payload-subscribers-plugin 0.0.1

package/src/endpoints/requestMagicLink.ts

@@ -0,0 +1,139 @@
+import type { CollectionSlug, Endpoint, PayloadHandler, PayloadRequest, TypedUser } from 'payload'
+
+import crypto from 'crypto'
+import { defaultCollectionSlug } from '../collections/Subscribers.js'
+
+import { getTokenAndHash } from '../helpers/token.js'
+
+export type RequestMagicLinkResponse =
+  | {
+      emailResult: any
+      now: string
+    }
+  | {
+      error: string
+      now: string
+    }
+
+/**
+ * createEndpointRequestMagicLink
+ * @param options
+ * @returns
+ *
+ * Factory to generate the endpoint config with handler based on input option for subscribersCollectionSlug
+ *
+ */
+function createEndpointRequestMagicLink({
+  subscribersCollectionSlug = defaultCollectionSlug,
+}: {
+  subscribersCollectionSlug: CollectionSlug
+}): Endpoint {
+  /**
+   * requestMagicLink Endpoint Handler
+   * @param req
+   * @data { email }
+   * @returns { status: 200, json: {message: string, now: date} }
+   * @returns { status: 400, json: {error: ('Bad data' | 'Unknown email result'), now: date} }
+   */
+  const requestMagicLinkHandler: PayloadHandler = async (req: PayloadRequest) => {
+    const data = req?.json ? await req.json() : {}
+    const { email, forwardUrl } = data // if by POST data
+    // const { email } = req.routeParams // if by path
+
+    if (!email) {
+      return Response.json(
+        { error: 'Bad data', now: new Date().toISOString() } as RequestMagicLinkResponse,
+        { status: 400 },
+      )
+    }
+
+    const userResults = await req.payload.find({
+      collection: subscribersCollectionSlug,
+      where: {
+        email: { equals: email },
+      },
+    })
+    const user = userResults.docs[0] as TypedUser
+
+    if (!user) {
+      //
+      // Create subscriber with status 'pending',
+      // and an invisible unknowable password,
+      //
+      const { tokenHash: tokenHash2 } = getTokenAndHash() // Unknowable
+      const createResult = await req.payload.create({
+        collection: subscribersCollectionSlug,
+        data: {
+          email,
+          password: tokenHash2,
+          status: 'pending',
+        },
+        draft: false,
+      })
+      if (!createResult) {
+        return Response.json(
+          { error: 'Bad data', now: new Date().toISOString() } as RequestMagicLinkResponse,
+          { status: 400 },
+        )
+      }
+    }
+
+    // Update user with verificationToken
+    const token = crypto.randomBytes(32).toString('hex')
+    const tokenHash = crypto.createHash('sha256').update(token).digest('hex')
+    const expiresAt = new Date(Date.now() + 15 * 60 * 1000) // 15 mins
+    await req.payload.update({
+      collection: subscribersCollectionSlug,
+      data: {
+        verificationToken: tokenHash,
+        verificationTokenExpires: expiresAt.toISOString(),
+      },
+      where: {
+        email: { equals: user.email },
+      },
+    })
+
+    // Send email
+    const forwardUrlParam = forwardUrl ? `&forwardUrl=${encodeURI(forwardUrl)}` : ''
+    const magicLink = `${req.payload.config.serverURL}/verify?token=${token}&email=${email}${forwardUrlParam}`
+    const subject = data.subject || 'Your Magic Login Link'
+    const message = `
+  ${data.message || '<p>Use this link to log in:</p>'}
+  <p><a href="${magicLink}"><b>Login</b></a></p>
+  `
+    const emailResult = await req.payload.sendEmail({
+      html: message,
+      subject,
+      to: user.email,
+    })
+    //   req.payload.logger.info(`email result: ${JSON.stringify(emailResult)}`)
+    // return data; // Return data to allow normal submission if needed
+    if (!emailResult) {
+      return Response.json(
+        {
+          error: 'Unknown email result',
+          now: new Date().toISOString(),
+        } as RequestMagicLinkResponse,
+        { status: 400 },
+      )
+    }
+    req.payload.logger.info(`requestMagicLinkHandler email sent \n ${magicLink}`)
+    return Response.json({
+      emailResult,
+      now: new Date().toISOString(),
+    } as RequestMagicLinkResponse)
+  }
+
+  /**
+   * requestMagicLink Endpoint Config
+   */
+  const requestMagicLinkEndpoint: Endpoint = {
+    handler: requestMagicLinkHandler,
+    method: 'post',
+    path: '/emailToken',
+  }
+
+  return requestMagicLinkEndpoint
+}
+
+export default createEndpointRequestMagicLink

package/src/endpoints/subscribe.ts

@@ -0,0 +1,435 @@
+import type { CollectionSlug, Endpoint, PayloadHandler } from 'payload'
+import type { Subscriber } from 'src/copied/payload-types.js'
+
+import { defaultCollectionSlug } from '../collections/Subscribers.js'
+
+import { getTokenAndHash } from '../helpers/token.js'
+import { verifyOptIns } from '../helpers/verifyOptIns.js'
+
+export type SubscribeResponse =
+  // When subscriber optIns are updated...
+  | {
+      email: string
+      now: string
+      optIns: string[]
+    }
+  // When a verify link is emailed...
+  | {
+      emailResult: any
+      now: string
+    }
+  // When any error occurs...
+  | {
+      error: string
+      now: string
+    }
+
+/**
+ * createEndpointLogout
+ * @param options
+ * @returns
+ *
+ * Factory to generate the endpoint config with handler based on input option for subscribersCollectionSlug
+ *
+ */
+function createEndpointSubscribe({
+  subscribersCollectionSlug = defaultCollectionSlug,
+}: {
+  subscribersCollectionSlug: CollectionSlug
+}): Endpoint {
+  /**
+   * subscribe Endpoint Handler
+   * @param req
+   * @data { email }
+   * @returns { status: 200, json: {message: string, now: date} }
+   * @returns { status: 400, json: {error: ('Bad data' | 'Already subscribed' | 'Unknown email result'), now: date} }
+   */
+  const subscribeHandler: PayloadHandler = async (req) => {
+    const data = req?.json ? await req.json() : {}
+    const {
+      afterVerifyUrl,
+      email,
+      optIns,
+    }: { afterVerifyUrl: string; email: string; optIns: string[] } = data // if by POST data
+    // const { email } = req.routeParams // if by path
+
+    //
+    // HELPERS
+    // Some of these functions make use of the scope within handler,
+    // and would have to be refactored if moved out.
+    //
+    const createSubscriber = async ({
+      optIns,
+      password,
+      status,
+      verificationToken,
+      verificationTokenExpires,
+    }: {
+      email: string
+      optIns?: string[]
+      password?: string
+      status?: 'pending' | 'subscribed' | 'unsubscribed'
+      verificationToken?: string
+      verificationTokenExpires?: Date
+    }) => {
+      await req.payload.create({
+        collection: subscribersCollectionSlug,
+        data: {
+          email,
+          optIns,
+          password,
+          status: status || 'pending',
+          verificationToken,
+          verificationTokenExpires: verificationTokenExpires?.toISOString(),
+        },
+        draft: false,
+      })
+    }
+    const updateSubscriber = async ({
+      id,
+      optIns,
+      password,
+      status,
+      verificationToken,
+      verificationTokenExpires,
+    }: {
+      id: string
+      optIns?: string[]
+      password?: string
+      status?: 'pending' | 'subscribed' | 'unsubscribed'
+      verificationToken?: string
+      verificationTokenExpires?: Date | null
+    }) => {
+      const updateResults = await req.payload.update({
+        id,
+        collection: subscribersCollectionSlug,
+        data: {
+          optIns,
+          password,
+          status,
+          verificationToken,
+          verificationTokenExpires: verificationTokenExpires?.toISOString() || null,
+        },
+        depth: 0,
+      })
+      return updateResults
+    }
+    const sendVerifyEmail = async ({
+      email,
+      forwardUrl,
+      linkText,
+      message,
+      subject,
+      token,
+    }: {
+      email: string
+      forwardUrl?: string
+      linkText: string
+      message: string
+      subject: string
+      token: string
+    }) => {
+      const forwardUrlParam = forwardUrl ? `&forwardUrl=${encodeURI(forwardUrl)}` : ''
+      const magicLink = `${req.payload.config.serverURL}/verify?token=${token}&email=${email}${forwardUrlParam}`
+      const html = message + `<p><a href="${magicLink}">${linkText}</a></p>`
+      const emailResult = await req.payload.sendEmail({
+        html,
+        subject,
+        to: email,
+      })
+      req.payload.logger.info(`subscribe email sent \n ${magicLink}`)
+      return emailResult
+    }
+
+    //
+    // VALIDATE INPUT
+    //
+    // Require email
+    if (!email) {
+      req.payload.logger.error(
+        JSON.stringify(
+          { error: 'Bad data', now: new Date().toISOString() } as SubscribeResponse,
+          undefined,
+          2,
+        ),
+      )
+      return Response.json(
+        { error: 'Bad data', now: new Date().toISOString() } as SubscribeResponse,
+        { status: 400 },
+      )
+    }
+
+    //
+    // Validate OptInChannels
+    const { invalidOptInsInput, verifiedOptInIDs } = await verifyOptIns(req.payload, optIns)
+
+    if (invalidOptInsInput) {
+      req.payload.logger.error(
+        JSON.stringify(
+          {
+            error: 'Invalid input: ' + JSON.stringify(optIns),
+            now: new Date().toISOString(),
+          } as SubscribeResponse,
+          undefined,
+          2,
+        ),
+      )
+      return Response.json(
+        {
+          error: 'Invalid input: ' + JSON.stringify(optIns),
+          now: new Date().toISOString(),
+        } as SubscribeResponse,
+        { status: 400 },
+      )
+    }
+
+    //
+    // Verify subscriber exists
+    const userResults = await req.payload.find({
+      collection: subscribersCollectionSlug,
+      where: {
+        email: { equals: email },
+      },
+    })
+    const subscriber = userResults.docs[0] as Subscriber
+
+    //
+    // Now we have a subscriber and validatedOptIns
+    // Handle scenarios
+    //
+    // ********************************************************
+    //
+    if (req.user && req.user.email != email) {
+      //
+      // Error: Auth-ed user doesn't match subscriber email
+      //
+      req.payload.logger.error(
+        JSON.stringify(
+          {
+            error: 'Unauthorized: ' + email,
+            now: new Date().toISOString(),
+          } as SubscribeResponse,
+          undefined,
+          2,
+        ),
+      )
+      return Response.json(
+        {
+          error: 'Unauthorized: ' + email,
+          now: new Date().toISOString(),
+        } as SubscribeResponse,
+        { status: 400 },
+      )
+    }
+
+    //
+    // ********************************************************
+    //
+    if (!subscriber) {
+      //
+      // Create subscriber with status 'pending',
+      // and an invisible unknowable password,
+      // and send a verify email
+      // Pass all optIns through verify link
+      //
+      const { expiresAt, token, tokenHash } = getTokenAndHash(15 * 60 * 1000) // Use for magic link
+      const { tokenHash: tokenHash2 } = getTokenAndHash() // Unknowable
+      await createSubscriber({
+        email,
+        optIns,
+        password: tokenHash2,
+        status: 'pending',
+        verificationToken: tokenHash,
+        verificationTokenExpires: expiresAt,
+      })
+
+      //
+      // Send email
+      const emailResult = await sendVerifyEmail({
+        email,
+        forwardUrl: afterVerifyUrl,
+        linkText: '<b>Verify</b>',
+        message: data.message || `<p>Click here to verify your subscription:</p>`,
+        subject: data.subject || 'Please verify your subscription',
+        token,
+      })
+      if (!emailResult) {
+        req.payload.logger.error(
+          JSON.stringify(
+            { error: 'Unknown email result', now: new Date().toISOString() } as SubscribeResponse,
+            undefined,
+            2,
+          ),
+        )
+        return Response.json(
+          { error: 'Unknown email result', now: new Date().toISOString() } as SubscribeResponse,
+          { status: 400 },
+        )
+      }
+      return Response.json({ emailResult, now: new Date().toISOString() } as SubscribeResponse)
+      //
+    }
+    //
+    // ********************************************************
+    //
+    if (!req.user && subscriber) {
+      //
+      // Send magic link to log the user in
+      // Pass all optIns through verify link
+      //
+      const { expiresAt, token, tokenHash } = getTokenAndHash(15 * 60 * 1000) // Use for magic link
+      // Update subscriber with token for pending email
+      const updateResults = await updateSubscriber({
+        id: subscriber.id,
+        verificationToken: tokenHash,
+        verificationTokenExpires: expiresAt,
+      })
+      if (!updateResults) {
+        req.payload.logger.error(
+          JSON.stringify(
+            { error: 'Unknown error', now: new Date().toISOString() } as SubscribeResponse,
+            undefined,
+            2,
+          ),
+        )
+        return Response.json(
+          { error: 'Unknown error', now: new Date().toISOString() } as SubscribeResponse,
+          { status: 400 },
+        )
+      }
+
+      //
+      // Send email
+      const emailResult = await sendVerifyEmail({
+        email,
+        forwardUrl: afterVerifyUrl,
+        linkText: 'Verify',
+        message: data.message || `<h1>Click here to verify your subscription:</h1>`,
+        subject: data.subject || 'Please verify your subscription',
+        token,
+      })
+      if (!emailResult) {
+        req.payload.logger.error(
+          JSON.stringify(
+            { error: 'Unknown email result', now: new Date().toISOString() } as SubscribeResponse,
+            undefined,
+            2,
+          ),
+        )
+        return Response.json(
+          { error: 'Unknown email result', now: new Date().toISOString() } as SubscribeResponse,
+          { status: 400 },
+        )
+      }
+      return Response.json({ emailResult, now: new Date().toISOString() } as SubscribeResponse)
+    }
+    //
+    // ********************************************************
+    //
+    if (req.user && subscriber && subscriber.status == 'pending') {
+      //
+      // Send magic link to verify the email and log the user in
+      // Pass all optIns through verify link
+      //
+      const { expiresAt, token, tokenHash } = getTokenAndHash(15 * 60 * 1000) // Use for magic link
+      // Create subscriber with token for pending email
+      const updateResults = await updateSubscriber({
+        id: subscriber.id,
+        verificationToken: tokenHash,
+        verificationTokenExpires: expiresAt,
+      })
+      if (!updateResults) {
+        req.payload.logger.error(
+          JSON.stringify(
+            { error: 'Unknown error', now: new Date().toISOString() } as SubscribeResponse,
+            undefined,
+            2,
+          ),
+        )
+        return Response.json(
+          { error: 'Unknown error', now: new Date().toISOString() } as SubscribeResponse,
+          { status: 400 },
+        )
+      }
+
+      const emailResult = await sendVerifyEmail({
+        email,
+        forwardUrl: afterVerifyUrl,
+        linkText: 'Verify',
+        message: data.message || `<h1>Click here to verify your email:</h1>`,
+        subject: data.subject || 'Please verify your subscription',
+        token,
+      })
+      if (!emailResult) {
+        req.payload.logger.error(
+          JSON.stringify(
+            { error: 'Unknown email result', now: new Date().toISOString() } as SubscribeResponse,
+            undefined,
+            2,
+          ),
+        )
+        return Response.json(
+          { error: 'Unknown email result', now: new Date().toISOString() } as SubscribeResponse,
+          { status: 400 },
+        )
+      }
+      return Response.json({ emailResult, now: new Date().toISOString() } as SubscribeResponse)
+    }
+
+    //
+    // ********************************************************
+    //
+    if (req.user && subscriber && subscriber.status != 'pending') {
+      //
+      // Update subscriber with status 'subscribed',
+      // an invisible unknowable password,
+      // and if any optIns input exists, set subscriber optIns
+      // to EXACTLY verifiedOptInIDs (potentially unsubscribing from any not in verifiedOptInIDs)
+      //
+      const { tokenHash } = getTokenAndHash() // Use for magic link
+      // Update subscriber with optIns
+      const updateResults = (await updateSubscriber({
+        id: subscriber.id,
+        optIns: verifiedOptInIDs,
+        password: tokenHash,
+        status: 'subscribed',
+        verificationToken: '',
+        verificationTokenExpires: null,
+      })) as Subscriber
+
+      // Return results, including the verified optIns
+      return Response.json({
+        email: updateResults.email,
+        now: new Date().toISOString(),
+        optIns: updateResults.optIns,
+      } as SubscribeResponse)
+    }
+    //
+    // Uncaught case
+    //
+    req.payload.logger.error(
+      JSON.stringify(
+        { error: 'Unknown error', now: new Date().toISOString() } as SubscribeResponse,
+        undefined,
+        2,
+      ),
+    )
+    return Response.json(
+      { error: 'Unknown error', now: new Date().toISOString() } as SubscribeResponse,
+      { status: 400 },
+    )
+  }
+
+  /**
+   * subscribe Endpoint Config
+   */
+  const subscribeEndpoint: Endpoint = {
+    handler: subscribeHandler,
+    method: 'post',
+    path: '/subscribe',
+  }
+
+  return subscribeEndpoint
+}
+
+export default createEndpointSubscribe

package/src/endpoints/subscriberAuth.ts

@@ -0,0 +1,100 @@
+import { headers as nextHeaders } from 'next/headers.js'
+
+import type { Subscriber } from '../copied/payload-types.js'
+
+// If you're using Next.js, you'll have to import headers from next/headers, like so:
+import type { CollectionSlug, Endpoint, PayloadHandler, Permissions } from 'payload'
+
+import { defaultCollectionSlug } from '../collections/Subscribers.js'
+
+export type SubscriberAuthResponse =
+  | {
+      error: string
+      now: string
+    }
+  | {
+      now: string
+      permissions: Permissions
+      subscriber: null | Subscriber
+    }
+
+/**
+ * createEndpointLogout
+ * @param options
+ * @returns
+ *
+ * Factory to generate the endpoint config with handler based on input option for subscribersCollectionSlug
+ *
+ */
+function createEndpointSubscriberAuth({
+  subscribersCollectionSlug = defaultCollectionSlug,
+}: {
+  subscribersCollectionSlug: CollectionSlug
+}): Endpoint {
+  /**
+   * subscriberAuth Endpoint Handler
+   * @param req
+   * @returns { status: 200, json: {message: string, now: date} }
+   * @returns { status: 400, json: {error: ('No subscriber authed' | catchError | 'Unknown error'), now: date} }
+   */
+  const subscriberAuthHandler: PayloadHandler = async (req) => {
+    // req.payload.logger.info('subscriberAuthHandler')
+    // Log the user in via Payload headers
+    const headers = await nextHeaders()
+
+    try {
+      const { permissions, user } = await req.payload.auth({
+        headers,
+      })
+
+      // req.payload.logger.info(`user = ${JSON.stringify(user)}`)
+      // req.payload.logger.info(`permissions = ${JSON.stringify(permissions)}`)
+
+      if (user && user.collection == subscribersCollectionSlug) {
+        const subscriber: Subscriber = user as Subscriber
+        if (subscriber.optIns) {
+          subscriber.optIns = subscriber.optIns.map((channel) =>
+            typeof channel == 'string' ? channel : channel.id,
+          )
+        }
+        return Response.json({
+          now: new Date().toISOString(),
+          permissions,
+          subscriber,
+        } as SubscriberAuthResponse)
+      }
+
+      // req.payload.logger.info('subscriberAuthHandler: No subscriber authed')
+      return Response.json(
+        {
+          // error: 'No subscriber authed',
+          now: new Date().toISOString(),
+          permissions,
+          subscriber: null,
+        } as SubscriberAuthResponse,
+        { headers, status: 200 },
+      )
+    } catch (error: unknown) {
+      // req.payload.logger.info(`subscriberAuth error: ${JSON.stringify(error)}`)
+      return Response.json(
+        {
+          error,
+          now: new Date().toISOString(),
+        } as SubscriberAuthResponse,
+        { headers, status: 400 },
+      )
+    }
+  }
+
+  /**
+   * subscriberAuth Endpoint Config
+   */
+  const subscriberAuthEndpoint: Endpoint = {
+    handler: subscriberAuthHandler,
+    method: 'post',
+    path: '/subscriberAuth',
+  }
+  return subscriberAuthEndpoint
+}
+
+export default createEndpointSubscriberAuth