exp-node-server 1.1.7 → 2.0.0

package/templates/prisma/tests/routes/profile.test.ts

@@ -0,0 +1,91 @@
+import request from 'supertest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import app from '../../src/app.js';
+import uploadCloud from '../../src/app/utils/cloudinary.js';
+import { bearer, makeAccount } from '../helpers/fixtures.js';
+import { prismaMock } from '../helpers/prisma.js';
+
+vi.mock('../../src/app/utils/cloudinary.js', () => ({ default: vi.fn() }));
+
+const account = makeAccount();
+const PNG = Buffer.from('89504e470d0a1a0a', 'hex');
+
+describe('PATCH /api/profile', () => {
+  beforeEach(() => {
+    prismaMock.account.findUnique.mockResolvedValue(account); // auth middleware
+    prismaMock.profile.update.mockImplementation(async ({ data }) => ({ id: 'p-1', ...data }));
+  });
+
+  it('requires a token', async () => {
+    const res = await request(app).patch('/api/profile').field('data', '{}');
+    expect(res.status).toBe(401);
+  });
+
+  it('updates the signed-in user profile', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', bearer(account))
+      .field('data', JSON.stringify({ fullName: '  Jane Doe  ' }));
+
+    expect(res.status).toBe(200);
+    expect(prismaMock.profile.update).toHaveBeenCalledWith({
+      where: { accountId: 'acc-1' },
+      data: { fullName: 'Jane Doe', profilePhoto: undefined },
+    });
+    expect(uploadCloud).not.toHaveBeenCalled();
+  });
+
+  it('ignores fields that are not in the schema', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', bearer(account))
+      .field('data', JSON.stringify({ fullName: 'Jane', accountId: 'someone-else' }));
+
+    expect(res.status).toBe(200);
+    expect(prismaMock.profile.update.mock.calls[0]![0].data).not.toHaveProperty('accountId');
+  });
+
+  it('uploads the photo and stores its url', async () => {
+    vi.mocked(uploadCloud).mockResolvedValue({ secure_url: 'https://cdn.test/p.png' } as never);
+
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', bearer(account))
+      .attach('file', PNG, { filename: 'me.png', contentType: 'image/png' });
+
+    expect(res.status).toBe(200);
+    expect(vi.mocked(uploadCloud).mock.calls[0]![0].buffer).toEqual(PNG);
+    expect(res.body.data.profilePhoto).toBe('https://cdn.test/p.png');
+  });
+
+  it('rejects files that are not images', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', bearer(account))
+      .attach('file', Buffer.from('#!/bin/sh'), { filename: 'x.sh', contentType: 'text/x-sh' });
+
+    expect(res.status).toBe(400);
+    expect(uploadCloud).not.toHaveBeenCalled();
+  });
+
+  it('rejects invalid data without uploading anything', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', bearer(account))
+      .field('data', JSON.stringify({ fullName: '' }))
+      .attach('file', PNG, { filename: 'me.png', contentType: 'image/png' });
+
+    expect(res.status).toBe(400);
+    expect(uploadCloud).not.toHaveBeenCalled();
+    expect(prismaMock.profile.update).not.toHaveBeenCalled();
+  });
+
+  it('rejects malformed JSON in `data`', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', bearer(account))
+      .field('data', '{not json');
+
+    expect(res.status).toBe(400);
+  });
+});

package/templates/prisma/tests/routes/social.test.ts

@@ -0,0 +1,317 @@
+import { createHash } from 'node:crypto';
+import passport, { type Profile } from 'passport';
+import request from 'supertest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import app from '../../src/app.js';
+import { hashLoginCode } from '../../src/app/passport-js/social-account.js';
+import { makeAccount } from '../helpers/fixtures.js';
+import { prismaMock } from '../helpers/prisma.js';
+
+const FRONT_END_CALLBACK = 'http://localhost:5173/auth/social/callback';
+
+type OAuth2Internals = {
+  _oauth2: { getOAuthAccessToken: (...args: unknown[]) => void };
+  userProfile: (token: string, done: (err: unknown, profile?: Profile) => void) => void;
+};
+const strategy = (name: string) =>
+  (passport as unknown as { _strategy: (n: string) => OAuth2Internals })._strategy(name);
+
+const googleProfile = (overrides: Partial<Profile> = {}): Profile => ({
+  provider: 'google',
+  id: 'google-123',
+  displayName: 'Jane Doe',
+  emails: [{ value: 'Jane@Example.com', verified: true } as never],
+  photos: [{ value: 'https://photos.test/jane.png' }],
+  ...overrides,
+});
+
+/** Stubs the provider's HTTP calls (code -> token, token -> profile). */
+const stubGoogle = (profile: Profile) => {
+  const google = strategy('google');
+  const tokenCall = vi
+    .spyOn(google._oauth2, 'getOAuthAccessToken')
+    .mockImplementation((...args: unknown[]) => {
+      const cb = args[2] as (err: unknown, access: string, refresh: string, params: object) => void;
+      cb(null, 'access-token', 'refresh-token', {});
+    });
+  vi.spyOn(google, 'userProfile').mockImplementation((_token, done) => done(null, profile));
+  return tokenCall;
+};
+
+/** Starts a login and returns what the browser would carry back to the callback. */
+const startGoogleLogin = async (query = '') => {
+  const res = await request(app).get(`/api/auth/social/google${query}`);
+  const location = new URL(res.headers.location);
+  const cookie = ([] as string[]).concat(res.headers['set-cookie'] ?? [])[0]!.split(';')[0]!;
+  return { res, location, cookie, state: location.searchParams.get('state')! };
+};
+
+const finishGoogleLogin = (state: string, cookie: string) =>
+  request(app)
+    .get(`/api/auth/social/google/callback?code=auth-code&state=${state}`)
+    .set('Cookie', cookie);
+
+const redirectParams = (res: request.Response) => {
+  const url = new URL(res.headers.location);
+  expect(`${url.origin}${url.pathname}`).toBe(FRONT_END_CALLBACK);
+  return url.searchParams;
+};
+
+describe('GET /api/auth/social/providers', () => {
+  it('lists only the enabled providers', async () => {
+    const res = await request(app).get('/api/auth/social/providers');
+
+    expect(res.status).toBe(200);
+    expect(res.body.data.map((p: { name: string }) => p.name)).toEqual([
+      'google',
+      'github',
+      'twitter',
+    ]);
+  });
+
+  it('has no routes for disabled providers', async () => {
+    const res = await request(app).get('/api/auth/social/facebook');
+    expect(res.status).toBe(404);
+  });
+});
+
+describe('GET /api/auth/social/<provider>', () => {
+  it('redirects to the provider with state and PKCE, keeping them in an httpOnly cookie', async () => {
+    const { res, location, cookie } = await startGoogleLogin();
+
+    expect(res.status).toBe(302);
+    expect(location.host).toBe('accounts.google.com');
+    expect(location.searchParams.get('state')).toBeTruthy();
+    expect(location.searchParams.get('code_challenge_method')).toBe('S256');
+    expect(location.searchParams.get('scope')).toBe('openid email profile');
+    expect(cookie).toMatch(/^oauth_google=/);
+    expect(res.headers['set-cookie']![0]).toMatch(/HttpOnly/);
+    // the cookie is encrypted: neither the state nor the verifier are readable
+    expect(cookie).not.toContain(location.searchParams.get('state'));
+  });
+
+  it('uses state (no PKCE) for GitHub', async () => {
+    const res = await request(app).get('/api/auth/social/github');
+    const location = new URL(res.headers.location);
+
+    expect(location.host).toBe('github.com');
+    expect(location.searchParams.get('state')).toBeTruthy();
+    expect(location.searchParams.get('code_challenge')).toBeNull();
+  });
+});
+
+describe('GET /api/auth/social/<provider>/callback', () => {
+  beforeEach(() => {
+    prismaMock.socialLoginCode.create.mockResolvedValue({});
+  });
+
+  it('creates an account on first login and redirects with a single-use code', async () => {
+    const tokenCall = stubGoogle(googleProfile());
+    prismaMock.socialAccount.findUnique.mockResolvedValue(null);
+    prismaMock.account.findUnique.mockResolvedValue(null);
+    prismaMock.account.create.mockResolvedValue(makeAccount({ id: 'new-acc', password: null }));
+
+    const { location, cookie, state } = await startGoogleLogin('?returnTo=/dashboard');
+    const res = await finishGoogleLogin(state, cookie);
+
+    expect(res.status).toBe(302);
+    const params = redirectParams(res);
+    expect(params.get('returnTo')).toBe('/dashboard');
+
+    // the code in the URL is stored only as a hash, for the new account
+    const code = params.get('code')!;
+    expect(prismaMock.socialLoginCode.create.mock.calls[0]![0].data).toMatchObject({
+      codeHash: hashLoginCode(code),
+      accountId: 'new-acc',
+    });
+
+    // PKCE: the verifier sent with the code matches the challenge from the start
+    const verifier = (tokenCall.mock.calls[0]![1] as { code_verifier: string }).code_verifier;
+    expect(createHash('sha256').update(verifier).digest('base64url')).toBe(
+      location.searchParams.get('code_challenge'),
+    );
+
+    const { data } = prismaMock.account.create.mock.calls[0]![0];
+    expect(data).toMatchObject({
+      email: 'jane@example.com',
+      password: null,
+      provider: 'GOOGLE',
+      isAccountVerified: true,
+      socialAccounts: { create: { provider: 'GOOGLE', providerUserId: 'google-123' } },
+    });
+  });
+
+  it('logs a linked identity into its account, even if the email changed', async () => {
+    stubGoogle(googleProfile({ emails: [] }));
+    prismaMock.socialAccount.findUnique.mockResolvedValue({ account: makeAccount() });
+
+    const { cookie, state } = await startGoogleLogin();
+    const res = await finishGoogleLogin(state, cookie);
+
+    expect(redirectParams(res).get('code')).toBeTruthy();
+    expect(prismaMock.account.create).not.toHaveBeenCalled();
+  });
+
+  it('links to an existing unverified account and drops its unproven password', async () => {
+    stubGoogle(googleProfile());
+    prismaMock.socialAccount.findUnique.mockResolvedValue(null);
+    prismaMock.account.findUnique.mockResolvedValue(makeAccount({ isAccountVerified: false }));
+    prismaMock.account.update.mockResolvedValue(makeAccount({ password: null }));
+
+    const { cookie, state } = await startGoogleLogin();
+    await finishGoogleLogin(state, cookie);
+
+    expect(prismaMock.account.update.mock.calls[0]![0].data).toMatchObject({
+      isAccountVerified: true,
+      password: null,
+      socialAccounts: { create: { provider: 'GOOGLE', providerUserId: 'google-123' } },
+    });
+  });
+
+  it('refuses unverified provider emails', async () => {
+    stubGoogle(
+      googleProfile({ emails: [{ value: 'jane@example.com', verified: false } as never] }),
+    );
+    prismaMock.socialAccount.findUnique.mockResolvedValue(null);
+
+    const { cookie, state } = await startGoogleLogin();
+    const res = await finishGoogleLogin(state, cookie);
+
+    expect(redirectParams(res).get('error')).toBe('email_unverified');
+    expect(prismaMock.account.create).not.toHaveBeenCalled();
+  });
+
+  it('refuses deleted accounts', async () => {
+    stubGoogle(googleProfile());
+    prismaMock.socialAccount.findUnique.mockResolvedValue({
+      account: makeAccount({ isDeleted: true }),
+    });
+
+    const { cookie, state } = await startGoogleLogin();
+    const res = await finishGoogleLogin(state, cookie);
+
+    expect(redirectParams(res).get('error')).toBe('account_disabled');
+    expect(prismaMock.socialLoginCode.create).not.toHaveBeenCalled();
+  });
+
+  it('rejects a callback whose state does not match (login CSRF)', async () => {
+    const tokenCall = stubGoogle(googleProfile());
+    const { cookie } = await startGoogleLogin();
+
+    const res = await finishGoogleLogin('attacker-state', cookie);
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+    expect(tokenCall).not.toHaveBeenCalled();
+  });
+
+  it('rejects a callback without the state cookie', async () => {
+    const tokenCall = stubGoogle(googleProfile());
+    const { state } = await startGoogleLogin();
+
+    const res = await request(app).get(
+      `/api/auth/social/google/callback?code=auth-code&state=${state}`,
+    );
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+    expect(tokenCall).not.toHaveBeenCalled();
+  });
+
+  it('reports when the user cancels at the provider', async () => {
+    const res = await request(app).get('/api/auth/social/google/callback?error=access_denied');
+
+    expect(redirectParams(res).get('error')).toBe('access_denied');
+  });
+
+  it('never redirects to another site through returnTo', async () => {
+    stubGoogle(googleProfile());
+    prismaMock.socialAccount.findUnique.mockResolvedValue({ account: makeAccount() });
+
+    const { cookie, state } = await startGoogleLogin(
+      `?returnTo=${encodeURIComponent('//evil.com')}`,
+    );
+    const res = await finishGoogleLogin(state, cookie);
+
+    const params = redirectParams(res);
+    expect(params.get('code')).toBeTruthy();
+    expect(params.get('returnTo')).toBeNull();
+  });
+});
+
+describe('X (Twitter) login, OAuth 1.0a', () => {
+  type OAuth1Internals = {
+    _oauth: {
+      getOAuthRequestToken: (...args: unknown[]) => void;
+      getOAuthAccessToken: (...args: unknown[]) => void;
+    };
+    userProfile: (...args: unknown[]) => void;
+  };
+  const twitter = () =>
+    (passport as unknown as { _strategy: (n: string) => OAuth1Internals })._strategy('twitter');
+
+  it('keeps the request token in an encrypted cookie and completes the login', async () => {
+    const t = twitter();
+    vi.spyOn(t._oauth, 'getOAuthRequestToken').mockImplementation((...args: unknown[]) => {
+      (args.at(-1) as (...a: unknown[]) => void)(null, 'req-token', 'req-secret', {});
+    });
+    const accessCall = vi
+      .spyOn(t._oauth, 'getOAuthAccessToken')
+      .mockImplementation((...args: unknown[]) => {
+        (args.at(-1) as (...a: unknown[]) => void)(null, 'access', 'access-secret', {});
+      });
+    vi.spyOn(t, 'userProfile').mockImplementation((...args: unknown[]) => {
+      (args.at(-1) as (...a: unknown[]) => void)(null, {
+        provider: 'twitter',
+        id: 'x-1',
+        displayName: 'Jane',
+        emails: [{ value: 'jane@example.com' }],
+      });
+    });
+    prismaMock.socialAccount.findUnique.mockResolvedValue({ account: makeAccount() });
+    prismaMock.socialLoginCode.create.mockResolvedValue({});
+
+    const start = await request(app).get('/api/auth/social/twitter?returnTo=/home');
+    expect(start.status).toBe(302);
+    const location = new URL(start.headers.location);
+    expect(`${location.origin}${location.pathname}`).toBe(
+      'https://api.twitter.com/oauth/authenticate',
+    );
+    expect(location.searchParams.get('oauth_token')).toBe('req-token');
+    const cookie = ([] as string[]).concat(start.headers['set-cookie'] ?? [])[0]!.split(';')[0]!;
+    expect(cookie).toMatch(/^oauth_twitter=/);
+    expect(cookie).not.toContain('req-secret');
+
+    const res = await request(app)
+      .get('/api/auth/social/twitter/callback?oauth_token=req-token&oauth_verifier=v')
+      .set('Cookie', cookie);
+
+    // the token secret from the cookie was used to get the access token
+    expect(accessCall.mock.calls[0]!.slice(0, 3)).toEqual(['req-token', 'req-secret', 'v']);
+    const params = redirectParams(res);
+    expect(params.get('code')).toBeTruthy();
+    expect(params.get('returnTo')).toBe('/home');
+  });
+
+  it('rejects a callback whose token does not match the one in the cookie', async () => {
+    vi.spyOn(twitter()._oauth, 'getOAuthRequestToken').mockImplementation((...args: unknown[]) => {
+      (args.at(-1) as (...a: unknown[]) => void)(null, 'req-token', 'req-secret', {});
+    });
+    const accessCall = vi.spyOn(twitter()._oauth, 'getOAuthAccessToken');
+    const start = await request(app).get('/api/auth/social/twitter');
+    const cookie = ([] as string[]).concat(start.headers['set-cookie'] ?? [])[0]!.split(';')[0]!;
+
+    const res = await request(app)
+      .get('/api/auth/social/twitter/callback?oauth_token=other-token&oauth_verifier=v')
+      .set('Cookie', cookie);
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+    expect(accessCall).not.toHaveBeenCalled();
+  });
+
+  it('rejects a callback for a request token it did not issue', async () => {
+    const res = await request(app).get(
+      '/api/auth/social/twitter/callback?oauth_token=forged&oauth_verifier=v',
+    );
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+  });
+});

package/templates/prisma/tests/setup.ts

@@ -0,0 +1,10 @@
+import { vi } from 'vitest';
+
+// external boundaries only: everything between the route and these runs for real
+vi.mock('../src/app/lib/prisma.js', async () => ({
+  prisma: (await import('./helpers/prisma.js')).prismaMock,
+}));
+
+vi.mock('../src/app/queues/email.queue.js', () => ({
+  enqueueEmail: vi.fn(),
+}));

package/templates/prisma/tsconfig.json

@@ -1,23 +1,16 @@
-{
-  "compilerOptions": {
-    "target": "ES2023",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "rootDir": "./",
-    "outDir": "./dist",
-    "esModuleInterop": true,
-    "forceConsistentCasingInFileNames": true,
-    "strict": true,
-    "skipLibCheck": true
-  },
-  "include": [
-    "src/**/*",
-    "prisma/**/*"
-  ],
-  "exclude": [
-    "node_modules",
-    "dist",
-    "build",
-    "generated/prisma"
-  ]
-}
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noImplicitAny": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "build", "generated/prisma"]
+}

package/templates/prisma/vitest.config.ts

@@ -0,0 +1,38 @@
+import { defineConfig } from 'vitest/config';
+
+const secret = (name: string) => `${name}-test-secret-0123456789abcdefghijklmnop`;
+
+export default defineConfig({
+  test: {
+    include: ['tests/**/*.test.ts'],
+    setupFiles: ['./tests/setup.ts'],
+    // every test starts with fresh mocks
+    mockReset: true,
+    // set before the app reads its config; values in .env don't override these
+    env: {
+      NODE_ENV: 'test',
+      DATABASE_URL: 'postgresql://test:test@localhost:5432/test',
+      ACCESS_TOKEN: secret('access'),
+      VERIFIED_TOKEN: secret('verify'),
+      RESET_SECRET: secret('reset'),
+      FRONT_END_URL: 'http://localhost:5173',
+      CORS_ORIGINS: 'http://localhost:5173',
+      ENABLE_SWAGGER: 'false',
+      IS_GOOGLE_LOGIN: 'true',
+      GOOGLE_CLIENT_ID: 'google-client-id',
+      GOOGLE_CLIENT_SECRET: 'google-client-secret',
+      GOOGLE_CALLBACK_URL: 'http://localhost:5000/api/auth/social/google/callback',
+      IS_GITHUB_LOGIN: 'true',
+      GITHUB_CLIENT_ID: 'github-client-id',
+      GITHUB_CLIENT_SECRET: 'github-client-secret',
+      GITHUB_CALLBACK_URL: 'http://localhost:5000/api/auth/social/github/callback',
+      IS_FACEBOOK_LOGIN: 'false',
+      IS_TWITTER_LOGIN: 'true',
+      TWITTER_CONSUMER_KEY: 'twitter-key',
+      TWITTER_CONSUMER_SECRET: 'twitter-secret',
+      TWITTER_CALLBACK_URL: 'http://localhost:5000/api/auth/social/twitter/callback',
+      IS_LINKEDIN_LOGIN: 'false',
+      IS_DISCORD_LOGIN: 'false',
+    },
+  },
+});

package/bin/cli.js

@@ -1,41 +0,0 @@
-#!/usr/bin/env node
-
-import chalk from "chalk";
-import { createProject } from "../src/createProject.js";
-import { generateModule } from "../src/generateModule.js";
-import { validateModuleName } from "../src/utils/validateModuleName.js";
-import { validateProjectName } from "../src/utils/validateProjectName.js";
-
-const args = process.argv.slice(2);
-
-if (!args.length) {
-    console.log(chalk.yellow("Usage:"));
-    console.log("  npx express-server -c <project-name>");
-    console.log("  npx express-server -g <module-name>");
-    process.exit(0);
-}
-
-const command = args[0];
-
-if (command === "-c") {
-    const projectName = validateProjectName(args[1]);
-
-    if (!projectName) {
-        console.log(chalk.red("❌ Project name required"));
-        process.exit(1);
-    }
-
-    await createProject(projectName);
-} else if (command === "-g") {
-    const moduleName = validateModuleName(args[1]);
-
-    if (!moduleName) {
-        console.log(chalk.red("❌ Module name required"));
-        process.exit(1);
-    }
-    await generateModule(moduleName);
-}
-else {
-    console.log(chalk.red("❌ Invalid command, use -c or -g"));
-    process.exit(1);
-}

package/src/createProject.js

@@ -1,61 +0,0 @@
-import chalk from "chalk";
-import fs from "fs";
-import inquirer from "inquirer";
-import ora from "ora";
-import path from "path";
-import { fileURLToPath } from "url";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-export async function createProject(projectName) {
-
-    // ask user template
-    const answers = await inquirer.prompt([
-        {
-            type: "list",
-            name: "template",
-            message: "Select a project template:",
-            choices: [
-                { name: "Mongoose (MongoDB)", value: "mongoose" },
-                { name: "Prisma (PostgreSQL)", value: "prisma" },
-            ],
-        },
-    ]);
-
-    const template = answers.template;
-
-    const templateDir = path.join(
-        __dirname,
-        `../templates/${template}`
-    );
-
-    const targetDir = path.join(process.cwd(), projectName);
-
-    if (fs.existsSync(targetDir)) {
-        console.log(chalk.red("❌ Folder already exists"));
-        process.exit(1);
-    }
-
-    const spinner = ora(`Creating ${template} project...`).start();
-
-    try {
-
-        fs.cpSync(templateDir, targetDir, {
-            recursive: true,
-        });
-
-        spinner.succeed("Project created successfully");
-
-        console.log(chalk.green(`\nNext steps:`));
-        console.log(chalk.cyan(`cd ${projectName}`));
-        console.log(chalk.cyan(`npm install`));
-        if (template === "prisma") {
-            console.log(chalk.cyan(`docker compose up -d`));
-        }
-        console.log(chalk.cyan(`npm run dev`));
-
-    } catch (err) {
-        spinner.fail("Failed to create project");
-        console.error(err);
-    }
-}