feat: changed backend-pg to backend

backend/src/services/identity-access-token/identity-access-token-dal.ts

@@ -0,0 +1,45 @@
+import { Knex } from "knex";
+
+import { TDbClient } from "@app/db";
+import { TableName,TIdentityAccessTokens } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
+
+export type TIdentityAccessTokenDALFactory = ReturnType<typeof identityAccessTokenDALFactory>;
+
+export const identityAccessTokenDALFactory = (db: TDbClient) => {
+  const identityAccessTokenOrm = ormify(db, TableName.IdentityAccessToken);
+
+  const findOne = async (filter: Partial<TIdentityAccessTokens>, tx?: Knex) => {
+    try {
+      const doc = await (tx || db)(TableName.IdentityAccessToken)
+        .where(filter)
+        .join(
+          TableName.Identity,
+          `${TableName.Identity}.id`,
+          `${TableName.IdentityAccessToken}.identityId`
+        )
+        .leftJoin(
+          TableName.IdentityUaClientSecret,
+          `${TableName.IdentityAccessToken}.identityUAClientSecretId`,
+          `${TableName.IdentityUaClientSecret}.id`
+        )
+        .leftJoin(
+          TableName.IdentityUniversalAuth,
+          `${TableName.IdentityUaClientSecret}.identityUAId`,
+          `${TableName.IdentityUniversalAuth}.id`
+        )
+        .select(selectAllTableCols(TableName.IdentityAccessToken))
+        .select(
+          db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityUniversalAuth),
+          db.ref("name").withSchema(TableName.Identity)
+        )
+        .first();
+      return doc;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "IdAccessTokenFindOne" });
+    }
+  };
+
+  return { ...identityAccessTokenOrm, findOne };
+};

backend/src/services/identity-access-token/identity-access-token-service.ts

@@ -0,0 +1,135 @@
+import jwt, { JwtPayload } from "jsonwebtoken";
+
+import { TableName, TIdentityAccessTokens } from "@app/db/schemas";
+import { getConfig } from "@app/lib/config/env";
+import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
+import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip";
+
+import { AuthTokenType } from "../auth/auth-type";
+import { TIdentityAccessTokenDALFactory } from "./identity-access-token-dal";
+import {
+  TIdentityAccessTokenJwtPayload,
+  TRenewAccessTokenDTO
+} from "./identity-access-token-types";
+
+type TIdentityAccessTokenServiceFactoryDep = {
+  identityAccessTokenDAL: TIdentityAccessTokenDALFactory;
+};
+
+export type TIdentityAccessTokenServiceFactory = ReturnType<
+  typeof identityAccessTokenServiceFactory
+>;
+
+export const identityAccessTokenServiceFactory = ({
+  identityAccessTokenDAL
+}: TIdentityAccessTokenServiceFactoryDep) => {
+  const validateAccessTokenExp = (identityAccessToken: TIdentityAccessTokens) => {
+    const {
+      accessTokenTTL,
+      accessTokenNumUses,
+      accessTokenNumUsesLimit,
+      accessTokenLastRenewedAt,
+      accessTokenMaxTTL,
+      createdAt: accessTokenCreatedAt
+    } = identityAccessToken;
+
+    if (accessTokenNumUsesLimit > 0 && accessTokenNumUses > 0 && accessTokenNumUses >= accessTokenNumUsesLimit) {
+      throw new BadRequestError({
+        message: "Unable to renew because access token number of uses limit reached"
+      });
+    }
+
+    // ttl check
+    if (accessTokenTTL > 0) {
+      const currentDate = new Date();
+      if (accessTokenLastRenewedAt) {
+        // access token has been renewed
+        const accessTokenRenewed = new Date(accessTokenLastRenewedAt);
+        const ttlInMilliseconds = accessTokenTTL * 1000;
+        const expirationDate = new Date(accessTokenRenewed.getTime() + ttlInMilliseconds);
+
+        if (currentDate > expirationDate)
+          throw new UnauthorizedError({
+            message: "Failed to renew MI access token due to TTL expiration"
+          });
+      } else {
+        // access token has never been renewed
+        const accessTokenCreated = new Date(accessTokenCreatedAt);
+        const ttlInMilliseconds = accessTokenTTL * 1000;
+        const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
+
+        if (currentDate > expirationDate)
+          throw new UnauthorizedError({
+            message: "Failed to renew MI access token due to TTL expiration"
+          });
+      }
+    }
+
+    // max ttl checks
+    if (accessTokenMaxTTL > 0) {
+      const accessTokenCreated = new Date(accessTokenCreatedAt);
+      const ttlInMilliseconds = accessTokenMaxTTL * 1000;
+      const currentDate = new Date();
+      const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
+
+      if (currentDate > expirationDate)
+        throw new UnauthorizedError({
+          message: "Failed to renew MI access token due to Max TTL expiration"
+        });
+
+      const extendToDate = new Date(currentDate.getTime() + accessTokenTTL);
+      if (extendToDate > expirationDate)
+        throw new UnauthorizedError({
+          message: "Failed to renew MI access token past its Max TTL expiration"
+        });
+    }
+  };
+
+  const renewAccessToken = async ({ accessToken }: TRenewAccessTokenDTO) => {
+    const appCfg = getConfig();
+
+    const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload;
+    if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN)
+      throw new UnauthorizedError();
+
+    const identityAccessToken = await identityAccessTokenDAL.findOne({
+      [`${TableName.IdentityAccessToken}.id` as "id"]: decodedToken.identityAccessTokenId,
+      isAccessTokenRevoked: false
+    });
+    if (!identityAccessToken) throw new UnauthorizedError();
+
+    validateAccessTokenExp(identityAccessToken);
+
+    const updatedIdentityAccessToken = await identityAccessTokenDAL.updateById(
+      identityAccessToken.id,
+      {
+        accessTokenLastRenewedAt: new Date()
+      }
+    );
+
+    return { accessToken, identityAccessToken: updatedIdentityAccessToken };
+  };
+
+  const fnValidateIdentityAccessToken = async (
+    token: TIdentityAccessTokenJwtPayload,
+    ipAddress?: string
+  ) => {
+    const identityAccessToken = await identityAccessTokenDAL.findOne({
+      [`${TableName.IdentityAccessToken}.id` as "id"]: token.identityAccessTokenId,
+      isAccessTokenRevoked: false
+    });
+    if (!identityAccessToken) throw new UnauthorizedError();
+
+    if (ipAddress) {
+      checkIPAgainstBlocklist({
+        ipAddress,
+        trustedIps: identityAccessToken?.accessTokenTrustedIps as TIp[]
+      });
+    }
+
+    validateAccessTokenExp(identityAccessToken);
+    return identityAccessToken;
+  };
+
+  return { renewAccessToken, fnValidateIdentityAccessToken };
+};

backend/src/services/identity-access-token/identity-access-token-types.ts

@@ -0,0 +1,10 @@
+export type TRenewAccessTokenDTO = {
+  accessToken: string;
+};
+
+export type TIdentityAccessTokenJwtPayload = {
+  identityId: string;
+  clientSecretId: string;
+  identityAccessTokenId: string;
+  authTokenType: string;
+};