@prosopo/client-example-server 0.2.11 → 0.2.13

package/env.development

@@ -0,0 +1,9 @@
+REACT_APP_API_PATH_PREFIX=/v1/prosopo
+REACT_APP_DAPP_SITE_KEY=
+REACT_APP_SUBSTRATE_NODE_URL=ws://localhost:9944
+REACT_APP_PROSOPO_CONTRACT_ADDRESS=
+REACT_APP_WEB2=true
+REACT_APP_SERVER_URL=https://localhost
+REACT_APP_SERVER_MNEMONIC=//Bob
+REACT_APP_SERVER_ACCOUNT_ADDRESS=
+REACT_APP_SERVER_PORT=9228

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@prosopo/client-example-server",
-    "version": "0.2.11",
+    "version": "0.2.13",
     "description": "Backend for client-example",
     "main": "dist/app.js",
     "type": "module",
@@ -30,15 +30,14 @@
     "homepage": "https://github.com/prosopo/client-example-server#readme",
     "dependencies": {
         "@noble/hashes": "^1.3.1",
-        "@polkadot/util": "12.3.2",
-        "@polkadot/util-crypto": "12.3.2",
-        "@prosopo/api": "0.2.11",
-        "@prosopo/contract": "0.2.11",
-        "@prosopo/procaptcha": "0.2.11",
-        "@prosopo/server": "0.2.11",
-        "@prosopo/types": "0.2.11",
+        "@polkadot/util": "12.5.1",
+        "@polkadot/util-crypto": "12.5.1",
+        "@prosopo/api": "0.2.13",
+        "@prosopo/contract": "0.2.13",
+        "@prosopo/procaptcha": "0.2.13",
+        "@prosopo/server": "0.2.13",
+        "@prosopo/types": "0.2.13",
         "@typegoose/auto-increment": "3.3.0",
-        "axios": "^1.5.0",
         "cors": "^2.8.5",
         "jsonwebtoken": "^9.0.0",
         "mongoose": "^7.3.3",
@@ -52,6 +51,6 @@
         "tslib": "2.6.2",
         "typescript": "5.1.6",
         "vite": "^4.4.9",
-        "@prosopo/config": "0.2.11"
+        "@prosopo/config": "0.2.13"
     }
 }

package/src/app.ts

@@ -0,0 +1,80 @@
+// Copyright 2021-2023 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { ProsopoServer, getServerConfig } from '@prosopo/server'
+import { getPair } from '@prosopo/contract'
+import connectionFactory from './utils/connection.js'
+import cors from 'cors'
+import dotenv from 'dotenv'
+import express from 'express'
+import memoryServerSetup from './utils/database.js'
+import path from 'path'
+import routesFactory from './routes/routes.js'
+
+export function loadEnv() {
+    dotenv.config({ path: getEnvFile() })
+}
+
+export function getEnvFile(filename = '.env', filepath = './') {
+    const env = process.env.NODE_ENV || 'development'
+    return path.join(filepath, `${filename}.${env}`)
+}
+
+async function main() {
+    loadEnv()
+
+    const app = express()
+
+    app.use(cors({ origin: true, credentials: true }))
+
+    app.use(express.urlencoded({ extended: true }))
+
+    app.use(express.json())
+
+    app.use((_, res, next) => {
+        res.setHeader('Access-Control-Allow-Origin', '*')
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE')
+        res.setHeader('Access-Control-Allow-Headers', 'Origin, Content-Type, X-Auth-Token, Authorization')
+        next()
+    })
+
+    app.options('/*', (_, res) => {
+        res.sendStatus(200)
+    })
+
+    const uri = await memoryServerSetup()
+    console.log('mongo uri', uri)
+    const mongoose = connectionFactory(uri)
+    if (!process.env.REACT_APP_SERVER_MNEMONIC) {
+        throw new Error('No mnemonic found')
+    }
+
+    const config = getServerConfig()
+
+    console.log('config', config)
+    const pair = await getPair(config.networks[config.defaultNetwork], process.env.REACT_APP_SERVER_MNEMONIC)
+    const prosopoServer = new ProsopoServer(config, pair)
+
+    app.use(routesFactory(mongoose, prosopoServer))
+
+    app.listen(process.env.REACT_APP_SERVER_PORT)
+}
+
+main()
+    .then(() => {
+        console.log('Server started')
+    })
+    .catch((err) => {
+        console.log(err)
+        process.exit()
+    })

package/src/controllers/auth.ts

@@ -0,0 +1,142 @@
+// Copyright 2021-2023 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { ApiParams } from '@prosopo/types'
+import { Connection } from 'mongoose'
+import { NextFunction, Request, Response } from 'express'
+import { ProcaptchaResponse } from '@prosopo/types'
+import { ProsopoServer } from '@prosopo/server'
+import { UserInterface } from '../models/user.js'
+import { at } from '@prosopo/util'
+import { blake2b } from '@noble/hashes/blake2b'
+import { randomAsHex } from '@polkadot/util-crypto'
+import { u8aToHex } from '@polkadot/util'
+import { z } from 'zod'
+import jwt from 'jsonwebtoken'
+
+const SubscribeBodySpec = ProcaptchaResponse.merge(
+    z.object({
+        email: z.string().email(),
+        password: z.string(),
+    })
+)
+
+function hashPassword(password: string): string {
+    return u8aToHex(blake2b(password))
+}
+
+const signup = async (
+    mongoose: Connection,
+    prosopoServer: ProsopoServer,
+    req: Request,
+    res: Response,
+    next: NextFunction
+) => {
+    try {
+        const User = mongoose.model<UserInterface>('User')
+        // checks if email exists
+        const dbUser = await User.findOne({
+            email: req.body.email,
+        })
+        const payload = SubscribeBodySpec.parse(req.body)
+        await prosopoServer.isReady()
+        if (dbUser) {
+            return res.status(409).json({ message: 'email already exists' })
+        }
+
+        if (await prosopoServer.isVerified(payload[ApiParams.procaptchaResponse])) {
+            // salt
+            const salt = randomAsHex(32)
+            // !!!DUMMY CODE!!! - Do not use in production. Use bcrypt or similar for password hashing.
+            const passwordHash = hashPassword(`${req.body.password}${salt}`)
+
+            if (passwordHash) {
+                return User.create({
+                    email: req.body.email,
+                    name: req.body.name,
+                    password: passwordHash,
+                    salt: salt,
+                })
+                    .then(() => {
+                        res.status(200).json({ message: 'user created' })
+                    })
+                    .catch((err) => {
+                        console.log(err)
+                        res.status(502).json({ message: 'error while creating the user' })
+                    })
+            }
+        } else {
+            res.status(401).json({ message: 'user has not completed a captcha' })
+        }
+    } catch (err) {
+        console.error('error', err)
+        res.status(500).json({ message: (err as Error).message || 'internal server error' })
+    }
+}
+
+const login = async (mongoose: Connection, prosopoServer: ProsopoServer, req: Request, res: Response) => {
+    const User = mongoose.model<UserInterface>('User')
+    await prosopoServer.isReady()
+    // checks if email exists
+    await User.findOne({
+        email: req.body.email,
+    })
+        .then(async (dbUser) => {
+            if (!dbUser) {
+                res.status(404).json({ message: 'user not found' })
+            } else {
+                const payload = SubscribeBodySpec.parse(req.body)
+
+                if (await prosopoServer.isVerified(payload[ApiParams.procaptchaResponse])) {
+                    // password hash
+                    // !!!DUMMY CODE!!! - Do not use in production. Use bcrypt or similar for password hashing.
+                    const passwordHash = hashPassword(`${req.body.password}${dbUser.salt}`)
+                    if (passwordHash !== dbUser.password) {
+                        // password doesnt match
+                        res.status(401).json({ message: 'invalid credentials' })
+                    } else {
+                        // password match
+                        const token = jwt.sign({ email: req.body.email }, 'secret', { expiresIn: '1h' })
+                        res.status(200).json({ message: 'user logged in', token: token })
+                    }
+                }
+            }
+        })
+        .catch((err) => {
+            console.error('error', err)
+            res.status(500).json({ message: err.message || 'internal server error' })
+        })
+}
+
+const isAuth = (req: Request, res: Response) => {
+    const authHeader = req.get('Authorization') || ''
+    if (!authHeader) {
+        res.status(401).json({ message: 'not authenticated' })
+    }
+
+    const token = at(authHeader.split(' '), 1)
+    let decodedToken
+    try {
+        decodedToken = jwt.verify(token, 'secret')
+    } catch (err) {
+        res.status(500).json({ message: (err as Error).message || 'could not decode the token' })
+    }
+
+    if (!decodedToken) {
+        res.status(401).json({ message: 'unauthorized' })
+    } else {
+        res.status(200).json({ message: 'here is your resource' })
+    }
+}
+
+export { signup, login, isAuth }

package/src/models/user.ts

@@ -0,0 +1,41 @@
+// Copyright 2021-2023 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import mongoose, { Schema } from 'mongoose'
+
+export interface UserInterface {
+    id: number
+    email: string
+    name: string
+    password: string
+    salt: string
+}
+
+const UserSchema = new Schema<UserInterface>({
+    email: {
+        type: mongoose.SchemaTypes.String,
+        required: true,
+    },
+    name: {
+        type: mongoose.SchemaTypes.String,
+    },
+    password: {
+        type: mongoose.SchemaTypes.String,
+        required: true,
+    },
+    id: {
+        type: mongoose.SchemaTypes.Number,
+    },
+})
+
+export default UserSchema

package/src/routes/routes.ts

@@ -0,0 +1,39 @@
+// Copyright 2021-2023 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { Connection } from 'mongoose'
+import { ProsopoServer } from '@prosopo/server'
+import { isAuth, login, signup } from '../controllers/auth.js'
+import express from 'express'
+
+const router = express.Router()
+
+function getRoutes(mongoose: Connection, prosopoServer: ProsopoServer): express.Router {
+    router.post('/login', login.bind(null, mongoose, prosopoServer))
+
+    router.post('/signup', signup.bind(null, mongoose, prosopoServer))
+
+    router.get('/private', isAuth)
+
+    router.get('/public', (req, res) => {
+        res.status(200).json({ message: 'here is your public resource' })
+    })
+
+    // will match any other path
+    router.use('/', (req, res) => {
+        res.status(404).json({ error: 'page not found' })
+    })
+    return router
+}
+
+export default getRoutes

package/src/utils/connection.ts

@@ -0,0 +1,26 @@
+// Copyright 2021-2023 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { AutoIncrementID, AutoIncrementIDOptions } from '@typegoose/auto-increment'
+import UserSchema from '../models/user.js'
+import mongoose, { Connection } from 'mongoose'
+
+function connectionFactory(uri: string): Connection {
+    const conn = mongoose.createConnection(uri)
+    if (!conn.models.user) {
+        UserSchema.plugin(AutoIncrementID, { field: 'id' } as AutoIncrementIDOptions)
+        conn.model('User', UserSchema)
+    }
+    return conn
+}
+export default connectionFactory

package/src/utils/database.ts

@@ -0,0 +1,20 @@
+// Copyright 2021-2023 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { MongoMemoryServer } from 'mongodb-memory-server'
+export async function memoryServerSetup(): Promise<string> {
+    const mongod = MongoMemoryServer.create()
+    const memoryServer = await mongod
+    return memoryServer.getUri()
+}
+export default memoryServerSetup

package/tsconfig.json

@@ -0,0 +1,29 @@
+{
+    "extends": "../../tsconfig.esm.json",
+    "compilerOptions": {
+        "rootDir": "./src",
+        "outDir": "./dist",
+        "lib": ["dom", "dom.iterable", "esnext"]
+    },
+    "include": ["src", "src/**/*.json"],
+    "references": [
+        {
+            "path": "../../packages/api"
+        },
+        {
+            "path": "../../packages/cli"
+        },
+        {
+            "path": "../../packages/contract"
+        },
+        {
+            "path": "../../packages/procaptcha"
+        },
+        {
+            "path": "../../packages/server"
+        },
+        {
+            "path": "../../packages/types"
+        }
+    ]
+}