flexbiz-server 12.1.16 → 12.1.18

package/package.json

@@ -2,7 +2,7 @@
 	"name": "flexbiz-server",
 	"main": "./server/app.js",
 	"description": "Flexible Server",
-	"version": "12.1.16",
+	"version": "12.1.18",
 	"author": {
 		"name": "Van Truong Pham",
 		"email": "invncur@gmail.com"

package/server/app.js

@@ -2,7 +2,7 @@
 const express=require("express"),bodyParser=require("body-parser"),passport=require("passport"),https=require("https"),http=require("http"),fs=require("fs"),cors=require("cors"),async=require("async"),_global=require("./global"),User=global.getModel("user"),defaultConfigs=require("./defaultConfigs"),crypto=require("crypto"),mainServer=function($app$$,$options$$={cluster:!0,port:443,useSocket:!0},$callback$jscomp$1$$=null){const $configs$$=global.configs={...defaultConfigs,...$options$$.configs};$configs$$.admins||
 ($configs$$.admins=$configs$$.adminUsers.map($u$$=>$u$$.email));$configs$$.supportUsers||($configs$$.supportUsers=[...$configs$$.admins]);$configs$$.public_token||($configs$$.public_token="flex.public.token");global.port=$options$$.port||$configs$$.PORT||443;var $compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require($configs$$.paths.menu||"./menu").getModules();global.modulesInMenu={};Object.values($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$).forEach(function($module$$){global.modulesInMenu[$module$$.name]=
 $module$$});require("moment-timezone").tz.setDefault($configs$$.timezone||"Asia/Ho_Chi_Minh");$app$$||($app$$=express());$app$$.set("trust proxy",1);$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("express-session");$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$({secret:"QV098PVT123456HLBN",resave:!1,saveUninitialized:!0,cookie:{secure:!1}}));$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=
-require("cookie-parser");$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());$app$$.use(function($req_uid$$,$res$$,$next$$){($req_uid$$=$req_uid$$.cookies.uid)||($req_uid$$="uid:"+crypto.randomBytes(20).toString("hex"));$res$$.cookie("uid",$req_uid$$,{expires:new Date(Date.now()+864E5),sameSite:"none",secure:!0});$next$$()});$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("compression");$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());
+require("cookie-parser");$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());$app$$.use(function($req$$,$res$$,$next$$){let $uid$$=$req$$.cookies.uid;$uid$$||($uid$$="uid:"+crypto.randomBytes(20).toString("hex"),$res$$.cookie("uid",$uid$$,{expires:new Date(Date.now()+31536E6),sameSite:"none",secure:!0}),$req$$.cookies.uid=$uid$$);$next$$()});$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("compression");$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());
 $compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=$configs$$.paths.uploads||__dirname+"/uploads";$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("multer")({dest:$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$,limits:{fileSize:$configs$$.limitFileSize||1048576}});$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$);$app$$.use(cors({credentials:!0,exposedHeaders:["set-cookie"],
 origin:($origin$$,$callback$$)=>{$callback$$(null,!0)}}));$configs$$.paths||($configs$$.paths={});$app$$.use("/",express.static($configs$$.paths.public||__dirname+"/public"));$app$$.use("/admin",express.static($configs$$.paths.admin||__dirname+"/admin"));$app$$.use("/templates",express.static($configs$$.paths.templates||__dirname+"/templates"));$app$$.use("/images",express.static($configs$$.paths.images||__dirname+"/images"));$app$$.use(bodyParser.json({limit:$configs$$.limitRequestSize||"1mb"}));
 $app$$.use(bodyParser.urlencoded({limit:$configs$$.limitRequestSize||"1mb",extended:!0}));$app$$.use(passport.initialize());$compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("morgan");var $accessLogStream_rfs$$=require("rotating-file-stream");const $logDirectory$$=$configs$$.paths.log||__dirname+"/log";fs.existsSync($logDirectory$$)||fs.mkdirSync($logDirectory$$);$accessLogStream_rfs$$=$accessLogStream_rfs$$("access.log",{interval:"1d",path:$logDirectory$$});$app$$.use($compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$("combined",

package/server/auths/bearer.js

@@ -1,3 +1,3 @@
 'use strict';const User=global.getModel("user"),BearerStrategy=require("passport-http-bearer").Strategy;
-module.exports=function($passport$$){$passport$$.use(new BearerStrategy({passReqToCallback:!0},function($req$$,$token$$,$done$$){let $ip$$=$req$$.ip||$req$$.headers["x-forwarded-for"]||$req$$.connection.remoteAddress;setImmediate(function(){User.findByToken($token$$,$ip$$,async function($err$$,$user$$,$tokenInfo$$){return $err$$?$done$$($err$$):$tokenInfo$$.once&&$tokenInfo$$.used?(console.error("can't use token",$token$$,"at",$req$$.originalUrl),$done$$("This token can only be used once")):$user$$?
-$done$$(null,$user$$):$done$$(null,!1)})})}))};
+module.exports=function($passport$$){$passport$$.use(new BearerStrategy({passReqToCallback:!0},function($req$$,$token$$,$done$$){let $ip$$=$req$$.ip||$req$$.headers["x-forwarded-for"]||$req$$.connection.remoteAddress,$session_created$$=($req$$.cookies||{}).uid;setImmediate(function(){User.findByToken($token$$,$ip$$,async function($err$$,$user$$,$tokenInfo$$){return $err$$?$done$$($err$$):$tokenInfo$$.once&&$tokenInfo$$.used?(console.error("can't use token",$token$$,"at",$req$$.originalUrl),$done$$("This token can only be used once")):
+$user$$?$done$$(null,$user$$):$done$$(null,!1)},{session_created:$session_created$$})})}))};

package/server/auths/local.js

@@ -1,42 +1,46 @@
-'use strict';const User=global.getModel("user"),Participant=global.getModel("participant"),UserGroup=global.getModel("usergroup"),Customer=global.getModel("customer"),request=require("request"),log=global.getModel("log"),App=global.getModel("app"),Wallet=global.getModel("wallet"),Token=global.getModel("token"),BasicStrategy=require("passport-http").BasicStrategy,_crypto=require("crypto"),validator=require("validator"),email=require("../libs/email"),loadTemplate=require("../libs/load-template"),OTP=
-global.getModel("otp"),DIGITS="0123456789",jwt=require("jsonwebtoken");function generateOTP(){let $OTP$$="";for(let $i$$=0;6>$i$$;$i$$++)$OTP$$+=DIGITS[Math.floor(10*Math.random())];return $OTP$$}
+'use strict';const User=global.getModel("user"),Participant=global.getModel("participant"),UserGroup=global.getModel("usergroup"),Customer=global.getModel("customer"),request=require("request"),log=global.getModel("log"),App=global.getModel("app"),Wallet=global.getModel("wallet"),Token=global.getModel("token"),BasicStrategy=require("passport-http").BasicStrategy,_crypto=require("crypto"),validator=require("validator"),email=require("../libs/email"),loadTemplate=require("../libs/load-template"),permission=
+require("../libs/permission"),OTP=global.getModel("otp"),DIGITS="0123456789",jwt=require("jsonwebtoken");function generateOTP(){let $OTP$$="";for(let $i$$=0;6>$i$$;$i$$++)$OTP$$+=DIGITS[Math.floor(10*Math.random())];return $OTP$$}
 function generateToken($user$$){var $body_n_n$$={email:$user$$.email};configs.APP_SECRET?jwt.sign({user:$body_n_n$$},configs.APP_SECRET):($body_n_n$$=new Date,_crypto.createHash("md5").update($user$$.email+$body_n_n$$.toISOString()).digest("hex"));$body_n_n$$=new Date;return _crypto.createHash("md5").update($user$$.email+$body_n_n$$.toISOString()).digest("hex")}
 function saveOTP($Phone$$,$otp_code$$,$callback$$,$expires$$=5){let $expire_time$$=new Date;$expire_time$$.setMinutes($expire_time$$.getMinutes()+$expires$$);OTP.create({phone:$Phone$$,otp:$otp_code$$,expire_time:$expire_time$$},($e$$,$rs$$)=>{if($e$$)return $callback$$($e$$);$callback$$(null,$rs$$.toObject())})}
 function findByUsername($username$$,$fn$$){if(!$username$$)return $fn$$("B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");User.findOne({$or:[{email:$username$$}]},function($error$$,$result$$){return!$error$$&&$result$$&&$result$$.local?$fn$$(null,$result$$):$fn$$($error$$||`T\u00e0i kho\u1ea3n ${$username$$} kh\u00f4ng t\u1ed3n t\u1ea1i`)})}
-async function addUserToApp($user$$,$body$$){if($body$$.id_app){if(!await App.findById($body$$.id_app))throw console.error("Can't find app",$body$$.id_app),"Kh\u00f4ng th\u1ec3 t\u00ecm th\u1ea5y th\u00f4ng tin c\u00f4ng ty n\u00e0y";await Participant.asyncCreateParticipant({id_app:$body$$.id_app,email:$body$$.email,group_id:$body$$.group_id,active:!0});await global.getModel("customer").findOne({id_app:$body$$.id_app,of_user:$user$$.email}).lean()||await Customer.asyncCreateCustomer({ten_kh:$body$$.name,
-email:$user$$.email,id_app:$body$$.id_app,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email})}}
+async function addUserToApp($user$$,$body$$,$session_created$$){if($body$$.id_app){if(!await App.findById($body$$.id_app))throw console.error("Can't find app",$body$$.id_app),"Kh\u00f4ng th\u1ec3 t\u00ecm th\u1ea5y th\u00f4ng tin c\u00f4ng ty n\u00e0y";await Participant.asyncCreateParticipant({id_app:$body$$.id_app,name:$body$$.name||$user$$.email,email:$body$$.email,group_id:$body$$.group_id,active:!0,session_created:$session_created$$});await global.getModel("customer").findOne({id_app:$body$$.id_app,
+of_user:$user$$.email}).lean()||await Customer.asyncCreateCustomer({ten_kh:$body$$.name||$user$$.email,email:$user$$.email,id_app:$body$$.id_app,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email})}}
 module.exports=async function($app$jscomp$0$$,$passport$$){const $rateLimiter$$=await global.createRateLimiterMiddleware(configs.limitRequest.auth||{},"auth");$passport$$.use(new BasicStrategy(function($username$$,$password$$,$done$$){if(!$username$$)return $done$$("B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");$username$$=$username$$.trim().toLowerCase();setImmediate(function(){findByUsername($username$$,function($err$$,$user$$){if($err$$)return $done$$($err$$);if(!$user$$)return $done$$("T\u00e0i kho\u1ea3n "+
 $username$$+" ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd.");if($user$$.local.rspassword)if($user$$.validRspassword($password$$))$user$$.local.password=$user$$.local.rspassword,$user$$.local.rspassword=void 0,User.findOneAndUpdate({email:$user$$.email},{local:$user$$.local},($e$$,$rs$$)=>{if($e$$)return console.error("Can't update password",$user$$.email,$e$$);console.log("updated new password",$user$$.email,$rs$$)});else{if(!$user$$.validPassword($password$$))return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}else{if(!$user$$.local.password)return $done$$("M\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i. H\u00e3y s\u1eed d\u1ee5ng t\u00ednh n\u0103ng kh\u00f4i ph\u1ee5c m\u1eadt kh\u1ea9u \u0111\u1ec3 \u0111\u1eb7t l\u1ea1i m\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng n\u00e0y");
-if(!$user$$.validPassword($password$$))return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}return $done$$(null,$user$$)})})}));$app$jscomp$0$$.get("/send-otp/:phone",$rateLimiter$$,async($req_url$$,$res$$)=>{const $Phone$$=$req_url$$.params.phone.trim();if(!await User.findOne({email:$Phone$$}))return $res$$.status(400).send({error:`T\u00e0i kho\u1ea3n ${$Phone$$} kh\u00f4ng t\u1ed3n t\u1ea1i`});const $otp_code$$=generateOTP();validator.isEmail($Phone$$)?email.sendHtml({to:{address:$Phone$$},
-subject:"M\u00e3 x\u00e1c th\u1ef1c",html:`Xin vui l\u00f2ng g\u1eedi qu\u00fd kh\u00e1ch m\u00e3 x\u00e1c th\u1ef1c: ${$otp_code$$}. M\u00e3 n\u00e0y s\u1ebd h\u1ebft h\u1ea1n s\u1eed d\u1ee5ng sau 5 ph\u00fat.`},function($error$$){$error$$?(console.error("Error send otp to email",$error$$),$res$$.status(400).send(`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi email ${$Phone$$}`)):saveOTP($Phone$$,$otp_code$$,($e$$,$rs$$)=>{if($e$$)return $res$$.status(400).send($e$$);$res$$.send($rs$$)},
-5)},configs.sender_otp):validator.isMobilePhone($Phone$$)?configs.sms.send?configs.sms.send($Phone$$,$otp_code$$,$req_url$$.query.id_app).then($rs$jscomp$0$$=>{$rs$jscomp$0$$.error_message?$res$$.status(400).send({error:$rs$jscomp$0$$.message||$rs$jscomp$0$$.error||$rs$jscomp$0$$.error_message||`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`}):saveOTP($Phone$$,$otp_code$$,($e$$,$rs$$)=>{if($e$$)return $res$$.status(400).send($e$$);$res$$.send($rs$$)})}).catch($e$$=>
-{console.error("Error send sms",$e$$);$res$$.status(400).send({error:$e$$.message||$e$$.error_message||`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`})}):($req_url$$=configs.sms.genUrlSendOTP($Phone$$,$otp_code$$,$req_url$$.query.id_app),request({url:$req_url$$},($error$$,$response$$,$body$$)=>{if($error$$||200!=$response$$.statusCode)$res$$.status(400).send({error:$error$$||`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`});
-else try{const $info$$=JSON.parse($body$$);"100"==$info$$.CodeResult?saveOTP($Phone$$,$otp_code$$,($e$$,$rs$$)=>{if($e$$)return $res$$.status(400).send($e$$);$res$$.send($rs$$)}):(console.error("Error send sms",$info$$),$res$$.status(400).send({error:`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`}))}catch($e$$){$res$$.status(400).send({error:$body$$})}})):$res$$.status(400).send({error:`T\u00e0i kho\u1ea3n ${$Phone$$} kh\u00f4ng c\u00f3 gi\u00e1 tr\u1ecb`})});
-$app$jscomp$0$$.get("/verify-otp/:id/:otp",$rateLimiter$$,async function($req$$,$res$$){try{const $id$$=$req$$.params.id;if(!global.mongoose.Types.ObjectId.isValid($id$$))return $res$$.status(400).send({error:"ID c\u1ee7a m\u00e3 x\u00e1c th\u1ef1c n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i",code:4001});const $otp_code$$=$req$$.params.otp,$otp$$=await OTP.findById($id$$);if(!$otp$$||$otp$$.otp!=$otp_code$$||$otp$$.verified||$otp$$.expire_time.getTime()<(new Date).getTime())return $res$$.status(400).send({error:"M\u00e3 x\u00e1c th\u1ef1c n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i ho\u1eb7c \u0111\u00e3 h\u1ebft hi\u1ec7u l\u1ef1c",
-code:4001});await OTP.findOneAndUpdate({_id:$id$$},{verified:!0});let $is_new$$=!1;const $username$$=$otp$$.phone;let $user$$=await User.findOne({email:$username$$});if(!$user$$){$user$$=new User;$user$$.email=$username$$;$user$$.local={active:!0};$user$$.local.email=$otp$$.email;$user$$.local.phone=$otp$$.phone;$user$$.local.name=$otp$$.phone;$user$$.name=$otp$$.phone;$is_new$$=!0;try{await $user$$.save()}catch($e$$){return console.log("error verify otp, create user",$e$$),$res$$.status(500).send($e$$)}}else if(!$user$$.local||
-!$user$$.local.active){$user$$.local=$user$$.local||{};$user$$.local.active=!0;try{await $user$$.save()}catch($e$$){return console.log("error verify otp, create user",$e$$),$res$$.status(500).send($e$$)}}if($req$$.query.id_app&&$req$$.query.group_id){const $id_app$$=$req$$.query.id_app,$group_id$$=$req$$.query.group_id,$app$$=await App.findById($id_app$$);$app$$&&Participant.createParticipant({id_app:$id_app$$,email:$user$$.email,name:$user$$.name,group_id:$group_id$$,active:!0},$cust$jscomp$1_e$$=>
-{if($cust$jscomp$1_e$$)return console.log("can't add user",$user$$.email,"to company",$app$$.name);$cust$jscomp$1_e$$={ten_kh:$user$$.name,email:$user$$.email,dien_thoai:$otp$$.phone,id_app:$id_app$$,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email};try{Customer.asyncCreateCustomer($cust$jscomp$1_e$$)}catch($e$$){console.log("Auto create new customer with error:",$e$$.message)}})}const $accessToken$$=generateToken($user$$),$agent$$=$req$$.headers["user-agent"];
-let $session_created$$;$req$$.cookies&&($session_created$$=$req$$.cookies.uid);(new Token({email:$user$$.email,session_created:$session_created$$,token:$accessToken$$,agent:$agent$$,ip:"",once:1==$req$$.query.once||"true"==$req$$.query.once||"1"===$req$$.query.once?!0:!1})).save(function($e$$,$rs$$){return $e$$?$res$$.status(500).send($e$$):$res$$.send({token:$accessToken$$,is_new:$is_new$$,once:$rs$$.once})})}catch($e$$){console.error("error verify otp",$e$$),$res$$.status(400).send($e$$.message)}});
-$app$jscomp$0$$.post("/auth/sign",$rateLimiter$$,($req$$,$res$$,$next$$)=>{$passport$$.authenticate("basic",{session:!1},function($err$$,$user$$){if($err$$||!$user$$)return $res$$.status(401).send({message:$err$$||"Unauthorized"});$req$$.user=$user$$;$next$$()})($req$$,$res$$,$next$$)},async($req$jscomp$3_user$$,$res$$)=>{let $data$$=$req$jscomp$3_user$$.body;$req$jscomp$3_user$$=$req$jscomp$3_user$$.user;if(!$data$$)return $res$$.status(400).send("Not have data to sign");if(!$data$$.id_app)return $res$$.status(400).send("Data miss id_app property");
-try{let $signature$$=await Wallet.sign($data$$.id_app,$req$jscomp$3_user$$.email,$data$$);$res$$.send($signature$$)}catch($e$$){return $res$$.status(400).send($e$$.message||$e$$)}});$app$jscomp$0$$.get("/auth/local",$rateLimiter$$,function($req$$,$res$$,$next$$){let $ip$$=($req$$.ip||$req$$.headers["x-forwarded-for"]||$req$$.connection.remoteAddress).split(".").join("").split(":").join(""),$authorization$$=$req$$.headers.authorization;if(!$authorization$$)return $res$$.status(400).send({message:"Authorization is required"});
-$authorization$$=Buffer.from($authorization$$.replace("Basic ",""),"base64").toString("utf-8");$authorization$$=$authorization$$.split(":");if(1<$authorization$$.length){let $t_session$$="times_login_"+$ip$$+"_"+$authorization$$[0].trim().toLowerCase(),$d_session$$="datetime_login_"+$ip$$+"_"+$authorization$$[0].trim().toLowerCase();$req$$.t_session=$t_session$$;$req$$.d_session=$d_session$$;let $now$$=new Date,$d$$=$now$$,$times_try$$=1;if($req$$.headers.cookie&&$req$$.session){$req$$=$req$$.session;
-$req$$[$t_session$$]?($times_try$$=$req$$[$t_session$$]+1,$req$$[$t_session$$]=$times_try$$):($req$$[$t_session$$]=$times_try$$,$req$$[$d_session$$]=$now$$);$req$$[$d_session$$]?$d$$=new Date($req$$[$d_session$$]):$req$$[$d_session$$]=$now$$;$req$$=$now$$.getTime()-$d$$.getTime();if(18E6>$req$$&&10<$times_try$$)return $res$$.status(400).send({message:"B\u1ea1n \u0111\u0103ng nh\u1eadp sai 10 l\u1ea7n li\u00ean ti\u1ebfp. H\u00e3y th\u1eed l\u1ea1i sau "+Math.roundBy((18E6-$req$$)/6E4,0)+" ph\u00fat"});
-$next$$()}else global.clientRedis.get($t_session$$,function($err$$,$reply$$){$reply$$?($times_try$$=Number($reply$$)+1,global.clientRedis.set($t_session$$,$times_try$$)):(global.clientRedis.set($t_session$$,$times_try$$),global.clientRedis.set($d_session$$,$now$$));global.clientRedis.get($d_session$$,function($err$jscomp$3_time_wait$$,$reply$$){$reply$$?$d$$=new Date($reply$$):global.clientRedis.set($d_session$$,$now$$);$err$jscomp$3_time_wait$$=$now$$.getTime()-$d$$.getTime();if(18E6>$err$jscomp$3_time_wait$$&&
-10<$times_try$$)return $res$$.status(400).send({message:"B\u1ea1n \u0111\u0103ng nh\u1eadp sai 10 l\u1ea7n li\u00ean ti\u1ebfp. H\u00e3y th\u1eed l\u1ea1i sau "+Math.roundBy((18E6-$err$jscomp$3_time_wait$$)/6E4,0)+" ph\u00fat"});$next$$()})})}},function($req$$,$res$$,$next$$){$passport$$.authenticate("basic",{session:!1},function($err$$,$user$$){if($err$$||!$user$$)return $res$$.status(401).send({message:$err$$||"Unauthorized"});if(configs.require_verify&&!$user$$.local.active)return $res$$.status(401).send({require_verify:!0});
-$req$$.user=$user$$;$next$$()})($req$$,$res$$,$next$$)},async($req$$,$res$$)=>{let $agent$$=$req$$.headers["user-agent"];if($req$$.headers.cookie){var $group_id$jscomp$1_session$$=$req$$.session;$group_id$jscomp$1_session$$[$req$$.t_session]=0;$group_id$jscomp$1_session$$[$req$$.d_session]=""}else global.clientRedis.set($req$$.t_session,0),global.clientRedis.set($req$$.d_session,"");log.create({id_app:"LOGIN",id_func:"LOGIN",action:"LOCALLOGIN"},$req$$.user.email,$req$$.header("user-agent"),$req$$);
-let $user$$=$req$$.user;if($req$$.query.id_app&&$req$$.query.group_id&&global.mongoose.Types.ObjectId.isValid($req$$.query.group_id)){const $id_app$$=$req$$.query.id_app;$group_id$jscomp$1_session$$=$req$$.query.group_id;const $app$$=await App.findById($id_app$$),$group$$=await UserGroup.findOne({_id:$group_id$jscomp$1_session$$,is_customer_group:!0});$app$$&&$group$$&&Participant.createParticipant({id_app:$id_app$$,email:$user$$.email,name:$user$$.name,group_id:$group_id$jscomp$1_session$$,active:!0},
-$cust$jscomp$2_e$$=>{if($cust$jscomp$2_e$$)return console.log("can't add user",$user$$.email,"to company",$app$$.name);$cust$jscomp$2_e$$={ten_kh:$user$$.name,email:$user$$.email,id_app:$id_app$$,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email};validator.isMobilePhone($user$$.email,["vi-VN"])&&($cust$jscomp$2_e$$.dien_thoai=$user$$.email);try{Customer.asyncCreateCustomer($cust$jscomp$2_e$$)}catch($e$$){console.log("Auto create new customer with error:",$e$$.message)}})}const $accessToken$$=
-generateToken($user$$);let $session_created$$;$req$$.cookies&&($session_created$$=$req$$.cookies.uid);(new Token({email:$user$$.email,session_created:$session_created$$,token:$accessToken$$,agent:$agent$$,ip:"",once:1==$req$$.query.once||"true"==$req$$.query.once||"1"===$req$$.query.once?!0:!1})).save(function($e$$,$rs$$){if($e$$)return $res$$.status(500).send($e$$);$res$$.send({token:$accessToken$$,once:$rs$$.once})})});$app$jscomp$0$$.get("/check-user/:email",$rateLimiter$$,function($req$$,$res$$){User.findOne({email:$req$$.params.email},
-{email:1,name:1,picture:1}).lean().exec(function($e$$,$user$$){if($e$$)return $res$$.status(400).send($e$$);$res$$.send($user$$)})});$app$jscomp$0$$.post("/signup",$rateLimiter$$,async($req$$,$res$$)=>{let $body$$=$req$$.body;$body$$.json&&($body$$=JSON.parse($body$$.json));if(!$body$$)return $res$$.status(400).send("Kh\u00f4ng c\u00f3 n\u1ed9i dung");if(!$body$$.email)return $res$$.status(400).send("L\u1ed7i: B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");$body$$.email=$body$$.email.trim().toLowerCase();
-if(!validator.isEmail($body$$.email)&&!validator.isMobilePhone($body$$.email,["vi-VN"]))return $res$$.status(400).send("T\u00e0i kho\u1ea3n \u0111\u0103ng nh\u1eadp ph\u1ea3i l\u00e0 1 \u0111\u1ecba ch\u1ec9 email ho\u1eb7c 1 s\u1ed1 \u0111i\u1ec7n tho\u1ea1i di \u0111\u1ed9ng");if(!$body$$.name)return $res$$.status(400).send("L\u1ed7i: H\u1ecd v\u00e0 t\u00ean ch\u01b0a nh\u1eadp");User.findOne({email:$body$$.email},async function($error$jscomp$1$$,$result$$){if($error$jscomp$1$$)return $res$$.status(400).send($error$jscomp$1$$);
-if($result$$)if($result$$.local&&$result$$.local.email==$body$$.email||$result$$.email===$body$$.email)if($body$$.id_app)try{return await addUserToApp($result$$,$body$$),$res$$.send("T\u00e0i kho\u1ea3n "+$body$$.email+" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd th\u00e0nh c\u00f4ng")}catch($e$$){return $res$$.status(400).send({error:$e$$.error||$e$$.message||$e$$})}else return $res$$.status(400).send("L\u1ed7i: T\u00e0i kho\u1ea3n "+$body$$.email+" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd");
-else $result$$.local||($result$$.local={});else $result$$=new User,$result$$.email=$body$$.email,$result$$.local={};$result$$.local.email=$body$$.email;$result$$.local.name=$body$$.name;$result$$.partner=$body$$.partner;$body$$.email2&&validator.isEmail($body$$.email2)&&($result$$.email2=$body$$.email2);$result$$.name=$result$$.local.name;$body$$.picture?$result$$.local.picture=$body$$.picture:$result$$.local.picture||($result$$.local.picture="/images/avatar.jpg");let $password$$;if($body$$.password){if($body$$.rePassword!==
-$body$$.password)return $res$$.status(400).send("L\u1ed7i: M\u1eadt kh\u1ea9u x\u00e1c nh\u1eadn kh\u00f4ng ch\u00ednh x\u00e1c");if(!User.teststrengthPassword($body$$.password))return $res$$.status(400).send("L\u1ed7i: M\u1eadt kh\u1ea9u ph\u1ea3i c\u00f3 \u00edt nh\u1ea5t 6 k\u00fd t\u1ef1 v\u00e0 bao g\u1ed3m \u00edt nh\u1ea5t m\u1ed9t ch\u1eef s\u1ed1, m\u1ed9t ch\u1eef hoa v\u00e0 m\u1ed9t ch\u1eef th\u01b0\u1eddng");$password$$=$body$$.password}else $password$$=_crypto.createHash("md5").update($result$$.email+
-(new Date).toISOString()).digest("hex");$result$$.local.password=$result$$.generateHash($password$$);$result$$.save(async function($app$jscomp$4_error$$,$newUser$$){if($app$jscomp$4_error$$)return $res$$.status(400).send("L\u1ed7i: Kh\u00f4ng th\u1ec3 \u0111\u0103ng k\u00fd");log.create({id_app:"SIGNUP",id_func:"SIGNUP",action:"SIGNUP"},$result$$.email,$req$$.header("user-agent"),$req$$);if($body$$.cty_name){$app$jscomp$4_error$$=new App;$app$jscomp$4_error$$.user_created=$result$$.email;$app$jscomp$4_error$$.user_updated=
-$result$$.email;$app$jscomp$4_error$$.name=$body$$.cty_name;var $d$jscomp$1_now$$=new Date;$app$jscomp$4_error$$.ngay_dn=new Date($d$jscomp$1_now$$.getFullYear(),0,1);$app$jscomp$4_error$$.ngay_ks=new Date($d$jscomp$1_now$$.getFullYear()-1,12,0);$app$jscomp$4_error$$.nam_bd=$d$jscomp$1_now$$.getFullYear();$app$jscomp$4_error$$.ngay_ky1=new Date($d$jscomp$1_now$$.getFullYear(),0,1);$d$jscomp$1_now$$=new Date;$d$jscomp$1_now$$.setMonth($d$jscomp$1_now$$.getMonth()+3);$app$jscomp$4_error$$.expire_date=
-new Date($d$jscomp$1_now$$);$app$jscomp$4_error$$.save(function($error$jscomp$0$$,$obj$$){if($error$jscomp$0$$)return console.log("Khong tao duoc new app: "+$error$jscomp$0$$);require("../libs/initDatabase").init($obj$$._id,function($error$$){$error$$&&console.log("Can't init database \n"+$error$$)})})}try{await addUserToApp($newUser$$,$body$$)}catch($e$$){return await User.deleteOne({email:$body$$.email}),$res$$.status(400).send({error:$e$$.error||$e$$.message||$e$$})}validator.isEmail($body$$.email)&&
-!$body$$.password?(loadTemplate("thong tin dang nhap.html",{email:$result$$.email,password:$password$$,receiver_name:$body$$.name},function($error$jscomp$0$$,$html$$){if($error$jscomp$0$$)return console.log($error$jscomp$0$$);email.sendHtml({to:{name:$result$$.name,address:$result$$.email},subject:"Th\u00f4ng tin t\u00e0i kho\u1ea3n",html:$html$$},function($error$$){$error$$&&console.error("Khong the gui email thon tin tai khoan cho nguoi dung\n"+$error$$)})}),$res$$.send("T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y th\u00f4ng tin \u0111\u0103ng nh\u1eadp")):
-$res$$.send("T\u00e0i kho\u1ea3n "+$body$$.email+" \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o")})})});$app$jscomp$0$$.get("/resetpassword",$rateLimiter$$,async($req$$,$res$$)=>{let $address$$=$req$$.query.email;if(!$address$$)return $res$$.status(400).send("Y\u00eau c\u1ea7u m\u1ed9t email");$address$$=$address$$.toLowerCase();User.findOne({$or:[{"local.email":$address$$},{email:$address$$},{email2:$address$$}]},function($error$jscomp$2$$,$result$$){if($error$jscomp$2$$)return $res$$.status(400).send($error$jscomp$2$$);
-if(!$result$$)return $res$$.status(400).send(`T\u00e0i kho\u1ea3n ${$address$$} ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd`);let $newpassword$$=_crypto.createHash("md5").update((new Date).toISOString()).digest("hex");$result$$.local.rspassword=$result$$.generateHash($newpassword$$);$result$$.save(function($error$jscomp$1$$){if($error$jscomp$1$$)return $res$$.status(400).send($error$jscomp$1$$);log.create({id_app:"RESETPASSWORD",id_func:"RESETPASSWORD",action:"RESETPASSWORD"},$result$$.email,
-$req$$.header("user-agent"),$req$$);loadTemplate("reset mat khau.html",{receiver_name:$result$$.name,email:$result$$.email,password:$newpassword$$},function($error$jscomp$0$$,$html$$){if($error$jscomp$0$$)return console.log($error$jscomp$0$$);$result$$.email&&validator.isEmail($result$$.email)&&email.sendHtml({to:{name:$result$$.name,address:$result$$.email},subject:"\u0110\u1ed5i m\u1eadt kh\u1ea9u",html:$html$$},function($error$$){$error$$&&console.error("Khong the gui thong tin tai khoan cho nguoi su dung\n"+
-$error$$)});$result$$.email2&&validator.isEmail($result$$.email2)&&email.sendHtml({to:{name:$result$$.name,address:$result$$.email2},subject:"\u0110\u1ed5i m\u1eadt kh\u1ea9u",html:$html$$},function($error$$){$error$$&&console.error("Khong the gui thong tin tai khoan cho nguoi su dung\n"+$error$$)})});$res$$.send("M\u1eadt kh\u1ea9u c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u1ed5i th\u00e0nh c\u00f4ng. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y m\u1eadt kh\u1ea9u m\u1edbi, sau \u0111\u00f3 b\u1ea1n n\u00ean \u0111\u1ed5i m\u1eadt kh\u1ea9u n\u00e0y")})})})};
+if(!$user$$.validPassword($password$$))return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}return $done$$(null,$user$$)})})}));$app$jscomp$0$$.get("/send-otp/:phone",$rateLimiter$$,async($req_url$$,$res$$)=>{const $Phone$$=$req_url$$.params.phone.trim();if(!await User.findOne({email:$Phone$$}))return $res$$.status(400).send({error:`T\u00e0i kho\u1ea3n ${$Phone$$} kh\u00f4ng t\u1ed3n t\u1ea1i`});if(!$req_url$$.query["g-recaptcha-response"])return $res$$.status(400).send("Ch\u1ee9c n\u0103ng n\u00e0y y\u00eau c\u1ea7u m\u1ed9t google recaptcha token");
+try{await permission.verifyReCaptcha($req_url$$.query["g-recaptcha-response"])}catch($e$$){return $res$$.status(400).send($e$$.messag||$e$$.error||$e$$)}const $otp_code$$=generateOTP();validator.isEmail($Phone$$)?email.sendHtml({to:{address:$Phone$$},subject:"M\u00e3 x\u00e1c th\u1ef1c",html:`Xin vui l\u00f2ng g\u1eedi qu\u00fd kh\u00e1ch m\u00e3 x\u00e1c th\u1ef1c: ${$otp_code$$}. M\u00e3 n\u00e0y s\u1ebd h\u1ebft h\u1ea1n s\u1eed d\u1ee5ng sau 5 ph\u00fat.`},function($error$$){$error$$?(console.error("Error send otp to email",
+$error$$),$res$$.status(400).send(`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi email ${$Phone$$}`)):saveOTP($Phone$$,$otp_code$$,($e$$,$rs$$)=>{if($e$$)return $res$$.status(400).send($e$$);$res$$.send($rs$$)},5)},configs.sender_otp):validator.isMobilePhone($Phone$$)?configs.sms.send?configs.sms.send($Phone$$,$otp_code$$,$req_url$$.query.id_app).then($rs$jscomp$0$$=>{$rs$jscomp$0$$.error_message?$res$$.status(400).send({error:$rs$jscomp$0$$.message||$rs$jscomp$0$$.error||
+$rs$jscomp$0$$.error_message||`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`}):saveOTP($Phone$$,$otp_code$$,($e$$,$rs$$)=>{if($e$$)return $res$$.status(400).send($e$$);$res$$.send($rs$$)})}).catch($e$$=>{console.error("Error send sms",$e$$);$res$$.status(400).send({error:$e$$.message||$e$$.error_message||`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`})}):($req_url$$=configs.sms.genUrlSendOTP($Phone$$,$otp_code$$,
+$req_url$$.query.id_app),request({url:$req_url$$},($error$$,$response$$,$body$$)=>{if($error$$||200!=$response$$.statusCode)$res$$.status(400).send({error:$error$$||`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`});else try{const $info$$=JSON.parse($body$$);"100"==$info$$.CodeResult?saveOTP($Phone$$,$otp_code$$,($e$$,$rs$$)=>{if($e$$)return $res$$.status(400).send($e$$);$res$$.send($rs$$)}):(console.error("Error send sms",$info$$),$res$$.status(400).send({error:`Kh\u00f4ng th\u1ec3 g\u1eedi \u0111\u01b0\u1ee3c m\u00e3 OTP t\u1edbi s\u1ed1 ${$Phone$$}`}))}catch($e$$){$res$$.status(400).send({error:$body$$})}})):
+$res$$.status(400).send({error:`T\u00e0i kho\u1ea3n ${$Phone$$} kh\u00f4ng c\u00f3 gi\u00e1 tr\u1ecb`})});$app$jscomp$0$$.get("/verify-otp/:id/:otp",$rateLimiter$$,async function($req$$,$res$$){try{const $id$$=$req$$.params.id;if(!global.mongoose.Types.ObjectId.isValid($id$$))return $res$$.status(400).send({error:"ID c\u1ee7a m\u00e3 x\u00e1c th\u1ef1c n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i",code:4001});const $otp_code$$=$req$$.params.otp,$otp$$=await OTP.findById($id$$);$otp$$.tried_number=($otp$$.tried_number||
+0)+1;await $otp$$.save();if(!$otp$$||$otp$$.otp!=$otp_code$$||$otp$$.verified||$otp$$.tried_number>(configs.MAX_TRY_OTP||3)||$otp$$.expire_time.getTime()<(new Date).getTime())return $res$$.status(400).send({error:"M\u00e3 x\u00e1c th\u1ef1c n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i ho\u1eb7c \u0111\u00e3 h\u1ebft hi\u1ec7u l\u1ef1c",code:4001});await OTP.findOneAndUpdate({_id:$id$$},{verified:!0});let $is_new$$=!1;const $username$$=$otp$$.phone;let $user$$=await User.findOne({email:$username$$});if(!$user$$){$user$$=
+new User;$user$$.email=$username$$;$user$$.local={active:!0};$user$$.local.email=$otp$$.email;$user$$.local.phone=$otp$$.phone;$user$$.local.name=$otp$$.phone;$user$$.name=$otp$$.phone;$is_new$$=!0;try{await $user$$.save()}catch($e$$){return console.log("error verify otp, create user",$e$$),$res$$.status(500).send($e$$)}}else if(!$user$$.local||!$user$$.local.active){$user$$.local=$user$$.local||{};$user$$.local.active=!0;try{await $user$$.save()}catch($e$$){return console.log("error verify otp, create user",
+$e$$),$res$$.status(500).send($e$$)}}if($req$$.query.id_app&&$req$$.query.group_id){const $id_app$$=$req$$.query.id_app,$group_id$$=$req$$.query.group_id,$app$$=await App.findById($id_app$$);$app$$&&Participant.createParticipant({id_app:$id_app$$,email:$user$$.email,name:$user$$.name,group_id:$group_id$$,active:!0},$cust$jscomp$1_e$$=>{if($cust$jscomp$1_e$$)return console.log("can't add user",$user$$.email,"to company",$app$$.name);$cust$jscomp$1_e$$={ten_kh:$user$$.name||$user$$.email,email:$user$$.email,
+dien_thoai:$otp$$.phone,id_app:$id_app$$,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email};try{Customer.asyncCreateCustomer($cust$jscomp$1_e$$)}catch($e$$){console.log("Auto create new customer with error:",$e$$.message)}})}const $accessToken$$=generateToken($user$$);(new Token({email:$user$$.email,session_created:($req$$.cookies||{}).uid,token:$accessToken$$,agent:$req$$.headers["user-agent"],ip:"",once:1==$req$$.query.once||"true"==$req$$.query.once||"1"===$req$$.query.once?
+!0:!1})).save(function($e$$,$rs$$){return $e$$?$res$$.status(500).send($e$$):$res$$.send({token:$accessToken$$,is_new:$is_new$$,once:$rs$$.once})})}catch($e$$){console.error("error verify otp",$e$$),$res$$.status(400).send($e$$.message)}});$app$jscomp$0$$.post("/auth/sign",$rateLimiter$$,($req$$,$res$$,$next$$)=>{$passport$$.authenticate("basic",{session:!1},function($err$$,$user$$){if($err$$||!$user$$)return $res$$.status(401).send({message:$err$$||"Unauthorized"});$req$$.user=$user$$;$next$$()})($req$$,
+$res$$,$next$$)},async($req$jscomp$3_user$$,$res$$)=>{let $data$$=$req$jscomp$3_user$$.body;$req$jscomp$3_user$$=$req$jscomp$3_user$$.user;if(!$data$$)return $res$$.status(400).send("Not have data to sign");if(!$data$$.id_app)return $res$$.status(400).send("Data miss id_app property");try{let $signature$$=await Wallet.sign($data$$.id_app,$req$jscomp$3_user$$.email,$data$$);$res$$.send($signature$$)}catch($e$$){return $res$$.status(400).send($e$$.message||$e$$)}});$app$jscomp$0$$.get("/auth/local",
+$rateLimiter$$,function($req$$,$res$$,$next$$){let $ip$$=($req$$.ip||$req$$.headers["x-forwarded-for"]||$req$$.connection.remoteAddress).split(".").join("").split(":").join(""),$authorization$$=$req$$.headers.authorization;if(!$authorization$$)return $res$$.status(400).send({message:"Authorization is required"});$authorization$$=Buffer.from($authorization$$.replace("Basic ",""),"base64").toString("utf-8");$authorization$$=$authorization$$.split(":");if(1<$authorization$$.length){let $t_session$$=
+"times_login_"+$ip$$+"_"+$authorization$$[0].trim().toLowerCase(),$d_session$$="datetime_login_"+$ip$$+"_"+$authorization$$[0].trim().toLowerCase();$req$$.t_session=$t_session$$;$req$$.d_session=$d_session$$;let $now$$=new Date,$d$$=$now$$,$times_try$$=1;if($req$$.headers.cookie&&$req$$.session){$req$$=$req$$.session;$req$$[$t_session$$]?($times_try$$=$req$$[$t_session$$]+1,$req$$[$t_session$$]=$times_try$$):($req$$[$t_session$$]=$times_try$$,$req$$[$d_session$$]=$now$$);$req$$[$d_session$$]?$d$$=
+new Date($req$$[$d_session$$]):$req$$[$d_session$$]=$now$$;$req$$=$now$$.getTime()-$d$$.getTime();if(18E6>$req$$&&10<$times_try$$)return $res$$.status(400).send({message:"B\u1ea1n \u0111\u0103ng nh\u1eadp sai 10 l\u1ea7n li\u00ean ti\u1ebfp. H\u00e3y th\u1eed l\u1ea1i sau "+Math.roundBy((18E6-$req$$)/6E4,0)+" ph\u00fat"});$next$$()}else global.clientRedis.get($t_session$$,function($err$$,$reply$$){$reply$$?($times_try$$=Number($reply$$)+1,global.clientRedis.set($t_session$$,$times_try$$)):(global.clientRedis.set($t_session$$,
+$times_try$$),global.clientRedis.set($d_session$$,$now$$));global.clientRedis.get($d_session$$,function($err$jscomp$3_time_wait$$,$reply$$){$reply$$?$d$$=new Date($reply$$):global.clientRedis.set($d_session$$,$now$$);$err$jscomp$3_time_wait$$=$now$$.getTime()-$d$$.getTime();if(18E6>$err$jscomp$3_time_wait$$&&10<$times_try$$)return $res$$.status(400).send({message:"B\u1ea1n \u0111\u0103ng nh\u1eadp sai 10 l\u1ea7n li\u00ean ti\u1ebfp. H\u00e3y th\u1eed l\u1ea1i sau "+Math.roundBy((18E6-$err$jscomp$3_time_wait$$)/
+6E4,0)+" ph\u00fat"});$next$$()})})}},function($req$$,$res$$,$next$$){$passport$$.authenticate("basic",{session:!1},function($err$$,$user$$){if($err$$||!$user$$)return $res$$.status(401).send({message:$err$$||"Unauthorized"});if(configs.require_verify&&!$user$$.local.active)return $res$$.status(401).send({require_verify:!0});$req$$.user=$user$$;$next$$()})($req$$,$res$$,$next$$)},async($req$$,$res$$)=>{let $agent$$=$req$$.headers["user-agent"];$req$$.headers.cookie?($group_id$jscomp$1_session$jscomp$1_session_created$$=
+$req$$.session,$group_id$jscomp$1_session$jscomp$1_session_created$$[$req$$.t_session]=0,$group_id$jscomp$1_session$jscomp$1_session_created$$[$req$$.d_session]=""):(global.clientRedis.set($req$$.t_session,0),global.clientRedis.set($req$$.d_session,""));log.create({id_app:"LOGIN",id_func:"LOGIN",action:"LOCALLOGIN"},$req$$.user.email,$req$$.header("user-agent"),$req$$);let $user$$=$req$$.user;if($req$$.query.id_app&&$req$$.query.group_id&&global.mongoose.Types.ObjectId.isValid($req$$.query.group_id)&&
+global.mongoose.Types.ObjectId.isValid($req$$.query.id_app)){const $id_app$$=$req$$.query.id_app;$group_id$jscomp$1_session$jscomp$1_session_created$$=$req$$.query.group_id;const $app$$=await App.findById($id_app$$),$group$$=await UserGroup.findOne({_id:$group_id$jscomp$1_session$jscomp$1_session_created$$,is_customer_group:!0});$app$$&&$group$$&&Participant.createParticipant({id_app:$id_app$$,email:$user$$.email,name:$user$$.name,group_id:$group_id$jscomp$1_session$jscomp$1_session_created$$,active:!0},
+$cust$jscomp$2_e$$=>{if($cust$jscomp$2_e$$)return console.log("can't add user",$user$$.email,"to company",$app$$.name);$cust$jscomp$2_e$$={ten_kh:$user$$.name||$user$$.email,email:$user$$.email,id_app:$id_app$$,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email};validator.isMobilePhone($user$$.email,["vi-VN"])&&($cust$jscomp$2_e$$.dien_thoai=$user$$.email);try{Customer.asyncCreateCustomer($cust$jscomp$2_e$$)}catch($e$$){console.log("Auto create new customer with error:",
+$e$$.message)}})}const $accessToken$$=generateToken($user$$);var $group_id$jscomp$1_session$jscomp$1_session_created$$=($req$$.cookies||{}).uid;$group_id$jscomp$1_session$jscomp$1_session_created$$&&User.updateOne({email:$user$$.email,session_created:null},{session_created:$group_id$jscomp$1_session$jscomp$1_session_created$$});(new Token({email:$user$$.email,session_created:$group_id$jscomp$1_session$jscomp$1_session_created$$,token:$accessToken$$,agent:$agent$$,ip:"",once:1==$req$$.query.once||
+"true"==$req$$.query.once||"1"===$req$$.query.once?!0:!1})).save(function($e$$,$rs$$){if($e$$)return $res$$.status(500).send($e$$);$res$$.send({token:$accessToken$$,once:$rs$$.once})})});$app$jscomp$0$$.get("/check-user/:email",$rateLimiter$$,function($req$$,$res$$){const $email$$=$req$$.params.email;User.findOne({email:$email$$},{email:1,name:1,picture:1}).lean().exec(function($e$$,$user$$){if($e$$||!$user$$)return $res$$.status(400).send($e$$||`T\u00e0i kho\u1ea3n ${$email$$} kh\u00f4ng t\u1ed3n t\u1ea1i`);
+$res$$.send($user$$)})});$app$jscomp$0$$.post("/signup",$rateLimiter$$,async($req$$,$res$$)=>{let $body$$=$req$$.body;$body$$.json&&($body$$=JSON.parse($body$$.json));if(!$body$$)return $res$$.status(400).send("Kh\u00f4ng c\u00f3 n\u1ed9i dung");if($body$$.id_app&&!global.mongoose.Types.ObjectId.isValid($body$$.id_app))return $res$$.status(400).send("id_app kh\u00f4ng h\u1ee3p l\u1ec7");var $app$$=$body$$["g-recaptcha-response"]||$req$$.query["g-recaptcha-response"];if(!$app$$)return $res$$.status(400).send("Ch\u1ee9c n\u0103ng n\u00e0y y\u00eau c\u1ea7u m\u1ed9t google recaptcha token");
+try{await permission.verifyReCaptcha($app$$)}catch($e$$){return $res$$.status(400).send($e$$.message||$e$$.error||$e$$)}let $session_created$$=($req$$.cookies||{}).uid;if($session_created$$&&$body$$.id_app){$app$$=await App.findById($body$$.id_app);if(!$app$$)return $res$$.status(400).send("C\u00f4ng ty kh\u00f4ng t\u1ed3n t\u1ea1i");if($app$$.options&&$app$$.options.one_account_per_device&&await Participant.findOne({session_created:$session_created$$,id_app:$body$$.id_app}).lean())return $res$$.status(400).send("M\u1ed7i thi\u1ebft b\u1ecb ch\u1ec9 \u0111\u01b0\u1ee3c t\u1ea1o m\u1ed9t t\u00e0i kho\u1ea3n")}if(!$body$$.email)return $res$$.status(400).send("B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");
+$body$$.email=$body$$.email.trim().toLowerCase();if(!validator.isEmail($body$$.email)&&!validator.isMobilePhone($body$$.email,["vi-VN"]))return $res$$.status(400).send("T\u00e0i kho\u1ea3n \u0111\u0103ng nh\u1eadp ph\u1ea3i l\u00e0 1 \u0111\u1ecba ch\u1ec9 email ho\u1eb7c 1 s\u1ed1 \u0111i\u1ec7n tho\u1ea1i di \u0111\u1ed9ng");if(!$body$$.name)return $res$$.status(400).send("H\u1ecd v\u00e0 t\u00ean ch\u01b0a nh\u1eadp");User.findOne({email:$body$$.email},async function($error$jscomp$1$$,$result$$){if($error$jscomp$1$$)return $res$$.status(400).send($error$jscomp$1$$);
+if($result$$)if($result$$.local&&$result$$.local.active&&$result$$.local.email==$body$$.email)if($body$$.id_app)try{if(await global.getModel("participant").findOne({id_app:$body$$.id_app,email:$body$$.email}))return $res$$.status(400).send({error:"T\u00e0i kho\u1ea3n n\u00e0y \u0111\u00e3 t\u1ed3n t\u1ea1i"});await addUserToApp($result$$,$body$$,$session_created$$);return $res$$.send("T\u00e0i kho\u1ea3n "+$body$$.email+" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd th\u00e0nh c\u00f4ng")}catch($e$$){return $res$$.status(400).send({error:$e$$.error||
+$e$$.message||$e$$})}else return $res$$.status(400).send("T\u00e0i kho\u1ea3n "+$body$$.email+" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd");else $result$$.local||($result$$.local={});else $result$$=new User,$result$$.email=$body$$.email,$result$$.local={};$result$$.local.email=$body$$.email;$result$$.local.name=$body$$.name;$result$$.partner=$body$$.partner;$result$$.session_created=$session_created$$;$body$$.email2&&validator.isEmail($body$$.email2)&&($result$$.email2=$body$$.email2);
+$result$$.name=$result$$.local.name;$body$$.picture?$result$$.local.picture=$body$$.picture:$result$$.local.picture||($result$$.local.picture="/images/avatar.jpg");let $password$$;if($body$$.password){if($body$$.rePassword!==$body$$.password)return $res$$.status(400).send("M\u1eadt kh\u1ea9u x\u00e1c nh\u1eadn kh\u00f4ng ch\u00ednh x\u00e1c");if(!User.teststrengthPassword($body$$.password))return $res$$.status(400).send("M\u1eadt kh\u1ea9u ph\u1ea3i c\u00f3 \u00edt nh\u1ea5t 6 k\u00fd t\u1ef1 v\u00e0 bao g\u1ed3m \u00edt nh\u1ea5t m\u1ed9t ch\u1eef s\u1ed1, m\u1ed9t ch\u1eef hoa v\u00e0 m\u1ed9t ch\u1eef th\u01b0\u1eddng");
+$password$$=$body$$.password}else $password$$=_crypto.createHash("md5").update($result$$.email+(new Date).toISOString()).digest("hex");$result$$.local.password=$result$$.generateHash($password$$);$result$$.save(async function($app$jscomp$5_error$$,$newUser$$){if($app$jscomp$5_error$$)return $res$$.status(400).send("Kh\u00f4ng th\u1ec3 \u0111\u0103ng k\u00fd");log.create({id_app:"SIGNUP",id_func:"SIGNUP",action:"SIGNUP"},$result$$.email,$req$$.header("user-agent"),$req$$);if($body$$.cty_name){$app$jscomp$5_error$$=
+new App;$app$jscomp$5_error$$.user_created=$result$$.email;$app$jscomp$5_error$$.user_updated=$result$$.email;$app$jscomp$5_error$$.name=$body$$.cty_name;var $d$jscomp$1_now$$=new Date;$app$jscomp$5_error$$.ngay_dn=new Date($d$jscomp$1_now$$.getFullYear(),0,1);$app$jscomp$5_error$$.ngay_ks=new Date($d$jscomp$1_now$$.getFullYear()-1,12,0);$app$jscomp$5_error$$.nam_bd=$d$jscomp$1_now$$.getFullYear();$app$jscomp$5_error$$.ngay_ky1=new Date($d$jscomp$1_now$$.getFullYear(),0,1);$d$jscomp$1_now$$=new Date;
+$d$jscomp$1_now$$.setMonth($d$jscomp$1_now$$.getMonth()+3);$app$jscomp$5_error$$.expire_date=new Date($d$jscomp$1_now$$);$app$jscomp$5_error$$.save(function($error$jscomp$0$$,$obj$$){if($error$jscomp$0$$)return console.log("Khong tao duoc new app: "+$error$jscomp$0$$);require("../libs/initDatabase").init($obj$$._id,function($error$$){$error$$&&console.log("Can't init database \n"+$error$$)})})}try{await addUserToApp($newUser$$,$body$$,$session_created$$)}catch($e$$){return await User.deleteOne({email:$body$$.email}),
+$res$$.status(400).send({error:$e$$.error||$e$$.message||$e$$})}validator.isEmail($body$$.email)&&!$body$$.password?(loadTemplate("thong tin dang nhap.html",{email:$result$$.email,password:$password$$,receiver_name:$body$$.name},function($error$jscomp$0$$,$html$$){if($error$jscomp$0$$)return console.log($error$jscomp$0$$);email.sendHtml({to:{name:$result$$.name,address:$result$$.email},subject:"Th\u00f4ng tin t\u00e0i kho\u1ea3n",html:$html$$},function($error$$){$error$$&&console.error("Khong the gui email thon tin tai khoan cho nguoi dung\n"+
+$error$$)})}),$res$$.send("T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y th\u00f4ng tin \u0111\u0103ng nh\u1eadp")):$res$$.send("T\u00e0i kho\u1ea3n "+$body$$.email+" \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o")})})});$app$jscomp$0$$.get("/resetpassword",$rateLimiter$$,async($req$$,$res$$)=>{try{await permission.verifyReCaptcha($req$$.query["g-recaptcha-response"])}catch($e$$){return $res$$.status(400).send($e$$.message||
+$e$$.error||$e$$)}let $address$$=$req$$.query.email;if(!$address$$)return $res$$.status(400).send("Y\u00eau c\u1ea7u m\u1ed9t email");$address$$=$address$$.toLowerCase();User.findOne({$or:[{"local.email":$address$$},{email:$address$$},{email2:$address$$}]},function($error$jscomp$2$$,$result$$){if($error$jscomp$2$$)return $res$$.status(400).send($error$jscomp$2$$);if(!$result$$)return $res$$.status(400).send(`T\u00e0i kho\u1ea3n ${$address$$} ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd`);
+let $newpassword$$=_crypto.createHash("md5").update((new Date).toISOString()).digest("hex");$result$$.local.rspassword=$result$$.generateHash($newpassword$$);$result$$.save(function($error$jscomp$1$$){if($error$jscomp$1$$)return $res$$.status(400).send($error$jscomp$1$$);log.create({id_app:"RESETPASSWORD",id_func:"RESETPASSWORD",action:"RESETPASSWORD"},$result$$.email,$req$$.header("user-agent"),$req$$);loadTemplate("reset mat khau.html",{receiver_name:$result$$.name,email:$result$$.email,password:$newpassword$$},
+function($error$jscomp$0$$,$html$$){if($error$jscomp$0$$)return console.log($error$jscomp$0$$);$result$$.email&&validator.isEmail($result$$.email)&&email.sendHtml({to:{name:$result$$.name,address:$result$$.email},subject:"\u0110\u1ed5i m\u1eadt kh\u1ea9u",html:$html$$},function($error$$){$error$$&&console.error("Khong the gui thong tin tai khoan cho nguoi su dung\n"+$error$$)});$result$$.email2&&validator.isEmail($result$$.email2)&&email.sendHtml({to:{name:$result$$.name,address:$result$$.email2},
+subject:"\u0110\u1ed5i m\u1eadt kh\u1ea9u",html:$html$$},function($error$$){$error$$&&console.error("Khong the gui thong tin tai khoan cho nguoi su dung\n"+$error$$)})});$res$$.send("M\u1eadt kh\u1ea9u c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u1ed5i th\u00e0nh c\u00f4ng. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y m\u1eadt kh\u1ea9u m\u1edbi, sau \u0111\u00f3 b\u1ea1n n\u00ean \u0111\u1ed5i m\u1eadt kh\u1ea9u n\u00e0y")})})})};

package/server/cluster.js

@@ -2,8 +2,8 @@
 const express=require("express"),bodyParser=require("body-parser"),passport=require("passport"),https=require("https"),http=require("http"),fs=require("fs"),cors=require("cors"),crypto=require("crypto"),_global=require("./global"),defaultConfigs=require("./defaultConfigs"),sslConfig=require("./sslConfig"),clusterServer=function($app$$,$sslDir$$,$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$={},$_port_accessLogStream_rfs$$=9999,$options$$={start_import_data_pool:!1,
 start_report_pool:!0,useAgenda:!0,createRedisCache:!0}){const $configs$$=global.configs={...defaultConfigs,...$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$,cluster:0!=$options$$.cluster};$configs$$.admins||($configs$$.admins=$configs$$.adminUsers.map($u$$=>$u$$.email));$configs$$.supportUsers||($configs$$.supportUsers=[...$configs$$.admins]);$configs$$.public_token||($configs$$.public_token="flex.public.token");global.port=$_port_accessLogStream_rfs$$;$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=
 require($configs$$.paths.menu||"./menu").getModules();global.modulesInMenu={};Object.values($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$).forEach(function($module$$){global.modulesInMenu[$module$$.name]=$module$$});require("moment-timezone").tz.setDefault($configs$$.timezone||"Asia/Ho_Chi_Minh");$app$$||($app$$=express());$app$$.set("trust proxy",1);$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("express-session");
-$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$({secret:"QV098PVT123456HLBN",resave:!1,saveUninitialized:!0,cookie:{secure:!1}}));$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("cookie-parser");$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());$app$$.use(function($req_uid$$,$res$$,$next$$){($req_uid$$=$req_uid$$.cookies.uid)||($req_uid$$="uid:"+crypto.randomBytes(20).toString("hex"));
-$res$$.cookie("uid",$req_uid$$,{expires:new Date(Date.now()+864E5),sameSite:"none",secure:!0});$next$$()});$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("compression");$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=$configs$$.paths.uploads||__dirname+"/uploads";$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=
+$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$({secret:"QV098PVT123456HLBN",resave:!1,saveUninitialized:!0,cookie:{secure:!1}}));$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("cookie-parser");$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());$app$$.use(function($req$$,$res$$,$next$$){let $uid$$=$req$$.cookies.uid;$uid$$||($uid$$="uid:"+crypto.randomBytes(20).toString("hex"),
+$res$$.cookie("uid",$uid$$,{expires:new Date(Date.now()+31536E6),sameSite:"none",secure:!0}),$req$$.cookies.uid=$uid$$);$next$$()});$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=require("compression");$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$());$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=$configs$$.paths.uploads||__dirname+"/uploads";$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=
 require("multer")({dest:$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$,limits:{fileSize:$configs$$.limitFileSize||1048576}});$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$);$app$$.use(cors({credentials:!0,exposedHeaders:["set-cookie"],origin:($origin$$,$callback$$)=>{$callback$$(null,!0)}}));$configs$$.paths||($configs$$.paths={});$app$$.use("/",express.static($configs$$.paths.public||__dirname+"/public"));
 $app$$.use("/admin",express.static($configs$$.paths.admin||__dirname+"/admin"));$app$$.use("/templates",express.static($configs$$.paths.templates||__dirname+"/templates"));$app$$.use("/images",express.static($configs$$.paths.images||__dirname+"/images"));$app$$.use(bodyParser.json({limit:$configs$$.limitRequestSize||"1mb"}));$app$$.use(bodyParser.urlencoded({limit:$configs$$.limitRequestSize||"1mb",extended:!0}));$app$$.use(passport.initialize());$_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$=
 require("morgan");$_port_accessLogStream_rfs$$=require("rotating-file-stream");const $logDirectory$$=$configs$$.paths.log||__dirname+"/log";fs.existsSync($logDirectory$$)||fs.mkdirSync($logDirectory$$);$_port_accessLogStream_rfs$$=$_port_accessLogStream_rfs$$("access-cluster.log",{interval:"1d",path:$logDirectory$$});$app$$.use($_configs_compress_cookieParser_modulesVisible_morgan_multer_root_dir_uploads_session$$("combined",{stream:$_port_accessLogStream_rfs$$,skip:function($req$$,$res$$){return 400>