mirror of
https://github.com/shishantbiswas/bknd.git
synced 2026-03-15 20:17:22 +00:00
Release 0.12 (#143)
* changed tb imports * cleanup: replace console.log/warn with $console, remove commented-out code Removed various commented-out code and replaced direct `console.log` and `console.warn` usage across the codebase with `$console` from "core" for standardized logging. Also adjusted linting rules in biome.json to enable warnings for `console.log` usage. * ts: enable incremental * fix imports in test files reorganize imports to use "@sinclair/typebox" directly, replacing local utility references, and add missing "override" keywords in test classes. * added media permissions (#142) * added permissions support for media module introduced `MediaPermissions` for fine-grained access control in the media module, updated routes to enforce these permissions, and adjusted permission registration logic. * fix: handle token absence in getUploadHeaders and add tests for transport modes ensure getUploadHeaders does not set Authorization header when token is missing. Add unit tests to validate behavior for different token_transport options. * remove console.log on DropzoneContainer.tsx Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * add bcrypt and refactored auth resolve (#147) * reworked auth architecture with improved password handling and claims Refactored password strategy to prepare supporting bcrypt, improving hashing/encryption flexibility. Updated authentication flow with enhanced user resolution mechanisms, safe JWT generation, and consistent profile handling. Adjusted dependencies to include bcryptjs and updated lock files accordingly. * fix strategy forms handling, add register route and hidden fields Refactored strategy forms to include hidden fields for type and name. Added a registration route with necessary adjustments to the admin controller and routes. Corrected field handling within relevant forms and components. * refactored auth handling to support bcrypt, extracted user pool * update email regex to allow '+' and '_' characters * update test stub password for AppAuth spec * update data exceptions to use HttpStatus constants, adjust logging level in AppUserPool * rework strategies to extend a base class instead of interface * added simple bcrypt test * add validation logs and improve data validation handling (#157) Added warning logs for invalid data during mutator validation, refined field validation logic to handle undefined values, and adjusted event validation comments for clarity. Minor improvements include exporting events from core and handling optional chaining in entity field validation. * modify MediaApi to support custom fetch implementation, defaults to native fetch (#158) * modify MediaApi to support custom fetch implementation, defaults to native fetch added an optional `fetcher` parameter to allow usage of a custom fetch function in both `upload` and `fetcher` methods. Defaults to the standard `fetch` if none is provided. * fix tests and improve api fetcher types * update admin basepath handling and window context integration (#155) Refactored `useBkndWindowContext` to include `admin_basepath` and updated its usage in routing. Improved type consistency with `AdminBkndWindowContext` and ensured default values are applied for window context. * trigger `repository-find-[one|many]-[before|after]` based on `limit` (#160) * refactor error handling in authenticator and password strategy (#161) made `respondWithError` method public, updated login and register routes in `PasswordStrategy` to handle errors using `respondWithError` for consistency. * add disableSubmitOnError prop to NativeForm and export getFlashMessage (#162) Introduced a `disableSubmitOnError` prop to NativeForm to control submit button behavior when errors are present. Also exported `getFlashMessage` from the core for external usage. * update dependencies in package.json (#156) moved several dependencies between devDependencies and dependencies for better categorization and removed redundant entries. * update imports to adjust nodeTestRunner path and remove unused export (#163) updated imports in test files to reflect the correct path for nodeTestRunner. removed redundant export of nodeTestRunner from index file to clean up module structure. In some environments this could cause issues requiring to exclude `node:test`, just removing it for now. * fix sync events not awaited (#164) * refactor(dropzone): extract DropzoneInner and unify state management with zustand (#165) Simplified Dropzone implementation by extracting inner logic to a new component, `DropzoneInner`. Replaced local dropzone state logic with centralized state management using zustand. Adjusted API exports and props accordingly for consistency and maintainability. * replace LiquidJs rendering with simplified renderer (#167) * replace LiquidJs rendering with simplified renderer Removed dependency on LiquidJS and replaced it with a custom templating solution using lodash `get`. Updated corresponding components, editors, and tests to align with the new rendering approach. Removed unused filters and tags. * remove liquid js from package json * feat/cli-generate-types (#166) * init types generation * update type generation for entities and fields Refactored `EntityTypescript` to support improved field types and relations. Added `toType` method overrides for various fields to define accurate TypeScript types. Enhanced CLI `types` command with new options for output style and file handling. Removed redundant test files. * update type generation code and CLI option description removed unused imports definition, adjusted formatting in EntityTypescript, and clarified the CLI style option description. * fix json schema field type generation * reworked system entities to prevent recursive types * reworked system entities to prevent recursive types * remove unused object function * types: use number instead of Generated * update data hooks and api types * update data hooks and api types * update data hooks and api types * update data hooks and api types --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
dswbx
@@ -1,13 +1,12 @@
|
||||
import { type DB, Exception, type PrimaryFieldType } from "core";
|
||||
import { $console, type DB, Exception } from "core";
|
||||
import { addFlashMessage } from "core/server/flash";
|
||||
import {
|
||||
type Static,
|
||||
StringEnum,
|
||||
type TObject,
|
||||
Type,
|
||||
parse,
|
||||
runtimeSupports,
|
||||
transformObject,
|
||||
truncate,
|
||||
} from "core/utils";
|
||||
import type { Context, Hono } from "hono";
|
||||
import { deleteCookie, getSignedCookie, setSignedCookie } from "hono/cookie";
|
||||
@@ -15,6 +14,9 @@ import { sign, verify } from "hono/jwt";
|
||||
import type { CookieOptions } from "hono/utils/cookie";
|
||||
import type { ServerEnv } from "modules/Controller";
|
||||
import { pick } from "lodash-es";
|
||||
import * as tbbox from "@sinclair/typebox";
|
||||
import { InvalidConditionsException } from "auth/errors";
|
||||
const { Type } = tbbox;
|
||||
|
||||
type Input = any; // workaround
|
||||
export type JWTPayload = Parameters<typeof sign>[0];
|
||||
@@ -23,11 +25,12 @@ export const strategyActions = ["create", "change"] as const;
|
||||
export type StrategyActionName = (typeof strategyActions)[number];
|
||||
export type StrategyAction<S extends TObject = TObject> = {
|
||||
schema: S;
|
||||
preprocess: (input: unknown) => Promise<Omit<DB["users"], "id" | "strategy">>;
|
||||
preprocess: (input: Static<S>) => Promise<Omit<DB["users"], "id" | "strategy">>;
|
||||
};
|
||||
export type StrategyActions = Partial<Record<StrategyActionName, StrategyAction>>;
|
||||
|
||||
// @todo: add schema to interface to ensure proper inference
|
||||
// @todo: add tests (e.g. invalid strategy_value)
|
||||
export interface Strategy {
|
||||
getController: (auth: Authenticator) => Hono<any>;
|
||||
getType: () => string;
|
||||
@@ -37,28 +40,22 @@ export interface Strategy {
|
||||
getActions?: () => StrategyActions;
|
||||
}
|
||||
|
||||
export type User = {
|
||||
id: PrimaryFieldType;
|
||||
email: string;
|
||||
password: string;
|
||||
role?: string | null;
|
||||
};
|
||||
export type User = DB["users"];
|
||||
|
||||
export type ProfileExchange = {
|
||||
email?: string;
|
||||
username?: string;
|
||||
sub?: string;
|
||||
password?: string;
|
||||
strategy?: string;
|
||||
strategy_value?: string;
|
||||
[key: string]: any;
|
||||
};
|
||||
|
||||
export type SafeUser = Omit<User, "password">;
|
||||
export type SafeUser = Omit<User, "strategy_value">;
|
||||
export type CreateUser = Pick<User, "email"> & { [key: string]: any };
|
||||
export type AuthResponse = { user: SafeUser; token: string };
|
||||
|
||||
export interface UserPool<Fields = "id" | "email" | "username"> {
|
||||
findBy: (prop: Fields, value: string | number) => Promise<User | undefined>;
|
||||
create: (user: CreateUser) => Promise<User | undefined>;
|
||||
export interface UserPool {
|
||||
findBy: (strategy: string, prop: keyof SafeUser, value: string | number) => Promise<User>;
|
||||
create: (strategy: string, user: CreateUser) => Promise<User>;
|
||||
}
|
||||
|
||||
const defaultCookieExpires = 60 * 60 * 24 * 7; // 1 week in seconds
|
||||
@@ -100,12 +97,17 @@ export const authenticatorConfig = Type.Object({
|
||||
|
||||
type AuthConfig = Static<typeof authenticatorConfig>;
|
||||
export type AuthAction = "login" | "register";
|
||||
export type AuthResolveOptions = {
|
||||
identifier?: "email" | string;
|
||||
redirect?: string;
|
||||
forceJsonResponse?: boolean;
|
||||
};
|
||||
export type AuthUserResolver = (
|
||||
action: AuthAction,
|
||||
strategy: Strategy,
|
||||
identifier: string,
|
||||
profile: ProfileExchange,
|
||||
) => Promise<SafeUser | undefined>;
|
||||
opts?: AuthResolveOptions,
|
||||
) => Promise<ProfileExchange | undefined>;
|
||||
type AuthClaims = SafeUser & {
|
||||
iat: number;
|
||||
iss?: string;
|
||||
@@ -113,33 +115,117 @@ type AuthClaims = SafeUser & {
|
||||
};
|
||||
|
||||
export class Authenticator<Strategies extends Record<string, Strategy> = Record<string, Strategy>> {
|
||||
private readonly strategies: Strategies;
|
||||
private readonly config: AuthConfig;
|
||||
private readonly userResolver: AuthUserResolver;
|
||||
|
||||
constructor(strategies: Strategies, userResolver?: AuthUserResolver, config?: AuthConfig) {
|
||||
this.userResolver = userResolver ?? (async (a, s, i, p) => p as any);
|
||||
this.strategies = strategies as Strategies;
|
||||
constructor(
|
||||
private readonly strategies: Strategies,
|
||||
private readonly userPool: UserPool,
|
||||
config?: AuthConfig,
|
||||
) {
|
||||
this.config = parse(authenticatorConfig, config ?? {});
|
||||
}
|
||||
|
||||
async resolve(
|
||||
action: AuthAction,
|
||||
async resolveLogin(
|
||||
c: Context,
|
||||
strategy: Strategy,
|
||||
identifier: string,
|
||||
profile: ProfileExchange,
|
||||
): Promise<AuthResponse> {
|
||||
//console.log("resolve", { action, strategy: strategy.getName(), profile });
|
||||
const user = await this.userResolver(action, strategy, identifier, profile);
|
||||
profile: Partial<SafeUser>,
|
||||
verify: (user: User) => Promise<void>,
|
||||
opts?: AuthResolveOptions,
|
||||
) {
|
||||
try {
|
||||
// @todo: centralize identifier and checks
|
||||
// @todo: check identifier value (if allowed)
|
||||
const identifier = opts?.identifier || "email";
|
||||
if (typeof identifier !== "string" || identifier.length === 0) {
|
||||
throw new InvalidConditionsException("Identifier must be a string");
|
||||
}
|
||||
if (!(identifier in profile)) {
|
||||
throw new InvalidConditionsException(`Profile must have identifier "${identifier}"`);
|
||||
}
|
||||
|
||||
if (user) {
|
||||
return {
|
||||
user,
|
||||
token: await this.jwt(user),
|
||||
};
|
||||
const user = await this.userPool.findBy(
|
||||
strategy.getName(),
|
||||
identifier as any,
|
||||
profile[identifier],
|
||||
);
|
||||
|
||||
if (!user.strategy_value) {
|
||||
throw new InvalidConditionsException("User must have a strategy value");
|
||||
} else if (user.strategy !== strategy.getName()) {
|
||||
throw new InvalidConditionsException("User signed up with a different strategy");
|
||||
}
|
||||
|
||||
await verify(user);
|
||||
const data = await this.safeAuthResponse(user);
|
||||
return this.respondWithUser(c, data, opts);
|
||||
} catch (e) {
|
||||
return this.respondWithError(c, e as Error, opts);
|
||||
}
|
||||
}
|
||||
|
||||
async resolveRegister(
|
||||
c: Context,
|
||||
strategy: Strategy,
|
||||
profile: CreateUser,
|
||||
verify: (user: User) => Promise<void>,
|
||||
opts?: AuthResolveOptions,
|
||||
) {
|
||||
try {
|
||||
const identifier = opts?.identifier || "email";
|
||||
if (typeof identifier !== "string" || identifier.length === 0) {
|
||||
throw new InvalidConditionsException("Identifier must be a string");
|
||||
}
|
||||
if (!(identifier in profile)) {
|
||||
throw new InvalidConditionsException(`Profile must have identifier "${identifier}"`);
|
||||
}
|
||||
if (!("strategy_value" in profile)) {
|
||||
throw new InvalidConditionsException("Profile must have a strategy value");
|
||||
}
|
||||
|
||||
const user = await this.userPool.create(strategy.getName(), {
|
||||
...profile,
|
||||
strategy_value: profile.strategy_value,
|
||||
});
|
||||
|
||||
await verify(user);
|
||||
const data = await this.safeAuthResponse(user);
|
||||
return this.respondWithUser(c, data, opts);
|
||||
} catch (e) {
|
||||
return this.respondWithError(c, e as Error, opts);
|
||||
}
|
||||
}
|
||||
|
||||
private async respondWithUser(c: Context, data: AuthResponse, opts?: AuthResolveOptions) {
|
||||
const successUrl = this.getSafeUrl(
|
||||
c,
|
||||
opts?.redirect ?? this.config.cookie.pathSuccess ?? "/",
|
||||
);
|
||||
|
||||
if ("token" in data) {
|
||||
await this.setAuthCookie(c, data.token);
|
||||
|
||||
if (this.isJsonRequest(c) || opts?.forceJsonResponse) {
|
||||
return c.json(data);
|
||||
}
|
||||
|
||||
// can't navigate to "/" – doesn't work on nextjs
|
||||
return c.redirect(successUrl);
|
||||
}
|
||||
|
||||
throw new Error("User could not be resolved");
|
||||
throw new Exception("Invalid response");
|
||||
}
|
||||
|
||||
async respondWithError(c: Context, error: Error, opts?: AuthResolveOptions) {
|
||||
$console.error("respondWithError", error);
|
||||
if (this.isJsonRequest(c) || opts?.forceJsonResponse) {
|
||||
// let the server handle it
|
||||
throw error;
|
||||
}
|
||||
|
||||
await addFlashMessage(c, String(error), "error");
|
||||
|
||||
const referer = this.getSafeUrl(c, opts?.redirect ?? c.req.header("Referer") ?? "/");
|
||||
return c.redirect(referer);
|
||||
}
|
||||
|
||||
getStrategies(): Strategies {
|
||||
@@ -158,7 +244,7 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
}
|
||||
|
||||
// @todo: add jwt tests
|
||||
async jwt(_user: Omit<User, "password">): Promise<string> {
|
||||
async jwt(_user: SafeUser | ProfileExchange): Promise<string> {
|
||||
const user = pick(_user, this.config.jwt.fields);
|
||||
|
||||
const payload: JWTPayload = {
|
||||
@@ -184,6 +270,14 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
return sign(payload, secret, this.config.jwt?.alg ?? "HS256");
|
||||
}
|
||||
|
||||
async safeAuthResponse(_user: User): Promise<AuthResponse> {
|
||||
const user = pick(_user, this.config.jwt.fields) as SafeUser;
|
||||
return {
|
||||
user,
|
||||
token: await this.jwt(user),
|
||||
};
|
||||
}
|
||||
|
||||
async verify(jwt: string): Promise<AuthClaims | undefined> {
|
||||
try {
|
||||
const payload = await verify(
|
||||
@@ -225,7 +319,7 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
return token;
|
||||
} catch (e: any) {
|
||||
if (e instanceof Error) {
|
||||
console.error("[Error:getAuthCookie]", e.message);
|
||||
$console.error("[getAuthCookie]", e.message);
|
||||
}
|
||||
|
||||
return undefined;
|
||||
@@ -242,11 +336,13 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
}
|
||||
|
||||
private async setAuthCookie(c: Context<ServerEnv>, token: string) {
|
||||
$console.debug("setting auth cookie", truncate(token));
|
||||
const secret = this.config.jwt.secret;
|
||||
await setSignedCookie(c, "auth", token, secret, this.cookieOptions);
|
||||
}
|
||||
|
||||
private async deleteAuthCookie(c: Context) {
|
||||
$console.debug("deleting auth cookie");
|
||||
await deleteCookie(c, "auth", this.cookieOptions);
|
||||
}
|
||||
|
||||
@@ -262,7 +358,6 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
|
||||
// @todo: move this to a server helper
|
||||
isJsonRequest(c: Context): boolean {
|
||||
//return c.req.header("Content-Type") === "application/x-www-form-urlencoded";
|
||||
return c.req.header("Content-Type") === "application/json";
|
||||
}
|
||||
|
||||
@@ -286,37 +381,6 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
return p;
|
||||
}
|
||||
|
||||
async respond(c: Context, data: AuthResponse | Error | any, redirect?: string) {
|
||||
const successUrl = this.getSafeUrl(c, redirect ?? this.config.cookie.pathSuccess ?? "/");
|
||||
const referer = redirect ?? c.req.header("Referer") ?? successUrl;
|
||||
//console.log("auth respond", { redirect, successUrl, successPath });
|
||||
|
||||
if ("token" in data) {
|
||||
await this.setAuthCookie(c, data.token);
|
||||
|
||||
if (this.isJsonRequest(c)) {
|
||||
return c.json(data);
|
||||
}
|
||||
|
||||
// can't navigate to "/" – doesn't work on nextjs
|
||||
//console.log("auth success, redirecting to", successUrl);
|
||||
return c.redirect(successUrl);
|
||||
}
|
||||
|
||||
if (this.isJsonRequest(c)) {
|
||||
return c.json(data, 400);
|
||||
}
|
||||
|
||||
let message = "An error occured";
|
||||
if (data instanceof Exception) {
|
||||
message = data.message;
|
||||
}
|
||||
|
||||
await addFlashMessage(c, message, "error");
|
||||
//console.log("auth failed, redirecting to", referer);
|
||||
return c.redirect(referer);
|
||||
}
|
||||
|
||||
// @todo: don't extract user from token, but from the database or cache
|
||||
async resolveAuthFromRequest(c: Context): Promise<SafeUser | undefined> {
|
||||
let token: string | undefined;
|
||||
@@ -341,13 +405,3 @@ export class Authenticator<Strategies extends Record<string, Strategy> = Record<
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
export function createStrategyAction<S extends TObject>(
|
||||
schema: S,
|
||||
preprocess: (input: Static<S>) => Promise<Partial<DB["users"]>>,
|
||||
) {
|
||||
return {
|
||||
schema,
|
||||
preprocess,
|
||||
} as StrategyAction<S>;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user