feat: migrate nextjs to rr7

packages/auth/server/routes/callback.ts

@@ -0,0 +1,20 @@
+import { Hono } from 'hono';
+
+import { GoogleAuthOptions, OidcAuthOptions } from '../config';
+import { handleOAuthCallbackUrl } from '../lib/utils/handle-oauth-callback-url';
+import type { HonoAuthContext } from '../types/context';
+
+/**
+ * Have to create this route instead of bundling callback with oauth routes to provide
+ * backwards compatibility for self-hosters (since we used to use NextAuth).
+ */
+export const callbackRoute = new Hono<HonoAuthContext>()
+  /**
+   * OIDC callback verification.
+   */
+  .get('/oidc', async (c) => handleOAuthCallbackUrl({ c, clientOptions: OidcAuthOptions }))
+
+  /**
+   * Google callback verification.
+   */
+  .get('/google', async (c) => handleOAuthCallbackUrl({ c, clientOptions: GoogleAuthOptions }));

packages/auth/server/routes/email-password.ts

@@ -0,0 +1,397 @@
+import { sValidator } from '@hono/standard-validator';
+import { compare } from '@node-rs/bcrypt';
+import { UserSecurityAuditLogType } from '@prisma/client';
+import { Hono } from 'hono';
+import { DateTime } from 'luxon';
+import { z } from 'zod';
+
+import { IS_BILLING_ENABLED } from '@documenso/lib/constants/app';
+import { EMAIL_VERIFICATION_STATE } from '@documenso/lib/constants/email';
+import { AppError } from '@documenso/lib/errors/app-error';
+import { jobsClient } from '@documenso/lib/jobs/client';
+import { disableTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/disable-2fa';
+import { enableTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/enable-2fa';
+import { isTwoFactorAuthenticationEnabled } from '@documenso/lib/server-only/2fa/is-2fa-availble';
+import { setupTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/setup-2fa';
+import { validateTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/validate-2fa';
+import { viewBackupCodes } from '@documenso/lib/server-only/2fa/view-backup-codes';
+import { createUser } from '@documenso/lib/server-only/user/create-user';
+import { forgotPassword } from '@documenso/lib/server-only/user/forgot-password';
+import { getMostRecentVerificationTokenByUserId } from '@documenso/lib/server-only/user/get-most-recent-verification-token-by-user-id';
+import { resetPassword } from '@documenso/lib/server-only/user/reset-password';
+import { updatePassword } from '@documenso/lib/server-only/user/update-password';
+import { verifyEmail } from '@documenso/lib/server-only/user/verify-email';
+import { env } from '@documenso/lib/utils/env';
+import { prisma } from '@documenso/prisma';
+
+import { AuthenticationErrorCode } from '../lib/errors/error-codes';
+import { getCsrfCookie } from '../lib/session/session-cookies';
+import { onAuthorize } from '../lib/utils/authorizer';
+import { getSession } from '../lib/utils/get-session';
+import type { HonoAuthContext } from '../types/context';
+import {
+  ZForgotPasswordSchema,
+  ZResendVerifyEmailSchema,
+  ZResetPasswordSchema,
+  ZSignInSchema,
+  ZSignUpSchema,
+  ZUpdatePasswordSchema,
+  ZVerifyEmailSchema,
+} from '../types/email-password';
+
+export const emailPasswordRoute = new Hono<HonoAuthContext>()
+  /**
+   * Authorize endpoint.
+   */
+  .post('/authorize', sValidator('json', ZSignInSchema), async (c) => {
+    const requestMetadata = c.get('requestMetadata');
+
+    const { email, password, totpCode, backupCode, csrfToken } = c.req.valid('json');
+
+    const csrfCookieToken = await getCsrfCookie(c);
+
+    // Todo: (RR7) Add logging here.
+    if (csrfToken !== csrfCookieToken || !csrfCookieToken) {
+      throw new AppError(AuthenticationErrorCode.InvalidRequest, {
+        message: 'Invalid CSRF token',
+      });
+    }
+
+    const user = await prisma.user.findFirst({
+      where: {
+        email: email.toLowerCase(),
+      },
+    });
+
+    if (!user || !user.password) {
+      throw new AppError(AuthenticationErrorCode.InvalidCredentials, {
+        message: 'Invalid email or password',
+      });
+    }
+
+    const isPasswordsSame = await compare(password, user.password);
+
+    if (!isPasswordsSame) {
+      await prisma.userSecurityAuditLog.create({
+        data: {
+          userId: user.id,
+          ipAddress: requestMetadata.ipAddress,
+          userAgent: requestMetadata.userAgent,
+          type: UserSecurityAuditLogType.SIGN_IN_FAIL,
+        },
+      });
+
+      throw new AppError(AuthenticationErrorCode.InvalidCredentials, {
+        message: 'Invalid email or password',
+      });
+    }
+
+    const is2faEnabled = isTwoFactorAuthenticationEnabled({ user });
+
+    if (is2faEnabled) {
+      const isValid = await validateTwoFactorAuthentication({ backupCode, totpCode, user });
+
+      if (!isValid) {
+        await prisma.userSecurityAuditLog.create({
+          data: {
+            userId: user.id,
+            ipAddress: requestMetadata.ipAddress,
+            userAgent: requestMetadata.userAgent,
+            type: UserSecurityAuditLogType.SIGN_IN_2FA_FAIL,
+          },
+        });
+
+        throw new AppError(AuthenticationErrorCode.InvalidTwoFactorCode);
+      }
+    }
+
+    if (!user.emailVerified) {
+      const mostRecentToken = await getMostRecentVerificationTokenByUserId({
+        userId: user.id,
+      });
+
+      if (
+        !mostRecentToken ||
+        mostRecentToken.expires.valueOf() <= Date.now() ||
+        DateTime.fromJSDate(mostRecentToken.createdAt).diffNow('minutes').minutes > -5
+      ) {
+        await jobsClient.triggerJob({
+          name: 'send.signup.confirmation.email',
+          payload: {
+            email: user.email,
+          },
+        });
+      }
+
+      throw new AppError('UNVERIFIED_EMAIL', {
+        message: 'Unverified email',
+      });
+    }
+
+    if (user.disabled) {
+      throw new AppError('ACCOUNT_DISABLED', {
+        message: 'Account disabled',
+      });
+    }
+
+    await onAuthorize({ userId: user.id }, c);
+
+    return c.text('', 201);
+  })
+  /**
+   * Signup endpoint.
+   */
+  .post('/signup', sValidator('json', ZSignUpSchema), async (c) => {
+    if (env('NEXT_PUBLIC_DISABLE_SIGNUP') === 'true') {
+      throw new AppError('SIGNUP_DISABLED', {
+        message: 'Signups are disabled.',
+      });
+    }
+
+    const { name, email, password, signature, url } = c.req.valid('json');
+
+    if (IS_BILLING_ENABLED() && url && url.length < 6) {
+      throw new AppError('PREMIUM_PROFILE_URL', {
+        message: 'Only subscribers can have a username shorter than 6 characters',
+      });
+    }
+
+    const user = await createUser({ name, email, password, signature, url });
+
+    await jobsClient.triggerJob({
+      name: 'send.signup.confirmation.email',
+      payload: {
+        email: user.email,
+      },
+    });
+
+    return c.text('OK', 201);
+  })
+  /**
+   * Update password endpoint.
+   */
+  .post('/update-password', sValidator('json', ZUpdatePasswordSchema), async (c) => {
+    const { password, currentPassword } = c.req.valid('json');
+    const requestMetadata = c.get('requestMetadata');
+
+    const session = await getSession(c);
+
+    await updatePassword({
+      userId: session.user.id,
+      password,
+      currentPassword,
+      requestMetadata,
+    });
+
+    return c.text('OK', 201);
+  })
+  /**
+   * Verify email endpoint.
+   */
+  .post('/verify-email', sValidator('json', ZVerifyEmailSchema), async (c) => {
+    const { state, userId } = await verifyEmail({ token: c.req.valid('json').token });
+
+    // If email is verified, automatically authenticate user.
+    if (state === EMAIL_VERIFICATION_STATE.VERIFIED && userId !== null) {
+      await onAuthorize({ userId }, c);
+    }
+
+    return c.json({
+      state,
+    });
+  })
+  /**
+   * Resend verification email endpoint.
+   */
+  .post('/resend-verify-email', sValidator('json', ZResendVerifyEmailSchema), async (c) => {
+    const { email } = c.req.valid('json');
+
+    await jobsClient.triggerJob({
+      name: 'send.signup.confirmation.email',
+      payload: {
+        email,
+      },
+    });
+
+    return c.text('OK', 201);
+  })
+  /**
+   * Forgot password endpoint.
+   */
+  .post('/forgot-password', sValidator('json', ZForgotPasswordSchema), async (c) => {
+    const { email } = c.req.valid('json');
+
+    await forgotPassword({
+      email,
+    });
+
+    return c.text('OK', 201);
+  })
+  /**
+   * Reset password endpoint.
+   */
+  .post('/reset-password', sValidator('json', ZResetPasswordSchema), async (c) => {
+    const { token, password } = c.req.valid('json');
+
+    const requestMetadata = c.get('requestMetadata');
+
+    await resetPassword({
+      token,
+      password,
+      requestMetadata,
+    });
+
+    return c.text('OK', 201);
+  })
+  /**
+   * Setup two factor authentication.
+   */
+  .post('/2fa/setup', async (c) => {
+    const { user } = await getSession(c);
+
+    const result = await setupTwoFactorAuthentication({
+      user,
+    });
+
+    return c.json({
+      success: true,
+      secret: result.secret,
+      uri: result.uri,
+    });
+  })
+  /**
+   * Enable two factor authentication.
+   */
+  .post(
+    '/2fa/enable',
+    sValidator(
+      'json',
+      z.object({
+        code: z.string(),
+      }),
+    ),
+    async (c) => {
+      const requestMetadata = c.get('requestMetadata');
+
+      const { user: sessionUser } = await getSession(c);
+
+      const user = await prisma.user.findFirst({
+        where: {
+          id: sessionUser.id,
+        },
+        select: {
+          id: true,
+          email: true,
+          twoFactorEnabled: true,
+          twoFactorSecret: true,
+        },
+      });
+
+      if (!user) {
+        throw new AppError(AuthenticationErrorCode.InvalidRequest);
+      }
+
+      const { code } = c.req.valid('json');
+
+      const result = await enableTwoFactorAuthentication({
+        user,
+        code,
+        requestMetadata,
+      });
+
+      return c.json({
+        success: true,
+        recoveryCodes: result.recoveryCodes,
+      });
+    },
+  )
+  /**
+   * Disable two factor authentication.
+   */
+  .post(
+    '/2fa/disable',
+    sValidator(
+      'json',
+      z.object({
+        totpCode: z.string().trim().optional(),
+        backupCode: z.string().trim().optional(),
+      }),
+    ),
+    async (c) => {
+      const requestMetadata = c.get('requestMetadata');
+
+      const { user: sessionUser } = await getSession(c);
+
+      const user = await prisma.user.findFirst({
+        where: {
+          id: sessionUser.id,
+        },
+        select: {
+          id: true,
+          email: true,
+          twoFactorEnabled: true,
+          twoFactorSecret: true,
+          twoFactorBackupCodes: true,
+        },
+      });
+
+      if (!user) {
+        throw new AppError(AuthenticationErrorCode.InvalidRequest);
+      }
+
+      const { totpCode, backupCode } = c.req.valid('json');
+
+      await disableTwoFactorAuthentication({
+        user,
+        totpCode,
+        backupCode,
+        requestMetadata,
+      });
+
+      return c.text('OK', 201);
+    },
+  )
+  /**
+   * View backup codes.
+   */
+  .post(
+    '/2fa/view-recovery-codes',
+    sValidator(
+      'json',
+      z.object({
+        token: z.string(),
+      }),
+    ),
+    async (c) => {
+      const { user: sessionUser } = await getSession(c);
+
+      const user = await prisma.user.findFirst({
+        where: {
+          id: sessionUser.id,
+        },
+        select: {
+          id: true,
+          email: true,
+          twoFactorEnabled: true,
+          twoFactorSecret: true,
+          twoFactorBackupCodes: true,
+        },
+      });
+
+      if (!user) {
+        throw new AppError(AuthenticationErrorCode.InvalidRequest);
+      }
+
+      const { token } = c.req.valid('json');
+
+      const backupCodes = await viewBackupCodes({
+        user,
+        token,
+      });
+
+      return c.json({
+        success: true,
+        backupCodes,
+      });
+    },
+  );

packages/auth/server/routes/oauth.ts

@@ -0,0 +1,37 @@
+import { sValidator } from '@hono/standard-validator';
+import { Hono } from 'hono';
+import { z } from 'zod';
+
+import { GoogleAuthOptions, OidcAuthOptions } from '../config';
+import { handleOAuthAuthorizeUrl } from '../lib/utils/handle-oauth-authorize-url';
+import type { HonoAuthContext } from '../types/context';
+
+const ZOAuthAuthorizeSchema = z.object({
+  redirectPath: z.string().optional(),
+});
+
+export const oauthRoute = new Hono<HonoAuthContext>()
+  /**
+   * Google authorize endpoint.
+   */
+  .post('/authorize/google', sValidator('json', ZOAuthAuthorizeSchema), async (c) => {
+    const { redirectPath } = c.req.valid('json');
+
+    return handleOAuthAuthorizeUrl({
+      c,
+      clientOptions: GoogleAuthOptions,
+      redirectPath,
+    });
+  })
+  /**
+   * OIDC authorize endpoint.
+   */
+  .post('/authorize/oidc', sValidator('json', ZOAuthAuthorizeSchema), async (c) => {
+    const { redirectPath } = c.req.valid('json');
+
+    return handleOAuthAuthorizeUrl({
+      c,
+      clientOptions: OidcAuthOptions,
+      redirectPath,
+    });
+  });

packages/auth/server/routes/passkey.ts

@@ -0,0 +1,121 @@
+import { sValidator } from '@hono/standard-validator';
+import { UserSecurityAuditLogType } from '@prisma/client';
+import { verifyAuthenticationResponse } from '@simplewebauthn/server';
+import { Hono } from 'hono';
+
+import { AppError, AppErrorCode } from '@documenso/lib/errors/app-error';
+import type { TAuthenticationResponseJSONSchema } from '@documenso/lib/types/webauthn';
+import { ZAuthenticationResponseJSONSchema } from '@documenso/lib/types/webauthn';
+import { getAuthenticatorOptions } from '@documenso/lib/utils/authenticator';
+import { prisma } from '@documenso/prisma';
+
+import { onAuthorize } from '../lib/utils/authorizer';
+import type { HonoAuthContext } from '../types/context';
+import { ZPasskeyAuthorizeSchema } from '../types/passkey';
+
+export const passkeyRoute = new Hono<HonoAuthContext>()
+  /**
+   * Authorize endpoint.
+   */
+  .post('/authorize', sValidator('json', ZPasskeyAuthorizeSchema), async (c) => {
+    const requestMetadata = c.get('requestMetadata');
+
+    const { csrfToken, credential } = c.req.valid('json');
+
+    if (typeof csrfToken !== 'string' || csrfToken.length === 0) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST);
+    }
+
+    let requestBodyCrediential: TAuthenticationResponseJSONSchema | null = null;
+
+    try {
+      const parsedBodyCredential = JSON.parse(credential);
+      requestBodyCrediential = ZAuthenticationResponseJSONSchema.parse(parsedBodyCredential);
+    } catch {
+      throw new AppError(AppErrorCode.INVALID_REQUEST);
+    }
+
+    const challengeToken = await prisma.anonymousVerificationToken
+      .delete({
+        where: {
+          id: csrfToken,
+        },
+      })
+      .catch(() => null);
+
+    if (!challengeToken) {
+      throw new AppError(AppErrorCode.INVALID_REQUEST);
+    }
+
+    if (challengeToken.expiresAt < new Date()) {
+      throw new AppError(AppErrorCode.EXPIRED_CODE);
+    }
+
+    const passkey = await prisma.passkey.findFirst({
+      where: {
+        credentialId: Buffer.from(requestBodyCrediential.id, 'base64'),
+      },
+      include: {
+        user: {
+          select: {
+            id: true,
+            email: true,
+            name: true,
+            emailVerified: true,
+          },
+        },
+      },
+    });
+
+    if (!passkey) {
+      throw new AppError(AppErrorCode.NOT_SETUP);
+    }
+
+    const user = passkey.user;
+
+    const { rpId, origin } = getAuthenticatorOptions();
+
+    const verification = await verifyAuthenticationResponse({
+      response: requestBodyCrediential,
+      expectedChallenge: challengeToken.token,
+      expectedOrigin: origin,
+      expectedRPID: rpId,
+      authenticator: {
+        credentialID: new Uint8Array(Array.from(passkey.credentialId)),
+        credentialPublicKey: new Uint8Array(passkey.credentialPublicKey),
+        counter: Number(passkey.counter),
+      },
+    }).catch(() => null);
+
+    if (!verification?.verified) {
+      await prisma.userSecurityAuditLog.create({
+        data: {
+          userId: user.id,
+          ipAddress: requestMetadata.ipAddress,
+          userAgent: requestMetadata.userAgent,
+          type: UserSecurityAuditLogType.SIGN_IN_PASSKEY_FAIL,
+        },
+      });
+
+      throw new AppError(AppErrorCode.INVALID_REQUEST);
+    }
+
+    await prisma.passkey.update({
+      where: {
+        id: passkey.id,
+      },
+      data: {
+        lastUsedAt: new Date(),
+        counter: verification.authenticationInfo.newCounter,
+      },
+    });
+
+    await onAuthorize({ userId: user.id }, c);
+
+    return c.json(
+      {
+        url: '/documents',
+      },
+      200,
+    );
+  });

packages/auth/server/routes/session.ts

@@ -0,0 +1,17 @@
+import { Hono } from 'hono';
+import superjson from 'superjson';
+
+import type { SessionValidationResult } from '../lib/session/session';
+import { getOptionalSession } from '../lib/utils/get-session';
+
+export const sessionRoute = new Hono()
+  .get('/session', async (c) => {
+    const session: SessionValidationResult = await getOptionalSession(c);
+
+    return c.json(session);
+  })
+  .get('/session-json', async (c) => {
+    const session: SessionValidationResult = await getOptionalSession(c);
+
+    return c.json(superjson.serialize(session));
+  });

packages/auth/server/routes/sign-out.ts

@@ -0,0 +1,27 @@
+import { Hono } from 'hono';
+
+import { invalidateSession, validateSessionToken } from '../lib/session/session';
+import { deleteSessionCookie, getSessionCookie } from '../lib/session/session-cookies';
+import type { HonoAuthContext } from '../types/context';
+
+export const signOutRoute = new Hono<HonoAuthContext>().post('/signout', async (c) => {
+  const metadata = c.get('requestMetadata');
+
+  const sessionId = await getSessionCookie(c);
+
+  if (!sessionId) {
+    return new Response('No session found', { status: 401 });
+  }
+
+  const { session } = await validateSessionToken(sessionId);
+
+  if (!session) {
+    return new Response('No session found', { status: 401 });
+  }
+
+  await invalidateSession(session.id, metadata);
+
+  deleteSessionCookie(c);
+
+  return c.status(200);
+});

packages/auth/server/routes/two-factor.ts

@@ -0,0 +1,151 @@
+import { sValidator } from '@hono/standard-validator';
+import { Hono } from 'hono';
+
+import { AppError } from '@documenso/lib/errors/app-error';
+import { disableTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/disable-2fa';
+import { enableTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/enable-2fa';
+import { setupTwoFactorAuthentication } from '@documenso/lib/server-only/2fa/setup-2fa';
+import { viewBackupCodes } from '@documenso/lib/server-only/2fa/view-backup-codes';
+import { prisma } from '@documenso/prisma';
+
+import { AuthenticationErrorCode } from '../lib/errors/error-codes';
+import { getSession } from '../lib/utils/get-session';
+import type { HonoAuthContext } from '../types/context';
+import {
+  ZDisableTwoFactorRequestSchema,
+  ZEnableTwoFactorRequestSchema,
+  ZViewTwoFactorRecoveryCodesRequestSchema,
+} from './two-factor.types';
+
+export const twoFactorRoute = new Hono<HonoAuthContext>()
+  /**
+   * Setup two factor authentication.
+   */
+  .post('/setup', async (c) => {
+    const { user } = await getSession(c);
+
+    const result = await setupTwoFactorAuthentication({
+      user,
+    });
+
+    return c.json({
+      success: true,
+      secret: result.secret,
+      uri: result.uri,
+    });
+  })
+
+  /**
+   * Enable two factor authentication.
+   */
+  .post('/enable', sValidator('json', ZEnableTwoFactorRequestSchema), async (c) => {
+    const requestMetadata = c.get('requestMetadata');
+
+    const { user: sessionUser } = await getSession(c);
+
+    const user = await prisma.user.findFirst({
+      where: {
+        id: sessionUser.id,
+      },
+      select: {
+        id: true,
+        email: true,
+        twoFactorEnabled: true,
+        twoFactorSecret: true,
+      },
+    });
+
+    if (!user) {
+      throw new AppError(AuthenticationErrorCode.InvalidRequest);
+    }
+
+    const { code } = c.req.valid('json');
+
+    const result = await enableTwoFactorAuthentication({
+      user,
+      code,
+      requestMetadata,
+    });
+
+    return c.json({
+      success: true,
+      recoveryCodes: result.recoveryCodes,
+    });
+  })
+
+  /**
+   * Disable two factor authentication.
+   */
+  .post('/disable', sValidator('json', ZDisableTwoFactorRequestSchema), async (c) => {
+    const requestMetadata = c.get('requestMetadata');
+
+    const { user: sessionUser } = await getSession(c);
+
+    const user = await prisma.user.findFirst({
+      where: {
+        id: sessionUser.id,
+      },
+      select: {
+        id: true,
+        email: true,
+        twoFactorEnabled: true,
+        twoFactorSecret: true,
+        twoFactorBackupCodes: true,
+      },
+    });
+
+    if (!user) {
+      throw new AppError(AuthenticationErrorCode.InvalidRequest);
+    }
+
+    const { totpCode, backupCode } = c.req.valid('json');
+
+    await disableTwoFactorAuthentication({
+      user,
+      totpCode,
+      backupCode,
+      requestMetadata,
+    });
+
+    return c.text('OK', 201);
+  })
+
+  /**
+   * View backup codes.
+   */
+  .post(
+    '/view-recovery-codes',
+    sValidator('json', ZViewTwoFactorRecoveryCodesRequestSchema),
+    async (c) => {
+      const { user: sessionUser } = await getSession(c);
+
+      const user = await prisma.user.findFirst({
+        where: {
+          id: sessionUser.id,
+        },
+        select: {
+          id: true,
+          email: true,
+          twoFactorEnabled: true,
+          twoFactorSecret: true,
+          twoFactorBackupCodes: true,
+        },
+      });
+
+      if (!user) {
+        throw new AppError(AuthenticationErrorCode.InvalidRequest);
+      }
+
+      const { token } = c.req.valid('json');
+
+      const backupCodes = await viewBackupCodes({
+        user,
+        token,
+      });
+
+      return c.json({
+        success: true,
+        backupCodes,
+      });
+    },
+  );

packages/auth/server/routes/two-factor.types.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+
+export const ZEnableTwoFactorRequestSchema = z.object({
+  code: z.string().min(6).max(6),
+});
+
+export type TEnableTwoFactorRequestSchema = z.infer<typeof ZEnableTwoFactorRequestSchema>;
+
+export const ZDisableTwoFactorRequestSchema = z.object({
+  totpCode: z.string().trim().optional(),
+  backupCode: z.string().trim().optional(),
+});
+
+export type TDisableTwoFactorRequestSchema = z.infer<typeof ZDisableTwoFactorRequestSchema>;
+
+export const ZViewTwoFactorRecoveryCodesRequestSchema = z.object({
+  token: z.string().trim().min(1),
+});
+
+export type TViewTwoFactorRecoveryCodesRequestSchema = z.infer<
+  typeof ZViewTwoFactorRecoveryCodesRequestSchema
+>;