8601631337

Committed 08 Apr 2024 02:14PM UTC coverage: 93.095% (+0.3%) from 92.806%

Build # 8601631337

Build Type

Pull #1368

github

Committed by

iamacook

Commit Message

Move data source logic to repository

Pull Request Pull Request #1368: Add `AuthController`

Run Details

1921 of 2323 branches covered (82.69%)

Branch coverage included in aggregate %.

63 of 64 new or added lines in 8 files covered. (98.44%)

6 existing lines in 1 file now uncovered.

6640 of 6873 relevant lines covered (96.61%)

362.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

75.31

/src/domain/auth/auth.repository.ts

import { CacheRouter } from '@/datasources/cache/cache.router';
import { IAuthRepository } from '@/domain/auth/auth.repository.interface';
import { SiweMessage } from '@/domain/auth/entities/siwe-message.entity';
import { IAuthApi } from '@/domain/interfaces/auth-api.interface';
import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';
import { Request } from 'express';
import { IConfigurationService } from '@/config/configuration.service.interface';
import {
  CacheService,
  ICacheService,
} from '@/datasources/cache/cache.service.interface';
import { AuthService } from '@/routes/auth/auth.service';
import { VerifyAuthMessageDto } from '@/routes/auth/entities/schemas/verify-auth-message.dto';
import { IJwtService } from '@/datasources/jwt/jwt.service.interface';

@Injectable()
export class AuthRepository implements IAuthRepository {
  private readonly nonceTtlInSeconds: number;

  constructor(
    @Inject(IAuthApi)
    private readonly authApi: IAuthApi,
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
    @Inject(CacheService) private readonly cacheService: ICacheService,
    @Inject(IJwtService)
    private readonly jwtService: IJwtService,
  ) {
    this.nonceTtlInSeconds = this.configurationService.getOrThrow(
      'auth.nonceTtlSeconds',
    );
  }

  /**
   * Generates a unique nonce and stores it in cache for later verification.
   *
   * @returns nonce - unique string to be signed
   */
  async generateNonce(): Promise<{ nonce: string }> {
    const nonce = this.authApi.generateNonce();

    // Store nonce for reference to verify/prevent replay attacks
    const cacheDir = CacheRouter.getAuthNonceCacheDir(nonce);
    await this.cacheService.set(cacheDir, nonce, this.nonceTtlInSeconds);

    return {
      nonce,
    };
  }

  /**
   * Verifies the validity of a signed message and returns an access token:
   *
   * 1. Ensure the message itself has not expired.
   * 2. Ensure the nonce was generated by us/is not a replay attack.
   * 3. Verify the signature of the message.
   * 4. Return an access token if all checks pass.
   *
   * @param args - DTO containing the message and signature to verify.
   *
   * The following adhere to JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
   *
   * @returns accessToken - JWT access token
   * @returns tokenType - token type ('Bearer') to be used in the `Authorization` header
   * @returns notBefore - epoch from when token is valid (if applicable, otherwise null)
   * @returns expiresIn - time in seconds until the token expires (if applicable, otherwise null)
   */
  async verify(args: VerifyAuthMessageDto): Promise<{
    accessToken: string;
    tokenType: string;
    notBefore: number | null;
    expiresIn: number | null;
  }> {
    const isAuthorized = await this.isAuthorized(args).catch(() => false);

    if (!isAuthorized) {
      throw new UnauthorizedException();
    }

    const dateWhenTokenIsValid = args.message.notBefore
      ? new Date(args.message.notBefore)
      : null;
    const dateWhenTokenExpires = args.message.expirationTime
      ? new Date(args.message.expirationTime)
      : null;

    const secondsUntilTokenIsValid = dateWhenTokenIsValid
      ? this.getSecondsUntil(dateWhenTokenIsValid)
      : null;
    const secondsUntilTokenExpires = dateWhenTokenExpires
      ? this.getSecondsUntil(dateWhenTokenExpires)
      : null;

    const accessToken = this.jwtService.sign(args.message, {
      ...(secondsUntilTokenIsValid !== null && {
        notBefore: secondsUntilTokenIsValid,
      }),
      ...(secondsUntilTokenExpires !== null && {
        expiresIn: secondsUntilTokenExpires,
      }),
    });

    return {
      tokenType: AuthService.AUTH_TOKEN_TOKEN_TYPE,
      accessToken,
      // Differing measurements match JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
      notBefore: dateWhenTokenIsValid?.getTime() ?? null,
      expiresIn: secondsUntilTokenExpires,
    };
  }

  /**
   * Verifies that a message is valid according to its expiration date,
   * signature and nonce.
   *
   * @param args.message - SiWe message in object form
   * @param args.signature - signature from signing the message
   *
   * @returns boolean - whether the message is valid
   */
  private async isAuthorized(args: {
    message: SiweMessage;
    signature: `0x${string}`;
  }): Promise<boolean> {
    const isExpired =
      !!args.message.expirationTime &&
      new Date(args.message.expirationTime) < new Date();

    const isValidSignature = await this.authApi
      .verifyMessage(args)
      // Don't prevent nonce from being deleted
      .catch(() => false);

    const cacheDir = CacheRouter.getAuthNonceCacheDir(args.message.nonce);
    const cachedNonce = await this.cacheService.get(cacheDir);
    const isValidNonce = cachedNonce === args.message.nonce;

    // Delete nonce from cache to prevent replay attacks
    await this.cacheService.deleteByKey(cacheDir.key);

    return !isExpired && isValidSignature && isValidNonce;
  }

  private getSecondsUntil(date: Date): number {
    return Math.floor((date.getTime() - Date.now()) / 1_000);
  }

  /**
   * Extracts the access token from the request.
   *
   * @param request - the express request object
   * @param tokenType - the type of token used in the Authorization header
   * @returns the access token, or null if not found
   */
  getAccessToken(request: Request, tokenType: string): string | null {
    const header = request.headers.authorization;

    if (typeof header !== 'string') {
      return null;
    }

    const [type, token] = header.split(' ');

    if (type !== tokenType || !token) {
      return null;
    }

    return token;
  }
}

1	import { CacheRouter } from '@/datasources/cache/cache.router';	92✔
2	import { IAuthRepository } from '@/domain/auth/auth.repository.interface';
3	import { SiweMessage } from '@/domain/auth/entities/siwe-message.entity';
4	import { IAuthApi } from '@/domain/interfaces/auth-api.interface';	92✔
5	import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';	92✔
6	import { Request } from 'express';
7	import { IConfigurationService } from '@/config/configuration.service.interface';	92✔
8	import {	92✔
9	CacheService,
10	ICacheService,
11	} from '@/datasources/cache/cache.service.interface';
12	import { AuthService } from '@/routes/auth/auth.service';	92✔
13	import { VerifyAuthMessageDto } from '@/routes/auth/entities/schemas/verify-auth-message.dto';
14	import { IJwtService } from '@/datasources/jwt/jwt.service.interface';	92✔
15
16	@Injectable()
17	export class AuthRepository implements IAuthRepository {	92✔
18	private readonly nonceTtlInSeconds: number;
19
20	constructor(
21	@Inject(IAuthApi)
22	private readonly authApi: IAuthApi,	1,192✔
23	@Inject(IConfigurationService)
24	private readonly configurationService: IConfigurationService,	1,192✔
25	@Inject(CacheService) private readonly cacheService: ICacheService,	1,192✔
26	@Inject(IJwtService)
27	private readonly jwtService: IJwtService,	1,192✔
28	) {
29	this.nonceTtlInSeconds = this.configurationService.getOrThrow(	1,192✔
30	'auth.nonceTtlSeconds',
31	);
32	}
33
34	/**
35	* Generates a unique nonce and stores it in cache for later verification.
36	*
37	* @returns nonce - unique string to be signed
38	*/
39	async generateNonce(): Promise<{ nonce: string }> {
40	const nonce = this.authApi.generateNonce();	10✔
41
42	// Store nonce for reference to verify/prevent replay attacks
43	const cacheDir = CacheRouter.getAuthNonceCacheDir(nonce);	10✔
44	await this.cacheService.set(cacheDir, nonce, this.nonceTtlInSeconds);	10✔
45
46	return {	10✔
47	nonce,
48	};
49	}
50
51	/**
52	* Verifies the validity of a signed message and returns an access token:
53	*
54	* 1. Ensure the message itself has not expired.
55	* 2. Ensure the nonce was generated by us/is not a replay attack.
56	* 3. Verify the signature of the message.
57	* 4. Return an access token if all checks pass.
58	*
59	* @param args - DTO containing the message and signature to verify.
60	*
61	* The following adhere to JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
62	*
63	* @returns accessToken - JWT access token
64	* @returns tokenType - token type ('Bearer') to be used in the `Authorization` header
65	* @returns notBefore - epoch from when token is valid (if applicable, otherwise null)
66	* @returns expiresIn - time in seconds until the token expires (if applicable, otherwise null)
67	*/
68	async verify(args: VerifyAuthMessageDto): Promise<{
69	accessToken: string;
70	tokenType: string;
71	notBefore: number \| null;
72	expiresIn: number \| null;
73	}> {
74	const isAuthorized = await this.isAuthorized(args).catch(() => false);	10✔
75
76	if (!isAuthorized) {	10✔
77	throw new UnauthorizedException();	8✔
78	}
79
80	const dateWhenTokenIsValid = args.message.notBefore	2!
81	? new Date(args.message.notBefore)
82	: null;
83	const dateWhenTokenExpires = args.message.expirationTime	2!
84	? new Date(args.message.expirationTime)
85	: null;
86
87	const secondsUntilTokenIsValid = dateWhenTokenIsValid	2!
88	? this.getSecondsUntil(dateWhenTokenIsValid)
89	: null;
90	const secondsUntilTokenExpires = dateWhenTokenExpires	2!
91	? this.getSecondsUntil(dateWhenTokenExpires)
92	: null;
93
94	const accessToken = this.jwtService.sign(args.message, {	2✔
95	...(secondsUntilTokenIsValid !== null && {	2✔
96	notBefore: secondsUntilTokenIsValid,
97	}),
98	...(secondsUntilTokenExpires !== null && {	2✔
99	expiresIn: secondsUntilTokenExpires,
100	}),
101	});
102
103	return {	2✔
104	tokenType: AuthService.AUTH_TOKEN_TOKEN_TYPE,
105	accessToken,
106	// Differing measurements match JWT standard {@link https://datatracker.ietf.org/doc/html/rfc7519}
107	notBefore: dateWhenTokenIsValid?.getTime() ?? null,	6!
108	expiresIn: secondsUntilTokenExpires,
109	};
110	}
111
112	/**
113	* Verifies that a message is valid according to its expiration date,
114	* signature and nonce.
115	*
116	* @param args.message - SiWe message in object form
117	* @param args.signature - signature from signing the message
118	*
119	* @returns boolean - whether the message is valid
120	*/
121	private async isAuthorized(args: {
122	message: SiweMessage;
123	signature: `0x${string}`;
124	}): Promise<boolean> {
125	const isExpired =
126	!!args.message.expirationTime &&	10✔
127	new Date(args.message.expirationTime) < new Date();
128
129	const isValidSignature = await this.authApi	10✔
130	.verifyMessage(args)
131	// Don't prevent nonce from being deleted
NEW 132	.catch(() => false);	×
133
134	const cacheDir = CacheRouter.getAuthNonceCacheDir(args.message.nonce);	10✔
135	const cachedNonce = await this.cacheService.get(cacheDir);	10✔
136	const isValidNonce = cachedNonce === args.message.nonce;	10✔
137
138	// Delete nonce from cache to prevent replay attacks
139	await this.cacheService.deleteByKey(cacheDir.key);	10✔
140
141	return !isExpired && isValidSignature && isValidNonce;	10✔
142	}
143
144	private getSecondsUntil(date: Date): number {
145	return Math.floor((date.getTime() - Date.now()) / 1_000);	4✔
146	}
147
148	/**
149	* Extracts the access token from the request.
150	*
151	* @param request - the express request object
152	* @param tokenType - the type of token used in the Authorization header
153	* @returns the access token, or null if not found
154	*/
155	getAccessToken(request: Request, tokenType: string): string \| null {
UNCOV 156	const header = request.headers.authorization;	×
157
UNCOV 158	if (typeof header !== 'string') {	×
UNCOV 159	return null;	×
160	}
161
UNCOV 162	const [type, token] = header.split(' ');	×
163
UNCOV 164	if (type !== tokenType \|\| !token) {	×
165	return null;	×
166	}
167
UNCOV 168	return token;	×
169	}
170	}

safe-global / safe-client-gateway / 8601631337

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous