kempo 4.2.4 → 4.2.5

package/server/utils/auth/changePassword.js

@@ -0,0 +1,27 @@
+import bcrypt from 'bcrypt';
+import db from '../../db/index.js';
+import { user } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async (userId, newPassword) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!newPassword){
+    return [{ code: 400, msg: 'New password is required' }, null];
+  }
+  
+  try {
+    const newPasswordHash = await bcrypt.hash(newPassword, 10);
+    
+    await db
+      .update(user)
+      .set({ passwordHash: newPasswordHash, updatedAt: new Date() })
+      .where(eq(user.id, userId));
+    
+    return [null, { success: true }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to change password' }, null];
+  }
+};

package/server/utils/auth/getSession.js

@@ -0,0 +1,35 @@
+import db from '../../db/index.js';
+import { session, user } from '../../db/schema.js';
+import { eq, and, gt } from 'drizzle-orm';
+
+export default async ({ token }) => {
+  if(!token){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  try {
+    const result = await db
+      .select({
+        session: session,
+        user: user,
+      })
+      .from(session)
+      .innerJoin(user, eq(session.userId, user.id))
+      .where(and(
+        eq(session.token, token),
+        gt(session.expiresAt, new Date())
+      ))
+      .limit(1);
+    
+    if(result.length === 0){
+      return [{ code: 404, msg: 'Session not found or expired' }, null];
+    }
+    
+    return [null, {
+      session: result[0].session,
+      user: result[0].user,
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to retrieve session' }, null];
+  }
+};

package/server/utils/auth/loginEmail.js

@@ -0,0 +1,66 @@
+import bcrypt from 'bcrypt';
+import db from '../../db/index.js';
+import { user } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import getSetting from '../settings/getSetting.js';
+import createSession from '../sessions/createSession.js';
+
+export default async (email, password) => {
+  if(!email){
+    return [{ code: 400, msg: 'Email is required' }, null];
+  }
+  
+  if(!password){
+    return [{ code: 400, msg: 'Password is required' }, null];
+  }
+  
+  try {
+    /*
+      Get the User
+    */
+    const existingUser = await db.select().from(user).where(eq(user.email, email)).limit(1);
+    if(existingUser.length === 0){
+      return [{ code: 401, msg: 'Invalid email or password' }, null];
+    }
+    const {
+      emailVerified,
+      id: userId,
+      name,
+      passwordHash
+    } = existingUser[0];
+    
+    /*
+      Is verification required? If so are they verified?
+    */
+    const [settingError, requireEmailVerification] = await getSetting('system', 'require_email_verification', false);
+    if(settingError){
+      return [settingError, null];
+    }
+    
+    if(requireEmailVerification && !emailVerified){
+      return [{ code: 403, msg: 'Please verify your email before logging in. Check your inbox for the verification link.' }, null];
+    }
+    
+    if(!await bcrypt.compare(password, passwordHash)){
+      return [{ code: 401, msg: 'Invalid email or password' }, null];
+    }
+    
+    const [sessionError, sessionData] = await createSession(userId);
+    if(sessionError){
+      return [sessionError, null];
+    }
+    
+    return [null, {
+      user: {
+        id: userId,
+        email,
+        name,
+        emailVerified
+      },
+      sessionToken: sessionData.sessionToken,
+      expiresAt: sessionData.expiresAt,
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to login' }, null];
+  }
+};

package/server/utils/auth/logout.js

@@ -0,0 +1,16 @@
+import db from '../../db/index.js';
+import { session } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+export default async ({ token }) => {
+  if(!token){
+    return [{ code: 400, msg: 'Session token is required' }, null];
+  }
+  
+  try {
+    await db.delete(session).where(eq(session.token, token));
+    return [null, { success: true }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to logout' }, null];
+  }
+};

package/server/utils/auth/registerEmail.js

@@ -0,0 +1,105 @@
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
+import db from '../../db/index.js';
+import { user } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+import getSetting from '../settings/getSetting.js';
+import sendVerificationEmail from './sendVerificationEmail.js';
+import createSession from '../sessions/createSession.js';
+
+const generateId = () => crypto.randomBytes(16).toString('hex');
+
+export default async ({ email, password, name }) => {
+  if(!email){
+    return [{ code: 400, msg: 'Email is required' }, null];
+  }
+  
+  if(!password){
+    return [{ code: 400, msg: 'Password is required' }, null];
+  }
+  
+  if(!name){
+    return [{ code: 400, msg: 'Name is required' }, null];
+  }
+  
+  try {
+    /* Is registration allowed */
+    const [settingError, allowRegistration] = await getSetting('system', 'allow_registration', true);
+    if(settingError){
+      return [settingError, null];
+    }
+    
+    if(!allowRegistration){
+      return [{ code: 403, msg: 'Registration is currently disabled' }, null];
+    }
+    
+    /* Does a user with this email address already exist? */
+    const existingUser = await db.select().from(user).where(eq(user.email, email)).limit(1);
+    if(existingUser.length > 0){
+      return [{ code: 409, msg: 'User already exists with this email' }, null];
+    }
+    
+    /* Create the User */
+    const userId = generateId();
+    const now = new Date();
+    await db.insert(user).values({
+      id: userId,
+      email,
+      name,
+      passwordHash: await bcrypt.hash(password, 10),
+      emailVerified: false,
+      createdAt: now,
+      updatedAt: now,
+    });
+
+    /* Is Email Verification Required? */
+    const [verifySettingError, requiresVerification] = await getSetting('system', 'require_email_verification', false);
+    if(verifySettingError){
+      return [verifySettingError, null];
+    }
+    
+    if(requiresVerification){
+      const [verifyEmailError] = await sendVerificationEmail({
+        userId,
+        email,
+        name,
+      });
+      
+      if(verifyEmailError){
+        return [verifyEmailError, null];
+      }
+
+      return [null, {
+        user: {
+          id: userId,
+          email,
+          name,
+          emailVerified: false,
+        },
+        requiresVerification,
+        sessionToken: null,
+        expiresAt: null
+      }];
+    }
+    
+    /* Login */
+    const [sessionError, sessionData] = await createSession(userId);
+    if(sessionError){
+      return [sessionError, null];
+    }
+    
+    return [null, {
+      user: {
+        id: userId,
+        email,
+        name,
+        emailVerified: false,
+      },
+      requiresVerification,
+      sessionToken: sessionData.sessionToken,
+      expiresAt: sessionData.expiresAt,
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to register user' }, null];
+  }
+};

package/server/utils/auth/requestPasswordReset.js

@@ -0,0 +1,62 @@
+import crypto from 'crypto';
+import { eq } from 'drizzle-orm';
+import db from '../../db/index.js';
+import { user, verificationToken } from '../../db/schema.js';
+import sendEmailFromTemplate from '../email/sendEmailFromTemplate.js';
+import getSetting from '../settings/getSetting.js';
+
+const generateToken = () => crypto.randomBytes(32).toString('hex');
+
+export default async ({ email }) => {
+  if(!email){
+    return [{ code: 400, msg: 'Email is required' }, null];
+  }
+  
+  try {
+    const userData = await db.select().from(user).where(eq(user.email, email)).limit(1);
+
+    if(userData.length === 0){
+      return [{ code: 404, msg: 'No account found with that email address' }, null];
+    }
+
+    const { id: userId, name } = userData[0];
+    const token = generateToken();
+    const expiresAt = new Date(Date.now() + 60 * 60 * 1000);
+    const now = new Date();
+
+    await db.insert(verificationToken).values({
+      token,
+      userId,
+      type: 'password_reset',
+      expiresAt,
+      createdAt: now,
+    });
+
+    const [settingError, passwordResetUrlTemplate] = await getSetting('system', 'password_reset_url', 'http://localhost:3000/reset-password/{{token}}');
+    
+    if(settingError){
+      return [settingError, null];
+    }
+    
+    const resetLink = passwordResetUrlTemplate.replace('{{token}}', token);
+
+    const [emailError] = await sendEmailFromTemplate({
+      to: email,
+      subject: 'Reset Your Password',
+      template: 'reset-password',
+      data: {
+        name,
+        resetLink,
+      },
+    });
+    
+    if(emailError){
+      return [emailError, null];
+    }
+
+    return [null, { success: true }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to request password reset' }, null];
+  }
+};
+

package/server/utils/auth/resetPassword.js

@@ -0,0 +1,58 @@
+import bcrypt from 'bcrypt';
+import db from '../../db/index.js';
+import { verificationToken, user, session } from '../../db/schema.js';
+import { eq, and, gt } from 'drizzle-orm';
+
+export default async ({ token, password, logoutAll = false }) => {
+  if(!token){
+    return [{ code: 400, msg: 'Reset token is required' }, null];
+  }
+  
+  if(!password){
+    return [{ code: 400, msg: 'Password is required' }, null];
+  }
+  
+  try {
+    const result = await db
+      .select()
+      .from(verificationToken)
+      .where(and(
+        eq(verificationToken.token, token),
+        eq(verificationToken.type, 'password_reset'),
+        gt(verificationToken.expiresAt, new Date())
+      ))
+      .limit(1);
+
+    if(result.length === 0){
+      return [{ code: 400, msg: 'Invalid or expired password reset token' }, null];
+    }
+
+    const tokenRecord = result[0];
+    const passwordHash = await bcrypt.hash(password, 10);
+
+    await db
+      .update(user)
+      .set({ 
+        passwordHash,
+        updatedAt: new Date()
+      })
+      .where(eq(user.id, tokenRecord.userId));
+
+    await db
+      .delete(verificationToken)
+      .where(eq(verificationToken.token, token));
+
+    if(logoutAll){
+      await db
+        .delete(session)
+        .where(eq(session.userId, tokenRecord.userId));
+    }
+
+    return [null, { 
+      success: true,
+      userId: tokenRecord.userId
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to reset password' }, null];
+  }
+};

package/server/utils/auth/sendVerificationEmail.js

@@ -0,0 +1,57 @@
+import crypto from 'crypto';
+import db from '../../db/index.js';
+import { verificationToken } from '../../db/schema.js';
+import sendEmailFromTemplate from '../email/sendEmailFromTemplate.js';
+import getSetting from '../settings/getSetting.js';
+
+const generateToken = () => crypto.randomBytes(32).toString('hex');
+
+export default async ({ userId, email, name }) => {
+  if(!userId){
+    return [{ code: 400, msg: 'User ID is required' }, null];
+  }
+  
+  if(!email){
+    return [{ code: 400, msg: 'Email is required' }, null];
+  }
+  
+  try {
+    const token = generateToken();
+    const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000);
+    const now = new Date();
+
+    await db.insert(verificationToken).values({
+      token,
+      userId,
+      type: 'email_verification',
+      expiresAt,
+      createdAt: now,
+    });
+
+    const [settingError, verificationUrlTemplate] = await getSetting('system', 'verification_url', 'http://localhost:3000/verify-email/{{token}}');
+    
+    if(settingError){
+      return [settingError, null];
+    }
+    
+    const verificationLink = verificationUrlTemplate.replace('{{token}}', token);
+
+    const [emailError] = await sendEmailFromTemplate({
+      to: email,
+      subject: 'Verify Your Email Address',
+      template: 'verify-email',
+      data: {
+        name,
+        verificationLink,
+      },
+    });
+    
+    if(emailError){
+      return [emailError, null];
+    }
+
+    return [null, { success: true }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to send verification email' }, null];
+  }
+};

package/server/utils/auth/verifyEmail.js

@@ -0,0 +1,46 @@
+import db from '../../db/index.js';
+import { verificationToken, user } from '../../db/schema.js';
+import { eq, and, gt } from 'drizzle-orm';
+
+export default async ({ token }) => {
+  if(!token){
+    return [{ code: 400, msg: 'Verification token is required' }, null];
+  }
+  
+  try {
+    const result = await db
+      .select()
+      .from(verificationToken)
+      .where(and(
+        eq(verificationToken.token, token),
+        eq(verificationToken.type, 'email_verification'),
+        gt(verificationToken.expiresAt, new Date())
+      ))
+      .limit(1);
+
+    if(result.length === 0){
+      return [{ code: 400, msg: 'Invalid or expired verification token' }, null];
+    }
+
+    const tokenRecord = result[0];
+
+    await db
+      .update(user)
+      .set({ 
+        emailVerified: true,
+        updatedAt: new Date()
+      })
+      .where(eq(user.id, tokenRecord.userId));
+
+    await db
+      .delete(verificationToken)
+      .where(eq(verificationToken.token, token));
+
+    return [null, { 
+      success: true,
+      userId: tokenRecord.userId
+    }];
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to verify email' }, null];
+  }
+};

package/server/utils/email/sendEmail.js

@@ -0,0 +1,42 @@
+import { Resend } from 'resend';
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+export default async ({ to, subject, html }) => {
+  if(!process.env.RESEND_API_KEY){
+    return [{ code: 500, msg: 'RESEND_API_KEY not configured' }, null];
+  }
+  
+  if(!to){
+    return [{ code: 400, msg: 'Recipient email is required' }, null];
+  }
+  
+  if(!subject){
+    return [{ code: 400, msg: 'Email subject is required' }, null];
+  }
+  
+  if(!html){
+    return [{ code: 400, msg: 'Email content is required' }, null];
+  }
+
+  const from = process.env.SMTP_FROM || 'onboarding@resend.dev';
+
+  try {
+    const { data, error } = await resend.emails.send({
+      from,
+      to,
+      subject,
+      html,
+    });
+
+    if(error){
+      console.error('Email send error:', error);
+      return [{ code: 500, msg: error.message || 'Failed to send email' }, null];
+    }
+
+    return [null, { success: true, messageId: data.id }];
+  } catch(error){
+    console.error('Email send error:', error);
+    return [{ code: 500, msg: 'Failed to send email' }, null];
+  }
+};

package/server/utils/email/sendEmailFromTemplate.js

@@ -0,0 +1,45 @@
+import { existsSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+import { renderPage } from 'kempo-server/templating';
+import shake from 'kempo-css/shake';
+import sendEmail from './sendEmail.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+export default async ({ to, subject, template, data = {} }) => {
+  if(!to){
+    return [{ code: 400, msg: 'Recipient email is required' }, null];
+  }
+
+  if(!subject){
+    return [{ code: 400, msg: 'Email subject is required' }, null];
+  }
+
+  if(!template){
+    return [{ code: 400, msg: 'Template name is required' }, null];
+  }
+
+  const consumerDir = join(process.cwd(), 'templates/emails');
+  const moduleDir = join(__dirname, '../../../app-templates/emails');
+  const rootDir = existsSync(join(consumerDir, `${template}.page.html`)) ? consumerDir : moduleDir;
+  const pagePath = join(rootDir, `${template}.page.html`);
+
+  if(!existsSync(pagePath)){
+    return [{ code: 404, msg: `Email template not found: ${template}` }, null];
+  }
+
+  const themePath = join(process.cwd(), 'public/styles.css');
+  const themeOpts = existsSync(themePath) ? { theme: themePath } : {};
+
+  try {
+    let html = await renderPage(pagePath, rootDir, {}, data);
+    const css = shake(html, { ...themeOpts, colorMode: 'light' });
+    html = html.replace('</head>', `<style>${css}</style></head>`);
+    return await sendEmail({ to, subject, html });
+  } catch(error){
+    console.error('Email render error:', error);
+    return [{ code: 500, msg: 'Failed to send email from template' }, null];
+  }
+};

package/server/utils/extensions/checkExtensionUpdate.js

@@ -0,0 +1,56 @@
+import db from '../../db/index.js';
+import { extension } from '../../db/schema.js';
+import { eq } from 'drizzle-orm';
+
+const toRawUrl = (gitUrl, file = 'package.json') => {
+  const match = gitUrl.match(/github\.com\/([^/]+)\/([^/]+)/);
+  if(!match) return null;
+  return `https://raw.githubusercontent.com/${match[1]}/${match[2]}/main/${file}`;
+};
+
+const semverGt = (a, b) => {
+  const parse = v => (v || '0.0.0').replace(/^v/, '').split('.').map(Number);
+  const [aMaj, aMin, aPatch] = parse(a);
+  const [bMaj, bMin, bPatch] = parse(b);
+  if(aMaj !== bMaj) return aMaj > bMaj;
+  if(aMin !== bMin) return aMin > bMin;
+  return aPatch > bPatch;
+};
+
+export default async ({ name }) => {
+  if(!name){
+    return [{ code: 400, msg: 'Extension name is required' }, null];
+  }
+
+  let record;
+  try {
+    [record] = await db.select().from(extension).where(eq(extension.name, name)).limit(1);
+    if(!record){
+      return [{ code: 404, msg: 'Extension not found' }, null];
+    }
+  } catch(error){
+    return [{ code: 500, msg: 'Failed to find extension' }, null];
+  }
+
+  const gitUrl = record.kempo?.git;
+  if(!gitUrl){
+    return [null, { hasUpdate: false, reason: 'No git URL configured' }];
+  }
+
+  const rawUrl = toRawUrl(gitUrl);
+  if(!rawUrl){
+    return [null, { hasUpdate: false, reason: 'Unsupported git URL format' }];
+  }
+
+  let remotePkg;
+  try {
+    const res = await fetch(rawUrl);
+    if(!res.ok) return [null, { hasUpdate: false, reason: 'Failed to fetch remote package.json' }];
+    remotePkg = await res.json();
+  } catch(error){
+    return [{ code: 502, msg: 'Failed to reach remote repository' }, null];
+  }
+
+  const hasUpdate = semverGt(remotePkg.version, record.version);
+  return [null, { hasUpdate, currentVersion: record.version, latestVersion: remotePkg.version }];
+};

package/server/utils/extensions/createTablesFromSchema.js

@@ -0,0 +1,57 @@
+import { getTableConfig } from 'drizzle-orm/pg-core';
+import { sql } from 'drizzle-orm';
+import db from '../../db/index.js';
+
+const TYPE_MAP = {
+  PgText: 'text',
+  PgVarchar: 'varchar',
+  PgChar: 'char',
+  PgBoolean: 'boolean',
+  PgInteger: 'integer',
+  PgBigInt53: 'bigint',
+  PgSerial: 'serial',
+  PgSmallInt: 'smallint',
+  PgDoublePrecision: 'double precision',
+  PgReal: 'real',
+  PgNumeric: 'numeric',
+  PgTimestamp: 'timestamp',
+  PgDate: 'date',
+  PgTime: 'time',
+  PgJsonb: 'jsonb',
+  PgJson: 'json',
+  PgUUID: 'uuid',
+};
+
+const serializeDefault = (value) => {
+  if(typeof value === 'string') return `'${value.replace(/'/g, "''")}'`;
+  if(typeof value === 'boolean' || typeof value === 'number') return String(value);
+  if(value === null) return 'null';
+  return `'${JSON.stringify(value).replace(/'/g, "''")}'`;
+};
+
+const tableToSql = (table) => {
+  const config = getTableConfig(table);
+  const primaryKeys = config.columns.filter(c => c.primary).map(c => c.name);
+  const cols = config.columns.map(c => {
+    const type = TYPE_MAP[c.columnType] || 'text';
+    let def = `"${c.name}" ${type}`;
+    if(c.notNull) def += ' NOT NULL';
+    if(c.hasDefault && c.default !== undefined) def += ` DEFAULT ${serializeDefault(c.default)}`;
+    if(c.primary && primaryKeys.length === 1) def += ' PRIMARY KEY';
+    return def;
+  });
+  if(primaryKeys.length > 1) cols.push(`PRIMARY KEY (${primaryKeys.map(k => `"${k}"`).join(', ')})`);
+  return `CREATE TABLE IF NOT EXISTS "${config.name}" (${cols.join(', ')})`;
+};
+
+export default async (schemaModule) => {
+  for(const exported of Object.values(schemaModule)){
+    if(typeof exported !== 'object' || !exported?.[Symbol.for('drizzle:Name')]) continue;
+    try {
+      await db.execute(sql.raw(tableToSql(exported)));
+    } catch(error){
+      return [{ code: 500, msg: `Failed to create table: ${error.message}` }, null];
+    }
+  }
+  return [null, true];
+};