphemeral(verifier)
+		} catch {
+			throw new Error('Invalid authentication credentials')
+		}
+
+		if (!user || !user?.id) {
+			// Simulation d'opération pour garder le même temps
+			await new Promise((resolve) => setTimeout(resolve, 10))
+			throw new Error('Invalid authentication credentials')
+		}
+
+		await context.wabe.controllers.database.updateObject({
+			className: 'User',
+			context: contextWithRoot(context),
+			id: user.id,
+			data: {
+				authentication: {
+					emailPasswordSRP: {
+						...user.authentication?.emailPasswordSRP,
+						serverSecret: ephemeral.secret,
+					},
+				},
+			},
+			select: {},
+		})
+
+		return { srp: { salt, serverPublic: ephemeral.public }, user }
+	}
+
+	async onSignUp({
+		input,
+		context,
+	}: AuthenticationEventsOptions<DevWabeTypes, EmailPasswordSRPInterface>) {
+		const users = await context.wabe.controllers.database.count({
+			className: 'User',
+			where: {
+				email: { equalTo: input.email },
+			},
+			context: contextWithRoot(context),
+		})
+
+		if (users > 0) throw new Error('Not authorized to create user')
+
+		return {
+			authenticationDataToSave: {
+				salt: input.salt,
+				verifier: input.verifier,
+				email: input.email,
+				serverSecret: null,
+			},
+		}
+	}
+}
+
+export interface EmailPasswordSRPChallengeInterface {
+	email: string
+	clientPublic: string
+	clientSessionProof: string
+}
+
+export class EmailPasswordSRPChallenge
+	implements
+		SecondaryProviderInterface<DevWabeTypes, EmailPasswordSRPChallengeInterface>
+{
+	async onVerifyChallenge({
+		context,
+		input,
+	}: OnVerifyChallengeOptions<
+		DevWabeTypes,
+		EmailPasswordSRPChallengeInterface
+	>) {
+		const server = createSRPServer('SHA-256', 3072)
+
+		const users = await context.wabe.controllers.database.getObjects({
+			className: 'User',
+			context: contextWithRoot(context),
+			where: {
+				authentication: {
+					emailPasswordSRP: {
+						email: { equalTo: input.email },
+					},
+				},
+			},
+			select: {
+				id: true,
+				authentication: true,
+			},
+		})
+
+		const user = users[0]
+
+		const salt = user?.authentication?.emailPasswordSRP?.salt ?? DUMMY_SALT
+		const verifier =
+			user?.authentication?.emailPasswordSRP?.verifier ?? DUMMY_VERIFIER
+		const serverSecret =
+			user?.authentication?.emailPasswordSRP?.serverSecret ?? 'deadbeef'
+
+		let serverSession: Session
+		try {
+			serverSession = await server.deriveSession(
+				serverSecret,
+				input.clientPublic,
+				salt,
+				'', // no username
+				verifier,
+				input.clientSessionProof,
+			)
+		} catch {
+			throw new Error('Invalid authentication credentials')
+		}
+
+		if (!user || !user?.id) {
+			// Simulation pour garder un timing constant
+			await new Promise((resolve) => setTimeout(resolve, 10))
+			throw new Error('Invalid authentication credentials')
+		}
+
+		return {
+			userId: user.id,
+			srp: {
+				serverSessionProof: serverSession.proof,
+			},
+		}
+	}
+}

package/src/authentication/providers/GitHub.ts

@@ -0,0 +1,30 @@
+import type { DevWabeTypes } from '../../utils/helper'
+import {
+	AuthenticationProvider,
+	type AuthenticationEventsOptions,
+	type ProviderInterface,
+} from '../interface'
+import { oAuthAuthentication } from './OAuth'
+
+type GitHubInterface = {
+	authorizationCode: string
+	codeVerifier: string
+}
+
+export class GitHub
+	implements ProviderInterface<DevWabeTypes, GitHubInterface>
+{
+	name = 'github'
+	onSignIn(
+		options: AuthenticationEventsOptions<DevWabeTypes, GitHubInterface>,
+	) {
+		return oAuthAuthentication(AuthenticationProvider.GitHub)(options)
+	}
+
+	// @ts-expect-error
+	onSignUp() {
+		throw new Error(
+			'SignUp is not implemented for Oauth provider, you should use signIn instead.',
+		)
+	}
+}

package/src/authentication/providers/Google.ts

@@ -0,0 +1,30 @@
+import type { DevWabeTypes } from '../../utils/helper'
+import {
+	AuthenticationProvider,
+	type AuthenticationEventsOptions,
+	type ProviderInterface,
+} from '../interface'
+import { oAuthAuthentication } from './OAuth'
+
+type GoogleInterface = {
+	authorizationCode: string
+	codeVerifier: string
+}
+
+export class Google
+	implements ProviderInterface<DevWabeTypes, GoogleInterface>
+{
+	name = 'google'
+	onSignIn(
+		options: AuthenticationEventsOptions<DevWabeTypes, GoogleInterface>,
+	) {
+		return oAuthAuthentication(AuthenticationProvider.Google)(options)
+	}
+
+	// @ts-expect-error
+	onSignUp() {
+		throw new Error(
+			'SignUp is not implemented for Oauth provider, you should use signIn instead.',
+		)
+	}
+}

package/src/authentication/providers/OAuth.test.ts

@@ -0,0 +1,185 @@
+import { afterEach, describe, expect, it, mock, spyOn } from 'bun:test'
+import { GitHub } from './GitHub'
+import * as OAuth from './OAuth'
+import { AuthenticationProvider } from '../interface'
+
+// Use GitHub test as use case
+describe('OAuth', () => {
+	const mockGetObjects = mock(() => Promise.resolve([]))
+	const mockCount = mock(() => Promise.resolve(0)) as any
+	const mockCreateObject = mock(() => Promise.resolve({ id: 'userId' })) as any
+
+	const mockGetUserInfo = mock().mockResolvedValue({
+		email: 'email@test.fr',
+		avatarUrl: 'avatarUrl',
+		username: 'username',
+	})
+
+	const mockValidateAuthorizationCode = mock().mockResolvedValue({
+		accessToken: 'accessToken',
+		refreshToken: 'refreshToken',
+		accessTokenExpiresAt: new Date(0),
+	})
+
+	spyOn(OAuth, 'getProvider').mockReturnValue({
+		validateAuthorizationCode: mockValidateAuthorizationCode,
+		getUserInfo: mockGetUserInfo,
+	} as never)
+
+	const context = {
+		wabe: {
+			controllers: {
+				database: {
+					getObjects: mockGetObjects,
+					createObject: mockCreateObject,
+					count: mockCount,
+				},
+			},
+			config: {
+				authentication: {
+					providers: {
+						github: {
+							clientId: 'clientId',
+							clientSecret: 'clientSecret',
+						},
+					},
+				},
+			},
+		},
+	} as any
+
+	afterEach(() => {
+		mockGetObjects.mockClear()
+		mockCreateObject.mockClear()
+		mockCount.mockClear()
+		mockValidateAuthorizationCode.mockClear()
+		mockGetUserInfo.mockClear()
+	})
+
+	it('should sign up with GitHub Provider if there is no user found', async () => {
+		const github = new GitHub()
+
+		await github.onSignIn({
+			context,
+			input: {
+				authorizationCode: 'authorizationCode',
+				codeVerifier: 'codeVerifier',
+			},
+		})
+
+		expect(mockValidateAuthorizationCode).toHaveBeenCalledTimes(1)
+		expect(mockGetUserInfo).toHaveBeenCalledTimes(1)
+
+		expect(mockGetObjects).toHaveBeenCalledTimes(1)
+		expect(mockGetObjects).toHaveBeenCalledWith({
+			className: 'User',
+			where: {
+				authentication: {
+					github: {
+						email: { equalTo: 'email@test.fr' },
+					},
+				},
+			},
+			first: 1,
+			context: expect.any(Object),
+			select: {
+				authentication: true,
+				role: true,
+				secondFA: true,
+				email: true,
+				id: true,
+				provider: true,
+				isOauth: true,
+				createdAt: true,
+				updatedAt: true,
+			},
+		})
+
+		expect(mockCreateObject).toHaveBeenCalledTimes(1)
+		expect(mockCreateObject).toHaveBeenCalledWith({
+			className: 'User',
+			data: {
+				provider: AuthenticationProvider.GitHub,
+				isOauth: true,
+				authentication: {
+					github: {
+						email: 'email@test.fr',
+						username: 'username',
+						avatarUrl: 'avatarUrl',
+					},
+				},
+			},
+			context: expect.any(Object),
+			select: {
+				authentication: true,
+				role: true,
+				secondFA: true,
+				email: true,
+				id: true,
+				provider: true,
+				isOauth: true,
+				createdAt: true,
+				updatedAt: true,
+			},
+		})
+	})
+
+	it('should sign in with GitHub Provider if there is no user found', async () => {
+		mockGetObjects.mockResolvedValue([
+			{
+				id: 'userId',
+				authentication: {
+					github: {
+						email: 'email@test.fr',
+						verifiedEmail: true,
+						idToken: 'idToken',
+					},
+				},
+				provider: AuthenticationProvider.Google,
+				isOauth: true,
+			} as any,
+		] as never)
+
+		const github = new GitHub()
+
+		await github.onSignIn({
+			context,
+			input: {
+				authorizationCode: 'authorizationCode',
+				codeVerifier: 'codeVerifier',
+			},
+		})
+
+		expect(mockValidateAuthorizationCode).toHaveBeenCalledTimes(1)
+		expect(mockGetUserInfo).toHaveBeenCalledTimes(1)
+
+		expect(mockGetObjects).toHaveBeenCalledTimes(1)
+		expect(mockGetObjects).toHaveBeenCalledWith({
+			className: 'User',
+			where: {
+				authentication: {
+					github: {
+						email: { equalTo: 'email@test.fr' },
+					},
+				},
+			},
+			first: 1,
+			context: expect.any(Object),
+			select: {
+				authentication: true,
+				role: true,
+				secondFA: true,
+				email: true,
+				id: true,
+				provider: true,
+				isOauth: true,
+				createdAt: true,
+				updatedAt: true,
+			},
+		})
+
+		expect(mockCreateObject).toHaveBeenCalledTimes(0)
+
+		mockValidateAuthorizationCode.mockRestore()
+	})
+})

package/src/authentication/providers/OAuth.ts

@@ -0,0 +1,112 @@
+import type { WabeContext } from '../../server/interface'
+import { contextWithRoot } from '../../utils/export'
+import type { DevWabeTypes } from '../../utils/helper'
+import {
+	type AuthenticationEventsOptions,
+	AuthenticationProvider,
+} from '../interface'
+import { Google } from '../oauth'
+import { GitHub } from '../oauth/GitHub'
+
+export type OAuthAuthenticationInterface = {
+	authorizationCode: string
+	codeVerifier: string
+}
+
+export const getProvider = (
+	context: WabeContext<DevWabeTypes>,
+	provider: AuthenticationProvider,
+) => {
+	const config = context.wabe.config
+
+	switch (provider) {
+		case AuthenticationProvider.Google:
+			return new Google(config)
+		case AuthenticationProvider.GitHub:
+			return new GitHub(config)
+		default:
+			throw new Error(`Provider ${provider} not found`)
+	}
+}
+
+export const oAuthAuthentication =
+	(oAuthProvider: AuthenticationProvider) =>
+	async ({
+		context,
+		input,
+	}: AuthenticationEventsOptions<
+		DevWabeTypes,
+		OAuthAuthenticationInterface
+	>) => {
+		const { authorizationCode, codeVerifier } = input
+
+		const provider = getProvider(context, oAuthProvider)
+
+		const { accessToken } = await provider.validateAuthorizationCode(
+			authorizationCode,
+			codeVerifier,
+		)
+
+		const userInfoToSave = await provider.getUserInfo(accessToken)
+
+		const user = await context.wabe.controllers.database.getObjects({
+			className: 'User',
+			where: {
+				authentication: {
+					[oAuthProvider]: {
+						email: { equalTo: userInfoToSave.email },
+					},
+				},
+			},
+			context: contextWithRoot(context),
+			first: 1,
+			select: {
+				authentication: true,
+				role: true,
+				secondFA: true,
+				email: true,
+				id: true,
+				provider: true,
+				isOauth: true,
+				createdAt: true,
+				updatedAt: true,
+			},
+		})
+
+		if (user.length === 0) {
+			const createdUser = await context.wabe.controllers.database.createObject({
+				className: 'User',
+				data: {
+					provider: oAuthProvider,
+					isOauth: true,
+					authentication: {
+						[oAuthProvider]: userInfoToSave,
+					},
+				},
+				context: contextWithRoot(context),
+				select: {
+					authentication: true,
+					role: true,
+					secondFA: true,
+					email: true,
+					id: true,
+					provider: true,
+					isOauth: true,
+					createdAt: true,
+					updatedAt: true,
+				},
+			})
+
+			if (!createdUser) throw new Error('User not found')
+
+			return {
+				user: createdUser,
+			}
+		}
+
+		if (!user[0]) throw new Error('User not found')
+
+		return {
+			user: user[0],
+		}
+	}