exp-node-server 1.1.7 → 2.0.0

package/templates/prisma/src/app/modules/account/account.service.ts

@@ -1,394 +1,410 @@
-import bcrypt from "bcrypt";
-import { Request } from "express";
-import { configs } from "../../configs";
-import { prisma } from "../../lib/prisma";
-import { AppError } from "../../utils/app_error";
-import { jwtHelpers } from "../../utils/JWT";
-import { otpGenerator } from "../../utils/otpGenerator";
-import sendMail from "../../utils/mail_sender";
+import { Prisma } from '@prisma/client';
+import bcrypt from 'bcrypt';
+import type { Request } from 'express';
+import { randomUUID } from 'node:crypto';
+import { configs } from '../../configs/index.js';
+import { prisma } from '../../lib/prisma.js';
+import { hashLoginCode } from '../../passport-js/social-account.js';
+import { enqueueEmail } from '../../queues/email.queue.js';
+import { AppError } from '../../utils/app_error.js';
+import { jwtHelpers, type TokenUser } from '../../utils/JWT.js';
+import { hashRefreshToken, readRefreshToken } from '../../utils/session.js';
+import {
+  generateOtp,
+  hashOtp,
+  isOtpMatch,
+  OTP_EXPIRY_MS,
+  OTP_MAX_ATTEMPTS,
+  OTP_RESEND_COOLDOWN_MS,
+} from '../../utils/otp.js';
 
-const create_account_into_db = async (req: Request) => {
-  const payload = req?.body;
+// cheap hashes under tests, the real cost everywhere else
+const BCRYPT_ROUNDS = configs.is_test ? 4 : 12;
 
-  // hash password
-  const hashPassword = bcrypt.hashSync(payload.password, 10);
+// a rotated refresh token that comes back within this window is most likely a
+// parallel refresh (two tabs at once), not theft, so it doesn't end the session
+const REFRESH_REUSE_GRACE_MS = 30 * 1000;
 
-  // create account and profile
-  const result = await prisma.$transaction(async (tx) => {
-    const account = await tx.account.create({
-      data: {
-        email: payload.email,
-        password: hashPassword,
-      },
-    });
+// a valid hash to compare against when the account doesn't exist, so login takes
+// the same time either way (prevents finding registered emails by timing)
+const DUMMY_HASH = bcrypt.hashSync('dummy-password', BCRYPT_ROUNDS);
 
-    const profile = await tx.profile.create({
-      data: {
-        fullName: payload.fullName,
-        accountId: account.id,
-      },
-    });
+type VerifyTokenPayload = { purpose: 'verify-account'; accountId: string };
+// `tv` is the account's token version; any password change makes the link stale
+type ResetTokenPayload = { purpose: 'reset-password'; accountId: string; tv: number };
 
-    return {
-      account,
-      profile,
-    };
-  });
+const toTokenUser = (account: {
+  id: string;
+  email: string;
+  role: TokenUser['role'];
+  tokenVersion: number;
+}): TokenUser => ({
+  accountId: account.id,
+  email: account.email,
+  role: account.role,
+  tokenVersion: account.tokenVersion,
+});
 
-  // sending otp and verification link
-  const newOtp = otpGenerator();
-  const verificationToken = jwtHelpers.generateToken(
-    {
-      email: payload.email,
-      accountId: result.account.id,
-    },
-    configs.jwt.verified_token as string,
-    "5m",
+/** A fresh OTP + verification link, and the columns to store for it. */
+const newVerification = (accountId: string) => {
+  const otp = generateOtp();
+  const token = jwtHelpers.generateToken(
+    { purpose: 'verify-account', accountId } satisfies VerifyTokenPayload,
+    configs.jwt.verified_token,
+    '5m',
   );
-  const verificationLink = `${configs.jwt.front_end_url}/verify/token?=${verificationToken}`;
-  // save otp into db
-  await prisma.account.update({
-    where: {
-      email: payload.email,
-    },
-    data: {
-      lastOtp: newOtp,
-      lastOtpSendingTime: new Date(),
-    },
-  });
-
-  await sendMail({
-    to: payload.email as string,
-    subject: "welcome to - Please verify your account",
-    htmlBody: `
-      <p><strong>OTP</strong> ${newOtp}</p>
-      <small>Otp will be expire in 5 minutes</small>
+  return {
+    otp,
+    verificationLink: `${configs.jwt.front_end_url}/verify?token=${encodeURIComponent(token)}`,
+    data: { lastOtp: hashOtp(otp), lastOtpSendingTime: new Date(), otpAttempts: 0 },
+  };
+};
 
-      <br/> <br/>
+const create_account_into_db = async (req: Request) => {
+  const payload: { email: string; password: string; fullName: string } = req.body;
 
-      <p>Or you can use Verification link </p>
-      <p>${verificationLink}</p>
-    `,
-    textBody: "You can use otp or direct link",
-    name: payload.fullName,
+  const exists = await prisma.account.findUnique({
+    where: { email: payload.email },
+    select: { id: true },
   });
-  return result;
-};
+  if (exists) {
+    throw new AppError('An account with this email already exists', 409);
+  }
 
-const verify_account_using_otp_into_db = async (req: Request) => {
-  const payload: { email: string; otp: string } = req?.body;
-  // check account
-  const account = await prisma.account.findUnique({
-    where: {
+  // id generated up front so the account and its OTP are written in one query
+  const id = randomUUID();
+  const { otp, verificationLink, data } = newVerification(id);
+
+  const account = await prisma.account.create({
+    data: {
+      id,
       email: payload.email,
+      password: await bcrypt.hash(payload.password, BCRYPT_ROUNDS),
+      ...data,
+      profile: { create: { fullName: payload.fullName } },
     },
+    select: { id: true, email: true, role: true, isAccountVerified: true, profile: true },
   });
-  // check if account exists
-  if (!account) {
-    throw new AppError("Account not found", 404);
+
+  await enqueueEmail({ type: 'verify-account', email: account.email, otp, verificationLink });
+  return account;
+};
+
+const verify_account_using_otp_into_db = async (req: Request) => {
+  const payload: { email: string; otp: string } = req.body;
+  const invalid = new AppError('Invalid or expired OTP', 401);
+
+  const account = await prisma.account.findUnique({ where: { email: payload.email } });
+  if (!account || account.isAccountVerified || !account.lastOtp) {
+    throw invalid;
   }
-  // match with last otp
-  const isOtpMatch = payload.otp === account.lastOtp;
-  if (!isOtpMatch) {
-    throw new AppError("Invalid OTP, Please try again!!", 401);
+
+  const isExpired =
+    !account.lastOtpSendingTime ||
+    Date.now() - account.lastOtpSendingTime.getTime() > OTP_EXPIRY_MS;
+  if (isExpired) {
+    throw invalid;
   }
-  // check otp timing
-  const OTP_EXPIRY_TIME = 5 * 60 * 1000; // 5 minutes in ms
-  const isOtpExpired = account.lastOtpSendingTime
-    ? new Date().getTime() - new Date(account.lastOtpSendingTime).getTime() >
-      OTP_EXPIRY_TIME
-    : true;
-
-  if (isOtpExpired) {
-    throw new AppError("OTP Expired, Please try again!!", 401);
+
+  // use up an attempt atomically, so parallel guesses can't go past the limit
+  const attempt = await prisma.account.updateMany({
+    where: { id: account.id, otpAttempts: { lt: OTP_MAX_ATTEMPTS } },
+    data: { otpAttempts: { increment: 1 } },
+  });
+  if (!attempt.count) {
+    throw new AppError('Too many wrong attempts, please request a new OTP', 429);
   }
-  // change account status
-  await prisma.account.update({
-    where: {
-      id: account.id,
-    },
-    data: {
-      isAccountVerified: true,
-    },
+
+  if (!isOtpMatch(payload.otp, account.lastOtp)) {
+    throw invalid;
+  }
+
+  // only succeeds if this OTP wasn't replaced or used in the meantime
+  const verified = await prisma.account.updateMany({
+    where: { id: account.id, lastOtp: account.lastOtp },
+    data: { isAccountVerified: true, lastOtp: null, otpAttempts: 0 },
   });
-  // infuter user welcome email
-  return "";
+  if (!verified.count) {
+    throw invalid;
+  }
+  return null;
 };
 
 const verify_account_using_link_into_db = async (req: Request) => {
-  const token = req?.body?.token as string;
-  let decoadeToken: any;
-  try {
-    decoadeToken = jwtHelpers.verifyToken(
-      token,
-      configs.jwt.verified_token as string,
-    );
-  } catch (error: any) {
-    if (error?.message == "invalid signature") {
-      throw new AppError("Invalid Token", 403);
-    } else if (error?.message == "jwt expired") {
-      throw new AppError("Token expired, please reset again", 403);
-    }
-  }
-  // check account
-  const account = await prisma.account.findUnique({
-    where: {
-      email: decoadeToken.email,
-    },
-  });
-  // check if account exists
-  if (!account) {
-    throw new AppError("Account not found", 404);
+  const decoded = jwtHelpers.verifyToken<VerifyTokenPayload>(
+    req.body.token,
+    configs.jwt.verified_token,
+  );
+  if (decoded.purpose !== 'verify-account') {
+    throw new AppError('Invalid token', 401);
   }
 
-  // change account status
-  await prisma.account.update({
-    where: {
-      id: account.id,
-    },
-    data: {
-      isAccountVerified: true,
-    },
+  const result = await prisma.account.updateMany({
+    where: { id: decoded.accountId, isDeleted: false },
+    data: { isAccountVerified: true, lastOtp: null, otpAttempts: 0 },
   });
-  // infuter user welcome email
-  return "";
+  if (!result.count) {
+    throw new AppError('Invalid token', 401);
+  }
+  return null;
 };
 
-const login_user_into_db = async (req: Request) => {
-  const payload = req?.body;
-  const account = await prisma.account.findUnique({
-    where: {
-      email: payload.email,
-    },
-  });
-
-  // check if account exists
-  if (!account) {
-    throw new AppError("Account not found", 404);
-  }
+const login_user_into_db = async (req: Request): Promise<TokenUser> => {
+  const payload: { email: string; password: string } = req.body;
+  const invalid = new AppError('Invalid email or password', 401);
 
-  // checking password
-  const isPasswordMatch = bcrypt.compareSync(
-    payload.password,
-    account.password,
-  );
+  const account = await prisma.account.findUnique({ where: { email: payload.email } });
 
-  if (!isPasswordMatch) {
-    throw new AppError("Invalid password", 401);
+  // always run bcrypt, and never skip the password check: social-login accounts
+  // have no password and must sign in through their provider
+  const isPasswordMatch = await bcrypt.compare(payload.password, account?.password ?? DUMMY_HASH);
+  if (!account || !account.password || !isPasswordMatch) {
+    throw invalid;
   }
 
-  // check if account is deleted
   if (account.isDeleted) {
-    throw new AppError("Account is deleted", 401);
+    throw new AppError('Account is deleted', 401);
   }
-  // check if account is verified
   if (!account.isAccountVerified) {
-    throw new AppError("Account is not verified", 401);
+    throw new AppError('Account is not verified', 401);
   }
 
-  // generate access
-  const accessToken = jwtHelpers.generateToken(
-    {
-      email: account.email,
-      role: account.role,
-      accountId: account.id,
-    },
-    configs.jwt.access_token as string,
-    configs.jwt.access_expires as string,
-  );
-  return accessToken;
+  return toTokenUser(account);
 };
 
 const get_user_account_from_db = async (req: Request) => {
-  const user = req?.user;
-
-  const result = await prisma.account.findUnique({
-    where: {
-      id: user?.accountId,
-    },
+  return prisma.account.findUnique({
+    where: { id: req.user!.accountId },
     select: {
       id: true,
       email: true,
       role: true,
+      provider: true,
       isAccountVerified: true,
       isDeleted: true,
       profile: true,
+      socialAccounts: { select: { provider: true, createdAt: true } },
     },
   });
-  return result;
 };
 
-const change_password_into_db = async (req: Request) => {
-  const user = req?.user;
-  // payload
-  const payload: { oldPassword: string; newPassword: string } = req?.body;
-  // check old and new password is not same
-  const isSamePassword = payload.oldPassword === payload.newPassword;
-  if (isSamePassword) {
-    throw new AppError(
-      "Old and new password are same, Please provide deffirent password",
-      404,
-    );
+/** Changes the password and revokes every other session. Returns the user for a new token. */
+const change_password_into_db = async (req: Request): Promise<TokenUser> => {
+  const payload: { oldPassword: string; newPassword: string } = req.body;
+
+  if (payload.oldPassword === payload.newPassword) {
+    throw new AppError('New password must be different from the old password', 400);
   }
-  // check user validity
-  const isUserExist = await prisma.account.findFirst({
-    where: {
-      email: user?.email,
-    },
-  });
-  // if account not exists
-  if (!isUserExist) {
-    throw new AppError("Account not found!!", 404);
+
+  const account = await prisma.account.findUnique({ where: { id: req.user!.accountId } });
+  if (!account) {
+    throw new AppError('Account not found', 404);
   }
-  // check old password
-  const isPasswordMatch = bcrypt.compareSync(
-    payload.oldPassword,
-    isUserExist.password,
-  );
+  if (!account.password) {
+    throw new AppError('This account uses social login and has no password', 400);
+  }
+
+  const isPasswordMatch = await bcrypt.compare(payload.oldPassword, account.password);
   if (!isPasswordMatch) {
-    throw new AppError("Incorrect password", 401);
+    throw new AppError('Incorrect password', 401);
   }
-  // change password logic
-  const newHashPassword = bcrypt.hashSync(payload.newPassword, 10);
-  await prisma.account.update({
-    where: {
-      id: isUserExist.id,
-    },
+
+  const updated = await prisma.account.update({
+    where: { id: account.id },
     data: {
-      password: newHashPassword,
+      password: await bcrypt.hash(payload.newPassword, BCRYPT_ROUNDS),
+      tokenVersion: { increment: 1 },
     },
   });
-
-  // in future email notification for more sucurity
-  return "";
+  await prisma.refreshToken.deleteMany({ where: { accountId: account.id } });
+  return toTokenUser(updated);
 };
 
 const resend_otp_and_verification_link_from_db = async (req: Request) => {
-  const email = req?.body?.email as string;
+  const email: string = req.body.email;
   const account = await prisma.account.findUnique({
-    where: {
-      email,
-    },
-  });
-  // check if account exists
-  if (!account) {
-    throw new AppError("Account not found", 404);
-  }
-  // if already verified
-  if (account.isAccountVerified) {
-    throw new AppError("Account already verified", 403);
-  }
-  // make new otp and verification link
-  const newOtp = otpGenerator();
-  const verificationToken = jwtHelpers.generateToken(
-    {
-      email,
-      accountId: account.id,
-    },
-    configs.jwt.verified_token as string,
-    "5m",
-  );
-  const verificationLink = `${configs.jwt.front_end_url}/verify/token?=${verificationToken}`;
-  // save otp into db
-  await prisma.account.update({
-    where: {
-      email,
-    },
-    data: {
-      lastOtp: newOtp,
-      lastOtpSendingTime: new Date(),
-    },
+    where: { email },
+    select: { id: true, isAccountVerified: true },
   });
 
-  await sendMail({
-    to: email as string,
-    subject: "New Verification otp and link",
-    htmlBody: `
-      <p><strong>OTP</strong> ${newOtp}</p>
-      <small>Otp will be expire in 5 minutes</small>
+  // same response whether or not the account exists (no email enumeration)
+  if (!account || account.isAccountVerified) return null;
 
-      <br/> <br/>
+  const { otp, verificationLink, data } = newVerification(account.id);
 
-      <p>Or you can use Verification link </p>
-      <p>${verificationLink}</p>
-    `,
-    textBody: "You can use otp or direct link",
+  // the cooldown check is part of the update, so parallel requests send one email
+  const result = await prisma.account.updateMany({
+    where: {
+      id: account.id,
+      isAccountVerified: false,
+      OR: [
+        { lastOtpSendingTime: null },
+        { lastOtpSendingTime: { lt: new Date(Date.now() - OTP_RESEND_COOLDOWN_MS) } },
+      ],
+    },
+    data,
   });
+  if (!result.count) {
+    throw new AppError('Please wait a minute before requesting a new OTP', 429);
+  }
+
+  await enqueueEmail({ type: 'verify-account', email, otp, verificationLink });
+  return null;
 };
 
-const forget_password_genereate_reset_token_from_db = async (req: Request) => {
-  const email = req?.body?.email as string;
+const forget_password_generate_reset_token_from_db = async (req: Request) => {
+  const email: string = req.body.email;
   const account = await prisma.account.findUnique({
-    where: {
-      email,
-    },
+    where: { email },
+    select: { id: true, isDeleted: true, tokenVersion: true },
   });
-  // check if account exists
-  if (!account) {
-    throw new AppError("Account not found", 404);
-  }
-  // generate forget token
-  const verificationToken = jwtHelpers.generateToken(
+
+  // same response whether or not the account exists (no email enumeration)
+  if (!account || account.isDeleted) return null;
+
+  const resetToken = jwtHelpers.generateToken(
     {
-      email: email,
+      purpose: 'reset-password',
       accountId: account.id,
-    },
-    configs.jwt.verified_token as string,
-    "5m",
+      tv: account.tokenVersion,
+    } satisfies ResetTokenPayload,
+    configs.jwt.reset_secret,
+    configs.jwt.reset_expires,
   );
-  const verificationLink = `${configs.jwt.front_end_url}/verify/token?=${verificationToken}`;
-
-  await sendMail({
-    to: email as string,
-    subject: "Forget Password- Use this link for new password ",
-    htmlBody: `
-      <p>Your Reset Link:  </p>
-      <p>${verificationLink}</p>
-    `,
-    textBody: "",
-  });
+  const resetLink = `${configs.jwt.front_end_url}/reset-password?token=${encodeURIComponent(resetToken)}`;
+
+  await enqueueEmail({ type: 'reset-password', email, resetLink });
+  return null;
 };
 
 const reset_password_using_token_into_db = async (req: Request) => {
-  const token = req?.body?.token as string;
-  const newPass = req?.body?.newPass as string;
-  let decoadeToken: any;
-  try {
-    decoadeToken = jwtHelpers.verifyToken(
-      token,
-      configs.jwt.verified_token as string,
-    );
-  } catch (error: any) {
-    if (error?.message == "invalid signature") {
-      throw new AppError("Invalid Token", 403);
-    } else if (error?.message == "jwt expired") {
-      throw new AppError("Link expired, please reset again", 403);
-    }
+  const { token, newPass }: { token: string; newPass: string } = req.body;
+  const invalid = new AppError('Invalid or expired reset link', 401);
+
+  const decoded = jwtHelpers.verifyToken<ResetTokenPayload>(token, configs.jwt.reset_secret);
+  if (decoded.purpose !== 'reset-password' || typeof decoded.tv !== 'number') {
+    throw invalid;
   }
-  // check account
-  const account = await prisma.account.findUnique({
-    where: {
-      email: decoadeToken.email,
+
+  // Matching on the token version makes the link single-use (the update bumps it)
+  // and also signs out every existing session. Following the emailed link proves
+  // ownership of the address, so the account counts as verified from now on.
+  const result = await prisma.account.updateMany({
+    where: { id: decoded.accountId, isDeleted: false, tokenVersion: decoded.tv },
+    data: {
+      password: await bcrypt.hash(newPass, BCRYPT_ROUNDS),
+      tokenVersion: { increment: 1 },
+      isAccountVerified: true,
+      lastOtp: null,
+      otpAttempts: 0,
     },
   });
-  // check if account exists
-  if (!account) {
-    throw new AppError("Account not found", 404);
+  if (!result.count) {
+    throw invalid;
   }
+  await prisma.refreshToken.deleteMany({ where: { accountId: decoded.accountId } });
+  return null;
+};
 
-  // change account password
-  const newHash = bcrypt.hashSync(newPass, 10);
+/** Revokes every access and refresh token issued for the account. */
+const sign_out_everywhere_from_db = async (req: Request) => {
+  const accountId = req.user!.accountId;
   await prisma.account.update({
-    where: {
-      id: account.id,
-    },
-    data: {
-      password: newHash,
+    where: { id: accountId },
+    data: { tokenVersion: { increment: 1 } },
+  });
+  await prisma.refreshToken.deleteMany({ where: { accountId } });
+  return null;
+};
+
+/** Ends the session the refresh token belongs to (this device only). */
+const sign_out_from_db = async (req: Request) => {
+  const token = readRefreshToken(req);
+  if (!token) return null;
+  const row = await prisma.refreshToken.findUnique({
+    where: { tokenHash: hashRefreshToken(token) },
+    select: { familyId: true },
+  });
+  if (row) await prisma.refreshToken.deleteMany({ where: { familyId: row.familyId } });
+  return null;
+};
+
+/**
+ * Validates and uses up a refresh token. Returns the user and the session it
+ * belongs to, so the controller can issue the next token of that session.
+ */
+const refresh_session_from_db = async (
+  req: Request,
+): Promise<{ user: TokenUser; familyId: string }> => {
+  const invalid = new AppError('Invalid or expired refresh token', 401);
+  const token = readRefreshToken(req);
+  if (!token) throw invalid;
+
+  const tokenHash = hashRefreshToken(token);
+  const row = await prisma.refreshToken.findUnique({
+    where: { tokenHash },
+    include: {
+      account: {
+        select: { id: true, email: true, role: true, tokenVersion: true, isDeleted: true },
+      },
     },
   });
-  // infuter user alart for changing password
-  return "";
+  if (!row) throw invalid;
+
+  const endSession = () => prisma.refreshToken.deleteMany({ where: { familyId: row.familyId } });
+
+  if (row.usedAt) {
+    // An already rotated token came back. Outside the grace window that means two
+    // parties hold this session (the token was stolen), so end the whole session.
+    if (Date.now() - row.usedAt.getTime() > REFRESH_REUSE_GRACE_MS) await endSession();
+    throw invalid;
+  }
+
+  const isStale =
+    row.expiresAt.getTime() < Date.now() ||
+    row.account.isDeleted ||
+    row.account.tokenVersion !== row.tokenVersion; // password changed / signed out everywhere
+  if (isStale) {
+    await endSession();
+    throw invalid;
+  }
+
+  // mark it used atomically, so of two parallel refreshes only one gets a new token
+  const used = await prisma.refreshToken.updateMany({
+    where: { tokenHash, usedAt: null },
+    data: { usedAt: new Date() },
+  });
+  if (!used.count) throw invalid;
+
+  return { user: toTokenUser(row.account), familyId: row.familyId };
 };
+
+/** Trades the single-use code from a social login redirect for the user to sign in. */
+const exchange_social_login_code_from_db = async (req: Request): Promise<TokenUser> => {
+  const invalid = new AppError('Invalid or expired login code', 401);
+
+  // deleting is what makes the code single-use, even under concurrent requests
+  const row = await prisma.socialLoginCode
+    .delete({
+      where: { codeHash: hashLoginCode(req.body.code) },
+      select: {
+        expiresAt: true,
+        account: {
+          select: { id: true, email: true, role: true, tokenVersion: true, isDeleted: true },
+        },
+      },
+    })
+    .catch((err) => {
+      if (err instanceof Prisma.PrismaClientKnownRequestError && err.code === 'P2025') return null;
+      throw err;
+    });
+
+  if (!row || row.expiresAt.getTime() < Date.now() || row.account.isDeleted) {
+    throw invalid;
+  }
+  return toTokenUser(row.account);
+};
+
 export const account_services = {
   create_account_into_db,
   login_user_into_db,
@@ -397,6 +413,10 @@ export const account_services = {
   verify_account_using_otp_into_db,
   resend_otp_and_verification_link_from_db,
   verify_account_using_link_into_db,
-  forget_password_genereate_reset_token_from_db,
-  reset_password_using_token_into_db
+  forget_password_generate_reset_token_from_db,
+  reset_password_using_token_into_db,
+  sign_out_everywhere_from_db,
+  sign_out_from_db,
+  refresh_session_from_db,
+  exchange_social_login_code_from_db,
 };