CultivaHub — Arquitectura de Autenticación y Autorización

// ─── CultivaHub · JWT Service ────────────────────────────────────
import jwt from 'jsonwebtoken';

interface JWTPayload {
  userId: string;
  email: string;
  role: 'admin' | 'manager' | 'viewer';
  workspaceId: string;   // multitenancy de CultivaHub
}

/** Genera par access + refresh token */
export function generateTokens(payload: JWTPayload) {
  const accessToken = jwt.sign(payload, process.env.JWT_SECRET!, {
    expiresIn: '15m',          // corto · renovar con refresh
  });
  const refreshToken = jwt.sign(
    { userId: payload.userId },
    process.env.JWT_REFRESH_SECRET!,
    { expiresIn: '7d' }
  );
  return { accessToken, refreshToken };
}

/** Middleware: valida Bearer token y adjunta req.user */
export function authenticate(req, res, next) {
  const token = req.headers.authorization?.substring(7);
  if (!token) return res.status(401).json({ error: 'Sin token' });
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET!);
    next();
  } catch {
    res.status(401).json({ error: 'Token inválido o expirado' });
  }
}

import { Strategy as GoogleStrategy } from 'passport-google-oauth20';

passport.use(new GoogleStrategy({
  clientID:     process.env.GOOGLE_CLIENT_ID!,
  clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
  callbackURL:  '/api/auth/google/callback',
}, async (_, __, profile, done) => {
  let user = await db.users.findOne({ googleId: profile.id });

  if (!user) {
    user = await db.users.create({
      googleId:    profile.id,
      email:       profile.emails?.[0]?.value,
      name:        profile.displayName,
      role:        'viewer',       // rol mínimo por defecto
      workspaceId: await resolveWorkspace(profile.emails?.[0]?.value),
    });
  }
  return done(null, user);
}));

// Ruta de callback — emite JWT en cookie httpOnly
app.get('/api/auth/google/callback',
  passport.authenticate('google', { session: false }),
  (req, res) => {
    const { accessToken, refreshToken } = generateTokens(req.user);
    res.cookie('refreshToken', refreshToken, {
      httpOnly: true, secure: true, sameSite: 'strict', maxAge: 604800000
    });
    res.redirect(`${process.env.FRONTEND_URL}/dashboard?token=${accessToken}`);
  }
);

enum Role { ADMIN = 'admin', MANAGER = 'manager', VIEWER = 'viewer' }

// Jerarquía: admin hereda todos los permisos de manager y viewer
const roleHierarchy: Record<Role, Role[]> = {
  [Role.ADMIN]:   [Role.ADMIN, Role.MANAGER, Role.VIEWER],
  [Role.MANAGER]: [Role.MANAGER, Role.VIEWER],
  [Role.VIEWER]:  [Role.VIEWER],
};

export function requireRole(...roles: Role[]) {
  return (req, res, next) => {
    if (!req.user) return res.status(401).json({ error: 'No autenticado' });
    const allowed = roles.some(r => roleHierarchy[req.user.role]?.includes(r));
    if (!allowed) return res.status(403).json({ error: 'Permisos insuficientes' });
    next();
  };
}

// Ejemplos de uso en las rutas de CultivaHub
router.delete('/workspaces/:id', authenticate, requireRole(Role.ADMIN), deleteWorkspace);
router.post('/campaigns',    authenticate, requireRole(Role.MANAGER), createCampaign);
router.get('/campaigns',     authenticate, requireRole(Role.VIEWER), listCampaigns);