@resolveio/server-lib 12.5.53 → 12.5.54

package/src/http/auth.ts

@@ -0,0 +1,732 @@
+import { Users } from '../collections/user.collection';
+import * as jwt from 'jsonwebtoken';
+import * as handlebars from 'handlebars';
+import ResolveIOMainServer from '../server-app';
+import { ResolveIOServer } from '..';
+import { objectIdHexString } from '../managers/mongo.manager';
+import { UserModel } from '../models/user.model';
+import SimpleSchema from 'simpl-schema';
+import * as bodyParser from 'body-parser';
+import jwt_decode from 'jwt-decode';
+
+export function setupAuthRoutes(mainServer: ResolveIOMainServer, app, serverConfig) {
+	app.post('/login365', bodyParser.json(), async (request, response) => {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				id_token: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/login)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/login365' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			let tokenData = body.id_token.split('&');
+			let token = tokenData[0].split('=')[1];
+			let decodedJWT = jwt_decode(token);
+
+			if (decodedJWT && decodedJWT['name'] && decodedJWT['preferred_username'] && decodedJWT['oid']) {
+				let user = await Users.findOne({'other.ms_oid': decodedJWT['oid']});
+
+				if (!user) {
+					user = await Users.findOne({email: decodedJWT['preferred_username']});
+
+					if (user) {
+						await Users.updateOne({_id: user._id}, {$set: {'other.ms_oid': decodedJWT['oid']}});
+					}
+				}
+
+				if (!user) {
+					user = {
+						_id: objectIdHexString(),
+						__v: 0,
+						roles: {
+							super_admin: false,
+							approvals: [],
+							groups: [],
+							notifications: [],
+							miscs: []
+						},
+						username: decodedJWT['preferred_username'],
+						email: decodedJWT['preferred_username'],
+						fullname: decodedJWT['name'],
+						active: true,
+						phonenumber: '',
+						readonly: false,
+						other: {
+							ms_oid: decodedJWT['oid']
+						},
+						attempts: 0,
+						salt: jwt.sign({now: (Date.now() - 1000).toString()}, serverConfig['JWT_SECRET'], {
+							expiresIn : 90 * 24 * 60 * 60 * 1000 // 90 days
+						}),
+						hash: jwt.sign({now: (Date.now() + 1000).toString()}, serverConfig['JWT_SECRET'], {
+							expiresIn : 90 * 24 * 60 * 60 * 1000 // 90 days
+						}),
+						last:  new Date(),
+						settings: null,
+						services: null
+					};
+					
+					await Users.create(user);
+				}
+				else {
+					let update = false;
+
+					if (user.email !== decodedJWT['preferred_username']) {
+						user.email = decodedJWT['preferred_username'];
+						update = true;
+					}
+
+					if (user.fullname !== decodedJWT['name']) {
+						user.fullname = decodedJWT['name'];
+						update = true;
+					}
+
+					if (update) {
+						await Users.updateOne({_id: user._id}, {$set: {email: user.email, fullname: user.fullname}});
+					}
+				}
+
+				response.send(JSON.stringify({
+					error: false,
+					result: {
+						token: jwt.sign({id_user: user._id}, serverConfig['JWT_SECRET'], {
+							expiresIn : 90 * 24 * 60 * 60 * 1000 // 90 days
+						})
+					}
+				}));
+			}
+			else {
+				console.log('ERROR - 1', tokenData, token, decodedJWT);
+
+				response.send(JSON.stringify({
+					error: true,
+					result: 'Invalid Azure Token'
+				}));
+			}
+		}
+	});
+
+	// Login via HTTP, return refresh token if authenticated
+	app.post('/login', bodyParser.json(), async (request, response) => {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				username: {
+					type: String
+				},
+				password: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/login)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/login' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			let user = await Users.findOne({username: body.username});
+
+			if (!user) {
+				user = await Users.findOne({email: body.username});
+			}
+			
+			if (!user) {
+				response.send(JSON.stringify({
+					error: true,
+					result: 'Invalid Username And Password'
+				}));
+
+				return;
+			}
+
+			let resAuth = await Users.authenticate(user, body.password);
+
+			if (resAuth['error']) {
+				if (resAuth['error'] === 'Too Many Attempts') {
+					response.send(JSON.stringify({
+						error: true,
+						result: resAuth['error'] + '.  A password reset link has been sent to your email, please reset your password.'
+					}));
+
+					if (!user.services) {
+						user.services = {};
+					}
+
+					user.services['forgot_password'] = jwt.sign({id_user: user._id}, serverConfig['JWT_SECRET']);
+
+					let emailData = {
+						userToChangePassword: user.fullname,
+						userWhoResetPassword: ResolveIOServer.getClientName() + ' System',
+						url: (serverConfig['ROOT_URL'] + '/forgot-password?' + encodeURIComponent(serverConfig['SERVER_URL']) + '&' + user.services['forgot_password'])
+					};
+
+					Users.updateOne({_id: user._id}, {$set: {services: user.services}}).then(resUp => {
+						mainServer.getMethodManager().readFile('email-templates/forgot-password.html').then(html => {
+							let template = handlebars.compile(html);
+							handlebars.registerHelper('equals', (a, b) => {
+								return a === b;
+							});
+		
+							mainServer.getMethodManager().sendEmail(user.email, 'ResolveIO (' + ResolveIOServer.getClientName() + ') - Forgot Password', '', template(emailData), null, null, '');
+						}, errEmail => console.log(errEmail));
+					}, errUp => {});
+				}
+				else if (resAuth['error'] === 'No Salt Value Stored') {
+					response.send(JSON.stringify({
+						error: true,
+						result: 'A password reset link has been sent to your email, please reset your password.'
+					}));
+
+					if (!user.services) {
+						user.services = {};
+					}
+
+					user.services['forgot_password'] = jwt.sign({id_user: user._id}, serverConfig['JWT_SECRET']);
+
+					let emailData = {
+						userToChangePassword: user.fullname,
+						userWhoResetPassword: ResolveIOServer.getClientName() + ' System',
+						url: (serverConfig['ROOT_URL'] + '/forgot-password?' + encodeURIComponent(serverConfig['SERVER_URL']) + '&' + user.services['forgot_password'])
+					};
+
+					Users.updateOne({_id: user._id}, {$set: {services: user.services}}).then(resUp => {
+						mainServer.getMethodManager().readFile('email-templates/forgot-password.html').then(html => {
+							let template = handlebars.compile(html);
+							handlebars.registerHelper('equals', (a, b) => {
+								return a === b;
+							});
+		
+							mainServer.getMethodManager().sendEmail(user.email, 'ResolveIO (' + ResolveIOServer.getClientName() + ') - Forgot Password', '', template(emailData), null, null, '');
+						}, errEmail => console.log(errEmail));
+					}, err => {});
+				}
+				else {
+					response.send(JSON.stringify({
+						error: true,
+						result: resAuth['error']
+					}));
+				}
+			}
+			else {
+				if (resAuth && resAuth['data'] && resAuth['data'].active) {
+					await Users.resetAttempts(resAuth['data']);
+					response.send(JSON.stringify({
+						error: false,
+						result: {
+							token: jwt.sign({id_user: resAuth['data']._id}, serverConfig['JWT_SECRET'], {
+								expiresIn : 90 * 24 * 60 * 60 * 1000 // 90 days
+							})
+						} 
+					}));
+				}
+			}
+		}
+	});
+
+	app.post('/accessToken', bodyParser.json(), async function (request, response) {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_SECONDARY_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				refreshToken: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/accessToken)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/accessToken' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			jwt.verify(body.refreshToken, serverConfig['JWT_SECRET'], (err, decoded) => {
+				if (err) {
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Token'
+					}));
+				}
+				else {
+					Users.findById(decoded['id_user']).then(async (user: UserModel) => {
+						if (user) {
+							if (user.active) {
+								response.send(JSON.stringify({
+									error: false,
+									result: {
+										token: jwt.sign({id_user: user._id}, serverConfig['JWT_SECRET'], {
+											expiresIn : 3 * 24 * 60 * 60 * 1000 // 3 days
+										}),
+										user: user
+									}
+								}));
+							}
+							else {
+								response.send(JSON.stringify({
+									error: true,
+									result: 'Account is Disabled'
+								}));
+							}
+						}
+						else {
+							response.send(JSON.stringify({
+								error: true,
+								result: 'Invalid User'
+							}));
+						}
+					}, error => {
+						response.send(JSON.stringify({
+							error: true,
+							result: 'Invalid Mongo Get User'
+						}));
+					});
+				}
+			});
+		}
+	});
+
+	app.post('/userWithEnrollmentToken', bodyParser.json(), function (request, response) {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_SECONDARY_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				enrollmentToken: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/userWithEnrollmentToken)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/userWithEnrollmentToken' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			jwt.verify(body.enrollmentToken, serverConfig['JWT_SECRET'], (err, decoded) => {
+				if (err) {
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Token'
+					}));
+				}
+				else {
+					Users.findOne({
+						$and: [
+							{_id: decoded['id_user']},
+							{'services.enrollment': body.enrollmentToken}
+						]
+					}, {projection: {_id: 1, __v: 1, username: 1, active: 1}}).then((user) => {
+						if (user) {
+							if (user.active) {
+
+								response.send(JSON.stringify({
+									error: false,
+									result: {
+										user: user
+									}
+								}));
+							}
+							else {
+								response.send(JSON.stringify({
+									error: true,
+									result: 'Account is Disabled'
+								}));
+							}
+						}
+						else {
+							response.send(JSON.stringify({
+								error: true,
+								result: 'Invalid User'
+							}));
+						}
+					}, error => {
+						response.send(JSON.stringify({
+							error: true,
+							result: 'Invalid Mongo Get User'
+						}));
+					});
+				}
+			});
+		}
+	});
+
+	app.post('/setUserWithEnrollmentToken', bodyParser.json(), function (request, response) {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_SECONDARY_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				enrollmentToken: {
+					type: String
+				},
+				password: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/setUserWithEnrollmentToken)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/setUserWithEnrollmentToken' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			jwt.verify(body.enrollmentToken, serverConfig['JWT_SECRET'], async (err, decoded) => {
+				if (err) {
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Token'
+					}));
+				}
+				else {
+					Users.findOne({
+						$and: [
+							{_id: decoded['id_user']},
+							{'services.enrollment': body.enrollmentToken}
+						]
+					}).then(async (user: UserModel) => {
+						if (user) {
+							if (user.active) {
+								await Users.setPassword(user, body.password);
+
+								response.send(JSON.stringify({
+									error: false,
+									result: true
+								}));
+							}
+							else {
+								response.send(JSON.stringify({
+									error: true,
+									result: 'Account is Disabled'
+								}));
+							}
+						}
+						else {
+							response.send(JSON.stringify({
+								error: true,
+								result: 'Invalid User'
+							}));
+						}
+					}, error => {
+						response.send(JSON.stringify({
+							error: true,
+							result: 'Invalid Mongo Get User'
+						}));
+					});
+				}
+			});
+		}
+	});
+
+	app.post('/userWithForgotPasswordToken', bodyParser.json(), function (request, response) {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_SECONDARY_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				forgotPasswordToken: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/userWithForgotPasswordToken)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/userWithForgotPasswordToken' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			jwt.verify(body.forgotPasswordToken, serverConfig['JWT_SECRET'], (err, decoded) => {
+				if (err) {
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Token'
+					}));
+				}
+				else {
+					Users.findOne({
+						$and: [
+							{_id: decoded['id_user']},
+							{'services.forgot_password': body.forgotPasswordToken}
+						]
+					}, {projection: {_id: 1, __v: 1, username: 1, active: 1}}).then((user) => {
+						if (user) {
+							if (user.active) {
+								response.send(JSON.stringify({
+									error: false,
+									result: {
+										user: user
+									}
+								}));
+							}
+							else {
+								response.send(JSON.stringify({
+									error: true,
+									result: 'Account is Disabled'
+								}));
+							}
+						}
+						else {
+							response.send(JSON.stringify({
+								error: true,
+								result: 'Invalid Token'
+							}));
+						}
+					}, error => {
+						response.send(JSON.stringify({
+							error: true,
+							result: 'Invalid Mongo Get User'
+						}));
+					});
+				}
+			});
+		}
+	});
+
+	app.post('/setUserWithForgotPasswordToken', bodyParser.json(), function (request, response) {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_URL'] && request.headers.origin !== serverConfig['RESOLVEIO_SECONDARY_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				forgotPasswordToken: {
+					type: String
+				},
+				password: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/setUserWithForgotPasswordToken)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/setUserWithForgotPasswordToken' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			jwt.verify(body.forgotPasswordToken, serverConfig['JWT_SECRET'], async (err, decoded) => {
+				if (err) {
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Token'
+					}));
+				}
+				else {
+					Users.findOne({
+						$and: [
+							{_id: decoded['id_user']},
+							{'services.forgot_password': body.forgotPasswordToken}
+						]
+					}).then(async (user: UserModel) => {
+						if (user) {
+							if (user.active) {
+								await Users.setPassword(user, body.password);
+								
+								response.send(JSON.stringify({
+									error: false,
+									result: true
+								}));
+							}
+							else {
+								response.send(JSON.stringify({
+									error: true,
+									result: 'Account is Disabled'
+								}));
+							}
+						}
+						else {
+							response.send(JSON.stringify({
+								error: true,
+								result: 'Invalid User'
+							}));
+						}
+					}, error => {
+						response.send(JSON.stringify({
+							error: true,
+							result: 'Invalid Mongo Get User'
+						}));
+					});
+				}
+			});
+		}
+	});
+
+	app.post('/resetPassword', bodyParser.json(), async (request, response) => {
+		if (request.headers.origin !== serverConfig['ROOT_URL'] && request.headers.origin !== serverConfig['SEC_ROOT_URL']) {
+			response.send(JSON.stringify({
+				error: true,
+				result: 'Invalid header'
+			}));
+		}
+		else {
+			let body = request.body;
+
+			let schema = new SimpleSchema({
+				username: {
+					type: String
+				}
+			});
+	
+			try {
+				schema.validate(body);
+			}
+			catch (errors) {
+				if (errors) {
+					console.error(new Date(), 'Error in HTTP Check (/resetPassword)', errors);
+	
+					ResolveIOServer.getMainServer().getMethodManager().sendEmail('dev@resolveio.com', ResolveIOServer.getClientName() + 'HTTP - Error Detected', 'Match Error On HTTP ' + '/resetPassword' + '\n\nData Being Checked\n' + JSON.stringify(body, null, 2) + '\n\nErrors\n' + JSON.stringify(errors, null, 2));
+	
+					response.send(JSON.stringify({
+						error: true,
+						result: 'Invalid Parameters'
+					}));
+		
+					return;
+				}
+			}
+
+			let user = await Users.findOne({username: body.username});
+
+			if (!user) {
+				user = await Users.findOne({email: body.username});
+			}
+			
+			if (user) {
+				mainServer.getMethodManager().callMethodInternal.call(mainServer.getMethodManager(), 'resetUserPassword', user._id);
+			}
+
+			response.send(JSON.stringify({
+				error: false,
+				result: ''
+			}));
+		}
+	});
+}