Authentication & Authorization

const sessionConfig = {
  maxAge: 60 * 60 * 24 * 360, // 360 days
  secret: process.env.SESSION_SECRET,
  cookieName: "keystonejs-session",
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
};

const authHeader = context.req.headers.authorization;

if (authHeader?.startsWith("Bearer ")) {
  const accessToken = authHeader.replace("Bearer ", "");
  
  // Find OAuth token in database
  const oauthToken = await context.sudo().query.OAuthToken.findOne({
    where: { token: accessToken },
    query: `id clientId scopes expiresAt tokenType isRevoked user { id }`
  });
  
  // Validate token
  if (oauthToken) {
    if (oauthToken.tokenType !== "access_token") return;
    if (oauthToken.isRevoked === "true") return;
    if (new Date() > new Date(oauthToken.expiresAt)) return;
    
    // Check if app is active
    const oauthApp = await context.sudo().query.OAuthApp.findOne({
      where: { clientId: oauthToken.clientId },
      query: `id status`
    });
    
    if (!oauthApp || oauthApp.status !== 'active') return;
    
    // Return session with OAuth scopes
    return { 
      itemId: oauthToken.user.id, 
      listKey: "User",
      oauthScopes: oauthToken.scopes
    };
  }
}

if (accessToken.startsWith("of_")) {
  // Get all active API keys
  const apiKeys = await context.sudo().query.ApiKey.findMany({
    where: { status: { equals: 'active' } },
    query: `
      id name scopes status expiresAt usageCount
      restrictedToIPs tokenSecret { isSet }
      user { id }
    `,
  });
  
  // Test token against each API key using bcrypt
  let matchingApiKey = null;
  for (const apiKey of apiKeys) {
    if (!apiKey.tokenSecret?.isSet) continue;
    
    const fullApiKey = await context.sudo().db.ApiKey.findOne({
      where: { id: apiKey.id },
    });
    
    // Verify using bcryptjs (same as Keystone password field)
    const isValid = await bcryptjs.compare(
      accessToken, 
      fullApiKey.tokenSecret
    );
    
    if (isValid) {
      matchingApiKey = apiKey;
      break;
    }
  }
  
  if (!matchingApiKey) return; // Invalid key
  
  // Check IP restrictions
  if (matchingApiKey.restrictedToIPs?.length > 0) {
    const clientIP = context.req.headers['x-forwarded-for'] || 
                     context.req.connection?.remoteAddress;
    
    if (!matchingApiKey.restrictedToIPs.includes(clientIP)) {
      return; // IP not allowed
    }
  }
  
  // Check expiration
  if (matchingApiKey.expiresAt && 
      new Date() > new Date(matchingApiKey.expiresAt)) {
    // Auto-revoke expired keys
    await context.sudo().query.ApiKey.updateOne({
      where: { id: matchingApiKey.id },
      data: { status: 'revoked' },
    });
    return;
  }
  
  // Update usage statistics
  const today = new Date().toISOString().split('T')[0];
  const usage = matchingApiKey.usageCount || { total: 0, daily: {} };
  usage.total = (usage.total || 0) + 1;
  usage.daily[today] = (usage.daily[today] || 0) + 1;
  
  context.sudo().query.ApiKey.updateOne({
    where: { id: matchingApiKey.id },
    data: {
      lastUsedAt: new Date(),
      usageCount: usage,
    },
  }).catch(console.error);
  
  // Return session with API key scopes
  return { 
    itemId: matchingApiKey.user.id, 
    listKey: "User",
    apiKeyScopes: matchingApiKey.scopes
  };
}

if (accessToken.startsWith('ctok_')) {
  // Find user by customer token
  const users = await context.sudo().query.User.findMany({
    where: { customerToken: { equals: accessToken } },
    take: 1,
    query: `
      id email name
      accounts(
        where: { 
          status: { equals: "active" }, 
          accountType: { equals: "business" } 
        }
      ) {
        id status availableCredit
      }
    `
  });
  
  const user = users[0];
  if (!user) return; // Invalid token
  
  // Require active business account
  const activeAccount = user.accounts?.[0];
  if (!activeAccount) return;
  
  // Return session with customer token flag
  return { 
    itemId: user.id, 
    listKey: "User",
    customerToken: true,
    activeAccountId: activeAccount.id
  };
}

export const Product = list({
  access: {
    operation: {
      query: () => true, // Public can query
      create: permissions.canManageProducts,
      update: permissions.canManageProducts,
      delete: permissions.canManageProducts,
    },
    filter: {
      query: ({ session }) => {
        // Only show published products to non-admins
        if (!permissions.canManageProducts({ session })) {
          return { status: { equals: "published" } };
        }
        return true; // Admins see all
      },
    },
  },
  // ... fields
});

export const permissions = {
  canAccessDashboard: ({ session }) => {
    return !!session?.data?.role?.canAccessDashboard;
  },
  
  canManageProducts: ({ session }) => {
    return !!session?.data?.role?.canManageProducts;
  },
  
  canManageOrders: ({ session }) => {
    return !!session?.data?.role?.canManageOrders;
  },
  
  // ... more permission checks
};

// Filter rules for query restrictions
export const rules = {
  canManageUsers: ({ session }) => {
    if (!session) return false;
    
    // Admins can manage all users
    if (permissions.canManageUsers({ session })) {
      return true;
    }
    
    // Users can only manage themselves
    return { id: { equals: session.itemId } };
  },
};