zibri 2.3.0 → 2.4.1

package/src/auth/2fa/methods/otp/otp.two-factor-method.ts

@@ -4,14 +4,14 @@ import { HiBase32Utilities } from './hi-base32.utilities';
 import { TwoFactorMethod } from '../two-factor-method.interface';
 import { OtpCredentials, OtpCredentialsCreateData } from './otp-credentials.model';
 import { OtpUtilities } from './otp.utilities';
+import { HttpRequestContext } from '../../../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../../../context/request/websocket-request.context';
 import { Repository } from '../../../../data-source/repository';
 import { InjectRepository } from '../../../../di/decorators/inject-repository.decorator';
 import { Inject } from '../../../../di/decorators/inject.decorator';
 import { ZIBRI_DI_TOKENS } from '../../../../di/default/zibri-di-tokens.default';
 import { UnauthorizedError } from '../../../../error-handling/errors/unauthorized.error';
-import { HttpRequest } from '../../../../http/http-request.model';
 import { KnownHeader } from '../../../../http/known-header.enum';
-import { WebsocketRequest } from '../../../../websocket/models/websocket-request.model';
 import { BaseUser } from '../../../models/base-user.model';
 
 /**
@@ -71,10 +71,10 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
     // eslint-disable-next-line jsdoc/require-jsdoc
     async validate<Role extends string, UserType extends BaseUser<Role>>(
         user: UserType,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ): Promise<void> {
         const credentials: OtpCredentials[] = await this.otpCredentialsRepository.findAll({ where: { userId: user.id } });
-        const token: string = this.extractTokenFromRequest(request);
+        const token: string = this.extractTokenFromRequestContext(context);
         for (const c of credentials) {
             if (OtpUtilities.validate(c.secret, token)) {
                 return;
@@ -83,8 +83,8 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
         throw new UnauthorizedError('The provided two factor code is invalid.');
     }
 
-    private extractTokenFromRequest(request: HttpRequest | WebsocketRequest): string {
-        const code: string | undefined = request.headers[this.otpHeader];
+    private extractTokenFromRequestContext(context: HttpRequestContext | WebsocketRequestContext): string {
+        const code: string | undefined = context.request.headers[this.otpHeader];
         if (!code) {
             throw new UnauthorizedError(`"${this.otpHeader}" header not found`);
         }

package/src/auth/2fa/methods/two-factor-method.interface.ts

@@ -1,5 +1,5 @@
-import { HttpRequest } from '../../../http/http-request.model';
-import { WebsocketRequest } from '../../../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../../context/request/websocket-request.context';
 import { BaseUser } from '../../models/base-user.model';
 
 /**
@@ -29,7 +29,7 @@ export interface TwoFactorMethod<TwoFactorRequestRegisterData, TwoFactorConfirmR
      */
     validate: <Role extends string, UserType extends BaseUser<Role>>(
         user: UserType,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ) => void | Promise<void>
 }
 

package/src/auth/2fa/two-factor-service.interface.ts

@@ -1,7 +1,7 @@
 import { TwoFactorMethod } from './methods/two-factor-method.interface';
 import { TwoFactorMethods } from './two-factor-methods.model';
-import { HttpRequest } from '../../http/http-request.model';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { BaseUser } from '../models/base-user.model';
 
 /**
@@ -52,7 +52,7 @@ export interface TwoFactorServiceInterface {
      */
     has2fa: (
         user: BaseUser<string>,
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedMethods?: TwoFactorMethods
     ) => Promise<boolean>
 }

package/src/auth/2fa/two-factor.service.test.ts

@@ -0,0 +1,151 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from '@jest/globals';
+import { TOTP } from 'otpauth';
+
+import { OtpCredentials } from './methods/otp/otp-credentials.model';
+import { TwoFactorServiceInterface } from './two-factor-service.interface';
+import { createTestDataSource, defaultTestServerEntities } from '../../__testing__/test-server/create-test-data-source.function';
+import { startTestServer, StartedTestServer } from '../../__testing__/test-server/start-test-server.function';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { RequestContextToken } from '../../context/request/request-context-token.model';
+import { PostgresDataSource } from '../../data-source/data-sources/postgres-typeorm-data-source.model';
+import { Repository } from '../../data-source/repository';
+import { repositoryTokenFor } from '../../di/decorators/inject-repository.decorator';
+import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
+import { inject } from '../../di/inject.function';
+import { BaseUserEntity } from '../models/base-user.model';
+import { OtpConfirmRegisterData, OtpTwoFactorMethod } from './methods/otp/otp.two-factor-method';
+import { Entity } from '../../entity/decorators/entity.decorator';
+import { Newable } from '../../types/newable.type';
+
+enum TestRole {
+    USER = 'user'
+}
+
+@Entity()
+class User extends BaseUserEntity(TestRole) {}
+
+let server: StartedTestServer;
+let twoFactorService: TwoFactorServiceInterface;
+let otpMethod: OtpTwoFactorMethod;
+let userRepo: Repository<User>;
+let otpCredentialsRepo: Repository<OtpCredentials>;
+let otpHeader: string; // injected value of ZIBRI_DI_TOKENS.OTP_HEADER
+let otpLength: number;
+
+describe('TwoFactorService (contract via OTP method)', () => {
+    beforeAll(async () => {
+        const dataSourceClass: Newable<PostgresDataSource> = createTestDataSource({
+            entities: [...defaultTestServerEntities, User]
+        });
+        server = await startTestServer({ dataSources: [dataSourceClass] });
+
+        twoFactorService = inject(ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE);
+        otpMethod = inject(OtpTwoFactorMethod);
+        userRepo = inject(repositoryTokenFor(User));
+        otpCredentialsRepo = inject(repositoryTokenFor(OtpCredentials));
+        otpHeader = inject(ZIBRI_DI_TOKENS.OTP_HEADER);
+        otpLength = inject(ZIBRI_DI_TOKENS.OTP_LENGTH);
+    }, 15000);
+
+    afterAll(async () => {
+        await server.shutdown();
+    });
+
+    let user: User;
+
+    beforeEach(async () => {
+        // start fresh every test
+        await otpCredentialsRepo.deleteAll({});
+        await userRepo.deleteAll({});
+        user = await userRepo.create({ email: '2fa-test@example.com', roles: [TestRole.USER] });
+    });
+
+    it('requestRegister should create an unconfirmed credential', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0].secret).toBeTruthy();
+        expect(credentials[0].confirmed).toBe(false);
+    });
+
+    it('confirmRegister with a valid token should mark the credential as confirmed', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const secret: string = credentials[0].secret;
+
+        const validToken: string = new TOTP({ secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const updated: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(updated[0].confirmed).toBe(true);
+    });
+
+    it('confirmRegister with an invalid token should throw', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        await expect(
+            twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+                token: '000000'.slice(0, otpLength)
+            } as OtpConfirmRegisterData)
+        ).rejects.toThrow('The provided two factor code is invalid.');
+    });
+
+    it('has2fa should return true when a valid OTP header is present', async () => {
+        // register & confirm
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const validToken: string = new TOTP({ secret: credentials[0].secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: validToken } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(true);
+    });
+
+    it('has2fa should return false when the token is invalid', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const validToken: string = new TOTP({ secret: credentials[0].secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: '000000'.slice(0, otpLength) } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(false);
+    });
+
+    it('unregister should delete all credentials and make has2fa false', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: new TOTP({ secret: credentials[0].secret }).generate()
+        } as OtpConfirmRegisterData);
+
+        await twoFactorService.unregisterTwoFactorMethodForUser(user, otpMethod);
+
+        const remaining: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(remaining).toHaveLength(0);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: 'does-not-matter' } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(false);
+    });
+});

package/src/auth/2fa/two-factor.service.ts

@@ -1,13 +1,14 @@
 import { ZibriApplication } from '../../application';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { ZIBRI_REQUEST_CONTEXT_TOKENS } from '../../context/request/request-context-token.model';
+import { WebsocketRequestContext } from '../../context/request/websocket-request.context';
 import { Inject } from '../../di/decorators/inject.decorator';
 import { Injectable } from '../../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
 import { inject } from '../../di/inject.function';
 import { register } from '../../di/register.function';
 import { OnAppInit } from '../../global/on-app-init.interface';
-import { HttpRequest } from '../../http/http-request.model';
 import { type LoggerInterface } from '../../logging/logger.interface';
-import { WebsocketRequest } from '../../websocket/models/websocket-request.model';
 import { BaseUser } from '../models/base-user.model';
 import { TwoFactorMethod } from './methods/two-factor-method.interface';
 import { TwoFactorMethods } from './two-factor-methods.model';
@@ -87,12 +88,15 @@ export class TwoFactorService implements TwoFactorServiceInterface, OnAppInit {
     // eslint-disable-next-line jsdoc/require-jsdoc
     async has2fa(
         user: BaseUser<string>,
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedMethods: TwoFactorMethods = this.twoFactorMethods
     ): Promise<boolean> {
+        if (context.has(ZIBRI_REQUEST_CONTEXT_TOKENS.HAS_2FA)) {
+            return context.get(ZIBRI_REQUEST_CONTEXT_TOKENS.HAS_2FA);
+        }
         try {
             await Promise.any(
-                allowedMethods.map(m => inject(m).validate(user, request))
+                allowedMethods.map(m => inject(m).validate(user, context))
             );
             return true;
         }

package/src/auth/auth-service.interface.ts

@@ -1,5 +1,4 @@
 import { BaseEntity } from '../entity/base-entity.model';
-import { HttpRequest } from '../http/http-request.model';
 import { Newable } from '../types/newable.type';
 import { BaseUser } from './models/base-user.model';
 import { BelongsToMetadata } from './models/belongs-to-metadata.model';
@@ -9,7 +8,8 @@ import { IsNotLoggedInMetadata } from './models/is-not-logged-in-metadata.model'
 import { Require2faMetadata } from './models/require-2fa-metadata.model';
 import { AuthStrategies } from './strategies/auth-strategies.model';
 import { AuthStrategyInterface } from './strategies/auth-strategy.interface';
-import { WebsocketRequest } from '../websocket/models/websocket-request.model';
+import { HttpRequestContext } from '../context/request/http-request.context';
+import { WebsocketRequestContext } from '../context/request/websocket-request.context';
 
 /**
  * Interface for an auth service.
@@ -25,24 +25,28 @@ export interface AuthServiceInterface {
     checkAccess: (
         controllerClass: Newable<unknown>,
         controllerMethod: string,
-        request: HttpRequest | WebsocketRequest
+        context: HttpRequestContext | WebsocketRequestContext
     ) => Promise<void>,
     /**
      * Checks whether there is a currently logged in user.
      */
     isLoggedIn: (
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies
     ) => Promise<boolean>,
     /**
      * Checks whether the currently logged in user has one of the provided roles.
      */
-    hasRole: (request: HttpRequest | WebsocketRequest, allowedStrategies: AuthStrategies, allowedRoles: string[]) => Promise<boolean>,
+    hasRole: (
+        context: HttpRequestContext | WebsocketRequestContext,
+        allowedStrategies: AuthStrategies,
+        allowedRoles: string[]
+    ) => Promise<boolean>,
     /**
      * Checks whether the currently logged in user belongs to the target entity.
      */
     belongsTo: <TargetEntity extends Newable<BaseEntity>>(
-        request: HttpRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         targetEntity: TargetEntity,
         targetUserIdKey: keyof InstanceType<TargetEntity>,
@@ -149,7 +153,7 @@ export interface AuthServiceInterface {
         UserType extends BaseUser<Role>,
         B extends boolean = true
     >(
-        request: HttpRequest | WebsocketRequest,
+        context: HttpRequestContext | WebsocketRequestContext,
         allowedStrategies: AuthStrategies,
         required: B
     ) => Promise<B extends false ? UserType | undefined : UserType>,