exp-node-server 1.1.7 → 2.0.0

package/templates/mongoose/src/app/middlewares/global_error_handler.ts

@@ -1,69 +1,63 @@
-import { Request, Response, NextFunction, ErrorRequestHandler } from 'express'
-import { ZodError } from 'zod'
-import handleZodError from '../errors/zodError'
-import handleValidationError from '../errors/validationError'
-import handleCastError from '../errors/castError'
-import { TErrorSources } from '../types/error'
-import handleDuplicateError from '../errors/duplicateError'
-import { AppError } from '../utils/app_error'
-import { configs } from '../configs'
+import type { ErrorRequestHandler } from 'express';
+import mongoose from 'mongoose';
+import multer from 'multer';
+import { ZodError } from 'zod';
+import { configs } from '../configs/index.js';
+import handleZodError from '../errors/zodError.js';
+import { logger } from '../lib/logger.js';
+import type { TErrorSources } from '../types/error.js';
+import { AppError } from '../utils/app_error.js';
 
-const globalErrorHandler: ErrorRequestHandler = (err, req, res, next) => {
-    let statusCode = 500
-    let message = 'Something went wrong!'
-    let errorSources: TErrorSources = [
-        {
-            path: '',
-            message: 'Something went wrong'
-        }
-    ]
+const globalErrorHandler: ErrorRequestHandler = (err, req, res, _next) => {
+  let statusCode = 500;
+  let message = 'Something went wrong!';
+  let errorSources: TErrorSources = [];
 
-    if (err instanceof ZodError) {
-        const simplifiedError = handleZodError(err)
-        statusCode = simplifiedError?.statusCode
-        message = simplifiedError?.message
-        errorSources = simplifiedError?.errorSources
-    } else if (err?.name === 'ValidationError') {
-        const simplifiedError = handleValidationError(err)
-        statusCode = simplifiedError?.statusCode
-        message = simplifiedError?.message
-        errorSources = simplifiedError?.errorSources
-    } else if (err?.name === 'CastError') {
-        const simplifiedError = handleCastError(err)
-        statusCode = simplifiedError?.statusCode
-        message = simplifiedError?.message
-        errorSources = simplifiedError?.errorSources
-    } else if (err?.code === 11000) {
-        const simplifiedError = handleDuplicateError(err)
-        statusCode = simplifiedError?.statusCode
-        message = simplifiedError?.message
-        errorSources = simplifiedError?.errorSources
-    } else if (err instanceof AppError) {
-        statusCode = err?.statusCode
-        message = err.message
-        errorSources = [
-            {
-                path: '',
-                message: err?.message
-            }
-        ]
-    } else if (err instanceof Error) {
-        message = err.message
-        errorSources = [
-            {
-                path: '',
-                message: err?.message
-            }
-        ]
-    }
+  if (err instanceof ZodError) {
+    ({ statusCode, message, errorSources } = handleZodError(err));
+  } else if (err instanceof AppError) {
+    statusCode = err.statusCode;
+    message = err.message;
+  } else if (err instanceof multer.MulterError) {
+    statusCode = 400;
+    message = err.message;
+  } else if (err?.code === 11000) {
+    // duplicate key; the offending value is not echoed back
+    statusCode = 409;
+    message = 'Resource already exists';
+  } else if (err instanceof mongoose.Error.CastError) {
+    statusCode = 400;
+    message = `Invalid ${err.path}`;
+  } else if (err instanceof mongoose.Error.ValidationError) {
+    statusCode = 400;
+    message = 'Validation Error';
+    errorSources = Object.values(err.errors).map((e) => ({ path: e.path, message: e.message }));
+  } else if (err?.status === 401 || err?.name === 'AuthenticationError') {
+    // passport authentication failures
+    statusCode = 401;
+    message = 'Authentication failed';
+  } else if (err instanceof SyntaxError && 'body' in err) {
+    // malformed JSON body
+    statusCode = 400;
+    message = 'Invalid JSON body';
+  } else if (err?.expose && typeof err.status === 'number' && err.status < 500) {
+    // client errors from body-parser & co (body too large, unsupported charset, ...)
+    statusCode = err.status;
+    message = err.message;
+  }
 
-    res.status(statusCode).json({
-        success: false,
-        message,
-        errorSources,
-        err,
-        stack: configs.env === 'development' ? err?.stack : null
-    })
-}
+  if (statusCode >= 500) {
+    logger.error({ err, method: req.method, url: req.originalUrl }, 'Unhandled error');
+    // don't leak internals (SQL, file paths, ...) to clients in production
+    if (!configs.is_production && err instanceof Error) message = err.message;
+  }
 
-export default globalErrorHandler
+  res.status(statusCode).json({
+    success: false,
+    message,
+    errorSources: errorSources.length ? errorSources : [{ path: '', message }],
+    ...(configs.is_production ? {} : { stack: err?.stack }),
+  });
+};
+
+export default globalErrorHandler;

package/templates/mongoose/src/app/middlewares/not_found_api.ts

@@ -1,10 +1,10 @@
 import { Request, Response, NextFunction } from 'express';
 
-const notFound = (req: Request, res: Response, next: NextFunction) => {
-    res.status(404).json({
-        message: 'Sorry Route is not found!! 😴😴😴',
-        success: false,
-        error: '',
-    });
+const notFound = (req: Request, res: Response, _next: NextFunction) => {
+  res.status(404).json({
+    message: 'Sorry Route is not found!! 😴😴😴',
+    success: false,
+    error: '',
+  });
 };
-export default notFound;
+export default notFound;

package/templates/mongoose/src/app/middlewares/rate_limiter.ts

@@ -0,0 +1,153 @@
+import type { Request } from 'express';
+import rateLimit, {
+  type IncrementResponse,
+  ipKeyGenerator,
+  type Options,
+  type Store,
+} from 'express-rate-limit';
+import type { Collection } from 'mongodb';
+import { model, Schema } from 'mongoose';
+
+type RateLimitDoc = { _id: string; hits: number; resetAt: Date };
+
+const rateLimitModel = model(
+  'rate_limit',
+  new Schema<RateLimitDoc>(
+    {
+      _id: { type: String, required: true },
+      hits: { type: Number, required: true },
+      // TTL index: MongoDB deletes counters once their window is over
+      resetAt: { type: Date, required: true, expires: 0 },
+    },
+    { versionKey: false },
+  ),
+);
+
+const isDuplicateKey = (err: unknown) => (err as { code?: number })?.code === 11000;
+
+/**
+ * Keeps hit counters in MongoDB, so limits are shared by every app instance and
+ * survive restarts (no Redis needed).
+ */
+class MongoStore implements Store {
+  windowMs = 60_000;
+  // `prefix` keeps counters of different limiters apart in the same collection
+  constructor(public prefix: string) {}
+
+  init(options: Options) {
+    this.windowMs = options.windowMs;
+  }
+
+  async increment(key: string): Promise<IncrementResponse> {
+    // one atomic update: start a new window if the old one is over, else count the hit
+    const update = [
+      {
+        $set: {
+          hits: { $cond: [{ $gt: ['$resetAt', '$$NOW'] }, { $add: ['$hits', 1] }, 1] },
+          resetAt: {
+            $cond: [{ $gt: ['$resetAt', '$$NOW'] }, '$resetAt', { $add: ['$$NOW', this.windowMs] }],
+          },
+        },
+      },
+    ];
+    const collection = rateLimitModel.collection as unknown as Collection<RateLimitDoc>;
+    const run = () =>
+      collection.findOneAndUpdate({ _id: this.prefix + key }, update, {
+        upsert: true,
+        returnDocument: 'after',
+        includeResultMetadata: false,
+      });
+
+    // two first hits at the same moment can race on the upsert; the loser retries
+    const row = await run().catch((err) => (isDuplicateKey(err) ? run() : Promise.reject(err)));
+    return { totalHits: row!.hits, resetTime: row!.resetAt };
+  }
+
+  async decrement(key: string) {
+    await rateLimitModel.updateOne(
+      { _id: this.prefix + key, hits: { $gt: 0 } },
+      { $inc: { hits: -1 } },
+    );
+  }
+
+  async resetKey(key: string) {
+    await rateLimitModel.deleteOne({ _id: this.prefix + key });
+  }
+}
+
+const message = { success: false, message: 'Too many attempts, please try again later.' };
+
+/** Client IP, with IPv6 addresses grouped by subnet so they can't rotate around the limit. */
+const ip = (req: Request) => ipKeyGenerator(req.ip ?? '');
+
+/** Email from the (not yet validated) body, normalised like the validators do. */
+const email = (req: Request) =>
+  typeof req.body?.email === 'string' ? req.body.email.trim().toLowerCase() : '';
+
+type LimiterOptions = {
+  windowMs: number;
+  limit: number;
+  keyGenerator?: (req: Request) => string;
+};
+
+/** A limiter backed by MongoDB. `name` must be unique. */
+const createLimiter = (name: string, { windowMs, limit, keyGenerator = ip }: LimiterOptions) =>
+  rateLimit({
+    windowMs,
+    limit,
+    keyGenerator,
+    standardHeaders: 'draft-8',
+    legacyHeaders: false,
+    message,
+    store: new MongoStore(`${name}:`),
+  });
+
+const MINUTE = 60 * 1000;
+
+/**
+ * Coarse limit for the whole API. Kept in memory (per instance) so normal traffic
+ * doesn't pay for a database round trip; the auth limiters below are the strict ones.
+ */
+export const apiRateLimiter = rateLimit({
+  windowMs: MINUTE,
+  limit: 300,
+  standardHeaders: 'draft-8',
+  legacyHeaders: false,
+  message,
+});
+
+export const rateLimiters = {
+  /** Account creation, per IP. */
+  signUp: createLimiter('sign-up', { windowMs: 60 * MINUTE, limit: 10 }),
+
+  /** Password guessing: per IP+email for one account, and per IP across many accounts. */
+  signIn: createLimiter('sign-in', {
+    windowMs: 15 * MINUTE,
+    limit: 10,
+    keyGenerator: (req) => `${ip(req)}:${email(req)}`,
+  }),
+  signInIp: createLimiter('sign-in-ip', { windowMs: 15 * MINUTE, limit: 50 }),
+
+  /** OTP / link / reset token guessing, per IP. */
+  verify: createLimiter('verify', { windowMs: 15 * MINUTE, limit: 20 }),
+
+  /**
+   * Endpoints that send an email. Limited per recipient so nobody can flood an
+   * inbox from many IPs, and per IP so one client can't spray many addresses.
+   */
+  emailPerAddress: createLimiter('email-address', {
+    windowMs: 15 * MINUTE,
+    limit: 3,
+    keyGenerator: email,
+  }),
+  emailPerIp: createLimiter('email-ip', { windowMs: 15 * MINUTE, limit: 10 }),
+
+  /** Password changes for signed-in users, per IP. */
+  changePassword: createLimiter('change-password', { windowMs: 15 * MINUTE, limit: 10 }),
+
+  /** Token refreshes, per IP (tokens are unguessable; this only caps abuse). */
+  refresh: createLimiter('refresh', { windowMs: 15 * MINUTE, limit: 300 }),
+
+  /** Starting a social login and exchanging its code, per IP. */
+  social: createLimiter('social', { windowMs: 15 * MINUTE, limit: 30 }),
+};

package/templates/mongoose/src/app/middlewares/request_validator.ts

@@ -1,14 +1,15 @@
-import { NextFunction, Request, Response } from 'express';
+import type { NextFunction, Request, Response } from 'express';
+import type { ZodType } from 'zod';
 
-const RequestValidator = (schema: any) => {
-    return async (req: Request, res: Response, next: NextFunction) => {
-        try {
-            req.body = await schema.parseAsync(req.body);
-            next();
-        } catch (err) {
-            next(err);
-        }
-    };
+const RequestValidator = (schema: ZodType) => {
+  return async (req: Request, _res: Response, next: NextFunction) => {
+    try {
+      req.body = await schema.parseAsync(req.body);
+      next();
+    } catch (err) {
+      next(err);
+    }
+  };
 };
 
 export default RequestValidator;

package/templates/mongoose/src/app/middlewares/uploader.ts

@@ -1,16 +1,20 @@
-import multer from "multer";
-import path from "path";
+import multer from 'multer';
+import { AppError } from '../utils/app_error.js';
 
-const storage = multer.diskStorage({
-    destination: function (req, file, cb) {
-        cb(null, path.join(process.cwd(), "uploads"))
-    },
-    filename: function (req, file, cb) {
+const ALLOWED_IMAGE_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
 
-        cb(null, file.originalname)
-    }
-})
+/**
+ * Keeps the (size limited) file in memory and streams it to Cloudinary, so nothing
+ * is ever left behind on disk when validation or the upload fails.
+ */
+const uploader = multer({
+  storage: multer.memoryStorage(),
+  limits: { fileSize: MAX_FILE_SIZE, files: 1, fields: 10 },
+  fileFilter: (_req, file, cb) => {
+    if (ALLOWED_IMAGE_TYPES.includes(file.mimetype)) return cb(null, true);
+    cb(new AppError(`Only ${ALLOWED_IMAGE_TYPES.join(', ')} files are allowed`, 400));
+  },
+});
 
-const uploader = multer({ storage: storage })
-
-export default uploader;
+export default uploader;

package/templates/mongoose/src/app/modules/account/account.controller.ts

@@ -0,0 +1,156 @@
+import catchAsync from '../../utils/catch_async.js';
+import manageResponse from '../../utils/manage_response.js';
+import { clearSessionCookies, createSession } from '../../utils/session.js';
+import { account_services } from './account.service.js';
+
+const create_account = catchAsync(async (req, res) => {
+  const result = await account_services.create_account_into_db(req);
+  manageResponse(res, {
+    statusCode: 201,
+    success: true,
+    message: 'Account created successfully',
+    data: result,
+  });
+});
+
+const verify_account_using_otp = catchAsync(async (req, res) => {
+  const result = await account_services.verify_account_using_otp_into_db(req);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Otp verification successful',
+    data: result,
+  });
+});
+
+const verify_account_using_link = catchAsync(async (req, res) => {
+  const result = await account_services.verify_account_using_link_into_db(req);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Account verification successful',
+    data: result,
+  });
+});
+
+const login_user = catchAsync(async (req, res) => {
+  const user = await account_services.login_user_into_db(req);
+  const tokens = await createSession(res, user);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'User logged in successfully',
+    data: tokens,
+  });
+});
+
+const get_user_account = catchAsync(async (req, res) => {
+  const result = await account_services.get_user_account_from_db(req);
+
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Account fetched successfully',
+    data: result,
+  });
+});
+
+const change_password = catchAsync(async (req, res) => {
+  const user = await account_services.change_password_into_db(req);
+  // every session was revoked, so give this one a fresh start
+  const tokens = await createSession(res, user);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Password changed successfully',
+    data: tokens,
+  });
+});
+
+const resend_otp_and_verification_link = catchAsync(async (req, res) => {
+  const result = await account_services.resend_otp_and_verification_link_from_db(req);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'If the account exists and is not verified, a new OTP has been sent',
+    data: result,
+  });
+});
+
+const forget_password_generate_reset_token = catchAsync(async (req, res) => {
+  const result = await account_services.forget_password_generate_reset_token_from_db(req);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'If an account exists for this email, a password reset link has been sent',
+    data: result,
+  });
+});
+
+const reset_password_using_token = catchAsync(async (req, res) => {
+  const result = await account_services.reset_password_using_token_into_db(req);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Password reset successfully',
+    data: result,
+  });
+});
+
+const refresh_token = catchAsync(async (req, res) => {
+  const { user, familyId } = await account_services.refresh_session_from_db(req);
+  const tokens = await createSession(res, user, familyId);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Tokens refreshed successfully',
+    data: tokens,
+  });
+});
+
+const sign_out = catchAsync(async (req, res) => {
+  await account_services.sign_out_from_db(req);
+  clearSessionCookies(res);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Signed out successfully',
+  });
+});
+
+const sign_out_everywhere = catchAsync(async (req, res) => {
+  await account_services.sign_out_everywhere_from_db(req);
+  clearSessionCookies(res);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Signed out from all devices',
+  });
+});
+
+const exchange_social_login_code = catchAsync(async (req, res) => {
+  const user = await account_services.exchange_social_login_code_from_db(req);
+  const tokens = await createSession(res, user);
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'User logged in successfully',
+    data: tokens,
+  });
+});
+
+export const account_controller = {
+  create_account,
+  login_user,
+  get_user_account,
+  change_password,
+  verify_account_using_otp,
+  resend_otp_and_verification_link,
+  verify_account_using_link,
+  forget_password_generate_reset_token,
+  reset_password_using_token,
+  refresh_token,
+  sign_out,
+  sign_out_everywhere,
+  exchange_social_login_code,
+};

package/templates/mongoose/src/app/modules/account/account.interface.ts

@@ -0,0 +1,65 @@
+import type { Types } from 'mongoose';
+
+export const ROLES = ['ADMIN', 'USER'] as const;
+export type ROLE = (typeof ROLES)[number];
+
+export const PROVIDERS = [
+  'LOCAL',
+  'GOOGLE',
+  'FACEBOOK',
+  'GITHUB',
+  'TWITTER',
+  'LINKEDIN',
+  'DISCORD',
+] as const;
+export type PROVIDER = (typeof PROVIDERS)[number];
+
+export type T_account = {
+  email: string;
+  password: string | null;
+  // provider the account was created with
+  provider: PROVIDER;
+  role: ROLE;
+  isDeleted: boolean;
+  isAccountVerified: boolean;
+  // bumped on password change/reset and "sign out everywhere"; access tokens
+  // and reset links carrying an older version stop working
+  tokenVersion: number;
+  // email verification (the OTP is stored as an HMAC, never in plain text)
+  lastOtp: string | null;
+  lastOtpSendingTime: Date | null;
+  otpAttempts: number;
+  createdAt: Date;
+  updatedAt: Date;
+};
+
+/** A social identity linked to an account, found by the provider's stable user id. */
+export type T_social_account = {
+  accountId: Types.ObjectId;
+  provider: PROVIDER;
+  providerUserId: string;
+  createdAt: Date;
+};
+
+/** Single-use code exchanged for an access token after a social login (hash only). */
+export type T_social_login_code = {
+  _id: string; // sha256 of the code
+  accountId: Types.ObjectId;
+  expiresAt: Date;
+};
+
+/**
+ * Refresh tokens are opaque random strings; only their hash is stored. Every refresh
+ * rotates the token, and all tokens of one sign-in share a `familyId`, so a stolen
+ * token that gets reused can revoke the whole session.
+ */
+export type T_refresh_token = {
+  _id: string; // sha256 of the token
+  accountId: Types.ObjectId;
+  familyId: string;
+  // the account's tokenVersion when issued; a password change makes it stale
+  tokenVersion: number;
+  expiresAt: Date;
+  // set when the token is rotated; kept until expiry to detect reuse
+  usedAt: Date | null;
+};

package/templates/mongoose/src/app/modules/account/account.route.ts

@@ -0,0 +1,101 @@
+import { Router } from 'express';
+import auth from '../../middlewares/auth.js';
+import { rateLimiters } from '../../middlewares/rate_limiter.js';
+import RequestValidator from '../../middlewares/request_validator.js';
+import { socialAuthRouter } from '../../passport-js/index.js';
+import { account_controller } from './account.controller.js';
+import { account_validation } from './account.validation.js';
+
+const accountRouter = Router();
+
+accountRouter.post(
+  '/sign-up',
+  rateLimiters.signUp,
+  rateLimiters.emailPerAddress,
+  RequestValidator(account_validation.sign_up),
+  account_controller.create_account,
+);
+
+accountRouter.post(
+  '/sign-in',
+  rateLimiters.signInIp,
+  rateLimiters.signIn,
+  RequestValidator(account_validation.sign_in),
+  account_controller.login_user,
+);
+
+accountRouter.post(
+  '/refresh-token',
+  rateLimiters.refresh,
+  RequestValidator(account_validation.refresh_token),
+  account_controller.refresh_token,
+);
+
+accountRouter.post(
+  '/sign-out',
+  RequestValidator(account_validation.refresh_token),
+  account_controller.sign_out,
+);
+
+accountRouter.post('/sign-out-all', auth(), account_controller.sign_out_everywhere);
+
+accountRouter.put(
+  '/verify-otp',
+  rateLimiters.verify,
+  RequestValidator(account_validation.verify_otp),
+  account_controller.verify_account_using_otp,
+);
+
+accountRouter.put(
+  '/verify-link',
+  rateLimiters.verify,
+  RequestValidator(account_validation.verify_link),
+  account_controller.verify_account_using_link,
+);
+
+accountRouter.get('/me', auth(), account_controller.get_user_account);
+
+accountRouter.put(
+  '/change-password',
+  rateLimiters.changePassword,
+  auth(),
+  RequestValidator(account_validation.change_password),
+  account_controller.change_password,
+);
+
+accountRouter.put(
+  '/resend-otp',
+  rateLimiters.emailPerIp,
+  rateLimiters.emailPerAddress,
+  RequestValidator(account_validation.resend_otp),
+  account_controller.resend_otp_and_verification_link,
+);
+
+accountRouter.put(
+  '/forget-password',
+  rateLimiters.emailPerIp,
+  rateLimiters.emailPerAddress,
+  RequestValidator(account_validation.forget_password),
+  account_controller.forget_password_generate_reset_token,
+);
+
+accountRouter.put(
+  '/reset-password',
+  rateLimiters.verify,
+  RequestValidator(account_validation.reset_pass),
+  account_controller.reset_password_using_token,
+);
+
+// Social login: the front-end trades the `?code=` from the redirect for a token
+accountRouter.post(
+  '/social/exchange',
+  rateLimiters.social,
+  RequestValidator(account_validation.social_exchange),
+  account_controller.exchange_social_login_code,
+);
+
+// GET /social/providers, /social/<provider> and /social/<provider>/callback
+// for every provider enabled in .env (see passport-js/providers.ts)
+accountRouter.use('/social', socialAuthRouter);
+
+export default accountRouter;