exp-node-server 1.1.7 → 2.0.0

package/templates/prisma/src/app/middlewares/global_error_handler.ts

@@ -1,50 +1,57 @@
-import { ErrorRequestHandler } from "express";
-import { ZodError } from "zod";
-import { configs } from "../configs";
-import handleZodError from "../errors/zodError";
-import { TErrorSources } from "../types/error";
-import { AppError } from "../utils/app_error";
+import { Prisma } from '@prisma/client';
+import type { ErrorRequestHandler } from 'express';
+import multer from 'multer';
+import { ZodError } from 'zod';
+import { configs } from '../configs/index.js';
+import handleZodError from '../errors/zodError.js';
+import { logger } from '../lib/logger.js';
+import type { TErrorSources } from '../types/error.js';
+import { AppError } from '../utils/app_error.js';
 
-const globalErrorHandler: ErrorRequestHandler = (err, req, res, next) => {
+const globalErrorHandler: ErrorRequestHandler = (err, req, res, _next) => {
   let statusCode = 500;
-  let message = "Something went wrong!";
-  let errorSources: TErrorSources = [
-    {
-      path: "",
-      message: "Something went wrong",
-    },
-  ];
+  let message = 'Something went wrong!';
+  let errorSources: TErrorSources = [];
 
   if (err instanceof ZodError) {
-    const simplifiedError = handleZodError(err);
-    statusCode = simplifiedError?.statusCode;
-    message = simplifiedError?.message;
-    errorSources = simplifiedError?.errorSources;
+    ({ statusCode, message, errorSources } = handleZodError(err));
   } else if (err instanceof AppError) {
-    statusCode = err?.statusCode;
+    statusCode = err.statusCode;
     message = err.message;
-    errorSources = [
-      {
-        path: "",
-        message: err?.message,
-      },
-    ];
-  } else if (err instanceof Error) {
+  } else if (err instanceof multer.MulterError) {
+    statusCode = 400;
     message = err.message;
-    errorSources = [
-      {
-        path: "",
-        message: err?.message,
-      },
-    ];
+  } else if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === 'P2002') {
+    statusCode = 409;
+    message = 'Resource already exists';
+  } else if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === 'P2025') {
+    statusCode = 404;
+    message = 'Resource not found';
+  } else if (err?.status === 401 || err?.name === 'AuthenticationError') {
+    // passport authentication failures
+    statusCode = 401;
+    message = 'Authentication failed';
+  } else if (err instanceof SyntaxError && 'body' in err) {
+    // malformed JSON body
+    statusCode = 400;
+    message = 'Invalid JSON body';
+  } else if (err?.expose && typeof err.status === 'number' && err.status < 500) {
+    // client errors from body-parser & co (body too large, unsupported charset, ...)
+    statusCode = err.status;
+    message = err.message;
+  }
+
+  if (statusCode >= 500) {
+    logger.error({ err, method: req.method, url: req.originalUrl }, 'Unhandled error');
+    // don't leak internals (SQL, file paths, ...) to clients in production
+    if (!configs.is_production && err instanceof Error) message = err.message;
   }
 
   res.status(statusCode).json({
     success: false,
     message,
-    errorSources,
-    err,
-    stack: configs.env === "development" ? err?.stack : null,
+    errorSources: errorSources.length ? errorSources : [{ path: '', message }],
+    ...(configs.is_production ? {} : { stack: err?.stack }),
   });
 };
 

package/templates/prisma/src/app/middlewares/not_found_api.ts

@@ -1,10 +1,10 @@
 import { Request, Response, NextFunction } from 'express';
 
-const notFound = (req: Request, res: Response, next: NextFunction) => {
-    res.status(404).json({
-        message: 'Sorry Route is not found!! 😴😴😴',
-        success: false,
-        error: '',
-    });
+const notFound = (req: Request, res: Response, _next: NextFunction) => {
+  res.status(404).json({
+    message: 'Sorry Route is not found!! 😴😴😴',
+    success: false,
+    error: '',
+  });
 };
-export default notFound;
+export default notFound;

package/templates/prisma/src/app/middlewares/rate_limiter.ts

@@ -0,0 +1,124 @@
+import type { Request } from 'express';
+import rateLimit, {
+  type IncrementResponse,
+  ipKeyGenerator,
+  type Options,
+  type Store,
+} from 'express-rate-limit';
+import { configs } from '../configs/index.js';
+import { prisma } from '../lib/prisma.js';
+
+/**
+ * Keeps hit counters in the `RateLimit` table, so limits are shared by every app
+ * instance and survive restarts (no Redis needed). Expired rows are removed by the
+ * maintenance job (see queues/maintenance.queue.ts).
+ */
+class PostgresStore implements Store {
+  windowMs = 60_000;
+  // `prefix` keeps counters of different limiters apart in the same table
+  constructor(public prefix: string) {}
+
+  init(options: Options) {
+    this.windowMs = options.windowMs;
+  }
+
+  async increment(key: string): Promise<IncrementResponse> {
+    // one atomic upsert: start a new window if the old one is over, else count the hit
+    const [row] = await prisma.$queryRaw<{ hits: number; resetAt: Date }[]>`
+      INSERT INTO "RateLimit" ("key", "hits", "resetAt")
+      VALUES (${this.prefix + key}, 1, now() + ${this.windowMs}::int * interval '1 millisecond')
+      ON CONFLICT ("key") DO UPDATE SET
+        "hits"    = CASE WHEN "RateLimit"."resetAt" <= now() THEN 1 ELSE "RateLimit"."hits" + 1 END,
+        "resetAt" = CASE WHEN "RateLimit"."resetAt" <= now() THEN EXCLUDED."resetAt" ELSE "RateLimit"."resetAt" END
+      RETURNING "hits", "resetAt"`;
+    return { totalHits: row!.hits, resetTime: row!.resetAt };
+  }
+
+  async decrement(key: string) {
+    await prisma.rateLimit.updateMany({
+      where: { key: this.prefix + key, hits: { gt: 0 } },
+      data: { hits: { decrement: 1 } },
+    });
+  }
+
+  async resetKey(key: string) {
+    await prisma.rateLimit.deleteMany({ where: { key: this.prefix + key } });
+  }
+}
+
+const message = { success: false, message: 'Too many attempts, please try again later.' };
+
+/** Client IP, with IPv6 addresses grouped by subnet so they can't rotate around the limit. */
+const ip = (req: Request) => ipKeyGenerator(req.ip ?? '');
+
+/** Email from the (not yet validated) body, normalised like the validators do. */
+const email = (req: Request) =>
+  typeof req.body?.email === 'string' ? req.body.email.trim().toLowerCase() : '';
+
+type LimiterOptions = {
+  windowMs: number;
+  limit: number;
+  keyGenerator?: (req: Request) => string;
+};
+
+/** A limiter backed by Postgres (in-memory under tests). `name` must be unique. */
+const createLimiter = (name: string, { windowMs, limit, keyGenerator = ip }: LimiterOptions) =>
+  rateLimit({
+    windowMs,
+    limit,
+    keyGenerator,
+    standardHeaders: 'draft-8',
+    legacyHeaders: false,
+    message,
+    store: configs.is_test ? undefined : new PostgresStore(`${name}:`),
+  });
+
+const MINUTE = 60 * 1000;
+
+/**
+ * Coarse limit for the whole API. Kept in memory (per instance) so normal traffic
+ * doesn't pay for a database round trip; the auth limiters below are the strict ones.
+ */
+export const apiRateLimiter = rateLimit({
+  windowMs: MINUTE,
+  limit: 300,
+  standardHeaders: 'draft-8',
+  legacyHeaders: false,
+  message,
+});
+
+export const rateLimiters = {
+  /** Account creation, per IP. */
+  signUp: createLimiter('sign-up', { windowMs: 60 * MINUTE, limit: 10 }),
+
+  /** Password guessing: per IP+email for one account, and per IP across many accounts. */
+  signIn: createLimiter('sign-in', {
+    windowMs: 15 * MINUTE,
+    limit: 10,
+    keyGenerator: (req) => `${ip(req)}:${email(req)}`,
+  }),
+  signInIp: createLimiter('sign-in-ip', { windowMs: 15 * MINUTE, limit: 50 }),
+
+  /** OTP / link / reset token guessing, per IP. */
+  verify: createLimiter('verify', { windowMs: 15 * MINUTE, limit: 20 }),
+
+  /**
+   * Endpoints that send an email. Limited per recipient so nobody can flood an
+   * inbox from many IPs, and per IP so one client can't spray many addresses.
+   */
+  emailPerAddress: createLimiter('email-address', {
+    windowMs: 15 * MINUTE,
+    limit: 3,
+    keyGenerator: email,
+  }),
+  emailPerIp: createLimiter('email-ip', { windowMs: 15 * MINUTE, limit: 10 }),
+
+  /** Password changes for signed-in users, per IP. */
+  changePassword: createLimiter('change-password', { windowMs: 15 * MINUTE, limit: 10 }),
+
+  /** Token refreshes, per IP (tokens are unguessable; this only caps abuse). */
+  refresh: createLimiter('refresh', { windowMs: 15 * MINUTE, limit: 300 }),
+
+  /** Starting a social login and exchanging its code, per IP. */
+  social: createLimiter('social', { windowMs: 15 * MINUTE, limit: 30 }),
+};

package/templates/prisma/src/app/middlewares/request_validator.ts

@@ -1,7 +1,8 @@
-import { NextFunction, Request, Response } from "express";
+import type { NextFunction, Request, Response } from 'express';
+import type { ZodType } from 'zod';
 
-const RequestValidator = (schema: any) => {
-  return async (req: Request, res: Response, next: NextFunction) => {
+const RequestValidator = (schema: ZodType) => {
+  return async (req: Request, _res: Response, next: NextFunction) => {
     try {
       req.body = await schema.parseAsync(req.body);
       next();

package/templates/prisma/src/app/middlewares/uploader.ts

@@ -1,16 +1,20 @@
-import multer from "multer";
-import path from "path";
+import multer from 'multer';
+import { AppError } from '../utils/app_error.js';
 
-const storage = multer.diskStorage({
-    destination: function (req, file, cb) {
-        cb(null, path.join(process.cwd(), "uploads"))
-    },
-    filename: function (req, file, cb) {
+const ALLOWED_IMAGE_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
 
-        cb(null, file.originalname)
-    }
-})
+/**
+ * Keeps the (size limited) file in memory and streams it to Cloudinary, so nothing
+ * is ever left behind on disk when validation or the upload fails.
+ */
+const uploader = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: MAX_FILE_SIZE, files: 1, fields: 10 },
+  fileFilter: (_req, file, cb) => {
+    if (ALLOWED_IMAGE_TYPES.includes(file.mimetype)) return cb(null, true);
+    cb(new AppError(`Only ${ALLOWED_IMAGE_TYPES.join(', ')} files are allowed`, 400));
+  },
+});
 
-const uploader = multer({ storage: storage })
-
-export default uploader;
+export default uploader;

package/templates/prisma/src/app/modules/account/account.controller.ts

@@ -1,14 +1,14 @@
-import { configs } from "../../configs";
-import catchAsync from "../../utils/catch_async";
-import manageResponse from "../../utils/manage_response";
-import { account_services } from "./account.service";
+import catchAsync from '../../utils/catch_async.js';
+import manageResponse from '../../utils/manage_response.js';
+import { clearSessionCookies, createSession } from '../../utils/session.js';
+import { account_services } from './account.service.js';
 
 const create_account = catchAsync(async (req, res) => {
   const result = await account_services.create_account_into_db(req);
   manageResponse(res, {
-    statusCode: 200,
+    statusCode: 201,
     success: true,
-    message: "Account created successfully",
+    message: 'Account created successfully',
     data: result,
   });
 });
@@ -18,7 +18,7 @@ const verify_account_using_otp = catchAsync(async (req, res) => {
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "Otp verification successfull",
+    message: 'Otp verification successful',
     data: result,
   });
 });
@@ -28,68 +28,61 @@ const verify_account_using_link = catchAsync(async (req, res) => {
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "Account verification successfull",
+    message: 'Account verification successful',
     data: result,
   });
 });
 
 const login_user = catchAsync(async (req, res) => {
-  const result = await account_services.login_user_into_db(req);
-
-  // set access token into cookie
-  res.cookie("access_token", result, {
-    secure: configs.env === "production",
-    httpOnly: true,
-  });
-
+  const user = await account_services.login_user_into_db(req);
+  const tokens = await createSession(res, user);
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "User logged in successfully",
-    data: {
-      accessToken: result,
-    },
+    message: 'User logged in successfully',
+    data: tokens,
   });
 });
+
 const get_user_account = catchAsync(async (req, res) => {
   const result = await account_services.get_user_account_from_db(req);
 
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "Account fetched successfully",
+    message: 'Account fetched successfully',
     data: result,
   });
 });
 
 const change_password = catchAsync(async (req, res) => {
-  const result = await account_services.change_password_into_db(req);
+  const user = await account_services.change_password_into_db(req);
+  // every session was revoked, so give this one a fresh start
+  const tokens = await createSession(res, user);
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "Password Change successfully",
-    data: result,
+    message: 'Password changed successfully',
+    data: tokens,
   });
 });
 
 const resend_otp_and_verification_link = catchAsync(async (req, res) => {
-  const result =
-    await account_services.resend_otp_and_verification_link_from_db(req);
+  const result = await account_services.resend_otp_and_verification_link_from_db(req);
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "OTP reset successfully",
+    message: 'If the account exists and is not verified, a new OTP has been sent',
     data: result,
   });
 });
 
-const forget_password_genereate_reset_token = catchAsync(async (req, res) => {
-  const result =
-    await account_services.forget_password_genereate_reset_token_from_db(req);
+const forget_password_generate_reset_token = catchAsync(async (req, res) => {
+  const result = await account_services.forget_password_generate_reset_token_from_db(req);
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "Password reset successfully",
+    message: 'If an account exists for this email, a password reset link has been sent',
     data: result,
   });
 });
@@ -99,10 +92,53 @@ const reset_password_using_token = catchAsync(async (req, res) => {
   manageResponse(res, {
     statusCode: 200,
     success: true,
-    message: "Password reset successfully",
+    message: 'Password reset successfully',
     data: result,
   });
 });
+
+const refresh_token = catchAsync(async (req, res) => {
+  const { user, familyId } = await account_services.refresh_session_from_db(req);
+  const tokens = await createSession(res, user, familyId);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Tokens refreshed successfully',
+    data: tokens,
+  });
+});
+
+const sign_out = catchAsync(async (req, res) => {
+  await account_services.sign_out_from_db(req);
+  clearSessionCookies(res);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Signed out successfully',
+  });
+});
+
+const sign_out_everywhere = catchAsync(async (req, res) => {
+  await account_services.sign_out_everywhere_from_db(req);
+  clearSessionCookies(res);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Signed out from all devices',
+  });
+});
+
+const exchange_social_login_code = catchAsync(async (req, res) => {
+  const user = await account_services.exchange_social_login_code_from_db(req);
+  const tokens = await createSession(res, user);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'User logged in successfully',
+    data: tokens,
+  });
+});
+
 export const account_controller = {
   create_account,
   login_user,
@@ -111,6 +147,10 @@ export const account_controller = {
   verify_account_using_otp,
   resend_otp_and_verification_link,
   verify_account_using_link,
-  forget_password_genereate_reset_token,
-  reset_password_using_token
+  forget_password_generate_reset_token,
+  reset_password_using_token,
+  refresh_token,
+  sign_out,
+  sign_out_everywhere,
+  exchange_social_login_code,
 };

package/templates/prisma/src/app/modules/account/account.route.ts

@@ -1,55 +1,101 @@
-import { Router } from "express";
-import auth from "../../middlewares/auth";
-import RequestValidator from "../../middlewares/request_validator";
-import { account_controller } from "./account.controller";
-import { account_validation } from "./account.validation";
+import { Router } from 'express';
+import auth from '../../middlewares/auth.js';
+import { rateLimiters } from '../../middlewares/rate_limiter.js';
+import RequestValidator from '../../middlewares/request_validator.js';
+import { socialAuthRouter } from '../../passport-js/index.js';
+import { account_controller } from './account.controller.js';
+import { account_validation } from './account.validation.js';
 
 const accountRouter = Router();
 
 accountRouter.post(
-  "/sign-up",
+  '/sign-up',
+  rateLimiters.signUp,
+  rateLimiters.emailPerAddress,
   RequestValidator(account_validation.sign_up),
   account_controller.create_account,
 );
+
 accountRouter.post(
-  "/sign-in",
-  RequestValidator(account_validation.sing_in),
+  '/sign-in',
+  rateLimiters.signInIp,
+  rateLimiters.signIn,
+  RequestValidator(account_validation.sign_in),
   account_controller.login_user,
 );
+
+accountRouter.post(
+  '/refresh-token',
+  rateLimiters.refresh,
+  RequestValidator(account_validation.refresh_token),
+  account_controller.refresh_token,
+);
+
+accountRouter.post(
+  '/sign-out',
+  RequestValidator(account_validation.refresh_token),
+  account_controller.sign_out,
+);
+
+accountRouter.post('/sign-out-all', auth(), account_controller.sign_out_everywhere);
+
 accountRouter.put(
-  "/verify-otp",
+  '/verify-otp',
+  rateLimiters.verify,
   RequestValidator(account_validation.verify_otp),
   account_controller.verify_account_using_otp,
 );
+
 accountRouter.put(
-  "/verify-link",
+  '/verify-link',
+  rateLimiters.verify,
   RequestValidator(account_validation.verify_link),
   account_controller.verify_account_using_link,
 );
-accountRouter.get(
-  "/me",
-  auth("USER", "ADMIN"),
-  account_controller.get_user_account,
-);
+
+accountRouter.get('/me', auth(), account_controller.get_user_account);
+
 accountRouter.put(
-  "/change-password",
-  auth("USER", "ADMIN"),
+  '/change-password',
+  rateLimiters.changePassword,
+  auth(),
   RequestValidator(account_validation.change_password),
   account_controller.change_password,
 );
+
 accountRouter.put(
-  "/resend-otp",
+  '/resend-otp',
+  rateLimiters.emailPerIp,
+  rateLimiters.emailPerAddress,
   RequestValidator(account_validation.resend_otp),
   account_controller.resend_otp_and_verification_link,
 );
+
 accountRouter.put(
-  "/forget-password",
-  RequestValidator(account_validation.resend_otp),
-  account_controller.forget_password_genereate_reset_token,
+  '/forget-password',
+  rateLimiters.emailPerIp,
+  rateLimiters.emailPerAddress,
+  RequestValidator(account_validation.forget_password),
+  account_controller.forget_password_generate_reset_token,
 );
+
 accountRouter.put(
-  "/reset-password",
+  '/reset-password',
+  rateLimiters.verify,
   RequestValidator(account_validation.reset_pass),
   account_controller.reset_password_using_token,
 );
+
+// Social login: the front-end trades the `?code=` from the redirect for a token
+accountRouter.post(
+  '/social/exchange',
+  rateLimiters.social,
+  RequestValidator(account_validation.social_exchange),
+  account_controller.exchange_social_login_code,
+);
+
+// GET /social/providers, /social/<provider> and /social/<provider>/callback
+// for every provider enabled in .env (see passport-js/providers.ts)
+accountRouter.use('/social', socialAuthRouter);
+
 export default accountRouter;