@semapps/auth 0.4.0-alpha.19 → 0.4.0-alpha.21

package/index.js

@@ -4,5 +4,6 @@ module.exports = {
   AuthOIDCService: require('./services/auth.oidc'),
   AuthAccountService: require('./services/account'),
   AuthJWTService: require('./services/jwt'),
-  AuthMigrationService: require('./services/migration')
+  AuthMigrationService: require('./services/migration'),
+  AuthMailService: require('./services/mail')
 };

package/package.json

@@ -1,26 +1,28 @@
 {
   "name": "@semapps/auth",
-  "version": "0.4.0-alpha.19",
+  "version": "0.4.0-alpha.21",
   "description": "Authentification module for SemApps",
   "license": "Apache-2.0",
   "author": "Virtual Assembly",
   "dependencies": {
-    "@semapps/mime-types": "0.4.0-alpha.19",
-    "@semapps/triplestore": "0.4.0-alpha.19",
+    "@semapps/mime-types": "0.4.0-alpha.21",
+    "@semapps/triplestore": "0.4.0-alpha.21",
     "bcrypt": "^5.0.1",
     "express-session": "^1.17.0",
     "jsonwebtoken": "^8.5.1",
     "moleculer": "^0.14.17",
     "moleculer-db": "^0.8.16",
     "moleculer-web": "^0.10.0-beta1",
+    "node-sass": "^7.0.1",
     "openid-client": "^4.7.4",
     "passport": "^0.4.1",
     "passport-cas2": "0.0.12",
     "passport-local": "^1.0.0",
+    "pug": "^3.0.2",
     "url-join": "^4.0.1"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "594627f715304cb9ebad832ea7019390c7b56711"
+  "gitHead": "03a76d610ac2abb85d8889afcdaa15fceab5039f"
 }

package/services/account.js

@@ -1,6 +1,7 @@
 const bcrypt = require('bcrypt');
 const DbService = require('moleculer-db');
 const { TripleStoreAdapter } = require('@semapps/triplestore');
+const crypto = require('crypto');
 
 module.exports = {
   name: 'auth.account',
@@ -88,6 +89,11 @@ module.exports = {
       const accounts = await this._find(ctx, { query: { webId } });
       return accounts.length > 0 ? accounts[0] : null;
     },
+    async findByEmail(ctx) {
+      const { email } = ctx.params;
+      const accounts = await this._find(ctx, { query: { email } });
+      return accounts.length > 0 ? accounts[0] : null;
+    },
     async setPassword(ctx) {
       const { webId, password } = ctx.params;
       const hashedPassword = await this.hashPassword(password);
@@ -97,6 +103,33 @@ module.exports = {
         '@id': account['@id'],
         hashedPassword
       });
+    },
+    async setNewPassword(ctx) {
+      const { webId, token, password } = ctx.params;
+      const hashedPassword = await this.hashPassword(password);
+      const account = await ctx.call('auth.account.findByWebId', { webId });
+
+      if (account.resetPasswordToken !== token) {
+        throw new Error('auth.password.invalid_reset_token');
+      }
+
+      return await this._update(ctx, {
+        '@id': account['@id'],
+        hashedPassword,
+        resetPasswordToken: undefined
+      });
+    },
+    async generateResetPasswordToken(ctx) {
+      const { webId } = ctx.params;
+      const resetPasswordToken = await this.generateResetPasswordToken();
+      const account = await ctx.call('auth.account.findByWebId', { webId });
+
+      await this._update(ctx, {
+        '@id': account['@id'],
+        resetPasswordToken
+      });
+
+      return resetPasswordToken;
     }
   },
   methods: {
@@ -138,6 +171,16 @@ module.exports = {
           }
         });
       });
+    },
+    async generateResetPasswordToken() {
+      return new Promise(resolve => {
+        crypto.randomBytes(32, function(ex, buf) {
+          if (ex) {
+            reject(ex);
+          }
+          resolve(buf.toString('hex'));
+        });
+      });
     }
   }
 };

package/services/auth.local.js

@@ -2,6 +2,7 @@ const { Strategy } = require('passport-local');
 const AuthMixin = require('../mixins/auth');
 const sendToken = require('../middlewares/sendToken');
 const { MoleculerError } = require('moleculer').Errors;
+const AuthMailService = require('../services/mail');
 
 const AuthLocalService = {
   name: 'auth',
@@ -12,10 +13,29 @@ const AuthLocalService = {
     registrationAllowed: true,
     reservedUsernames: [],
     webIdSelection: [],
-    accountSelection: []
+    accountSelection: [],
+    mail: {
+      from: null,
+      transport: {
+        host: null,
+        port: null
+      },
+      defaults: {
+        locale: null,
+        frontUrl: null
+      }
+    }
   },
-  created() {
+  async created() {
+    const { mail } = this.settings;
+
     this.passportId = 'local';
+
+    await this.broker.createService(AuthMailService, {
+      settings: {
+        ...mail
+      }
+    });
   },
   actions: {
     async signup(ctx) {
@@ -50,6 +70,33 @@ const AuthLocalService = {
       const token = await ctx.call('auth.jwt.generateToken', { payload: { webId: accountData.webId } });
 
       return { token, webId: accountData.webId, newUser: true };
+    },
+    async resetPassword(ctx) {
+      const { email } = ctx.params;
+
+      const account = await ctx.call('auth.account.findByEmail', { email });
+
+      if (!account) {
+        throw new Error('email.not.exists');
+      }
+
+      const token = await ctx.call('auth.account.generateResetPasswordToken', { webId: account.webId });
+
+      await ctx.call('auth.mail.sendResetPasswordEmail', {
+        account,
+        token
+      });
+    },
+    async setNewPassword(ctx) {
+      const { email, token, password } = ctx.params;
+
+      const account = await ctx.call('auth.account.findByEmail', { email });
+
+      if (!account) {
+        throw new Error('email.not.exists');
+      }
+
+      await ctx.call('auth.account.setNewPassword', { webId: account.webId, token, password });
     }
   },
   methods: {
@@ -89,10 +136,23 @@ const AuthLocalService = {
         }
       };
 
+      const resetPasswordRoute = {
+        path: '/auth/reset_password',
+        aliases: {
+          'POST /': 'auth.resetPassword'
+        }
+      };
+      const setNewPasswordRoute = {
+        path: '/auth/new_password',
+        aliases: {
+          'POST /': 'auth.setNewPassword'
+        }
+      };
+
       if (this.settings.registrationAllowed) {
-        return [loginRoute, signupRoute];
+        return [loginRoute, signupRoute, resetPasswordRoute, setNewPasswordRoute];
       } else {
-        return [loginRoute];
+        return [loginRoute, resetPasswordRoute, setNewPasswordRoute];
       }
     }
   }

package/services/mail.js

@@ -0,0 +1,49 @@
+const MailService = require('moleculer-mail');
+const path = require('path');
+
+module.exports = {
+  name: 'auth.mail',
+  mixins: [MailService],
+  settings: {
+    defaults: {
+      locale: 'en',
+      frontUrl: null
+    },
+    templateFolder: path.join(__dirname, '../templates'),
+    from: null,
+    transport: null
+  },
+  actions: {
+    async sendResetPasswordEmail(ctx) {
+      const { account, token } = ctx.params;
+
+      await this.actions.send(
+        {
+          to: account.email,
+          template: 'reset-password',
+          locale: this.getTemplateLocale(account.preferredLocale || this.settings.defaults.locale),
+          data: {
+            account,
+            token,
+            frontUrl: account.preferredFrontUrl || this.settings.defaults.frontUrl
+          }
+        },
+        {
+          parentCtx: ctx
+        }
+      );
+    }
+  },
+  methods: {
+    getTemplateLocale(userLocale) {
+      switch (userLocale) {
+        case 'fr':
+          return 'fr-FR';
+        case 'en':
+          return 'en-EN';
+        default:
+          return 'en-EN';
+      }
+    }
+  }
+};

package/templates/reset-password/en-EN/subject.hbs

@@ -0,0 +1 @@
+Password reset for {{account.username}} account

package/templates/reset-password/en-EN/text.hbs

@@ -0,0 +1,7 @@
+Hello {{account.username}},
+
+In order to reset your password, please click on the link below:
+
+{{frontUrl}}/login?new_password=true&token={{token}}
+
+If you did not request a password reset, please ignore this message.

package/templates/reset-password/fr-FR/subject.hbs

@@ -0,0 +1 @@
+Réinitialisation du mot de passe du compte {{account.username}}

package/templates/reset-password/fr-FR/text.hbs

@@ -0,0 +1,7 @@
+Bonjour {{account.username}},
+
+Pour réinitialiser votre mot de passe, veuillez cliquer sur le lien ci-dessous:
+
+{{frontUrl}}/login?new_password=true&token={{token}}
+
+Si vous n'avez pas fait une telle demande, vous pouvez ignorer ce message.