101 lines
2.8 KiB
TypeScript
101 lines
2.8 KiB
TypeScript
|
/**
|
|||
|
|
* AuthService – Registration, Login, Session Management
|
|||
|
|
*/
|
|||
|
|
import bcrypt from 'bcrypt';
|
|||
|
|
import { randomUUID } from 'crypto';
|
|||
|
|
import type { DatabaseInterface, DBUser } from '../database/DatabaseInterface.js';
|
|||
|
|
|
|||
|
|
const SALT_ROUNDS = 10;
|
|||
|
|
const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
|
|||
|
|
|
|||
|
|
export interface Session {
|
|||
|
|
token: string;
|
|||
|
|
userId: string;
|
|||
|
|
expiresAt: number;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
export interface AuthResult {
|
|||
|
|
user: Omit<DBUser, 'password_hash'>;
|
|||
|
|
session: Session;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
export class AuthService {
|
|||
|
|
private sessions = new Map<string, Session>();
|
|||
|
|
|
|||
|
|
constructor(private db: DatabaseInterface) {}
|
|||
|
|
|
|||
|
|
async register(email: string, password: string, name: string, role: string = 'planer'): Promise<AuthResult> {
|
|||
|
|
const existing = this.db.getUserByEmail(email);
|
|||
|
|
if (existing) {
|
|||
|
|
throw new Error('Email already registered');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
const password_hash = await bcrypt.hash(password, SALT_ROUNDS);
|
|||
|
|
const user = this.db.createUser({ email, password_hash, name, role });
|
|||
|
|
const session = this.createSession(user.id);
|
|||
|
|
return { user: this.sanitizeUser(user), session };
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
async login(email: string, password: string): Promise<AuthResult> {
|
|||
|
|
const user = this.db.getUserByEmail(email);
|
|||
|
|
if (!user) {
|
|||
|
|
throw new Error('Invalid credentials');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
const valid = await bcrypt.compare(password, user.password_hash);
|
|||
|
|
if (!valid) {
|
|||
|
|
throw new Error('Invalid credentials');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
const session = this.createSession(user.id);
|
|||
|
|
return { user: this.sanitizeUser(user), session };
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
async changePassword(userId: string, oldPassword: string, newPassword: string): Promise<void> {
|
|||
|
|
const user = this.db.getUser(userId);
|
|||
|
|
if (!user) throw new Error('User not found');
|
|||
|
|
|
|||
|
|
const valid = await bcrypt.compare(oldPassword, user.password_hash);
|
|||
|
|
if (!valid) throw new Error('Invalid current password');
|
|||
|
|
|
|||
|
|
const password_hash = await bcrypt.hash(newPassword, SALT_ROUNDS);
|
|||
|
|
this.db.updateUser(userId, { password_hash });
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
createSession(userId: string): Session {
|
|||
|
|
const token = randomUUID();
|
|||
|
|
const session: Session = {
|
|||
|
|
token,
|
|||
|
|
userId,
|
|||
|
|
expiresAt: Date.now() + SESSION_TTL_MS,
|
|||
|
|
};
|
|||
|
|
this.sessions.set(token, session);
|
|||
|
|
return session;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
validateSession(token: string): Session | null {
|
|||
|
|
const session = this.sessions.get(token);
|
|||
|
|
if (!session) return null;
|
|||
|
|
if (Date.now() > session.expiresAt) {
|
|||
|
|
this.sessions.delete(token);
|
|||
|
|
return null;
|
|||
|
|
}
|
|||
|
|
return session;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
destroySession(token: string): void {
|
|||
|
|
this.sessions.delete(token);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
getUserFromSession(token: string): DBUser | null {
|
|||
|
|
const session = this.validateSession(token);
|
|||
|
|
if (!session) return null;
|
|||
|
|
return this.db.getUser(session.userId);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
private sanitizeUser(user: DBUser): Omit<DBUser, 'password_hash'> {
|
|||
|
|
const { password_hash, ...safe } = user;
|
|||
|
|
return safe;
|
|||
|
|
}
|
|||
|
|
}
|