auth.service.ts

import {
  BadRequestException,
  Injectable,
  UnauthorizedException,
} from "@nestjs/common";
import { ConfigService } from "@nestjs/config";
import { AuthEventType } from "@prisma/client";
import { Keypair, StrKey } from "@stellar/stellar-base";
import { createHash, randomBytes } from "crypto";
import { PrismaService } from "../database/prisma.service";
import { sha256 } from "../common/crypto/hash";
import { AuthAuditService } from "./auth-audit.service";
import { AuthRateLimiterService } from "./auth-rate-limiter.service";
import { SessionService } from "./session.service";

@Injectable()
export class AuthService {
  private readonly appUrl: string;
  private readonly networkPassphrase: string;

  constructor(
    private readonly prisma: PrismaService,
    private readonly sessionService: SessionService,
    private readonly auditService: AuthAuditService,
    private readonly rateLimiter: AuthRateLimiterService,
    configService: ConfigService,
  ) {
    this.appUrl = configService.getOrThrow<string>("appUrl");
    this.networkPassphrase = configService.getOrThrow<string>(
      "stellar.networkPassphrase",
    );
  }

  async createChallenge(walletAddress: string, clientMetadata?: string) {
    this.assertValidPublicKey(walletAddress);

    // Check rate limits before creating challenge
    await this.rateLimiter.checkChallengeCreationLimit(
      walletAddress,
      clientMetadata,
    );

    const nonce = randomBytes(24).toString("base64url");
    const expiresAt = new Date(Date.now() + 5 * 60 * 1000);
    const message = [
      "EarnProof wallet authentication",
      `Domain: ${this.appUrl}`,
      `Network: ${this.networkPassphrase}`,
      `Wallet: ${walletAddress}`,
      `Nonce: ${nonce}`,
      `Expires At: ${expiresAt.toISOString()}`,
    ].join("\n");

    const challenge = await this.prisma.walletChallenge.create({
      data: {
        walletAddress,
        nonceHash: sha256(nonce),
        message,
        expiresAt,
      },
      select: {
        id: true,
        message: true,
        expiresAt: true,
      },
    });

    // Record successful challenge creation
    await this.auditService.recordEvent(
      AuthEventType.CHALLENGE_CREATED,
      walletAddress,
      {
        challengeId: challenge.id,
        success: true,
        clientMetadata,
      },
    );

    return challenge;
  }

  async verifyChallenge(input: {
    challengeId: string;
    walletAddress: string;
    signature: string;
    clientMetadata?: string;
  }) {
    this.assertValidPublicKey(input.walletAddress);

    // Check rate limits before verification attempt
    await this.rateLimiter.checkVerificationLimit(
      input.walletAddress,
      input.clientMetadata,
    );

    // Atomically mark the challenge as consumed only if it exists, is not used,
    // and is not expired. This closes the TOCTOU window in which two concurrent
    // requests could both pass an existence check before either marked it used.
    // Atomically mark challenge as consumed only if it exists, is not used, and is not expired.
    // This prevents TOCTOU race conditions where multiple concurrent requests could both
    // pass the existence check before any are marked as used.
    const consumedChallenge = await this.prisma.walletChallenge.updateMany({
      where: {
        id: input.challengeId,
        walletAddress: input.walletAddress,
        usedAt: null, // Not yet consumed
        expiresAt: {
          gt: new Date(), // Not expired
        },
      },
      data: {
        usedAt: new Date(),
      },
    });

    if (consumedChallenge.count === 0) {
      // Nothing was consumed: the challenge was already used (a replay), or it
      // expired or never existed. The two are audited separately; both return
      // the same message, so the caller learns nothing either way.
      // The atomic update matched nothing — either the challenge doesn't
      // exist, was already consumed (replay), or is expired. Distinguish
      // those for the audit trail with a read-only lookup; this happens
      // after the fact, so it cannot reintroduce the race the update above
      // closes.
      const usedChallenge = await this.prisma.walletChallenge.findFirst({
        where: {
          id: input.challengeId,
          walletAddress: input.walletAddress,
          usedAt: { not: null },
        },
      });

      if (usedChallenge) {
        await this.auditService.recordEvent(
          AuthEventType.CHALLENGE_REPLAYED,
          input.walletAddress,
          {
            challengeId: input.challengeId,
            success: false,
            failureReason: "Challenge already used",
            clientMetadata: input.clientMetadata,
          },
        );
      } else {
        await this.auditService.recordEvent(
          AuthEventType.CHALLENGE_EXPIRED,
          input.walletAddress,
          {
            challengeId: input.challengeId,
            success: false,
            failureReason: "Challenge expired or not found",
            clientMetadata: input.clientMetadata,
          },
        );
      }

      throw new UnauthorizedException("Challenge is expired or unavailable");
    }

    // Fetch the challenge again to get the message for signature verification.
    // It is already marked used, so a failed verification cannot be retried.
    // The challenge is now marked as used, so even if verification fails, it cannot be reused.
    const challenge = await this.prisma.walletChallenge.findUnique({
      where: {
        id: input.challengeId,
      },
    });

    if (!challenge) {
      // Unreachable unless the row was deleted between the two statements;
      // safeguarded rather than dereferenced.
      // Should be unreachable: updateMany just matched and updated this row,
      // so it exists. Safeguard against a concurrent deletion between the
      // two statements.
      throw new UnauthorizedException("Challenge is expired or unavailable");
    }

    const isValid = this.verifySignature(
      input.walletAddress,
      challenge.message,
      input.signature,
    );

    if (!isValid) {
      await this.auditService.recordEvent(
        AuthEventType.SIGNATURE_INVALID,
        input.walletAddress,
        {
          challengeId: input.challengeId,
          success: false,
          failureReason: "Invalid signature",
          clientMetadata: input.clientMetadata,
        },
      );

      throw new UnauthorizedException("Invalid wallet signature");
    }

    const walletHash = `sha256:${sha256(input.walletAddress)}`;
    const user = await this.prisma.user.upsert({
      where: { walletAddress: input.walletAddress },
      update: { walletHash, lastLoginAt: new Date() },
      create: {
        walletAddress: input.walletAddress,
        walletHash,
        lastLoginAt: new Date(),
      },
    });

    // Create a persisted, revocable session.  Only the hash is stored.
    const { token, sessionId, expiresAt } = await this.sessionService.create({
      id: user.id,
      walletAddress: user.walletAddress,
      walletHash: user.walletHash,
      role: user.role,
    });

    // Record successful verification
    await this.auditService.recordEvent(
      AuthEventType.CHALLENGE_VERIFIED,
      input.walletAddress,
      {
        challengeId: input.challengeId,
        success: true,
        clientMetadata: input.clientMetadata,
      },
    );

    return {
      user: {
        id: user.id,
        walletAddress: user.walletAddress,
        walletHash: user.walletHash,
        role: user.role,
      },
      session: {
        token,
        tokenType: "Bearer",
        sessionId,
        expiresAt,
      },
    };
  }

  async getSession(userId: string) {
    const user = await this.prisma.user.findUnique({
      where: { id: userId },
      select: {
        id: true,
        walletAddress: true,
        walletHash: true,
        role: true,
        status: true,
        lastLoginAt: true,
      },
    });

    if (!user) {
      throw new UnauthorizedException("User session is no longer valid");
    }

    return { user };
  }

  /**
   * Revoke the caller's active session server-side.
   * The sessionId is extracted from the authenticated request context by
   * the controller — the raw token is never passed here.
   */
  async logout(sessionId: string): Promise<void> {
    await this.sessionService.revoke(sessionId);
  }

  // ---------------------------------------------------------------------------
  // Private helpers
  // ---------------------------------------------------------------------------

  private verifySignature(
    walletAddress: string,
    message: string,
    signature: string,
  ) {
    const signatureBuffer = this.decodeSignature(signature);
    return Keypair.fromPublicKey(walletAddress).verify(
      this.sep53MessageHash(message),
      signatureBuffer,
    );
  }

  private sep53MessageHash(message: string) {
    return createHash("sha256")
      .update("Stellar Signed Message:\n", "utf8")
      .update(message, "utf8")
      .digest();
  }

  private decodeSignature(signature: string) {
    if (/^[a-f0-9]+$/i.test(signature) && signature.length % 2 === 0) {
      return Buffer.from(signature, "hex");
    }
    return Buffer.from(signature, "base64");
  }

  private assertValidPublicKey(walletAddress: string) {
    if (!StrKey.isValidEd25519PublicKey(walletAddress)) {
      throw new BadRequestException("Invalid Stellar public key");
    }
  }
}