flexbiz-server 12.7.1 → 12.7.5

package/server/auths/local.js

@@ -1,6 +1,6 @@
 const User=global.getModel("user"),Participant=global.getModel("participant"),UserGroup=global.getModel("usergroup"),Customer=global.getModel("customer"),axios=require("axios"),log=global.getModel("log"),App=global.getModel("app"),Wallet=global.getModel("wallet"),Token=global.getModel("token"),BasicStrategy=require("passport-http").BasicStrategy,_crypto=require("crypto"),validator=require("validator"),email=require("../libs/email"),loadTemplate=require("../libs/load-template"),permission=require("../libs/permission"),
-OTP=global.getModel("otp"),DIGITS="0123456789",redisCache=require("../libs/redis-cache"),utils=require("../libs/utils"),Controler=require("../controllers/controller"),{executeInTransaction}=require("../libs/sessionContext"),{isValidObjectId}=require("mongoose"),total_time_wait_login=36E5,total_time_try_login=3;function generateOTP(){let $OTP$$="";for(let $i$$=0;$i$$<6;$i$$++)$OTP$$+=DIGITS[Math.floor(Math.random()*10)];return $OTP$$}
-function generateToken($user$$){const $n$$=new Date;return _crypto.createHash("md5").update($user$$.email+$n$$.toISOString()).digest("hex")}function saveOTP($Phone$$,$otp_code$$,$expires$$=5){let $expire_time$$=new Date;$expire_time$$.setMinutes($expire_time$$.getMinutes()+$expires$$);return OTP.create({phone:$Phone$$,otp:$otp_code$$,expire_time:$expire_time$$})}
+OTP=global.getModel("otp"),DIGITS="0123456789",redisCache=require("../libs/redis-cache"),utils=require("../libs/utils"),Controler=require("../controllers/controller"),{executeInTransaction}=require("../libs/sessionContext"),{isValidObjectId}=require("mongoose"),{createRateLimiterMiddleware}=require("./rateLimiterMiddleware"),{promisify}=require("util"),{asyncHandler,redisIncrAsync,redisExpireAsync,redisPttlAsync,redisDelAsync}=require("../libs/utils"),total_time_wait_login=36E5,total_time_try_login=
+3;function generateOTP(){let $OTP$$="";for(let $i$$=0;$i$$<6;$i$$++)$OTP$$+=DIGITS[Math.floor(Math.random()*10)];return $OTP$$}function generateToken($user$$){const $n$$=new Date;return _crypto.createHash("md5").update($user$$.email+$n$$.toISOString()).digest("hex")}function saveOTP($Phone$$,$otp_code$$,$expires$$=5){let $expire_time$$=new Date;$expire_time$$.setMinutes($expire_time$$.getMinutes()+$expires$$);return OTP.create({phone:$Phone$$,otp:$otp_code$$,expire_time:$expire_time$$})}
 function findByUsername($username$$,$fn$$){if(!$username$$)return $fn$$("B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");User.findOne({$or:[{email:$username$$},{"local.phone":$username$$}]},function($error$$,$result$$){return!$error$$&&$result$$&&$result$$.local?$fn$$(null,$result$$):$fn$$($error$$||`T\u00e0i kho\u1ea3n ${$username$$} kh\u00f4ng t\u1ed3n t\u1ea1i`)})}const INTRODUCER_CONTROLLER_KEY="INTRODUCER";
 async function addUserToApp($user$$,$body$$,$session_created$$){if($body$$.id_app){if(!global.mongoose.Types.ObjectId.isValid($body$$.id_app))throw Logger.error("[addUserToApp] id_app kh\u00f4ng h\u1ee3p l\u1ec7",$body$$.id_app),Error("Kh\u00f4ng th\u1ec3 t\u00ecm th\u1ea5y th\u00f4ng tin c\u00f4ng ty n\u00e0y");return executeInTransaction(async()=>{if(!await App.findById($body$$.id_app))throw Logger.error("[addUserToApp] Can't find app",$body$$.id_app),Error("Kh\u00f4ng th\u1ec3 t\u00ecm th\u1ea5y th\u00f4ng tin c\u00f4ng ty n\u00e0y");
 $user$$.current_id_app=$body$$.id_app;let $introducedBy$$;if($body$$.introduce_code){const $contrIntroducer$$=global.controllers[INTRODUCER_CONTROLLER_KEY];if(!$contrIntroducer$$)throw Logger.error("[addUserToApp] Introducer controller ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd"),Error("Kh\u00f4ng th\u1ec3 x\u1eed l\u00fd m\u00e3 gi\u1edbi thi\u1ec7u l\u00fac n\u00e0y");try{$introducedBy$$=await new Promise(($resolve$$,$reject$$)=>{Controler.create($user$$,$contrIntroducer$$,{introduce_code:$body$$.introduce_code},
@@ -11,12 +11,16 @@ var $cust_existingCustomer$$=await global.getModel("customer").findOne({id_app:$
 module.exports=async function($app$$,$passport$$){async function $joinUserToApp$$($req$$,$user$$){return executeInTransaction(async()=>{var $customer_idApp$$=$req$$.query.id_app,$participant$$=$req$$.query.group_id&&global.mongoose.Types.ObjectId.isValid($req$$.query.group_id)?$req$$.query.group_id:void 0;const $groupQuery$$={id_app:$customer_idApp$$,$or:[{is_customer_group:!0},{is_partner_group:!0},{is_agent_group:!0},{is_pttt_group:!0}]};$participant$$?$groupQuery$$._id=$participant$$:$groupQuery$$.default_group=
 !0;const [$app$$,$group$$]=await Promise.all([App.findById($customer_idApp$$),UserGroup.findOne($groupQuery$$).lean()]);if(!$app$$||!$group$$)return{blocked:!1};if(($participant$$=await Participant.asyncCreateParticipant({id_app:$customer_idApp$$,email:$user$$.email,name:$user$$.name,group_id:$group$$._id.toString(),active:$group$$.not_need_active}))&&!$participant$$.active)return{blocked:!0,message:"T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111ang ch\u1edd \u0111\u01b0\u1ee3c x\u00e9t duy\u1ec7t"};
 if($participant$$&&$participant$$.group_id&&await UserGroup.findOne({id_app:$customer_idApp$$,_id:$participant$$.group_id,is_customer_group:!0}).lean()){$customer_idApp$$={ten_kh:$user$$.name||$user$$.email,email:$user$$.email,id_app:$customer_idApp$$,user_created:$user$$.email,user_updated:$user$$.email,kh_yn:!0,of_user:$user$$.email};utils.isMobilePhone($user$$.email,["vi-VN"])&&($customer_idApp$$.dien_thoai=$user$$.email);try{await Customer.asyncCreateCustomer($customer_idApp$$)}catch($e$$){Logger.error("[auth][local] Auto create new customer with error:",
-$e$$.message)}}return{blocked:!1}},{useParent:!0})}const $rateLimiter$$=await global.createRateLimiterMiddleware(configs.limitRequest.auth||{},"auth");$passport$$.use(new BasicStrategy(function($username$$,$password$$,$done$$){if(!$username$$)return $done$$("B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");$username$$=$username$$.trim();let $id_app$$;if($username$$.indexOf("@app=")>0){const $user_app$$=$username$$.split("@app=");$username$$=$user_app$$[0];$id_app$$=$user_app$$[1]}$username$$=$username$$.toLowerCase();
-setImmediate(function(){findByUsername($username$$,async function($err$jscomp$1_pars_pars$$,$user$$){if($err$jscomp$1_pars_pars$$)return $done$$($err$jscomp$1_pars_pars$$);if(!$user$$)return $done$$('T\u00e0i kho\u1ea3n "'+$username$$+'" ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd.');if($user$$.status==0)return $done$$("T\u00e0i kho\u1ea3n n\u00e0y kh\u00f4ng c\u00f2n hi\u1ec7u l\u1ef1c");if($user$$.local.rspassword)if($user$$.validRspassword($password$$))$user$$.local.password=$user$$.local.rspassword,
-$user$$.local.rspassword=void 0,User.updateOne({email:$user$$.email},{local:$user$$.local},($e$$,$rs$$)=>{if($e$$)return Logger.error("Can't update password",$user$$.email,$e$$);Logger.info("updated new password",$user$$.email,$rs$$)});else{if(!$user$$.validPassword($password$$))if($id_app$$)if(await $user$$.validAppPassword($password$$,$id_app$$))$user$$=$user$$.toObject(),$user$$.token_id_app=$id_app$$;else return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.");else return $err$jscomp$1_pars_pars$$=
-await $user$$.getAppOfPassword($password$$),$err$jscomp$1_pars_pars$$.length>0?($user$$=$user$$.toObject(),$user$$.token_id_apps=$err$jscomp$1_pars_pars$$.map($p$$=>$p$$.id_app),$done$$(null,$user$$)):$done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}else{if(!$user$$.local.password)return $done$$("M\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i. H\u00e3y s\u1eed d\u1ee5ng t\u00ednh n\u0103ng kh\u00f4i ph\u1ee5c m\u1eadt kh\u1ea9u \u0111\u1ec3 \u0111\u1eb7t l\u1ea1i m\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng n\u00e0y");
-if(!$user$$.validPassword($password$$))if($id_app$$)if(await $user$$.validAppPassword($password$$,$id_app$$))$user$$=$user$$.toObject(),$user$$.token_id_app=$id_app$$;else return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.");else return $err$jscomp$1_pars_pars$$=await $user$$.getAppOfPassword($password$$),$err$jscomp$1_pars_pars$$.length>0?($user$$=$user$$.toObject(),$user$$.token_id_apps=$err$jscomp$1_pars_pars$$.map($p$$=>$p$$.id_app),$done$$(null,$user$$)):$done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}return $done$$(null,
-$user$$)})})}));$app$$.get("/send-otp/:address_receive_otp",$rateLimiter$$,async($id_app$jscomp$2_req$$,$res$$)=>{let $address_receive_otp$$=$id_app$jscomp$2_req$$.params.address_receive_otp.trim().toLowerCase();if(configs.GOOGLE_RECAPTCHA_SECRET_KEY){if(!$id_app$jscomp$2_req$$.query["g-recaptcha-response"])return $res$$.status(400).send("Ch\u1ee9c n\u0103ng n\u00e0y y\u00eau c\u1ea7u m\u1ed9t google recaptcha token");try{await permission.verifyReCaptcha($id_app$jscomp$2_req$$.query["g-recaptcha-response"])}catch($e$$){return Logger.error("Can't verify recaptcha when send otp",
+$e$$.message)}}return{blocked:!1}},{useParent:!0})}async function $issueLoginTokenIfActive$$($user$$,$req$$){if($user$$.local&&$user$$.local.active)try{const $accessToken$$=generateToken($user$$);await (new Token({email:$user$$.email,session_created:($req$$.cookies||{}).uid,token:$accessToken$$,agent:$req$$.headers["user-agent"],ip:"",once:$req$$.query.once==="true"||$req$$.query.once==="1"})).save();return $accessToken$$}catch($e$$){Logger.error("[signup] can't gen new token for new user:",$user$$.email,
+$e$$)}}async function $createCompanyForUser$$($d_expireDate_initDatabase_user$$,$body$$){const $app$$=new App;$app$$.user_created=$d_expireDate_initDatabase_user$$.email;$app$$.user_updated=$d_expireDate_initDatabase_user$$.email;$app$$.name=$body$$.cty_name;$d_expireDate_initDatabase_user$$=new Date;$app$$.ngay_dn=new Date($d_expireDate_initDatabase_user$$.getFullYear(),0,1);$app$$.ngay_ks=new Date($d_expireDate_initDatabase_user$$.getFullYear()-1,12,0);$app$$.nam_bd=$d_expireDate_initDatabase_user$$.getFullYear();
+$app$$.ngay_ky1=new Date($d_expireDate_initDatabase_user$$.getFullYear(),0,1);$d_expireDate_initDatabase_user$$=new Date;$d_expireDate_initDatabase_user$$.setMonth($d_expireDate_initDatabase_user$$.getMonth()+3);$app$$.expire_date=$d_expireDate_initDatabase_user$$;await $app$$.save();$d_expireDate_initDatabase_user$$=require("../libs/initDatabase");await promisify($d_expireDate_initDatabase_user$$.init.bind($d_expireDate_initDatabase_user$$))($app$$._id)}async function $sendCredentialsEmail$$($user$$,
+$html_plainPassword$$,$receiverName$$){$html_plainPassword$$=await promisify(loadTemplate)("thong tin dang nhap.html",{email:$user$$.email,password:$html_plainPassword$$,receiver_name:$receiverName$$});await promisify(email.sendHtml.bind(email))({to:{name:$user$$.name,address:$user$$.email},subject:"Th\u00f4ng tin t\u00e0i kho\u1ea3n",html:$html_plainPassword$$})}const $rateLimiter$$=await createRateLimiterMiddleware(configs.limitRequest.auth||{},"auth");$passport$$.use(new BasicStrategy(function($username$$,
+$password$$,$done$$){if(!$username$$)return $done$$("B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n");$username$$=$username$$.trim();let $id_app$$;if($username$$.indexOf("@app=")>0){const $user_app$$=$username$$.split("@app=");$username$$=$user_app$$[0];$id_app$$=$user_app$$[1]}$username$$=$username$$.toLowerCase();setImmediate(function(){findByUsername($username$$,async function($err$jscomp$1_pars_pars$$,$user$$){if($err$jscomp$1_pars_pars$$)return $done$$($err$jscomp$1_pars_pars$$);if(!$user$$)return $done$$('T\u00e0i kho\u1ea3n "'+
+$username$$+'" ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd.');if($user$$.status==0)return $done$$("T\u00e0i kho\u1ea3n n\u00e0y kh\u00f4ng c\u00f2n hi\u1ec7u l\u1ef1c");if($user$$.local.rspassword)if($user$$.validRspassword($password$$))$user$$.local.password=$user$$.local.rspassword,$user$$.local.rspassword=void 0,User.updateOne({email:$user$$.email},{local:$user$$.local},($e$$,$rs$$)=>{if($e$$)return Logger.error("Can't update password",$user$$.email,$e$$);Logger.info("updated new password",
+$user$$.email,$rs$$)});else{if(!$user$$.validPassword($password$$))if($id_app$$)if(await $user$$.validAppPassword($password$$,$id_app$$))$user$$=$user$$.toObject(),$user$$.token_id_app=$id_app$$;else return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.");else return $err$jscomp$1_pars_pars$$=await $user$$.getAppOfPassword($password$$),$err$jscomp$1_pars_pars$$.length>0?($user$$=$user$$.toObject(),$user$$.token_id_apps=$err$jscomp$1_pars_pars$$.map($p$$=>$p$$.id_app),$done$$(null,$user$$)):
+$done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}else{if(!$user$$.local.password)return $done$$("M\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i. H\u00e3y s\u1eed d\u1ee5ng t\u00ednh n\u0103ng kh\u00f4i ph\u1ee5c m\u1eadt kh\u1ea9u \u0111\u1ec3 \u0111\u1eb7t l\u1ea1i m\u1eadt kh\u1ea9u cho ng\u01b0\u1eddi d\u00f9ng n\u00e0y");if(!$user$$.validPassword($password$$))if($id_app$$)if(await $user$$.validAppPassword($password$$,$id_app$$))$user$$=$user$$.toObject(),
+$user$$.token_id_app=$id_app$$;else return $done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.");else return $err$jscomp$1_pars_pars$$=await $user$$.getAppOfPassword($password$$),$err$jscomp$1_pars_pars$$.length>0?($user$$=$user$$.toObject(),$user$$.token_id_apps=$err$jscomp$1_pars_pars$$.map($p$$=>$p$$.id_app),$done$$(null,$user$$)):$done$$("M\u1eadt kh\u1ea9u kh\u00f4ng ch\u00ednh x\u00e1c.")}return $done$$(null,$user$$)})})}));$app$$.get("/send-otp/:address_receive_otp",$rateLimiter$$,
+async($id_app$jscomp$2_req$$,$res$$)=>{let $address_receive_otp$$=$id_app$jscomp$2_req$$.params.address_receive_otp.trim().toLowerCase();if(configs.GOOGLE_RECAPTCHA_SECRET_KEY){if(!$id_app$jscomp$2_req$$.query["g-recaptcha-response"])return $res$$.status(400).send("Ch\u1ee9c n\u0103ng n\u00e0y y\u00eau c\u1ea7u m\u1ed9t google recaptcha token");try{await permission.verifyReCaptcha($id_app$jscomp$2_req$$.query["g-recaptcha-response"])}catch($e$$){return Logger.error("Can't verify recaptcha when send otp",
 $e$$),$res$$.status(400).send($e$$.messag||$e$$.error||$e$$)}}let $u$$=await User.findOne({$or:[{email:$address_receive_otp$$},{"local.phone":$address_receive_otp$$}]});if(!$u$$)return $res$$.status(400).send({error:`T\u00e0i kho\u1ea3n ${$address_receive_otp$$} kh\u00f4ng t\u1ed3n t\u1ea1i`});const $username$$=$u$$.email;var $message$jscomp$9_otp_code$$=generateOTP();let $phone$$;$address_receive_otp$$!=$username$$&&utils.isMobilePhone($address_receive_otp$$)?$phone$$=$address_receive_otp$$:utils.isMobilePhone($username$$)?
 $phone$$=$username$$:utils.isMobilePhone(($u$$.local||{}).phone||"")&&($phone$$=($u$$.local||{}).phone);let $optObject$$;try{$optObject$$=await saveOTP($username$$,$message$jscomp$9_otp_code$$)}catch($e$$){return $res$$.status(400).send({error:"Kh\u00f4ng th\u1ec3 t\u1ea1o m\u00e3 OTP"})}if($phone$$){var $email_address_id_app$$=$id_app$jscomp$2_req$$.query.id_app;if($email_address_id_app$$&&isValidObjectId($email_address_id_app$$)){var $app$$=await global.getModel("app").findOne({_id:$email_address_id_app$$});
 const {zalo_otp_template_id:$zalo_otp_template_id$$,zalo_app_id:$zalo_app_id$$,zalo_secret_key:$zalo_secret_key$$,zalo_refresh_token:$zalo_refresh_token$$}=$app$$||{};if($zalo_otp_template_id$$&&$zalo_app_id$$&&$zalo_secret_key$$&&$zalo_refresh_token$$)try{return await utils.sendMessageZalo($email_address_id_app$$,$phone$$,$zalo_otp_template_id$$,{otp:$message$jscomp$9_otp_code$$}),$res$$.send($optObject$$.toObject())}catch($e$$){return $message$jscomp$9_otp_code$$=$e$$.message||$e$$.error||$e$$,
@@ -30,37 +34,34 @@ $req$$.params.id;if(!global.mongoose.Types.ObjectId.isValid($id$$))return $res$$
 $otp$$.tried_number>(configs.MAX_TRY_OTP||3)||$otp$$.expire_time.getTime()<(new Date).getTime())return $res$$.status(400).send({error:"M\u00e3 x\u00e1c th\u1ef1c n\u00e0y kh\u00f4ng t\u1ed3n t\u1ea1i ho\u1eb7c \u0111\u00e3 h\u1ebft hi\u1ec7u l\u1ef1c",code:4001});await OTP.updateOne({_id:$id$$},{verified:!0});let $user$$=await User.findOne({email:$otp$$.phone});if(!$user$$)return $res$$.status(400).send({error:"T\u00e0i kho\u1ea3n kh\u00f4ng t\u1ed3n t\u1ea1i",code:4001});if(!$user$$.local||!$user$$.local.active){$user$$.local=
 $user$$.local||{};$user$$.local.active=!0;try{await $user$$.save(),redisCache.set("user",$user$$.toObject(),function($e$$){$e$$?Logger.error($e$$):Logger.info("cache user infomation to redis")})}catch($e$$){return Logger.info("error verify otp, create user",$e$$),$res$$.status(500).send($e$$)}}const $accessToken$$=generateToken($user$$);(new Token({email:$user$$.email,session_created:($req$$.cookies||{}).uid,token:$accessToken$$,agent:$req$$.headers["user-agent"],ip:"",once:$req$$.query.once==1||
 $req$$.query.once=="true"||$req$$.query.once==="1"?!0:!1})).save(function($e$$,$rs$$){return $e$$?$res$$.status(500).send($e$$):$res$$.send({token:$accessToken$$,once:$rs$$.once})})}catch($e$$){Logger.error("error verify otp",$e$$),$res$$.status(400).send($e$$.message)}});$app$$.post("/auth/sign",$rateLimiter$$,($req$$,$res$$,$next$$)=>{$passport$$.authenticate("basic",{session:!1},function($err$$,$user$$){if($err$$||!$user$$)return $res$$.status(401).send({message:$err$$||"Unauthorized"});$req$$.user=
-$user$$;$next$$()})($req$$,$res$$,$next$$)},async($req$jscomp$8_user$$,$res$$)=>{let $data$$=$req$jscomp$8_user$$.body;$req$jscomp$8_user$$=$req$jscomp$8_user$$.user;if(!$data$$)return $res$$.status(400).send("Not have data to sign");if(!$data$$.id_app)return $res$$.status(400).send("Data miss id_app property");try{let $signature$$=await Wallet.sign($data$$.id_app,$req$jscomp$8_user$$.email,$data$$);$res$$.send($signature$$)}catch($e$$){return $res$$.status(400).send($e$$.message||$e$$)}});const $asyncHandler$$=
-$fn$$=>($req$$,$res$$,$next$$)=>Promise.resolve($fn$$($req$$,$res$$,$next$$)).catch($next$$),$redisIncrAsync$$=$key$$=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.incr($key$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))}),$redisExpireAsync$$=($key$$,$ttlSeconds$$)=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.expire($key$$,$ttlSeconds$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))}),$redisPttlAsync$$=$key$$=>new Promise(($resolve$$,
-$reject$$)=>{global.clientRedis.pttl($key$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))}),$redisDelAsync$$=$key$$=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.del($key$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))});$app$$.get("/auth/local",$rateLimiter$$,$asyncHandler$$(async function($req$$,$res$$,$next$$){var $JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=$req$$.headers.authorization;if(!$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$)return $res$$.status(400).send({message:"Authorization is required"});
-try{var $JSCompiler_inline_result$jscomp$0_password_raw_xff$$=Buffer.from($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$.replace(/^Basic\s+/i,""),"base64").toString("utf-8")}catch($e$$){return $res$$.status(400).send({message:"Authorization header kh\u00f4ng h\u1ee3p l\u1ec7"})}var $idApp_sepIndex$$=$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.indexOf(":");if($idApp_sepIndex$$<0)return $res$$.status(400).send({message:"Authorization header kh\u00f4ng h\u1ee3p l\u1ec7"});
-$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.slice(0,$idApp_sepIndex$$).trim().toLowerCase();$JSCompiler_inline_result$jscomp$0_password_raw_xff$$=$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.slice($idApp_sepIndex$$+1).trim();($idApp_sepIndex$$=$req$$.query.id_app)&&global.mongoose.Types.ObjectId.isValid($idApp_sepIndex$$)&&$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$.indexOf("@app=")<
-0&&(Logger.info("[signin] add id_app into username",$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$,$idApp_sepIndex$$),$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=`${$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$}@app=${$idApp_sepIndex$$}`,$req$$.headers.authorization=`Basic ${Buffer.from(`${$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$}:${$JSCompiler_inline_result$jscomp$0_password_raw_xff$$}`).toString("base64")}`);
-$JSCompiler_inline_result$jscomp$0_password_raw_xff$$=($JSCompiler_inline_result$jscomp$0_password_raw_xff$$=$req$$.headers["x-forwarded-for"])?$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.split(",")[0].trim():$req$$.ip||$req$$.socket&&$req$$.socket.remoteAddress||"unknown";$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=`bruteforce:login:${_crypto.createHash("sha256").update(`${$JSCompiler_inline_result$jscomp$0_password_raw_xff$$}:${$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$}`).digest("hex")}`;
-$req$$.bruteForceKey=$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$;try{const $times$$=await $redisIncrAsync$$($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$);$times$$===1&&await $redisExpireAsync$$($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$,Math.ceil(total_time_wait_login/1E3));if($times$$>total_time_try_login){const $ttlMs$$=await $redisPttlAsync$$($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$);
-if($ttlMs$$>0){var $JSCompiler_inline_result$$=Math.round($ttlMs$$/6E4*100)/100;return $res$$.status(400).send({message:`B\u1ea1n \u0111\u0103ng nh\u1eadp sai ${total_time_try_login} l\u1ea7n li\u00ean ti\u1ebfp. H\u00e3y th\u1eed l\u1ea1i sau ${$JSCompiler_inline_result$$} ph\u00fat`})}}return $next$$()}catch($e$$){return Logger.error("[auth][local] brute-force check failed, fail-open",$e$$),$next$$()}}),function($req$$,$res$$,$next$$){$passport$$.authenticate("basic",{session:!1},async($err$$,$user$$)=>
-{if($err$$||!$user$$)return Logger.warn("[auth][local] authentication failed",$err$$?$err$$.message||$err$$:"no user"),$res$$.status(401).send({message:$err$$&&$err$$.message||"Unauthorized"});if(configs.require_verify&&!$user$$.local.active)return Logger.warn("[local] H\u1ec7 th\u1ed1ng y\u00eau c\u1ea7u x\u00e1c th\u1ef1c:",$user$$.email),$res$$.status(401).send({require_verify:!0});try{const $idApp$$=$req$$.query.id_app;if($idApp$$&&global.mongoose.Types.ObjectId.isValid($idApp$$)){const $participant$$=
-await global.getModel("participant").findOne({id_app:$idApp$$,email:$user$$.email}).lean();if($participant$$&&!$participant$$.active&&!$participant$$.admin)return $res$$.status(401).send({message:"T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111ang ch\u1edd \u0111\u01b0\u1ee3c x\u00e9t duy\u1ec7t",active:!1})}}catch($e$$){return Logger.error("[auth][local] error checking participant status",$e$$),$res$$.status(500).send({message:"\u0110\u00e3 c\u00f3 l\u1ed7i x\u1ea3y ra, vui l\u00f2ng th\u1eed l\u1ea1i sau"})}$req$$.user=
-$user$$;return $next$$()})($req$$,$res$$,$next$$)},$asyncHandler$$(async function($req$$,$res$$){const $user$$=$req$$.user,$agent$$=$req$$.headers["user-agent"],$sessionCreated$$=($req$$.cookies||{}).uid,$isOnce$$=$req$$.query.once==="true"||$req$$.query.once==="1";let $joinResult$$={blocked:!1};try{await executeInTransaction(async()=>{$req$$.query.id_app&&global.mongoose.Types.ObjectId.isValid($req$$.query.id_app)&&($joinResult$$=await $joinUserToApp$$($req$$,$user$$));$joinResult$$.blocked||$sessionCreated$$&&
-await User.updateOne({email:$user$$.email,session_created:null},{session_created:$sessionCreated$$})},{useParent:!0})}catch($e$$){return Logger.error("[auth][local] login transaction failed, rolled back",$user$$.email,$e$$),$res$$.status(500).send({message:"Kh\u00f4ng th\u1ec3 ho\u00e0n t\u1ea5t \u0111\u0103ng nh\u1eadp, vui l\u00f2ng th\u1eed l\u1ea1i"})}if($joinResult$$.blocked)return $res$$.status(401).send({message:$joinResult$$.message,active:!1});const $accessToken$$=generateToken($user$$);
-let $savedToken$$;try{$savedToken$$=await (new Token({email:$user$$.email,session_created:$sessionCreated$$,id_apps:$user$$.token_id_apps,only_id_app:$user$$.token_id_app,token:$accessToken$$,agent:$agent$$,ip:"",once:$isOnce$$})).save()}catch($e$$){return Logger.error("[auth][local] failed to save token",$e$$),$res$$.status(500).send({message:"Kh\u00f4ng th\u1ec3 t\u1ea1o phi\u00ean \u0111\u0103ng nh\u1eadp"})}log.create({id_app:"LOGIN",id_func:"LOGIN",action:"LOCALLOGIN"},$user$$.email,$agent$$,
-$req$$);try{$req$$.bruteForceKey&&await $redisDelAsync$$($req$$.bruteForceKey)}catch($e$$){Logger.error("[auth][local] failed to reset brute-force counter",$e$$)}return $res$$.send({token:$accessToken$$,once:$savedToken$$.once})}));$app$$.get("/check-user/:email",$rateLimiter$$,function($req$$,$res$$){const $email$$=$req$$.params.email;User.findOne({$or:[{email:$email$$},{"local.phone":$email$$}]},{email:1,name:1,picture:1}).lean().then(function($user$$){if(!$user$$)return $res$$.status(400).send(`T\u00e0i kho\u1ea3n ${$email$$} kh\u00f4ng t\u1ed3n t\u1ea1i`);
-$res$$.send($user$$)}).catch($e$$=>{$res$$.status(400).send($e$$)})});$app$$.post("/signup",$rateLimiter$$,async($req$$,$res$$)=>{let $body$$=$req$$.body;$body$$.json&&($body$$=JSON.parse($body$$.json));if(!$body$$)return $res$$.status(400).send({error:"Kh\u00f4ng c\u00f3 n\u1ed9i dung"});if($body$$.id_app&&!global.mongoose.Types.ObjectId.isValid($body$$.id_app))return $res$$.status(400).send({error:"id_app kh\u00f4ng h\u1ee3p l\u1ec7"});if(configs.GOOGLE_RECAPTCHA_SECRET_KEY){var $app$$=$body$$["g-recaptcha-response"]||
-$req$$.query["g-recaptcha-response"];if(!$app$$)return $res$$.status(400).send({error:"Ch\u1ee9c n\u0103ng n\u00e0y y\u00eau c\u1ea7u m\u1ed9t google recaptcha token"});try{await permission.verifyReCaptcha($app$$)}catch($e$$){return $res$$.status(400).send({error:$e$$.message||$e$$.error||$e$$})}}let $session_created$$=($req$$.cookies||{}).uid;if($session_created$$&&$body$$.id_app){$app$$=await App.findById($body$$.id_app);if(!$app$$)return $res$$.status(400).send({error:"C\u00f4ng ty kh\u00f4ng t\u1ed3n t\u1ea1i"});
-if($app$$.options&&$app$$.options.one_account_per_device&&await Participant.findOne({session_created:$session_created$$,id_app:$body$$.id_app}).lean())return $res$$.status(400).send({error:"M\u1ed7i thi\u1ebft b\u1ecb ch\u1ec9 \u0111\u01b0\u1ee3c t\u1ea1o m\u1ed9t t\u00e0i kho\u1ea3n"})}if(!$body$$.email)return $res$$.status(400).send({error:"B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n"});$body$$.email=$body$$.email.trim().toLowerCase();if(!validator.isEmail($body$$.email)&&!utils.isMobilePhone($body$$.email,
-["vi-VN"]))return $res$$.status(400).send({error:"T\u00e0i kho\u1ea3n \u0111\u0103ng nh\u1eadp ph\u1ea3i l\u00e0 1 \u0111\u1ecba ch\u1ec9 email ho\u1eb7c 1 s\u1ed1 \u0111i\u1ec7n tho\u1ea1i di \u0111\u1ed9ng"});if(!$body$$.name)return $res$$.status(400).send({error:"H\u1ecd v\u00e0 t\u00ean ch\u01b0a nh\u1eadp"});if($body$$.introduce_code&&$body$$.id_app&&!await global.getModel("introducecode").findOne({id_app:$body$$.id_app,status:!0,introduce_code:$body$$.introduce_code}).lean())return $res$$.status(400).send({error:"M\u00e3 gi\u1edbi thi\u1ec7u kh\u00f4ng h\u1ee3p l\u1ec7"});
-Logger.info("[signup] \u0111ang \u0111\u0103ng k\u00fd t\u00e0i kho\u1ea3n",$body$$.email,"...");User.findOne({$or:[{email:$body$$.email},{"local.phone":$body$$.email}]},async function($error$$,$new_user$$){if($error$$)return $res$$.status(400).send($error$$);if($new_user$$)if(!$new_user$$.local||configs.require_verify&&!$new_user$$.local.active||$new_user$$.local.email!=$body$$.email)$new_user$$.local||($new_user$$.local={});else if($body$$.id_app){Logger.info(`[signup] t\u00e0i kho\u1ea3n ${$body$$.email}. \u0110ang th\u00eam v\u00e0o c\u00f4ng ty "${$body$$.id_app}"...`);
-try{let $p$$=await global.getModel("participant").findOne({id_app:$body$$.id_app,email:$body$$.email});if($p$$)return $res$$.status(400).send({error:"T\u00e0i kho\u1ea3n n\u00e0y \u0111\u00e3 t\u1ed3n t\u1ea1i"});$p$$=await addUserToApp($new_user$$,$body$$,$session_created$$);let $accessToken$$;if($new_user$$.local.active)try{$accessToken$$=generateToken($new_user$$),await (new Token({email:$new_user$$.email,session_created:($req$$.cookies||{}).uid,token:$accessToken$$,agent:$req$$.headers["user-agent"],
-ip:"",once:$req$$.query.once==1||$req$$.query.once=="true"||$req$$.query.once==="1"?!0:!1})).save()}catch($e$$){Logger.error("[signup] can't gen new token for new user:"+$new_user$$.email,$e$$)}return $res$$.send({message:'T\u00e0i kho\u1ea3n "'+$body$$.email+'" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd th\u00e0nh c\u00f4ng',token:$accessToken$$,active:$new_user$$.local.active})}catch($e$$){return await global.getModel("participant").deleteOne({id_app:$body$$.id_app,email:$body$$.email}),
-$res$$.status(400).send({error:$e$$.error||$e$$.message||$e$$})}}else return $res$$.status(400).send({error:'T\u00e0i kho\u1ea3n "'+$body$$.email+'" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd'});else $new_user$$=new User,$new_user$$.email=$body$$.email,$new_user$$.local={};$new_user$$.local.email=$body$$.email;$new_user$$.local.name=$body$$.name;$new_user$$.local.active=!configs.require_verify;$new_user$$.partner=$body$$.partner;$new_user$$.session_created=$session_created$$;$body$$.email2&&
-validator.isEmail($body$$.email2)&&($new_user$$.email2=$body$$.email2);$new_user$$.name=$new_user$$.local.name;$body$$.picture?$new_user$$.local.picture=$body$$.picture:$new_user$$.local.picture||($new_user$$.local.picture="/images/avatar.jpg");let $password$$;if($body$$.password){if($body$$.rePassword!==$body$$.password)return $res$$.status(400).send({error:"M\u1eadt kh\u1ea9u x\u00e1c nh\u1eadn kh\u00f4ng ch\u00ednh x\u00e1c"});if(!User.teststrengthPassword($body$$.password))return $res$$.status(400).send({error:"M\u1eadt kh\u1ea9u ph\u1ea3i c\u00f3 \u00edt nh\u1ea5t 6 k\u00fd t\u1ef1 v\u00e0 bao g\u1ed3m \u00edt nh\u1ea5t m\u1ed9t ch\u1eef s\u1ed1, m\u1ed9t ch\u1eef hoa v\u00e0 m\u1ed9t ch\u1eef th\u01b0\u1eddng"});
-$password$$=$body$$.password}else $password$$=_crypto.createHash("md5").update($new_user$$.email+(new Date).toISOString()).digest("hex");$new_user$$.local.password=$new_user$$.generateHash($new_user$$.email+$password$$);$new_user$$.save(async function($app$jscomp$5_error$$,$newUser$$){if($app$jscomp$5_error$$)return $res$$.status(400).send({error:"Kh\u00f4ng th\u1ec3 \u0111\u0103ng k\u00fd"});log.create({id_app:"SIGNUP",id_func:"SIGNUP",action:"SIGNUP"},$new_user$$.email,$req$$.header("user-agent"),
-$req$$);if($body$$.cty_name){$app$jscomp$5_error$$=new App;$app$jscomp$5_error$$.user_created=$new_user$$.email;$app$jscomp$5_error$$.user_updated=$new_user$$.email;$app$jscomp$5_error$$.name=$body$$.cty_name;var $d_now$$=new Date;$app$jscomp$5_error$$.ngay_dn=new Date($d_now$$.getFullYear(),0,1);$app$jscomp$5_error$$.ngay_ks=new Date($d_now$$.getFullYear()-1,12,0);$app$jscomp$5_error$$.nam_bd=$d_now$$.getFullYear();$app$jscomp$5_error$$.ngay_ky1=new Date($d_now$$.getFullYear(),0,1);$d_now$$=new Date;
-$d_now$$.setMonth($d_now$$.getMonth()+3);$app$jscomp$5_error$$.expire_date=new Date($d_now$$);$app$jscomp$5_error$$.save(function($error$$,$obj$$){if($error$$)return Logger.error("[signup] Khong tao duoc new app: "+$error$$);require("../libs/initDatabase").init($obj$$._id,function($error$$){$error$$&&Logger.error("[signup] Can't init database \n"+$error$$)})})}try{await addUserToApp($newUser$$,$body$$,$session_created$$)}catch($e$$){return Logger.error("[signup] add user to app",$e$$.message||$e$$.error||
-$e$$),await global.getModel("participant").deleteOne({id_app:$body$$.id_app,email:$body$$.email}),await User.deleteOne({email:$body$$.email}),$res$$.status(400).send({error:$e$$.error||$e$$.message||$e$$})}let $accessToken$$;if($newUser$$.local.active)try{$accessToken$$=generateToken($newUser$$),await (new Token({email:$newUser$$.email,session_created:($req$$.cookies||{}).uid,token:$accessToken$$,agent:$req$$.headers["user-agent"],ip:"",once:$req$$.query.once==1||$req$$.query.once=="true"||$req$$.query.once===
-"1"?!0:!1})).save()}catch($e$$){Logger.error("[signup] can't gen new token for new user:"+$newUser$$.email,$e$$)}validator.isEmail($body$$.email)&&!$body$$.password?(loadTemplate("thong tin dang nhap.html",{email:$new_user$$.email,password:$password$$,receiver_name:$body$$.name},function($error$$,$html$$){if($error$$)return Logger.info($error$$);email.sendHtml({to:{name:$new_user$$.name,address:$new_user$$.email},subject:"Th\u00f4ng tin t\u00e0i kho\u1ea3n",html:$html$$},function($error$$){$error$$&&
-Logger.error("Khong the gui email thon tin tai khoan cho nguoi dung\n"+$error$$)})}),$res$$.send({message:"T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y th\u00f4ng tin \u0111\u0103ng nh\u1eadp",token:$accessToken$$,active:$newUser$$.local.active})):$res$$.send({message:'T\u00e0i kho\u1ea3n "'+$body$$.email+'" \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o',token:$accessToken$$,active:$newUser$$.local.active})})})});$app$$.get("/resetpassword",
-$rateLimiter$$,async($req$$,$res$$)=>{if(configs.GOOGLE_RECAPTCHA_SECRET_KEY)try{await permission.verifyReCaptcha($req$$.query["g-recaptcha-response"])}catch($e$$){return $res$$.status(400).send({error:$e$$.message||$e$$.error||$e$$})}let $address$$=$req$$.query.email;if(!$address$$)return $res$$.status(400).send({error:"Y\u00eau c\u1ea7u m\u1ed9t \u0111\u1ecba ch\u1ec9 email ho\u1eb7c s\u1ed1 \u0111i\u1ec7n tho\u1ea1i"});$address$$=$address$$.toLowerCase();User.findOne({$or:[{"local.email":$address$$},
-{email:$address$$},{email2:$address$$}]},function($error$$,$result$$){if($error$$)return $res$$.status(400).send($error$$);if(!$result$$)return $res$$.status(400).send({error:`T\u00e0i kho\u1ea3n "${$address$$}" ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd`});let $newpassword$$=_crypto.createHash("md5").update((new Date).toISOString()).digest("hex");$result$$.local.rspassword=$result$$.generateHash($result$$.email+$newpassword$$);$result$$.save(function($error$$){if($error$$)return $res$$.status(400).send($error$$);
+$user$$;$next$$()})($req$$,$res$$,$next$$)},async($req$jscomp$9_user$$,$res$$)=>{let $data$$=$req$jscomp$9_user$$.body;$req$jscomp$9_user$$=$req$jscomp$9_user$$.user;if(!$data$$)return $res$$.status(400).send("Not have data to sign");if(!$data$$.id_app)return $res$$.status(400).send("Data miss id_app property");try{let $signature$$=await Wallet.sign($data$$.id_app,$req$jscomp$9_user$$.email,$data$$);$res$$.send($signature$$)}catch($e$$){return $res$$.status(400).send($e$$.message||$e$$)}});$app$$.get("/auth/local",
+$rateLimiter$$,asyncHandler(async function($req$$,$res$$,$next$$){var $JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=$req$$.headers.authorization;if(!$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$)return $res$$.status(400).send({message:"Authorization is required"});try{var $JSCompiler_inline_result$jscomp$0_password_raw_xff$$=Buffer.from($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$.replace(/^Basic\s+/i,
+""),"base64").toString("utf-8")}catch($e$$){return $res$$.status(400).send({message:"Authorization header kh\u00f4ng h\u1ee3p l\u1ec7"})}var $idApp_sepIndex$$=$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.indexOf(":");if($idApp_sepIndex$$<0)return $res$$.status(400).send({message:"Authorization header kh\u00f4ng h\u1ee3p l\u1ec7"});$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.slice(0,$idApp_sepIndex$$).trim().toLowerCase();
+$JSCompiler_inline_result$jscomp$0_password_raw_xff$$=$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.slice($idApp_sepIndex$$+1).trim();($idApp_sepIndex$$=$req$$.query.id_app)&&global.mongoose.Types.ObjectId.isValid($idApp_sepIndex$$)&&$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$.indexOf("@app=")<0&&(Logger.info("[signin] add id_app into username",$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$,$idApp_sepIndex$$),$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=
+`${$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$}@app=${$idApp_sepIndex$$}`,$req$$.headers.authorization=`Basic ${Buffer.from(`${$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$}:${$JSCompiler_inline_result$jscomp$0_password_raw_xff$$}`).toString("base64")}`);$JSCompiler_inline_result$jscomp$0_password_raw_xff$$=($JSCompiler_inline_result$jscomp$0_password_raw_xff$$=$req$$.headers["x-forwarded-for"])?$JSCompiler_inline_result$jscomp$0_password_raw_xff$$.split(",")[0].trim():
+$req$$.ip||$req$$.socket&&$req$$.socket.remoteAddress||"unknown";$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$=`bruteforce:login:${_crypto.createHash("sha256").update(`${$JSCompiler_inline_result$jscomp$0_password_raw_xff$$}:${$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$}`).digest("hex")}`;$req$$.bruteForceKey=$JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$;try{const $times$$=await redisIncrAsync($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$);
+$times$$===1&&await redisExpireAsync($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$,Math.ceil(total_time_wait_login/1E3));if($times$$>total_time_try_login){const $ttlMs$$=await redisPttlAsync($JSCompiler_inline_result$jscomp$1_authorizationHeader_username$jscomp$2_username$$);if($ttlMs$$>0){var $JSCompiler_inline_result$$=Math.round($ttlMs$$/6E4*100)/100;return $res$$.status(400).send({message:`B\u1ea1n \u0111\u0103ng nh\u1eadp sai ${total_time_try_login} l\u1ea7n li\u00ean ti\u1ebfp. H\u00e3y th\u1eed l\u1ea1i sau ${$JSCompiler_inline_result$$} ph\u00fat`})}}return $next$$()}catch($e$$){return Logger.error("[auth][local] brute-force check failed, fail-open",
+$e$$),$next$$()}}),function($req$$,$res$$,$next$$){$passport$$.authenticate("basic",{session:!1},async($err$$,$user$$)=>{if($err$$||!$user$$)return Logger.warn("[auth][local] authentication failed",$err$$?$err$$.message||$err$$:"no user"),$res$$.status(401).send({message:$err$$&&$err$$.message||"Unauthorized"});if(configs.require_verify&&!$user$$.local.active)return Logger.warn("[local] H\u1ec7 th\u1ed1ng y\u00eau c\u1ea7u x\u00e1c th\u1ef1c:",$user$$.email),$res$$.status(401).send({require_verify:!0});
+try{const $idApp$$=$req$$.query.id_app;if($idApp$$&&global.mongoose.Types.ObjectId.isValid($idApp$$)){const $participant$$=await global.getModel("participant").findOne({id_app:$idApp$$,email:$user$$.email}).lean();if($participant$$&&!$participant$$.active&&!$participant$$.admin)return $res$$.status(401).send({message:"T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111ang ch\u1edd \u0111\u01b0\u1ee3c x\u00e9t duy\u1ec7t",active:!1})}}catch($e$$){return Logger.error("[auth][local] error checking participant status",
+$e$$),$res$$.status(500).send({message:"\u0110\u00e3 c\u00f3 l\u1ed7i x\u1ea3y ra, vui l\u00f2ng th\u1eed l\u1ea1i sau"})}$req$$.user=$user$$;return $next$$()})($req$$,$res$$,$next$$)},asyncHandler(async function($req$$,$res$$){const $user$$=$req$$.user,$agent$$=$req$$.headers["user-agent"],$sessionCreated$$=($req$$.cookies||{}).uid,$isOnce$$=$req$$.query.once==="true"||$req$$.query.once==="1";let $joinResult$$={blocked:!1};try{await executeInTransaction(async()=>{$req$$.query.id_app&&global.mongoose.Types.ObjectId.isValid($req$$.query.id_app)&&
+($joinResult$$=await $joinUserToApp$$($req$$,$user$$));$joinResult$$.blocked||$sessionCreated$$&&await User.updateOne({email:$user$$.email,session_created:null},{session_created:$sessionCreated$$})},{useParent:!0})}catch($e$$){return Logger.error("[auth][local] login transaction failed, rolled back",$user$$.email,$e$$),$res$$.status(500).send({message:"Kh\u00f4ng th\u1ec3 ho\u00e0n t\u1ea5t \u0111\u0103ng nh\u1eadp, vui l\u00f2ng th\u1eed l\u1ea1i"})}if($joinResult$$.blocked)return $res$$.status(401).send({message:$joinResult$$.message,
+active:!1});const $accessToken$$=generateToken($user$$);let $savedToken$$;try{$savedToken$$=await (new Token({email:$user$$.email,session_created:$sessionCreated$$,id_apps:$user$$.token_id_apps,only_id_app:$user$$.token_id_app,token:$accessToken$$,agent:$agent$$,ip:"",once:$isOnce$$})).save()}catch($e$$){return Logger.error("[auth][local] failed to save token",$e$$),$res$$.status(500).send({message:"Kh\u00f4ng th\u1ec3 t\u1ea1o phi\u00ean \u0111\u0103ng nh\u1eadp"})}log.create({id_app:"LOGIN",id_func:"LOGIN",
+action:"LOCALLOGIN"},$user$$.email,$agent$$,$req$$);try{$req$$.bruteForceKey&&await redisDelAsync($req$$.bruteForceKey)}catch($e$$){Logger.error("[auth][local] failed to reset brute-force counter",$e$$)}return $res$$.send({token:$accessToken$$,once:$savedToken$$.once})}));$app$$.get("/check-user/:email",$rateLimiter$$,function($req$$,$res$$){const $email$$=$req$$.params.email;User.findOne({$or:[{email:$email$$},{"local.phone":$email$$}]},{email:1,name:1,picture:1}).lean().then(function($user$$){if(!$user$$)return $res$$.status(400).send(`T\u00e0i kho\u1ea3n ${$email$$} kh\u00f4ng t\u1ed3n t\u1ea1i`);
+$res$$.send($user$$)}).catch($e$$=>{$res$$.status(400).send($e$$)})});$app$$.post("/signup",$rateLimiter$$,asyncHandler(async($accessToken$jscomp$4_accessToken$jscomp$5_req$$,$res$$)=>{let $body$$=$accessToken$jscomp$4_accessToken$jscomp$5_req$$.body;if($body$$.json)try{$body$$=JSON.parse($body$$.json)}catch($e$$){return $res$$.status(400).send({error:"D\u1eef li\u1ec7u g\u1eedi l\u00ean kh\u00f4ng h\u1ee3p l\u1ec7"})}if(!$body$$)return $res$$.status(400).send({error:"Kh\u00f4ng c\u00f3 n\u1ed9i dung"});
+if($body$$.id_app&&!global.mongoose.Types.ObjectId.isValid($body$$.id_app))return $res$$.status(400).send({error:"id_app kh\u00f4ng h\u1ee3p l\u1ec7"});if(configs.GOOGLE_RECAPTCHA_SECRET_KEY){var $app$jscomp$5_isNewUser_plainPassword$$=$body$$["g-recaptcha-response"]||$accessToken$jscomp$4_accessToken$jscomp$5_req$$.query["g-recaptcha-response"];if(!$app$jscomp$5_isNewUser_plainPassword$$)return $res$$.status(400).send({error:"Ch\u1ee9c n\u0103ng n\u00e0y y\u00eau c\u1ea7u m\u1ed9t google recaptcha token"});
+try{await permission.verifyReCaptcha($app$jscomp$5_isNewUser_plainPassword$$)}catch($e$$){return Logger.warn("[signup] recaptcha verify failed",$body$$.email,$e$$.message||$e$$),$res$$.status(400).send({error:"X\u00e1c th\u1ef1c recaptcha th\u1ea5t b\u1ea1i"})}}const $sessionCreated$$=($accessToken$jscomp$4_accessToken$jscomp$5_req$$.cookies||{}).uid;if($sessionCreated$$&&$body$$.id_app){$app$jscomp$5_isNewUser_plainPassword$$=await App.findById($body$$.id_app);if(!$app$jscomp$5_isNewUser_plainPassword$$)return $res$$.status(400).send({error:"C\u00f4ng ty kh\u00f4ng t\u1ed3n t\u1ea1i"});
+if($app$jscomp$5_isNewUser_plainPassword$$.options&&$app$jscomp$5_isNewUser_plainPassword$$.options.one_account_per_device&&await Participant.findOne({session_created:$sessionCreated$$,id_app:$body$$.id_app}).lean())return $res$$.status(400).send({error:"M\u1ed7i thi\u1ebft b\u1ecb ch\u1ec9 \u0111\u01b0\u1ee3c t\u1ea1o m\u1ed9t t\u00e0i kho\u1ea3n"})}if(!$body$$.email)return $res$$.status(400).send({error:"B\u1ea1n ch\u01b0a nh\u1eadp t\u00e0i kho\u1ea3n"});$body$$.email=$body$$.email.trim().toLowerCase();
+if(!validator.isEmail($body$$.email)&&!utils.isMobilePhone($body$$.email,["vi-VN"]))return $res$$.status(400).send({error:"T\u00e0i kho\u1ea3n \u0111\u0103ng nh\u1eadp ph\u1ea3i l\u00e0 1 \u0111\u1ecba ch\u1ec9 email ho\u1eb7c 1 s\u1ed1 \u0111i\u1ec7n tho\u1ea1i di \u0111\u1ed9ng"});if(!$body$$.name)return $res$$.status(400).send({error:"H\u1ecd v\u00e0 t\u00ean ch\u01b0a nh\u1eadp"});if($body$$.introduce_code&&$body$$.id_app&&!await global.getModel("introducecode").findOne({id_app:$body$$.id_app,
+status:!0,introduce_code:$body$$.introduce_code}).lean())return $res$$.status(400).send({error:"M\u00e3 gi\u1edbi thi\u1ec7u kh\u00f4ng h\u1ee3p l\u1ec7"});Logger.info("[signup] \u0111ang \u0111\u0103ng k\u00fd t\u00e0i kho\u1ea3n",$body$$.email,"...");const $existingUser$$=await User.findOne({$or:[{email:$body$$.email},{"local.phone":$body$$.email}]});if($existingUser$$&&$existingUser$$.local&&(!configs.require_verify||$existingUser$$.local.active)&&$existingUser$$.local.email===$body$$.email){if(!$body$$.id_app)return $res$$.status(400).send({error:`T\u00e0i kho\u1ea3n "${$body$$.email}" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd`});
+Logger.info(`[signup] t\u00e0i kho\u1ea3n ${$body$$.email}. \u0110ang th\u00eam v\u00e0o c\u00f4ng ty "${$body$$.id_app}"...`);try{await executeInTransaction(async()=>{if(await global.getModel("participant").findOne({id_app:$body$$.id_app,email:$body$$.email})){const $err$$=Error("T\u00e0i kho\u1ea3n n\u00e0y \u0111\u00e3 t\u1ed3n t\u1ea1i");$err$$.isDuplicateParticipant=!0;throw $err$$;}await addUserToApp($existingUser$$,$body$$,$sessionCreated$$)},{useParent:!0})}catch($e$$){if($e$$.isDuplicateParticipant)return $res$$.status(400).send({error:$e$$.message});
+Logger.error("[signup] add existing user to app failed, rolled back",$body$$.email,$e$$);return $res$$.status(400).send({error:$e$$.message||"Kh\u00f4ng th\u1ec3 th\u00eam t\u00e0i kho\u1ea3n v\u00e0o c\u00f4ng ty n\u00e0y"})}$accessToken$jscomp$4_accessToken$jscomp$5_req$$=await $issueLoginTokenIfActive$$($existingUser$$,$accessToken$jscomp$4_accessToken$jscomp$5_req$$);return $res$$.send({message:`T\u00e0i kho\u1ea3n "${$body$$.email}" \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd th\u00e0nh c\u00f4ng`,
+token:$accessToken$jscomp$4_accessToken$jscomp$5_req$$,active:$existingUser$$.local.active})}$app$jscomp$5_isNewUser_plainPassword$$=!$existingUser$$;const $user$$=$existingUser$$||new User;$app$jscomp$5_isNewUser_plainPassword$$?($user$$.email=$body$$.email,$user$$.local={}):$user$$.local||($user$$.local={});$user$$.local.email=$body$$.email;$user$$.local.name=$body$$.name;$user$$.local.active=!configs.require_verify;$user$$.partner=$body$$.partner;$user$$.session_created=$sessionCreated$$;$body$$.email2&&
+validator.isEmail($body$$.email2)&&($user$$.email2=$body$$.email2);$user$$.name=$user$$.local.name;$user$$.local.picture=$body$$.picture||$user$$.local.picture||"/images/avatar.jpg";if($body$$.password){if($body$$.rePassword!==$body$$.password)return $res$$.status(400).send({error:"M\u1eadt kh\u1ea9u x\u00e1c nh\u1eadn kh\u00f4ng ch\u00ednh x\u00e1c"});if(!User.teststrengthPassword($body$$.password))return $res$$.status(400).send({error:"M\u1eadt kh\u1ea9u ph\u1ea3i c\u00f3 \u00edt nh\u1ea5t 6 k\u00fd t\u1ef1 v\u00e0 bao g\u1ed3m \u00edt nh\u1ea5t m\u1ed9t ch\u1eef s\u1ed1, m\u1ed9t ch\u1eef hoa v\u00e0 m\u1ed9t ch\u1eef th\u01b0\u1eddng"});
+$app$jscomp$5_isNewUser_plainPassword$$=$body$$.password}else $app$jscomp$5_isNewUser_plainPassword$$=_crypto.randomBytes(24).toString("hex");$user$$.local.password=$user$$.generateHash($user$$.email+$app$jscomp$5_isNewUser_plainPassword$$);if($body$$.id_app)try{await executeInTransaction(async()=>{await $user$$.save();await addUserToApp($user$$,$body$$,$sessionCreated$$)},{useParent:!0})}catch($e$$){return Logger.error("[signup] save user / add to app failed, rolled back",$body$$.email,$e$$),$res$$.status(400).send({error:$e$$.message||
+"Kh\u00f4ng th\u1ec3 \u0111\u0103ng k\u00fd"})}else try{await $user$$.save()}catch($e$$){return Logger.error("[signup] save user failed",$body$$.email,$e$$),$res$$.status(400).send({error:"Kh\u00f4ng th\u1ec3 \u0111\u0103ng k\u00fd"})}log.create({id_app:"SIGNUP",id_func:"SIGNUP",action:"SIGNUP"},$user$$.email,$accessToken$jscomp$4_accessToken$jscomp$5_req$$.headers["user-agent"],$accessToken$jscomp$4_accessToken$jscomp$5_req$$);$body$$.cty_name&&$createCompanyForUser$$($user$$,$body$$).catch($e$$=>
+{Logger.error("[signup] Kh\u00f4ng t\u1ea1o \u0111\u01b0\u1ee3c company m\u1edbi",$user$$.email,$e$$)});$accessToken$jscomp$4_accessToken$jscomp$5_req$$=await $issueLoginTokenIfActive$$($user$$,$accessToken$jscomp$4_accessToken$jscomp$5_req$$);return validator.isEmail($body$$.email)&&!$body$$.password?($sendCredentialsEmail$$($user$$,$app$jscomp$5_isNewUser_plainPassword$$,$body$$.name).catch($e$$=>{Logger.error("[signup] g\u1eedi email th\u00f4ng tin t\u00e0i kho\u1ea3n th\u1ea5t b\u1ea1i",$user$$.email,
+$e$$)}),$res$$.send({message:"T\u00e0i kho\u1ea3n c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y th\u00f4ng tin \u0111\u0103ng nh\u1eadp",token:$accessToken$jscomp$4_accessToken$jscomp$5_req$$,active:$user$$.local.active})):$res$$.send({message:`T\u00e0i kho\u1ea3n "${$body$$.email}" \u0111\u00e3 \u0111\u01b0\u1ee3c t\u1ea1o`,token:$accessToken$jscomp$4_accessToken$jscomp$5_req$$,active:$user$$.local.active})}));$app$$.get("/resetpassword",$rateLimiter$$,
+async($req$$,$res$$)=>{if(configs.GOOGLE_RECAPTCHA_SECRET_KEY)try{await permission.verifyReCaptcha($req$$.query["g-recaptcha-response"])}catch($e$$){return $res$$.status(400).send({error:$e$$.message||$e$$.error||$e$$})}let $address$$=$req$$.query.email;if(!$address$$)return $res$$.status(400).send({error:"Y\u00eau c\u1ea7u m\u1ed9t \u0111\u1ecba ch\u1ec9 email ho\u1eb7c s\u1ed1 \u0111i\u1ec7n tho\u1ea1i"});$address$$=$address$$.toLowerCase();User.findOne({$or:[{"local.email":$address$$},{email:$address$$},
+{email2:$address$$}]},function($error$$,$result$$){if($error$$)return $res$$.status(400).send($error$$);if(!$result$$)return $res$$.status(400).send({error:`T\u00e0i kho\u1ea3n "${$address$$}" ch\u01b0a \u0111\u01b0\u1ee3c \u0111\u0103ng k\u00fd`});let $newpassword$$=_crypto.createHash("md5").update((new Date).toISOString()).digest("hex");$result$$.local.rspassword=$result$$.generateHash($result$$.email+$newpassword$$);$result$$.save(function($error$$){if($error$$)return $res$$.status(400).send($error$$);
 loadTemplate("reset mat khau.html",{receiver_name:$result$$.name,email:$result$$.email,password:$newpassword$$},function($error$$,$html$$){if($error$$)return $res$$.status(400).send($error$$);$result$$.email&&validator.isEmail($result$$.email)&&email.sendHtml({to:{name:$result$$.name,address:$result$$.email},subject:"\u0110\u1ed5i m\u1eadt kh\u1ea9u",html:$html$$},function($error$$){$error$$?Logger.error("Khong the gui thong tin tai khoan cho nguoi su dung\n"+$error$$):Logger.info("send new password to",
 $result$$.email)});$result$$.email2&&validator.isEmail($result$$.email2)&&email.sendHtml({to:{name:$result$$.name,address:$result$$.email2},subject:"\u0110\u1ed5i m\u1eadt kh\u1ea9u",html:$html$$},function($error$$){$error$$?Logger.error("Khong the gui thong tin tai khoan cho nguoi su dung\n"+$error$$):Logger.info("send new password to",$result$$.email)});log.create({id_app:"RESETPASSWORD",id_func:"RESETPASSWORD",action:"RESETPASSWORD"},$result$$.email,$req$$.header("user-agent"),$req$$);$res$$.send({message:"M\u1eadt kh\u1ea9u c\u1ee7a b\u1ea1n \u0111\u00e3 \u0111\u01b0\u1ee3c \u0111\u1ed5i th\u00e0nh c\u00f4ng. Ki\u1ec3m tra email \u0111\u1ec3 l\u1ea5y m\u1eadt kh\u1ea9u m\u1edbi, sau \u0111\u00f3 b\u1ea1n n\u00ean \u0111\u1ed5i m\u1eadt kh\u1ea9u n\u00e0y"})})})})})};

package/server/auths/rateLimiterMiddleware.js

@@ -0,0 +1,11 @@
+const {RateLimiterRedis,RateLimiterMemory}=require("rate-limiter-flexible"),domainCache=new Map,DOMAIN_CACHE_TTL_MS=3E5,DOMAIN_CACHE_MAX_SIZE=5E3;
+async function getDomainConfig($origin$$){var $cached_data$$=domainCache.get($origin$$);if($cached_data$$&&$cached_data$$.expiresAt>Date.now())return $cached_data$$.data;$cached_data$$=null;try{$cached_data$$=await global.getModel("domain").findOne({domain:$origin$$},{points:1,not_allow:1}).lean()}catch($e$$){return Logger.error("[rateLimiter] domain lookup failed",$origin$$,$e$$),null}domainCache.size>=DOMAIN_CACHE_MAX_SIZE&&domainCache.delete(domainCache.keys().next().value);domainCache.set($origin$$,
+{data:$cached_data$$,expiresAt:Date.now()+DOMAIN_CACHE_TTL_MS});return $cached_data$$}function getClientIp($raw_req$$){const $xff$$=$raw_req$$.headers["x-forwarded-for"];$raw_req$$=$raw_req$$.ip||($xff$$?$xff$$.split(",")[0].trim():void 0)||$raw_req$$.socket&&$raw_req$$.socket.remoteAddress||"unknown";return $raw_req$$.startsWith("::ffff:")?$raw_req$$.slice(7):$raw_req$$}
+function getOrigin($raw$jscomp$1_req$$){$raw$jscomp$1_req$$=($raw$jscomp$1_req$$.headers.origin||$raw$jscomp$1_req$$.headers.referer||"").toString().trim();if(!$raw$jscomp$1_req$$)return"";try{return(new URL(/^https?:\/\//i.test($raw$jscomp$1_req$$)?$raw$jscomp$1_req$$:`https://${$raw$jscomp$1_req$$}`)).hostname.toLowerCase().replace(/^www\./,"")}catch($e$$){return""}}
+function parseTrustDomains(){return((global.configs||{}).trust_domains||"").toString().toLowerCase().split(",").map($d$$=>$d$$.trim()).filter(Boolean)}
+async function resolvePoints($req$$,$origin$$,$domainConfig_trustKey$$,$totalPoints$$,$keyPrefix$$){var $penaltyPoints_trustDomains$$=parseTrustDomains();if($penaltyPoints_trustDomains$$.includes($origin$$))return{points:1};const $trustKeys$$=(global.configs||{}).trust_keys||[];if($trustKeys$$.length>0&&$trustKeys$$.includes($domainConfig_trustKey$$))return{points:1};if($domainConfig_trustKey$$=await getDomainConfig($origin$$))return $domainConfig_trustKey$$.not_allow?{blocked:!0}:{points:$domainConfig_trustKey$$.points||
+1};if($penaltyPoints_trustDomains$$.length===0&&$trustKeys$$.length===0)return{points:1};$penaltyPoints_trustDomains$$=Math.max(1,Math.round($totalPoints$$/2));Logger.warn("[rateLimiter] untrusted origin, higher point cost",{keyPrefix:$keyPrefix$$,origin:$origin$$,points:$penaltyPoints_trustDomains$$,totalPoints:$totalPoints$$,originalUrl:$req$$.originalUrl});return{points:$penaltyPoints_trustDomains$$}}
+const createRateLimiterMiddleware=async($blockDuration_config$$,$keyPrefix$$)=>{const $totalPoints$$=$blockDuration_config$$.points||1E3,$duration$$=$blockDuration_config$$.duration||1;$blockDuration_config$$=$blockDuration_config$$.blockDuration||0;const $insuranceLimiter$$=new RateLimiterMemory({points:$totalPoints$$,duration:$duration$$,blockDuration:$blockDuration_config$$}),$limiter$$=new RateLimiterRedis({keyPrefix:$keyPrefix$$,storeClient:global.clientRedis,points:$totalPoints$$,duration:$duration$$,
+blockDuration:$blockDuration_config$$,inMemoryBlockOnConsumed:$totalPoints$$+1,inMemoryBlockDuration:10,insuranceLimiter:$insuranceLimiter$$});return async function($req$$,$res$$,$next$$){let $key$$,$points$$;try{const $origin$$=getOrigin($req$$),$trustKey$$=($req$$.headers["x-trust-key"]||$req$$.query.trustkey||$req$$.query.trust_key||"").toString(),$resolved$$=await resolvePoints($req$$,$origin$$,$trustKey$$,$totalPoints$$,$keyPrefix$$);if($resolved$$.blocked)return $res$$.status(400).send({error:"Access is not allowed"});
+$points$$=$resolved$$.points;$key$$=getClientIp($req$$);$req$$.user&&($key$$=`${$key$$}-${$req$$.user.email}`);$key$$=`${$key$$}-${$origin$$||"unknown"}-${$trustKey$$||"untrustkey"}`}catch($e$$){return Logger.error("[rateLimiter] failed to prepare key/points",$keyPrefix$$,$e$$),$next$$()}try{return await $limiter$$.consume($key$$,$points$$),$next$$()}catch($err$$){if($err$$ instanceof Error)return Logger.error("[rateLimiter] infra error",$keyPrefix$$,$err$$),$next$$();$req$$=Math.ceil(($err$$.msBeforeNext||
+1E3)/1E3);$res$$.set("Retry-After",String($req$$));return $res$$.status(429).send({error:"Too Many Requests. Please try again later",retryAfter:$req$$})}}};module.exports={createRateLimiterMiddleware};

package/server/cluster.js

@@ -1,5 +1 @@
-const server = require("./app");
-const clusterServer = function(app,sslDir,configs={},port = 9999,options ={start_import_data_pool:false,start_report_pool:true,createRedisCache:true}){
-  server(app,{sslDir,configs,port,...options})
-}
-module.exports =clusterServer;
+const server=require("./app"),clusterServer=function($app$$,$sslDir$$,$configs$$={},$port$$=9999,$options$$={start_import_data_pool:!1,start_report_pool:!0,createRedisCache:!0}){server($app$$,{sslDir:$sslDir$$,configs:$configs$$,port:$port$$,...$options$$})};module.exports=clusterServer;

package/server/global.js

@@ -1,25 +1,20 @@
-const fs=require("fs"),async=require("async"),logger=require("./libs/logger.js");global.Logger=logger;const prototypes=require("./libs/prototypes.js"),TransactionPool=require("./libs/BlockchainTransactionPool"),leanID=require("./libs/mongooseLeanId"),mongooseSecurityPlugin=require("./libs/mongooseSecurityPlugin"),deletePost=require("./libs/mongooseDeletePost");
+const fs=require("fs"),async=require("async"),logger=require("./libs/logger.js");global.Logger=logger;const prototypes=require("./libs/prototypes.js"),TransactionPool=require("./libs/BlockchainTransactionPool"),leanID=require("./libs/mongooseLeanId"),mongooseSecurityPlugin=require("./libs/mongooseSecurityPlugin"),deletePost=require("./libs/mongooseDeletePost"),{onAfterCommit}=require("./libs/sessionContext.js");
 function globalListinfoCodePlugin($schema$$){$schema$$.path("listinfo_code")||$schema$$.add({listinfo_code:{type:String,default:null}});$schema$$.path("id_client")||$schema$$.add({id_client:{type:String,default:null}})}global.blockchainTransactionPool=new TransactionPool;global.new_schedules=[];global.rootDir=__dirname;global.ctrlVouchers={};global.controllers={};global.report_controllers={};global.postingVouchers={};global.cacheDatas={};
 global.socketContainer={loadConnectionId:async()=>new Promise($res$$=>{global.clientRedis.get("client-io",function($err$$,$reply$$){if($err$$)return console.error($err$$),$res$$({});if($reply$$)try{let $ios$$=JSON.parse($reply$$);return $res$$($ios$$||{})}catch($e$$){return console.error($e$$),$res$$({})}else return $res$$({})})}),saveConnectionId:async($clientIO$$={})=>new Promise(($res$$,$rej$$)=>{global.clientRedis.set("client-io",JSON.stringify($clientIO$$),$e$$=>{if($e$$)return console.error($e$$),
 $rej$$($e$$);$res$$($clientIO$$)})})};global.clientIO={};global.model_books="socai socaitmp socainpp vsocai sokho sokhott sokhonpp sokhokhongton sosanxuat vatvao vatra phucap".split(" ");global.secu_models="asskey assproduct assperiod assinvestment asssell assbuy assneedtobuy asswithdraw asscashwithdraw wallet assfindhash assbank asstransaction assissue token tokens user app listinfo right otp payload smsaccount emailaccount".split(" ");global.webPush=require("web-push");global.mongoose=require("mongoose");
-const originalCast=global.mongoose.Number.cast();global.mongoose.Number.cast(function($value$$){return typeof $value$$==="number"&&Number.isNaN($value$$)?0:originalCast($value$$)});global.mongoose.plugin(mongooseSecurityPlugin);require("./libs/mongoosePatch.js");global.mongoose.plugin(leanID);global.mongoose.plugin(deletePost);global.mongoose.plugin(globalListinfoCodePlugin);const {createStorageUsageTracker}=require("mongoose-storage-usage");
-global.storageUsage=createStorageUsageTracker(mongoose,{autoApply:!0,fileFieldsConfig:{File:["file"]}});global.storageUsage.registerCronJob("0 2 * * *");global.mongoose.plugin(function($schema$$){$schema$$.set("versionKey",!1)});global.Schema=global.mongoose.Schema;
+const originalCast=global.mongoose.Number.cast();global.mongoose.Number.cast(function($value$$){return typeof $value$$==="number"&&Number.isNaN($value$$)?0:originalCast($value$$)});global.mongoose.plugin(mongooseSecurityPlugin);require("./libs/mongoosePatch.js");global.mongoose.plugin(leanID);global.mongoose.plugin(deletePost);global.mongoose.plugin(globalListinfoCodePlugin);global.Schema=global.mongoose.Schema;
 global.getModel=$model_name_name$$=>{$model_name_name$$=$model_name_name$$.split(".js")[0];var $_requireFields_manualMap_model_model_path_mySchema$$={kbmpttct:"kbmPttct",kbmtkgtgt:"kbmTkgtgt",token:"tokens",bn1:"pc1",bc1:"pt1",dmnhkh:"group",dmchucvu:"group",dmnhtask:"group",dmntt:"group",dmnt:"currentcy",dmtk:"account",dmkh:"customer",dmsp:"dmvt",data_socai:"socai",data_socaitc:"socaitc",data_sokho:"sokho"};$_requireFields_manualMap_model_model_path_mySchema$$[$model_name_name$$]&&($model_name_name$$=
 $_requireFields_manualMap_model_model_path_mySchema$$[$model_name_name$$]);if($_requireFields_manualMap_model_model_path_mySchema$$=mongoose.models[$model_name_name$$])return $_requireFields_manualMap_model_model_path_mySchema$$;if(global.controllers[$model_name_name$$.toUpperCase()]&&global.controllers[$model_name_name$$.toUpperCase()].model)return global.controllers[$model_name_name$$].model;if(((global.configs||{}).paths||{}).models&&($_requireFields_manualMap_model_model_path_mySchema$$=((global.configs||
 {}).paths||{}).models+"/"+$model_name_name$$+".js",fs.existsSync($_requireFields_manualMap_model_model_path_mySchema$$)))return require($_requireFields_manualMap_model_model_path_mySchema$$);$_requireFields_manualMap_model_model_path_mySchema$$=__dirname+"/models/"+$model_name_name$$+".js";if(fs.existsSync($_requireFields_manualMap_model_model_path_mySchema$$))return require($_requireFields_manualMap_model_model_path_mySchema$$);console.error("model",$model_name_name$$,"is not exists. create new model");
-$_requireFields_manualMap_model_model_path_mySchema$$={...require("./models/listinfo").requireFields};$_requireFields_manualMap_model_model_path_mySchema$$=new global.Schema($_requireFields_manualMap_model_model_path_mySchema$$,{strict:!1});return global.mongoose.model($model_name_name$$,$_requireFields_manualMap_model_model_path_mySchema$$)};global.getLib=$lib_name$$=>require("./libs/"+$lib_name$$);
+$_requireFields_manualMap_model_model_path_mySchema$$={...require("./models/listinfo").requireFields};$_requireFields_manualMap_model_model_path_mySchema$$=new global.Schema($_requireFields_manualMap_model_model_path_mySchema$$,{strict:!1});return global.mongoose.model($model_name_name$$,$_requireFields_manualMap_model_model_path_mySchema$$)};const {createStorageUsageTracker}=require("mongoose-storage-usage");
+global.storageUsage=createStorageUsageTracker(mongoose,{autoApply:!0,appModel:global.getModel("app"),fileFieldsConfig:{File:["file"]}});global.storageUsage.registerCronJob("0 2 * * *");global.mongoose.plugin(function($schema$$){$schema$$.set("versionKey",!1)});global.getLib=$lib_name$$=>require("./libs/"+$lib_name$$);
 const pointSchema=new global.mongoose.Schema({type:{type:String,enum:["Point"],required:!0,default:"Point"},coordinates:{type:[Number],required:!0}}),polygonSchema=new global.mongoose.Schema({type:{type:String,enum:["Polygon"],required:!0,default:"Polygon"},coordinates:{type:[[[Number]]],required:!0}});global.customTypes={Point:pointSchema,Polygon:polygonSchema};const EventEmitter=require("events");class GlobalEmitter extends EventEmitter{}global.globalEvents=new GlobalEmitter;
-global.getSysConfig=async $cf_code$$=>{if($cf_code$$=await global.getModel("sysconfig").findOne({code:$cf_code$$}))return $cf_code$$.value};global.asyncCountUnRead=async $email$$=>{const $Message$$=global.getModel("message");return new Promise($resolve$$=>{setImmediate(()=>{$Message$$.countDocuments({email:$email$$,read:!1},($e$$,$rs$$)=>{$resolve$$($rs$$||0)})})})};
-global.alertMessage=function($email$$,$id_app$$){onAfterCommit(()=>{const $Message$$=global.getModel("message"),$User$$=global.getModel("user");let $query$$={email_owner:$email$$,read:!1};$id_app$$&&($query$$["exfields.id_app"]=$id_app$$);$Message$$.countDocuments($query$$,function($error$$,$count$$){$error$$?console.log($error$$):$User$$.emitEvent($email$$,"message:count",$count$$,!1)})})};
+global.getSysConfig=async $cf_code$$=>{if($cf_code$$=await global.getModel("sysconfig").findOne({code:$cf_code$$}))return $cf_code$$.value};global.asyncCountUnRead=async $email$$=>global.getModel("message").countDocuments({email:$email$$,read:!1});
+global.alertMessage=function($email$$,$id_app$$){onAfterCommit(async()=>{var $Message$jscomp$1_count$$=global.getModel("message");const $User$$=global.getModel("user");let $query$$={email_owner:$email$$,read:!1};$id_app$$&&($query$$["exfields.id_app"]=$id_app$$);$Message$jscomp$1_count$$=await $Message$jscomp$1_count$$.countDocuments($query$$);$User$$.emitEvent($email$$,"message:count",$Message$jscomp$1_count$$,!1)})};
 global.createNotification=function($email_sender$$,$email_receiver$$,$title$$,$content$$,$fn$$,$exfields$$,$emitEvent$$,$c_token$$,$send_email$$){global.getModel("notification").createNotification($email_sender$$,$email_receiver$$,$title$$,$content$$,$fn$$,$exfields$$,$emitEvent$$,$c_token$$,$send_email$$)};
-global.getNotifies=function($email$$,$fn$$,$id_app$$){if(!$id_app$$)return $fn$$(null,{notifications:[],colls:[],apps:[]});const $Notification$$=global.getModel("notification");async.parallel({colls:function($callback$$){$callback$$(null,[])},notifications:function($callback$$){let $query$$={email_owner:$email$$,read:!1};$id_app$$&&($query$$["exfields.id_app"]=$id_app$$);$Notification$$.find($query$$,function($error$$,$colls_raw$$){setImmediate(()=>{if($error$$)$callback$$($error$$);else{const $colls$$=
-$colls_raw$$.map(function($c$$){return $c$$.toObject()});$callback$$(null,$colls$$)}})})},apps:function($callback$$){$callback$$(null,[])}},function($error$$,$rs$$){setImmediate(()=>{$fn$$($error$$,$rs$$)})})};
-global.sendNotification=function($email$$,$_id$$,$notify$$,$push_to_mobile_and_web$$=!0){const $User$$=global.getModel("user");setImmediate(()=>{$notify$$||={email_sender:"H\u1ec7 th\u1ed1ng"};const $obj_notify$$={_id:$_id$$,code:"notification",action:"view"};$obj_notify$$.body=$notify$$.content||$notify$$.title||"";$obj_notify$$.sender=$notify$$.email_sender;$obj_notify$$.title=$notify$$.title||"";$obj_notify$$.content=$notify$$.content||"";$User$$.emitEvent($email$$,"notify:new",$obj_notify$$,$push_to_mobile_and_web$$)})};
-global.alertNotification=function($email$$,$id_app$$){const $Notification$$=global.getModel("notification"),$User$$=global.getModel("user");setImmediate(()=>{let $condition$$={email_owner:$email$$,read:!1};$id_app$$&&($condition$$["exfields.id_app"]=$id_app$$);$Notification$$.countDocuments($condition$$,function($error$$,$count$$){$error$$?Logger.error("[alertNotification]",$error$$):(Logger.warn("[global][alertNotification]",{email:$email$$,id_app:$id_app$$,count:$count$$}),$User$$.emitEvent($email$$,
-"notify:count",$count$$,!1))})})};global.asyncCountNotifications=async function($email$$,$id_app$$){const $Notification$$=global.getModel("notification");return new Promise($resolve$$=>{setImmediate(()=>{let $condition$$={email_owner:$email$$,read:!1};$id_app$$&&($condition$$["exfields.id_app"]=$id_app$$);$Notification$$.countDocuments($condition$$,function($error$$,$count$$){setImmediate(()=>{$error$$?(Logger.error("[global][countNotification]",$error$$),$resolve$$(0)):$resolve$$($count$$)})})})})};
-const {RateLimiterRedis,RateLimiterQueue,RateLimiterMemory}=require("rate-limiter-flexible"),{onAfterCommit}=require("./libs/sessionContext.js");
-global.createRateLimiterMiddleware=async($config$$,$keyPrefix$$)=>{const $total_points$$=$config$$.points||1E3;var $duration_limiterFlexible$$=$config$$.duration||1;const $insuranceLimiter$$=new RateLimiterMemory({points:$total_points$$,duration:$duration_limiterFlexible$$});$duration_limiterFlexible$$=new RateLimiterRedis({keyPrefix:$keyPrefix$$,storeClient:global.clientRedis,points:$total_points$$,duration:$duration_limiterFlexible$$,blockDuration:$config$$.blockDuration||0,inmemoryBlockOnConsumed:$total_points$$+
-1,inmemoryBlockDuration:10,insuranceLimiter:$insuranceLimiter$$});const $rateLimiter$$=new RateLimiterQueue($duration_limiterFlexible$$,{maxQueueSize:$config$$.maxQueueSize||1E4});return async($req$$,$res$$,$next$$)=>{let $key$$=($req$$.ip||$req$$.headers["x-forwarded-for"]||$req$$.connection.remoteAddress).replace("::ffff:","");const $origin$$=($req$$.headers.origin||$req$$.headers.referer||"").toString().toLowerCase().replace("https://","").replace("http://","").replace("www.","").split("/").join("").trim();
-let $trust_domains$$=((global.configs||{}).trust_domains||"").toString().toLowerCase().split(","),$points$$;if($origin$$&&$trust_domains$$.indexOf($origin$$)<0){var $check_query$$={domain:$origin$$};if($check_query$$=await global.getModel("domain").findOne($check_query$$).lean()){if($check_query$$.not_allow)return $res$$.status(400).send({error:"Access is not allowed"});$points$$=$check_query$$.points;$trust_domains$$.push($origin$$)}}$check_query$$=$req$$.headers["x-trust-key"]||$req$$.query.trustkey||
-$req$$.query.trust_key||"";const $trust_keys$$=(global.configs||{}).trust_keys||[];$req$$.user&&($key$$=`${$key$$}-${$req$$.user.email}`);$key$$=`${$key$$}-${$origin$$||"unknow"}-${$check_query$$||"untrustkey"}`;$points$$||(!$origin$$||$trust_domains$$.length==0&&$trust_keys$$.length==0||$origin$$&&$trust_domains$$.length>0&&$trust_domains$$.indexOf($origin$$)>=0||$trust_keys$$.length>0&&$trust_keys$$.indexOf($check_query$$)>=0?$points$$=1:($points$$=Math.roundBy($total_points$$/2),Logger.warn("This request is limit rate at",
-$points$$,"/",$total_points$$,{origin:$origin$$,originalUrl:$req$$.originalUrl,trust_keys:$trust_keys$$,trust_Key:$check_query$$,key:$key$$})));setImmediate(async()=>{try{await $rateLimiter$$.removeTokens($points$$,$key$$),$next$$()}catch($err$$){console.error("Error rate limiter",$keyPrefix$$,$err$$),$err$$ instanceof Error?$res$$.status(400).send({error:$err$$.message||"Error rate limiter"}):$res$$.status(429).send({error:"Too Many Requests. Please try again later"})}})}};
+global.getNotifies=function($email$$,$fn$$,$id_app$$){if(!$id_app$$)return $fn$$(null,{notifications:[],colls:[],apps:[]});const $Notification$$=global.getModel("notification");async.parallel({colls:function($callback$$){$callback$$(null,[])},notifications:function($callback$$){setImmediate(async()=>{var $colls_raw_query$$={email_owner:$email$$,read:!1};$id_app$$&&($colls_raw_query$$["exfields.id_app"]=$id_app$$);$colls_raw_query$$=await $Notification$$.find($colls_raw_query$$).lean();$callback$$(null,
+$colls_raw_query$$)})},apps:function($callback$$){$callback$$(null,[])}},function($error$$,$rs$$){setImmediate(()=>{$fn$$($error$$,$rs$$)})})};
+global.sendNotification=function($email$$,$_id_obj_notify$$,$notify$$,$push_to_mobile_and_web$$=!0){const $User$$=global.getModel("user");$notify$$||={email_sender:"H\u1ec7 th\u1ed1ng"};$_id_obj_notify$$={_id:$_id_obj_notify$$,code:"notification",action:"view"};$_id_obj_notify$$.body=$notify$$.content||$notify$$.title||"";$_id_obj_notify$$.sender=$notify$$.email_sender;$_id_obj_notify$$.title=$notify$$.title||"";$_id_obj_notify$$.content=$notify$$.content||"";$User$$.emitEvent($email$$,"notify:new",
+$_id_obj_notify$$,$push_to_mobile_and_web$$)};
+global.alertNotification=async function($email$$,$id_app$$){var $Notification$jscomp$2_count$$=global.getModel("notification");const $User$$=global.getModel("user");let $condition$$={email_owner:$email$$,read:!1};$id_app$$&&($condition$$["exfields.id_app"]=$id_app$$);$Notification$jscomp$2_count$$=await $Notification$jscomp$2_count$$.countDocuments($condition$$);Logger.warn("[global][alertNotification]",{email:$email$$,id_app:$id_app$$,count:$Notification$jscomp$2_count$$});$User$$.emitEvent($email$$,
+"notify:count",$Notification$jscomp$2_count$$,!1)};global.asyncCountNotifications=async function($condition$jscomp$1_email$$,$id_app$$){const $Notification$$=global.getModel("notification");$condition$jscomp$1_email$$={email_owner:$condition$jscomp$1_email$$,read:!1};$id_app$$&&($condition$jscomp$1_email$$["exfields.id_app"]=$id_app$$);return await $Notification$$.countDocuments($condition$jscomp$1_email$$)};

package/server/libs/mongooseSecurityPlugin.js

@@ -1,14 +1,16 @@
 const mongoose=require("mongoose");
 module.exports=function($schema$$){const $schemaPaths$$={};$schema$$.eachPath(($pathname$$,$schemaType$$)=>{$schemaPaths$$[$pathname$$]=$schemaType$$.instance});const $hasIdAppField$$=!!$schema$$.path("id_app"),$isMongoOperatorObject$$=$keys_obj$$=>{if(!$keys_obj$$||typeof $keys_obj$$!=="object"||Array.isArray($keys_obj$$)||$keys_obj$$ instanceof Date||$keys_obj$$._bsontype==="ObjectID")return!1;$keys_obj$$=Object.keys($keys_obj$$);return $keys_obj$$.length===0?!1:$keys_obj$$.every($k$$=>$k$$.startsWith("$"))},
+$filterValidArrayItems$$=($currentPath$$,$arr$$,$expectedType$$)=>{const $validItems$$=$arr$$.filter($item$$=>$validateType$$($currentPath$$,$item$$,$expectedType$$)===null);if($validItems$$.length!==$arr$$.length){const $removed$$=$arr$$.filter($item$$=>!$validItems$$.includes($item$$));Logger.warn(`[Security Info] \u0110\u00e3 lo\u1ea1i b\u1ecf ${$arr$$.length-$validItems$$.length} ph\u1ea7n t\u1eed kh\u00f4ng h\u1ee3p l\u1ec7 t\u1ea1i '${$currentPath$$}': ${JSON.stringify($removed$$)}`)}return $validItems$$},
 $validateType$$=($key$$,$val$$,$expectedType$$)=>{if($val$$===null||$val$$===void 0)return null;switch($expectedType$$){case "ObjectID":if(typeof $val$$==="string"&&!mongoose.isValidObjectId($val$$))return`Sai \u0111\u1ecbnh d\u1ea1ng ObjectId t\u1ea1i '${$key$$}'`;break;case "String":if(Array.isArray($val$$))return`Sai \u0111\u1ecbnh d\u1ea1ng String t\u1ea1i '${$key$$}' (nh\u1eadn \u0111\u01b0\u1ee3c m\u1ea3ng)`;if(typeof $val$$==="object"&&$val$$!==null&&$val$$._bsontype!=="ObjectID"&&!($val$$ instanceof
 Date))return`Sai \u0111\u1ecbnh d\u1ea1ng String t\u1ea1i '${$key$$}' (nh\u1eadn \u0111\u01b0\u1ee3c object r\u00e1c)`;break;case "Number":if(typeof $val$$==="object"||Array.isArray($val$$)||$val$$===""||isNaN(Number($val$$)))return`Sai \u0111\u1ecbnh d\u1ea1ng Number t\u1ea1i '${$key$$}'`;break;case "Boolean":if(typeof $val$$!=="boolean"&&!["true","false","1","0",1,0].includes($val$$))return`Sai \u0111\u1ecbnh d\u1ea1ng Boolean t\u1ea1i '${$key$$}'`;break;case "Date":if(typeof $val$$==="object"&&
-!($val$$ instanceof Date))return`Sai \u0111\u1ecbnh d\u1ea1ng Date t\u1ea1i '${$key$$}'`;if(isNaN((new Date($val$$)).getTime()))return`Th\u1eddi gian kh\u00f4ng h\u1ee3p l\u1ec7 t\u1ea1i '${$key$$}'`}return null},$scanFilterForInvalidTypes$$=($filter$$,$prefix$$="")=>{if(!$filter$$||typeof $filter$$!=="object")return null;for(const $key$$ of Object.keys($filter$$)){var $err$jscomp$1_value$$=$filter$$[$key$$];if(["$and","$or","$nor"].includes($key$$)){if(Array.isArray($err$jscomp$1_value$$))for(const $sub$$ of $err$jscomp$1_value$$){var $currentPath_err_err$jscomp$4_err$$=
-$scanFilterForInvalidTypes$$($sub$$,"");if($currentPath_err_err$jscomp$4_err$$)return $currentPath_err_err$jscomp$4_err$$}continue}$currentPath_err_err$jscomp$4_err$$=$prefix$$?`${$prefix$$}.${$key$$}`:$key$$;const $expectedType$$=$schemaPaths$$[$currentPath_err_err$jscomp$4_err$$];if($expectedType$$)if(Array.isArray($err$jscomp$1_value$$)){if($expectedType$$!=="Array"){$filter$$[$key$$]={$in:$err$jscomp$1_value$$};for(const $item$$ of $err$jscomp$1_value$$)if($err$jscomp$1_value$$=$validateType$$($currentPath_err_err$jscomp$4_err$$,
-$item$$,$expectedType$$))return $err$jscomp$1_value$$}}else if($isMongoOperatorObject$$($err$jscomp$1_value$$))for(const $op$$ of Object.keys($err$jscomp$1_value$$)){var $err$jscomp$2_err$$=$err$jscomp$1_value$$[$op$$];if("$eq $ne $gt $gte $lt $lte".split(" ").includes($op$$)){if($err$jscomp$2_err$$=$validateType$$($currentPath_err_err$jscomp$4_err$$,$err$jscomp$2_err$$,$expectedType$$))return $err$jscomp$2_err$$}else if(["$in","$nin"].includes($op$$)){if(!Array.isArray($err$jscomp$2_err$$))return`To\u00e1n t\u1eed ${$op$$} t\u1ea1i '${$currentPath_err_err$jscomp$4_err$$}' y\u00eau c\u1ea7u m\u1ed9t m\u1ea3ng`;
-for(const $item$$ of $err$jscomp$2_err$$)if($err$jscomp$2_err$$=$validateType$$($currentPath_err_err$jscomp$4_err$$,$item$$,$expectedType$$))return $err$jscomp$2_err$$}else if($op$$==="$regex"&&$expectedType$$!=="String")return`To\u00e1n t\u1eed $regex t\u1ea1i '${$currentPath_err_err$jscomp$4_err$$}' ch\u1ec9 d\u00f9ng cho ki\u1ec3u String`}else if(typeof $err$jscomp$1_value$$!=="object"||$err$jscomp$1_value$$===null||$err$jscomp$1_value$$ instanceof Date||$err$jscomp$1_value$$._bsontype==="ObjectID"){if($currentPath_err_err$jscomp$4_err$$=
-$validateType$$($currentPath_err_err$jscomp$4_err$$,$err$jscomp$1_value$$,$expectedType$$))return $currentPath_err_err$jscomp$4_err$$}else return`Tr\u01b0\u1eddng '${$currentPath_err_err$jscomp$4_err$$}' (ki\u1ec3u ${$expectedType$$}) nh\u1eadn \u0111\u01b0\u1ee3c Object r\u00e1c kh\u00f4ng h\u1ee3p l\u1ec7`;else if(typeof $err$jscomp$1_value$$==="object"&&$err$jscomp$1_value$$!==null&&!$isMongoOperatorObject$$($err$jscomp$1_value$$)&&!Array.isArray($err$jscomp$1_value$$)&&($currentPath_err_err$jscomp$4_err$$=
-$scanFilterForInvalidTypes$$($err$jscomp$1_value$$,$currentPath_err_err$jscomp$4_err$$)))return $currentPath_err_err$jscomp$4_err$$}return null},$hasIdAppInFilter$$=$filter$$=>{if(!$filter$$||typeof $filter$$!=="object")return!1;if(Object.hasOwn($filter$$,"id_app"))return!0;for(const $key$$ of Object.keys($filter$$))if(["$and","$or","$nor"].includes($key$$)&&Array.isArray($filter$$[$key$$])&&$filter$$[$key$$].some($sub$$=>$hasIdAppInFilter$$($sub$$)))return!0;return!1};"find findOne findOneAndUpdate findOneAndDelete findOneAndRemove update updateOne updateMany deleteOne deleteMany count countDocuments".split(" ").forEach($method$$=>
-{$schema$$.pre($method$$,function($next$$){var $errorMessage$jscomp$1_filter$$=this.getFilter();Object.keys($errorMessage$jscomp$1_filter$$).length===0&&["updateMany","deleteMany","update"].includes($method$$)&&Logger.warn(`[DANGER WARN] L\u1ec7nh '${$method$$}' c\u00f3 filter r\u1ed7ng tr\u00ean Model '${this.model.modelName}'!`);var $errorMessage_modelName$$=$scanFilterForInvalidTypes$$($errorMessage$jscomp$1_filter$$);if($errorMessage_modelName$$)return Logger.warn(`[Security Warn] ${$errorMessage_modelName$$} tr\u00ean Model '${this.model.modelName}'. \u0110\u00e3 \u00e9p query tr\u1ea3 v\u1ec1 r\u1ed7ng. Filter: ${JSON.stringify($errorMessage$jscomp$1_filter$$)}`),
+!($val$$ instanceof Date))return`Sai \u0111\u1ecbnh d\u1ea1ng Date t\u1ea1i '${$key$$}'`;if(isNaN((new Date($val$$)).getTime()))return`Th\u1eddi gian kh\u00f4ng h\u1ee3p l\u1ec7 t\u1ea1i '${$key$$}'`}return null},$scanFilterForInvalidTypes$$=($filter$$,$prefix$$="")=>{if(!$filter$$||typeof $filter$$!=="object")return null;for(const $key$$ of Object.keys($filter$$)){var $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$=$filter$$[$key$$];if(["$and","$or","$nor"].includes($key$$)){if(Array.isArray($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$))for(const $sub$$ of $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$)if($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$=
+$scanFilterForInvalidTypes$$($sub$$,""))return $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$;continue}const $currentPath$$=$prefix$$?`${$prefix$$}.${$key$$}`:$key$$,$expectedType$$=$schemaPaths$$[$currentPath$$];if($expectedType$$)if(Array.isArray($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$))$expectedType$$!=="Array"&&($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$=$filterValidArrayItems$$($currentPath$$,$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$,
+$expectedType$$),$filter$$[$key$$]={$in:$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$});else if($isMongoOperatorObject$$($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$))for(const $op$$ of Object.keys($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$)){var $err$$=$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$[$op$$];if("$eq $ne $gt $gte $lt $lte".split(" ").includes($op$$)){if($err$$=$validateType$$($currentPath$$,$err$$,$expectedType$$))return $err$$}else if(["$in",
+"$nin"].includes($op$$)){if(!Array.isArray($err$$))return`To\u00e1n t\u1eed ${$op$$} t\u1ea1i '${$currentPath$$}' y\u00eau c\u1ea7u m\u1ed9t m\u1ea3ng`;$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$[$op$$]=$filterValidArrayItems$$($currentPath$$,$err$$,$expectedType$$)}else if($op$$==="$regex"&&$expectedType$$!=="String")return`To\u00e1n t\u1eed $regex t\u1ea1i '${$currentPath$$}' ch\u1ec9 d\u00f9ng cho ki\u1ec3u String`}else if(typeof $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$!==
+"object"||$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$===null||$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$ instanceof Date||$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$._bsontype==="ObjectID"){if($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$=$validateType$$($currentPath$$,$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$,$expectedType$$))return $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$}else return`Tr\u01b0\u1eddng '${$currentPath$$}' (ki\u1ec3u ${$expectedType$$}) nh\u1eadn \u0111\u01b0\u1ee3c Object r\u00e1c kh\u00f4ng h\u1ee3p l\u1ec7`;
+else if(typeof $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$==="object"&&$err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$!==null&&!$isMongoOperatorObject$$($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$)&&!Array.isArray($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$)&&($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$=$scanFilterForInvalidTypes$$($err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$,$currentPath$$)))return $err_err$jscomp$2_err$jscomp$3_validItems$jscomp$1_value$$}return null},
+$hasIdAppInFilter$$=$filter$$=>{if(!$filter$$||typeof $filter$$!=="object")return!1;if(Object.hasOwn($filter$$,"id_app"))return!0;for(const $key$$ of Object.keys($filter$$))if(["$and","$or","$nor"].includes($key$$)&&Array.isArray($filter$$[$key$$])&&$filter$$[$key$$].some($sub$$=>$hasIdAppInFilter$$($sub$$)))return!0;return!1};"find findOne findOneAndUpdate findOneAndDelete findOneAndRemove update updateOne updateMany deleteOne deleteMany count countDocuments".split(" ").forEach($method$$=>{$schema$$.pre($method$$,
+function($next$$){var $errorMessage$jscomp$1_filter$$=this.getFilter();Object.keys($errorMessage$jscomp$1_filter$$).length===0&&["updateMany","deleteMany","update"].includes($method$$)&&Logger.warn(`[DANGER WARN] L\u1ec7nh '${$method$$}' c\u00f3 filter r\u1ed7ng tr\u00ean Model '${this.model.modelName}'!`);var $errorMessage_modelName$$=$scanFilterForInvalidTypes$$($errorMessage$jscomp$1_filter$$);if($errorMessage_modelName$$)return Logger.warn(`[Security Warn] ${$errorMessage_modelName$$} tr\u00ean Model '${this.model.modelName}'. \u0110\u00e3 \u00e9p query tr\u1ea3 v\u1ec1 r\u1ed7ng. Filter: ${JSON.stringify($errorMessage$jscomp$1_filter$$)}`),
 this.setQuery({_id:{$in:[]}}),$next$$();this.setQuery($errorMessage$jscomp$1_filter$$);$hasIdAppField$$&&Object.keys($errorMessage$jscomp$1_filter$$).length>0&&!$errorMessage$jscomp$1_filter$$._id&&!$hasIdAppInFilter$$($errorMessage$jscomp$1_filter$$)&&($errorMessage_modelName$$=this.model?this.model.modelName:"UnknownModel",$errorMessage$jscomp$1_filter$$.id_ct||["sys_job_queue_book_keeping","participant","cache","parameter"].indexOf($errorMessage_modelName$$)>=0?($errorMessage$jscomp$1_filter$$=
 `[SECURITY WARN] Query tr\u00ean Model '${$errorMessage_modelName$$}' \u0111ang thi\u1ebfu \u0111i\u1ec1u ki\u1ec7n 'id_app'! \u0110i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 g\u00e2y l\u1ecdt d\u1eef li\u1ec7u ch\u00e9o. Filter: ${JSON.stringify($errorMessage$jscomp$1_filter$$)}`,Logger.warn($errorMessage$jscomp$1_filter$$)):($errorMessage$jscomp$1_filter$$=`[SECURITY ERROR] Query tr\u00ean Model '${$errorMessage_modelName$$}' \u0111ang thi\u1ebfu \u0111i\u1ec1u ki\u1ec7n 'id_app'! \u0110i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 g\u00e2y l\u1ecdt d\u1eef li\u1ec7u ch\u00e9o. Filter: ${JSON.stringify($errorMessage$jscomp$1_filter$$)}`,
 Logger.error($errorMessage$jscomp$1_filter$$)));$next$$()})})};

package/server/libs/utils.js

@@ -116,4 +116,6 @@ const getDir=$dirName$$=>{let $dirPath$$=configs.paths[$dirName$$];$dirPath$$||(
 const getPathFile=$file_file_name$$=>{if($file_file_name$$.file&&$file_file_name$$.file.name){$file_file_name$$=$file_file_name$$.file.name;var $root$$=getDir("uploads");return path.join($root$$,$file_file_name$$)}};exports.getPathFile=getPathFile;
 function restoreObjectIds($data$$){const $walk$$=$buffer$jscomp$inline_2_value$$=>{if($buffer$jscomp$inline_2_value$$===null||typeof $buffer$jscomp$inline_2_value$$!=="object"||$buffer$jscomp$inline_2_value$$ instanceof Date||$buffer$jscomp$inline_2_value$$ instanceof RegExp||Buffer.isBuffer($buffer$jscomp$inline_2_value$$))return $buffer$jscomp$inline_2_value$$;if(Array.isArray($buffer$jscomp$inline_2_value$$))return $buffer$jscomp$inline_2_value$$.map($walk$$);if($buffer$jscomp$inline_2_value$$&&
 typeof $buffer$jscomp$inline_2_value$$==="object"&&$buffer$jscomp$inline_2_value$$._bsontype==="ObjectID"&&$buffer$jscomp$inline_2_value$$.id&&typeof $buffer$jscomp$inline_2_value$$.id==="object")return $buffer$jscomp$inline_2_value$$=Buffer.from(Object.values($buffer$jscomp$inline_2_value$$.id)),new mongoose.Types.ObjectId($buffer$jscomp$inline_2_value$$);const $result$$={};for(const $key$$ in $buffer$jscomp$inline_2_value$$)Object.prototype.hasOwnProperty.call($buffer$jscomp$inline_2_value$$,$key$$)&&
-($result$$[$key$$]=$walk$$($buffer$jscomp$inline_2_value$$[$key$$]));return $result$$};return $walk$$($data$$)}exports.restoreObjectIds=restoreObjectIds;
+($result$$[$key$$]=$walk$$($buffer$jscomp$inline_2_value$$[$key$$]));return $result$$};return $walk$$($data$$)}exports.restoreObjectIds=restoreObjectIds;exports.asyncHandler=$fn$$=>($req$$,$res$$,$next$$)=>Promise.resolve($fn$$($req$$,$res$$,$next$$)).catch($next$$);exports.redisIncrAsync=$key$$=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.incr($key$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))});
+exports.redisExpireAsync=($key$$,$ttlSeconds$$)=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.expire($key$$,$ttlSeconds$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))});exports.redisPttlAsync=$key$$=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.pttl($key$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))});
+exports.redisDelAsync=$key$$=>new Promise(($resolve$$,$reject$$)=>{global.clientRedis.del($key$$,($err$$,$reply$$)=>$err$$?$reject$$($err$$):$resolve$$($reply$$))});

package/server/models/account.js

@@ -0,0 +1,7 @@
+const dmnt=require("./currency"),accountSchema=new Schema({id_app:{type:String,required:!0,maxlength:1024},tk:{type:String,required:"tk is required",uppercase:!0,trim:!0,maxlength:32},ten_tk:{type:String,required:"ten_tk is required",trim:!0,maxlength:1024},ten_tk2:{type:String,maxlength:1024},tk_me:{type:String,default:"",trim:!0,uppercase:!0,maxlength:32},loai_tk:{type:Number,min:0,max:1,default:1,enum:[0,1]},tk_cn:{type:Boolean,default:!1,required:!0},ma_nt:{type:String,uppercase:!0,required:"ma_nt is required",
+default:"VND",trim:!0,maxlength:32},tk_kho_yn:Boolean,tk_cp_yn:Boolean,tk_bp_yn:Boolean,tk_dt_yn:Boolean,tk_hd_yn:Boolean,tk_nv_yn:Boolean,tk_td1_yn:Boolean,tk_td2_yn:Boolean,tk_td3_yn:Boolean,not_du_co_yn:Boolean,not_du_no_yn:Boolean,exfields:Schema.Types.Mixed,status:{type:Boolean,default:!0},date_created:{type:Date,default:Date.now},date_updated:{type:Date,default:Date.now},user_created:{type:String,default:""},user_updated:{type:String,default:""},visible_to:{type:Number,default:0},visible_to_users:[String],
+update_right:[String],delete_right:[String]},{toJSON:{virtuals:!0}});
+(global.configs||{}).createIndexes&&(accountSchema.index({id_app:1,tk:1,status:1}),accountSchema.index({id_app:1,tk:1,ten_tk:1,status:1}),accountSchema.index({id_app:1,tk_me:1}),accountSchema.index({id_app:1,tk:1,loai_tk:1,ten_tk:1,status:1}),accountSchema.index({id_app:1,loai_tk:1,status:1}),accountSchema.index({id_app:1,tk_cn:1,status:1}),accountSchema.index({id_app:1,tk:1},{unique:!0}),accountSchema.index({id_app:1,user_created:1,visible_to:1,visible_to_users:1,status:1}),accountSchema.index({id_app:1,
+user_created:1,visible_to:1,visible_to_users:1,status:1,tk:1,ten_tk:1}),accountSchema.index({id_app:1,ten_tk:"text",ten_tk2:"text",tk:"text",ma_nt:"text"},{name:"account_index"}));accountSchema.validate={ma_nt:[function($id_app$$,$value$$,$callback$$){if(!$value$$)return $callback$$(!0);dmnt.findOne({id_app:$id_app$$,ma_nt:$value$$},function($error$$,$nt$$){if($error$$)return $callback$$(!1);$nt$$&&$callback$$(!0)})},"M\u00e3 ngo\u1ea1i t\u1ec7 kh\u00f4ng t\u1ed3n t\u1ea1i"]};
+const model=mongoose.models.account||mongoose.model("account",accountSchema);model.referenceKeys={tk:[{model:"vsocai",key:"tk",error:"T\u00e0i kho\u1ea3n ${obj.tk} \u0111\u00e3 ph\u00e1t sinh d\u1eef li\u1ec7u"},{model:"cdtk",key:"tk",error:"T\u00e0i kho\u1ea3n ${obj.tk} \u0111\u00e3 ph\u00e1t sinh d\u1eef li\u1ec7u"},{model:"cdkh",key:"tk",error:"T\u00e0i kho\u1ea3n ${obj.tk} \u0111\u00e3 ph\u00e1t sinh d\u1eef li\u1ec7u"},{model:"dmvt",key:"tk_vt",error:"T\u00e0i kho\u1ea3n ${obj.tk} \u0111\u00e3 ph\u00e1t sinh d\u1eef li\u1ec7u"}]};
+module.exports=model;

package/server/models/actionLog.js

@@ -0,0 +1,2 @@
+const mongoose=require("mongoose"),actionLogSchema=new mongoose.Schema({idempotencyKey:{type:String,required:!0,unique:!0,index:!0},actionType:{type:String,required:!0,index:!0},status:{type:String,enum:["PENDING","SUCCESS","FAILED"],default:"PENDING"},payload:{type:mongoose.Schema.Types.Mixed,default:{}},result:{type:mongoose.Schema.Types.Mixed,default:{}},expiresAt:{type:Date,default:()=>new Date(+new Date+2592E6),index:{expires:"0s"}}},{timestamps:!0}),ActionLog=mongoose.model("actionLog",actionLogSchema);
+module.exports=ActionLog;

package/server/models/afflink.js

@@ -0,0 +1,2 @@
+const afflinkScheam=new Schema({id_app:{type:String,required:!0,maxlength:1024},title:{type:String,required:!0},page_link:{type:String,required:!0},of_user:String,da_truy_cap:{type:Number,default:0},da_dat_hang:{type:Number,default:0},status:{type:Boolean,default:!0},date_created:{type:Date,default:Date.now},date_updated:{type:Date,default:Date.now},user_created:{type:String,default:""},user_updated:{type:String,default:""}});
+(global.configs||{}).createIndexes&&(afflinkScheam.index({id_app:1}),afflinkScheam.index({status:1}),afflinkScheam.index({of_user:1}),afflinkScheam.index({user_created:1,visible_to:1,visible_to_users:1}));module.exports=mongoose.models.afflink||mongoose.model("afflink",afflinkScheam);

package/server/models/aimemory.js

@@ -0,0 +1 @@
+const mongoose=require("mongoose"),aiMemorySchema=new mongoose.Schema({id_app:{type:String,required:!0},user_id:{type:String,required:!0,index:!0},core_memories:[{type:String}],last_summarized_date:{type:Date,default:Date.now}},{timestamps:!0});module.exports=mongoose.model("aimemory",aiMemorySchema);

package/server/models/app.js

@@ -0,0 +1,16 @@
+const User=require("./user"),Participant=require("./participant"),_=require("lodash"),{runWithoutSession}=require("../libs/sessionContext"),appScheam=new global.Schema({menu_code:{type:String,uppercase:!0,trim:!0,maxlength:32},app_code:{type:String,uppercase:!0,trim:!0,maxlength:32},name:{type:String,required:!0,maxlength:1024},name_en:{type:String,maxlength:1024},short_name:{type:String,maxlength:1024},address:{type:String,maxlength:1024},address_en:{type:String,maxlength:1024},factory_address:{type:String,
+maxlength:1024},factory_address_en:{type:String,maxlength:1024},city:{type:String,maxlength:1024},province:{type:String,maxlength:1024},country:{type:String,maxlength:1024},phone:{type:String,maxlength:1024},fax:{type:String,maxlength:1024},email:{type:String,maxlength:1024},website:{type:String,maxlength:1024},sale_online:{type:Boolean,default:!1},facebook:{type:String,maxlength:2024},zalo:{type:String,maxlength:2024},messager:{type:String,maxlength:2024},bao_hanh:{type:String},van_chuyen:{type:String},
+dieu_khoan_su_dung:{type:String},dieu_khoan_su_dung_en:{type:String},dieu_khoan_kygui:{type:String},dieu_khoan_kygui_en:{type:String},dieu_khoan_congtacvien:{type:String},dieu_khoan_congtacvien_en:{type:String},chinh_sach_dau_tu:{type:String},chinh_sach_dau_tu_en:{type:String},gioi_thieu:{type:String},nganh_nghe:{type:String},keywords:{type:String},site_name:{type:String},ngay_dn:{type:Date,required:!0},ngay_ks:{type:Date,required:!0},nam_bd:{type:Number,required:!0},ngay_ky1:{type:Date,required:!0},
+ma_so_thue:{type:String,maxlength:1024},dia_chi_xuat_hoa_don:String,nguoi_nop_thue:{type:String,maxlength:1024},giam_doc:{type:String,maxlength:1024},ke_toan_truong:{type:String,maxlength:1024},ma_nganh_kd:{type:String,maxlength:1024},ten_nganh_kd:{type:String},ma_cqt:{type:String},ten_cqt:{type:String},wallet_address:{type:String,maxlength:2024},wallet_token:{type:String,maxlength:2024},exchange_fee:Number,wallet_network:{type:String,maxlength:2024},tang_duoc_gioi_thieu:Number,tang_gioi_thieu:Number,
+ty_le_hoa_hong:Number,tang_gioi_thieu_denom:String,ten_chu_tai_khoan:String,tai_khoan_ngan_hang:String,ten_ngan_hang:String,chi_nhanh_ngan_hang:String,so_bin:String,so_ngay_lam_mot_thang:{type:Number,default:24},logo:{type:String,maxlength:1024},logo_watermark:{type:String,maxlength:1024},account_types_accept:[],options:{},allow_modules:[String],partner:String,server:String,owner:String,default_password:String,google_credentials:String,email_host:String,email_port:Number,email_secure:{type:Boolean,
+default:!0},email_authMethod:{type:String,default:"LOGIN"},email_user:String,email_pass:String,email_name:String,invoice_service:String,viettel_version:{type:String,maxlength:1024},viettel_user:{type:String,maxlength:1024},viettel_password:{type:String,maxlength:1024},viettel_token:{type:String},viettel_url_service:{type:String,maxlength:1024},viettel_direct_issue:Boolean,ma_hoa_don:String,ky_hieu_hoa_don:String,so_serial:String,vnpt_user:{type:String,maxlength:1024},vnpt_password:{type:String,maxlength:1024},
+vnpt_url_service:{type:String,maxlength:1024},vnpt_ky_hieu_hoa_don:String,vnpt_so_serial:String,easy_user:{type:String,maxlength:1024},easy_password:{type:String,maxlength:1024},easy_url_service:{type:String,maxlength:1024},easy_ky_hieu_hoa_don:String,easy_so_serial:String,facebook_webhook_verify_token:String,facebook_webhook:String,sip_uri:String,sip_password:String,sip_websocket:String,voiip_access_token:String,voiip_webhook:String,zalo_app_id:String,zalo_secret_key:String,zalo_code:String,zalo_oa_id:String,
+zalo_code_verifier:String,zalo_code_challenge:String,zalo_access_token:String,zalo_refresh_token:String,zalo_expires_in:Number,zalo_updated:Date,zalo_otp_template_id:String,exfields:global.Schema.Types.Mixed,domain:String,ssl_key:String,ssl_cert:String,ssl_ca:String,ai_name:String,ai_api_key:String,ai_model:String,expire_date:Date,dung_luong_duoc_su_dung:Number,so_tai_lieu_duoc_su_dung:Number,trang_thai:{type:String,default:"0"},status:{type:Boolean,default:!0},date_created:{type:Date,default:Date.now},
+date_updated:{type:Date,default:Date.now},user_created:{type:String,default:""},user_updated:{type:String,default:""}});
+(global.configs||{}).createIndexes&&(appScheam.index({app_code:1},{unique:!0}),appScheam.index({name:1,province:1}),appScheam.index({menu_code:1}),appScheam.index({trang_thai:1}),appScheam.index({sale_online:1}),appScheam.index({date_created:1}),appScheam.index({date_updated:1}),appScheam.index({user_created:"text"},{name:"app_index_created"}),appScheam.index({name:"text",province:"text",name_en:"text",address:"text",phone:"text",email:"text",ma_so_thue:"text"},{name:"app_index"}));
+const App=global.mongoose.models.app||global.mongoose.model("app",appScheam);
+App.participants=async $app$$=>{_.isString($app$$)&&($app$$=await App.getInfo($app$$));let $participants$$=await Participant.find({id_app:$app$$._id});if($app$$.user_created&&!$participants$$.find($p$$=>$p$$.email===$app$$.user_created)){let $_p$$={email:$app$$.user_created,name:$app$$.user_created.split("@")[0],admin:!0,active:!0,cancel:!1,id_app:$app$$._id};$participants$$.push($_p$$);Participant.createParticipant($_p$$,$e$$=>{$e$$&&Logger.error("create participant for user owner",$e$$)})}return $participants$$};
+App.getInfo=async function($id_app$$,$field$$){return new Promise(($resolve$$,$reject$$)=>{App.findOne({_id:$id_app$$}).lean().then($rs$$=>{if(!$rs$$)return $reject$$(Error("App is not exists"));$resolve$$($field$$?$rs$$[$field$$]:$rs$$)}).catch($e$$=>{$reject$$($e$$)})})};
+App.emitEvent=function($id_app$$,$event$$,$_data$$,$c_token$$=null,$users$$=null,$_createNotify$$=!1,$_push$$=!0){runWithoutSession(()=>{App.findOne({_id:$id_app$$}).lean().then(async $app$$=>{$app$$&&($_data$$.company=$app$$.name,$_data$$.id_app=$id_app$$,$users$$?$users$$=$users$$.map($u$$=>({email:$u$$,name:$u$$})):($users$$=await App.participants($app$$),$users$$.find($u$$=>$app$$.user_created===$u$$.email)||$users$$.push({email:$app$$.user_created,name:$app$$.user_created})),$users$$.forEach(function($user$$){let $data$$=
+_.cloneDeep($_data$$);!$data$$.title||!$_createNotify$$&&$event$$?$event$$&&($data$$.app_info=$app$$,User.emitEvent($user$$.email,$event$$,$data$$,$_push$$,$c_token$$)):global.createNotification($data$$.user_updated||"SYSTEM",$user$$.email,$data$$.title,$data$$.body,($e$$,$notify$$)=>{$e$$?Logger.error("[app][emitEvent][createNotification]",$e$$):$event$$&&($notify$$&&($data$$.notify_id=$notify$$._id.toString()),$data$$.app_info=$app$$,User.emitEvent($user$$.email,$event$$,$data$$,$_push$$,$c_token$$))},
+$data$$,!$event$$,$c_token$$)}))}).catch($e$$=>{Logger.error($e$$)})})};module.exports=App;