exp-node-server 1.1.7 → 2.0.0

package/templates/mongoose/src/app/modules/account/account.swagger.ts

@@ -0,0 +1,278 @@
+export const accountSwaggerDocs = {
+  '/api/auth/sign-up': {
+    post: {
+      tags: ['auth'],
+      summary: 'Create  new account',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              email: 'user@gmail.com',
+              password: 'password',
+              fullName: 'User',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'account created successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/sign-in': {
+    post: {
+      tags: ['auth'],
+      summary: 'Sign In your account',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              email: 'user@gmail.com',
+              password: 'password',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'User signed in successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/verify-otp': {
+    put: {
+      tags: ['auth'],
+      summary: 'Verify OTP',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              email: 'user@gmail.com',
+              otp: '654321',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'OTP verification successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/verify-link': {
+    put: {
+      tags: ['auth'],
+      summary: 'Verify Link',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              token: 'dsakfjasdkj',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'Token verification successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/me': {
+    get: {
+      tags: ['auth'],
+      summary: 'Get me account',
+      description: '',
+      responses: {
+        200: { description: 'account fetched successfully' },
+        401: { description: 'unauthorized' },
+      },
+    },
+  },
+  '/api/auth/change-password': {
+    put: {
+      tags: ['auth'],
+      summary: 'Change Password',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              oldPassword: '123456',
+              newPassword: '654321',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'Passwrod change successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/resend-otp': {
+    put: {
+      tags: ['auth'],
+      summary: 'Resend OTP',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              email: 'user@gmail.com',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'OTP resend successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/forget-password': {
+    put: {
+      tags: ['auth'],
+      summary: 'Forget Password',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              email: 'user@gmail.com',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'Forget password successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/reset-password': {
+    put: {
+      tags: ['auth'],
+      summary: 'Reset Password',
+      description: '',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': {
+            example: JSON.stringify({
+              token: 'dkfjadskfds',
+              newPass: 'newpass',
+            }),
+          },
+        },
+      },
+      responses: {
+        201: { description: 'Password reset successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+  '/api/auth/refresh-token': {
+    post: {
+      tags: ['auth'],
+      summary: 'Get a new access token (and a rotated refresh token)',
+      description:
+        'Browsers send the `refresh_token` cookie automatically; other clients send it in the body. ' +
+        'Every call returns a new refresh token and invalidates the old one. Reusing an old ' +
+        'refresh token ends the whole session.',
+      requestBody: {
+        required: false,
+        content: {
+          'application/json': {
+            example: JSON.stringify({ refreshToken: 'only-for-non-browser-clients' }),
+          },
+        },
+      },
+      responses: {
+        200: { description: '{ accessToken, refreshToken }, both also set as httpOnly cookies' },
+        401: { description: 'Missing, invalid, expired or reused refresh token' },
+      },
+    },
+  },
+  '/api/auth/sign-out': {
+    post: {
+      tags: ['auth'],
+      summary: 'Sign out this device (revokes its refresh token, clears the cookies)',
+      responses: { 200: { description: 'Signed out' } },
+    },
+  },
+  '/api/auth/sign-out-all': {
+    post: {
+      tags: ['auth'],
+      summary: 'Sign out from all devices (revokes every access token)',
+      responses: {
+        200: { description: 'Signed out everywhere' },
+        401: { description: 'unauthorized' },
+      },
+    },
+  },
+  '/api/auth/social/providers': {
+    get: {
+      tags: ['social auth'],
+      summary: 'List the enabled social login providers',
+      responses: { 200: { description: 'Providers, with the URL that starts each login' } },
+    },
+  },
+  '/api/auth/social/{provider}': {
+    get: {
+      tags: ['social auth'],
+      summary: 'Start a social login (open in the browser, not via fetch)',
+      description:
+        "Link to it from the front-end: <a href='/api/auth/social/google?returnTo=/dashboard'>Login with Google</a>. " +
+        'After the provider, the browser is redirected to SOCIAL_REDIRECT_URL with `?code=` (and `returnTo`) on success, ' +
+        'or `?error=` (access_denied, invalid_state, email_unverified, account_disabled, social_login_failed).',
+      parameters: [
+        {
+          name: 'provider',
+          in: 'path',
+          required: true,
+          schema: {
+            type: 'string',
+            enum: ['google', 'facebook', 'github', 'twitter', 'linkedin', 'discord'],
+          },
+        },
+        {
+          name: 'returnTo',
+          in: 'query',
+          required: false,
+          schema: { type: 'string', example: '/dashboard' },
+          description: 'Path on the front-end to come back to. Only same-site paths are kept.',
+        },
+      ],
+      responses: { 302: { description: 'Redirect to the provider' } },
+    },
+  },
+  '/api/auth/social/exchange': {
+    post: {
+      tags: ['social auth'],
+      summary: 'Trade the single-use code from the social login redirect for an access token',
+      requestBody: {
+        required: true,
+        content: {
+          'application/json': { example: JSON.stringify({ code: 'code-from-redirect' }) },
+        },
+      },
+      responses: {
+        200: { description: 'Logged in (token in body and httpOnly cookie)' },
+        401: { description: 'Invalid, expired or already used code' },
+      },
+    },
+  },
+};

package/templates/mongoose/src/app/modules/account/account.validation.ts

@@ -0,0 +1,63 @@
+import z from 'zod';
+
+const email = z.email('A valid email is required.').transform((e) => e.toLowerCase());
+const password = z
+  .string('Password is required.')
+  .min(8, 'Password must be at least 8 characters.')
+  .max(72, 'Password must be at most 72 characters.'); // bcrypt ignores bytes past 72
+
+const sign_up = z.object({
+  email,
+  password,
+  fullName: z.string('Full name is required.').trim().min(1).max(100),
+});
+
+const sign_in = z.object({
+  email,
+  password: z.string('Password is required.').max(72),
+});
+
+const change_password = z.object({
+  oldPassword: z.string('Old Password is required').max(72),
+  newPassword: password,
+});
+
+const verify_otp = z.object({
+  email,
+  otp: z.string('OTP is required').regex(/^\d{6}$/, 'OTP must be 6 digits'),
+});
+
+const token = z.string('Token is required').min(1).max(2048);
+
+const verify_link = z.object({
+  token,
+});
+
+const email_only = z.object({
+  email,
+});
+
+const reset_pass = z.object({
+  token,
+  newPass: password,
+});
+
+// optional: browsers send the refresh token as a cookie instead
+const refresh_token = z.object({ refreshToken: z.string().min(1).max(256).optional() }).optional();
+
+const social_exchange = z.object({
+  code: z.string('Code is required').min(1).max(256),
+});
+
+export const account_validation = {
+  sign_up,
+  sign_in,
+  change_password,
+  verify_otp,
+  resend_otp: email_only,
+  forget_password: email_only,
+  verify_link,
+  reset_pass,
+  social_exchange,
+  refresh_token,
+};

package/templates/mongoose/src/app/modules/profile/profile.controller.ts

@@ -0,0 +1,17 @@
+import catchAsync from '../../utils/catch_async.js';
+import manageResponse from '../../utils/manage_response.js';
+import { profile_service } from './profile.service.js';
+
+const update_profile = catchAsync(async (req, res) => {
+  const result = await profile_service.update_profile_into_db(req);
+  manageResponse(res, {
+    success: true,
+    statusCode: 200,
+    message: 'profile updated successfully.',
+    data: result,
+  });
+});
+
+export const profile_controller = {
+  update_profile,
+};

package/templates/mongoose/src/app/modules/profile/profile.interface.ts

@@ -0,0 +1,7 @@
+import type { Types } from 'mongoose';
+
+export type T_profile = {
+  accountId: Types.ObjectId;
+  fullName: string;
+  profilePhoto: string | null;
+};

package/templates/mongoose/src/app/modules/profile/profile.route.ts

@@ -0,0 +1,28 @@
+import { Router } from 'express';
+import auth from '../../middlewares/auth.js';
+import RequestValidator from '../../middlewares/request_validator.js';
+import uploader from '../../middlewares/uploader.js';
+import { AppError } from '../../utils/app_error.js';
+import { profile_controller } from './profile.controller.js';
+import { profile_validations } from './profile.validation.js';
+
+const router = Router();
+
+router.patch(
+  '/',
+  auth(),
+  uploader.single('file'),
+  // multipart forms send the JSON fields as a `data` string
+  (req, _res, next) => {
+    try {
+      req.body = req.body?.data ? JSON.parse(req.body.data) : {};
+      next();
+    } catch {
+      next(new AppError('`data` must be valid JSON', 400));
+    }
+  },
+  RequestValidator(profile_validations.update_profile),
+  profile_controller.update_profile,
+);
+
+export default router;

package/templates/mongoose/src/app/modules/profile/profile.schema.ts

@@ -0,0 +1,13 @@
+import { model, Schema } from 'mongoose';
+import type { T_profile } from './profile.interface.js';
+
+const profileSchema = new Schema<T_profile>(
+  {
+    accountId: { type: Schema.Types.ObjectId, ref: 'account', required: true, unique: true },
+    fullName: { type: String, required: true, trim: true },
+    profilePhoto: { type: String, default: null },
+  },
+  { timestamps: true, versionKey: false },
+);
+
+export const profile_model = model('profile', profileSchema);

package/templates/mongoose/src/app/modules/profile/profile.service.ts

@@ -0,0 +1,28 @@
+import { Request } from 'express';
+import uploadCloud from '../../utils/cloudinary.js';
+import { profile_model } from './profile.schema.js';
+
+const update_profile_into_db = async (req: Request) => {
+  const payload: { fullName?: string } = req.body;
+
+  // validation already ran (see profile.route.ts), so only valid requests upload
+  const profilePhoto = req.file ? (await uploadCloud(req.file, 'profiles')).secure_url : undefined;
+
+  // only the known fields, never the raw body (no operator or field injection)
+  const update = {
+    ...(payload.fullName !== undefined && { fullName: payload.fullName }),
+    ...(profilePhoto !== undefined && { profilePhoto }),
+  };
+
+  return profile_model
+    .findOneAndUpdate(
+      { accountId: req.user!.accountId },
+      { $set: update },
+      { returnDocument: 'after' },
+    )
+    .lean();
+};
+
+export const profile_service = {
+  update_profile_into_db,
+};

package/templates/mongoose/src/app/modules/profile/profile.swagger.ts

@@ -0,0 +1,34 @@
+export const profileSwaggerDocs = {
+  '/api/profile': {
+    patch: {
+      tags: ['profile'],
+      summary: 'Update profile',
+      requestBody: {
+        required: true,
+        content: {
+          'multipart/form-data': {
+            schema: {
+              type: 'object',
+              properties: {
+                data: {
+                  type: 'object',
+                  properties: {
+                    fullName: { type: 'string' },
+                  },
+                },
+                file: {
+                  type: 'string',
+                  format: 'binary',
+                },
+              },
+            },
+          },
+        },
+      },
+      responses: {
+        200: { description: 'profile updated successfully' },
+        500: { description: 'Validation error or internal server error' },
+      },
+    },
+  },
+};

package/templates/mongoose/src/app/modules/profile/profile.validation.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+const update_profile = z.object({
+  fullName: z.string().trim().min(1).max(100).optional(),
+});
+
+export const profile_validations = {
+  update_profile,
+};

package/templates/mongoose/src/app/passport-js/index.ts

@@ -0,0 +1,87 @@
+import type { Express, NextFunction, Request, Response } from 'express';
+import { Router } from 'express';
+import passport from 'passport';
+import { configs } from '../configs/index.js';
+import { logger } from '../lib/logger.js';
+import { rateLimiters } from '../middlewares/rate_limiter.js';
+import manageResponse from '../utils/manage_response.js';
+import { getReturnTo } from './oauth-state.js';
+import { enabledSocialProviders, type SocialProvider } from './providers.js';
+import { createSocialLoginCode, SocialLoginError } from './social-account.js';
+
+for (const provider of enabledSocialProviders) {
+  passport.use(provider.name, provider.createStrategy());
+}
+
+/** Mounts passport on the app. Logins are stateless, no session is needed. */
+export const setupPassport = (app: Express) => {
+  app.use(passport.initialize());
+};
+
+/** Sends the browser back to the front-end with `?code=` or `?error=`. */
+const redirectToFrontEnd = (res: Response, params: Record<string, string | undefined>) => {
+  const url = new URL(configs.social.redirect_url);
+  for (const [key, value] of Object.entries(params)) {
+    if (value) url.searchParams.set(key, value);
+  }
+  res.redirect(url.toString());
+};
+
+/** Maps a failed handshake to a short error code the front-end can show. */
+const errorCode = (req: Request, err: unknown, info: unknown): string => {
+  if (err instanceof SocialLoginError) return err.code;
+  if (req.query.error === 'access_denied' || req.query.denied) return 'access_denied';
+  const message = err instanceof Error ? err.message : (info as { message?: string })?.message;
+  if (message === 'invalid_state') return 'invalid_state';
+  if (err) logger.error({ err }, 'Social login failed');
+  return 'social_login_failed';
+};
+
+const callback =
+  ({ name }: SocialProvider) =>
+  (req: Request, res: Response, next: NextFunction) => {
+    passport.authenticate(
+      name,
+      { session: false },
+      async (err: unknown, user: Express.User | false, info: unknown) => {
+        const returnTo = getReturnTo(res);
+        if (err || !user) {
+          return redirectToFrontEnd(res, { error: errorCode(req, err, info), returnTo });
+        }
+        try {
+          const code = await createSocialLoginCode(user.accountId);
+          redirectToFrontEnd(res, { code, returnTo });
+        } catch (e) {
+          next(e);
+        }
+      },
+    )(req, res, next);
+  };
+
+/**
+ * `GET /providers` lists the enabled providers (for rendering login buttons),
+ * `GET /<provider>?returnTo=/path` starts a login, `GET /<provider>/callback` finishes it.
+ */
+export const socialAuthRouter = Router();
+
+socialAuthRouter.get('/providers', (_req, res) => {
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Social login providers fetched successfully',
+    data: enabledSocialProviders.map(({ name, label }) => ({
+      name,
+      label,
+      url: `/api/auth/social/${name}`,
+    })),
+  });
+});
+
+for (const provider of enabledSocialProviders) {
+  socialAuthRouter.get(
+    `/${provider.name}`,
+    rateLimiters.social,
+    passport.authenticate(provider.name, { session: false }),
+  );
+  socialAuthRouter.get(`/${provider.name}/callback`, callback(provider));
+}