`DW-Agents/dw-agents/DWLegalTeam/shared-auth.ts`

93 lines
/**
 * Shared Authentication System for DW-Agents
 *
 * Provides Single Sign-On (SSO) across all agents
 * Login once on Master Hub, stay logged in everywhere
 */

import { Request, Response, NextFunction } from 'express';

export const AUTH_USERNAME = 'admin';
export const AUTH_PASSWORD = '2025';
export const SSO_TOKEN_NAME = 'dw_agents_sso_token';
export const SSO_TOKEN_VALUE = 'dw-agents-authenticated-2025-session';

export interface AuthRequest extends Request {
  session: any;
}

/**
 * Check if user is authenticated via session or SSO token
 */
export function isAuthenticated(req: AuthRequest): boolean {
  // Check session first
  if (req.session && req.session.authenticated) {
    return true;
  }

  // Check SSO cookie
  if (req.cookies && req.cookies[SSO_TOKEN_NAME] === SSO_TOKEN_VALUE) {
    // Set session as authenticated
    if (req.session) {
      req.session.authenticated = true;
    }
    return true;
  }

  return false;
}

/**
 * Set SSO token cookie
 */
export function setSSOToken(res: Response) {
  res.cookie(SSO_TOKEN_NAME, SSO_TOKEN_VALUE, {
    httpOnly: true,
    maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
    path: '/',
    sameSite: 'lax'
  });
}

/**
 * Authentication middleware with SSO support
 */
export function requireAuth(req: AuthRequest, res: Response, next: NextFunction) {
  if (isAuthenticated(req)) {
    return next();
  }

  // Redirect to login with return URL
  const returnUrl = encodeURIComponent(req.originalUrl);
  res.redirect(`/login?return=${returnUrl}`);
}

/**
 * Handle login and set SSO token
 */
export function handleLogin(username: string, password: string, req: AuthRequest, res: Response, returnUrl?: string) {
  if (username === AUTH_USERNAME && password === AUTH_PASSWORD) {
    // Set session
    req.session.authenticated = true;

    // Set SSO cookie
    setSSOToken(res);

    // Redirect to return URL or home
    const redirect = returnUrl || '/';
    res.redirect(redirect);
    return true;
  }
  return false;
}

/**
 * Logout and clear SSO token
 */
export function handleLogout(req: AuthRequest, res: Response) {
  req.session.destroy(() => {
    res.clearCookie(SSO_TOKEN_NAME);
    res.redirect('/login');
  });
}