@intranefr/superbackend 1.4.3

package/src/controllers/user.controller.js

@@ -0,0 +1,361 @@
+const User = require('../models/User');
+const ActivityLog = require('../models/ActivityLog');
+const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
+const emailService = require('../services/email.service');
+
+// Helper function to log activity
+const logActivity = async (userId, action, category, description, metadata = {}, req) => {
+  try {
+    await ActivityLog.create({
+      userId,
+      action,
+      category,
+      description,
+      ipAddress: req.ip || req.connection.remoteAddress,
+      userAgent: req.get('user-agent'),
+      metadata
+    });
+  } catch (error) {
+    console.error('Failed to log activity:', error);
+    // Don't throw - activity logging should not break the main flow
+  }
+};
+
+// PUT /api/user/profile - Update user profile
+exports.updateProfile = async (req, res) => {
+  try {
+    const { name, email } = req.body;
+    const userId = req.user._id;
+    
+    const updates = {};
+    const changedFields = [];
+    if (name !== undefined) {
+      updates.name = name;
+      changedFields.push('name');
+    }
+    if (email !== undefined) {
+      // Check if email is already taken by another user
+      const existingUser = await User.findOne({ email, _id: { $ne: userId } });
+      if (existingUser) {
+        return res.status(400).json({ error: 'Email already in use' });
+      }
+      updates.email = email;
+      changedFields.push('email');
+    }
+    
+    const user = await User.findByIdAndUpdate(
+      userId,
+      updates,
+      { new: true, runValidators: true }
+    );
+    
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Log activity
+    await logActivity(
+      userId,
+      'update_profile',
+      'settings',
+      `Updated profile: ${changedFields.join(', ')}`,
+      { updatedFields: changedFields },
+      req
+    );
+    
+    res.json({
+      message: 'Profile updated successfully',
+      user
+    });
+  } catch (error) {
+    console.error('Error updating profile:', error);
+    res.status(500).json({ error: 'Failed to update profile' });
+  }
+};
+
+// PUT /api/user/password - Change password
+exports.changePassword = async (req, res) => {
+  try {
+    const { currentPassword, newPassword } = req.body;
+    const userId = req.user._id;
+    
+    if (!currentPassword || !newPassword) {
+      return res.status(400).json({ 
+        error: 'Current password and new password are required' 
+      });
+    }
+    
+    // Validate new password strength
+    if (newPassword.length < 8) {
+      return res.status(400).json({ 
+        error: 'New password must be at least 8 characters long' 
+      });
+    }
+    
+    const user = await User.findById(userId);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Verify current password
+    const isMatch = await user.comparePassword(currentPassword);
+    if (!isMatch) {
+      return res.status(401).json({ error: 'Current password is incorrect' });
+    }
+    
+    // Update password (will be hashed by pre-save hook)
+    user.passwordHash = newPassword;
+    await user.save();
+    
+    // Log activity
+    await logActivity(
+      userId,
+      'change_password',
+      'auth',
+      'User changed their password',
+      {},
+      req
+    );
+    
+    // Send confirmation email
+    try {
+      await emailService.sendPasswordChangedEmail(user.email);
+    } catch (emailError) {
+      console.error('Failed to send password change email:', emailError);
+      // Don't fail the request if email fails
+    }
+    
+    res.json({ message: 'Password changed successfully' });
+  } catch (error) {
+    console.error('Error changing password:', error);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+};
+
+// POST /api/user/password-reset-request - Request password reset
+exports.requestPasswordReset = async (req, res) => {
+  try {
+    const { email } = req.body;
+    
+    if (!email) {
+      return res.status(400).json({ error: 'Email is required' });
+    }
+    
+    // Always return success message to prevent email enumeration
+    const successMessage = 'If an account with that email exists, a password reset link has been sent.';
+    
+    const user = await User.findOne({ email: email.toLowerCase() });
+    
+    if (user) {
+      // Generate secure reset token
+      const resetToken = crypto.randomBytes(32).toString('hex');
+      const hashedToken = crypto.createHash('sha256').update(resetToken).digest('hex');
+      
+      // Set token and expiry (1 hour)
+      user.passwordResetToken = hashedToken;
+      user.passwordResetExpiry = new Date(Date.now() + 60 * 60 * 1000);
+      await user.save();
+      
+      // Log activity
+      await logActivity(
+        user._id,
+        'password_reset_request',
+        'auth',
+        'User requested password reset',
+        { email: user.email },
+        req
+      );
+      
+      // Send reset email with plain token
+      try {
+        await emailService.sendPasswordResetEmail(user.email, resetToken);
+      } catch (emailError) {
+        console.error('Failed to send password reset email:', emailError);
+        // Still return success to user
+      }
+    }
+    
+    res.json({ message: successMessage });
+  } catch (error) {
+    console.error('Error requesting password reset:', error);
+    res.status(500).json({ error: 'Failed to process password reset request' });
+  }
+};
+
+// POST /api/user/password-reset-confirm - Confirm password reset
+exports.confirmPasswordReset = async (req, res) => {
+  try {
+    const { token, newPassword } = req.body;
+    
+    if (!token || !newPassword) {
+      return res.status(400).json({ 
+        error: 'Token and new password are required' 
+      });
+    }
+    
+    // Validate new password strength
+    if (newPassword.length < 8) {
+      return res.status(400).json({ 
+        error: 'Password must be at least 8 characters long' 
+      });
+    }
+    
+    // Hash the token to compare with stored hash
+    const hashedToken = crypto.createHash('sha256').update(token).digest('hex');
+    
+    // Find user with valid token
+    const user = await User.findOne({
+      passwordResetToken: hashedToken,
+      passwordResetExpiry: { $gt: Date.now() }
+    });
+    
+    if (!user) {
+      return res.status(400).json({ 
+        error: 'Invalid or expired password reset token' 
+      });
+    }
+    
+    // Update password (will be hashed by pre-save hook)
+    user.passwordHash = newPassword;
+    user.passwordResetToken = undefined;
+    user.passwordResetExpiry = undefined;
+    await user.save();
+    
+    // Log activity
+    await logActivity(
+      user._id,
+      'password_reset_confirm',
+      'auth',
+      'User completed password reset',
+      {},
+      req
+    );
+    
+    // Send confirmation email
+    try {
+      await emailService.sendPasswordChangedEmail(user.email);
+    } catch (emailError) {
+      console.error('Failed to send password change email:', emailError);
+    }
+    
+    res.json({ message: 'Your password has been successfully reset' });
+  } catch (error) {
+    console.error('Error confirming password reset:', error);
+    res.status(500).json({ error: 'Failed to reset password' });
+  }
+};
+
+// DELETE /api/user/account - Delete user account
+exports.deleteAccount = async (req, res) => {
+  try {
+    const { password } = req.body;
+    const userId = req.user._id;
+    
+    if (!password) {
+      return res.status(400).json({ 
+        error: 'Password is required for account deletion' 
+      });
+    }
+    
+    const user = await User.findById(userId);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Verify password for re-authentication
+    const isMatch = await user.comparePassword(password);
+    if (!isMatch) {
+      return res.status(401).json({ error: 'Incorrect password' });
+    }
+    
+    const userEmail = user.email;
+    
+    // Log activity before deletion
+    await logActivity(
+      userId,
+      'delete_account',
+      'auth',
+      'User deleted their account',
+      { email: userEmail },
+      req
+    );
+    
+    // Delete the user
+    await User.findByIdAndDelete(userId);
+    
+    // Send confirmation email
+    try {
+      await emailService.sendAccountDeletionEmail(userEmail);
+    } catch (emailError) {
+      console.error('Failed to send account deletion email:', emailError);
+    }
+    
+    res.json({ message: 'Account deleted successfully' });
+  } catch (error) {
+    console.error('Error deleting account:', error);
+    res.status(500).json({ error: 'Failed to delete account' });
+  }
+};
+
+// GET /api/user/settings - Get user settings
+exports.getSettings = async (req, res) => {
+  try {
+    const userId = req.user._id;
+    
+    const user = await User.findById(userId);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    res.json({
+      settings: user.settings || {}
+    });
+  } catch (error) {
+    console.error('Error fetching settings:', error);
+    res.status(500).json({ error: 'Failed to fetch settings' });
+  }
+};
+
+// PUT /api/user/settings - Update user settings
+exports.updateSettings = async (req, res) => {
+  try {
+    const userId = req.user._id;
+    const newSettings = req.body;
+    
+    if (!newSettings || typeof newSettings !== 'object') {
+      return res.status(400).json({ error: 'Settings must be an object' });
+    }
+    
+    const user = await User.findById(userId);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+    
+    // Merge new settings with existing settings
+    user.settings = {
+      ...user.settings,
+      ...newSettings
+    };
+    
+    await user.save();
+    
+    // Log activity
+    await logActivity(
+      userId,
+      'update_settings',
+      'settings',
+      'User updated their settings',
+      { updatedKeys: Object.keys(newSettings) },
+      req
+    );
+    
+    res.json({
+      message: 'Settings updated successfully',
+      settings: user.settings
+    });
+  } catch (error) {
+    console.error('Error updating settings:', error);
+    res.status(500).json({ error: 'Failed to update settings' });
+  }
+};

package/src/controllers/userAdmin.controller.js

@@ -0,0 +1,277 @@
+const mongoose = require('mongoose');
+const User = require('../models/User');
+const Notification = require('../models/Notification');
+const OrganizationMember = require('../models/OrganizationMember');
+const { createAuditEvent, getBasicAuthActor } = require('../services/audit.service');
+
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 500;
+
+function parseLimit(value) {
+  const parsed = parseInt(value, 10);
+  if (!Number.isFinite(parsed)) return DEFAULT_LIMIT;
+  return Math.min(MAX_LIMIT, Math.max(1, parsed));
+}
+
+function parseOffset(value) {
+  const parsed = parseInt(value, 10);
+  if (!Number.isFinite(parsed)) return 0;
+  return Math.max(0, parsed);
+}
+
+function escapeRegex(str) {
+  return String(str).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+exports.listUsers = async (req, res) => {
+  try {
+    const { q, role, subscriptionStatus, currentPlan, disabled, limit, offset } = req.query;
+
+    const parsedLimit = parseLimit(limit);
+    const parsedOffset = parseOffset(offset);
+
+    const query = {};
+
+    if (q) {
+      const pattern = escapeRegex(String(q).trim());
+      query.$or = [
+        { email: { $regex: pattern, $options: 'i' } },
+        { name: { $regex: pattern, $options: 'i' } },
+      ];
+    }
+
+    if (role) {
+      query.role = String(role);
+    }
+
+    if (subscriptionStatus) {
+      query.subscriptionStatus = String(subscriptionStatus);
+    }
+
+    if (currentPlan) {
+      query.currentPlan = String(currentPlan);
+    }
+
+    if (disabled === 'true') {
+      query.disabled = true;
+    } else if (disabled === 'false') {
+      query.disabled = { $ne: true };
+    }
+
+    const users = await User.find(query)
+      .select('-passwordHash -passwordResetToken -passwordResetExpiry')
+      .sort({ createdAt: -1 })
+      .limit(parsedLimit)
+      .skip(parsedOffset)
+      .lean();
+
+    const total = await User.countDocuments(query);
+
+    return res.json({
+      users,
+      pagination: {
+        total,
+        limit: parsedLimit,
+        offset: parsedOffset,
+      },
+    });
+  } catch (error) {
+    console.error('Admin user list error:', error);
+    return res.status(500).json({ error: 'Failed to list users' });
+  }
+};
+
+exports.getUser = async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    if (!id || !mongoose.Types.ObjectId.isValid(String(id))) {
+      return res.status(400).json({ error: 'Invalid user ID' });
+    }
+
+    const user = await User.findById(id)
+      .select('-passwordHash -passwordResetToken -passwordResetExpiry')
+      .lean();
+
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    const [notificationCount, orgMembershipCount] = await Promise.all([
+      Notification.countDocuments({ userId: user._id }),
+      OrganizationMember.countDocuments({ userId: user._id, status: 'active' }),
+    ]);
+
+    return res.json({
+      user,
+      counts: {
+        notifications: notificationCount,
+        organizations: orgMembershipCount,
+      },
+    });
+  } catch (error) {
+    console.error('Admin user get error:', error);
+    return res.status(500).json({ error: 'Failed to get user' });
+  }
+};
+
+exports.updateUser = async (req, res) => {
+  try {
+    const { id } = req.params;
+    const { name, role, subscriptionStatus, currentPlan } = req.body;
+
+    if (!id || !mongoose.Types.ObjectId.isValid(String(id))) {
+      return res.status(400).json({ error: 'Invalid user ID' });
+    }
+
+    const user = await User.findById(id);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    const before = user.toJSON();
+    const actor = getBasicAuthActor(req);
+
+    if (name !== undefined) {
+      user.name = String(name).trim();
+    }
+
+    if (role !== undefined) {
+      if (!['user', 'admin'].includes(String(role))) {
+        return res.status(400).json({ error: 'Invalid role. Must be user or admin.' });
+      }
+      user.role = String(role);
+    }
+
+    if (subscriptionStatus !== undefined) {
+      const validStatuses = ['none', 'active', 'cancelled', 'past_due', 'incomplete', 'incomplete_expired', 'trialing', 'unpaid'];
+      if (!validStatuses.includes(String(subscriptionStatus))) {
+        return res.status(400).json({ error: 'Invalid subscription status' });
+      }
+      user.subscriptionStatus = String(subscriptionStatus);
+    }
+
+    if (currentPlan !== undefined) {
+      const planStr = String(currentPlan).trim();
+      if (planStr.length > 100) {
+        return res.status(400).json({ error: 'Plan name too long (max 100 chars)' });
+      }
+      user.currentPlan = planStr || 'free';
+    }
+
+    await user.save();
+
+    await createAuditEvent({
+      ...actor,
+      action: 'admin.user.update',
+      entityType: 'User',
+      entityId: String(user._id),
+      before,
+      after: user.toJSON(),
+      meta: null,
+    });
+
+    return res.json({ user: user.toJSON() });
+  } catch (error) {
+    console.error('Admin user update error:', error);
+    return res.status(500).json({ error: 'Failed to update user' });
+  }
+};
+
+exports.disableUser = async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    if (!id || !mongoose.Types.ObjectId.isValid(String(id))) {
+      return res.status(400).json({ error: 'Invalid user ID' });
+    }
+
+    const user = await User.findById(id);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    const before = user.toJSON();
+    const actor = getBasicAuthActor(req);
+
+    user.disabled = true;
+    await user.save();
+
+    await createAuditEvent({
+      ...actor,
+      action: 'admin.user.disable',
+      entityType: 'User',
+      entityId: String(user._id),
+      before,
+      after: user.toJSON(),
+      meta: null,
+    });
+
+    return res.json({ message: 'User disabled successfully', user: user.toJSON() });
+  } catch (error) {
+    console.error('Admin user disable error:', error);
+    return res.status(500).json({ error: 'Failed to disable user' });
+  }
+};
+
+exports.enableUser = async (req, res) => {
+  try {
+    const { id } = req.params;
+
+    if (!id || !mongoose.Types.ObjectId.isValid(String(id))) {
+      return res.status(400).json({ error: 'Invalid user ID' });
+    }
+
+    const user = await User.findById(id);
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    const before = user.toJSON();
+    const actor = getBasicAuthActor(req);
+
+    user.disabled = false;
+    await user.save();
+
+    await createAuditEvent({
+      ...actor,
+      action: 'admin.user.enable',
+      entityType: 'User',
+      entityId: String(user._id),
+      before,
+      after: user.toJSON(),
+      meta: null,
+    });
+
+    return res.json({ message: 'User enabled successfully', user: user.toJSON() });
+  } catch (error) {
+    console.error('Admin user enable error:', error);
+    return res.status(500).json({ error: 'Failed to enable user' });
+  }
+};
+
+exports.getUserStats = async (req, res) => {
+  try {
+    const [
+      totalUsers,
+      adminUsers,
+      activeSubscriptions,
+      disabledUsers,
+    ] = await Promise.all([
+      User.countDocuments({}),
+      User.countDocuments({ role: 'admin' }),
+      User.countDocuments({ subscriptionStatus: 'active' }),
+      User.countDocuments({ disabled: true }),
+    ]);
+
+    return res.json({
+      total: totalUsers,
+      admins: adminUsers,
+      activeSubscriptions,
+      disabled: disabledUsers,
+    });
+  } catch (error) {
+    console.error('Admin user stats error:', error);
+    return res.status(500).json({ error: 'Failed to get user stats' });
+  }
+};