@nka212bg/backend-utils 0.1.60 → 0.1.62

package/location/index.js

@@ -5,21 +5,24 @@ const { locales, timeZones } = require(`./localelib`);
 const Reader = require("@maxmind/geoip2-node").Reader;
 const GeoDB = Reader.openBuffer(readFileSync(`${__dirname}/GeoLite2-City.mmdb`));
 
-exports.userIp = (req) => {
+// x-forwarded-for is client-controlled, trust it only behind a reverse proxy (nginx, Cloudflare...)
+exports.userIp = (req, { trustProxy = false } = {}) => {
     if (!req) throw new Error("Request object is missing, can't work like that! That's absurd!!!");
 
-    let ip = (req.headers["x-forwarded-for"] || req.socket?.remoteAddress || req.connection?.remoteAddress || req.ip)?.split(",")[0].replace(/::ffff:/gi, "");
+    let ip = ((trustProxy && req.headers["x-forwarded-for"]) || req.socket?.remoteAddress || req.connection?.remoteAddress || req.ip)
+        ?.split(",")[0]
+        .trim()
+        .replace(/::ffff:/gi, "");
 
-    // if (["127.0.0.1", "::1"].includes(ip)) return "146.70.185.8";
     return ip;
 };
 
 // user geo
-exports.location = ({ req, ip }) => {
+exports.location = ({ req, ip, trustProxy }) => {
     let userIP;
     try {
         if (!ip && !req) throw "missing_required";
-        userIP = ip || this.userIp(req);
+        userIP = ip || this.userIp(req, { trustProxy });
         const geo = GeoDB.city(userIP);
 
         const country = locales[geo.country.isoCode];

package/package.json

@@ -1,19 +1,20 @@
 {
     "name": "@nka212bg/backend-utils",
     "author": "nka212bg",
-    "version": "0.1.60",
+    "version": "0.1.62",
     "main": "index.js",
     "dependencies": {
         "@maxmind/geoip2-node": "^5.0.0",
-        "systeminformation": "^5.21.24",
+        "adm-zip": "^0.5.16",
         "formidable": "^2.1.5",
+        "mysql2": "^3.11.0",
         "nodemailer": "^8.0.8",
-        "adm-zip": "^0.5.16",
         "os-utils": "^0.0.14",
-        "stripe": "^14.23.0",
-        "mysql2": "^3.11.0",
-        "sqlite3": "^6.0.1",
         "sharp": "^0.33.5",
+        "sqlite3": "^6.0.1",
+        "stripe": "^14.23.0",
+        "systeminformation": "^5.21.24",
+        "web-push": "^3.6.7",
         "ws": "^7.3.0"
     }
 }

package/socket.js

@@ -115,60 +115,3 @@ module.exports = (server, { authenticate } = {}) => {
     return socket;
 };
 
-
-
-
-
-////////////////////////////////////////
-
-// "web-push": "^3.2.2", // package.json
-// const webPush = require("web-push");
-// const VAPID_KEYS = webPush.generateVAPIDKeys();
-
-// webPush.setVapidDetails(process.env.VAPID_ORIGIN, process.env.VAPID_PUBLIC_KEY, process.env.VAPID_PRIVATE_KEY);
-
-// module.exports = (app) => {
-//     app.get("vapidPublicKey", function (req, res) {
-//         res.send(process.env.VAPID_PUBLIC_KEY);
-//     });
-
-//     app.post("register", function (req, res) {
-//         // A real world application would store the subscription info.
-//         res.sendStatus(201);
-//     });
-
-//     app.post("sendNotification", function (req, res) {
-//         const subscription = req.body.subscription;
-//         const payload = req.body.payload;
-//         const options = {
-//             TTL: req.body.ttl,
-//         };
-
-//         setTimeout(function () {
-//             webPush
-//                 .sendNotification(subscription, payload, options)
-//                 .then(function () {
-//                     res.sendStatus(201);
-//                 })
-//                 .catch(function (error) {
-//                     console.log(error);
-//                     res.sendStatus(500);
-//                 });
-//         }, req.body.delay * 1000);
-
-//         fetch("./sendNotification", {
-//             method: "post",
-//             headers: {
-//                 "Content-type": "application/json",
-//             },
-//             body: JSON.stringify({
-//                 subscription: subscription,
-//                 payload: payload,
-//                 delay: delay,
-//                 ttl: ttl,
-//             }),
-//         });
-//     });
-
-//     return app;
-// };

package/webPush.js

@@ -0,0 +1,118 @@
+const { existsSync, readFileSync, writeFileSync, mkdirSync } = require("fs");
+const webPush = require("web-push");
+
+!existsSync(`${__basedir}/state`) && mkdirSync(`${__basedir}/state`, { recursive: true });
+const subscriptionsFilePath = `${__basedir}/state/pushSubscriptions.json`;
+
+// { "<userId>": { "<endpoint>": subscription } }
+let SUBSCRIPTIONS = existsSync(subscriptionsFilePath) ? JSON.parse(readFileSync(subscriptionsFilePath, "utf8") || "{}") : {};
+
+const val = (v) => (typeof v == "function" ? v() : v);
+const toSubscription = (s) => (typeof s == "string" ? JSON.parse(s) : s);
+
+// sync on purpose, overlapping async writeFile calls on the same file can corrupt it
+const saveSubscriptions = () => writeFileSync(subscriptionsFilePath, JSON.stringify(SUBSCRIPTIONS));
+
+// -------- user's devices --------
+// shared by all instances, it's one file on disk
+const subscriptionState = {
+    is(userId) {
+        return Object.values(SUBSCRIPTIONS[userId] || {});
+    },
+
+    // an endpoint belongs to one user only (same browser, different account)
+    subscribe(userId, subscription) {
+        subscription = toSubscription(subscription);
+        if (!userId || !subscription?.endpoint) return;
+
+        removeEndpoint(subscription.endpoint);
+        (SUBSCRIPTIONS[userId] ||= {})[subscription.endpoint] = subscription;
+        saveSubscriptions();
+    },
+
+    unsubscribe(endpoint) {
+        if (removeEndpoint(endpoint)) saveSubscriptions();
+    },
+};
+
+const removeEndpoint = (endpoint) => {
+    let change;
+    Object.keys(SUBSCRIPTIONS).forEach((userId) => {
+        if (!(endpoint in SUBSCRIPTIONS[userId])) return;
+
+        delete SUBSCRIPTIONS[userId][endpoint];
+        if (!Object.keys(SUBSCRIPTIONS[userId]).length) delete SUBSCRIPTIONS[userId];
+        change = true;
+    });
+
+    return change;
+};
+
+// the subject must be an https: URL or a mailto:, so anything else (http local dev) falls back to the smtp user's email
+const smtpUser = () => (process.env.SMTP_URL ? decodeURIComponent(new URL(process.env.SMTP_URL).username) : process.env.SMTP_USER);
+const vapidSubject = (subject) => (/^(https|mailto):/.test(subject || "") ? subject : `mailto:${smtpUser()}`);
+
+// every call creates a separate instance with its own config:
+// const { sendPush, subscriptionState, publicKey } = require(".../webPush")({ subject: () => __baseUrl, options: { TTL: 86400, urgency: "high" } }); // publicKey()
+// subscriptionState.subscribe(userId, subscription); sendPush({ userId, payload: { title, body } });
+// const { sendPush } = require(".../webPush"); // default instance, env config only
+//
+// empty values fall back to process.env (VAPID_SUBJECT, VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY)
+// subject, publicKey, privateKey, options can also be functions, resolved on each send (e.g. subject: () => __baseUrl)
+const createInstance = (opts = {}) => {
+    const config = {
+        subject: "",
+        publicKey: "",
+        privateKey: "",
+        options: {}, // web-push sendNotification options { TTL, urgency, topic… }
+        ...opts,
+    };
+
+    const publicKey = () => val(config.publicKey) || process.env.VAPID_PUBLIC_KEY;
+
+    return {
+        subscriptionState,
+
+        // for the client's pushManager.subscribe({ applicationServerKey })
+        publicKey,
+
+        // userId: sends to the user's stored subscriptions and deletes the expired ones
+        // subscriptions: or pass them directly, one or an array, objects or JSON strings
+        // options are merged over the instance options
+        // "data" means the push service accepted it, not that the device showed it (offline devices get it later, within TTL)
+        // "expired" (404/410) subscriptions are dead, delete them if you passed them directly
+        async sendPush({ userId, subscriptions, payload, options } = {}) {
+            if (userId) subscriptions = subscriptionState.is(userId);
+            if (!Array.isArray(subscriptions)) subscriptions = subscriptions ? [subscriptions] : [];
+            if (!subscriptions.length) return { error: "missing_subscriptions", data: [] };
+            if (!payload) return { error: "missing_payload", data: [] };
+
+            subscriptions = subscriptions.map(toSubscription);
+            if (typeof payload != "string") payload = JSON.stringify(payload);
+
+            const vapidDetails = {
+                subject: vapidSubject(val(config.subject) || process.env.VAPID_SUBJECT),
+                publicKey: publicKey(),
+                privateKey: val(config.privateKey) || process.env.VAPID_PRIVATE_KEY,
+            };
+            options = { ...val(config.options), ...options, vapidDetails };
+
+            const results = await Promise.allSettled(subscriptions.map((s) => webPush.sendNotification(s, payload, options)));
+
+            const data = [];
+            const expired = [];
+            const errors = [];
+            results.forEach((r, i) => {
+                if (r.status == "fulfilled") return data.push(subscriptions[i]);
+                [404, 410].includes(r.reason.statusCode) ? expired.push(subscriptions[i]) : errors.push(r.reason);
+            });
+
+            if (userId && expired.length && expired.map((s) => removeEndpoint(s.endpoint)).some(Boolean)) saveSubscriptions();
+
+            return { error: errors.length ? errors : null, expired: expired.length ? expired : null, data };
+        },
+    };
+};
+
+// callable for a configured instance, plain require gives the default one
+module.exports = Object.assign(createInstance, createInstance());