Authentication & sessions

// src/auth/passwords.ts
import { randomBytes, scrypt as scryptCb, timingSafeEqual } from 'node:crypto'
import { promisify } from 'node:util'

const scrypt = promisify(scryptCb) as (
  password: string, salt: Buffer, keylen: number, options: { N: number; r: number; p: number; maxmem: number },
) => Promise<Buffer>

const PARAMS = { N: 2 ** 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 } // ~32 MiB and ~50 ms per hash
const KEY_LENGTH = 32

export async function hashPassword(password: string): Promise<string> {
  const salt = randomBytes(16)
  const key = await scrypt(password, salt, KEY_LENGTH, PARAMS)
  return `scrypt$${PARAMS.N}$${PARAMS.r}$${PARAMS.p}$${salt.toString('base64')}$${key.toString('base64')}`
}

export async function verifyPassword(password: string, stored: string): Promise<boolean> {
  const [algo, N, r, p, saltB64, keyB64] = stored.split('$')
  if (algo !== 'scrypt' || !saltB64 || !keyB64) return false
  const expected = Buffer.from(keyB64, 'base64')
  const actual = await scrypt(password, Buffer.from(saltB64, 'base64'), expected.length, {
    N: Number(N), r: Number(r), p: Number(p), maxmem: PARAMS.maxmem,
  })
  return timingSafeEqual(actual, expected)
}

-- migrations/002_users_and_sessions.sql
CREATE TABLE users (
  id            integer GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
  email         text NOT NULL UNIQUE,
  password_hash text NOT NULL,
  role          text NOT NULL DEFAULT 'customer' CHECK (role IN ('customer', 'admin')),
  created_at    timestamptz NOT NULL DEFAULT now()
);

CREATE TABLE sessions (
  token_hash  bytea PRIMARY KEY,
  user_id     integer NOT NULL REFERENCES users (id) ON DELETE CASCADE,
  expires_at  timestamptz NOT NULL,
  created_at  timestamptz NOT NULL DEFAULT now()
);
CREATE INDEX sessions_user_id_idx ON sessions (user_id);

// src/auth/sessions.ts
import { createHash, randomBytes } from 'node:crypto'
import { pool } from '../db.ts'

const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000 // 30 days
const hashToken = (token: string) => createHash('sha256').update(token).digest()

export type SessionUser = { id: number; email: string; role: 'customer' | 'admin' }

export async function createSession(userId: number): Promise<{ token: string; expiresAt: Date }> {
  const token = randomBytes(32).toString('base64url') // 256 bits: unguessable
  const expiresAt = new Date(Date.now() + SESSION_TTL_MS)
  await pool.query('INSERT INTO sessions (token_hash, user_id, expires_at) VALUES ($1, $2, $3)', [
    hashToken(token), userId, expiresAt,
  ])
  return { token, expiresAt }
}

export async function userForSession(token: string): Promise<SessionUser | undefined> {
  const { rows } = await pool.query<SessionUser>(
    `SELECT u.id, u.email, u.role FROM sessions s JOIN users u ON u.id = s.user_id
     WHERE s.token_hash = $1 AND s.expires_at > now()`,
    [hashToken(token)],
  )
  return rows[0]
}

export async function deleteSession(token: string) {
  await pool.query('DELETE FROM sessions WHERE token_hash = $1', [hashToken(token)])
}

import { setCookie } from 'hono/cookie'

setCookie(c, 'session', token, {
  httpOnly: true,     // page JavaScript can't read it, so an XSS bug can't steal it
  secure: true,       // only sent over HTTPS
  sameSite: 'Lax',    // not sent on cross-site POSTs: the main CSRF defence
  path: '/',
  expires: expiresAt,
})

// src/auth/routes.ts
import { Hono } from 'hono'
import { deleteCookie, getCookie, setCookie } from 'hono/cookie'
import { z } from 'zod'
import { pool } from '../db.ts'
import { validate } from '../http/errors.ts'
import { hashPassword, verifyPassword } from './passwords.ts'
import { createSession, deleteSession } from './sessions.ts'

const Credentials = z.object({
  email: z.email().transform((e) => e.toLowerCase()),
  password: z.string().min(12).max(256),
})

// A real hash of a random password, used when the email doesn't exist (see below).
const DUMMY_HASH = await hashPassword(crypto.randomUUID())

export const authRoutes = new Hono()
  .post('/register', validate('json', Credentials), async (c) => {
    const { email, password } = c.req.valid('json')
    const passwordHash = await hashPassword(password)
    const { rows } = await pool.query<{ id: number }>(
      'INSERT INTO users (email, password_hash) VALUES ($1, $2) ON CONFLICT (email) DO NOTHING RETURNING id',
      [email, passwordHash],
    )
    if (!rows[0]) return c.json({ error: { code: 'email_taken', message: 'That email is already registered.' } }, 409)
    return c.json({ id: rows[0].id, email }, 201)
  })
  .post('/login', validate('json', Credentials), async (c) => {
    const { email, password } = c.req.valid('json')
    const { rows } = await pool.query<{ id: number; password_hash: string }>(
      'SELECT id, password_hash FROM users WHERE email = $1', [email],
    )
    const user = rows[0]
    const ok = await verifyPassword(password, user?.password_hash ?? DUMMY_HASH)
    if (!user || !ok) return c.json({ error: { code: 'invalid_credentials', message: 'Wrong email or password.' } }, 401)

    const { token, expiresAt } = await createSession(user.id)
    setCookie(c, 'session', token, { httpOnly: true, secure: true, sameSite: 'Lax', path: '/', expires: expiresAt })
    return c.body(null, 204)
  })
  .post('/logout', async (c) => {
    const token = getCookie(c, 'session')
    if (token) await deleteSession(token)
    deleteCookie(c, 'session', { path: '/', secure: true })
    return c.body(null, 204)
  })

// src/auth/middleware.ts
import { getCookie } from 'hono/cookie'
import { createMiddleware } from 'hono/factory'
import { HTTPException } from 'hono/http-exception'
import { userForSession, type SessionUser } from './sessions.ts'

export type AuthEnv = { Variables: { user: SessionUser } }

export const requireUser = createMiddleware<AuthEnv>(async (c, next) => {
  const token = getCookie(c, 'session')
  const user = token ? await userForSession(token) : undefined
  if (!user) throw new HTTPException(401, { message: 'Please sign in.' })
  c.set('user', user)
  await next()
})

export const requireRole = (role: SessionUser['role']) =>
  createMiddleware<AuthEnv>(async (c, next) => {
    if (c.get('user').role !== role) throw new HTTPException(403, { message: 'Not allowed.' })
    await next()
  })

const app = new Hono<AuthEnv>()
app.get('/me', requireUser, (c) => c.json(c.get('user')))           // c.get('user') is typed
app.get('/admin/stats', requireUser, requireRole('admin'), (c) => c.json({ ok: true }))

app.get('/orders/:id', requireUser, validate('param', IdParam), async (c) => {
  const user = c.get('user')
  const { rows } = await pool.query(
    `SELECT * FROM orders WHERE id = $1 AND ($2 = 'admin' OR customer_id = $3)`,
    [c.req.valid('param').id, user.role, user.id],
  )
  if (!rows[0]) throw new NotFoundError('order', c.req.valid('param').id) // 404, not 403
  return c.json(rows[0])
})

import { csrf } from 'hono/csrf'

app.use(csrf({ origin: ['https://app.example.com'] }))