zibri 2.3.0 → 2.4.0

package/src/auth/auth-service.interface.ts

@@ -1,5 +1,4 @@
 import { BaseEntity } from '../entity/base-entity.model';
-import { HttpRequest } from '../http/http-request.model';
 import { Newable } from '../types/newable.type';
 import { BaseUser } from './models/base-user.model';
 import { BelongsToMetadata } from './models/belongs-to-metadata.model';
@@ -9,7 +8,8 @@ import { IsNotLoggedInMetadata } from './models/is-not-logged-in-metadata.model'
 import { Require2faMetadata } from './models/require-2fa-metadata.model';
 import { AuthStrategies } from './strategies/auth-strategies.model';
 import { AuthStrategyInterface } from './strategies/auth-strategy.interface';
-import { WebsocketRequest } from '../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../context/request/http-request.context';
+import { WebsocketRequestContext } from '../context/request/websocket-request.context';
 
 /**
  * Interface for an auth service.
@@ -25,24 +25,28 @@ export interface AuthServiceInterface {
     checkAccess: (
         controllerClass: Newable<unknown>,
         controllerMethod: string,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ) => Promise<void>,
     /**
      * Checks whether there is a currently logged in user.
      */
     isLoggedIn: (
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies
     ) => Promise<boolean>,
     /**
      * Checks whether the currently logged in user has one of the provided roles.
      */
-    hasRole: (request: HttpRequest | WebsocketRequest, allowedStrategies: AuthStrategies, allowedRoles: string[]) => Promise<boolean>,
+    hasRole: (
+        context: HttpRequestContext | WebsocketRequestContext,
+        allowedStrategies: AuthStrategies,
+        allowedRoles: string[]
+    ) => Promise<boolean>,
     /**
      * Checks whether the currently logged in user belongs to the target entity.
      */
     belongsTo: <TargetEntity extends Newable<BaseEntity>>(
-        request: HttpRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         targetEntity: TargetEntity,
         targetUserIdKey: keyof InstanceType<TargetEntity>,
@@ -149,7 +153,7 @@ export interface AuthServiceInterface {
         UserType extends BaseUser<Role>,
         B extends boolean = true
     >(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         required: B
     ) => Promise<B extends false ? UserType | undefined : UserType>,

package/src/auth/auth.service.ts

@@ -12,18 +12,19 @@ import { Require2faMetadata, SkipRequire2faMetadata } from './models/require-2fa
 import { SkipAuthMetadata } from './models/skip-auth-metadata.model';
 import { AuthStrategies } from './strategies/auth-strategies.model';
 import { AuthStrategyInterface } from './strategies/auth-strategy.interface';
+import { HttpRequestContext } from '../context/request/http-request.context';
+import { ZIBRI_REQUEST_CONTEXT_TOKENS } from '../context/request/request-context-token.model';
+import { WebsocketRequestContext } from '../context/request/websocket-request.context';
 import { Inject } from '../di/decorators/inject.decorator';
 import { Injectable } from '../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
 import { inject } from '../di/inject.function';
 import { UnauthorizedError } from '../error-handling/errors/unauthorized.error';
 import { OnAppInit } from '../global/on-app-init.interface';
-import { HttpRequest } from '../http/http-request.model';
 import { type LoggerInterface } from '../logging/logger.interface';
 import { Newable } from '../types/newable.type';
 import { MetadataUtilities } from '../utilities/metadata.utilities';
 import { PromiseUtilities } from '../utilities/promise.utilities';
-import { WebsocketRequest } from '../websocket/models/websocket-request.model';
 
 /**
  * Default auth service implementation of Zibri.
@@ -41,8 +42,8 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
     ) {}
 
     // eslint-disable-next-line jsdoc/require-jsdoc
-    async onAppInit({ options }: ZibriApplication): Promise<void> {
-        const { authStrategies } = options;
+    async onAppInit(app: ZibriApplication): Promise<void> {
+        const { authStrategies } = app.options;
         for (const strategy of authStrategies) {
             register({ token: strategy, useClass: strategy });
             this.strategies.push(strategy);
@@ -53,6 +54,7 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
             );
             for (const strategy of authStrategies) {
                 await this.logger.info(`  - ${strategy.name}`);
+                await inject(strategy).init?.(app);
             }
         }
     }
@@ -119,15 +121,18 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
         UserType extends BaseUser<Role>,
         B extends boolean = true
     >(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         required: B
     ): Promise<B extends false ? UserType | undefined : UserType> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.CURRENT_USER)) {
+            return await context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.CURRENT_USER) as B extends false ? UserType | undefined : UserType;
+        }
         // eslint-disable-next-line stylistic/max-len
         const strategies: AuthStrategyInterface<Role, UserType, unknown, unknown, unknown, unknown, unknown, unknown>[] = allowedStrategies.map(
             s => inject(s)
         ) as unknown as AuthStrategyInterface<Role, UserType, unknown, unknown, unknown, unknown, unknown, unknown>[];
-        const res: PromiseSettledResult<UserType | undefined>[] = await Promise.allSettled(strategies.map(s => s.resolveUser(request)));
+        const res: PromiseSettledResult<UserType | undefined>[] = await Promise.allSettled(strategies.map(s => s.resolveUser(context)));
         const currentUser: UserType | undefined = (
             res.find(r => r.status === 'fulfilled' && r.value !== undefined) as PromiseFulfilledResult<UserType> | undefined
         )?.value;
@@ -197,7 +202,7 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
     async checkAccess(
         controllerClass: Newable<unknown>,
         controllerMethod: string,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ): Promise<void> {
         const isLoggedInMetadata: IsLoggedInMetadata | undefined = await this.resolveIsLoggedInMetadata(controllerClass, controllerMethod);
         const isNotLoggedInMetadata: IsNotLoggedInMetadata | undefined = await this.resolveIsNotLoggedInMetadata(
@@ -226,14 +231,14 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
         // isLoggedIn
         if (
             (isLoggedInMetadata || hasRoleMetadata || belongsToMetadata || require2faMetadata)
-            && !await this.isLoggedIn(request, isLoggedInMetadata?.allowedStrategies ?? this.strategies)
+            && !await this.isLoggedIn(context, isLoggedInMetadata?.allowedStrategies ?? this.strategies)
         ) {
             throw new UnauthorizedError('You need to be logged in to access this route.');
         }
         // isNotLoggedIn
         if (
             isNotLoggedInMetadata
-            && await this.isLoggedIn(request, isLoggedInMetadata?.allowedStrategies ?? this.strategies)
+            && await this.isLoggedIn(context, isNotLoggedInMetadata.allowedStrategies ?? this.strategies)
         ) {
             throw new UnauthorizedError('You cannot be logged in when accessing this route.');
         }
@@ -241,15 +246,15 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
         // hasRole
         if (
             hasRoleMetadata
-            && !await this.hasRole(request, hasRoleMetadata.allowedStrategies ?? this.strategies, hasRoleMetadata.allowedRoles)
+            && !await this.hasRole(context, hasRoleMetadata.allowedStrategies ?? this.strategies, hasRoleMetadata.allowedRoles)
         ) {
             throw new UnauthorizedError(`You need to have one role of ${hasRoleMetadata.allowedRoles} to access this route.`);
         }
 
         // require2fa
         if (require2faMetadata) {
-            const user: BaseUser<string> = await this.getCurrentUser(request, this.strategies, true);
-            if (!await this.twoFactorService.has2fa(user, request, require2faMetadata.allowedMethods)) {
+            const user: BaseUser<string> = await this.getCurrentUser(context, this.strategies, true);
+            if (!await this.twoFactorService.has2fa(user, context, require2faMetadata.allowedMethods)) {
                 throw new UnauthorizedError('You need to provide a second factor to access this route.');
             }
         }
@@ -258,14 +263,14 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
         if (
             belongsToMetadata
             && !await this.belongsTo(
-                request,
+                context,
                 belongsToMetadata.allowedStrategies ?? this.strategies,
                 belongsToMetadata.targetEntity,
                 belongsToMetadata.targetUserIdKey,
                 belongsToMetadata.targetIdParamKey
             )
         ) {
-            const targetId: string | undefined = request.params?.[belongsToMetadata.targetIdParamKey];
+            const targetId: string | undefined = context.request.params?.[belongsToMetadata.targetIdParamKey];
             throw new UnauthorizedError(
                 // eslint-disable-next-line stylistic/max-len
                 `You need to to have access to the ${belongsToMetadata.targetEntity.name} entity with the id ${String(targetId)} to access this route.`
@@ -275,13 +280,16 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     async isLoggedIn(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies
     ): Promise<boolean> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.IS_LOGGED_IN)) {
+            return context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.IS_LOGGED_IN);
+        }
         // eslint-disable-next-line stylistic/max-len
         const strategies: AuthStrategyInterface<string, BaseUser<string>, unknown, unknown, unknown, unknown, unknown, unknown>[] = allowedStrategies.map(s => inject(s));
         try {
-            return await PromiseUtilities.anyValueTrue(strategies, s => s.isLoggedIn(request));
+            return await PromiseUtilities.anyValueTrue(strategies, s => s.isLoggedIn(context));
         }
         catch {
             return false;
@@ -290,14 +298,14 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     async hasRole(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         allowedRoles: string[]
     ): Promise<boolean> {
         // eslint-disable-next-line stylistic/max-len
         const strategies: AuthStrategyInterface<string, BaseUser<string>, unknown, unknown, unknown, unknown, unknown, unknown>[] = allowedStrategies.map(s => inject(s));
         try {
-            return await PromiseUtilities.anyValueTrue(strategies, s => s.hasRole(request, allowedRoles));
+            return await PromiseUtilities.anyValueTrue(strategies, s => s.hasRole(context, allowedRoles));
         }
         catch {
             return false;
@@ -306,7 +314,7 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
 
     // eslint-disable-next-line jsdoc/require-jsdoc
     async belongsTo<TargetEntity extends Newable<BaseEntity>>(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         targetEntity: TargetEntity,
         targetUserIdKey: keyof InstanceType<TargetEntity>,
@@ -317,7 +325,7 @@ export class AuthService implements AuthServiceInterface, OnAppInit {
         try {
             return await PromiseUtilities.anyValueTrue(
                 strategies,
-                s => s.belongsTo(request, targetEntity, targetUserIdKey, targetIdParamKey)
+                s => s.belongsTo(context, targetEntity, targetUserIdKey, targetIdParamKey)
             );
         }
         catch {

package/src/auth/encryption/encryption-key.model.ts

@@ -0,0 +1,51 @@
+import { type EncryptionString } from './encryption.utilities';
+import { EncryptionStrategyEntity } from './strategies/encryption-strategy-entity.model';
+import { BaseEntity } from '../../entity/base-entity.model';
+import { Entity } from '../../entity/decorators/entity.decorator';
+import { Property } from '../../entity/decorators/property.decorator';
+import { DeepPartial } from '../../types/deep-partial.type';
+import { ExcludeStrict } from '../../types/exclude-strict.type';
+import { OmitStrict } from '../../types/omit-strict.type';
+
+/**
+ * The status that an encryption key can have.
+ */
+export enum EncryptionKeyStatus {
+    ACTIVE = 'ACTIVE',
+    DEFAULT = 'DEFAULT',
+    DEPRECATED = 'DEPRECATED'
+}
+
+/**
+ * A key used for encrypting data.
+ */
+@Entity({ allowOrphan: true })
+export class EncryptionKey extends BaseEntity {
+    /**
+     * The actual key value, stored encrypted.
+     */
+    @Property.string()
+    value!: EncryptionString;
+    /**
+     * The encryption strategy that this key belongs to.
+     */
+    @Property.manyToOne({ target: () => EncryptionStrategyEntity, inverseSide: 'keys' })
+    strategy!: EncryptionStrategyEntity;
+    /**
+     * The status of the key.
+     */
+    @Property.string({ enum: EncryptionKeyStatus })
+    status!: EncryptionKeyStatus;
+}
+
+/**
+ * The data for creating a new key.
+ */
+export type EncryptionKeyCreateData = OmitStrict<EncryptionKey, 'id' | 'strategy' | 'status'>
+    & DeepPartial<Pick<EncryptionKey, 'strategy'>>
+    & {
+        /**
+         * The status of the key.
+         */
+        status: ExcludeStrict<EncryptionKeyStatus, EncryptionKeyStatus.DEPRECATED>
+    };

package/src/auth/encryption/encryption-master-options.model.ts

@@ -0,0 +1,41 @@
+import { BaseDecryptOptions, BaseEncryptOptions, EncryptionStrategyInterface } from './strategies/encryption-strategy.interface';
+
+/**
+ * Definition of the key used to encrypt encryption keys.
+ */
+export type EncryptionMasterKey<TKey> = {
+    /**
+     * The id of the key.
+     */
+    id: string,
+    /**
+     * The actual value.
+     */
+    value: TKey
+};
+
+/**
+ * Options on how encryption keys should be encrypted.
+ */
+export type EncryptionMasterOptions<
+    TKey,
+    TEncryptOptions extends BaseEncryptOptions<TKey> = BaseEncryptOptions<TKey>,
+    TDecryptOptions extends BaseDecryptOptions<TKey> = BaseEncryptOptions<TKey>
+> = {
+    /**
+     * The current master key for encrypting encryption keys.
+     */
+    currentMasterKey: EncryptionMasterKey<TKey>,
+    /**
+     * The strategy that is used to encrypt encryption keys.
+     */
+    currentMasterStrategy: EncryptionStrategyInterface<TKey, TEncryptOptions, TDecryptOptions>,
+    /**
+     * Any old master keys.
+     */
+    oldMasterKeys?: EncryptionMasterKey<unknown>[],
+    /**
+     * Any old master strategies.
+     */
+    oldMasterStrategies?: EncryptionStrategyInterface<unknown>[]
+};

package/src/auth/encryption/encryption-service.interface.ts

@@ -0,0 +1,87 @@
+import { EncryptionKey, EncryptionKeyCreateData } from './encryption-key.model';
+import { EncryptionString } from './encryption.utilities';
+import { BaseEncryptOptions, EncryptionStrategyInterface } from './strategies/encryption-strategy.interface';
+import { BaseRepositoryOptions } from '../../data-source/models/options/base-repository-options.model';
+import { Where } from '../../data-source/models/where/where-filter.model';
+import { AnyObject } from '../../entity/any-object.model';
+import { Newable } from '../../types/newable.type';
+import { OmitStrict } from '../../types/omit-strict.type';
+
+/**
+ * Options for encrypting a value.
+ */
+export type EncryptOptions<TKey, TEncryptOptions extends BaseEncryptOptions<TKey>> = {
+    /**
+     * The strategy to use.
+     */
+    strategy: Newable<EncryptionStrategyInterface<TKey, TEncryptOptions>>,
+    /**
+     * Additional options for that strategy.
+     */
+    strategyOptions?: Partial<OmitStrict<TEncryptOptions, 'key'>>
+};
+
+/**
+ * Additional options for deleting encryption keys.
+ */
+export type DeleteEncryptionKeyOptions = BaseRepositoryOptions & {
+    /**
+     * Whether or not it is allowed to delete the default key.
+     */
+    allowDefault?: boolean
+};
+
+/**
+ * Interface for an encryption service.
+ */
+export interface EncryptionServiceInterface {
+    /**
+     * Encrypts the given value using the provided options.
+     */
+    encrypt: <TKey, TEncryptOptions extends BaseEncryptOptions<TKey>>(
+        value: string,
+        options?: EncryptOptions<TKey, TEncryptOptions>
+    ) => EncryptionString | Promise<EncryptionString>,
+    /**
+     * Decrypts the given value using the provided options.
+     */
+    decrypt: <TDecryptOptions extends BaseRepositoryOptions & AnyObject>(
+        value: EncryptionString,
+        options?: TDecryptOptions
+    ) => string | Promise<string>,
+    /**
+     * Creates a new encryption key for the given strategy.
+     */
+    createKey: <TKey>(
+        strategy: Newable<EncryptionStrategyInterface<TKey>>,
+        data: OmitStrict<EncryptionKeyCreateData, 'strategy' | 'value'>,
+        options?: BaseRepositoryOptions
+    ) => EncryptionKey | Promise<EncryptionKey>,
+    /**
+     * Deletes the key with the given id.
+     */
+    deleteKey: (keyId: string, options?: DeleteEncryptionKeyOptions) => void | Promise<void>,
+    /**
+     * Deletes all keys that match the given where clause.
+     */
+    deleteAllKeys: (where: Where<EncryptionKey>, options?: DeleteEncryptionKeyOptions) => void | Promise<void>,
+    /**
+     * Marks the key with the given id as the default key for the given strategy.
+     */
+    markKeyAsDefaultForStrategy: <TKey>(
+        keyId: string,
+        strategy: Newable<EncryptionStrategyInterface<TKey>>,
+        options?: BaseRepositoryOptions
+    ) => void | Promise<void>,
+    /**
+     * Decrypts the key of the given strategy.
+     */
+    decryptKey: <TKey>(
+        strategy: Newable<EncryptionStrategyInterface<TKey>>,
+        encryptedKey: EncryptionString
+    ) => Promise<TKey>,
+    /**
+     * Checks whether or not the given encryption string should be re-encrypted.
+     */
+    needsReEncryption: (encrypted: EncryptionString) => boolean | Promise<boolean>
+}

package/src/auth/encryption/encryption.service.test.ts

@@ -0,0 +1,67 @@
+import { afterAll, beforeAll, describe, expect, test } from '@jest/globals';
+
+import { EncryptionKey } from './encryption-key.model';
+import { EncryptionService } from './encryption.service';
+import { EncryptionString } from './encryption.utilities';
+import { AesGcmEncryptionStrategy } from './strategies/aes-gcm.encryption-strategy';
+import { EncryptionStrategyEntity } from './strategies/encryption-strategy-entity.model';
+import { StartedTestServer, startTestServer } from '../../__testing__/test-server/start-test-server.function';
+import { Repository } from '../../data-source/repository';
+import { repositoryTokenFor } from '../../di/decorators/inject-repository.decorator';
+import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
+import { inject } from '../../di/inject.function';
+
+describe('EncryptionService', () => {
+    let server: StartedTestServer;
+    let encryptionService: EncryptionService;
+    let strategyRepository: Repository<EncryptionStrategyEntity>;
+    let keyRepository: Repository<EncryptionKey>;
+
+    beforeAll(async () => {
+        server = await startTestServer();
+        strategyRepository = inject(repositoryTokenFor(EncryptionStrategyEntity));
+        keyRepository = inject(repositoryTokenFor(EncryptionKey));
+        encryptionService = inject(ZIBRI_DI_TOKENS.ENCRYPTION_SERVICE) as EncryptionService;
+    }, 15000);
+
+    afterAll(async () => {
+        await server?.shutdown();
+    });
+
+    test('creates strategy metadata and key metadata on first encrypt', async () => {
+        const strategiesBeforeEncryption: EncryptionStrategyEntity[] = await strategyRepository.findAll();
+        expect(strategiesBeforeEncryption.length).toBe(0);
+
+        const encrypted: string = await encryptionService.encrypt('hello');
+        expect(encrypted).toBeTruthy();
+
+        const strategies: EncryptionStrategyEntity[] = await strategyRepository.findAll();
+        const keys: EncryptionKey[] = await keyRepository.findAll();
+
+        expect(strategies.length).toBeGreaterThan(0);
+        expect(keys.length).toBeGreaterThan(0);
+    });
+
+    test('decrypts an encrypted value', async () => {
+        const encrypted: EncryptionString = await encryptionService.encrypt('secret');
+
+        await expect(encryptionService.decrypt(encrypted)).resolves.toBe('secret');
+    });
+
+    test('does not duplicate key metadata on repeated encryptions with same strategy', async () => {
+        await encryptionService.encrypt('first');
+        await encryptionService.encrypt('second');
+
+        const keys: EncryptionKey[] = await keyRepository.findAll();
+        expect(keys).toHaveLength(1);
+    });
+
+    test('fails with invalid aad', async () => {
+        const encrypted: EncryptionString = await encryptionService.encrypt(
+            'secret',
+            { strategy: AesGcmEncryptionStrategy, strategyOptions: { aad: 'userId:42' } }
+        );
+        await expect(encryptionService.decrypt(encrypted)).rejects.toThrow();
+        await expect(encryptionService.decrypt(encrypted, { aad: 'userId:42' })).resolves.toBe('secret');
+    });
+});