auth.controller.ts

import {
    Body,
    Controller,
    Delete,
    Get,
    HttpCode,
    Param,
    Patch,
    Post,
    Req,
    Res,
} from '@nestjs/common'
import { Throttle } from '@nestjs/throttler'
import type { Request, Response } from 'express'
import {
    AUTH_ACTION,
    accountParametersSchema,
    registerAuthenticationSchema,
    loginAuthenticationSchema,
    accountAuthenticationVerifySchema,
    accountAuthenticationChangeSchema,
    type RegisterAuthentication,
    type LoginAuthentication,
    type AccountAuthenticationVerify,
    type AccountAuthenticationChange,
    type User,
} from '@vault/contracts'
import { ValidationPipe } from '@api/checks/validation.pipe'
import {
    profileSchema,
    loginOptionsSchema,
    authenticationVerifySchema,
    registrationVerifySchema,
    emptySchema,
    type ProfileInput,
    type AuthenticationInput,
    type RegistrationInput,
} from '@api/checks/passkey.checks'
import { Configuration } from '@api/common/config'
import { ROUTE, SECURITY } from '@api/common/constants'
import { respond } from '@api/utilities/response.utility'
import {
    cookieOptions,
    newSessionToken,
    requestCookie as cookie,
} from '@api/utilities/session.utility'
import { AuthService } from './auth.service'
import { PasswordService } from './password.service'
import { CurrentUser, PassiveSession, Public } from './auth.decorators'

@Controller(ROUTE.auth)
class AuthController {
    constructor(
        private readonly service: AuthService,
        private readonly configuration: Configuration,
        private readonly passwords: PasswordService,
    ) {}

    @Public()
    @HttpCode(200)
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('password/parameters')
    async passwordParameters(
        @Body(new ValidationPipe(accountParametersSchema)) input: { email: string },
    ) {
        return respond(await this.passwords.parameters(input.email))
    }

    @Public()
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post(AUTH_ACTION.register)
    async passwordRegister(
        @Body(new ValidationPipe(registerAuthenticationSchema)) input: RegisterAuthentication,
        @Res({ passthrough: true }) response: Response,
    ) {
        const result = await this.passwords.register(input)
        this.session(response, result.token)
        return respond(result.user)
    }

    @Public()
    @HttpCode(200)
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post(AUTH_ACTION.login)
    async passwordLogin(
        @Body(new ValidationPipe(loginAuthenticationSchema)) input: LoginAuthentication,
        @Res({ passthrough: true }) response: Response,
    ) {
        const result = await this.passwords.login(input)
        this.session(response, result.token)
        return respond(result.user)
    }

    @Get('methods')
    async methods(@CurrentUser() user: User) {
        return respond(await this.passwords.methods(user.id))
    }

    @HttpCode(200)
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('password/verify')
    async passwordVerify(
        @CurrentUser() user: User,
        @Body(new ValidationPipe(accountAuthenticationVerifySchema))
        input: AccountAuthenticationVerify,
        @Req() request: Request,
    ) {
        await this.passwords.verify(
            user.id,
            cookie(request, SECURITY.sessionCookie),
            input.credential,
        )
        return respond(null)
    }

    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Patch('password')
    async passwordChange(
        @CurrentUser() user: User,
        @Body(new ValidationPipe(accountAuthenticationChangeSchema))
        input: AccountAuthenticationChange,
        @Req() request: Request,
    ) {
        return respond(
            await this.passwords.change(user, cookie(request, SECURITY.sessionCookie), input),
        )
    }

    @Public()
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('login/options')
    async loginOptions(
        @Body(new ValidationPipe(loginOptionsSchema)) input: { email: string },
        @Res({ passthrough: true }) response: Response,
    ) {
        return respond(await this.service.loginOptions(input.email, this.flow(response)))
    }

    @Public()
    @HttpCode(200)
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('login/verify')
    async login(
        @Body(new ValidationPipe(authenticationVerifySchema)) input: AuthenticationInput,
        @Req() request: Request,
        @Res({ passthrough: true }) response: Response,
    ) {
        const result = await this.service.login(input, cookie(request, SECURITY.flowCookie))
        this.session(response, result.token)
        return respond(result.user)
    }

    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('passkeys/options')
    async addOptions(
        @CurrentUser() user: User,
        @Req() request: Request,
        @Res({ passthrough: true }) response: Response,
    ) {
        await new ValidationPipe(emptySchema).transform(request.body)
        return respond(
            await this.service.addOptions(
                user,
                cookie(request, SECURITY.sessionCookie),
                this.flow(response),
            ),
        )
    }

    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('passkeys/verify')
    async add(
        @CurrentUser() user: User,
        @Body(new ValidationPipe(registrationVerifySchema)) input: RegistrationInput,
        @Req() request: Request,
    ) {
        await this.service.add(
            user,
            cookie(request, SECURITY.sessionCookie),
            input,
            cookie(request, SECURITY.flowCookie),
        )
        return respond(null)
    }

    @Get('passkeys')
    async passkeys(@CurrentUser() user: User) {
        return respond(await this.service.listPasskeys(user.id))
    }

    @HttpCode(200)
    @Delete('passkeys/:id')
    async remove(@CurrentUser() user: User, @Param('id') id: string, @Req() request: Request) {
        await this.service.removePasskey(user.id, cookie(request, SECURITY.sessionCookie), id)
        return respond(null)
    }

    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('reauth/options')
    async reauthOptions(
        @CurrentUser() user: User,
        @Req() request: Request,
        @Res({ passthrough: true }) response: Response,
    ) {
        await new ValidationPipe(emptySchema).transform(request.body)
        return respond(
            await this.service.reauthOptions(
                user,
                cookie(request, SECURITY.sessionCookie),
                this.flow(response),
            ),
        )
    }

    @HttpCode(200)
    @Throttle({ default: { limit: SECURITY.authLimit, ttl: SECURITY.rateWindowMs } })
    @Post('reauth/verify')
    async reauth(
        @CurrentUser() user: User,
        @Body(new ValidationPipe(authenticationVerifySchema)) input: AuthenticationInput,
        @Req() request: Request,
    ) {
        await this.service.reauth(
            user,
            cookie(request, SECURITY.sessionCookie),
            input,
            cookie(request, SECURITY.flowCookie),
        )
        return respond(null)
    }

    @Get(AUTH_ACTION.me)
    @PassiveSession()
    me(@CurrentUser() user: User) {
        return respond(user)
    }

    @Patch(AUTH_ACTION.me)
    async updateProfile(
        @CurrentUser() user: User,
        @Body(new ValidationPipe(profileSchema)) input: ProfileInput,
        @Req() request: Request,
    ) {
        return respond(
            await this.service.updateProfile(
                user.id,
                cookie(request, SECURITY.sessionCookie),
                input,
            ),
        )
    }

    @HttpCode(200)
    @Post(AUTH_ACTION.logout)
    async logout(@Req() request: Request, @Res({ passthrough: true }) response: Response) {
        await this.service.logout(cookie(request, SECURITY.sessionCookie))
        response.clearCookie(
            SECURITY.sessionCookie,
            cookieOptions(this.configuration.values.NODE_ENV),
        )
        response.clearCookie(SECURITY.flowCookie, cookieOptions(this.configuration.values.NODE_ENV))
        return respond(null)
    }

    private flow(response: Response): string {
        const binding = newSessionToken()
        response.cookie(
            SECURITY.flowCookie,
            binding,
            cookieOptions(this.configuration.values.NODE_ENV, SECURITY.challengeMs),
        )
        return binding
    }

    private session(response: Response, token: string): void {
        response.cookie(
            SECURITY.sessionCookie,
            token,
            cookieOptions(this.configuration.values.NODE_ENV),
        )
        response.clearCookie(SECURITY.flowCookie, cookieOptions(this.configuration.values.NODE_ENV))
    }
}

export { AuthController }