zibri 2.2.1 → 2.4.0

package/src/auth/hash/strategies/hash-strategy-entity.model.ts

@@ -0,0 +1,40 @@
+import { BaseEntity } from '../../../entity/base-entity.model';
+import { Entity } from '../../../entity/decorators/entity.decorator';
+import { Property } from '../../../entity/decorators/property.decorator';
+import { OmitStrict } from '../../../types/omit-strict.type';
+
+/**
+ * The status that a hash strategy can have.
+ */
+export enum HashStrategyStatus {
+    ACTIVE = 'ACTIVE',
+    DEFAULT = 'DEFAULT',
+    DEPRECATED = 'DEPRECATED'
+}
+
+/**
+ * The hash strategy entity that is stored in the db.
+ */
+@Entity({ allowOrphan: true })
+export class HashStrategyEntity extends BaseEntity {
+    /**
+     * The name of the strategy.
+     */
+    @Property.string()
+    name!: string;
+    /**
+     * The version of the strategy.
+     */
+    @Property.string()
+    version!: string;
+    /**
+     * The status of the strategy.
+     */
+    @Property.string({ enum: HashStrategyStatus })
+    status!: HashStrategyStatus;
+}
+
+/**
+ * The data for creating a new hash strategy entity.
+ */
+export type HashStrategyEntityCreateData = OmitStrict<HashStrategyEntity, 'id'>;

package/src/auth/hash/strategies/hash-strategy.interface.ts

@@ -0,0 +1,23 @@
+import { HashString } from '../hash.utilities';
+
+/**
+ * Interface for a hash strategy.
+ */
+export interface HashStrategyInterface<THashOptions extends Record<string, unknown>> {
+    /**
+     * The name of the strategy.
+     */
+    name: string,
+    /**
+     * The version of the strategy.
+     */
+    version: string,
+    /**
+     * Hashes the given value with the given options.
+     */
+    hash: (value: string, options: THashOptions | undefined) => HashString | Promise<HashString>,
+    /**
+     * Checks whether or not the given value equals the given hash.
+     */
+    equal: (value: string, hash: HashString) => boolean | Promise<boolean>
+}

package/src/auth/models/password-reset-token.model.ts

@@ -6,7 +6,7 @@ import { OmitClass } from '../../entity/omit-class.model';
 /**
  * A short lived token used to confirm a password reset.
  */
-@Entity()
+@Entity({ allowOrphan: true })
 export class PasswordResetToken extends BaseEntity {
     /**
      * The expiration date of the password reset token.

package/src/auth/strategies/auth-strategy.interface.ts

@@ -1,8 +1,10 @@
+import { AuthStrategies } from './auth-strategies.model';
+import { ZibriApplication } from '../../application';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { BaseEntity } from '../../entity/base-entity.model';
-import { HttpRequest } from '../../http/http-request.model';
 import { OpenApiSecuritySchemeObject } from '../../open-api/open-api.model';
 import { Newable } from '../../types/newable.type';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
 import { BaseUser } from '../models/base-user.model';
 
 /**
@@ -19,13 +21,13 @@ export interface AuthStrategyInterface<
     LogoutData
 > {
     /**
-     * Initializes the strategy.
+     * Initializes the auth strategy.
      */
-    init: () => void,
+    init?: (app: ZibriApplication) => void | Promise<void>,
     /**
      * Resolves the current user.
      */
-    resolveUser: (request: HttpRequest | WebsocketRequest) => Promise<UserType | undefined>,
+    resolveUser: (context: HttpRequestContext | WebsocketRequestContext) => Promise<UserType | undefined>,
     /**
      * Logs in a user.
      */
@@ -41,16 +43,16 @@ export interface AuthStrategyInterface<
     /**
      * Checks whether a user is currently logged in.
      */
-    isLoggedIn: (request: HttpRequest | WebsocketRequest) => Promise<boolean>,
+    isLoggedIn: (context: HttpRequestContext | WebsocketRequestContext) => Promise<boolean>,
     /**
      * Checks whether a currently logged in user has one of the provided roles.
      */
-    hasRole: (request: HttpRequest | WebsocketRequest, allowedRoles: RoleType[]) => Promise<boolean>,
+    hasRole: (context: HttpRequestContext | WebsocketRequestContext, allowedRoles: RoleType[]) => Promise<boolean>,
     /**
      * Checks whether a currently logged belongs to the requested resource.
      */
     belongsTo: <TargetEntity extends Newable<BaseEntity>>(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         targetEntity: TargetEntity,
         targetUserIdKey: keyof InstanceType<TargetEntity>,
         targetIdParamKey: string
@@ -71,4 +73,34 @@ export interface AuthStrategyInterface<
      * The name of the auth strategy.
      */
     name: string
+}
+
+/**
+ * Checks whether or not the given value is a auth strategy.
+ * @param value - The value to check.
+ * @returns True if all keys of the AuthStrategyInterface are present, false otherwise.
+ */
+export function isAuthStrategy(value: unknown): value is InstanceType<AuthStrategies[number]> {
+    if (value == undefined) {
+        return false;
+    }
+    if (typeof value !== 'object') {
+        return false;
+    }
+
+    const keys: (keyof InstanceType<AuthStrategies[number]>)[] = [
+        'belongsTo',
+        'confirmPasswordReset',
+        'hasRole',
+        'isLoggedIn',
+        'login',
+        'logout',
+        'name',
+        'refreshLogin',
+        'requestPasswordReset',
+        'resolveUser',
+        'securityScheme'
+    ];
+
+    return !keys.find(key => !(key in value));
 }

package/src/auth/strategies/cookie/cookie-auth-confirm-password-reset-data.model.ts

@@ -0,0 +1,23 @@
+import { Transaction } from '../../../data-source/transaction/transaction.model';
+import { Property } from '../../../entity/decorators/property.decorator';
+
+/**
+ * The data used to confirm a password reset.
+ */
+export class CookieAuthConfirmPasswordResetData {
+    /**
+     * The reset token value.
+     */
+    @Property.string()
+    resetToken!: string;
+
+    /**
+     * The new password that should be used from now on.
+     */
+    @Property.string()
+    newPassword!: string;
+    /**
+     * The transaction that this should run in.
+     */
+    transaction!: Transaction;
+}

package/src/auth/strategies/cookie/cookie-auth-credentials.model.ts

@@ -0,0 +1,56 @@
+import { Transaction } from '../../../data-source/transaction/transaction.model';
+import { BaseEntity } from '../../../entity/base-entity.model';
+import { Entity } from '../../../entity/decorators/entity.decorator';
+import { Property } from '../../../entity/decorators/property.decorator';
+import { OmitClass } from '../../../entity/omit-class.model';
+import type { HashString } from '../../hash/hash.utilities';
+import { BaseUser } from '../../models/base-user.model';
+
+/**
+ * The credentials used by the cookie-auth auth strategy.
+ */
+@Entity({ allowOrphan: true })
+export class CookieAuthCredentials extends BaseEntity implements Pick<BaseUser<string>, 'id' | 'email'> {
+    /**
+     * The id of the user that this credentials belong to.
+     */
+    @Property.string({ format: 'uuid' })
+    userId!: string;
+
+    /**
+     * The email of the user.
+     */
+    @Property.string({ unique: true, format: 'email' })
+    email!: string;
+
+    /**
+     * The hashed password.
+     */
+    @Property.string({ hash: true })
+    password!: HashString;
+}
+
+/**
+ * The data that is used to login a user via the cookie auth auth strategy.
+ */
+export class CookieAuthCredentialsData extends OmitClass(CookieAuthCredentials, ['id', 'userId', 'password']) {
+    /**
+     * The password.
+     */
+    @Property.string()
+    password!: string;
+    /**
+     * The transaction that this should run in.
+     */
+    transaction!: Transaction;
+}
+
+/**
+ * The actual credentials sent over http.
+ */
+export class CookieAuthCredentialsDto extends OmitClass(CookieAuthCredentialsData, ['transaction']) {}
+
+/**
+ * The data for creating new cookie auth credentials.
+ */
+export class CookieAuthCredentialsCreateData extends OmitClass(CookieAuthCredentials, ['id']) {}

package/src/auth/strategies/cookie/cookie-auth-data.model.ts

@@ -0,0 +1,32 @@
+import { Property } from '../../../entity/decorators/property.decorator';
+
+/**
+ * The authentication data that gets returned when logging in or refreshing the login.
+ */
+export class CookieAuthData<Role extends string> {
+    /**
+     * The id of the user of the cookie.
+     */
+    @Property.string({ format: 'uuid' })
+    userId!: string;
+    /**
+     * The roles of the user.
+     */
+    @Property.array({ items: { type: 'string' } })
+    roles!: Role[];
+    /**
+     * The token to prohibit cross site request forgery.
+     */
+    @Property.string()
+    csrfToken!: string;
+    /**
+     * The expiration date of the session.
+     */
+    @Property.date()
+    sessionExpirationDate!: Date;
+    /**
+     * The expiration date of the refresh session.
+     */
+    @Property.date()
+    refreshSessionExpirationDate!: Date;
+}

package/src/auth/strategies/cookie/cookie-auth-logout-data.model.ts

@@ -0,0 +1,22 @@
+import { Transaction } from '../../../data-source/transaction/transaction.model';
+import { Property } from '../../../entity/decorators/property.decorator';
+
+/**
+ * Data for logging a user out with the cookie auth strategy.
+ */
+export class CookieAuthLogoutData {
+    /**
+     * Whether or not cookies should be cleared.
+     */
+    @Property.boolean()
+    clearCookies!: boolean;
+    /**
+     * The id of the refresh session to logout.
+     */
+    @Property.string({ format: 'uuid' })
+    refreshSessionId!: string;
+    /**
+     * The transaction that this should run in.
+     */
+    transaction: Transaction | undefined;
+}

package/src/auth/strategies/cookie/cookie-auth-refresh-login-data.model.ts

@@ -0,0 +1,11 @@
+import { Transaction } from '../../../data-source/transaction/transaction.model';
+
+/**
+ * Data for refreshing a login with the cookie auth strategy.
+ */
+export class CookieAuthRefreshLoginData {
+    /**
+     * The transaction that this should run in.
+     */
+    transaction!: Transaction;
+}

package/src/auth/strategies/cookie/cookie-auth-refresh-session.model.ts

@@ -0,0 +1,46 @@
+import { BaseEntity } from '../../../entity/base-entity.model';
+import { Entity } from '../../../entity/decorators/entity.decorator';
+import { Property } from '../../../entity/decorators/property.decorator';
+import { OmitClass } from '../../../entity/omit-class.model';
+
+/**
+ * A cookie auth refresh session.
+ */
+@Entity({ allowOrphan: true })
+export class CookieAuthRefreshSession extends BaseEntity {
+    /**
+     * The id of the user that this session belong to.
+     */
+    @Property.string({ format: 'uuid' })
+    userId!: string;
+    /**
+     * The expiration date of the session.
+     */
+    @Property.date()
+    expirationDate!: Date;
+    /**
+     * The token to prohibit cross site request forgery.
+     */
+    @Property.string()
+    csrfToken!: string;
+    /**
+     * Whether or not this session has been blacklisted.
+     *
+     * Is used for automatic reuse detection.
+     */
+    @Property.boolean()
+    blacklisted!: boolean;
+    /**
+     * The id of the "family" this token belongs to.
+     * All tokens that belong to the same "ancestor" are considered to be in a family.
+     *
+     * Is used for automatic reuse detection.
+     */
+    @Property.string({ format: 'uuid' })
+    familyId!: string;
+}
+
+/**
+ * Data for creating a new cookie auth refresh session.
+ */
+export class CookieAuthRefreshSessionCreateData extends OmitClass(CookieAuthRefreshSession, ['id']) {}

package/src/auth/strategies/cookie/cookie-auth-request-password-reset-data.model.ts

@@ -0,0 +1,28 @@
+import { Transaction } from '../../../data-source/transaction/transaction.model';
+import { QueueEmailData } from '../../../email/models/create-email-data.model';
+import { BaseUser } from '../../models/base-user.model';
+
+/**
+ * The data used by the cookie auth strategy to request a password reset.
+ */
+export type CookieAuthRequestPasswordResetData<RoleType extends string, UserType extends BaseUser<RoleType>> = {
+    /**
+     * The user which password should be reset.
+     */
+    user: UserType,
+    /**
+     * Additional data for the password reset email.
+     */
+    emailData?: Partial<
+        QueueEmailData & {
+            /**
+             * The url where the password reset confirmation happens.
+             */
+            confirmPasswordResetUrl: string
+        }
+    >,
+    /**
+     * The transaction that this should run in.
+     */
+    transaction: Transaction
+};

package/src/auth/strategies/cookie/cookie-auth-session-cleanup.cron-job.ts

@@ -0,0 +1,35 @@
+import { CookieAuthRefreshSession } from './cookie-auth-refresh-session.model';
+import { CookieAuthSession } from './cookie-auth-session.model';
+import { CronExpression } from '../../../cron/cron-expression.utilities';
+import { CronJob, InitialCronConfig } from '../../../cron/cron-job.model';
+import { Repository } from '../../../data-source/repository';
+import { InjectRepository } from '../../../di/decorators/inject-repository.decorator';
+
+/**
+ * A cron job to cleanup expired cookie and cookie refresh sessions.
+ */
+export class CookieAuthSessionCleanupCronJob extends CronJob {
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    initialConfig: InitialCronConfig = {
+        name: 'Cleanup cookie auth sessions',
+        cron: CronExpression.daily().build(),
+        runOnInit: false
+    };
+
+    constructor(
+        @InjectRepository(CookieAuthSession)
+        private readonly sessionRepository: Repository<CookieAuthSession>,
+        @InjectRepository(CookieAuthRefreshSession)
+        private readonly refreshSessionRepository: Repository<CookieAuthRefreshSession>
+    ) {
+        super();
+    }
+
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async onTick(): Promise<void> {
+        await this.sessionRepository.deleteAll({ expirationDate: { before: new Date() } });
+        // blacklisted refresh sessions need to stay,
+        // to find out if someone tries to use them a second time.
+        await this.refreshSessionRepository.deleteAll({ expirationDate: { before: new Date() } });
+    }
+}

package/src/auth/strategies/cookie/cookie-auth-session.model.ts

@@ -0,0 +1,34 @@
+import { BaseEntity } from '../../../entity/base-entity.model';
+import { Entity } from '../../../entity/decorators/entity.decorator';
+import { Property } from '../../../entity/decorators/property.decorator';
+import { OmitClass } from '../../../entity/omit-class.model';
+
+/**
+ * A cookie auth session.
+ */
+@Entity({ allowOrphan: true })
+export class CookieAuthSession extends BaseEntity {
+    /**
+     * The id of the user that this session belong to.
+     */
+    @Property.string({ format: 'uuid' })
+    userId!: string;
+    /**
+     * The expiration date of the session.
+     */
+    @Property.date()
+    expirationDate!: Date;
+    /**
+     * The id of the "family" this token belongs to.
+     * All tokens that belong to the same "ancestor" are considered to be in a family.
+     *
+     * Is used for automatic reuse detection.
+     */
+    @Property.string({ format: 'uuid' })
+    familyId!: string;
+}
+
+/**
+ * Data for creating a new cookie auth session.
+ */
+export class CookieAuthSessionCreateData extends OmitClass(CookieAuthSession, ['id']) {}