propro-utils 1.3.46 → 1.3.48

package/middlewares/access_token.js

@@ -1,39 +1,87 @@
-require("dotenv").config();
-const axios =  require("axios");
-const {getOrSetCache} = require("../utils/redis");
+require('dotenv').config();
+const axios = require('axios');
+const { getOrSetCache } = require('../utils/redis');
+const { checkIfUserExists } = require('./account_info');
 
-const authValidation = (redisClient, requiredPermissions = []) => {
-    return async (req, res, next) => {
-        try {
-            const accessToken = req.cookies['x-access-token'] || req.headers.authorization?.split(" ")[1];
+/**
+ * Middleware for authenticating and authorizing API requests.
+ * It validates an access token and checks for required permissions using both a Redis cache
+ * and propro authentication service.
+ *
+ * @param {object} redisClient - The Redis client used for caching permission data.
+ * @param {object} userSchema - The user schema/model object.
+ * @param {string[]} [requiredPermissions=[]] - An array of permissions required to access the endpoint.
+ * This function first attempts to retrieve the account's permissions from the cache.
+ * If the cache is empty or expired, it fetches permissions from propro authentication service
+ * and updates the cache. If the access token is invalid or does not grant the required permissions,
+ * the request is rejected.
+ *
+ * @returns {function} A middleware function that takes Express.js request (req), response (res),
+ * and next function parameters. The middleware validates the access token and permissions.
+ * If validation is successful, it adds the account ID and req.user to the request object (req.account) and
+ * calls `next()` to pass control to the next middleware. If validation fails, it responds with
+ * an error message and a 403 status code.
+ *
+ * Usage of the middleware requires an environment variable `AUTH_URL` to be set, pointing to the
+ * authentication service's URL. The function leverages async/await for asynchronous operations
+ * and tries to handle errors gracefully, reporting them through the next middleware in the chain.
+ *
+ * @example
+ * // Applying authValidation middleware
+ * const redisClient = require('./redisClient');
+ * app.use('/api/protected-route', authValidation(redisClient, ['admin', 'user']), (req, res) => {
+ *   res.json({ message: 'You have access to protected data' });
+ * });
+ */
+const authValidation = (redisClient, userSchema, requiredPermissions = []) => {
+  return async (req, res, next) => {
+    try {
+      const accessToken =
+        req.cookies['x-access-token'] ||
+        req.headers.authorization?.split(' ')[1];
 
-            if (!accessToken) {
-                return res.status(403).json({ error: "Access token is required" });
-            }
+      if (!accessToken) {
+        return res.status(403).json({ error: 'Access token is required' });
+      }
 
-            const fetchPermission = async () => {
-                const response = await axios.post(`${process.env.AUTH_URL}/api/v1/auth/validateToken`, {
-                    accessToken: accessToken,
-                    requiredPermissions: requiredPermissions
-                });
-                return response.data;
-            }
-            const cacheKey = `account:permissions:${accessToken}`;
-            const { accountId, validPermissions }  = await getOrSetCache(redisClient, cacheKey, fetchPermission, 1800);
+      const fetchPermission = async () => {
+        const response = await axios.post(
+          `${process.env.AUTH_URL}/api/v1/auth/validateToken`,
+          {
+            accessToken: accessToken,
+            requiredPermissions: requiredPermissions,
+          }
+        );
+        return response.data;
+      };
+      const cacheKey = `account:permissions:${accessToken}`;
+      const { accountId, validPermissions } = await getOrSetCache(
+        redisClient,
+        cacheKey,
+        fetchPermission,
+        1800
+      );
 
-            if (!validPermissions) {
-                return res.status(403).json({ error: "Invalid permissions" });
-            }
+      if (!validPermissions) {
+        return res.status(403).json({ error: 'Invalid permissions' });
+      }
 
-            req.account = accountId;
-            next();
-        } catch (error) {
-            if (error.response && error.response.status) {
-                next(new Error(error.response.data.message));
-            }
-            next(new Error('Error validating token'));
-        }
-    };
+      req.account = accountId;
+
+      const user = await checkIfUserExists(userSchema, accountId);
+      if (!user) {
+        return res.status(403).json({ error: 'User not found' });
+      }
+      console.log('user', user);
+      req.user = user.id;
+      next();
+    } catch (error) {
+      if (error.response && error.response.status) {
+        next(new Error(error.response.data.message));
+      }
+      next(new Error('Error validating token'));
+    }
+  };
 };
 
-module.exports = authValidation;
+module.exports = authValidation;

package/middlewares/account_info.js

@@ -1,6 +1,6 @@
-require("dotenv").config();
-const axios =  require("axios");
-const {getOrSetCache} = require("../utils/redis");
+require('dotenv').config();
+const axios = require('axios');
+const { getOrSetCache } = require('../utils/redis');
 const { v4: uuidv4 } = require('uuid');
 
 /**
@@ -14,62 +14,70 @@ const { v4: uuidv4 } = require('uuid');
  * @throws {Error} - If there is an error retrieving the account profile data or validating the token
  */
 const getAccountProfile = async (redisClient, userSchema, accountId) => {
-        try {
-            const accessToken = req.cookies['x-access-token'] || req.headers.authorization?.split(" ")[1];
+  try {
+    const accessToken =
+      req.cookies['x-access-token'] || req.headers.authorization?.split(' ')[1];
 
-            if (!accessToken) {
-                throw new Error("Access token is required");
-            }
-
-            const fetchPermission = async () => {
-                const response = await axios.get(`${process.env.AUTH_URL}/api/v1/account/profile`, {
-                    headers: {
-                        Authorization: `Bearer ${accessToken}`,
-                    },
-                    params: {
-                        accountId
-                    }
-                });
-                return response.data;
-            }
-            const cacheKey = `account:info:${accountId}`;
-            const { profileData }  = await getOrSetCache(redisClient, cacheKey, fetchPermission, 1800);
+    if (!accessToken) {
+      throw new Error('Access token is required');
+    }
 
-            if (!profileData) {
-                throw new Error("Invalid permissions");
-            }
+    const fetchPermission = async () => {
+      const response = await axios.get(
+        `${process.env.AUTH_URL}/api/v1/account/profile`,
+        {
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+          },
+          params: {
+            accountId,
+          },
+        }
+      );
+      return response.data;
+    };
+    const cacheKey = `account:info:${accountId}`;
+    const { profileData } = await getOrSetCache(
+      redisClient,
+      cacheKey,
+      fetchPermission,
+      1800
+    );
 
-            return profileData;
+    if (!profileData) {
+      throw new Error('Invalid permissions');
+    }
 
-        } catch (error) {
-            if (error.response && error.response.status) {
-                throw new Error(error.response.data.message);
-            }
-            throw new Error('Error validating token');
-        }
+    return profileData;
+  } catch (error) {
+    if (error.response && error.response.status) {
+      throw new Error(error.response.data.message);
+    }
+    throw new Error('Error validating token');
+  }
 };
 
-
 /**
  * Checks if a user exists based on the given account ID.
  * If the user does not exist, creates a new user with the given account ID.
  *
  * @param {Schema} userSchema - The user schema to perform the operations on.
  * @param {string} accountId - The account ID of the user to check/create.
- * @returns {Promise<void>} - A promise that resolves once the check/create operation is done.
+ * @returns {Promise<user>} - A promise that resolves once the check/create operation is done.
  */
 const checkIfUserExists = async (userSchema, accountId) => {
-    const user = await userSchema.findOne({ accountId });
-    if (!user) {
-        await userSchema.create({
-            accountId,
-            id: uuidv4(),
-            verified: false,
-        });
-    }
+  const user = await userSchema.findOne({ accountId });
+  if (!user) {
+    await userSchema.create({
+      accountId,
+      id: uuidv4(),
+      verified: false,
+    });
+  }
+  return user;
 };
 
 module.exports = {
-    getAccountProfile,
-    checkIfUserExists
-}
+  getAccountProfile,
+  checkIfUserExists,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.3.46",
+  "version": "1.3.48",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/index.js

@@ -107,7 +107,6 @@ function proproAuthMiddleware(options = {}, userSchema) {
           return res.status(400).send('No code received');
         }
 
-        console.log('code', code);
         const { tokens, account, redirectUrl } = await exchangeToken(
           authUrl,
           code,
@@ -116,14 +115,8 @@ function proproAuthMiddleware(options = {}, userSchema) {
           redirectUri
         );
 
-        console.log('account', account);
-        console.log('tokens', tokens);
-        console.log('redirectUrl', redirectUrl);
-
         await checkIfUserExists(userSchema, account.accountId);
 
-        console.log('User exists');
-
         const currentDateTime = new Date();
 
         const refreshMaxAge =