Migrated auth to Nitro

server/api/auth/register.post.ts

@@ -0,0 +1,51 @@
+import { readBody, setCookie, setResponseStatus } from "h3"
+import argon2 from "argon2"
+import { User } from "../../models/user"
+import { REFRESH_COOKIE } from "../../utils/auth"
+import { getAuthValidationMessage } from "../../utils/auth-validation"
+
+export default defineEventHandler(async (event) => {
+	const body = await readBody(event)
+	const validationMessage = getAuthValidationMessage(body, [
+		{ name: "name" },
+		{ name: "email", email: true },
+		{ name: "password", minimumLength: 8 },
+	])
+	if (validationMessage) {
+		setResponseStatus(event, 400)
+		return { message: validationMessage }
+	}
+
+	const email = body.email.toLowerCase()
+	if (await User.findOne({ email })) {
+		setResponseStatus(event, 400)
+		return { message: "The email is already in use" }
+	}
+
+	try {
+		const user = await User.create({
+			name: body.name,
+			email,
+			passwordHash: await argon2.hash(body.password),
+		})
+		const refreshToken = await User.findById(user._id).select("+refreshToken").then((doc) => doc?.refreshToken)
+
+		if (!refreshToken) throw new Error("Unable to create refresh token")
+
+		setCookie(event, REFRESH_COOKIE, refreshToken, {
+			path: "/",
+			httpOnly: true,
+			sameSite: "lax",
+			secure: !import.meta.dev,
+		})
+		setResponseStatus(event, 201)
+		// Refresh credentials are now delivered only through the HttpOnly cookie.
+		return {}
+	} catch (error) {
+		if ((error as { code?: number }).code === 11000) {
+			setResponseStatus(event, 400)
+			return { message: "The email is already in use" }
+		}
+		throw error
+	}
+})

server/api/auth/session.get.ts

@@ -0,0 +1,35 @@
+import { getCookie, setCookie } from "h3"
+import { User } from "../../models/user"
+import { getSessionModel } from "../../models/session"
+import {
+	findAuthenticatedSession,
+	getSessionTtl,
+	REFRESH_COOKIE,
+	SESSION_COOKIE,
+} from "../../utils/auth"
+
+export default defineEventHandler(async (event) => {
+	const activeSession = await findAuthenticatedSession(event)
+	if (activeSession) {
+		return { authenticated: true, sessionToken: activeSession.session.token }
+	}
+
+	const refreshToken = getCookie(event, REFRESH_COOKIE)
+	if (!refreshToken) return { authenticated: false }
+
+	const user = await User.findOne({ refreshToken }).select("+refreshToken +verified")
+	if (!user?.verified) return { authenticated: false }
+
+	const ttl = getSessionTtl(event)
+	const Session = getSessionModel(ttl)
+	const session = await Session.create({ userId: user._id })
+	setCookie(event, SESSION_COOKIE, session.token, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: !import.meta.dev,
+		maxAge: Math.floor(ttl / 1000),
+	})
+
+	return { authenticated: true, sessionToken: session.token }
+})

server/api/auth/session.post.ts

@@ -0,0 +1,52 @@
+import { getCookie, readBody, setCookie, setResponseStatus } from "h3"
+import { User } from "../../models/user"
+import { getSessionModel } from "../../models/session"
+import {
+	getSessionTtl,
+	REFRESH_COOKIE,
+	SESSION_COOKIE,
+} from "../../utils/auth"
+import { getAuthValidationMessage } from "../../utils/auth-validation"
+
+export default defineEventHandler(async (event) => {
+	const body = await readBody(event).catch(() => undefined)
+	const validationMessage =
+		body === undefined ? null : getAuthValidationMessage(body, [{ name: "refreshToken" }])
+	if (validationMessage) {
+		setResponseStatus(event, 400)
+		return { message: validationMessage }
+	}
+
+	const refreshToken =
+		(typeof body?.refreshToken === "string" && body.refreshToken) ||
+		getCookie(event, REFRESH_COOKIE)
+
+	if (!refreshToken) {
+		setResponseStatus(event, 401)
+		return { message: "Invalid refresh token" }
+	}
+
+	const user = await User.findOne({ refreshToken }).select("+refreshToken")
+	if (!user) {
+		setResponseStatus(event, 401)
+		return { message: "Invalid refresh token" }
+	}
+
+	const ttl = getSessionTtl(event)
+	const Session = getSessionModel(ttl)
+	const session = await Session.create({ userId: user._id })
+	const expireAt = new Date(session.createdAt.getTime() + ttl)
+
+	setCookie(event, SESSION_COOKIE, session.token, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: !import.meta.dev,
+		maxAge: Math.floor(ttl / 1000),
+	})
+	setResponseStatus(event, 201)
+
+	// The response token remains for unmigrated frontend calls that still send
+	// Authorization: Bearer. The HttpOnly cookie serves migrated Nitro routes.
+	return { sessionToken: session.token, expireAt }
+})

server/api/auth/signin.post.ts

@@ -0,0 +1,47 @@
+import { readBody, setCookie, setResponseStatus } from "h3"
+import argon2 from "argon2"
+import { User } from "../../models/user"
+import { REFRESH_COOKIE } from "../../utils/auth"
+import { getAuthValidationMessage } from "../../utils/auth-validation"
+
+export default defineEventHandler(async (event) => {
+	const body = await readBody(event)
+	const validationMessage = getAuthValidationMessage(body, [
+		{ name: "email", email: true },
+		{ name: "password", minimumLength: 8 },
+	])
+	if (validationMessage) {
+		setResponseStatus(event, 400)
+		return { message: validationMessage }
+	}
+
+	const user = await User.findOne({ email: body.email.toLowerCase() }).select(
+		"+refreshToken +passwordHash",
+	)
+	let passwordMatches = false
+	if (user) {
+		try {
+			// Bun.password's default output is PHC Argon2id and argon2 verifies
+			// its encoded algorithm and parameters directly.
+			passwordMatches = await argon2.verify(user.passwordHash, body.password)
+		} catch {
+			// Malformed or unsupported stored hashes must not reveal account state.
+		}
+	}
+
+	if (!user || !passwordMatches) {
+		setResponseStatus(event, 400)
+		return { message: "The email or password is wrong" }
+	}
+
+	setCookie(event, REFRESH_COOKIE, user.refreshToken, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: !import.meta.dev,
+		...(body.remember ? { maxAge: 60 * 60 * 24 * 30 } : {}),
+	})
+	setResponseStatus(event, 200)
+	// The long-lived refresh token is deliberately omitted from the JSON body.
+	return {}
+})

server/api/auth/signout.post.ts

@@ -0,0 +1,8 @@
+import { deleteCookie } from "h3"
+import { REFRESH_COOKIE, SESSION_COOKIE } from "../../utils/auth"
+
+export default defineEventHandler((event) => {
+	deleteCookie(event, REFRESH_COOKIE, { path: "/", sameSite: "lax", secure: !import.meta.dev })
+	deleteCookie(event, SESSION_COOKIE, { path: "/", sameSite: "lax", secure: !import.meta.dev })
+	return { success: true }
+})