prvng_platform/crates/control-center/src/auth/mod.rs

//! Authentication and Authorization Module
//!
//! Comprehensive authentication system with JWT tokens, password hashing,
//! user management, and Cedar policy integration.
//!
//! # Architecture
//!
//! ```text
//! ┌─────────────────────────────────────────┐
//! │     Authentication Module               │
//! ├─────────────────────────────────────────┤
//! │                                         │
//! │  ┌──────────────┐  ┌─────────────────┐ │
//! │  │ JWT Service  │  │ Password Service│ │
//! │  │              │  │                 │ │
//! │  │ • Generate   │  │ • Hash (Argon2) │ │
//! │  │ • Validate   │  │ • Verify        │ │
//! │  │ • Rotate     │  │ • Strength      │ │
//! │  │ • Revoke     │  └─────────────────┘ │
//! │  └──────────────┘                      │
//! │         │                              │
//! │         ▼                              │
//! │  ┌──────────────┐                     │
//! │  │ User Service │                     │
//! │  │              │                     │
//! │  │ • Create     │                     │
//! │  │ • Login      │                     │
//! │  │ • Logout     │                     │
//! │  │ • Update     │                     │
//! │  └──────────────┘                     │
//! └─────────────────────────────────────────┘
//! ```
//!
//! # Token Flow
//!
//! ```text
//! 1. Login Request
//!    ↓
//! 2. Validate Credentials (Password Service)
//!    ↓
//! 3. Generate Token Pair (JWT Service)
//!    ├─ Access Token (15 min)
//!    └─ Refresh Token (7 days)
//!    ↓
//! 4. Return Token Pair
//!    ↓
//! 5. Client Uses Access Token
//!    ↓
//! 6. Access Token Expires
//!    ↓
//! 7. Rotate Using Refresh Token
//!    ↓
//! 8. New Token Pair Generated
//! ```
//!
//! # Security Features
//!
//! - **RS256 Asymmetric Signing**: Enhanced security over symmetric HMAC
//! - **Token Rotation**: Automatic rotation before expiry
//! - **Token Revocation**: Blacklist-based revocation
//! - **Password Hashing**: Argon2id (memory-hard, side-channel resistant)
//! - **Cedar Integration**: Permissions hash for quick validation
//! - **Thread-Safe**: Arc + RwLock for concurrent access
//!
//! # Usage Example
//!
//! ```no_run
//! # use control_center::auth::{JwtService, PasswordService, User};
//! # async fn example() -> Result<(), Box<dyn std::error::Error>> {
//! // Initialize services
//! let private_key = std::fs::read("keys/private.pem")?;
//! let public_key = std::fs::read("keys/public.pem")?;
//!
//! let jwt_service = JwtService::new(
//!     &private_key,
//!     &public_key,
//!     "control-center",
//!     vec!["orchestrator".to_string(), "cli".to_string()],
//! )?;
//!
//! let password_service = PasswordService::new();
//!
//! // Create user with hashed password
//! let password_hash = password_service.hash_password("secure_password")?;
//! let user = User {
//!     id: "user123".to_string(),
//!     username: "alice".to_string(),
//!     password_hash,
//!     // ... other fields
//! };
//!
//! // Login: verify password and generate tokens
//! if password_service.verify_password("secure_password", &user.password_hash)? {
//!     let tokens = jwt_service.generate_token_pair(
//!         &user.id,
//!         "workspace1",
//!         "permissions_hash",
//!         None,
//!     )?;
//!
//!     println!("Access token: {}", tokens.access_token);
//!     println!("Expires in: {} seconds", tokens.expires_in);
//! }
//!
//! // Validate token
//! let claims = jwt_service.validate_token(&tokens.access_token)?;
//! println!("User: {}, Workspace: {}", claims.sub, claims.workspace);
//!
//! // Rotate token before expiry
//! if claims.needs_rotation() {
//!     let new_tokens = jwt_service.rotate_token(&tokens.refresh_token)?;
//!     println!("New access token: {}", new_tokens.access_token);
//! }
//!
//! // Revoke token (logout)
//! jwt_service.revoke_token(&claims.jti, claims.exp)?;
//! # Ok(())
//! # }
//! ```

pub mod jwt;
pub mod password;
pub mod user;

// Re-export commonly used types
use std::collections::HashMap;
use std::sync::Arc;

pub use jwt::{BlacklistStats, JwtService, TokenClaims, TokenPair, TokenType};
pub use password::{PasswordService, PasswordStrength};
pub use user::{User, UserRole, UserService, UserStatus};

use crate::error::{auth, http, infrastructure, ControlCenterError, Result};
#[cfg(feature = "mfa")]
use crate::mfa::MfaService;

/// Unified authentication service combining JWT, password, and MFA management
#[allow(clippy::manual_non_exhaustive)]
pub struct AuthService {
    /// JWT token service
    pub jwt: Arc<JwtService>,

    /// Password management service
    pub password: Arc<PasswordService>,

    /// User management service
    pub user: Arc<UserService>,

    /// MFA service (optional)
    #[cfg(feature = "mfa")]
    pub mfa: Option<Arc<MfaService>>,

    /// MFA service placeholder when feature is disabled
    #[cfg(not(feature = "mfa"))]
    _mfa_placeholder: (),
}

impl AuthService {
    /// Create new authentication service
    ///
    /// # Arguments
    /// * `jwt_service` - JWT token service
    /// * `password_service` - Password management service
    /// * `user_service` - User management service
    pub fn new(
        jwt_service: JwtService,
        password_service: PasswordService,
        user_service: UserService,
    ) -> Self {
        #[cfg(feature = "mfa")]
        {
            Self {
                jwt: Arc::new(jwt_service),
                password: Arc::new(password_service),
                user: Arc::new(user_service),
                mfa: None,
            }
        }
        #[cfg(not(feature = "mfa"))]
        {
            Self {
                jwt: Arc::new(jwt_service),
                password: Arc::new(password_service),
                user: Arc::new(user_service),
                _mfa_placeholder: (),
            }
        }
    }

    /// Create new authentication service with MFA support
    #[cfg(feature = "mfa")]
    pub fn with_mfa(
        jwt_service: JwtService,
        password_service: PasswordService,
        user_service: UserService,
        mfa_service: MfaService,
    ) -> Self {
        Self {
            jwt: Arc::new(jwt_service),
            password: Arc::new(password_service),
            user: Arc::new(user_service),
            mfa: Some(Arc::new(mfa_service)),
        }
    }

    /// Authenticate user and generate token pair
    ///
    /// # Arguments
    /// * `username` - Username or email
    /// * `password` - Plain text password
    /// * `workspace` - Workspace identifier
    ///
    /// # Returns
    /// Token pair on successful authentication (or partial token if MFA
    /// required)
    pub async fn login(
        &self,
        username: &str,
        password: &str,
        workspace: &str,
    ) -> Result<TokenPair> {
        // Find user
        let user = self.user.find_by_username(username).await?.ok_or_else(|| {
            ControlCenterError::Auth(auth::AuthError::Authentication(
                "Invalid credentials".to_string(),
            ))
        })?;

        // Check user status
        if user.status != UserStatus::Active {
            return Err(ControlCenterError::Auth(auth::AuthError::Authentication(
                format!("User account is {}", user.status),
            )));
        }

        // Verify password
        if !self
            .password
            .verify_password(password, &user.password_hash)?
        {
            return Err(ControlCenterError::Auth(auth::AuthError::Authentication(
                "Invalid credentials".to_string(),
            )));
        }

        // Check if MFA is required
        #[cfg(feature = "mfa")]
        {
            if let Some(ref mfa_service) = self.mfa {
                if mfa_service.user_has_mfa(&user.id).await? {
                    // Return partial token - user must complete MFA
                    // The token has limited permissions and expires in 5 minutes
                    let mut metadata = HashMap::new();
                    metadata.insert("mfa_required".to_string(), "true".to_string());
                    metadata.insert("ttl".to_string(), "300".to_string());
                    return self.jwt.generate_token_pair(
                        &user.id,
                        workspace,
                        "mfa_pending",
                        Some(metadata),
                    );
                }
            }
        }

        // Update last login
        self.user.update_last_login(&user.id).await?;

        // Generate permissions hash from user roles
        let permissions_hash = self.generate_permissions_hash(&user.roles);

        // Generate token pair
        self.jwt
            .generate_token_pair(&user.id, workspace, &permissions_hash, None)
    }

    /// Complete MFA verification and upgrade partial token to full access
    ///
    /// # Arguments
    /// * `partial_token` - Partial access token from initial login
    /// * `mfa_code` - MFA verification code (TOTP or backup code)
    ///
    /// # Returns
    /// Full access token pair on successful MFA verification
    #[cfg(feature = "mfa")]
    pub async fn complete_mfa_login(
        &self,
        partial_token: &str,
        mfa_code: &str,
    ) -> Result<TokenPair> {
        // Validate partial token
        let claims = self.jwt.validate_token(partial_token)?;

        // Verify it's a pending MFA token
        if claims.permissions_hash != "mfa_pending" {
            return Err(ControlCenterError::Auth(auth::AuthError::Authentication(
                "Invalid MFA token".to_string(),
            )));
        }

        // Get MFA service
        let mfa_service = self.mfa.as_ref().ok_or_else(|| {
            ControlCenterError::Infrastructure(infrastructure::InfrastructureError::Internal(
                "MFA not configured".to_string(),
            ))
        })?;

        // Get user for email
        let user = self.user.find_by_id(&claims.sub).await?.ok_or_else(|| {
            ControlCenterError::Http(http::HttpError::NotFound("User not found".to_string()))
        })?;

        // Verify MFA code
        let verification = mfa_service
            .verify_any_mfa(&user.id, &user.email, mfa_code)
            .await?;

        if !verification.verified {
            return Err(ControlCenterError::Auth(auth::AuthError::Authentication(
                "Invalid MFA code".to_string(),
            )));
        }

        // Revoke partial token
        self.jwt.revoke_token(&claims.jti, claims.exp)?;

        // Update last login
        self.user.update_last_login(&user.id).await?;

        // Generate full permissions hash
        let permissions_hash = self.generate_permissions_hash(&user.roles);

        // Generate full access token pair
        self.jwt
            .generate_token_pair(&user.id, &claims.workspace, &permissions_hash, None)
    }

    /// Logout user by revoking tokens
    pub async fn logout(&self, access_token: &str) -> Result<()> {
        let claims = self.jwt.validate_token(access_token)?;
        self.jwt.revoke_token(&claims.jti, claims.exp)?;
        Ok(())
    }

    /// Validate access token and return claims
    pub fn validate(&self, token: &str) -> Result<TokenClaims> {
        self.jwt.validate_token(token)
    }

    /// Rotate tokens using refresh token
    pub fn refresh(&self, refresh_token: &str) -> Result<TokenPair> {
        self.jwt.rotate_token(refresh_token)
    }

    /// Generate permissions hash from user roles
    ///
    /// This creates a stable hash of the user's Cedar permissions
    /// for quick validation without policy evaluation
    fn generate_permissions_hash(&self, roles: &[UserRole]) -> String {
        use sha2::{Digest, Sha256};

        let mut hasher = Sha256::new();
        for role in roles {
            hasher.update(role.to_string().as_bytes());
        }

        format!("{:x}", hasher.finalize())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn create_test_jwt_service() -> JwtService {
        // Pre-generated RSA keys to avoid runtime key generation (avoids rand_core
        // conflict)
        let private_pem = b"-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7F43HxrVfJJ+k
DQMEjENGqJLnBn6MvJnCu93A4ZNKEEpPGX1Y6V+qiqLH5B7wNMIJ2QVnLjYjKZu5
K5LkVCH8N7N1s9QXiLI7TzQVEH2TQx3MzQFRmVzGlyVFxF0qMHf/mNlZvE0Hb9oI
YdYnBW5k4TRmzrN4THEbWqLcGVVfMVFQqG1j/V3G5dTpV1sN8a9xqJG0dKNmVP2M
H5JG3kQ8CxFqp7pRsGvqH9IVjB6KXj8L3VPQYJxIBKHGZMlsP9SVqH3vwqLLKcBj
G2UvhkVYJ6ZLvYIj7LvZKrCBrP3h5Q7hYpXZqDGYd5dDwWFJ3xkVMkJMGR3D3VrK
R1jvJTEhAgMBAAECggEAXV2TZjfRbhR0IaqU3bpSZvb+6uL+5OgWRO5VbG0XGFmv
1v+2F5hQEZYKKxZvTlF4IxN1J0YQRKt4BG6PZqN9+Uj8z7DVEDqiWLIZSEhUPzVu
E3IKZaEqvGKvEwBglmfqnE6cEZ2Kb9aOx1a5N8UH5q7xQ2d4YxKfYwRBkDYEZmZp
R4tEb0qfKFgIGmCfK5fNvJqXvH/f1xq9QW1qrGYqGAqh7bkxvXGfkRBXh7Q8sAXW
B2XQ8L9CZV5lsP0F7n8nKvDVKfqZfGXlZJZQvJPF5L8p6g7V7uE+6bZlF4YZLRvW
2aq2xZR6bGCWxBpLb2lG1QU0aJLqVmVjAQYDM9PB0QKBgQDfhKn8F5aITVFJhVVu
BN8F2hLRtFDfSPTN0JM1WZq/EqYdLjnlAY8L7kBBzNaKgOGBRqfO1lVv7DG4vPtX
nrLaM3SU3F0lC8tVwqJTUvZS5/Pl3wqAZRlWbWm4Yp6gWXlGPTaWRpGRBOqB+rWP
b8rX2SnZjvFlQZlZPfvHGWpkFQKBgQDYtvXAGNdj8hMZ6mMUKYv3YbF7F2xUlf1x
H0f8I5QGPiZoqzNGJXCEGvNVNEUgR7LY6AeqWtLqRKJsQ5NYb2XzLhA2BVOV1BV2
Z1Y3s0V5XjFE4q7gWmEcLlWyEiKiRCRQC4T7qB+gUQ8lFBrGqQ4vZqE+7pQyYfCt
1yFQnvqrQQKBgQCcvCvE4wMhF2lYFxM4v8qCDXJ9nLMKjYPFn3C0YrP6Zn2Pm7r3
fJGDVBmN5wVLDXqZnSrmh0iBs7PdBqeHALF7jTj9X8tNe+hpXwQ/GWSF8b3q1b6k
wZLhKpJQGpYH0M3l7B6rrM3Vr1E/DQjXvXdqXrL3vKfHQrEk3c9zVCkfTQKBgGVl
qdvBYvdgWHvPzL3+vqvLPVKDnLjN6hXA2cJGaBNpOlm+bI5cJLLnWhJrjCkK+POo
0oPKvnO5qKQjRDWLVCJH3z8MxPjqV6Yk1hAg/4vqV3oQsJDfU3qiDPAHrBbKBlRm
4KYmEqIhqNYJqXN7nnQFOLYFxOaXKqe6HBh1g4QBAoGBAIRXPwKJhwIUfLJ8DQAO
9z9YH3eIiGkLxF8f7WZvVnNwMEpXl4IqN8N3qGXKJfXJI1YfBKXN7LOqCOVFGkVq
JkVN8qPTwAKU8E2U3dGzQVPP2JmGPPNyZJxQJ3sYtKnLkz2YdEbKDhkG5wPDHKKu
LfEK1YMqL/VvAJdIXxqZqDXf
-----END PRIVATE KEY-----";

        let public_pem = b"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuxeNx8a1XySfpA0DBIxD
RqiS5wZ+jLyZwrvdwOGTShBKTxl9WOlfqoqix+Qe8DTCCdkFZy42IymbhSuS5FQh
/DezdLPUF4iyO080FRB9k0MdzM0BUZlcxpclRcRdKjB3/5jZWbxNB2/aCGHWJwVu
ZOE0Zs6zeExxG1qi3BlVXzFRUKhtY/1dxuXU6Vdbl/GvcaiRtHSjZlT9jB+SRt5E
PAsTaqe6UbBr6h/SFYweil4/C91T0GCcSAShxmTJbD/Ulah978KizynAYxtlL4ZF
WCemS72CI+y72SqwgaZ94eUO4WKV2agxmHeXQ8FhSd8ZFTJCTBKDW91Kykdo7yUx
IQIDAQAB
-----END PUBLIC KEY-----";

        JwtService::new(
            private_pem,
            public_pem,
            "test-issuer",
            vec!["test-audience".to_string()],
        )
        .unwrap()
    }

    #[test]
    fn test_auth_service_creation() {
        let jwt_service = create_test_jwt_service();
        let password_service = PasswordService::new();
        let user_service = UserService::new();

        let auth_service = AuthService::new(jwt_service, password_service, user_service);

        assert!(Arc::strong_count(&auth_service.jwt) >= 1);
        assert!(Arc::strong_count(&auth_service.password) >= 1);
        assert!(Arc::strong_count(&auth_service.user) >= 1);
    }

    #[test]
    fn test_permissions_hash_generation() {
        let jwt_service = create_test_jwt_service();
        let password_service = PasswordService::new();
        let user_service = UserService::new();

        let auth_service = AuthService::new(jwt_service, password_service, user_service);

        let roles = vec![UserRole::Admin, UserRole::Developer];
        let hash1 = auth_service.generate_permissions_hash(&roles);
        let hash2 = auth_service.generate_permissions_hash(&roles);

        // Hash should be deterministic
        assert_eq!(hash1, hash2);
        assert_eq!(hash1.len(), 64); // SHA256 hex = 64 chars
    }
}