init studio auth backend
This commit is contained in:
@@ -0,0 +1,534 @@
|
||||
import { config } from '../config'
|
||||
import { prisma } from '../prisma'
|
||||
import { hashPassword, verifyPassword } from '../security/password'
|
||||
import { redis } from '../redis'
|
||||
import { createOpaqueToken, hashToken } from '../security/tokens'
|
||||
import type { AuthUser } from '../types'
|
||||
|
||||
type UserWithAffiliation = {
|
||||
id: string
|
||||
email: string
|
||||
name: string | null
|
||||
role: string
|
||||
createdAt: Date
|
||||
lastLoginAt: Date | null
|
||||
appRoles?: Array<{
|
||||
appKey: string
|
||||
roleCode: string
|
||||
}>
|
||||
affiliations?: Array<{
|
||||
id: string
|
||||
organizationId: string
|
||||
department: string | null
|
||||
position: string | null
|
||||
organization: {
|
||||
name: string
|
||||
type: string
|
||||
}
|
||||
}>
|
||||
userLicenses?: Array<{
|
||||
id: string
|
||||
startsAt: Date
|
||||
expiresAt: Date | null
|
||||
license: {
|
||||
code: string
|
||||
name: string
|
||||
}
|
||||
}>
|
||||
}
|
||||
|
||||
const activeLicenseWhere = () => {
|
||||
const now = new Date()
|
||||
return {
|
||||
startsAt: { lte: now },
|
||||
OR: [{ expiresAt: null }, { expiresAt: { gt: now } }],
|
||||
license: { isActive: true }
|
||||
}
|
||||
}
|
||||
|
||||
const currentLicenseRelation = () => ({
|
||||
where: activeLicenseWhere(),
|
||||
orderBy: { startsAt: 'desc' },
|
||||
take: 1,
|
||||
select: {
|
||||
id: true,
|
||||
startsAt: true,
|
||||
expiresAt: true,
|
||||
license: {
|
||||
select: {
|
||||
code: true,
|
||||
name: true
|
||||
}
|
||||
}
|
||||
}
|
||||
}) as const
|
||||
|
||||
const userSelect = () => {
|
||||
const now = new Date()
|
||||
return {
|
||||
id: true,
|
||||
email: true,
|
||||
name: true,
|
||||
role: true,
|
||||
createdAt: true,
|
||||
lastLoginAt: true,
|
||||
affiliations: {
|
||||
where: { isPrimary: true, endsAt: null },
|
||||
take: 1,
|
||||
select: {
|
||||
id: true,
|
||||
organizationId: true,
|
||||
department: true,
|
||||
position: true,
|
||||
organization: {
|
||||
select: {
|
||||
name: true,
|
||||
type: true
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
userLicenses: currentLicenseRelation(),
|
||||
appRoles: {
|
||||
where: {
|
||||
AND: [
|
||||
{ OR: [{ startsAt: null }, { startsAt: { lte: now } }] },
|
||||
{ OR: [{ endsAt: null }, { endsAt: { gt: now } }] }
|
||||
]
|
||||
},
|
||||
select: {
|
||||
appKey: true,
|
||||
roleCode: true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const toAuthUser = (user: UserWithAffiliation): AuthUser => {
|
||||
const primaryAffiliation = user.affiliations?.[0]
|
||||
const currentLicense = user.userLicenses?.[0]
|
||||
return {
|
||||
id: user.id,
|
||||
email: user.email,
|
||||
name: user.name,
|
||||
role: user.role,
|
||||
appRoles: user.appRoles ?? [],
|
||||
createdAt: user.createdAt,
|
||||
lastLoginAt: user.lastLoginAt,
|
||||
primaryAffiliation: primaryAffiliation
|
||||
? {
|
||||
id: primaryAffiliation.id,
|
||||
organizationId: primaryAffiliation.organizationId,
|
||||
organizationName: primaryAffiliation.organization.name,
|
||||
organizationType: primaryAffiliation.organization.type,
|
||||
department: primaryAffiliation.department,
|
||||
position: primaryAffiliation.position
|
||||
}
|
||||
: null,
|
||||
currentLicense: currentLicense
|
||||
? {
|
||||
id: currentLicense.id,
|
||||
code: currentLicense.license.code,
|
||||
name: currentLicense.license.name,
|
||||
startsAt: currentLicense.startsAt,
|
||||
expiresAt: currentLicense.expiresAt
|
||||
}
|
||||
: null
|
||||
}
|
||||
}
|
||||
|
||||
export async function findUserByEmail(email: string) {
|
||||
return prisma.user.findUnique({
|
||||
where: { email: email.toLowerCase() },
|
||||
include: {
|
||||
affiliations: {
|
||||
where: { isPrimary: true, endsAt: null },
|
||||
take: 1,
|
||||
include: { organization: true }
|
||||
},
|
||||
userLicenses: {
|
||||
where: activeLicenseWhere(),
|
||||
orderBy: { startsAt: 'desc' },
|
||||
take: 1,
|
||||
include: { license: true }
|
||||
},
|
||||
appRoles: {
|
||||
where: {
|
||||
AND: [
|
||||
{ OR: [{ startsAt: null }, { startsAt: { lte: new Date() } }] },
|
||||
{ OR: [{ endsAt: null }, { endsAt: { gt: new Date() } }] }
|
||||
]
|
||||
},
|
||||
select: {
|
||||
appKey: true,
|
||||
roleCode: true
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
export async function createUser(input: { email: string; password: string; name?: string | null }): Promise<AuthUser> {
|
||||
const freeLicense = await prisma.license.findUnique({
|
||||
where: { code: 'FREE' },
|
||||
select: { defaultDurationDays: true }
|
||||
})
|
||||
const licenseStartsAt = new Date()
|
||||
const licenseExpiresAt = calculateLicenseExpiresAt(licenseStartsAt, freeLicense?.defaultDurationDays)
|
||||
|
||||
const user = await prisma.user.create({
|
||||
data: {
|
||||
email: input.email.toLowerCase(),
|
||||
passwordHash: await hashPassword(input.password),
|
||||
name: input.name?.trim() || null,
|
||||
userLicenses: {
|
||||
create: {
|
||||
startsAt: licenseStartsAt,
|
||||
expiresAt: licenseExpiresAt,
|
||||
license: {
|
||||
connect: { code: 'FREE' }
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
select: userSelect()
|
||||
})
|
||||
|
||||
return toAuthUser(user)
|
||||
}
|
||||
|
||||
function calculateLicenseExpiresAt(startsAt: Date, durationDays: number | null | undefined): Date | null {
|
||||
if (!durationDays) return null
|
||||
|
||||
const expiresAt = new Date(startsAt)
|
||||
expiresAt.setDate(expiresAt.getDate() + durationDays)
|
||||
return expiresAt
|
||||
}
|
||||
|
||||
export async function createManagedUser(input: {
|
||||
email: string
|
||||
password: string
|
||||
name?: string | null
|
||||
organizationId: string
|
||||
department?: string | null
|
||||
position?: string | null
|
||||
licenseCode?: 'FREE' | 'EDU' | 'PRO'
|
||||
}): Promise<AuthUser> {
|
||||
const user = await prisma.user.create({
|
||||
data: {
|
||||
email: input.email.toLowerCase(),
|
||||
passwordHash: await hashPassword(input.password),
|
||||
name: input.name?.trim() || null,
|
||||
role: 'USER',
|
||||
affiliations: {
|
||||
create: {
|
||||
organizationId: input.organizationId,
|
||||
department: input.department?.trim() || null,
|
||||
position: input.position?.trim() || null,
|
||||
isPrimary: true
|
||||
}
|
||||
},
|
||||
userLicenses: {
|
||||
create: {
|
||||
license: {
|
||||
connect: { code: input.licenseCode ?? 'EDU' }
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
select: userSelect()
|
||||
})
|
||||
|
||||
return toAuthUser(user)
|
||||
}
|
||||
|
||||
export async function updateUserPassword(userId: string, password: string): Promise<void> {
|
||||
await prisma.user.update({
|
||||
where: { id: userId },
|
||||
data: { passwordHash: await hashPassword(password) }
|
||||
})
|
||||
}
|
||||
|
||||
export async function changeUserPassword(userId: string, currentPassword: string, newPassword: string): Promise<boolean> {
|
||||
const user = await prisma.user.findFirst({
|
||||
where: { id: userId, isActive: true },
|
||||
select: { passwordHash: true }
|
||||
})
|
||||
|
||||
if (!user) return false
|
||||
|
||||
const passwordOk = await verifyPassword(currentPassword, user.passwordHash)
|
||||
if (!passwordOk) return false
|
||||
|
||||
await updateUserPassword(userId, newPassword)
|
||||
return true
|
||||
}
|
||||
|
||||
export async function updateUserProfileImage(userId: string, imageData: Uint8Array, mimeType: string): Promise<void> {
|
||||
await prisma.user.update({
|
||||
where: { id: userId },
|
||||
data: {
|
||||
profileImageData: Buffer.from(imageData),
|
||||
profileImageMime: mimeType,
|
||||
profileImageUpdatedAt: new Date()
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
export async function deleteUserProfileImage(userId: string): Promise<void> {
|
||||
await prisma.user.update({
|
||||
where: { id: userId },
|
||||
data: {
|
||||
profileImageData: null,
|
||||
profileImageMime: null,
|
||||
profileImageUpdatedAt: null
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
export async function findUserProfileImage(userId: string): Promise<{ data: Buffer; mimeType: string; updatedAt: Date | null } | null> {
|
||||
const user = await prisma.user.findFirst({
|
||||
where: { id: userId, isActive: true },
|
||||
select: {
|
||||
profileImageData: true,
|
||||
profileImageMime: true,
|
||||
profileImageUpdatedAt: true
|
||||
}
|
||||
})
|
||||
|
||||
if (!user?.profileImageData || !user.profileImageMime) return null
|
||||
|
||||
return {
|
||||
data: Buffer.from(user.profileImageData),
|
||||
mimeType: user.profileImageMime,
|
||||
updatedAt: user.profileImageUpdatedAt
|
||||
}
|
||||
}
|
||||
|
||||
export async function findUserById(id: string): Promise<AuthUser | null> {
|
||||
const user = await prisma.user.findFirst({
|
||||
where: { id, isActive: true },
|
||||
select: userSelect()
|
||||
})
|
||||
|
||||
return user ? toAuthUser(user) : null
|
||||
}
|
||||
|
||||
export async function listOrganizations() {
|
||||
return prisma.organization.findMany({
|
||||
where: { isActive: true },
|
||||
orderBy: [{ type: 'asc' }, { name: 'asc' }],
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
type: true,
|
||||
domain: true,
|
||||
createdAt: true
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
export async function createOrganization(input: { name: string; type: 'COMPANY' | 'SCHOOL' | 'GOVERNMENT' | 'LAB' | 'OTHER'; domain?: string | null }) {
|
||||
return prisma.organization.create({
|
||||
data: {
|
||||
name: input.name.trim(),
|
||||
type: input.type,
|
||||
domain: input.domain?.trim() || null
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
type: true,
|
||||
domain: true,
|
||||
createdAt: true
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
export async function assignUserAffiliation(input: {
|
||||
userId: string
|
||||
organizationId: string
|
||||
department?: string | null
|
||||
position?: string | null
|
||||
isPrimary?: boolean
|
||||
}) {
|
||||
return prisma.$transaction(async (tx) => {
|
||||
if (input.isPrimary) {
|
||||
await tx.userAffiliation.updateMany({
|
||||
where: { userId: input.userId, endsAt: null },
|
||||
data: { isPrimary: false }
|
||||
})
|
||||
}
|
||||
|
||||
return tx.userAffiliation.create({
|
||||
data: {
|
||||
userId: input.userId,
|
||||
organizationId: input.organizationId,
|
||||
department: input.department?.trim() || null,
|
||||
position: input.position?.trim() || null,
|
||||
isPrimary: input.isPrimary ?? true
|
||||
},
|
||||
select: {
|
||||
id: true,
|
||||
userId: true,
|
||||
organizationId: true,
|
||||
department: true,
|
||||
position: true,
|
||||
isPrimary: true,
|
||||
organization: {
|
||||
select: {
|
||||
name: true,
|
||||
type: true
|
||||
}
|
||||
}
|
||||
}
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
export async function markLastLogin(userId: string, loggedInAt = new Date()): Promise<void> {
|
||||
await prisma.user.update({
|
||||
where: { id: userId },
|
||||
data: { lastLoginAt: loggedInAt }
|
||||
})
|
||||
}
|
||||
|
||||
export async function isLoginBlocked(email: string): Promise<boolean> {
|
||||
const attempts = Number(await redis.get(loginAttemptKey(email)))
|
||||
return Number.isFinite(attempts) && attempts >= config.maxFailedLoginAttempts
|
||||
}
|
||||
|
||||
export async function recordFailedLogin(email: string): Promise<void> {
|
||||
const attempts = await redis.incr(loginAttemptKey(email))
|
||||
if (attempts === 1) {
|
||||
await redis.expire(loginAttemptKey(email), config.loginAttemptWindowSeconds)
|
||||
}
|
||||
}
|
||||
|
||||
export async function clearLoginAttempts(email: string): Promise<void> {
|
||||
await redis.del(loginAttemptKey(email))
|
||||
}
|
||||
|
||||
export async function storeEmailVerificationCode(email: string, code: string): Promise<void> {
|
||||
await redis.set(
|
||||
emailVerificationKey(email),
|
||||
JSON.stringify({ code, email: email.toLowerCase() }),
|
||||
'EX',
|
||||
config.emailVerificationTtlSeconds
|
||||
)
|
||||
}
|
||||
|
||||
export async function verifyEmailVerificationCode(email: string, code: string): Promise<boolean> {
|
||||
const key = emailVerificationKey(email)
|
||||
const tokenJson = await redis.get(key)
|
||||
if (typeof tokenJson !== 'string') return false
|
||||
|
||||
const token = parseStoredEmailVerification(tokenJson)
|
||||
if (!token || token.email !== email.toLowerCase() || token.code !== code) return false
|
||||
|
||||
await redis.del(key)
|
||||
return true
|
||||
}
|
||||
|
||||
export async function storePasswordResetCode(email: string, code: string): Promise<void> {
|
||||
await redis.set(
|
||||
passwordResetKey(email),
|
||||
JSON.stringify({ code, email: email.toLowerCase() }),
|
||||
'EX',
|
||||
config.emailVerificationTtlSeconds
|
||||
)
|
||||
}
|
||||
|
||||
export async function verifyPasswordResetCode(email: string, code: string): Promise<boolean> {
|
||||
const key = passwordResetKey(email)
|
||||
const tokenJson = await redis.get(key)
|
||||
if (typeof tokenJson !== 'string') return false
|
||||
|
||||
const token = parseStoredEmailVerification(tokenJson)
|
||||
if (!token || token.email !== email.toLowerCase() || token.code !== code) return false
|
||||
|
||||
await redis.del(key)
|
||||
return true
|
||||
}
|
||||
|
||||
export async function createRefreshToken(userId: string): Promise<string> {
|
||||
const token = createOpaqueToken()
|
||||
await redis.set(refreshTokenKey(token), JSON.stringify({ userId }), 'EX', config.refreshTokenTtlSeconds)
|
||||
return token
|
||||
}
|
||||
|
||||
export async function rotateRefreshToken(refreshToken: string): Promise<AuthUser | null> {
|
||||
const tokenJson = await redis.send('GETDEL', [refreshTokenKey(refreshToken)])
|
||||
if (typeof tokenJson !== 'string') return null
|
||||
|
||||
const token = parseStoredRefreshToken(tokenJson)
|
||||
if (!token) return null
|
||||
|
||||
return findUserById(token.userId)
|
||||
}
|
||||
|
||||
export async function revokeRefreshToken(refreshToken: string): Promise<void> {
|
||||
await redis.del(refreshTokenKey(refreshToken))
|
||||
}
|
||||
|
||||
export async function createHandoffToken(userId: string, audienceApp: string): Promise<string> {
|
||||
const token = createOpaqueToken()
|
||||
await redis.set(
|
||||
handoffTokenKey(token),
|
||||
JSON.stringify({ userId, audienceApp }),
|
||||
'EX',
|
||||
config.handoffTokenTtlSeconds
|
||||
)
|
||||
return token
|
||||
}
|
||||
|
||||
export async function exchangeHandoffToken(handoffToken: string, audienceApp?: string): Promise<AuthUser | null> {
|
||||
const tokenJson = await redis.send('GETDEL', [handoffTokenKey(handoffToken)])
|
||||
if (typeof tokenJson !== 'string') return null
|
||||
|
||||
const token = parseStoredHandoffToken(tokenJson)
|
||||
if (!token || (audienceApp && token.audienceApp !== audienceApp)) return null
|
||||
|
||||
return findUserById(token.userId)
|
||||
}
|
||||
|
||||
const refreshTokenKey = (token: string): string => `auth:refresh:${hashToken(token)}`
|
||||
|
||||
const handoffTokenKey = (token: string): string => `auth:handoff:${hashToken(token)}`
|
||||
|
||||
const loginAttemptKey = (email: string): string => `auth:login_attempt:${hashToken(email.toLowerCase())}`
|
||||
|
||||
const emailVerificationKey = (email: string): string => `auth:email_verify:${hashToken(email.toLowerCase())}`
|
||||
|
||||
const passwordResetKey = (email: string): string => `auth:password_reset:${hashToken(email.toLowerCase())}`
|
||||
|
||||
const parseStoredRefreshToken = (value: string): { userId: string } | null => {
|
||||
try {
|
||||
const parsed = JSON.parse(value)
|
||||
return typeof parsed.userId === 'string' ? { userId: parsed.userId } : null
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
const parseStoredHandoffToken = (value: string): { userId: string; audienceApp: string } | null => {
|
||||
try {
|
||||
const parsed = JSON.parse(value)
|
||||
return typeof parsed.userId === 'string' && typeof parsed.audienceApp === 'string'
|
||||
? { userId: parsed.userId, audienceApp: parsed.audienceApp }
|
||||
: null
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
|
||||
const parseStoredEmailVerification = (value: string): { email: string; code: string } | null => {
|
||||
try {
|
||||
const parsed = JSON.parse(value)
|
||||
return typeof parsed.email === 'string' && typeof parsed.code === 'string'
|
||||
? { email: parsed.email, code: parsed.code }
|
||||
: null
|
||||
} catch {
|
||||
return null
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user