@airoom/nextmin-node 2.0.2 → 2.0.3

package/dist/api/router/setupAuthRoutes.js

@@ -6,37 +6,306 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setupAuthRoutes = setupAuthRoutes;
 const bcrypt_1 = __importDefault(require("bcrypt"));
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const keyv_1 = __importDefault(require("keyv"));
+const Events_1 = require("../../utils/Events");
+const otpStore = new keyv_1.default({ ttl: 300000 }); // 5 minutes TTL
+function getAllowedAuthServices(ctx) {
+    let authServices = [];
+    const usersSchema = ctx.getSchema('users');
+    if (usersSchema?.authServices) {
+        authServices = [...usersSchema.authServices];
+    }
+    const schemas = ctx.liveSchemas || {};
+    for (const s of Object.values(schemas)) {
+        if (s.extends === 'Users' && s.authServices && Array.isArray(s.authServices)) {
+            for (const service of s.authServices) {
+                if (!authServices.includes(service)) {
+                    authServices.push(service);
+                }
+            }
+        }
+    }
+    if (authServices.length === 0) {
+        authServices = ['email', 'username'];
+    }
+    return authServices;
+}
+function getPhoneVerificationSetting(ctx, roleIdOrName) {
+    const usersSchema = ctx.getSchema('users');
+    let phoneVerification = !!usersSchema?.phoneVerification;
+    if (roleIdOrName) {
+        const schemas = ctx.liveSchemas || {};
+        const normalizedRole = String(roleIdOrName).trim().toLowerCase();
+        for (const s of Object.values(schemas)) {
+            const isSubclass = s.extends === 'Users';
+            const nameMatches = s.modelName.toLowerCase() === normalizedRole ||
+                s.modelName.toLowerCase() === normalizedRole + 's' ||
+                (normalizedRole.endsWith('s') && s.modelName.toLowerCase() === normalizedRole.slice(0, -1));
+            if (isSubclass && nameMatches) {
+                if (s.phoneVerification !== undefined) {
+                    return !!s.phoneVerification;
+                }
+            }
+        }
+    }
+    if (!phoneVerification) {
+        const schemas = ctx.liveSchemas || {};
+        for (const s of Object.values(schemas)) {
+            if (s.extends === 'Users' && s.phoneVerification) {
+                return true;
+            }
+        }
+    }
+    return phoneVerification;
+}
 function setupAuthRoutes(ctx) {
     const basePath = '/auth/users';
-    // REGISTER
-    ctx.router.post(`${basePath}/register`, ctx.apiKeyMiddleware, async (req, res) => {
+    // SEND OTP
+    ctx.router.post(`${basePath}/send-otp`, ctx.apiKeyMiddleware, async (req, res) => {
         try {
-            let { email, username, password, ...rest } = req.body;
-            if (String(password).length < 8) {
-                return res
-                    .status(400)
-                    .json({
+            const phoneVerification = getPhoneVerificationSetting(ctx);
+            if (!phoneVerification) {
+                return res.status(400).json({
                     error: true,
-                    message: 'Password must be at least 8 characters long',
+                    message: 'Phone verification is not enabled in schema.',
                 });
             }
+            const { phone, purpose = 'register' } = req.body;
+            if (!phone || !String(phone).trim()) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Phone number is required',
+                });
+            }
+            const cleanPhone = String(phone).trim();
+            const userModel = ctx.getModel('users');
+            // Find existing user by phone OR username (since username can be the phone number)
+            const existingByPhone = await userModel.read({ phone: cleanPhone }, 1, 0, true);
+            const existingByUsername = await userModel.read({ username: cleanPhone }, 1, 0, true);
+            const userExists = (existingByPhone && existingByPhone.length > 0) || (existingByUsername && existingByUsername.length > 0);
+            if (purpose === 'login') {
+                if (!userExists) {
+                    return res.status(400).json({
+                        error: true,
+                        message: 'Phone number not registered',
+                    });
+                }
+            }
+            else {
+                if (userExists) {
+                    return res.status(400).json({
+                        error: true,
+                        message: 'Phone number already registered',
+                    });
+                }
+            }
+            const otp = Math.floor(100000 + Math.random() * 900000).toString();
+            await otpStore.set(cleanPhone, otp);
+            Events_1.events.emitEvent('auth:otp:send', { phone: cleanPhone, otp });
+            // OTP Logging logic for development & FORCE_LOG_OTP
+            const isDev = process.env.APP_MODE?.toLowerCase() !== 'production' && process.env.NODE_ENV?.toLowerCase() !== 'production';
+            const forceLogOtp = process.env.FORCE_LOG_OTP === 'true';
+            if (forceLogOtp) {
+                console.log(`[FORCE OTP LOG] Phone: ${cleanPhone}, OTP: ${otp}`);
+            }
+            else if (isDev) {
+                console.log(`[OTP] Phone: ${cleanPhone}, OTP: ${otp}`);
+            }
+            return res.json({
+                success: true,
+                message: 'OTP sent successfully.',
+            });
+        }
+        catch (error) {
+            return res.status(500).json({ error: true, message: error.message });
+        }
+    });
+    // VERIFY OTP
+    ctx.router.post(`${basePath}/verify-otp`, ctx.apiKeyMiddleware, async (req, res) => {
+        try {
+            const { phone, otp } = req.body;
+            if (!phone || !String(phone).trim() || !otp || !String(otp).trim()) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Phone number and OTP are required',
+                });
+            }
+            const cleanPhone = String(phone).trim();
+            const storedOtp = await otpStore.get(cleanPhone);
+            if (!storedOtp || storedOtp !== String(otp).trim()) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Invalid or expired OTP',
+                });
+            }
+            return res.json({
+                success: true,
+                message: 'OTP verified successfully.',
+            });
+        }
+        catch (error) {
+            return res.status(500).json({ error: true, message: error.message });
+        }
+    });
+    // REGISTER
+    ctx.router.post(`${basePath}/register`, ctx.optionalAuthMiddleware, async (req, res) => {
+        try {
             const userModel = ctx.getModel('users');
             const usersSchema = ctx.getSchema('users');
+            // Whitelist check (backward-compatible: only enforce if publicRegisterFields is defined)
+            const whitelist = usersSchema?.publicRegisterFields;
+            if (whitelist) {
+                const bodyKeys = Object.keys(req.body);
+                const forbidden = bodyKeys.filter((key) => key !== 'otp' && !whitelist.includes(key));
+                if (forbidden.length > 0) {
+                    return res.status(400).json({
+                        error: true,
+                        message: `Field(s) not allowed during registration: ${forbidden.join(', ')}`,
+                    });
+                }
+            }
+            let { email, username, password, otp, ...rest } = req.body;
+            const isPasswordless = !password && otp;
+            if (!isPasswordless) {
+                if (!password || String(password).length < 8) {
+                    return res
+                        .status(400)
+                        .json({
+                        error: true,
+                        message: 'Password must be at least 8 characters long',
+                    });
+                }
+            }
             if (email)
                 email = String(email).trim().toLowerCase();
             if (username)
                 username = String(username).trim();
+            const phone = rest.phone;
+            if (!username && phone) {
+                username = String(phone).trim();
+            }
             const data = { ...rest };
             if (email)
                 data.email = email;
             if (username)
                 data.username = username;
-            if (data.status == null)
-                data.status = 'pending';
+            // Resolve Role Name to Database ID (Relation Hydration on Signup)
+            const rolesModel = ctx.getModel('roles');
+            if (data.role && rolesModel) {
+                const roleStr = String(data.role).trim();
+                let foundRole = null;
+                // Try finding by name first
+                const byName = await rolesModel.read({ name: roleStr }, 1, 0, true);
+                if (byName && byName.length > 0) {
+                    foundRole = byName[0];
+                }
+                else {
+                    const byNameLower = await rolesModel.read({ name: roleStr.toLowerCase() }, 1, 0, true);
+                    if (byNameLower && byNameLower.length > 0) {
+                        foundRole = byNameLower[0];
+                    }
+                }
+                // Try finding by ID if not found by name
+                if (!foundRole) {
+                    const isHex24 = /^[0-9a-fA-F]{24}$/.test(roleStr);
+                    const isNumeric = !isNaN(Number(roleStr)) && roleStr !== '';
+                    if (isHex24 || isNumeric) {
+                        const queryId = isNumeric ? Number(roleStr) : roleStr;
+                        const byId = await rolesModel.read({ id: queryId }, 1, 0, true);
+                        if (byId && byId.length > 0) {
+                            foundRole = byId[0];
+                        }
+                    }
+                }
+                if (foundRole) {
+                    data.role = foundRole.id;
+                }
+                else {
+                    return res.status(400).json({
+                        error: true,
+                        message: `Invalid role specified: ${roleStr}`,
+                    });
+                }
+            }
+            // If no role specified, resolve default role to its database ID
+            if (!data.role && rolesModel) {
+                const roleAttr = usersSchema?.attributes?.role;
+                const defaultRoleVal = (Array.isArray(roleAttr) ? roleAttr[0]?.default : roleAttr?.default) || 'user';
+                const defaultRoles = await rolesModel.read({ name: String(defaultRoleVal).toLowerCase() }, 1, 0, true);
+                if (defaultRoles && defaultRoles.length > 0) {
+                    data.role = defaultRoles[0].id;
+                }
+            }
+            // Admin-only role assignment validation
+            const resolvedRoleName = (await ctx.normalizeRoleName(data.role)) ?? '';
+            const targetIsAdmin = ['admin', 'superadmin'].includes(resolvedRoleName.toLowerCase());
+            const requesterRole = String(req.user?.role || '').toLowerCase();
+            const isSuperadmin = requesterRole === 'superadmin';
+            if (targetIsAdmin && !isSuperadmin) {
+                return res.status(403).json({
+                    error: true,
+                    message: 'Only super administrators can assign administrative roles.',
+                });
+            }
+            // OTP Phone Verification check
+            const cleanPhone = phone ? String(phone).trim() : '';
+            const verificationEnabled = getPhoneVerificationSetting(ctx, resolvedRoleName);
+            if (verificationEnabled && cleanPhone) {
+                const hasApiKey = req.headers['x-api-key'] && req.headers['x-api-key'] === ctx.trustedApiKey;
+                const isRequesterAdmin = ['admin', 'superadmin'].includes(String(requesterRole).toLowerCase());
+                const bypassOtp = hasApiKey || isRequesterAdmin;
+                if (!bypassOtp) {
+                    if (!otp || !String(otp).trim()) {
+                        return res.status(400).json({
+                            error: true,
+                            message: 'Verification OTP is required',
+                        });
+                    }
+                    const storedOtp = await otpStore.get(cleanPhone);
+                    if (!storedOtp || storedOtp !== String(otp).trim()) {
+                        return res.status(400).json({
+                            error: true,
+                            message: 'Invalid or expired OTP',
+                        });
+                    }
+                    await otpStore.delete(cleanPhone);
+                }
+            }
+            // Onboarding status defaults based on role (Verification gate)
+            if (data.status == null) {
+                let defaultStatus = 'pending';
+                if (usersSchema) {
+                    const roleDefaultStatuses = usersSchema.roleDefaultStatuses;
+                    if (roleDefaultStatuses && roleDefaultStatuses[resolvedRoleName.toLowerCase()]) {
+                        defaultStatus = roleDefaultStatuses[resolvedRoleName.toLowerCase()];
+                    }
+                    else {
+                        const statusAttr = usersSchema.attributes?.status;
+                        defaultStatus = (Array.isArray(statusAttr) ? statusAttr[0]?.default : statusAttr?.default) || 'pending';
+                    }
+                }
+                data.status = defaultStatus;
+            }
+            // Hydrate default values for required fields that are not in the registration payload
+            if (usersSchema) {
+                for (const [key, attr] of Object.entries(usersSchema.attributes)) {
+                    if (Array.isArray(attr))
+                        continue;
+                    if (attr?.private)
+                        continue;
+                    const reqd = Boolean(attr?.required);
+                    if (reqd && data[key] == null) {
+                        const defaultVal = attr?.default;
+                        if (defaultVal !== undefined) {
+                            data[key] = defaultVal;
+                        }
+                    }
+                }
+            }
             if (usersSchema) {
                 const missing = ctx.validateRequiredFields(usersSchema, {
                     ...data,
-                    password,
+                    ...(isPasswordless ? {} : { password }),
                 });
                 if (missing.length > 0) {
                     return res.status(400).json({
@@ -52,13 +321,20 @@ function setupAuthRoutes(ctx) {
                     });
                 }
             }
-            const salt = await bcrypt_1.default.genSalt(10);
-            const hashed = await bcrypt_1.default.hash(String(password) + ctx.jwtSecret, salt);
-            data.password = hashed;
+            if (!isPasswordless && password) {
+                const salt = await bcrypt_1.default.genSalt(10);
+                const hashed = await bcrypt_1.default.hash(String(password) + ctx.jwtSecret, salt);
+                data.password = hashed;
+            }
+            else {
+                data.isPasswordless = true;
+            }
             const created = await userModel.create(data);
             const roleName = (await ctx.normalizeRoleName(created.role)) ?? '';
             const token = jsonwebtoken_1.default.sign({ id: created.id, role: roleName }, ctx.jwtSecret, { expiresIn: '7days' });
             delete created.password;
+            // Emit signup event
+            Events_1.events.emitEvent(Events_1.Events.AUTH_SIGNUP, { user: created });
             return res.json({
                 success: true,
                 message: 'Registration successful.',
@@ -71,26 +347,54 @@ function setupAuthRoutes(ctx) {
     });
     // LOGIN
     ctx.router.post(`${basePath}/login`, ctx.apiKeyMiddleware, async (req, res) => {
-        let { email, username, password } = req.body;
-        if ((!email && !username) || !password) {
+        let { email, username, password, phone } = req.body;
+        if ((!email && !username && !phone) || !password) {
             return res
                 .status(400)
                 .json({
                 error: true,
-                message: 'Email/username and password are required',
+                message: 'Credentials and password are required',
             });
         }
         try {
             const userModel = ctx.getModel('users');
-            const findBy = email
-                ? { email: String(email).trim().toLowerCase() }
-                : { username: String(username).trim() };
+            const allowedFields = getAllowedAuthServices(ctx);
+            let findBy = null;
+            if (phone && allowedFields.includes('phone')) {
+                findBy = { phone: String(phone).trim() };
+            }
+            else if (email && allowedFields.includes('email') && !/^\+?[0-9]{7,15}$/.test(String(email).trim())) {
+                findBy = { email: String(email).trim().toLowerCase() };
+            }
+            else if (username || email) {
+                const lookupVal = String(username || email).trim();
+                const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(lookupVal);
+                const isPhone = /^\+?[0-9]{7,15}$/.test(lookupVal);
+                if (isPhone && allowedFields.includes('phone')) {
+                    findBy = { phone: lookupVal };
+                }
+                else if (isEmail && allowedFields.includes('email')) {
+                    findBy = { email: lookupVal.toLowerCase() };
+                }
+                else if (allowedFields.includes('username')) {
+                    findBy = { username: lookupVal };
+                }
+            }
+            if (!findBy) {
+                return res.status(400).json({ error: true, message: 'Invalid credentials' });
+            }
             const users = await userModel.read(findBy, 1, 0, true);
             const user = users?.[0];
             if (!user)
                 return res
                     .status(400)
                     .json({ error: true, message: 'Invalid credentials' });
+            if (user.isPasswordless) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'No password set for this account. Please log in using OTP.',
+                });
+            }
             const hashedPassword = user.password;
             if (!hashedPassword)
                 return res
@@ -101,16 +405,11 @@ function setupAuthRoutes(ctx) {
                 return res
                     .status(400)
                     .json({ error: true, message: 'Invalid credentials' });
-            const status = user.status;
-            if (status && status !== 'active') {
-                const msg = status === 'pending'
-                    ? 'Your account is awaiting approval.'
-                    : 'Your account is suspended.';
-                return res.status(403).json({ error: true, message: msg });
-            }
             const roleName = (await ctx.normalizeRoleName(user.role)) ?? '';
             const token = jsonwebtoken_1.default.sign({ id: user.id, role: roleName }, ctx.jwtSecret, { expiresIn: '7days' });
             delete user.password;
+            // Emit login event
+            Events_1.events.emitEvent(Events_1.Events.AUTH_LOGIN, { user: { ...user, roleName }, token });
             res.json({
                 success: true,
                 message: 'You are successfully logged in.',
@@ -123,6 +422,59 @@ function setupAuthRoutes(ctx) {
             res.status(500).json({ error: true, message: error.message });
         }
     });
+    // LOGIN OTP
+    ctx.router.post(`${basePath}/login-otp`, ctx.apiKeyMiddleware, async (req, res) => {
+        const { phone, otp } = req.body;
+        if (!phone || !String(phone).trim() || !otp || !String(otp).trim()) {
+            return res.status(400).json({
+                error: true,
+                message: 'Phone number and OTP are required',
+            });
+        }
+        try {
+            const cleanPhone = String(phone).trim();
+            const storedOtp = await otpStore.get(cleanPhone);
+            if (!storedOtp || storedOtp !== String(otp).trim()) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Invalid or expired OTP',
+                });
+            }
+            await otpStore.delete(cleanPhone);
+            const userModel = ctx.getModel('users');
+            // Find user by phone OR username
+            let user = null;
+            const byPhone = await userModel.read({ phone: cleanPhone }, 1, 0, true);
+            if (byPhone && byPhone.length > 0) {
+                user = byPhone[0];
+            }
+            else {
+                const byUsername = await userModel.read({ username: cleanPhone }, 1, 0, true);
+                if (byUsername && byUsername.length > 0) {
+                    user = byUsername[0];
+                }
+            }
+            if (!user) {
+                return res.status(404).json({
+                    error: true,
+                    message: 'User not found',
+                });
+            }
+            const roleName = (await ctx.normalizeRoleName(user.role)) ?? '';
+            const token = jsonwebtoken_1.default.sign({ id: user.id, role: roleName }, ctx.jwtSecret, { expiresIn: '7days' });
+            delete user.password;
+            // Emit login event
+            Events_1.events.emitEvent(Events_1.Events.AUTH_LOGIN, { user: { ...user, roleName }, token });
+            return res.json({
+                success: true,
+                message: 'You are successfully logged in.',
+                data: { token, user: { ...user, roleName } },
+            });
+        }
+        catch (error) {
+            return res.status(500).json({ error: true, message: error.message });
+        }
+    });
     // ME
     ctx.router.get(`${basePath}/me`, ctx.apiKeyMiddleware, ctx.authenticateMiddleware, async (req, res) => {
         try {
@@ -224,28 +576,113 @@ function setupAuthRoutes(ctx) {
     // FORGOT PASSWORD
     const forgotPasswordHandler = async (req, res) => {
         try {
-            const { email } = (req.body || {});
-            if (!email || !String(email).trim()) {
+            const { email, phone } = (req.body || {});
+            if ((!email || !String(email).trim()) && (!phone || !String(phone).trim())) {
                 return res
                     .status(400)
-                    .json({ error: true, message: 'Email is required' });
+                    .json({ error: true, message: 'Email or phone number is required' });
+            }
+            const services = getAllowedAuthServices(ctx);
+            const allowedPhone = services.includes('phone') || services.includes('Phone');
+            const allowedEmail = services.includes('email') || services.includes('Email');
+            let findBy = null;
+            const rawInput = String(phone || email).trim();
+            if (phone && allowedPhone) {
+                findBy = { phone: rawInput };
             }
-            const normalizedEmail = String(email).trim().toLowerCase();
-            try {
-                const userModel = ctx.getModel('users');
-                await userModel.read({ email: normalizedEmail }, 1, 0, true);
+            else if (email) {
+                const isPhone = /^\+?[0-9]{7,15}$/.test(rawInput);
+                if (isPhone && allowedPhone) {
+                    findBy = { phone: rawInput };
+                }
+                else if (allowedEmail) {
+                    findBy = { email: rawInput.toLowerCase() };
+                }
+            }
+            const userModel = ctx.getModel('users');
+            let users = findBy ? await userModel.read(findBy, 1, 0, true) : null;
+            if ((!users || users.length === 0) && rawInput) {
+                users = await userModel.read({ username: rawInput }, 1, 0, true);
+            }
+            if ((!users || users.length === 0) && rawInput && !findBy?.phone) {
+                users = await userModel.read({ phone: rawInput }, 1, 0, true);
             }
-            catch { }
+            const user = users?.[0];
+            if (!user) {
+                return res.status(404).json({
+                    error: true,
+                    message: 'No account found with the provided phone number or email.',
+                });
+            }
+            const targetPhone = user.phone || user.username || rawInput;
+            const otp = Math.floor(100000 + Math.random() * 900000).toString();
+            const storeKey = `reset:${targetPhone}`;
+            await otpStore.set(storeKey, otp);
+            Events_1.events.emitEvent('auth:otp:send', { phone: targetPhone, otp, type: 'forgot_password' });
             return res.json({
                 success: true,
-                message: 'If an account exists, reset instructions have been sent.',
+                message: 'Verification OTP sent successfully.',
+                data: { phone: targetPhone },
             });
         }
         catch (error) {
             return res
-                .status(400)
-                .json({ error: true, message: error?.message || 'Error' });
+                .status(500)
+                .json({ error: true, message: error?.message || 'Error processing forgot password' });
         }
     };
     ctx.router.post(`${basePath}/forgot-password`, ctx.apiKeyMiddleware, forgotPasswordHandler);
+    // RESET PASSWORD
+    ctx.router.post(`${basePath}/reset-password`, ctx.apiKeyMiddleware, async (req, res) => {
+        try {
+            const { phone, email, otp, newPassword } = req.body;
+            const identifier = String(phone || email || '').trim();
+            if (!identifier || !otp || !String(otp).trim() || !newPassword || !String(newPassword).trim()) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Phone/email, OTP, and new password are required',
+                });
+            }
+            if (String(newPassword).length < 8) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Password must be at least 8 characters long',
+                });
+            }
+            const storeKey = `reset:${identifier}`;
+            const storedOtp = await otpStore.get(storeKey);
+            if (!storedOtp || storedOtp !== String(otp).trim()) {
+                return res.status(400).json({
+                    error: true,
+                    message: 'Invalid or expired OTP',
+                });
+            }
+            const userModel = ctx.getModel('users');
+            let users = await userModel.read({ phone: identifier }, 1, 0, true);
+            if (!users || users.length === 0) {
+                users = await userModel.read({ username: identifier }, 1, 0, true);
+            }
+            if (!users || users.length === 0) {
+                users = await userModel.read({ email: identifier.toLowerCase() }, 1, 0, true);
+            }
+            const user = users?.[0];
+            if (!user) {
+                return res.status(404).json({
+                    error: true,
+                    message: 'User account not found',
+                });
+            }
+            const salt = await bcrypt_1.default.genSalt(10);
+            const newHash = await bcrypt_1.default.hash(String(newPassword) + ctx.jwtSecret, salt);
+            await userModel.update(user.id, { password: newHash });
+            await otpStore.delete(storeKey);
+            return res.json({
+                success: true,
+                message: 'Password reset successfully. Please sign in with your new password.',
+            });
+        }
+        catch (error) {
+            return res.status(500).json({ error: true, message: error?.message || 'Error resetting password' });
+        }
+    });
 }

package/dist/api/router/setupChatWidgetRoutes.d.ts

@@ -0,0 +1,3 @@
+import { RouterCtx } from './ctx';
+import { ChatWidgetConfig } from '../apiRouter';
+export declare function setupChatWidgetRoutes(ctx: RouterCtx, chatWidget?: ChatWidgetConfig): void;