@aeriajs/builtins 0.0.296 → 0.0.297

package/dist/collections/user/activate.d.ts

@@ -37,7 +37,7 @@ export declare const activateContract: {
                 readonly required: readonly ["httpStatus", "code"];
                 readonly properties: {
                     readonly httpStatus: {
-                        readonly enum: [404, 403, 401, 422];
+                        readonly enum: [400, 404, 403, 401, 422];
                     };
                     readonly code: {
                         readonly enum: ["RESOURCE_NOT_FOUND", "MALFORMED_INPUT", "ALREADY_ACTIVE_USER", "INVALID_LINK", "INVALID_TOKEN", "USER_NOT_FOUND"];

package/dist/collections/user/activate.js

@@ -26,6 +26,7 @@ export const activateContract = defineContract({
     response: [
         endpointErrorSchema({
             httpStatus: [
+                HTTPStatus.BadRequest,
                 HTTPStatus.NotFound,
                 HTTPStatus.Forbidden,
                 HTTPStatus.Unauthorized,
@@ -57,7 +58,7 @@ export const activate = async (payload, context) => {
         throw new Error('config.secret is not set');
     }
     if (!userId || !token) {
-        return context.error(HTTPStatus.NotFound, {
+        return context.error(HTTPStatus.BadRequest, {
             code: ActivationError.InvalidLink,
         });
     }
@@ -67,6 +68,7 @@ export const activate = async (payload, context) => {
         projection: {
             password: 1,
             active: 1,
+            activation_timestamp: 1,
         },
     });
     if (!user) {
@@ -79,7 +81,7 @@ export const activate = async (payload, context) => {
             code: ActivationError.AlreadyActiveUser,
         });
     }
-    const { error } = await decodeToken(token, context.config.secret);
+    const { error } = await decodeToken(token, `${context.config.secret}:${user.activation_timestamp?.getTime() || ''}`);
     if (error) {
         return context.error(HTTPStatus.Unauthorized, {
             code: ActivationError.InvalidToken,
@@ -97,6 +99,7 @@ export const activate = async (payload, context) => {
             $set: {
                 active: true,
                 password: await bcrypt.hash(password, 10),
+                activation_timestamp: undefined,
             },
         });
     }
@@ -106,6 +109,7 @@ export const activate = async (payload, context) => {
         }, {
             $set: {
                 active: true,
+                activation_timestamp: undefined,
             },
         });
     }

package/dist/collections/user/createAccount.d.ts

@@ -62,6 +62,10 @@ export declare const createAccountContract: {
                 readonly type: "string";
                 readonly format: "date-time";
             };
+            readonly activation_timestamp: {
+                readonly type: "string";
+                readonly format: "date-time";
+            };
         };
     };
     readonly response: [{

package/dist/collections/user/description.d.ts

@@ -63,6 +63,10 @@ export declare const description: {
             readonly type: "string";
             readonly format: "date-time";
         };
+        readonly activation_timestamp: {
+            readonly type: "string";
+            readonly format: "date-time";
+        };
     };
     readonly presets: readonly ["crud", "duplicate"];
     readonly layout: {

package/dist/collections/user/description.js

@@ -88,6 +88,10 @@ export const description = defineDescription({
             type: 'string',
             format: 'date-time',
         },
+        activation_timestamp: {
+            type: 'string',
+            format: 'date-time',
+        },
     },
     presets: [
         'crud',

package/dist/collections/user/editProfile.d.ts

@@ -58,6 +58,10 @@ export declare const editProfileContract: {
                 readonly type: "string";
                 readonly format: "date-time";
             };
+            readonly activation_timestamp: {
+                readonly type: "string";
+                readonly format: "date-time";
+            };
         };
     };
     readonly response: [{

package/dist/collections/user/getActivationLink.d.ts

@@ -59,10 +59,10 @@ export declare const getActivationLinkContract: {
                 readonly required: readonly ["httpStatus", "code"];
                 readonly properties: {
                     readonly httpStatus: {
-                        readonly enum: [400, 403];
+                        readonly enum: [400, 403, 404];
                     };
                     readonly code: {
-                        readonly enum: ["INVALID_LINK", "ALREADY_ACTIVE_USER"];
+                        readonly enum: ["INVALID_LINK", "USER_NOT_FOUND", "ALREADY_ACTIVE_USER"];
                     };
                     readonly message: {
                         readonly type: "string";
@@ -95,5 +95,4 @@ export declare const getActivationLinkContract: {
         };
     }];
 };
-export declare const getActivationToken: (userId: string, context: Context) => Promise<string>;
 export declare const getActivationLink: ContractToFunction<typeof getActivationLinkContract, Context<typeof description>>;

package/dist/collections/user/getActivationLink.js

@@ -1,7 +1,7 @@
-import { throwIfError } from '@aeriajs/common';
-import { signToken } from '@aeriajs/core';
+import { ObjectId } from 'mongodb';
 import { Result, HTTPStatus, defineContract, resultSchema, endpointErrorSchema, functionSchemas } from '@aeriajs/types';
 import { ActivationError } from './activate.js';
+import { getActivationToken } from './getActivationToken.js';
 export const getActivationLinkContract = defineContract({
     payload: {
         type: 'object',
@@ -22,9 +22,11 @@ export const getActivationLinkContract = defineContract({
             httpStatus: [
                 HTTPStatus.BadRequest,
                 HTTPStatus.Forbidden,
+                HTTPStatus.NotFound,
             ],
             code: [
                 ActivationError.InvalidLink,
+                ActivationError.UserNotFound,
                 ActivationError.AlreadyActiveUser,
             ],
         }),
@@ -38,44 +40,44 @@ export const getActivationLinkContract = defineContract({
         }),
     ],
 });
-export const getActivationToken = async (userId, context) => {
-    if (context.calledFunction === 'getActivationToken') {
-        throw new Error('cannot be called externally');
-    }
-    if (!context.config.secret) {
-        throw new Error('config.secret is not set');
-    }
-    const token = throwIfError(await signToken({
-        data: userId,
-    }, context.config.secret, {
-        expiresIn: context.config.security.linkTokenExpiration,
-    }));
-    return token;
-};
 export const getActivationLink = async (payload, context) => {
     if (!context.config.webPublicUrl) {
         return context.error(HTTPStatus.BadRequest, {
             code: ActivationError.InvalidLink,
         });
     }
-    const { error, result: user } = await context.collections.user.functions.get({
-        filters: {
-            _id: payload.userId,
+    const now = new Date();
+    const user = await context.collections.user.model.findOneAndUpdate({
+        _id: new ObjectId(payload.userId),
+    }, {
+        $set: {
+            activation_link_last_generated_at: now,
+        },
+    }, {
+        returnDocument: 'after',
+        projection: {
+            active: 1,
+            password: 1,
         },
-        project: ['active'],
     });
-    if (error) {
-        return Result.error(error);
+    if (!user) {
+        return Result.error({
+            httpStatus: HTTPStatus.NotFound,
+            code: ActivationError.UserNotFound,
+        });
     }
     if (user.active) {
         return context.error(HTTPStatus.Forbidden, {
             code: ActivationError.AlreadyActiveUser,
         });
     }
-    const activationToken = await getActivationToken(payload.userId.toString(), context);
+    const token = await getActivationToken({
+        _id: user._id,
+        timestamp: now,
+    }, context);
     const url = new URL(`${context.config.webPublicUrl}/user/activation`);
     url.searchParams.set('u', payload.userId.toString());
-    url.searchParams.set('t', activationToken);
+    url.searchParams.set('t', token);
     if (!user.password) {
         url.searchParams.set('step', 'password');
     }

package/dist/collections/user/getActivationToken.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '@aeriajs/types';
+import type { ObjectId } from '@aeriajs/core';
+export declare const getActivationToken: (options: {
+    _id: ObjectId;
+    timestamp: Date;
+}, context: Context) => Promise<string>;

package/dist/collections/user/getActivationToken.js

@@ -0,0 +1,13 @@
+import { throwIfError } from '@aeriajs/common';
+import { signToken } from '@aeriajs/core';
+export const getActivationToken = async (options, context) => {
+    if (!context.config.secret) {
+        throw new Error('config.secret is not set');
+    }
+    const token = throwIfError(await signToken({
+        data: options._id.toString(),
+    }, `${context.config.secret}:${options.timestamp}`, {
+        expiresIn: context.config.security.linkTokenExpiration,
+    }));
+    return token;
+};

package/dist/collections/user/getRedefinePasswordLink.d.ts

@@ -59,10 +59,10 @@ export declare const getRedefinePasswordLinkContract: {
                 readonly required: readonly ["httpStatus", "code"];
                 readonly properties: {
                     readonly httpStatus: {
-                        readonly enum: [403];
+                        readonly enum: [403, 404];
                     };
                     readonly code: {
-                        readonly enum: ["USER_NOT_ACTIVE"];
+                        readonly enum: ["USER_NOT_ACTIVE", "USER_NOT_FOUND"];
                     };
                     readonly message: {
                         readonly type: "string";

package/dist/collections/user/getRedefinePasswordLink.js

@@ -1,6 +1,7 @@
+import { ObjectId } from 'mongodb';
 import { Result, HTTPStatus, resultSchema, functionSchemas, endpointErrorSchema, defineContract } from '@aeriajs/types';
 import { RedefinePasswordError } from './redefinePassword.js';
-import { getActivationToken } from './getActivationLink.js';
+import { getActivationToken } from './getActivationToken.js';
 export const getRedefinePasswordLinkContract = defineContract({
     payload: {
         type: 'object',
@@ -18,8 +19,14 @@ export const getRedefinePasswordLinkContract = defineContract({
     response: [
         functionSchemas.getError(),
         endpointErrorSchema({
-            httpStatus: [HTTPStatus.Forbidden],
-            code: [RedefinePasswordError.UserNotActive],
+            httpStatus: [
+                HTTPStatus.Forbidden,
+                HTTPStatus.NotFound,
+            ],
+            code: [
+                RedefinePasswordError.UserNotActive,
+                RedefinePasswordError.UserNotFound,
+            ],
         }),
         resultSchema({
             type: 'object',
@@ -35,25 +42,40 @@ export const getRedefinePasswordLink = async (payload, context) => {
     if (!context.config.webPublicUrl) {
         throw new Error('config.webPublicUrl is not set');
     }
-    const { error, result: user } = await context.collections.user.functions.get({
-        filters: {
-            _id: payload.userId,
+    console.log(payload);
+    const now = new Date();
+    const user = await context.collections.user.model.findOneAndUpdate({
+        _id: new ObjectId(payload.userId),
+    }, {
+        $set: {
+            activation_timestamp: now,
+        },
+    }, {
+        returnDocument: 'after',
+        projection: {
+            active: 1,
+            password: 1,
         },
-        project: ['active'],
     });
-    if (error) {
-        return Result.error(error);
+    if (!user) {
+        return Result.error({
+            httpStatus: HTTPStatus.NotFound,
+            code: RedefinePasswordError.UserNotFound,
+        });
     }
     if (!user.active) {
         return context.error(HTTPStatus.Forbidden, {
             code: RedefinePasswordError.UserNotActive,
         });
     }
-    const redefineToken = await getActivationToken(payload.userId.toString(), context);
+    const token = await getActivationToken({
+        _id: user._id,
+        timestamp: now,
+    }, context);
     const url = new URL(`${context.config.webPublicUrl}/user/redefine-password`);
     url.searchParams.set('step', 'password'),
         url.searchParams.set('u', payload.userId.toString());
-    url.searchParams.set('t', redefineToken);
+    url.searchParams.set('t', token);
     if (payload.redirect) {
         url.searchParams.set('next', payload.redirect);
     }