[CLI] Ethereum auth setup updates

packages/cli/src/commands/setup/auth/auth.js

@@ -23,6 +23,8 @@ const OUTPUT_PATHS = {
     getPaths().api.functions,
     getProject().isTypeScriptProject ? 'auth.ts' : 'auth.js'
   ),
+  service: path.join(getPaths().api.services, '/ethereumAuth/ethereumAuth.js'),
+  graphql: path.join(getPaths().api.graphql, 'ethereumAuth.sdl.js'),
 }
 
 const getGraphqlPath = () =>

packages/cli/src/commands/setup/auth/templates/ethereum.auth.js.template

@@ -1,12 +1,23 @@
-import { AuthenticationError } from '@redwoodjs/api'
+import { AuthenticationError, ForbiddenError, parseJWT } from '@redwoodjs/api'
 
-import { db } from './db'
-
-// See https://redwoodjs.com/cookbook/role-based-access-control-rbac
-// for how to add Role-based Access Control (RBAC) here.
-
-export const getCurrentUser = async (decoded) => {
-  return db.user.findUnique({ where: { address: decoded.address } })
+/**
+ * getCurrentUser returns the user information together with
+ * an optional collection of roles used by requireAuth() to check
+ * if the user is authenticated or has role-based access
+ *
+ * @param decoded - The decoded access token containing user info and JWT claims like `sub`
+ * @param { token, SupportedAuthTypes type } - The access token itself as well as the auth provider type
+ * @param { APIGatewayEvent event, Context context } - An object which contains information from the invoker
+ * such as headers and cookies, and the context information about the invocation such as IP Address
+ *
+ * @see https://github.com/redwoodjs/redwood/tree/main/packages/auth for examples
+ */
+export const getCurrentUser = async (
+  decoded,
+  { _token, _type },
+  { _event, _context }
+) => {
+  return { ...decoded, roles: parseJWT({ decoded }).roles }
 }
 
 /**
@@ -18,11 +29,55 @@ export const isAuthenticated = () => {
   return !!context.currentUser
 }
 
-// Use this function in your services to check that a user is logged in, and
-// optionally raise an error if they're not.
+/**
+ * Checks if the currentUser is authenticated (and assigned one of the given roles)
+ *
+ * @param {string | string[]} roles - A single role or list of roles to check if the user belongs to
+ *
+ * @returns {boolean} - Returns true if the currentUser is logged in and assigned one of the given roles,
+ * or when no roles are provided to check against. Otherwise returns false.
+ */
+export const hasRole = ({ roles }) => {
+  if (!isAuthenticated()) {
+    return false
+  }
+
+  if (roles) {
+    if (Array.isArray(roles)) {
+      return context.currentUser.roles?.some((r) => roles.includes(r))
+    }
+
+    if (typeof roles === 'string') {
+      return context.currentUser.roles?.includes(roles)
+    }
 
-export const requireAuth = () => {
-  if (!context.currentUser) {
+    // roles not found
+    return false
+  }
+
+  return true
+}
+
+/**
+ * Use requireAuth in your services to check that a user is logged in,
+ * whether or not they are assigned a role, and optionally raise an
+ * error if they're not.
+ *
+ * @param {string= | string[]=} roles - A single role or list of roles to check if the user belongs to
+ *
+ * @returns - If the currentUser is authenticated (and assigned one of the given roles)
+ *
+ * @throws {AuthenticationError} - If the currentUser is not authenticated
+ * @throws {ForbiddenError} If the currentUser is not allowed due to role permissions
+ *
+ * @see https://github.com/redwoodjs/redwood/tree/main/packages/auth for examples
+ */
+export const requireAuth = ({ roles } = {}) => {
+  if (!isAuthenticated()) {
     throw new AuthenticationError("You don't have permission to do that.")
   }
+
+  if (!hasRole({ roles })) {
+    throw new ForbiddenError("You don't have access to do that.")
+  }
 }

packages/cli/src/commands/setup/auth/templates/ethereum.graphql.sdl.template

@@ -0,0 +1,25 @@
+export const schema = gql`
+  type AuthChallengeResult {
+    message: String!
+  }
+
+  type AuthVerifyResult {
+    token: String!
+  }
+
+  input AuthChallengeInput {
+    address: String!
+    options: JSON
+  }
+
+  input AuthVerifyInput {
+    signature: String!
+    address: String!
+    options: JSON
+  }
+
+  type Mutation {
+    authChallenge(input: AuthChallengeInput!): AuthChallengeResult
+    authVerify(input: AuthVerifyInput!): AuthVerifyResult
+  }
+`

packages/cli/src/commands/setup/auth/templates/ethereum.service.js.template

@@ -0,0 +1,96 @@
+import { AuthenticationError } from '@redwoodjs/api'
+
+import { bufferToHex } from 'ethereumjs-util'
+import { recoverPersonalSignature } from 'eth-sig-util'
+import jwt from 'jsonwebtoken'
+
+import { db } from 'src/lib/db'
+
+const NONCE_MESSAGE =
+  'Please prove you control this wallet by signing this random text: '
+
+const getNonceMessage = (nonce, options) => {
+  let optionsText = ''
+  if (options)
+    optionsText =
+      '&' +
+      Object.keys(options)
+        .map(
+          (key) =>
+            encodeURIComponent(key) + '=' + encodeURIComponent(options[key])
+        )
+        .join('&')
+  return NONCE_MESSAGE + nonce + optionsText
+}
+
+export const beforeResolver = (rules) => {
+  rules.skip({ only: ['authChallenge', 'authVerify'] })
+}
+
+export const authChallenge = async ({
+  input: { address: addressRaw, options },
+}) => {
+  const nonce = Math.floor(Math.random() * 1000000).toString()
+  const address = addressRaw.toLowerCase()
+  await db.user.upsert({
+    where: { address },
+    update: {
+      authDetail: {
+        update: {
+          nonce,
+          timestamp: new Date(),
+        },
+      },
+    },
+    create: {
+      address,
+      authDetail: {
+        create: {
+          nonce,
+        },
+      },
+    },
+  })
+
+  return { message: getNonceMessage(nonce, options) }
+}
+
+export const authVerify = async ({
+  input: { signature, address: addressRaw, options },
+}) => {
+  try {
+    const address = addressRaw.toLowerCase()
+    const user = await db.user.findUnique({
+      where: { address },
+    })
+    if (!user) throw new Error('No authentication started')
+    const { nonce, timestamp } = await db.user
+      .findUnique({
+        where: { address },
+      })
+      .authDetail()
+
+    const startTime = new Date(timestamp)
+    if (new Date() - startTime > 5 * 60 * 1000)
+      throw new Error(
+        'The challenge must have been generated within the last 5 minutes'
+      )
+    const signerAddress = recoverPersonalSignature({
+      data: bufferToHex(Buffer.from(getNonceMessage(nonce, options), 'utf8')),
+      sig: signature,
+    })
+    if (address !== signerAddress.toLowerCase())
+      throw new Error('invalid signature')
+
+    const token = jwt.sign(
+      { address, id: user.id },
+      process.env.ETHEREUM_JWT_SECRET,
+      {
+        expiresIn: '5h',
+      }
+    )
+    return { token }
+  } catch (e) {
+    throw new Error(e)
+  }
+}