jxp 2.16.0 → 3.0.0

package/.vscode/launch.json

@@ -19,11 +19,16 @@
                 "-u",
                 "tdd",
                 "--timeout",
-                "999999",
+                "30000",
                 "--colors",
+                "--exit",
+                "--bail",
                 "${workspaceFolder}/test"
             ],
-            "internalConsoleOptions": "openOnSessionStart"
+            "internalConsoleOptions": "openOnSessionStart",
+            "env": {
+                "NODE_ENV": "test"
+            }
         }
     ]
 }

package/bin/server.js

@@ -26,9 +26,9 @@ config.callbacks = {
 	// 	console.log("Delete callback");
 	// }
 
-	post: function() {},
-	put: function() {},
-	delete: function() {}
+	post: function () { },
+	put: function () { },
+	delete: function () { }
 };
 
 config.pre_hooks = {
@@ -56,7 +56,19 @@ config.pre_hooks = {
 mongoose.Promise = Promise;
 if (!config.mongo) config.mongo = {};
 if (!config.mongo.options) config.mongo.options = {};
-const mongo_options = Object.assign(config.mongo.options, {});
+const mongo_options = Object.assign(config.mongo.options, {
+	useNewUrlParser: true,
+	useUnifiedTopology: true,
+	serverSelectionTimeoutMS: 10000,
+	socketTimeoutMS: 45000,
+	maxPoolSize: process.env.NODE_ENV === 'test' ? 20 : 50,
+	minPoolSize: process.env.NODE_ENV === 'test' ? 5 : 10,
+	maxIdleTimeMS: 30000,
+	connectTimeoutMS: 10000,
+	heartbeatFrequencyMS: 10000,
+	retryWrites: true,
+	retryReads: true
+});
 
 const connection_string = require("../libs/connection_string");
 console.log(`Connecting to ${connection_string}`);
@@ -65,18 +77,53 @@ mongoose.connect(connection_string, mongo_options);
 const db = mongoose.connection;
 
 // mongodb error
-db.on('error', console.error.bind(console, 'connection error:'));
+db.on('error', (err) => {
+	console.error('MongoDB connection error:', err);
+	if (err.name === 'MongoNetworkError') {
+		// Handle network errors
+		console.error('Network error occurred. Attempting to reconnect...');
+	}
+});
 
 // mongodb connection open
 db.once('open', () => {
 	console.log(`Connected to Mongo at: ${new Date()}`);
+	console.log('Connection pool size:', mongoose.connection.base.connections.length);
 });
 
+mongoose.connection.on('connected', () => {
+	console.log('Mongoose connected');
+	console.log('Connection pool size:', mongoose.connection.base.connections.length);
+});
+
+mongoose.connection.on('disconnected', () => {
+	console.log('Mongoose disconnected');
+	// Attempt to reconnect after a delay
+	setTimeout(() => {
+		mongoose.connect(connection_string, mongo_options).catch(err => {
+			console.error('Failed to reconnect to MongoDB:', err);
+		});
+	}, 5000);
+});
+
+mongoose.connection.on('error', (err) => {
+	console.error('Mongoose connection error:', err);
+});
+
+// Monitor connection pool
+setInterval(() => {
+	const poolSize = mongoose.connection.base.connections.length;
+	const maxPoolSize = mongo_options.maxPoolSize;
+	if (poolSize > maxPoolSize * 0.8) {
+		console.warn(`Connection pool is at ${Math.round((poolSize / maxPoolSize) * 100)}% capacity`);
+	}
+}, 30000);
+
 var server = new JXP(config);
 
 let port = process.env.NODE_DOCKER_PORT || process.env.PORT || config.port || 4001;
 if (process.env.NODE_ENV === "test") port = 4005;
-server.listen(port, function() {
+server.listen(port, function () {
 	console.log('%s listening at %s', `${pkg.name} v${pkg.version}`, server.url);
 	console.log(`Mongoose version ${mongoose.version}`);
 });

package/docs/authentication.md

@@ -179,5 +179,5 @@ Header: `Authorization: Bearer <your bearer token>`
 
 ### API Key
 
-The API Key is a permanent key that doesn't expire. It can be used by adding `?apikey=<apikey>` to the end of any request, or sending `apikey: <apikey>` in the header. 
+The API Key is a permanent key that doesn't expire. It can be used by adding `?apikey=<apikey>` to the end of any request, or sending `x-api-key: <apikey>` in the header. 
 

package/libs/login.js

@@ -65,7 +65,7 @@ const logout = async (req, res) => {
 		if (!res.user) throw new errors.ForbiddenError("You don't seem to be logged in");
 		await security.revokeToken(res.user._id);
 		res.send({ status: "ok", message: "User logged out" });
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
 		if (err.code) throw err;
 		throw new errors.InternalServerError(err.toString());
@@ -148,13 +148,17 @@ const login = async (req, res) => {
 	}
 	if ((!password) || (!email)) {
 		console.error(new Date(), "Missing email or password parameters");
-		return new errors.ForbiddenError("Missing email or password parameters");
+		throw new errors.ForbiddenError("Missing email or password parameters");
 	}
 	try {
 		const user = await User.findOne({ email });
-		if (!user) throw (`Incorrect email; email: ${email}`);
+		if (!user) {
+			console.error(new Date(), `Authentication failed - user not found`, ip, email);
+			throw new errors.ForbiddenError("Incorrect email or password");
+		}
 		if (!(await bcrypt.compare(password, user.password))) {
-			throw (`Incorrect password; email: ${email}`);
+			console.error(new Date(), `Authentication failed - invalid password`, ip, email);
+			throw new errors.ForbiddenError("Incorrect email or password");
 		}
 		const token = await security.refreshToken(user._id);
 		const refreshtoken = await security.ensureRefreshToken(user._id);
@@ -171,7 +175,7 @@ const login = async (req, res) => {
 	} catch (err) {
 		console.error(new Date(), `Authentication failed`, ip, err);
 		if (err.code) throw err;
-		return new errors.ForbiddenError(err.toString());
+		throw new errors.ForbiddenError("Incorrect email or password");
 	}
 }
 

package/libs/security.js

@@ -9,7 +9,7 @@ var User = null;
 var RefreshToken = null;
 var provider = "https://api.workspaceman.nl";
 
-const init = function(config) {
+const init = function (config) {
 	APIKey = require(path.join(config.model_dir, "apikey_model"));
 	Groups = require(path.join(config.model_dir, "usergroups_model.js"));
 	User = require(path.join(config.model_dir, "user_model"));
@@ -18,7 +18,7 @@ const init = function(config) {
 	if (config.url) provider = config.url;
 };
 
-const basicAuthData = function(req) {
+const basicAuthData = function (req) {
 	if (!req.headers.authorization) {
 		return false;
 	}
@@ -34,19 +34,19 @@ const basicAuthData = function(req) {
 const basicAuth = async ba => {
 	try {
 		if (!Array.isArray(ba) || ba.length !== 2) {
-			throw("Basic Auth incorrectly formatted");
+			throw ("Basic Auth incorrectly formatted");
 		}
 		var email = ba[0];
 		var password = ba[1];
 		const user = await User.findOne({ email }).exec();
 		if (!user) {
-			throw(new Date(), `Incorrect username or password for ${email}`);
+			throw (new Date(), `Incorrect username or password for ${email}`);
 		}
 		if (!await bcrypt.compare(password, user.password)) {
-			throw(`Incorrect username or password for ${email}`);
+			throw (`Incorrect username or password for ${email}`);
 		}
 		return user;
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		throw err;
 	}
@@ -66,13 +66,13 @@ const bearerAuthData = req => {
 
 const bearerAuth = async t => {
 	try {
-		if (!t) throw("Token invalid");
+		if (!t) throw ("Token invalid");
 		const token = await Token.findOne({ access_token: t, provider }).exec();
 		if (!token) {
-			throw(`Token ${t} not found`);
+			throw (`Token ${t} not found`);
 		}
 		if (!tokenIsValid(token)) {
-			throw(`Token is no loger valid`);
+			throw (`Token is no loger valid`);
 		}
 		const user = await User.findOne({ _id: token.user_id }).exec();
 		if (!user) {
@@ -87,13 +87,13 @@ const bearerAuth = async t => {
 
 const apiKeyAuth = async apikey => {
 	try {
-		if (!apikey) throw("Missing apikey");
+		if (!apikey) throw ("Missing apikey");
 		const result = await APIKey.findOne({ apikey });
-		if (!result) throw("Could not find apikey");
+		if (!result) throw ("Could not find apikey");
 		const user = User.findOne({ _id: result.user_id });
-		if (!user) throw("Could not find user associated to apikey");
+		if (!user) throw ("Could not find user associated to apikey");
 		return user;
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		throw err;
 	}
@@ -104,7 +104,7 @@ const getGroups = async user_id => {
 		const userGroup = await Groups.findOne({ user_id });
 		var groups = userGroup && userGroup.groups ? userGroup.groups : [];
 		return groups;
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		throw err;
 	}
@@ -126,7 +126,7 @@ const generateApiKey = async user_id => {
 		apikey.apikey = randToken.generate(16);
 		await apikey.save();
 		return apikey;
-	} catch(err) {
+	} catch (err) {
 		console.error(new Date(), err);
 		throw err;
 	}
@@ -208,10 +208,10 @@ const revokeRefreshToken = async user_id => {
 
 const refresh = async (req, res) => {
 	try {
-		if(req.headers.authorization && req.headers.authorization.trim().toLowerCase().indexOf("bearer") === 0) {
+		if (req.headers.authorization && req.headers.authorization.trim().toLowerCase().indexOf("bearer") === 0) {
 			const refresh_token = await RefreshToken.findOne({ refresh_token: bearerAuthData(req) }).exec();
-			if (!refresh_token) throw("Refresh token not found");
-			if (!tokenIsValid(refresh_token)) throw("Refresh token has expired");
+			if (!refresh_token) throw ("Refresh token not found");
+			if (!tokenIsValid(refresh_token)) throw ("Refresh token has expired");
 			const user_id = refresh_token.user_id;
 			const token = await refreshToken(user_id);
 			await revokeRefreshToken(user_id);
@@ -224,7 +224,7 @@ const refresh = async (req, res) => {
 				refresh_token_expires: tokenExpires(new_refresh_token)
 			});
 		} else {
-			throw("Missing refresh token")
+			throw ("Missing refresh token")
 		}
 	} catch (err) {
 		console.error(err);
@@ -242,7 +242,7 @@ const login = async (req, res) => {
 			return;
 		}
 		res = Object.assign(res, authenticate_result);
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
 		if (err.code) throw err;
 		throw new errors.ForbiddenError(err.toString());
@@ -264,7 +264,7 @@ const authenticate = async req => {
 		user = await apiKeyAuth(req.query.apikey);
 	} else if (req.headers["X-API-Key"] || req.headers["x-api-key"]) {
 		// API Key
-		user = await apiKeyAuth(req.query.apikey || req.headers["X-API-Key"] || req.headers["x-api-key"])
+		user = await apiKeyAuth(req.headers["X-API-Key"] || req.headers["x-api-key"])
 	} else {
 		throw ("Could not find any way to authenticate");
 	}
@@ -278,7 +278,7 @@ const authenticate = async req => {
 		username: user.email,
 		user
 	}
-	
+
 }
 
 const auth = async (req, res) => {
@@ -303,7 +303,7 @@ const auth = async (req, res) => {
 			throw new errors.InternalServerError(`Unsupported operation: ${req.method}`);
 		}
 		return await check_perms(res.user, res.groups, req.Model, method, req.params.item_id);
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
 		if (err.code) throw err;
 		throw new errors.ForbiddenError(err.toString());
@@ -355,7 +355,7 @@ const check_perms = async (user, groups, model, method, item_id) => {
 		}
 		//Group check
 		for (let group of groups) {
-			if (perms[group] && perms[group].includes(method) ) {
+			if (perms[group] && perms[group].includes(method)) {
 				// console.log("Matched permission '" + group + "':" + method);
 				return;
 			}

package/libs/ws.js

@@ -235,24 +235,47 @@ class WSClient {
 wss.on('connection', function connection(ws) {
     try {
         const client = new WSClient(ws);
-        // clients[client.id] = client;
+        const startTime = Date.now();
+        console.log(`New WebSocket connection established at ${new Date()}`);
+
         ws.on('message', async function message(msg) {
+            const messageStartTime = Date.now();
             try {
-                console.log(`Received message from ${client.id}`);
+                console.log(`Received message from ${client.id} at ${new Date()}`);
                 const result = await client.receive(msg);
                 ws.send(JSON.stringify(result));
+                console.log(`Message processed in ${Date.now() - messageStartTime}ms`);
             } catch (err) {
                 console.error("message error", err);
+                console.error(`Message processing failed after ${Date.now() - messageStartTime}ms`);
             }
         });
+
         ws.on('close', function close() {
+            const connectionDuration = Date.now() - startTime;
             if (client.user) {
-                console.log(`Close ${client.user.name} <${client.user.email}>`);
+                console.log(`Connection closed for ${client.user.name} <${client.user.email}> after ${connectionDuration}ms`);
             } else {
-                console.log(`Close anonymous connection`);
+                console.log(`Anonymous connection closed after ${connectionDuration}ms`);
             }
             client.close();
         });
+
+        // Add ping/pong monitoring
+        const pingInterval = setInterval(() => {
+            if (ws.readyState === ws.OPEN) {
+                const pingStart = Date.now();
+                ws.ping();
+                ws.once('pong', () => {
+                    const latency = Date.now() - pingStart;
+                    if (latency > 1000) { // Alert if latency > 1 second
+                        console.warn(`High WebSocket latency detected: ${latency}ms`);
+                    }
+                });
+            }
+        }, 30000);
+
+        ws.on('close', () => clearInterval(pingInterval));
     } catch (err) {
         console.error("connection error", err);
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jxp",
   "description:": "An opinionated RESTful API library based on Mongoose and Restify. Make an API by just writing Mongoose models.",
-  "version": "2.16.0",
+  "version": "3.0.0",
   "private": false,
   "main": "libs/jxp.js",
   "scripts": {
@@ -33,7 +33,7 @@
     "bcryptjs": "^3.0.2",
     "commander": "^13.1.0",
     "config": "^3.3.12",
-    "dotenv": "^16.4.7",
+    "dotenv": "^16.5.0",
     "glob": "11.0.1",
     "js-yaml": "4.1.0",
     "json2csv": "^5.0.7",
@@ -46,7 +46,7 @@
     "mongoose-friendly": "^0.1.4",
     "morgan": "^1.10.0",
     "node-cache": "^5.1.2",
-    "nodemailer": "^6.10.0",
+    "nodemailer": "^6.10.1",
     "nodemailer-smtp-transport": "^2.7.4",
     "path": "^0.12.7",
     "pug": "^3.0.3",

package/test/auth.js

@@ -0,0 +1,190 @@
+process.env.NODE_ENV = 'test';
+
+var chai = require('chai');
+var chaiHttp = require('chai-http');
+
+var init = require("./init");
+var server = require("../bin/server");
+
+chai.use(chaiHttp);
+
+describe('Authentication Tests', () => {
+    before(async function () {
+        // First empty collections
+        await init.empty_user_collections();
+        console.log("Emptied collections");
+
+        // Then run setup
+        await new Promise((resolve, reject) => {
+            chai.request(server)
+                .post("/setup")
+                .send({ email: init.email, password: init.password })
+                .end((err, res) => {
+                    if (err) return reject(err);
+                    res.should.have.status(200);
+                    res.body.status.should.equal('success');
+                    console.log("Setup complete with email:", init.email);
+                    resolve();
+                });
+        });
+    });
+
+    var apikey = null;
+    var token = null;
+    var refresh_token = null;
+    var user_id = null;
+
+    describe("Login", () => {
+        it("should login with valid credentials", (done) => {
+            chai.request(server)
+                .post("/login")
+                .send({ email: init.email, password: init.password })
+                .end((err, res) => {
+                    res.should.have.status(200);
+                    res.body.should.have.property('user_id');
+                    res.body.should.have.property('apikey');
+                    res.body.should.have.property('token');
+                    res.body.should.have.property('token_expires');
+                    res.body.should.have.property('refresh_token');
+                    res.body.should.have.property('refresh_token_expires');
+                    res.body.should.have.property('provider');
+                    apikey = res.body.apikey;
+                    token = res.body.token;
+                    user_id = res.body.user_id;
+                    refresh_token = res.body.refresh_token;
+                    done();
+                });
+        });
+
+        it("should fail with invalid credentials", (done) => {
+            console.log("Attempting login with invalid password for:", init.email);
+            chai.request(server)
+                .post("/login")
+                .send({ email: init.email, password: "wrongpassword" })
+                .end((err, res) => {
+                    if (err) return done(err);
+                    console.log("Response status:", res.status);
+                    console.log("Response body:", res.body);
+                    res.should.have.status(403);
+                    done();
+                });
+        });
+    });
+
+    describe("Token Authentication", () => {
+        it("should authenticate with valid token", (done) => {
+            chai.request(server)
+                .get("/api/user")
+                .set("Authorization", `Bearer ${token}`)
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(200);
+                    res.body.data.should.be.an('array');
+                    done();
+                });
+        });
+
+        it("should fail with invalid token", (done) => {
+            chai.request(server)
+                .get("/api/user")
+                .set("Authorization", "Bearer invalidtoken")
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(403);
+                    done();
+                });
+        });
+    });
+
+    describe("API Key Authentication", () => {
+        it("should authenticate with valid API key in header", (done) => {
+            chai.request(server)
+                .get("/api/user")
+                .set("X-API-Key", apikey)
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(200);
+                    res.body.data.should.be.an('array');
+                    done();
+                });
+        });
+
+        it("should authenticate with valid API key in query", (done) => {
+            chai.request(server)
+                .get(`/api/user?apikey=${apikey}`)
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(200);
+                    res.body.data.should.be.an('array');
+                    done();
+                });
+        });
+
+        it("should fail with invalid API key", (done) => {
+            chai.request(server)
+                .get("/api/user")
+                .set("X-API-Key", "invalidapikey")
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(403);
+                    done();
+                });
+        });
+    });
+
+    describe("Refresh Token", () => {
+        it("should refresh token successfully", (done) => {
+            chai.request(server)
+                .post("/refresh")
+                .set("Authorization", `Bearer ${refresh_token}`)
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(200);
+                    res.body.should.have.property('token');
+                    res.body.should.have.property('token_expires');
+                    res.body.should.have.property('refresh_token');
+                    res.body.should.have.property('refresh_token_expires');
+                    res.body.token.should.not.eql(token);
+                    res.body.refresh_token.should.not.eql(refresh_token);
+                    token = res.body.token;
+                    refresh_token = res.body.refresh_token;
+                    done();
+                });
+        });
+
+        it("should fail with invalid refresh token", (done) => {
+            chai.request(server)
+                .post("/refresh")
+                .set("Authorization", "Bearer invalidrefreshtoken")
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(403);
+                    done();
+                });
+        });
+    });
+
+    describe("Logout", () => {
+        it("should logout successfully", (done) => {
+            chai.request(server)
+                .get("/login/logout")
+                .set("Authorization", `Bearer ${token}`)
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(200);
+                    done();
+                });
+        });
+
+        it("should not be able to use token after logout", (done) => {
+            chai.request(server)
+                .get("/api/user")
+                .set("Authorization", `Bearer ${token}`)
+                .end((err, res) => {
+                    if (err) return done(err);
+                    res.should.have.status(403);
+                    done();
+                });
+        });
+    });
+}); 

package/test/init.js

@@ -15,9 +15,9 @@ const security = require("../libs/security");
 const empty = async model => {
 	try {
 		await model.deleteMany({});
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
-		throw(err);
+		throw (err);
 	}
 };
 
@@ -44,9 +44,9 @@ const init = async () => {
 		await post(User, { name: "Admin User", email: admin_email, password: security.encPassword(admin_password), urlid: "admin-user", admin: true });
 		await post(User, { name: "Test User", email, password: security.encPassword(password), urlid: "test-user" });
 		return true;
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
-		throw(err);
+		throw (err);
 	}
 };
 
@@ -55,9 +55,9 @@ const empty_user_collections = async () => {
 		await empty(User);
 		await empty(Apikey);
 		await empty(Test);
-	} catch(err) {
+	} catch (err) {
 		console.error(err);
-		throw(err);
+		throw (err);
 	}
 }