Claude
31b31c3a17
Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).
Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
(create/validate/partial-TOTP/revoke), session.middleware.js
(attachSession/requireAuth/requireRole). utils/auth.js is now a thin
compat facade so existing imports are unchanged.
Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
long-lived refresh token, stored hashed and rotated on use, in a new
mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
TOTP. token.signToken gains a backward-compatible expiresIn option.
Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
identities are never auto-provisioned. Client secrets encrypted at rest
(AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
account linking (/admin/account/identities). New auth_providers +
user_identities tables.
Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
graceful with zero providers). New Authentication admin view
(Local/Google/Discord/Custom). Account page linked-accounts section.
Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.7 KiB
JavaScript
37 lines
1.7 KiB
JavaScript
// ── Auth compatibility facade ──────────────────────────────────────────────
|
|
//
|
|
// The auth logic now lives in server/src/auth/ (token primitives, the session
|
|
// service, and session middleware). This module stays as a thin facade so every
|
|
// existing import site (auth.routes, admin.routes, siteMode, auth.controller)
|
|
// keeps working with the exact same names and behavior — nothing else in the
|
|
// codebase needs to change. New code should prefer requiring ../auth/* directly.
|
|
|
|
const token = require('../auth/token')
|
|
const sessionService = require('../auth/session.service')
|
|
const { requireAuth, requireRole } = require('../auth/session.middleware')
|
|
|
|
// Non-rejecting identity check. Returns the decoded token payload (with `.id`)
|
|
// or null — same shape callers relied on (siteMode only truthiness-checks it).
|
|
// Backed by the session service so there is a single validation path.
|
|
function getUserFromRequest(req) {
|
|
const session = sessionService.validateSession(req)
|
|
if (!session) return null
|
|
// Preserve the historical payload shape (id/username/role) for callers.
|
|
return { id: session.userId, username: session.username, role: session.role }
|
|
}
|
|
|
|
module.exports = {
|
|
COOKIE_NAME: token.COOKIE_NAME,
|
|
// Token primitives (re-exported from auth/token.js).
|
|
signToken: token.signToken,
|
|
verifyToken: token.verifyToken,
|
|
signTotpChallenge: token.signTotpChallenge,
|
|
verifyTotpChallenge: token.verifyTotpChallenge,
|
|
setAuthCookie: token.setAuthCookie,
|
|
clearAuthCookie: token.clearAuthCookie,
|
|
// Request helpers / middleware.
|
|
getUserFromRequest,
|
|
isLoggedIn: requireAuth, // old name → new middleware, identical behavior
|
|
requireRole,
|
|
}
|