@vulkano/core 1.22.0 → 1.22.1

package/README.md

@@ -116,7 +116,7 @@ GET /users/edit/1
 
 A controller method key is `<path tail>` on its own, or `'<verb> <path tail>'` when the verb isn't `GET`. The auto-router only reassigns the HTTP method when the key has a space-separated verb prefix — otherwise it defaults to **GET**.
 
-- A **custom action name with no verb prefix** (no space in the key) is still `GET`, e.g. `me(req, res)` on `AuthController` → `GET /auth/me`. Don't write `'get me'`; it's redundant.
+- A **custom action name with no verb prefix** (no space in the key) is still `GET`, e.g. `me(req, res)` on `AuthController` → `GET /auth/current`. Don't write `'get current'`; it's redundant.
 - A **custom action that isn't `GET`** needs the verb spelled out, e.g. `'post login'` → `POST /auth/login`.
 - The path tail can carry arbitrary nested segments and multiple params:
 
@@ -134,8 +134,8 @@ module.exports = {
 // controllers/api/AuthController.js
 module.exports = {
 
-  // GET /api/auth/me — no verb prefix needed, GET is the default
-  me(req, res) { },
+  // GET /api/auth/current — no verb prefix needed, GET is the default
+  current(req, res) { },
 
   // POST /api/auth/login
   'post login': (req, res) => { },
@@ -304,6 +304,10 @@ module.exports = {
 
 NOTE: To find examples with the best practices for available methods ahd hooks, look in `examples/models` and read the file `Example.js`, and Scaffold Model API `ExampleWithScaffold.js`.
 
+### Vulkano models — don't hand-roll `createdAt` or `updatedAt`
+
+`@vulkano/core`'s `database/mongodb.js` auto-injects `createdAt: Date` and `updatedAt: Date` attributes into every model schema if the model doesn't already define them (`if (!attributes.createdAt) { ... }`, same for `updatedAt`). Never add a manual timestamp field (`at`, `date`, `timestamp`, `createdAt`, `updatedAt`, etc.) to a model's `attributes` — they're already automatic in Vulkano, so a hand-rolled one is redundant, and if named anything other than `createdAt`/`updatedAt` it also fights the framework's own sort/index defaults (`database/scaffold.js` defaults `sort: 'createdAt|DESC'`). Use `createdAt` and `updatedAt` directly in indexes, sort strings, and business logic.
+
 ---
 
 ## Key conventions

package/examples/controllers/api/AuthController.js

@@ -0,0 +1,56 @@
+/* global Auth, Jwt */
+
+/**
+ * AuthController.js
+ */
+
+module.exports = {
+
+  'get current': (req, res) => {
+
+    const {
+      auth
+    } = req || {};
+
+    res.vsr(Auth.getCurrent(auth));
+
+  },
+
+  'post login': (req, res) => {
+
+    Auth.login(req.body)
+      .then(({ user, token }) => {
+
+        const {
+          cookieName
+        } = Jwt.getConfig();
+
+        res.cookie(cookieName || 'token', token, {
+          httpOnly: true,
+          // secure: app.PRODUCTION,
+          // sameSite: 'lax',
+          maxAge: Auth.SESSION_MS,
+        });
+
+        res.vsr(Promise.resolve(user));
+
+      })
+      .catch((err) => {
+        res.vsr(Promise.reject(err));
+      });
+
+  },
+
+  'post logout': (req, res) => {
+
+    const {
+      cookieName
+    } = Jwt.getConfig();
+
+    res.clearCookie(cookieName || 'token');
+
+    res.vsr(Promise.resolve({ success: true }));
+
+  }
+
+};

package/examples/services/Auth.js

@@ -0,0 +1,111 @@
+/* global User, Auth, VSError */
+
+const bcrypt = require('bcryptjs');
+
+module.exports = {
+
+  SESSION_MS: 1000 * 60 * 60 * 24 * 365 * 10,
+
+  /**
+   * Verify a plain-text password against a stored hash.
+   * @param {String} plain
+   * @param {String} hash
+   * @returns {Boolean}
+   */
+  verifyPassword(plain, hash) {
+    return bcrypt.compareSync(`${process.env.SALT_KEY || ''}-${plain}`, hash);
+  },
+
+  /**
+   * Look up a user by email and verify their password. The only place in
+   * the model that explicitly loads the password hash.
+   * @param {String} email
+   * @param {String} password
+   * @returns {Promise<Object>} the authenticated User document
+   */
+  login({ email, password }) {
+
+    const normalizedEmail = String(email || '')
+      .toLowerCase()
+      .trim();
+
+    return User.findOne({ email: normalizedEmail, active: true })
+      .select('+password')
+      .then((user) => {
+
+        if (!user || !Auth.verifyPassword(password || '', user.password)) {
+          return VSError.reject('Invalid credentials', 401);
+        }
+
+        return Auth.setToken(user);
+      });
+
+  },
+
+  /**
+   *  Generate token
+   * @param {Object} props
+   * @returns {Object}
+   */
+  setToken(u) {
+
+    const {
+      _id
+    } = u || {};
+
+    if (!_id) {
+      return VSError.reject('The user and/or password are incorrect', 400);
+    }
+
+    return Promise.resolve({
+
+      user: {
+        _id: u._id || '',
+        name: u.name || ''
+      },
+
+      token: Jwt.encode({
+        _id: u._id || '',
+        name: u.name || '',
+        email: u.email,
+        role: u.role || '',
+        expiration: Auth.SESSION_MS + Date.now()
+      })
+
+    });
+  },
+
+  /**
+   * Get current user logged
+   *
+   * @param {Object} auth
+   * @returns Promise
+   */
+  getCurrent(auth) {
+
+    const {
+      _id
+    } = auth || {};
+
+    if (!_id) {
+      return VSError.reject('Invalid token', 401);
+    }
+
+    return User
+      .getUser(_id)
+      .then( (u) => {
+
+        const {
+          active
+        } = u || {};
+
+        if (String(active || '') !== 'true' || !_id) {
+          return VSError.reject('Invalid ID. User not found', 401);
+        }
+
+        return u;
+
+      });
+
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vulkano/core",
-  "version": "1.22.0",
+  "version": "1.22.1",
   "description": "A MVC framework using Express 4",
   "license": "MIT",
   "author": "Vulkano Team",
@@ -44,6 +44,7 @@
   "dependencies": {
     "@socket.io/mongo-adapter": "^0.4.0",
     "@socket.io/redis-adapter": "^8.3.0",
+    "bcryptjs": "^3.0.3",
     "compression": "^1.8.1",
     "connect-timeout": "^1.9.1",
     "cookie-parser": "^1.4.7",