Merge branch 'develop'

.npmignore

@@ -7,6 +7,5 @@
 .yarnrc.yml
 babel.config.*
 jest.config.*
-src
 tsconfig*.json
 tslint.json

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifi/auth-service",
-  "version": "1.0.12",
+  "version": "1.0.17",
   "author": "mifi (Mike Fitzpatrick)",
   "license": "MIT",
   "scripts": {
@@ -21,23 +21,18 @@
     "@babel/core": "^7.21.8",
     "@babel/preset-env": "^7.21.5",
     "@babel/preset-typescript": "^7.21.5",
+    "@simplewebauthn/typescript-types": "^7.x.x",
     "@tsconfig/node16": "^1.0.4",
     "@types/jest": "^29.5.1",
     "@types/jsonwebtoken": "^9.0.1",
     "@types/koa": "^2.13.5",
     "@types/koa-bodyparser": "^4.3.10",
     "@types/koa-cookie": "^1.0.0",
-    "@types/koa-passport": "^4.0.3",
     "@types/koa-router": "^7.4.4",
     "@types/koa-session": "^5.10.6",
     "@types/luxon": "^3.2.0",
     "@types/node": "^18.14.0",
-    "@types/passport": "^1.0.12",
+    "@types/uuid": "^9.0.1",
-    "@types/passport-facebook": "^2.1.11",
-    "@types/passport-fido2-webauthn": "^0.1.0",
-    "@types/passport-google-oauth": "^1.0.42",
-    "@types/passport-jwt": "^3.0.8",
-    "@types/passport-local": "^1.0.35",
     "@typescript-eslint/eslint-plugin": "^5.59.2",
     "@typescript-eslint/parser": "^5.59.2",
     "babel-jest": "^29.5.0",
@@ -54,30 +49,27 @@
     "prettier-eslint": "^15.0.1",
     "prettier-eslint-cli": "^7.1.0",
     "reflect-metadata": "^0.1.13",
-    "ts-node": "^10.9.1",
+    "ts-node": "^10.x.x",
-    "typescript": "^4.9.5"
+    "typescript": "^4.x.x"
   },
   "dependencies": {
-    "@mifi/auth-db": "^1.x.x",
+    "@mifi/auth-common": "^1.0.15",
-    "@mifi/services-common": "^1.x.x",
+    "@mifi/auth-db": "^1.0.20",
-    "@simplewebauthn/server": "^7.2.0",
+    "@mifi/auth-gatekeeper": "^1.0.12",
-    "dotenv": "^16.0.3",
+    "@mifi/services-common": "^1.0.16",
-    "http-status-codes": "^2.2.0",
+    "@simplewebauthn/server": "^7.x.x",
-    "jsonwebtoken": "^9.0.0",
+    "base64url": "^3.x.x",
-    "koa": "^2.14.1",
+    "dotenv": "^16.x.x",
-    "koa-bodyparser": "^4.3.0",
+    "http-status-codes": "^2.x.x",
-    "koa-cookie": "^1.0.0",
+    "jsonwebtoken": "^9.x.x",
-    "koa-passport": "^6.0.0",
+    "koa": "^2.x.x",
-    "koa-router": "^12.0.0",
+    "koa-bodyparser": "^4.x.x",
-    "koa-session": "^6.4.0",
+    "koa-compose": "^4.1.0",
+    "koa-cookie": "^1.x.x",
+    "koa-router": "^12.x.x",
+    "koa-session": "^6.x.x",
     "luxon": "^3.3.0",
-    "passport": "^0.6.0",
+    "uuid": "^9.x.x"
-    "passport-facebook": "^3.0.0",
-    "passport-fido2-webauthn": "^0.1.0",
-    "passport-google-oauth": "^2.0.0",
-    "passport-http-bearer": "^1.0.1",
-    "passport-jwt": "^4.0.1",
-    "passport-local": "^1.0.0"
   },
   "description": "",
   "repository": {

src/app.ts

@@ -3,11 +3,12 @@ import bodyparser from 'koa-bodyparser';
 import cookie from 'koa-cookie';
 import session from 'koa-session';
 
-import passport from './passport';
+import { gatekeeper } from '@mifi/auth-gatekeeper/lib';
+
 import { performanceLogger, performanceTimer } from './middleware/performance';
 import { errorHandler } from './middleware/errorHandler';
 import { authRouter } from './controllers/auth';
-import { SESSION_KEY } from './constants/env';
+import { SESSION_KEY } from './env';
 
 const app: Koa = new Koa();
 
@@ -20,8 +21,8 @@ app.use(cookie());
 app.keys = [SESSION_KEY];
 app.use(session({}, app));
 
-app.use(passport.initialize());
+app.use(gatekeeper.initialize);
-app.use(passport.session());
+app.use(gatekeeper.jwt);
 
 app.use(authRouter.routes());
 app.use(authRouter.allowedMethods());

src/constants/action.ts

@@ -1,9 +0,0 @@
-export enum Action {
-    AUTHENTICATE = 'AUTHENTICATE',
-    AUTHENTICATE_FAILURE = 'AUTHENTICATE_FAILURE',
-    CREATE = 'CREATE',
-    DELETE = 'DELETE',
-    RESET = 'RESET',
-    RESET_REQUEST = 'RESET_REQUEST',
-    UPDATE = 'UPDATE',
-}

src/constants/auth.ts

@@ -1,8 +0,0 @@
-export enum Status {
-    ACTIVE,
-    BLOCK_HARD,
-    BLOCK_SOFT,
-    DELETED,
-    INACTIVE,
-    UNVERIFIED,
-}

src/constants/db.ts

@@ -1,10 +0,0 @@
-export const DB_HOST = process.env.DB_HOST;
-export const DB_PORT = process.env.DB_PORT || 27017;
-export const DB_USERNAME = process.env.DB_USERNAME;
-export const DB_PASSWORD = process.env.DB_PASSWORD;
-export const DB_NAME = process.env.DB_NAME;
-
-export const COLL_AUTH = 'Auth';
-export const COLL_LOG = 'Log';
-export const COLL_STRATEGY = 'Strategy';
-export const COLL_TOKEN = 'Token';

src/constants/env.ts

@@ -1,20 +0,0 @@
-export const PACKAGE_NAME = '@mifi/auth';
-export const PORT = process.env.PORT || 9000;
-
-export const SESSION_KEY = process.env.SESSION_KEY || 'secret-key';
-
-export const JWT_AUDIENCE = process.env.JWT_AUDIENCE || 'mifi.dev';
-export const JWT_ISSUER = process.env.JWT_ISSUER || PACKAGE_NAME;
-export const JWT_SECRET = process.env.JWT_SECRET || 'secret';
-
-export const LOGIN_VALID_TIMEOUT = process.env.LOGIN_VALID_TIMEOUT || '12h'; // ###d|h|m
-export const RESET_VALID_TIMEOUT = process.env.RESET_VALID_TIMEOUT || '15m'; // ###d|h|m
-export const VERIFY_VALID_TIMEOUT = process.env.VERIFY_VALID_TIMEOUT || '60d'; // ###d|h|m
-export const DEFAULT_TOKEN_DAYS = process.env.DEFAULT_TOKEN_DAYS || 365;
-
-export const ROUTE_PREFIX = process.env.ROUTE_PREFIX || '/auth';
-export const LOGIN_ROUTE = process.env.LOGIN_ROUTE || '/login';
-export const RESET_ROUTE = process.env.RESET_ROUTE || '/reset';
-export const VERIFICATION_ROUTE = process.env.VERIFICATION_ROUTE || '/verification';
-
-export const REQUIRE_VERIFICATION = process.env.REQUIRE_VERIFICATION || true;

src/constants/strategies.ts

@@ -1,7 +0,0 @@
-export enum STRATEGIES {
-    LOCAL,
-    APPLE,
-    FACEBOOK,
-    FIDO2,
-    GOOGLE,
-}

src/constants/tokens.ts

@@ -1,4 +0,0 @@
-export enum TokenType {
-    RESET = 'RESET',
-    VERIFICATION = 'VERIFICATION',
-}

src/controllers/auth.ts

@@ -3,6 +3,8 @@ import Koa from 'koa';
 import Router from 'koa-router';
 import { StringSchemaDefinition } from 'mongoose';
 
+import { ROUTE_PREFIX as prefix, RESET_ROUTE } from '@mifi/auth-common/lib/env/routes';
+import { STRATEGIES } from '@mifi/auth-common/lib/enums/strategies';
 import { Auth } from '@mifi/auth-db/lib';
 import { deleteStrategy } from '@mifi/auth-db/lib/api/deleteStrategy';
 import { resetPasswordGet } from '@mifi/auth-db/lib/api/resetPasswordGet';
@@ -10,11 +12,9 @@ import { resetPasswordPost } from '@mifi/auth-db/lib/api/resetPasswordPost';
 import { create } from '@mifi/auth-db/lib/dao/create';
 import { deleteById } from '@mifi/auth-db/lib/dao/deleteById';
 import { AuthDocument } from '@mifi/auth-db/lib/schema/auth';
+import { gatekeeper } from '@mifi/auth-gatekeeper/lib';
 
-import { ROUTE_PREFIX as prefix, RESET_ROUTE } from '../constants/env';
-import passport from '../passport';
 import { ErrorCodes, getErrorBody } from '../constants/errors';
-import { authenticated } from '../middleware/authenication';
 
 const routerOpts: Router.IRouterOptions = { prefix };
 const router: Router = new Router(routerOpts);
@@ -34,20 +34,15 @@ router.post('/', async (ctx) => {
     ctx.body = { success: !!data, data };
 });
 
-router.delete('/strategy/:id', async (ctx) => {
+router.delete('/strategy/:id', gatekeeper.authenticated, async (ctx) => {
     ctx.body = { success: await deleteStrategy(ctx.params.id as StringSchemaDefinition) };
 });
 
-router.delete('/:id', async (ctx) => {
+router.delete('/:id', gatekeeper.authenticated, async (ctx) => {
     ctx.body = { success: await deleteById(ctx.params.id as StringSchemaDefinition) };
 });
 
-router.post('/login', async (ctx, next) => {
+router.post('/login', gatekeeper.authenticate(STRATEGIES[STRATEGIES.LOCAL]));
-    return passport.authenticate('local', (err, user) => {
-        ctx.body = user;
-        return user ? ctx.login(user) : ctx.throw(StatusCodes.UNAUTHORIZED);
-    })(ctx, next);
-});
 
 router.post(process.env.RESET_ROUTE || RESET_ROUTE, async (ctx) => {
     const { password, token, username } = ctx.request.body as { token?: string; password?: string; username?: string };
@@ -66,8 +61,8 @@ router.post(process.env.RESET_ROUTE || RESET_ROUTE, async (ctx) => {
     }
 });
 
-router.patch('/:record', authenticated(), (ctx: Koa.Context) => {
+router.patch('/:record', gatekeeper.authenticated, (ctx: Koa.Context) => {
-    if (ctx.user !== ctx.param.record) {
+    if (ctx.user.record !== ctx.param.record) {
         ctx.throw(StatusCodes.UNAUTHORIZED);
     }
     const data = Auth.findOneAndUpdate({ record: ctx.params.record });

src/controllers/passkey.ts

@@ -0,0 +1,10 @@
+// import Router from 'koa-router';
+
+// const routerOpts: Router.IRouterOptions = { prefix: '/passkey' };
+// const router: Router = new Router(routerOpts);
+
+// router.post('/login', async (ctx, next) => {});
+
+// router.post('/login/challenge', async (ctx, next) => {});
+
+// router.post('/signup/challenge', async (ctx, next) => {});

src/env.ts

@@ -0,0 +1,4 @@
+import { getEnvVar } from '@mifi/services-common/lib/utils/getEnvVar';
+
+export const SESSION_KEY = getEnvVar<string>('SESSION_KEY', 'secret');
+export const PORT = getEnvVar<number>('PORT', 9001);

src/index.ts

@@ -1,6 +1,6 @@
 import app from './app';
 import { connection } from '@mifi/auth-db/lib';
-import { PORT } from './constants/env';
+import { PORT } from './env';
 
 connection.then(
     () => {

src/middleware/authenication.ts

@@ -1,13 +0,0 @@
-import { Middleware } from 'koa';
-
-import { LOGIN_ROUTE } from '../constants/env';
-
-export const authenticated = (): Middleware => {
-    return (ctx, next) => {
-        if (ctx.isAuthenticated()) {
-            return next();
-        } else {
-            ctx.redirect(process.env.LOGIN_ROUTE || LOGIN_ROUTE);
-        }
-    };
-};

src/middleware/errorHandler.ts

@@ -1,7 +1,7 @@
 import { StatusCodes } from 'http-status-codes';
-import { Context, Next } from 'koa';
+import { Middleware } from 'koa';
 
-export const errorHandler = async (ctx: Context, next: Next) => {
+export const errorHandler: Middleware = async (ctx, next) => {
     try {
         await next();
         // eslint-disable-next-line @typescript-eslint/no-explicit-any

src/middleware/performance.ts

@@ -1,12 +1,12 @@
-import { Context, Next } from 'koa';
+import { Middleware } from 'koa';
 
-export const performanceLogger = async (ctx: Context, next: Next) => {
+export const performanceLogger: Middleware = async (ctx, next) => {
     await next();
     const rt = ctx.response.get('X-Response-Time');
-    console.log(`${ctx.method} ${ctx.url} - ${rt}`);
+    console.debug(`${ctx.method} ${ctx.url} - ${rt}`);
 };
 
-export const performanceTimer = async (ctx: Context, next: Next) => {
+export const performanceTimer: Middleware = async (ctx, next) => {
     const start = Date.now();
     await next();
     const ms = Date.now() - start;

src/passport/index.ts

@@ -1,23 +0,0 @@
-import passport from 'koa-passport';
-import { Types } from 'mongoose';
-
-import { AuthDocument } from '@mifi/auth-db/lib/schema/auth';
-import { readOneByRecord } from '@mifi/auth-db/lib/dao/readOneByRecord';
-import { readOneById } from '@mifi/auth-db/lib/dao/readOneById';
-
-import LocalStrategy from './strategies/local';
-import JwtStrategy from './strategies/jwt';
-
-passport.use(LocalStrategy);
-passport.use(JwtStrategy);
-
-passport.serializeUser((user, done) => {
-    done(null, (user as AuthDocument).record || (user as AuthDocument).id);
-});
-
-passport.deserializeUser(async (id, done) => {
-    const user = await readOneByRecord(<Types.ObjectId>id).catch(async () => await readOneById(<Types.ObjectId>id));
-    done(user ? null : 'user not found', user);
-});
-
-export default passport;

src/passport/strategies/jwt.ts

@@ -1,17 +0,0 @@
-import { ExtractJwt, Strategy as JwtStrategy } from 'passport-jwt';
-
-import { readOneByRecord } from '@mifi/auth-db/lib/dao/readOneByRecord';
-
-import { JWT_SECRET } from '../../constants/env';
-
-const opts = {
-    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-    secretOrKey: JWT_SECRET,
-    issuer: process.env.JWT_ISSUER,
-    audience: process.env.JWT_AUDIENCE,
-};
-
-export default new JwtStrategy(opts, async ({ sub }, done) => {
-    const auth = await readOneByRecord(sub);
-    return done(null, auth || false);
-});

src/passport/strategies/local.ts

@@ -1,9 +0,0 @@
-// eslint-disable-next-line import/named
-import { Strategy as LocalStrategy } from 'passport-local';
-
-import { authenticate } from '@mifi/auth-db/lib/api/authenticate';
-
-export default new LocalStrategy(async (username, password, done) => {
-    const user = await authenticate(username, password);
-    done(null, user);
-});

src/strategies/LocalStrategy.ts

@@ -0,0 +1,18 @@
+import { Context } from 'koa';
+
+import { STRATEGIES } from '@mifi/auth-common/lib/enums/strategies';
+import { authenticate } from '@mifi/auth-db/lib/api/authenticate';
+import { Strategy } from '@mifi/auth-gatekeeper/lib';
+import { GatekeeperUser } from '@mifi/auth-gatekeeper/lib/types/GatekeeperUser';
+
+interface LocalStrategyBody {
+    username: string;
+    password: string;
+}
+
+const name = STRATEGIES[STRATEGIES.LOCAL];
+
+export const LocalStrategy = new Strategy(name, async (ctx: Context) => {
+    const { password, username } = <LocalStrategyBody>ctx.request.body;
+    return authenticate(username, password) as Promise<false | GatekeeperUser>;
+});

src/types/PasskeyUser.ts

@@ -0,0 +1,5 @@
+export interface PasskeyUser {
+    displayName: string;
+    id: Buffer | string;
+    name: string;
+}

src/utils/jwt.ts

@@ -1,35 +0,0 @@
-import jwt from 'jsonwebtoken';
-import { JWT_AUDIENCE, JWT_ISSUER, JWT_SECRET } from '../constants/env';
-export interface TokenProps {
-    aud?: string;
-    exp?: number | Date;
-    iss?: string;
-    sub: string | null;
-    [key: string]: any;
-}
-
-export type SignProps = string | TokenProps | void;
-
-export const sign = (props: SignProps) => {
-    const today = new Date();
-    const { sub = null, ...rest }: TokenProps =
-        typeof props === 'string' || typeof props === 'undefined' ? { sub: props || null } : props;
-    let { exp } = rest;
-    if (!exp) {
-        exp = new Date(today);
-        exp.setDate(today.getDate() + parseInt(process.env.JWT_DAYS_VALID as string));
-        exp = exp.getTime() / 1000;
-    }
-    return jwt.sign(
-        {
-            exp,
-            sub,
-            aud: rest.aud || JWT_AUDIENCE,
-            iat: today.getTime(),
-            iss: rest.iss || JWT_ISSUER,
-        },
-        JWT_SECRET,
-    );
-};
-
-export const verify = (token: string) => jwt.verify(token, JWT_SECRET);

src/utils/links.ts

@@ -1,4 +1,4 @@
-import { RESET_ROUTE, ROUTE_PREFIX, VERIFICATION_ROUTE } from '../constants/env';
+import { RESET_ROUTE, ROUTE_PREFIX, VERIFICATION_ROUTE } from '@mifi/auth-common/lib/env/routes';
 
 export const getPasswordResetPath = (token: string) => `${ROUTE_PREFIX}${RESET_ROUTE}?t=${token}`;
 

src/utils/parseTimeoutToMs.ts

@@ -1,13 +0,0 @@
-export const parseTimeoutToMs = (timeout: string) => {
-    const match = timeout.match(/(?<number>\d+)(?<unit>d|h|m)/gi)?.groups || {};
-    const { number, unit } = match;
-    switch (unit) {
-        case 'd':
-            return 1000 * 60 * 60 * 24 * parseInt(number);
-        case 'h':
-            return 1000 * 60 * 60 * parseInt(number);
-        case 'm':
-        default:
-            return 1000 * 60 * parseInt(number) || 1;
-    }
-};

src/utils/password.ts

@@ -1,12 +0,0 @@
-import { pbkdf2Sync, randomBytes } from 'crypto';
-
-export const encrypt = (password: string) => {
-    const salt = randomBytes(16).toString('hex');
-    const hash = pbkdf2Sync(password, salt, 10000, 512, 'sha512').toString('hex');
-    return `${salt}:${hash}`;
-};
-
-export const verify = (test: string, secret: string) => {
-    const [salt, hash] = secret.split(':');
-    return pbkdf2Sync(test, salt, 10000, 512, 'sha512').toString('hex') === hash;
-};

src/utils/tokens.ts

@@ -1,11 +0,0 @@
-import { sign } from './jwt';
-import { LOGIN_VALID_TIMEOUT } from '../constants/env';
-import { Status } from '../constants/auth';
-import { parseTimeoutToMs } from './parseTimeoutToMs';
-
-export const generateLoginToken = (sub: string, status: Status) =>
-    sign({
-        sub,
-        status,
-        exp: Date.now() + parseTimeoutToMs(LOGIN_VALID_TIMEOUT),
-    });

tsconfig.package.json

@@ -10,8 +10,8 @@
         "rootDirs": ["./", "src/"],
         "strict": true,
         "esModuleInterop": true,
-        "sourceMap": false,
+        "sourceMap": true,
-        "removeComments": true
+        "removeComments": false
     },
     "include": ["./src"]
 }