webspresso 0.0.98 → 0.0.100

package/core/auth/manager.js

@@ -4,6 +4,7 @@
  * @module core/auth/manager
  */
 
+const EventEmitter = require('events');
 const { generateToken, hashToken } = require('./hash');
 const { PolicyManager } = require('./policy');
 const { signJwt, verifyJwt, decodeJwt } = require('./jwt');
@@ -60,13 +61,14 @@ const DEFAULT_CONFIG = {
     logout: '/logout',
     home: '/',
     redirectAfterLogin: '/dashboard',
+    twoFactor: '/2fa',
   },
 };
 
 /**
  * AuthManager - Handles authentication operations
  */
-class AuthManager {
+class AuthManager extends EventEmitter {
   /**
    * Create AuthManager instance
    * @param {Object} config - Configuration
@@ -82,6 +84,7 @@ class AuthManager {
    * @param {Object} [config.routes] - Route configuration
    */
   constructor(config) {
+    super();
     this.validateConfig(config);
     
     this.config = {
@@ -105,8 +108,13 @@ class AuthManager {
       passwordReset: config.notifications?.passwordReset || null,
       emailVerification: config.notifications?.emailVerification || null,
       welcome: config.notifications?.welcome || null,
+      magicLink: config.notifications?.magicLink || null,
     };
 
+    // TOTP & 2FA initialization
+    this.totp = require('./totp');
+    this.twoFactor = config.twoFactor || { enabled: false };
+
     if (config.jwt) {
       const jwtSecret = typeof config.jwt === 'object' && config.jwt.secret
         ? config.jwt.secret
@@ -133,6 +141,30 @@ class AuthManager {
     
     // Policy manager instance
     this.policies = new PolicyManager();
+
+    // Session tracking and revocation manager
+    const { SessionManager } = require('./session-manager');
+    const { createKnexSessionTracker, createMemorySessionTracker } = require('./sessions');
+
+    let tracker = config.sessionTracker || null;
+    if (!tracker && (config.sessionTracking || config.trackSessions)) {
+      if (config.db || this.config.db) {
+        tracker = createKnexSessionTracker(config.db || this.config.db);
+      } else {
+        tracker = createMemorySessionTracker();
+      }
+    }
+
+    if (tracker || config.sessionTracking || config.trackSessions) {
+      this.sessionManager = new SessionManager({
+        tracker: tracker || createMemorySessionTracker(),
+        sessionStore: config.sessionStore || this.config.session?.store,
+        touchThrottleMs: config.sessionTouchThrottleMs,
+        emitter: this,
+      });
+    } else {
+      this.sessionManager = null;
+    }
   }
 
   /**
@@ -280,7 +312,7 @@ class AuthManager {
         
         // Set req.user
         req.user = user;
-        
+
         // Handle remember me
         if (options.remember && self.rememberTokens && self.config.rememberMe.enabled) {
           await self.createRememberToken(user.id, res);
@@ -289,18 +321,34 @@ class AuthManager {
         // Regenerate session ID for security if supported
         if (req.session && typeof req.session.regenerate === 'function') {
           return new Promise((resolve, reject) => {
-            req.session.regenerate((err) => {
+            req.session.regenerate(async (err) => {
               if (err) {
                 reject(new AuthenticationError('Session regeneration failed', 'SESSION_ERROR'));
               } else {
                 // Restore userId after regenerate
                 req.session.userId = user.id;
                 req.session.loggedInAt = Date.now();
+                if (req.sessionID && self.sessionManager) {
+                  try {
+                    await self.sessionManager.track(req.sessionID, user.id, req);
+                  } catch (e) {
+                    // Non-blocking
+                  }
+                }
                 resolve();
               }
             });
           });
         }
+
+        // Track active session if sessionManager is active and not regenerated
+        if (req.sessionID && self.sessionManager) {
+          try {
+            await self.sessionManager.track(req.sessionID, user.id, req);
+          } catch (e) {
+            // Non-blocking
+          }
+        }
       },
 
       /**
@@ -329,6 +377,22 @@ class AuthManager {
           }
         }
         
+        // Clear 2FA session state
+        this.clear2Fa();
+
+        // Revoke session if sessionManager is active
+        if (req.sessionID && self.sessionManager) {
+          try {
+            if (options.everywhere && userId) {
+              await self.sessionManager.revokeAllSessions(userId);
+            } else {
+              await self.sessionManager.revokeSession(req.sessionID, { userId });
+            }
+          } catch (e) {
+            // Non-blocking
+          }
+        }
+
         // Clear user
         req.user = null;
         
@@ -377,6 +441,119 @@ class AuthManager {
         return req.user?.id || null;
       },
 
+      /**
+       * TOTP helper utilities (RFC 6238 / RFC 4226)
+       */
+      totp: self.totp,
+
+      /**
+       * Check if two-factor authentication has been verified in current session/request
+       * @returns {boolean}
+       */
+      is2FaVerified() {
+        if (req.session?.twoFactorVerified) return true;
+        if (req.jwtPayload?.twoFactorVerified) return true;
+        return false;
+      },
+
+      /**
+       * Check if two-factor authentication is pending verification
+       * @returns {boolean}
+       */
+      is2FaPending() {
+        return Boolean(req.session?.twoFactorPending);
+      },
+
+      /**
+       * Mark two-factor authentication as verified
+       * @param {boolean} [verified=true]
+       */
+      set2FaVerified(verified = true) {
+        if (req.session) {
+          req.session.twoFactorVerified = Boolean(verified);
+          if (verified) {
+            delete req.session.twoFactorPending;
+            delete req.session.twoFactorUserId;
+          }
+        }
+      },
+
+      /**
+       * Mark two-factor authentication as pending verification for a user
+       * @param {Object} [user] - User object or user ID
+       */
+      set2FaPending(user) {
+        if (req.session) {
+          req.session.twoFactorPending = true;
+          req.session.twoFactorVerified = false;
+          if (user?.id) {
+            req.session.twoFactorUserId = user.id;
+          } else if (typeof user === 'string' || typeof user === 'number') {
+            req.session.twoFactorUserId = user;
+          }
+        }
+      },
+
+      /**
+       * Clear two-factor authentication status from session
+       */
+      clear2Fa() {
+        if (req.session) {
+          delete req.session.twoFactorVerified;
+          delete req.session.twoFactorPending;
+          delete req.session.twoFactorUserId;
+        }
+      },
+
+      /**
+       * Verify submitted TOTP token or recovery code
+       * Automatically marks 2FA as verified upon success
+       * @param {string} tokenOrCode - Submitted 6-digit TOTP code or recovery code
+       * @param {Object|string} secretOrUser - Secret string or user object with totp_secret / recovery_codes
+       * @param {Object} [options]
+       * @returns {{ success: boolean, type?: 'totp'|'recovery_code', delta?: number, remainingHashedCodes?: string[], matchedIndex?: number }}
+       */
+      verify2Fa(tokenOrCode, secretOrUser, options = {}) {
+        if (!tokenOrCode) {
+          return { success: false };
+        }
+
+        let secret = null;
+        let recoveryCodes = null;
+
+        if (typeof secretOrUser === 'string') {
+          secret = secretOrUser;
+        } else if (secretOrUser && typeof secretOrUser === 'object') {
+          secret = secretOrUser.totp_secret || secretOrUser.totpSecret || secretOrUser.two_factor_secret || secretOrUser.twoFactorSecret;
+          recoveryCodes = secretOrUser.recovery_codes || secretOrUser.recoveryCodes || secretOrUser.two_factor_recovery_codes;
+        }
+
+        // Try TOTP code first
+        if (secret) {
+          const totpResult = self.totp.verifyTotp(tokenOrCode, secret, { ...options, detailed: true });
+          if (totpResult.valid) {
+            this.set2FaVerified(true);
+            return { success: true, type: 'totp', delta: totpResult.delta };
+          }
+        }
+
+        // Try recovery codes if provided
+        if (recoveryCodes && Array.isArray(recoveryCodes) && recoveryCodes.length > 0) {
+          const recResult = self.totp.verifyRecoveryCode(tokenOrCode, recoveryCodes);
+          if (recResult.valid) {
+            this.set2FaVerified(true);
+            return {
+              success: true,
+              type: 'recovery_code',
+              matchedIndex: recResult.matchedIndex,
+              remainingHashedCodes: recResult.remainingHashedCodes,
+            };
+          }
+        }
+
+        return { success: false };
+      },
+
       /**
        * Check if user can perform action (policy check)
        * @param {string} action - Action name
@@ -409,6 +586,91 @@ class AuthManager {
       authorize(action, policy = null, resource = null) {
         return self.policies.authorize(req.user, action, policy, resource);
       },
+
+      /**
+       * Request a magic link for passwordless login
+       * @param {string} identifier - User email or username
+       * @param {Object} [options]
+       * @returns {Promise<{ sent: boolean, expiresAt?: Date, token?: string, magicLinkUrl?: string, userFound: boolean }>}
+       */
+      requestMagicLink(identifier, options = {}) {
+        return self.requestMagicLink(identifier, options);
+      },
+
+      /**
+       * Verify magic link token
+       * @param {string} rawToken
+       * @param {Object} [options]
+       * @returns {Promise<{ ok: true, user: Object, userId: * }>}
+       */
+      verifyMagicLink(rawToken, options = {}) {
+        return self.verifyMagicLink(rawToken, options);
+      },
+
+      /**
+       * Verify magic link token and log user into current request session
+       * @param {string} rawToken
+       * @param {Object} [options]
+       * @returns {Promise<{ ok: true, user: Object, userId: *, accessToken?: string, refreshToken?: string }>}
+       */
+      async loginWithMagicLink(rawToken, options = {}) {
+        const result = await self.verifyMagicLink(rawToken, options);
+        await this.login(result.user, options.remember);
+
+        const response = { ...result };
+        if (options.jwt) {
+          response.accessToken = self.generateUserToken(result.user, options.jwtAccessOptions);
+          response.refreshToken = self.generateRefreshToken(result.user, options.jwtRefreshOptions);
+        }
+
+        return response;
+      },
+
+      /**
+       * List active sessions/devices for current user
+       * @returns {Promise<Array<Object>>}
+       */
+      sessions() {
+        if (!req.user?.id) return Promise.resolve([]);
+        return self.listSessions(req.user.id, req.sessionID);
+      },
+
+      /**
+       * Revoke a specific session
+       * @param {string} sessionId
+       * @returns {Promise<boolean>}
+       */
+      async revokeSession(sessionId) {
+        if (sessionId === req.sessionID) {
+          await this.logout();
+          return true;
+        }
+        return await self.revokeSession(sessionId, { userId: req.user?.id });
+      },
+
+      /**
+       * Revoke all other active sessions except current
+       * @returns {Promise<number>}
+       */
+      revokeOtherSessions() {
+        if (!req.user?.id) return Promise.resolve(0);
+        return self.revokeOtherSessions(req.user.id, req.sessionID);
+      },
+
+      /**
+       * Revoke all active sessions for user (force logout from all devices)
+       * @param {string|number} [userId]
+       * @returns {Promise<number>}
+       */
+      async revokeAllSessions(userId = null) {
+        const targetUserId = userId || req.user?.id;
+        if (!targetUserId) return 0;
+        const count = await self.revokeAllSessions(targetUserId);
+        if (targetUserId === req.user?.id) {
+          await this.logout();
+        }
+        return count;
+      },
     };
   }
 
@@ -666,6 +928,122 @@ class AuthManager {
     return { ok: true, userId: verified.userId };
   }
 
+  /**
+   * Request magic link passwordless login — safe against user enumeration
+   * @param {string} identifier - Email or username
+   * @param {Object} [options]
+   * @param {number} [options.tokenTtlMs=900000] - Default 15 minutes (900,000ms)
+   * @param {Function} [options.buildMagicLinkUrl] - (rawToken) => string
+   * @param {string} [options.path='/auth/magic-link/verify']
+   * @param {boolean} [options.hideUserNotFound=true]
+   * @returns {Promise<{ sent: boolean, expiresAt?: Date, token?: string, magicLinkUrl?: string, userFound: boolean }>}
+   */
+  async requestMagicLink(identifier, options = {}) {
+    if (!this.authTokens) {
+      throw new Error('authTokens adapter is required for magic link authentication');
+    }
+
+    const user = await this.resolveUserByIdentifier(identifier);
+    if (!user) {
+      return {
+        sent: options.hideUserNotFound !== false,
+        userFound: false,
+      };
+    }
+
+    const tokenTtlMs = options.tokenTtlMs ?? 15 * 60 * 1000;
+    const { rawToken, expiresAt } = await createAuthToken(
+      this.authTokens,
+      TOKEN_TYPES.MAGIC_LINK,
+      user.id,
+      tokenTtlMs
+    );
+
+    let baseUrl = String(options.baseUrl || this.config.baseUrl || process.env.BASE_URL || 'http://localhost:3000');
+    while (baseUrl.endsWith('/')) {
+      baseUrl = baseUrl.slice(0, -1);
+    }
+    const pathSegment = options.path || '/auth/magic-link/verify';
+    const cleanPath = pathSegment.startsWith('/') ? pathSegment : `/${pathSegment}`;
+    const sep = cleanPath.includes('?') ? '&' : '?';
+
+    const hasCustomUrl = typeof options.buildMagicLinkUrl === 'function' || Boolean(options.path) || Boolean(options.baseUrl);
+    const customMagicLinkUrl = typeof options.buildMagicLinkUrl === 'function'
+      ? options.buildMagicLinkUrl(rawToken)
+      : hasCustomUrl
+        ? `${baseUrl}${cleanPath}${sep}token=${encodeURIComponent(rawToken)}`
+        : null;
+
+    const defaultMagicLinkUrl = `${baseUrl}${cleanPath}${sep}token=${encodeURIComponent(rawToken)}`;
+
+    if (typeof this.notifications.magicLink === 'function') {
+      await this.notifications.magicLink(user, {
+        token: rawToken,
+        expiresAt,
+        magicLinkUrl: customMagicLinkUrl,
+        expiresMinutes: Math.round(tokenTtlMs / 60000),
+      });
+    }
+
+    this.emit('magicLink:requested', { userId: user.id, email: user.email, expiresAt });
+
+    return {
+      sent: true,
+      userFound: true,
+      expiresAt,
+      token: rawToken,
+      magicLinkUrl: customMagicLinkUrl || defaultMagicLinkUrl,
+    };
+  }
+
+  /**
+   * Verify magic link token and resolve user
+   * @param {string} rawToken
+   * @param {Object} [options]
+   * @param {boolean} [options.markEmailVerified=true]
+   * @param {boolean} [options.consumeAllForUser=true]
+   * @returns {Promise<{ ok: true, user: Object, userId: * }>}
+   */
+  async verifyMagicLink(rawToken, options = {}) {
+    if (!this.authTokens) {
+      throw new Error('authTokens adapter is required for magic link authentication');
+    }
+
+    const verified = await verifyAuthToken(
+      this.authTokens,
+      TOKEN_TYPES.MAGIC_LINK,
+      rawToken
+    );
+    if (!verified) {
+      throw new AuthenticationError('Invalid or expired magic link', 'INVALID_MAGIC_LINK');
+    }
+
+    const user = await this.findUserById(verified.userId);
+    if (!user) {
+      throw new AuthenticationError('User not found for magic link', 'USER_NOT_FOUND');
+    }
+
+    await consumeAuthToken(this.authTokens, verified.tokenHash);
+
+    if (options.consumeAllForUser !== false) {
+      await this.authTokens.deleteAllForUser(verified.userId, TOKEN_TYPES.MAGIC_LINK);
+    }
+
+    // Auto mark email verified if user has not verified it yet
+    if (options.markEmailVerified !== false && this.updateUser && this.verifiedField && !user[this.verifiedField]) {
+      try {
+        await this.updateUser(user.id, { [this.verifiedField]: new Date() });
+        user[this.verifiedField] = new Date();
+      } catch (e) {
+        // Continue even if update fails
+      }
+    }
+
+    this.emit('magicLink:verified', { userId: user.id });
+
+    return { ok: true, user, userId: verified.userId };
+  }
+
   /**
    * Send welcome notification if configured
    * @param {Object} user
@@ -801,6 +1179,102 @@ class AuthManager {
     }
     return this._authMiddleware.requireJwt(options);
   }
+
+  /**
+   * Get require2Fa guard middleware for Express routes
+   * @param {Object} [options]
+   * @returns {Function} Express middleware
+   */
+  require2Fa(options = {}) {
+    if (!this._authMiddleware) {
+      const { createAuthMiddleware } = require('./middleware');
+      this._authMiddleware = createAuthMiddleware(this);
+    }
+    return this._authMiddleware.require2Fa(options);
+  }
+
+  /**
+   * Track session for a request
+   * @param {string} sessionId
+   * @param {string|number} userId
+   * @param {Object} req
+   */
+  async trackSession(sessionId, userId, req) {
+    if (this.sessionManager) {
+      return await this.sessionManager.track(sessionId, userId, req);
+    }
+    return null;
+  }
+
+  /**
+   * Touch session to update activity timestamp
+   * @param {string} sessionId
+   */
+  async touchSession(sessionId) {
+    if (this.sessionManager) {
+      return await this.sessionManager.touch(sessionId);
+    }
+    return false;
+  }
+
+  /**
+   * List active sessions for user
+   * @param {string|number} userId
+   * @param {string} [currentSessionId]
+   */
+  async listSessions(userId, currentSessionId = null) {
+    if (this.sessionManager) {
+      return await this.sessionManager.listSessions(userId, currentSessionId);
+    }
+    return [];
+  }
+
+  /**
+   * Check if session is valid in store
+   * @param {string} sessionId
+   * @param {string|number} [userId]
+   */
+  async isSessionValid(sessionId, userId = null) {
+    if (this.sessionManager) {
+      return await this.sessionManager.isSessionValid(sessionId, userId);
+    }
+    return true;
+  }
+
+  /**
+   * Revoke a specific session
+   * @param {string} sessionId
+   * @param {Object} [options]
+   */
+  async revokeSession(sessionId, options = {}) {
+    if (this.sessionManager) {
+      return await this.sessionManager.revokeSession(sessionId, options);
+    }
+    return false;
+  }
+
+  /**
+   * Revoke all other sessions for user
+   * @param {string|number} userId
+   * @param {string} currentSessionId
+   */
+  async revokeOtherSessions(userId, currentSessionId) {
+    if (this.sessionManager) {
+      return await this.sessionManager.revokeOtherSessions(userId, currentSessionId);
+    }
+    return 0;
+  }
+
+  /**
+   * Revoke all sessions for user
+   * @param {string|number} userId
+   */
+  async revokeAllSessions(userId) {
+    if (this.sessionManager) {
+      return await this.sessionManager.revokeAllSessions(userId);
+    }
+    return 0;
+  }
 }
 
 module.exports = {