free-be-account 0.0.14 → 0.0.16

package/index.js

@@ -51,12 +51,13 @@ const __getServiceList = async (res, filter = { Enabled: true }) => {
                     filter ? {} : {
                         Scope: filter ? undefined: doc.Scope.map(sc => {
                             const dso = res.app.getContainerContent('DataScope').find(ds => ds.Name === sc.Name);
-                            return {
-                                Label: dso ? dso.Label : '',
+                            return dso ? {
+                                Label: dso.Label || '',
                                 Field: `${sc.Name}`,
-                                Type: 'Select',
-                                Options: dso ? dso.Options : []
-                            }
+                                Type: dso.Component || 'Select',
+                                Options: dso.Options || [],
+                                Multiple: dso.Multiple || false,
+                            } : {};
                         })
                     })
                 }
@@ -204,6 +205,10 @@ module.exports = (app) => ({
         accountDefaultPassword: '12345678',
         accountDefaultPasswordRandom: false,
         accountDefaultPasswordRandomLength: 6,
+
+        autoCreateNewUser: false,
+        recoverNoSamePwd: false,
+
         // accountDefaultPermissions: [
         //     // could from system config
         //     // {
@@ -226,6 +231,7 @@ module.exports = (app) => ({
 
         dataScopes: [],
         permissionControls: [],
+        smsFormat: '6n',
         captcha: {
             cache: 5 * 60 * 1000,
             login: false,
@@ -366,6 +372,7 @@ module.exports = (app) => ({
             Description: { type: 'String' },
             Index: { type: 'Number', required: true },
             IsVirtual: { type: 'Boolean', default: false },
+            Profile: { type: 'Object', default: {} },
 
             Permission: { type: 'Object', default: {} },
         },
@@ -895,9 +902,43 @@ module.exports = (app) => ({
                                 // Password: password,
                                 Enabled: true,
                                 Deleted: false,
-                            }).then((user) => {
+                            }).then(async (user) => {
                                 if (!user) { 
-                                    return done(null, false); 
+                                    // auto create new user
+                                    if (m.config.autoCreateNewUser) {
+                                        const valid_phone = (d) => {
+                                            return /^(0|86|17951)?(13[0-9]|14[0-9]|15[0-9]|16[0-9]|17[0-9]|18[0-9]|19[0-9])[0-9]{8}$/.test(d);
+                                        };
+                                        const valid_email = (d) => {
+                                            // eslint-disable-next-line no-useless-escape
+                                            return /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(d);
+                                        }
+
+                                        const userPhoneEmail = {};
+                                        if (valid_phone(username)) {
+                                            userPhoneEmail.PhoneNumber = username;
+                                        } else if (valid_email(username)) {
+                                            userPhoneEmail['Profile'] = {
+                                                Email: username
+                                            };
+                                        }
+                                        
+                                        const permission = Object.assign({}, m.config.accountDefaultPermissions);
+                                        clearPermission(permission);
+                                        const newU = await app.models['account'].create({
+                                            Saved: true,
+                                            UserName: username,
+                                            Password: '',
+                                            Status: m.config.accountRequireAudit ? AccountAuditStatus.Auditing : AccountAuditStatus.Passed,
+                                            Permission: permission,
+                                            
+                                            // set phone number or email
+                                            ...userPhoneEmail,
+                                        });
+                                        return done(null, newU);
+                                    } else {
+                                        return done(null, false); 
+                                    }
                                 }
 
                                 const pwdVerified = verifyPassword(password, user.Password, m.config.pwdEncryptMethod || 'md5');
@@ -971,49 +1012,56 @@ module.exports = (app) => ({
             // permission control
             app.use(async (req, res, next) => {
                 // permission control
-                if (!await m.hasPermission(req, m)) {
-                    const whiteList = ((m.config && m.config['whiteList']) || []).concat([`${app.config['baseUrl'] || ''}/login`]);
-                    for (let i = 0; i < whiteList.length; i += 1) {
-                        const wl = whiteList[i];
-
-                        if (typeof wl === 'string' && wl.toLowerCase() === req.originalUrl.toLowerCase()) return next();
+                let inWhiteList = false;
+                const whiteList = ((m.config && m.config['whiteList']) || []).concat([`${app.config['baseUrl'] || ''}/login`]);
+                for (let i = 0; i < whiteList.length; i += 1) {
+                    const wl = whiteList[i];
+
+                    if (typeof wl === 'string' && wl.toLowerCase() === req.originalUrl.toLowerCase()) {
+                        inWhiteList = true;
+                        break;
+                    }
 
-                        if (typeof wl === 'object' && new RegExp(wl).test(req.originalUrl)) return next();
+                    if (typeof wl === 'object' && new RegExp(wl).test(req.originalUrl)) {
+                        inWhiteList = true;
+                        break;
                     }
+                }
 
+                if (inWhiteList) {
+                    await m.hasPermission(req, m)
+                    return next();
+                }
+                
+                if (!await m.hasPermission(req, m)) {
                     if (req.user && req.user.id) {
                         await res.endWithErr(400, 401);
                     }
                     else {
+                        res.clearCookie('token');
                         await res.endWithErr(401);
                     }
 
                     return;
                 }
 
-                return next();
-            });
+                // update token in cookies
+                const token = req.cookies.token;
+                if (token) {
+                    res.cookie('token', token, { maxAge: app.config['cookieTimeout'] });
+                }
 
-            // check for force reset pwd
-            app.use(async (req, res, next) => {
+                // check for force reset pwd
                 const resetP = m.config && m.config['forceResetPwd'];
 
-                if(resetP) {
-                    if (req.user && req.user.id) {
-                        const updateAt = req.user.PwdUpdatedAt || req.user.CreatedDate || req.user.LastUpdateDate;
-                        const pastP = new Date() - updateAt;
+                if(resetP && req.user && req.user.id) {
+                    const updateAt = req.user.PwdUpdatedAt || req.user.CreatedDate || req.user.LastUpdateDate;
+                    const pastP = new Date() - updateAt;
 
-                        if(pastP > (resetP * 24 * 3600 * 1000)) {
-                            await res.endWithErr(403, 'RSTPWD');
-                        } else {
-                            return next();
-                        }
-                    }
-                    else {
-                        await res.endWithErr(401);
+                    if(pastP > (resetP * 24 * 3600 * 1000)) {
+                        await res.makeError(403, 'RSTPWD');
+                        return next('route');
                     }
-
-                    return;
                 }
 
                 return next();
@@ -1127,17 +1175,17 @@ module.exports = (app) => ({
                             { 'Profile.Email': phone },
                         ]});
     
-                        if (req.body.exists && existsCount <= 0) {
+                        if (req.body.exists === true && existsCount <= 0) {
                             res.makeError(409, 'User not exists!', m);
                             return next('route');
                         }
-                        if (!req.body.exists && existsCount > 0) {
+                        if (req.body.exists === false && existsCount > 0) {
                             res.makeError(410, 'User aleady exists!', m);
                             return next('route');
                         }
                     }
 
-                    const result = await m.sms.sendRandom(phone, undefined, true, req.body.smsTemp || 'register');
+                    const result = await m.sms.sendRandom(phone, m.config.smsFormat || undefined, true, req.body.smsTemp || 'register');
 
                     if (!result) {
                         res.makeError(500, 'Failed to send sms!', m);
@@ -1220,16 +1268,52 @@ module.exports = (app) => ({
                         }
                     }
 
-                    const existPhone = await res.app.models.account.countDocuments({ PhoneNumber: phone });
-                    if (existPhone) {
-                        res.makeError(404, 'The phone number was used already!', m);
-                        return next('route');
+                    const valid_phone = (d) => {
+                        return /^(0|86|17951)?(13[0-9]|14[0-9]|15[0-9]|16[0-9]|17[0-9]|18[0-9]|19[0-9])[0-9]{8}$/.test(d);
+                    };
+                    const valid_email = (d) => {
+                        // eslint-disable-next-line no-useless-escape
+                        return /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(d);
+                    }
+
+                    const userPhoneEmail = {};
+                    let isPhone = false;
+                    let isEmail = false;
+
+                    if (valid_phone(phone)) {
+                        userPhoneEmail.PhoneNumber = phone;
+                        isPhone = true;
+                    } else if (valid_email(phone)) {
+                        isEmail = true;
+                        userPhoneEmail.UserName = phone;
+                        userPhoneEmail['Profile'] = {
+                            Email: phone
+                        };
+                    } else {
+                        userPhoneEmail.UserName = phone;
+                    }
+
+                    if (isPhone) {
+                        const existPhone = await res.app.models.account.countDocuments({ PhoneNumber: phone });
+                        if (existPhone) {
+                            res.makeError(404, 'The phone number was used already!', m);
+                            return next('route');
+                        }
+                    }
+
+                    if (isEmail) {
+                        const existPhone = await res.app.models.account.countDocuments({ 'Profile.Email': phone });
+                        if (existPhone) {
+                            res.makeError(405, 'The email address was used already!', m);
+                            return next('route');
+                        }
                     }
 
                     // only create with specified fields
                     res.locals.body = {
                         Saved: true,
-                        PhoneNumber: phone,
+                        // PhoneNumber: phone,
+                        ...userPhoneEmail,
                         Password: encryptPwd(password, m.config.pwdEncryptMethod || 'md5')
                     }
 
@@ -1280,14 +1364,32 @@ module.exports = (app) => ({
                     }
 
                     // only create with specified fields
-                    res.locals.body = {
-                        Password: encryptPwd(password, m.config.pwdEncryptMethod || 'md5')
+                    if (m.config.recoverNoSamePwd) {
+                        let oldPwd = req.user && req.user.Password;
+                        if (!oldPwd) {
+                            const theUser = await res.app.models.account.findOne({$or: [
+                                { PhoneNumber: phone },
+                                { 'Profile.Email': phone },
+                            ]});
+    
+                            oldPwd = theUser && theUser.Password;
+                        }
+
+                        if (oldPwd && verifyPassword(password, oldPwd, m.config.pwdEncryptMethod || 'md5')) {
+                            res.makeError(406, 'New password cannot be the same as the old one!', m);
+                            return next('route');
+                        }
                     }
 
-                    res.locals.filter = {
-                        PhoneNumber: phone
+                    res.locals.body = {
+                        Password: encryptPwd(password, m.config.pwdEncryptMethod || 'md5'),
                     }
 
+                    res.locals.filter = {$or: [
+                        { PhoneNumber: phone },
+                        { 'Profile.Email': phone },
+                    ]}
+
                     return next();
                 },
                 app.UpdateDocument('account', false, (req, res) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-be-account",
-  "version": "0.0.14",
+  "version": "0.0.16",
   "main": "index.js",
   "license": "UNLICENSED",
   "repository": {
@@ -9,14 +9,14 @@
   },
   "dependencies": {
     "@alicloud/pop-core": "^1.7.13",
-    "axios": "^1.4.0",
-    "bcrypt": "^5.1.0",
-    "crypto-js": "^4.1.1",
+    "axios": "^1.6.8",
+    "bcrypt": "^5.1.1",
+    "crypto-js": "^4.2.0",
     "js-md5": "^0.7.3",
-    "nodemailer": "^6.9.2",
+    "nodemailer": "^6.9.13",
     "passport": "^0.6.0",
     "passport-local": "^1.0.0",
     "svg-captcha": "^1.4.0",
-    "uuid": "^9.0.0"
+    "uuid": "^9.0.1"
   }
 }

package/routers/mgmt/route.js

@@ -4,26 +4,26 @@ const router = express.Router();
 const { AccountAuditStatus } = require('../../enum');
 const { clearPermission, encryptPwd, crypto } = require('../../utils');
 
-// TODO: i18n translate
 const accountFilters = [
+    {
+        Name: 'id',
+        Type: 'String',
+        Info: {
+            Separate: true,
+        },
+    },
     {
         Name: 'LastUpdateDate',
         Type: 'DateRange',
-        Label: '更新日期',
-        Placeholder: '请选择',
     },
     {
         Name: 'Enabled',
         Type: 'Select',
-        Label: '激活状态',
-        Placeholder: '请选择',
         Options: [
             {
-                Label: '已激活',
                 Value: true,
             },
             {
-                Label: '未激活',
                 Value: false,
             },
         ],
@@ -31,22 +31,18 @@ const accountFilters = [
     {
         Name: 'Profile.Name',
         Type: 'String',
-        Label: '姓名',
     },
     {
         Name: 'Profile.Title',
         Type: 'String',
-        Label: '职务',
     },
     {
         Name: 'PhoneNumber',
         Type: 'String',
-        Label: '手机号',
     },
     {
         Name: 'UserName',
         Type: 'String',
-        Label: '用户名',
     },
 ];
 

package/routers/org/route.js

@@ -9,7 +9,8 @@ router.get('/',
             'Name',
             'Index',
             'IsVirtual',
-            'Permission'
+            'Permission',
+            'Profile',
         ];
         res.locals.filter = {
             Parent: req.query.Parent || {

package/routers/uc/info/route.js

@@ -29,6 +29,8 @@ router.get('/', (req, res, next) => {
         Status: user.Status,
 
         StepsDefinition,
+
+        ar: router.mdl.config.accountRequireAudit,
     });
 
     return next();
@@ -61,7 +63,15 @@ router.post('/edit', async (req, res, next) => {
     res.app.modules.account.utils.clearPermission(p);
 
     // TODO: should not use mongoose directly
-    await res.app.models['account'].update({ id: req.user.id }, { $unset: { Status: 0 }, $set: { Permission: p } });
+    const setObj = {
+        $set: { Permission: p }
+    };
+
+    if (router.mdl.config.accountRequireAudit) {
+        Object.assign(setObj, { $unset: { Status: 0 } });
+    }
+
+    await res.app.models['account'].update({ id: req.user.id }, setObj);
 
     res.addData({});
 
@@ -79,14 +89,16 @@ router.post('/submit',
             res.locals.body.Profile = {...user.Profile, ...req.body.Profile};
         }
 
-        res.locals.body.Status = res.app.modules.account.AccountAuditStatus.Auditing;
+        if (router.mdl.config.accountRequireAudit) {
+            res.locals.body.Status = router.mdl.AccountAuditStatus.Auditing;
+        }
 
         // set to default permission 
-        const p = res.app.modules.account.config.accountDefaultPermissions;
+        const p = router.mdl.config.accountDefaultPermissions;
         res.app.modules.account.utils.clearPermission(p);
         res.locals.body.Permission = p;
 
-        res.locals.filters = { id: req.user.id };
+        res.locals.filter = { id: req.user.id };
         res.locals.fields = [
             'Profile',
             'Status',

package/routers/uc/phone/route.js

@@ -63,7 +63,7 @@ router.put('/',
             res.locals.body.UserName = res.locals.body.PhoneNumber;
         }
 
-        res.locals.filters = { id: req.user.id };
+        res.locals.filter = { id: req.user.id };
         res.locals.fields = [
             'PhoneNumber',
             'Password',

package/routers/uc/pwd/route.js

@@ -34,7 +34,7 @@ router.put('/',
         res.locals.body = {};
         res.locals.body.Password = res.app.modules.account.utils.encryptPwd(password, res.app.modules.account.config.pwdEncryptMethod || 'md5');
 
-        res.locals.filters = { id: req.user.id };
+        res.locals.filter = { id: req.user.id };
         res.locals.fields = [
             'password',
         ];

package/sms/index.js

@@ -129,7 +129,13 @@ module.exports = (app) => ({
             t = `${t}_mail`;
         }
 
-        const keys = (global && global.sms && global.sms[t]) || app.modules.account.config.sms.keys[t] || app.modules.account.config.sms.keys;
+        let keys = app.modules.account.config.sms.keys[t] || app.modules.account.config.sms.keys;
+
+        if (!keys.platform) {
+            keys = (global && global.sms && global.sms[t]);
+        }
+        
+        // const keys = (global && global.sms && global.sms[t]) || app.modules.account.config.sms.keys[t] || app.modules.account.config.sms.keys;
         
         if (keys.platform) {
             // should not send too frequent!

package/utils.js

@@ -60,7 +60,7 @@ function clearPermission(perm) {
     return clearP(perm);
 }
 
-function verifyPassword(pwd, storedPwd, method = 'md5') {
+function verifyPassword(pwd, storedPwd = '', method = 'md5') {
     let verified = false;
     let methods = [];
 
@@ -77,7 +77,7 @@ function verifyPassword(pwd, storedPwd, method = 'md5') {
                 verified = verified || (crypto.MD5(pwd) === storedPwd);
                 break;
             case 'sha1':
-                verified = verified || (crypto.sha1(pwd, storedPwd.substr(0, EncryptOptions.saltLength), EncryptOptions.sha1Iteration).toString() === storedPwd.substr(EncryptOptions.saltLength));
+                verified = verified || (crypto.sha1(pwd, storedPwd.substring(0, EncryptOptions.saltLength), EncryptOptions.sha1Iteration).toString() === storedPwd.substr(EncryptOptions.saltLength));
                 break;
             case 'bcrypt':
                 verified = verified || crypto.bcryptVerify(pwd, storedPwd);
@@ -132,6 +132,12 @@ async function saveServiceList (app, clean=false) {
         for (let i = 0; i < Object.keys(perm).length; i += 1) {
             const p = Object.keys(perm)[i];
 
+            // in case the developer didn't provide title and description information
+            perm[p] = perm[p] || {
+                title: p,
+                description: p,
+            };
+
             // TODO: notify user if they are creating permission with these names
             if (['title', 'description', 'scope', 'label'].indexOf(p.toLowerCase()) >= 0) continue;