wabe 0.6.9 → 0.6.11

package/src/authentication/Session.ts

@@ -0,0 +1,493 @@
+import jwt, { verify, type SignOptions } from 'jsonwebtoken'
+import crypto from 'node:crypto'
+import type { WabeContext } from '../server/interface'
+import type { User } from '../../generated/wabe'
+import type { WabeConfig } from '../server'
+import { contextWithRoot } from '../utils/export'
+import type { DevWabeTypes } from '../utils/helper'
+import { encryptDeterministicToken, decryptDeterministicToken } from '../utils/crypto'
+
+const getJwtSecret = (context: WabeContext<DevWabeTypes>): string => {
+	const secret = context.wabe.config.authentication?.session?.jwtSecret
+	if (!secret) throw new Error('Authentication session requires jwtSecret')
+	return secret
+}
+
+const safeVerify = (
+	token: string,
+	secret: string,
+	options: Pick<SignOptions, 'audience' | 'issuer'> = {},
+) => {
+	try {
+		return !!verify(token, secret, options)
+	} catch {
+		return false
+	}
+}
+
+const getTokenSecret = (context: WabeContext<DevWabeTypes>): string =>
+	context.wabe.config.authentication?.session?.tokenSecret ?? getJwtSecret(context)
+
+const getTokenEncryptionKey = (context: WabeContext<DevWabeTypes>) =>
+	crypto.createHash('sha256').update(getTokenSecret(context)).digest()
+
+const getJwtVerifyOptions = (context: WabeContext<DevWabeTypes>) => {
+	const opts: Pick<SignOptions, 'audience' | 'issuer'> = {}
+	const audience = context.wabe.config.authentication?.session?.jwtAudience
+	const issuer = context.wabe.config.authentication?.session?.jwtIssuer
+	if (audience) opts.audience = audience
+	if (issuer) opts.issuer = issuer
+	return opts
+}
+
+export class Session {
+	private accessToken: string | undefined = undefined
+	private refreshToken: string | undefined = undefined
+
+	getAccessTokenExpireAt(config: WabeConfig<DevWabeTypes>) {
+		const customExpiresInMs = config?.authentication?.session?.accessTokenExpiresInMs
+
+		if (!customExpiresInMs) return new Date(Date.now() + 1000 * 60 * 15) // 15 minutes in ms
+
+		return new Date(Date.now() + customExpiresInMs)
+	}
+
+	_getRefreshTokenExpiresInMs(config: WabeConfig<DevWabeTypes>) {
+		const customExpiresInMs = config?.authentication?.session?.refreshTokenExpiresInMs
+
+		if (!customExpiresInMs) return 1000 * 60 * 60 * 24 * 7 // 7 days in ms
+
+		return customExpiresInMs
+	}
+
+	getRefreshTokenExpireAt(config: WabeConfig<DevWabeTypes>) {
+		const expiresInMs = this._getRefreshTokenExpiresInMs(config)
+
+		return new Date(Date.now() + expiresInMs)
+	}
+
+	async meFromAccessToken(
+		{ accessToken, csrfToken }: { accessToken: string; csrfToken: string },
+		context: WabeContext<DevWabeTypes>,
+	): Promise<{
+		sessionId: string | null
+		user: User | null
+		accessToken: string | null
+		refreshToken?: string | null
+	}> {
+		const verifyOptions = getJwtVerifyOptions(context)
+		if (!safeVerify(accessToken, getJwtSecret(context), verifyOptions)) {
+			return {
+				sessionId: null,
+				user: null,
+				accessToken: null,
+				refreshToken: null,
+			}
+		}
+
+		const encryptedAccessToken = encryptDeterministicToken(
+			accessToken,
+			getTokenEncryptionKey(context),
+		)
+
+		const sessions = await context.wabe.controllers.database.getObjects({
+			className: '_Session',
+			where: {
+				accessTokenEncrypted: { equalTo: encryptedAccessToken },
+				OR: [
+					{
+						accessTokenExpiresAt: {
+							greaterThanOrEqualTo: new Date(),
+						},
+					},
+					{
+						refreshTokenExpiresAt: {
+							greaterThanOrEqualTo: new Date(),
+						},
+					},
+				],
+			},
+			select: {
+				id: true,
+				user: true,
+				accessTokenExpiresAt: true,
+				refreshTokenExpiresAt: true,
+				refreshTokenEncrypted: true,
+			},
+			first: 1,
+			context,
+		})
+
+		if (sessions.length === 0)
+			return {
+				sessionId: null,
+				user: null,
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		const session = sessions[0]
+
+		if (!session || !session?.user)
+			return {
+				sessionId: null,
+				user: null,
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		// CSRF check only for cookie-based sessions (enabled by default unless explicitly disabled)
+		if (
+			context.wabe.config.authentication?.session?.cookieSession &&
+			context.wabe.config.security?.disableCSRFProtection !== true
+		) {
+			const [receivedHmacHex, receivedRandomValue] = csrfToken.split('.')
+
+			if (!receivedHmacHex || !receivedRandomValue)
+				return {
+					sessionId: null,
+					user: null,
+					accessToken: null,
+					refreshToken: null,
+				}
+
+			const currentSessionId = session.id
+
+			const message = `${currentSessionId.length}!${currentSessionId}!${receivedRandomValue?.length}!${receivedRandomValue}`
+
+			const csrfSecret =
+				context.wabe.config.authentication?.session?.csrfSecret || getJwtSecret(context)
+
+			const expectedHmac = crypto.createHmac('sha256', csrfSecret).update(message).digest('hex')
+
+			const isValid = crypto.timingSafeEqual(
+				Buffer.from(receivedHmacHex || '', 'hex'),
+				Buffer.from(expectedHmac, 'hex'),
+			)
+
+			if (!isValid)
+				return {
+					sessionId: null,
+					user: null,
+					accessToken: null,
+					refreshToken: null,
+				}
+		}
+
+		// User check
+
+		const user = session.user
+
+		const userWithRole = await context.wabe.controllers.database.getObject({
+			className: 'User',
+			select: {
+				role: true,
+			},
+			context,
+			id: user.id,
+		})
+
+		// If access token is expired and refresh token is not expired
+		if (
+			new Date(session.accessTokenExpiresAt) < new Date() &&
+			new Date(session.refreshTokenExpiresAt) >= new Date() &&
+			session.refreshTokenEncrypted
+		) {
+			const decryptedRefreshToken = decryptDeterministicToken(
+				session.refreshTokenEncrypted as string,
+				getTokenEncryptionKey(context),
+			)
+
+			if (!decryptedRefreshToken)
+				return {
+					sessionId: null,
+					user: null,
+					accessToken: null,
+					refreshToken: null,
+				}
+
+			const { accessToken: newAccessToken, refreshToken: newRefreshToken } = await this.refresh(
+				accessToken,
+				decryptedRefreshToken,
+				context,
+			)
+
+			return {
+				sessionId: session.id,
+				user: {
+					...user,
+					role: userWithRole?.role,
+				},
+				accessToken: newAccessToken,
+				refreshToken: newRefreshToken,
+			}
+		}
+
+		return {
+			sessionId: session.id,
+			user: {
+				...user,
+				role: userWithRole?.role,
+			},
+			accessToken,
+			refreshToken: decryptDeterministicToken(
+				session.refreshTokenEncrypted as string,
+				getTokenEncryptionKey(context),
+			),
+		}
+	}
+
+	async create(userId: string, context: WabeContext<DevWabeTypes>) {
+		const jwtTokenFields = context.wabe.config.authentication?.session?.jwtTokenFields
+
+		const nowSeconds = Math.floor(Date.now() / 1000)
+
+		const result = jwtTokenFields
+			? await context.wabe.controllers.database.getObject({
+					className: 'User',
+					select: jwtTokenFields,
+					context,
+					id: userId,
+				})
+			: undefined
+
+		const secretKey = getJwtSecret(context)
+
+		const signOptions: SignOptions = { jwtid: crypto.randomUUID() }
+		const audience = context.wabe.config.authentication?.session?.jwtAudience
+		const issuer = context.wabe.config.authentication?.session?.jwtIssuer
+		if (audience) signOptions.audience = audience
+		if (issuer) signOptions.issuer = issuer
+
+		this.accessToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(this.getAccessTokenExpireAt(context.wabe.config).getTime() / 1000),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		this.refreshToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(this.getRefreshTokenExpireAt(context.wabe.config).getTime() / 1000),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		const accessTokenEncrypted = encryptDeterministicToken(
+			this.accessToken,
+			getTokenEncryptionKey(context),
+		)
+		const refreshTokenEncrypted = encryptDeterministicToken(
+			this.refreshToken,
+			getTokenEncryptionKey(context),
+		)
+
+		const res = await context.wabe.controllers.database.createObject({
+			className: '_Session',
+			context: contextWithRoot(context),
+			data: {
+				accessTokenEncrypted,
+				accessTokenExpiresAt: this.getAccessTokenExpireAt(context.wabe.config),
+				refreshTokenEncrypted,
+				refreshTokenExpiresAt: this.getRefreshTokenExpireAt(context.wabe.config),
+				user: userId,
+			},
+			select: { id: true },
+		})
+
+		if (!res) throw new Error('Session not created')
+
+		const sessionId = res.id
+		const randomValue = crypto.randomBytes(16).toString('hex')
+		const message = `${sessionId.length}!${sessionId}!${randomValue.length}!${randomValue}`
+
+		const csrfSecret = context.wabe.config.authentication?.session?.csrfSecret || secretKey
+
+		const hmac = crypto.createHmac('sha256', csrfSecret).update(message).digest('hex')
+
+		const csrfToken = `${hmac}.${randomValue}`
+
+		return {
+			accessToken: this.accessToken,
+			refreshToken: this.refreshToken,
+			csrfToken,
+			sessionId: res.id,
+		}
+	}
+
+	async refresh(accessToken: string, refreshToken: string, context: WabeContext<DevWabeTypes>) {
+		const secretKey = getJwtSecret(context)
+
+		const verifyOptions = getJwtVerifyOptions(context)
+
+		if (!safeVerify(accessToken, secretKey, verifyOptions))
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		if (!safeVerify(refreshToken, secretKey, verifyOptions))
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		const accessTokenEncrypted = encryptDeterministicToken(
+			accessToken,
+			getTokenEncryptionKey(context),
+		)
+		const incomingRefreshTokenEncrypted = encryptDeterministicToken(
+			refreshToken,
+			getTokenEncryptionKey(context),
+		)
+
+		const session = await context.wabe.controllers.database.getObjects({
+			className: '_Session',
+			where: {
+				accessTokenEncrypted: { equalTo: accessTokenEncrypted },
+				refreshTokenEncrypted: { equalTo: incomingRefreshTokenEncrypted },
+			},
+			select: {
+				id: true,
+				user: {
+					id: true,
+					role: {
+						id: true,
+						name: true,
+					},
+				},
+				refreshTokenEncrypted: true,
+				refreshTokenExpiresAt: true,
+			},
+			context: contextWithRoot(context),
+		})
+
+		if (!session.length)
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		if (!session[0]) throw new Error('Session not found')
+
+		const {
+			refreshTokenExpiresAt,
+			user,
+			refreshTokenEncrypted: storedRefreshTokenEncrypted,
+			id,
+		} = session[0]
+
+		if (new Date(refreshTokenExpiresAt) < new Date(Date.now()))
+			throw new Error('Refresh token expired')
+
+		const decryptedRefreshToken =
+			decryptDeterministicToken(storedRefreshTokenEncrypted, getTokenEncryptionKey(context)) ||
+			refreshToken
+
+		if (!decryptedRefreshToken || decryptedRefreshToken !== refreshToken)
+			throw new Error('Invalid refresh token')
+
+		// Always rotate tokens on refresh
+		const userId = user?.id
+
+		if (!userId)
+			return {
+				accessToken: null,
+				refreshToken: null,
+			}
+
+		const jwtTokenFields = context.wabe.config.authentication?.session?.jwtTokenFields
+
+		const result = jwtTokenFields
+			? await context.wabe.controllers.database.getObject({
+					className: 'User',
+					select: jwtTokenFields,
+					context,
+					id: userId,
+				})
+			: undefined
+
+		const nowSeconds = Math.floor(Date.now() / 1000)
+
+		const signOptions: SignOptions = { jwtid: crypto.randomUUID() }
+		const audience = context.wabe.config.authentication?.session?.jwtAudience
+		const issuer = context.wabe.config.authentication?.session?.jwtIssuer
+		if (audience) signOptions.audience = audience
+		if (issuer) signOptions.issuer = issuer
+
+		const newAccessToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(this.getAccessTokenExpireAt(context.wabe.config).getTime() / 1000),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		const newRefreshToken = jwt.sign(
+			{
+				userId,
+				user: result,
+				iat: nowSeconds,
+				exp: Math.floor(this.getRefreshTokenExpireAt(context.wabe.config).getTime() / 1000),
+			},
+			secretKey,
+			signOptions,
+		)
+
+		const newAccessTokenEncrypted = encryptDeterministicToken(
+			newAccessToken,
+			getTokenEncryptionKey(context),
+		)
+		const newRefreshTokenEncrypted = encryptDeterministicToken(
+			newRefreshToken,
+			getTokenEncryptionKey(context),
+		)
+
+		await context.wabe.controllers.database.updateObject({
+			className: '_Session',
+			context: contextWithRoot(context),
+			id,
+			data: {
+				accessTokenEncrypted: newAccessTokenEncrypted,
+				accessTokenExpiresAt: this.getAccessTokenExpireAt(context.wabe.config),
+				refreshTokenEncrypted: newRefreshTokenEncrypted,
+				refreshTokenExpiresAt: this.getRefreshTokenExpireAt(context.wabe.config),
+			},
+			select: {},
+		})
+
+		return {
+			accessToken: newAccessToken,
+			refreshToken: newRefreshToken,
+		}
+	}
+
+	async delete(context: WabeContext<DevWabeTypes>) {
+		if (!context.sessionId) return
+
+		await context.wabe.controllers.database.deleteObject({
+			className: '_Session',
+			context: contextWithRoot(context),
+			id: context.sessionId,
+			select: {},
+		})
+	}
+
+	_isRefreshTokenExpired(userRefreshTokenExpiresAt: Date, refreshTokenAgeInMs: number) {
+		const refreshTokenEmittedAt = userRefreshTokenExpiresAt.getTime() - refreshTokenAgeInMs
+		const numberOfMsSinceRefreshTokenEmitted = Date.now() - refreshTokenEmittedAt
+
+		return numberOfMsSinceRefreshTokenEmitted >= 0.75 * refreshTokenAgeInMs
+	}
+}

package/src/authentication/defaultAuthentication.ts

@@ -0,0 +1,209 @@
+import type { WabeTypes } from '..'
+import type { CustomAuthenticationMethods, ProviderInterface } from './interface'
+import { GitHub, QRCodeOTP } from './providers'
+import { Google } from './providers'
+import { EmailOTP } from './providers/EmailOTP'
+import { EmailPassword } from './providers/EmailPassword'
+import { EmailPasswordSRPChallenge, EmailPasswordSRP } from './providers/EmailPasswordSRP'
+import { PhonePassword } from './providers/PhonePassword'
+
+export const defaultAuthenticationMethods = <T extends WabeTypes>(): CustomAuthenticationMethods<
+	T,
+	ProviderInterface<T>
+>[] => [
+	{
+		name: 'emailPasswordSRPChallenge',
+		input: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			clientPublic: {
+				type: 'String',
+				required: true,
+			},
+			clientSessionProof: {
+				type: 'String',
+				required: true,
+			},
+		},
+		// @ts-expect-error
+		provider: new EmailPasswordSRPChallenge(),
+		isSecondaryFactor: true,
+	},
+	{
+		name: 'emailPasswordSRP',
+		input: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			clientPublic: {
+				type: 'String',
+			},
+			salt: {
+				type: 'String',
+			},
+			verifier: {
+				type: 'String',
+			},
+		},
+		dataToStore: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			salt: {
+				type: 'String',
+				required: true,
+			},
+			verifier: {
+				type: 'String',
+				required: true,
+			},
+			serverSecret: {
+				type: 'String',
+			},
+		},
+		// @ts-expect-error
+		provider: new EmailPasswordSRP(),
+	},
+	{
+		name: 'emailOTP',
+		input: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			otp: {
+				type: 'String',
+				required: true,
+			},
+		},
+		// @ts-expect-error
+		provider: new EmailOTP(),
+		isSecondaryFactor: true,
+	},
+	{
+		name: 'qrCodeOTP',
+		input: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			otp: {
+				type: 'String',
+				required: true,
+			},
+		},
+		// @ts-expect-error
+		provider: new QRCodeOTP(),
+		isSecondaryFactor: true,
+	},
+	{
+		name: 'phonePassword',
+		input: {
+			phone: {
+				type: 'Phone',
+				required: true,
+			},
+			password: {
+				type: 'Hash',
+				required: true,
+			},
+		},
+		dataToStore: {
+			phone: {
+				type: 'Phone',
+				required: true,
+			},
+			password: {
+				type: 'Hash',
+				required: true,
+			},
+		},
+		// @ts-expect-error
+		provider: new PhonePassword(),
+	},
+	{
+		name: 'emailPassword',
+		input: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			password: {
+				type: 'Hash',
+				required: true,
+			},
+		},
+		dataToStore: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			password: {
+				type: 'Hash',
+				required: true,
+			},
+		},
+		// @ts-expect-error
+		provider: new EmailPassword(),
+	},
+	{
+		name: 'google',
+		input: {
+			authorizationCode: {
+				type: 'String',
+				required: true,
+			},
+			codeVerifier: {
+				type: 'String',
+				required: true,
+			},
+		},
+		dataToStore: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			verifiedEmail: {
+				type: 'Boolean',
+				required: true,
+			},
+		},
+		// There is no signUp method for Google provider
+		// @ts-expect-error
+		provider: new Google(),
+	},
+	{
+		name: 'github',
+		input: {
+			authorizationCode: {
+				type: 'String',
+				required: true,
+			},
+			codeVerifier: {
+				type: 'String',
+				required: true,
+			},
+		},
+		dataToStore: {
+			email: {
+				type: 'Email',
+				required: true,
+			},
+			avatarUrl: {
+				type: 'String',
+				required: true,
+			},
+			username: {
+				type: 'String',
+				required: true,
+			},
+		},
+		// There is no signUp method for Google provider
+		// @ts-expect-error
+		provider: new GitHub(),
+	},
+]

package/src/authentication/index.ts

@@ -0,0 +1,3 @@
+export * from './interface'
+export * from './oauth'
+export * from './OTP'