Module 4 - Méthodes d'authentification avancées

# Configuration SMS MFA
mfa:
  methods:
    - sms
    
  sms:
    provider: "twilio"
    accountSid: "ACXXXXXXXXXXXXXXXXXXXX"
    authToken: "your_twilio_auth_token"
    fromNumber: "+15551234567"
    
    # Template du message
    messageTemplate: "Votre code de vérification: {{code}}"
    
    # Sécurité
    codeLength: 6
    expiryMinutes: 5
    maxAttempts: 3
    
    # Limitation par pays
    allowedCountries: ["FR", "BE", "CH", "CA"]

# Configuration Email MFA
mfa:
  methods:
    - email
    
  email:
    # Configuration SMTP
    host: "smtp.gmail.com"
    port: 587
    secure: false
    user: "noreply@mondomaine.com"
    pass: "mot_de_passe_application"
    
    # Template de l'email
    subject: "Code de vérification - {{siteName}}"
    template: |
      Bonjour {{userName}},
      
      Votre code de vérification: {{code}}
      
      Ce code expire dans {{expiryMinutes}} minutes.
      
    # Sécurité
    codeLength: 8
    expiryMinutes: 10
    alphanumeric: true

# Configuration WebAuthn/FIDO2
mfa:
  methods:
    - webauthn
    
  webauthn:
    # Configuration du Relying Party
    rpName: "MonWiki"
    rpId: "wiki.mondomaine.com"
    origin: "https://wiki.mondomaine.com"
    
    # Types d'authentificateurs acceptés
    authenticatorSelection:
      authenticatorAttachment: "cross-platform"  # ou "platform"
      userVerification: "required"
      residentKey: "preferred"
      
    # Algorithmes cryptographiques
    supportedAlgorithms: [-7, -35, -36, -257, -258, -259]
    
    # Timeout
    timeout: 60000  # 60 secondes
    
    # Attestation (validation des clés)
    attestation: "none"  # "direct", "indirect", ou "none"

// Middleware de validation JWT personnalisé
const jwt = require('jsonwebtoken');
const redis = require('redis');

class JWTValidator {
  constructor(options) {
    this.publicKey = options.publicKey;
    this.algorithms = options.algorithms || ['RS256'];
    this.issuer = options.issuer;
    this.audience = options.audience;
    this.redis = redis.createClient(options.redis);
  }

  async validateToken(token) {
    try {
      // 1. Vérification de la signature et des claims standards
      const decoded = jwt.verify(token, this.publicKey, {
        algorithms: this.algorithms,
        issuer: this.issuer,
        audience: this.audience,
        clockTolerance: 30 // tolérance de 30 secondes
      });

      // 2. Vérifier si le token n'est pas en blacklist
      const isBlacklisted = await this.isTokenBlacklisted(decoded.jti);
      if (isBlacklisted) {
        throw new Error('Token is blacklisted');
      }

      // 3. Vérifications métier personnalisées
      if (!this.validateCustomClaims(decoded)) {
        throw new Error('Custom claims validation failed');
      }

      // 4. Vérifier la freshness (optionnel)
      if (decoded.iat < Date.now() / 1000 - 86400) {
        throw new Error('Token is too old');
      }

      return decoded;
    } catch (error) {
      throw new Error(`JWT validation failed: ${error.message}`);
    }
  }

  async isTokenBlacklisted(jti) {
    if (!jti) return false;
    const result = await this.redis.get(`blacklist:${jti}`);
    return result !== null;
  }

  validateCustomClaims(decoded) {
    // Validation des claims personnalisés
    if (decoded.clearance && !['PUBLIC', 'INTERNAL', 'CONFIDENTIAL'].includes(decoded.clearance)) {
      return false;
    }

    if (decoded.groups && !Array.isArray(decoded.groups)) {
      return false;
    }

    return true;
  }

  async blacklistToken(jti, exp) {
    // Ajouter à la blacklist jusqu'à expiration
    const ttl = exp - Math.floor(Date.now() / 1000);
    if (ttl > 0) {
      await this.redis.setex(`blacklist:${jti}`, ttl, 'true');
    }
  }
}

# Stratégie 1: Token Blacklist
revocation:
  strategy: "blacklist"
  storage: "redis"
  cleanup: true
  cleanupInterval: 3600

# Stratégie 2: Short-lived tokens avec refresh
revocation:
  strategy: "short-lived"
  accessTokenTTL: 300  # 5 minutes
  refreshTokenRotation: true

# Stratégie 3: Token versioning
revocation:
  strategy: "versioning"
  userTokenVersion: "database"
  globalTokenVersion: "environment"

# Stratégie 4: Claims-based
revocation:
  strategy: "claims"
  activeSessionId: "database"
  deviceFingerprint: true

// Client OAuth pour accès programmatique
class WikiJSApiClient {
  constructor(clientId, clientSecret, baseUrl) {
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    this.baseUrl = baseUrl;
    this.accessToken = null;
    this.tokenExpiry = null;
  }

  async authenticate() {
    const tokenUrl = `${this.baseUrl}/oauth/token`;
    
    const response = await fetch(tokenUrl, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Authorization': `Basic ${btoa(`${this.clientId}:${this.clientSecret}`)}`
      },
      body: new URLSearchParams({
        'grant_type': 'client_credentials',
        'scope': 'read:pages write:pages read:assets'
      })
    });

    if (!response.ok) {
      throw new Error(`Authentication failed: ${response.status}`);
    }

    const data = await response.json();
    this.accessToken = data.access_token;
    this.tokenExpiry = Date.now() + (data.expires_in * 1000);
  }

  async ensureAuthenticated() {
    if (!this.accessToken || Date.now() >= this.tokenExpiry) {
      await this.authenticate();
    }
  }

  async apiCall(method, endpoint, body = null) {
    await this.ensureAuthenticated();

    const response = await fetch(`${this.baseUrl}/api${endpoint}`, {
      method,
      headers: {
        'Authorization': `Bearer ${this.accessToken}`,
        'Content-Type': 'application/json'
      },
      body: body ? JSON.stringify(body) : null
    });

    if (!response.ok) {
      throw new Error(`API call failed: ${response.status}`);
    }

    return response.json();
  }

  // Méthodes helper
  async getPage(path) {
    return this.apiCall('GET', `/pages${path}`);
  }

  async createPage(pageData) {
    return this.apiCall('POST', '/pages', pageData);
  }

  async updatePage(path, pageData) {
    return this.apiCall('PUT', `/pages${path}`, pageData);
  }
}

# Configuration des comptes de service
serviceAccounts:
  enabled: true
  
  # Template par défaut
  defaultTemplate:
    type: "service"
    mustChangePassword: false
    verifyEmail: false
    
  # Restrictions de sécurité
  security:
    # Pas de connexion interactive
    allowInteractiveLogin: false
    
    # IP whitelist obligatoire
    requireIPWhitelist: true
    
    # Rotation automatique des clés
    autoRotateKeys: true
    rotationInterval: 90  # jours
    
    # Audit renforcé
    auditAllActions: true
    
  # Permissions disponibles
  availablePermissions:
    # Pages
    - "read:pages"
    - "write:pages"
    - "delete:pages"
    
    # Assets
    - "read:assets"
    - "write:assets"
    - "delete:assets"
    
    # Users (lecture seulement pour service accounts)
    - "read:users"
    
    # System
    - "read:system"
    - "read:analytics"

# Via CLI WikiJS (à implémenter)
wikijs service-account create \
  --name "backup-service" \
  --description "Service de sauvegarde automatique" \
  --permissions "read:pages,read:assets" \
  --ip-whitelist "192.168.1.100,10.0.0.50" \
  --expires-in "1year"

# Via API REST
curl -X POST https://wiki.mondomaine.com/api/admin/service-accounts \
  -H "Authorization: Bearer admin_token" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "integration-service",
    "description": "Service intégration CRM",
    "permissions": ["read:pages", "write:pages"],
    "ipWhitelist": ["203.0.113.0/24"],
    "expiresAt": "2025-12-31T23:59:59Z"
  }'

// Côté client - Enregistrement d'un authentificateur
async function registerWebAuthn() {
  try {
    // Récupérer les options depuis le serveur
    const optionsResponse = await fetch('/api/webauthn/register/begin', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email: userEmail })
    });
    const options = await optionsResponse.json();

    // Créer les credentials
    const credential = await navigator.credentials.create({
      publicKey: {
        // Challenge cryptographique
        challenge: base64ToArrayBuffer(options.challenge),
        
        // Informations utilisateur
        user: {
          id: base64ToArrayBuffer(options.user.id),
          name: options.user.name,
          displayName: options.user.displayName
        },
        
        // Informations du Relying Party
        rp: options.rp,
        
        // Algorithmes cryptographiques supportés
        pubKeyCredParams: options.pubKeyCredParams,
        
        // Timeout
        timeout: 60000,
        
        // Sélection de l'authentificateur
        authenticatorSelection: {
          authenticatorAttachment: "platform", // ou "cross-platform"
          userVerification: "required",
          residentKey: "preferred"
        },
        
        // Type d'attestation
        attestation: "direct"
      }
    });

    // Envoyer au serveur pour vérification
    const verificationResponse = await fetch('/api/webauthn/register/finish', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        credential: {
          id: credential.id,
          rawId: arrayBufferToBase64(credential.rawId),
          response: {
            attestationObject: arrayBufferToBase64(credential.response.attestationObject),
            clientDataJSON: arrayBufferToBase64(credential.response.clientDataJSON)
          },
          type: credential.type
        }
      })
    });

    if (verificationResponse.ok) {
      alert('Authentificateur enregistré avec succès !');
    }
  } catch (error) {
    console.error('Erreur d\'enregistrement WebAuthn:', error);
  }
}

// Côté client - Authentification
async function authenticateWebAuthn() {
  try {
    const optionsResponse = await fetch('/api/webauthn/authenticate/begin', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email: userEmail })
    });
    const options = await optionsResponse.json();

    const assertion = await navigator.credentials.get({
      publicKey: {
        challenge: base64ToArrayBuffer(options.challenge),
        allowCredentials: options.allowCredentials.map(cred => ({
          id: base64ToArrayBuffer(cred.id),
          type: cred.type,
          transports: cred.transports
        })),
        timeout: 60000,
        userVerification: "required"
      }
    });

    const verificationResponse = await fetch('/api/webauthn/authenticate/finish', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        credential: {
          id: assertion.id,
          rawId: arrayBufferToBase64(assertion.rawId),
          response: {
            authenticatorData: arrayBufferToBase64(assertion.response.authenticatorData),
            clientDataJSON: arrayBufferToBase64(assertion.response.clientDataJSON),
            signature: arrayBufferToBase64(assertion.response.signature),
            userHandle: assertion.response.userHandle ? 
              arrayBufferToBase64(assertion.response.userHandle) : null
          },
          type: assertion.type
        }
      })
    });

    if (verificationResponse.ok) {
      window.location.href = '/dashboard';
    }
  } catch (error) {
    console.error('Erreur d\'authentification WebAuthn:', error);
  }
}

# Configuration Push Authentication
passwordless:
  pushAuth:
    enabled: true
    
    # Service de push notifications
    provider: "firebase"  # ou "apns", "custom"
    
    # Configuration Firebase
    firebase:
      projectId: "mon-wikijs-project"
      privateKey: "path/to/service-account.json"
      
    # Configuration des notifications
    notification:
      title: "Demande de connexion"
      body: "Quelqu'un tente de se connecter à {{siteName}}"
      icon: "/assets/logo.png"
      
    # Données contextuelles
    context:
      includeLocation: true
      includeDeviceInfo: true
      includeBrowser: true
      
    # Sécurité
    timeout: 120  # secondes
    maxPendingRequests: 3
    
    # Actions disponibles
    actions:
      - id: "approve"
        title: "Approuver"
        icon: "check"
      - id: "deny"
        title: "Refuser"
        icon: "times"