webspresso 0.0.99 → 0.0.101

package/core/auth/manager.js

@@ -4,6 +4,7 @@
  * @module core/auth/manager
  */
 
+const EventEmitter = require('events');
 const { generateToken, hashToken } = require('./hash');
 const { PolicyManager } = require('./policy');
 const { signJwt, verifyJwt, decodeJwt } = require('./jwt');
@@ -67,7 +68,7 @@ const DEFAULT_CONFIG = {
 /**
  * AuthManager - Handles authentication operations
  */
-class AuthManager {
+class AuthManager extends EventEmitter {
   /**
    * Create AuthManager instance
    * @param {Object} config - Configuration
@@ -83,6 +84,7 @@ class AuthManager {
    * @param {Object} [config.routes] - Route configuration
    */
   constructor(config) {
+    super();
     this.validateConfig(config);
     
     this.config = {
@@ -106,6 +108,7 @@ class AuthManager {
       passwordReset: config.notifications?.passwordReset || null,
       emailVerification: config.notifications?.emailVerification || null,
       welcome: config.notifications?.welcome || null,
+      magicLink: config.notifications?.magicLink || null,
     };
 
     // TOTP & 2FA initialization
@@ -138,6 +141,30 @@ class AuthManager {
     
     // Policy manager instance
     this.policies = new PolicyManager();
+
+    // Session tracking and revocation manager
+    const { SessionManager } = require('./session-manager');
+    const { createKnexSessionTracker, createMemorySessionTracker } = require('./sessions');
+
+    let tracker = config.sessionTracker || null;
+    if (!tracker && (config.sessionTracking || config.trackSessions)) {
+      if (config.db || this.config.db) {
+        tracker = createKnexSessionTracker(config.db || this.config.db);
+      } else {
+        tracker = createMemorySessionTracker();
+      }
+    }
+
+    if (tracker || config.sessionTracking || config.trackSessions) {
+      this.sessionManager = new SessionManager({
+        tracker: tracker || createMemorySessionTracker(),
+        sessionStore: config.sessionStore || this.config.session?.store,
+        touchThrottleMs: config.sessionTouchThrottleMs,
+        emitter: this,
+      });
+    } else {
+      this.sessionManager = null;
+    }
   }
 
   /**
@@ -285,7 +312,7 @@ class AuthManager {
         
         // Set req.user
         req.user = user;
-        
+
         // Handle remember me
         if (options.remember && self.rememberTokens && self.config.rememberMe.enabled) {
           await self.createRememberToken(user.id, res);
@@ -294,18 +321,34 @@ class AuthManager {
         // Regenerate session ID for security if supported
         if (req.session && typeof req.session.regenerate === 'function') {
           return new Promise((resolve, reject) => {
-            req.session.regenerate((err) => {
+            req.session.regenerate(async (err) => {
               if (err) {
                 reject(new AuthenticationError('Session regeneration failed', 'SESSION_ERROR'));
               } else {
                 // Restore userId after regenerate
                 req.session.userId = user.id;
                 req.session.loggedInAt = Date.now();
+                if (req.sessionID && self.sessionManager) {
+                  try {
+                    await self.sessionManager.track(req.sessionID, user.id, req);
+                  } catch (e) {
+                    // Non-blocking
+                  }
+                }
                 resolve();
               }
             });
           });
         }
+
+        // Track active session if sessionManager is active and not regenerated
+        if (req.sessionID && self.sessionManager) {
+          try {
+            await self.sessionManager.track(req.sessionID, user.id, req);
+          } catch (e) {
+            // Non-blocking
+          }
+        }
       },
 
       /**
@@ -337,6 +380,19 @@ class AuthManager {
         // Clear 2FA session state
         this.clear2Fa();
 
+        // Revoke session if sessionManager is active
+        if (req.sessionID && self.sessionManager) {
+          try {
+            if (options.everywhere && userId) {
+              await self.sessionManager.revokeAllSessions(userId);
+            } else {
+              await self.sessionManager.revokeSession(req.sessionID, { userId });
+            }
+          } catch (e) {
+            // Non-blocking
+          }
+        }
+
         // Clear user
         req.user = null;
         
@@ -530,6 +586,91 @@ class AuthManager {
       authorize(action, policy = null, resource = null) {
         return self.policies.authorize(req.user, action, policy, resource);
       },
+
+      /**
+       * Request a magic link for passwordless login
+       * @param {string} identifier - User email or username
+       * @param {Object} [options]
+       * @returns {Promise<{ sent: boolean, expiresAt?: Date, token?: string, magicLinkUrl?: string, userFound: boolean }>}
+       */
+      requestMagicLink(identifier, options = {}) {
+        return self.requestMagicLink(identifier, options);
+      },
+
+      /**
+       * Verify magic link token
+       * @param {string} rawToken
+       * @param {Object} [options]
+       * @returns {Promise<{ ok: true, user: Object, userId: * }>}
+       */
+      verifyMagicLink(rawToken, options = {}) {
+        return self.verifyMagicLink(rawToken, options);
+      },
+
+      /**
+       * Verify magic link token and log user into current request session
+       * @param {string} rawToken
+       * @param {Object} [options]
+       * @returns {Promise<{ ok: true, user: Object, userId: *, accessToken?: string, refreshToken?: string }>}
+       */
+      async loginWithMagicLink(rawToken, options = {}) {
+        const result = await self.verifyMagicLink(rawToken, options);
+        await this.login(result.user, options.remember);
+
+        const response = { ...result };
+        if (options.jwt) {
+          response.accessToken = self.generateUserToken(result.user, options.jwtAccessOptions);
+          response.refreshToken = self.generateRefreshToken(result.user, options.jwtRefreshOptions);
+        }
+
+        return response;
+      },
+
+      /**
+       * List active sessions/devices for current user
+       * @returns {Promise<Array<Object>>}
+       */
+      sessions() {
+        if (!req.user?.id) return Promise.resolve([]);
+        return self.listSessions(req.user.id, req.sessionID);
+      },
+
+      /**
+       * Revoke a specific session
+       * @param {string} sessionId
+       * @returns {Promise<boolean>}
+       */
+      async revokeSession(sessionId) {
+        if (sessionId === req.sessionID) {
+          await this.logout();
+          return true;
+        }
+        return await self.revokeSession(sessionId, { userId: req.user?.id });
+      },
+
+      /**
+       * Revoke all other active sessions except current
+       * @returns {Promise<number>}
+       */
+      revokeOtherSessions() {
+        if (!req.user?.id) return Promise.resolve(0);
+        return self.revokeOtherSessions(req.user.id, req.sessionID);
+      },
+
+      /**
+       * Revoke all active sessions for user (force logout from all devices)
+       * @param {string|number} [userId]
+       * @returns {Promise<number>}
+       */
+      async revokeAllSessions(userId = null) {
+        const targetUserId = userId || req.user?.id;
+        if (!targetUserId) return 0;
+        const count = await self.revokeAllSessions(targetUserId);
+        if (targetUserId === req.user?.id) {
+          await this.logout();
+        }
+        return count;
+      },
     };
   }
 
@@ -787,6 +928,122 @@ class AuthManager {
     return { ok: true, userId: verified.userId };
   }
 
+  /**
+   * Request magic link passwordless login — safe against user enumeration
+   * @param {string} identifier - Email or username
+   * @param {Object} [options]
+   * @param {number} [options.tokenTtlMs=900000] - Default 15 minutes (900,000ms)
+   * @param {Function} [options.buildMagicLinkUrl] - (rawToken) => string
+   * @param {string} [options.path='/auth/magic-link/verify']
+   * @param {boolean} [options.hideUserNotFound=true]
+   * @returns {Promise<{ sent: boolean, expiresAt?: Date, token?: string, magicLinkUrl?: string, userFound: boolean }>}
+   */
+  async requestMagicLink(identifier, options = {}) {
+    if (!this.authTokens) {
+      throw new Error('authTokens adapter is required for magic link authentication');
+    }
+
+    const user = await this.resolveUserByIdentifier(identifier);
+    if (!user) {
+      return {
+        sent: options.hideUserNotFound !== false,
+        userFound: false,
+      };
+    }
+
+    const tokenTtlMs = options.tokenTtlMs ?? 15 * 60 * 1000;
+    const { rawToken, expiresAt } = await createAuthToken(
+      this.authTokens,
+      TOKEN_TYPES.MAGIC_LINK,
+      user.id,
+      tokenTtlMs
+    );
+
+    let baseUrl = String(options.baseUrl || this.config.baseUrl || process.env.BASE_URL || 'http://localhost:3000');
+    while (baseUrl.endsWith('/')) {
+      baseUrl = baseUrl.slice(0, -1);
+    }
+    const pathSegment = options.path || '/auth/magic-link/verify';
+    const cleanPath = pathSegment.startsWith('/') ? pathSegment : `/${pathSegment}`;
+    const sep = cleanPath.includes('?') ? '&' : '?';
+
+    const hasCustomUrl = typeof options.buildMagicLinkUrl === 'function' || Boolean(options.path) || Boolean(options.baseUrl);
+    const customMagicLinkUrl = typeof options.buildMagicLinkUrl === 'function'
+      ? options.buildMagicLinkUrl(rawToken)
+      : hasCustomUrl
+        ? `${baseUrl}${cleanPath}${sep}token=${encodeURIComponent(rawToken)}`
+        : null;
+
+    const defaultMagicLinkUrl = `${baseUrl}${cleanPath}${sep}token=${encodeURIComponent(rawToken)}`;
+
+    if (typeof this.notifications.magicLink === 'function') {
+      await this.notifications.magicLink(user, {
+        token: rawToken,
+        expiresAt,
+        magicLinkUrl: customMagicLinkUrl,
+        expiresMinutes: Math.round(tokenTtlMs / 60000),
+      });
+    }
+
+    this.emit('magicLink:requested', { userId: user.id, email: user.email, expiresAt });
+
+    return {
+      sent: true,
+      userFound: true,
+      expiresAt,
+      token: rawToken,
+      magicLinkUrl: customMagicLinkUrl || defaultMagicLinkUrl,
+    };
+  }
+
+  /**
+   * Verify magic link token and resolve user
+   * @param {string} rawToken
+   * @param {Object} [options]
+   * @param {boolean} [options.markEmailVerified=true]
+   * @param {boolean} [options.consumeAllForUser=true]
+   * @returns {Promise<{ ok: true, user: Object, userId: * }>}
+   */
+  async verifyMagicLink(rawToken, options = {}) {
+    if (!this.authTokens) {
+      throw new Error('authTokens adapter is required for magic link authentication');
+    }
+
+    const verified = await verifyAuthToken(
+      this.authTokens,
+      TOKEN_TYPES.MAGIC_LINK,
+      rawToken
+    );
+    if (!verified) {
+      throw new AuthenticationError('Invalid or expired magic link', 'INVALID_MAGIC_LINK');
+    }
+
+    const user = await this.findUserById(verified.userId);
+    if (!user) {
+      throw new AuthenticationError('User not found for magic link', 'USER_NOT_FOUND');
+    }
+
+    await consumeAuthToken(this.authTokens, verified.tokenHash);
+
+    if (options.consumeAllForUser !== false) {
+      await this.authTokens.deleteAllForUser(verified.userId, TOKEN_TYPES.MAGIC_LINK);
+    }
+
+    // Auto mark email verified if user has not verified it yet
+    if (options.markEmailVerified !== false && this.updateUser && this.verifiedField && !user[this.verifiedField]) {
+      try {
+        await this.updateUser(user.id, { [this.verifiedField]: new Date() });
+        user[this.verifiedField] = new Date();
+      } catch (e) {
+        // Continue even if update fails
+      }
+    }
+
+    this.emit('magicLink:verified', { userId: user.id });
+
+    return { ok: true, user, userId: verified.userId };
+  }
+
   /**
    * Send welcome notification if configured
    * @param {Object} user
@@ -935,6 +1192,89 @@ class AuthManager {
     }
     return this._authMiddleware.require2Fa(options);
   }
+
+  /**
+   * Track session for a request
+   * @param {string} sessionId
+   * @param {string|number} userId
+   * @param {Object} req
+   */
+  async trackSession(sessionId, userId, req) {
+    if (this.sessionManager) {
+      return await this.sessionManager.track(sessionId, userId, req);
+    }
+    return null;
+  }
+
+  /**
+   * Touch session to update activity timestamp
+   * @param {string} sessionId
+   */
+  async touchSession(sessionId) {
+    if (this.sessionManager) {
+      return await this.sessionManager.touch(sessionId);
+    }
+    return false;
+  }
+
+  /**
+   * List active sessions for user
+   * @param {string|number} userId
+   * @param {string} [currentSessionId]
+   */
+  async listSessions(userId, currentSessionId = null) {
+    if (this.sessionManager) {
+      return await this.sessionManager.listSessions(userId, currentSessionId);
+    }
+    return [];
+  }
+
+  /**
+   * Check if session is valid in store
+   * @param {string} sessionId
+   * @param {string|number} [userId]
+   */
+  async isSessionValid(sessionId, userId = null) {
+    if (this.sessionManager) {
+      return await this.sessionManager.isSessionValid(sessionId, userId);
+    }
+    return true;
+  }
+
+  /**
+   * Revoke a specific session
+   * @param {string} sessionId
+   * @param {Object} [options]
+   */
+  async revokeSession(sessionId, options = {}) {
+    if (this.sessionManager) {
+      return await this.sessionManager.revokeSession(sessionId, options);
+    }
+    return false;
+  }
+
+  /**
+   * Revoke all other sessions for user
+   * @param {string|number} userId
+   * @param {string} currentSessionId
+   */
+  async revokeOtherSessions(userId, currentSessionId) {
+    if (this.sessionManager) {
+      return await this.sessionManager.revokeOtherSessions(userId, currentSessionId);
+    }
+    return 0;
+  }
+
+  /**
+   * Revoke all sessions for user
+   * @param {string|number} userId
+   */
+  async revokeAllSessions(userId) {
+    if (this.sessionManager) {
+      return await this.sessionManager.revokeAllSessions(userId);
+    }
+    return 0;
+  }
 }
 
 module.exports = {

package/core/auth/middleware.js

@@ -6,6 +6,7 @@
 
 const session = require('express-session');
 const cookieParser = require('cookie-parser');
+const { createListSessionsHandler, createRevokeSessionHandler } = require('./session-manager');
 
 /**
  * Create authentication middleware stack
@@ -43,7 +44,21 @@ function createAuthMiddleware(authManager) {
   /**
    * Cookie parser middleware (needed for signed cookies / remember me)
    */
-  const cookieMiddleware = cookieParser(config.session.secret);
+  const baseCookieMiddleware = cookieParser(config.session?.secret);
+  const cookieMiddleware = (req, res, next) => {
+    if (!req.cookies) {
+      return baseCookieMiddleware(req, res, next);
+    }
+    if (config.session?.secret) {
+      if (!req.secret) {
+        req.secret = config.session.secret;
+      }
+      if (!req.signedCookies || Object.keys(req.signedCookies).length === 0) {
+        req.signedCookies = cookieParser.signedCookies(req.cookies, config.session.secret);
+      }
+    }
+    next();
+  };
 
   /**
    * Authenticate middleware
@@ -79,12 +94,29 @@ function createAuthMiddleware(authManager) {
 
       // Try to load user from session if not authenticated by JWT
       if (!req.user && req.session?.userId) {
-        const user = await authManager.findUserById(req.session.userId);
-        if (user) {
-          req.user = user;
-        } else {
-          // User no longer exists, clear session
+        // If session tracking is enabled, verify session has not been revoked
+        let isSessionValid = true;
+        if (authManager.sessionManager && req.sessionID) {
+          isSessionValid = await authManager.isSessionValid(req.sessionID, req.session.userId);
+        }
+
+        if (!isSessionValid) {
+          // Session was revoked remotely
           delete req.session.userId;
+          if (typeof req.session.destroy === 'function') {
+            req.session.destroy(() => {});
+          }
+        } else {
+          const user = await authManager.findUserById(req.session.userId);
+          if (user) {
+            req.user = user;
+            if (req.sessionID && authManager.sessionManager) {
+              authManager.touchSession(req.sessionID).catch(() => {});
+            }
+          } else {
+            // User no longer exists, clear session
+            delete req.session.userId;
+          }
         }
       }
 
@@ -95,6 +127,9 @@ function createAuthMiddleware(authManager) {
           req.user = user;
           req.session.userId = user.id;
           req.session.loggedInAt = Date.now();
+          if (req.sessionID && authManager.sessionManager) {
+            authManager.trackSession(req.sessionID, user.id, req).catch(() => {});
+          }
         }
       }
 
@@ -389,6 +424,10 @@ function createAuthMiddleware(authManager) {
     // Utility
     parseMiddlewareString,
     
+    // Session handlers
+    listSessions: createListSessionsHandler(authManager),
+    revokeSession: createRevokeSessionHandler(authManager),
+
     // Aliases for route config (factories — file-router calls requireAuth(opts) / requireGuest(opts))
     auth: requireAuth,
     jwt: requireJwt,