@server/next 0.20.10 → 0.20.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.10",
+  "version": "0.20.11",
   "description": "An experimental reimplementation of server.js focused on the DX",
   "homepage": "https://node-server.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/auth/auth-token.test.js

@@ -11,32 +11,99 @@ describe("user creation flow", () => {
   const CREDENTIALS = { email: EMAIL, password: PASS };
 
   const store = kv(new Map());
+  const sessions = () => store.prefix("auth:").keys();
+  const users = () => store.prefix("user:").keys();
   const api = server({ store, auth: "token:email" })
     .get("/me", (ctx) => ctx.user || "No data")
     .test();
 
-  it("can create a new user", async () => {
-    const register = await api.post("/auth/register/email", CREDENTIALS);
-    expect(register).toSucceed();
-    expect(await store.keys()).toEqual([
-      "user:abc@test.com",
-      "auth:" + register.data.token,
-    ]);
-
-    const headers = { authorization: "Bearer " + register.data.token };
-    const me = await api.get("/me", { headers });
-    expect(me).toSucceed();
-    expect(me.data.email).toEqual(EMAIL);
-
-    const logout = await api.post("/auth/logout", {}, { headers });
-    expect(logout).toSucceed();
-    expect(await store.keys()).toEqual(["user:abc@test.com"]);
-
-    const login = await api.post("/auth/login/email", CREDENTIALS);
-    expect(login).toSucceed();
-    expect(await store.keys()).toEqual([
-      "user:abc@test.com",
-      "auth:" + login.data.token,
-    ]);
+  it("tests a long user flow with tokens", async () => {
+    // The latest updated token
+    let token;
+
+    // REGISTER A NEW USER
+    token = await (async () => {
+      const register = await api.post("/auth/register/email", CREDENTIALS);
+      expect(register).toSucceed();
+
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([register.data.token]);
+      return register.data.token;
+    })();
+
+    // CAN GET MY OWN INFO
+    await (async () => {
+      const headers = { authorization: "Bearer " + token };
+      const me = await api.get("/me", { headers });
+      expect(me).toSucceed();
+      expect(me.data.email).toEqual(EMAIL);
+
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([token]);
+    })();
+
+    // LOGOUT TEST
+    await (async () => {
+      const headers = { authorization: "Bearer " + token };
+      const logout = await api.post("/auth/logout", {}, { headers });
+      expect(logout).toSucceed();
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([]);
+    })();
+
+    // LOGIN FOR THE FIRST TIME
+    token = await (async () => {
+      const login = await api.post("/auth/login/email", CREDENTIALS);
+      expect(login).toSucceed();
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([login.data.token]);
+      return login.data.token;
+    })();
+
+    // CAN GET MY OWN INFO
+    await (async () => {
+      const headers = { authorization: "Bearer " + token };
+      const me = await api.get("/me", { headers });
+      expect(me).toSucceed();
+      expect(me.data.email).toEqual(EMAIL);
+    })();
+
+    // UPDATE PASSWORD
+    await (async () => {
+      const headers = { authorization: "Bearer " + token };
+      const body = { previous: PASS, updated: "22222222" };
+      const update = await api.put("/auth/password/email", body, { headers });
+      expect(update).toSucceed();
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([token]);
+    })();
+
+    // LOGOUT AGAIN
+    await (async () => {
+      const headers = { authorization: "Bearer " + token };
+      const logout = await api.post("/auth/logout", {}, { headers });
+      expect(logout).toSucceed();
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([]);
+    })();
+
+    // LOGIN WITH OLD PASSWORD
+    await (async () => {
+      const login = await api.post("/auth/login/email", CREDENTIALS);
+      expect(login).not.toSucceed();
+      expect(await users()).toEqual(["abc@test.com"]);
+    })();
+
+    // LOGIN WITH NEW PASSWORD
+    token = await (async () => {
+      const login = await api.post("/auth/login/email", {
+        ...CREDENTIALS,
+        password: "22222222",
+      });
+      expect(login).toSucceed();
+      expect(await users()).toEqual(["abc@test.com"]);
+      expect(await sessions()).toEqual([login.data.token]);
+      return login.data.token;
+    })();
   });
 });

package/src/auth/auth.js

@@ -48,5 +48,10 @@ export default async function findAuth(ctx) {
 
   const auth = await options.session.get(sessionId);
   if (!auth) throw ServerError.AUTH_NO_SESSION();
+  if (!auth.provider) throw ServerError.AUTH_NO_PROVIDER();
+  if (!options.provider.includes(auth.provider)) {
+    const valid = JSON.stringify(options.provider);
+    throw ServerError.AUTH_INVALID_PROVIDER({ provider: auth.provider, valid });
+  }
   return auth;
 }

package/src/auth/findUser.js

@@ -0,0 +1,5 @@
+export default async function findUser(auth, store) {
+  if (auth.provider === "email") {
+    return await store.get(auth.email);
+  }
+}

package/src/auth/index.js

@@ -17,6 +17,8 @@ const middle = async (ctx) => {
     if (ctx.options.auth.provider.includes("email")) {
       ctx.app.post("/auth/register/email", providers.email.register);
       ctx.app.post("/auth/login/email", providers.email.login);
+      ctx.app.put("/auth/password/email", providers.email.password);
+      ctx.app.put("/auth/reset/email", providers.email.password);
     }
   }
 };

package/src/auth/providers/email.js

@@ -2,6 +2,8 @@ import argon2 from "argon2";
 
 import { createId } from "../../helpers/index.js";
 import { ServerError, status } from "../../index.js";
+import findUser from "../findUser.js";
+import updateUser from "../updateUser.js";
 
 const createSession = async (user, ctx) => {
   const { type, session, cleanUser } = ctx.options.auth;
@@ -70,4 +72,40 @@ async function register(ctx) {
   return createSession(user, ctx);
 }
 
-export default { login, register };
+async function reset(ctx) {
+  // const reset = ctx.options.store.prefix("reset:");
+  // // Already resetting
+  // if (ctx.body.token) {
+  //   const { token, password } = ctx.body;
+  //   const secret = sha256(token);
+  //   const auth = await reset.get(secret);
+  //   const user = await store.get(auth.email);
+  // } else {
+  //   const email = ctx.body.email;
+  //   const user = await store.get(email);
+  //   const token = createId();
+  //   const secret = sha256(token);
+  //   await reset.set(secret, { email }, { expires: "2h" });
+  //   //
+  //   ctx.email.send(
+  //     user.email,
+  //     `Reset email: <a href="${domain}/auth/reset/email?token=${token}">`
+  //   );
+  // }
+}
+
+async function password(ctx) {
+  const { previous, updated } = ctx.body;
+
+  const fullUser = await findUser(ctx.auth, ctx.options.auth.store);
+
+  const isValid = await argon2.verify(fullUser.password, previous);
+  if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
+
+  fullUser.password = await argon2.hash(updated);
+  await updateUser(fullUser, ctx.auth, ctx.options.auth.store);
+
+  return 200;
+}
+
+export default { login, register, reset, password };

package/src/auth/updateUser.js

@@ -0,0 +1,6 @@
+// At this point we can assume that "auth" has already been validated
+export default async function updateUser(user, auth, store) {
+  if (auth.provider === "email") {
+    return await store.set(auth.email, user);
+  }
+}

package/src/auth/user.js

@@ -1,21 +1,10 @@
-import ServerError from "../ServerError";
-
-const findUser = async (auth, options) => {
-  if (!auth.provider) throw ServerError.AUTH_NO_PROVIDER();
-  if (!options.provider.includes(auth.provider)) {
-    const valid = JSON.stringify(options.provider);
-    throw ServerError.AUTH_INVALID_PROVIDER({ provider: auth.provider, valid });
-  }
-
-  if (auth.provider === "email") {
-    return await options.store.get(auth.email);
-  }
-};
+import ServerError from "../ServerError.js";
+import findUser from "./findUser.js";
 
 export default async function user(ctx) {
   if (!ctx.auth) return;
 
-  const user = await findUser(ctx.auth, ctx.options.auth);
+  const user = await findUser(ctx.auth, ctx.options.auth.store);
   if (!user) throw ServerError.AUTH_NO_USER();
   return ctx.options.auth.cleanUser(user);
 }