first commit
This commit is contained in:
293
server/module.ts
Normal file
293
server/module.ts
Normal file
@@ -0,0 +1,293 @@
|
||||
import { ExpressAuth } from "@auth/express";
|
||||
import Credentials from "@auth/express/providers/credentials";
|
||||
import Google from "@auth/express/providers/google";
|
||||
import Slack from "@auth/express/providers/slack";
|
||||
import { PrismaAdapter } from "@auth/prisma-adapter";
|
||||
import type { Request, RequestHandler } from "express";
|
||||
import { z } from "zod";
|
||||
|
||||
type CredentialUser = {
|
||||
id: string;
|
||||
name: string | null;
|
||||
email: string | null;
|
||||
image?: string | null;
|
||||
passwordHash: string | null;
|
||||
};
|
||||
|
||||
type CreateAuthModuleOptions<TAuthUser> = {
|
||||
prisma: any;
|
||||
clientUrl: string;
|
||||
sessionCookieName: string;
|
||||
sessionCookieSecure: boolean;
|
||||
authUrl?: string;
|
||||
authDebug?: boolean;
|
||||
authSecret?: string;
|
||||
trustHost?: boolean;
|
||||
extraSessionCookieNames?: string[];
|
||||
signInPath?: string;
|
||||
authenticatedRedirectPath?: string;
|
||||
googleClientId?: string;
|
||||
googleClientSecret?: string;
|
||||
slackClientId?: string;
|
||||
slackClientSecret?: string;
|
||||
findCredentialsUserByEmail: (email: string) => Promise<CredentialUser | null>;
|
||||
comparePassword: (password: string, passwordHash: string) => Promise<boolean>;
|
||||
sessionUserSelect: Record<string, boolean>;
|
||||
mapSessionUser: (user: any) => TAuthUser;
|
||||
onSessionValidated?: (user: TAuthUser) => Promise<void> | void;
|
||||
};
|
||||
|
||||
function parseBoolean(value: string | undefined, fallback: boolean): boolean {
|
||||
if (value === undefined) {
|
||||
return fallback;
|
||||
}
|
||||
const normalized = value.trim().toLowerCase();
|
||||
if (["1", "true", "yes", "on"].includes(normalized)) {
|
||||
return true;
|
||||
}
|
||||
if (["0", "false", "no", "off"].includes(normalized)) {
|
||||
return false;
|
||||
}
|
||||
return fallback;
|
||||
}
|
||||
|
||||
export function createAuthModule<TAuthUser>(options: CreateAuthModuleOptions<TAuthUser>) {
|
||||
const signInPath = options.signInPath ?? "/login";
|
||||
const authenticatedRedirectPath = options.authenticatedRedirectPath ?? "/chat";
|
||||
const googleAuthEnabled = Boolean(options.googleClientId && options.googleClientSecret);
|
||||
const slackAuthEnabled = Boolean(options.slackClientId && options.slackClientSecret);
|
||||
|
||||
const providers: any[] = [
|
||||
Credentials({
|
||||
name: "Email et mot de passe",
|
||||
credentials: {
|
||||
email: { label: "Email", type: "email" },
|
||||
password: { label: "Password", type: "password" }
|
||||
},
|
||||
authorize: async (rawCredentials) => {
|
||||
const parsed = z
|
||||
.object({
|
||||
email: z.string().email(),
|
||||
password: z.string().min(8)
|
||||
})
|
||||
.safeParse(rawCredentials);
|
||||
|
||||
if (!parsed.success) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const user = await options.findCredentialsUserByEmail(parsed.data.email);
|
||||
if (!user?.passwordHash) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const valid = await options.comparePassword(parsed.data.password, user.passwordHash);
|
||||
if (!valid) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
name: user.name,
|
||||
email: user.email,
|
||||
image: user.image ?? null
|
||||
};
|
||||
}
|
||||
})
|
||||
];
|
||||
|
||||
if (googleAuthEnabled) {
|
||||
providers.push(
|
||||
Google({
|
||||
clientId: options.googleClientId!,
|
||||
clientSecret: options.googleClientSecret!,
|
||||
allowDangerousEmailAccountLinking: true
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
if (slackAuthEnabled) {
|
||||
providers.push(
|
||||
Slack({
|
||||
clientId: options.slackClientId!,
|
||||
clientSecret: options.slackClientSecret!,
|
||||
allowDangerousEmailAccountLinking: true
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
const authConfig = {
|
||||
adapter: PrismaAdapter(options.prisma),
|
||||
trustHost: options.trustHost ?? parseBoolean(process.env.AUTH_TRUST_HOST, true),
|
||||
debug: options.authDebug ?? parseBoolean(process.env.AUTH_DEBUG, false),
|
||||
logger: options.authDebug
|
||||
? {
|
||||
error(error: Error) {
|
||||
console.error("[authjs:error]", error.name, error.message, error.cause ?? "");
|
||||
},
|
||||
warn(code: string) {
|
||||
console.warn("[authjs:warn]", code);
|
||||
},
|
||||
debug(message: string, metadata?: unknown) {
|
||||
console.log("[authjs:debug]", message, metadata ?? "");
|
||||
}
|
||||
}
|
||||
: undefined,
|
||||
session: { strategy: "database" as const },
|
||||
secret: options.authSecret ?? process.env.AUTH_SECRET,
|
||||
cookies: {
|
||||
sessionToken: {
|
||||
name: options.sessionCookieName,
|
||||
options: {
|
||||
httpOnly: true,
|
||||
sameSite: "lax" as const,
|
||||
path: "/",
|
||||
secure: options.sessionCookieSecure
|
||||
}
|
||||
}
|
||||
},
|
||||
providers,
|
||||
pages: {
|
||||
signIn: signInPath
|
||||
},
|
||||
callbacks: {
|
||||
redirect: async ({ url, baseUrl }: { url: string; baseUrl: string }) => {
|
||||
const clientOrigin = new URL(options.clientUrl).origin;
|
||||
const successUrl = new URL(authenticatedRedirectPath, clientOrigin).toString();
|
||||
|
||||
const shouldForceChat = (pathname: string, searchParams: URLSearchParams): boolean => {
|
||||
if (pathname !== "/" && pathname !== signInPath) {
|
||||
return false;
|
||||
}
|
||||
return !searchParams.has("error");
|
||||
};
|
||||
|
||||
if (url.startsWith("/")) {
|
||||
const relative = new URL(url, clientOrigin);
|
||||
if (shouldForceChat(relative.pathname, relative.searchParams)) {
|
||||
return successUrl;
|
||||
}
|
||||
return `${clientOrigin}${relative.pathname}${relative.search}${relative.hash}`;
|
||||
}
|
||||
|
||||
try {
|
||||
const target = new URL(url);
|
||||
const base = new URL(baseUrl);
|
||||
|
||||
if (target.origin === clientOrigin) {
|
||||
if (shouldForceChat(target.pathname, target.searchParams)) {
|
||||
return successUrl;
|
||||
}
|
||||
return target.toString();
|
||||
}
|
||||
|
||||
if (target.origin === base.origin) {
|
||||
if (shouldForceChat(target.pathname, target.searchParams)) {
|
||||
return successUrl;
|
||||
}
|
||||
return `${clientOrigin}${target.pathname}${target.search}${target.hash}`;
|
||||
}
|
||||
} catch {
|
||||
return successUrl;
|
||||
}
|
||||
|
||||
return successUrl;
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
const authHandler = ExpressAuth(authConfig);
|
||||
|
||||
const requireSession: RequestHandler = async (req, res, next) => {
|
||||
const token = extractSessionToken(req.headers.cookie);
|
||||
const authDebug = options.authDebug ?? parseBoolean(process.env.AUTH_DEBUG, false);
|
||||
|
||||
if (!token) {
|
||||
const payload: { error: string; reason?: string } = { error: "Unauthorized" };
|
||||
if (authDebug) {
|
||||
payload.reason = "missing_session_cookie";
|
||||
}
|
||||
return res.status(401).json(payload);
|
||||
}
|
||||
|
||||
const session = await options.prisma.session.findUnique({
|
||||
where: { sessionToken: token },
|
||||
include: {
|
||||
user: {
|
||||
select: options.sessionUserSelect
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
if (!session || session.expires <= new Date()) {
|
||||
const payload: { error: string; reason?: string } = { error: "Unauthorized" };
|
||||
if (authDebug) {
|
||||
payload.reason = !session ? "session_not_found" : "session_expired";
|
||||
}
|
||||
return res.status(401).json(payload);
|
||||
}
|
||||
|
||||
const authUser = options.mapSessionUser(session.user);
|
||||
(req as Request & { authUser?: TAuthUser }).authUser = authUser;
|
||||
await options.onSessionValidated?.(authUser);
|
||||
next();
|
||||
};
|
||||
|
||||
const extractSessionToken = (cookieHeader: string | undefined): string | null => {
|
||||
if (!cookieHeader) {
|
||||
return null;
|
||||
}
|
||||
|
||||
const cookies = cookieHeader
|
||||
.split(";")
|
||||
.map((part) => part.trim())
|
||||
.map((part) => {
|
||||
const index = part.indexOf("=");
|
||||
if (index < 0) {
|
||||
return null;
|
||||
}
|
||||
return [part.slice(0, index), decodeURIComponent(part.slice(index + 1))] as const;
|
||||
})
|
||||
.filter((entry): entry is readonly [string, string] => entry !== null);
|
||||
|
||||
const possibleNames = [
|
||||
options.sessionCookieName,
|
||||
...(options.extraSessionCookieNames ?? []),
|
||||
"__Secure-authjs.session-token",
|
||||
"authjs.session-token",
|
||||
"__Secure-next-auth.session-token",
|
||||
"next-auth.session-token"
|
||||
];
|
||||
|
||||
for (const name of possibleNames) {
|
||||
const exact = cookies.find(([cookieName]) => cookieName === name);
|
||||
if (exact) {
|
||||
return exact[1];
|
||||
}
|
||||
|
||||
const chunks = cookies
|
||||
.filter(([cookieName]) => cookieName.startsWith(`${name}.`))
|
||||
.map(([cookieName, value]) => {
|
||||
const suffix = cookieName.slice(name.length + 1);
|
||||
return [Number.parseInt(suffix, 10), value] as const;
|
||||
})
|
||||
.filter(([index]) => Number.isInteger(index))
|
||||
.sort((left, right) => left[0] - right[0]);
|
||||
|
||||
if (chunks.length > 0) {
|
||||
return chunks.map(([, value]) => value).join("");
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
};
|
||||
|
||||
return {
|
||||
authConfig,
|
||||
authHandler,
|
||||
requireSession,
|
||||
extractSessionToken,
|
||||
googleAuthEnabled,
|
||||
slackAuthEnabled
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user