propro-utils 1.5.24 → 1.5.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.5.24",
+  "version": "1.5.25",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "scripts": {

package/src/server/middleware/cookieUtils.js

@@ -5,6 +5,55 @@
 
 const { URL } = require('url');
 
+/**
+ * Safely stringify an object, handling circular references
+ * @param {Object} obj - The object to stringify
+ * @return {string} A JSON string representation of the object
+ */
+const safeStringify = obj => {
+  const seen = new WeakSet();
+  return JSON.stringify(obj, (key, value) => {
+    if (typeof value === 'object' && value !== null) {
+      if (seen.has(value)) {
+        return '[Circular]';
+      }
+      seen.add(value);
+    }
+    return value;
+  });
+};
+
+/**
+ * Sanitize user object by removing sensitive and unnecessary information
+ * @param {Object} user - The user object to sanitize
+ * @return {Object} A sanitized version of the user object
+ */
+const sanitizeUser = user => {
+  const sanitized = { ...user };
+
+  delete sanitized.password;
+  delete sanitized.passwordHistory;
+  delete sanitized.loginAttempts;
+
+  // Remove Mongoose-specific fields
+  delete sanitized.$__;
+  delete sanitized.$isNew;
+
+  if (sanitized._doc) {
+    sanitized.id = sanitized._doc.id;
+    sanitized.accountId = sanitized._doc.accountId;
+    sanitized.createdAt = sanitized._doc.createdAt;
+    sanitized.updatedAt = sanitized._doc.updatedAt;
+
+    delete sanitized._doc.mapList;
+    delete sanitized._doc.folderList;
+
+    delete sanitized._doc;
+  }
+
+  return sanitized;
+};
+
 /**
  * Sets the authentication cookies in the response object.
  *
@@ -31,7 +80,6 @@ const setAuthCookies = (res, tokens, account, user, appUrl) => {
   const accessMaxAge =
     new Date(tokens.access.expires).getTime() - currentDateTime.getTime();
 
-  // Determine the domain
   let domain;
   try {
     domain = appUrl ? new URL(appUrl).hostname : undefined;
@@ -43,7 +91,6 @@ const setAuthCookies = (res, tokens, account, user, appUrl) => {
     domain = undefined;
   }
 
-  // Define common cookie attributes
   const commonAttributes = {
     secure: process.env.NODE_ENV === 'production',
     sameSite: process.env.NODE_ENV === 'production' ? 'None' : 'Lax',
@@ -54,54 +101,44 @@ const setAuthCookies = (res, tokens, account, user, appUrl) => {
     commonAttributes.secure = true;
   }
 
-  const httpOnlyCookies = [
-    {
-      name: 'x-refresh-token',
-      value: tokens.refresh.token,
-      maxAge: refreshMaxAge,
-    },
-    {
-      name: 'x-access-token',
-      value: tokens.access.token,
-      maxAge: accessMaxAge,
-    },
-  ];
+  // Set httpOnly cookies
+  res.cookie('x-refresh-token', tokens.refresh.token, {
+    ...commonAttributes,
+    httpOnly: true,
+    maxAge: refreshMaxAge,
+  });
 
-  httpOnlyCookies.forEach(cookie => {
-    res.cookie(cookie.name, cookie.value, {
-      ...commonAttributes,
-      httpOnly: true,
-      maxAge: cookie.maxAge,
-    });
+  res.cookie('x-access-token', tokens.access.token, {
+    ...commonAttributes,
+    httpOnly: true,
+    maxAge: accessMaxAge,
   });
 
-  const sanitizedUser = { ...user };
-  delete sanitizedUser.password;
+  // Set non-httpOnly cookies
+  const sanitizedUser = sanitizeUser(user);
+  const sanitizedAccount = { ...account };
+  delete sanitizedAccount.passwordHistory;
 
-  const regularCookies = [
-    {
-      name: 'user',
-      value: JSON.stringify(sanitizedUser),
-      maxAge: refreshMaxAge,
-    },
-    { name: 'account', value: JSON.stringify(account), maxAge: refreshMaxAge },
-    {
-      name: 'has_account_token',
-      value: JSON.stringify({ value: 'true', expires: accessMaxAge }),
-      maxAge: accessMaxAge,
-    },
-  ];
+  res.cookie('user', safeStringify(sanitizedUser), {
+    ...commonAttributes,
+    maxAge: refreshMaxAge,
+  });
 
-  regularCookies.forEach(cookie => {
-    res.cookie(cookie.name, cookie.value, {
-      ...commonAttributes,
-      maxAge: cookie.maxAge,
-    });
+  res.cookie('account', safeStringify(sanitizedAccount), {
+    ...commonAttributes,
+    maxAge: refreshMaxAge,
   });
 
+  res.cookie(
+    'has_account_token',
+    JSON.stringify({ value: 'true', expires: accessMaxAge }),
+    {
+      ...commonAttributes,
+      maxAge: accessMaxAge,
+    }
+  );
+
   console.log('Setting auth cookies');
-  console.log('tokens', tokens);
-  console.log('account', account);
   console.log('sanitizedUser', sanitizedUser);
 };