sumba 1.1.3 → 1.1.5

package/bajo/hook/dobo.sumba-user@after-record-validation.js

@@ -1,9 +1,9 @@
 async function doboSumbaUserAfterRecordValidation (body, options) {
-  const { isBcrypt, isMd5, hash } = this.app.bajoExtra
+  const { isBcrypt, hash } = this.app.bajoExtra
   const { has } = this.app.bajo.lib._
 
   if (has(body, 'password') && !isBcrypt(body.password)) body.password = await hash(body.password, 'bcrypt')
-  if (has(body, 'token') && !isMd5(body.token)) body.token = await hash(body.password ?? body.token)
+  // if (has(body, 'token') && !isMd5(body.token)) body.token = await hash(body.token)
 }
 
 export default doboSumbaUserAfterRecordValidation

package/bajo/hook/dobo.sumba-user@before-record-create.js

@@ -0,0 +1,9 @@
+import resetToken from '../../lib/reset-token.js'
+
+async function afterRecordCreate (body, options = {}) {
+  const { token, salt } = await resetToken.call(this)
+  body.token = token
+  body.salt = salt
+}
+
+export default afterRecordCreate

package/bajo/hook/dobo.sumba-user@before-record-update.js

@@ -0,0 +1,11 @@
+import resetToken from '../../lib/reset-token.js'
+
+async function beforeRecordUpdate (id, body, options = {}) {
+  if (body.salt) {
+    const { token, salt } = await resetToken.call(this, body.salt)
+    body.token = token
+    body.salt = salt
+  }
+}
+
+export default beforeRecordUpdate

package/bajo/hook/dobo@before-record-find.js

@@ -1,10 +1,13 @@
+const useAdmin = ['waibuAdmin']
+
 export async function rebuildFilter (model, filter, req) {
-  const { isEmpty, map } = this.app.bajo.lib._
+  const { isEmpty, map, find, get } = this.app.bajo.lib._
   const { hasColumn } = this
   filter.query = filter.query ?? {}
   const hasSiteId = await hasColumn('siteId', model)
   const hasUserId = await hasColumn('userId', model)
   const hasTeamId = await hasColumn('teamId', model)
+  const isAdmin = find(req.user.teams, { alias: 'administrator' }) && useAdmin.includes(get(req, 'routeOptions.config.ns'))
   if (!(hasSiteId || hasUserId || hasTeamId)) return filter
   const q = { $and: [] }
   if (!isEmpty(filter.query)) {
@@ -12,11 +15,11 @@ export async function rebuildFilter (model, filter, req) {
     else q.$and.push(filter.query)
   }
   if (hasSiteId) q.$and.push({ siteId: req.site.id })
-  if (hasTeamId) {
+  if (hasTeamId && !isAdmin) {
     const teamIds = map(req.user.teams, 'id')
     if (hasUserId) q.$and.push({ $or: [{ teamId: { $in: teamIds } }, { userId: req.user.id }] })
     else q.$and.push({ teamId: { $in: teamIds } })
-  } else {
+  } else if (!isAdmin) {
     if (hasUserId) q.$and.push({ userId: req.user.id })
   }
   filter.query = q

package/bajo/hook/waibu@after-app-boot.js

@@ -2,6 +2,8 @@ import collectRoutes from '../../lib/collect-routes.js'
 import collectTeam from '../../lib/collect-team.js'
 
 async function afterAppBoot () {
+  const { runHook } = this.app.bajo
+  await runHook(`${this.name}:beforeBoot`)
   this.log.trace('collectingRouteGuards')
   await collectRoutes.call(this, 'secure')
   this.log.trace('secureRoutes%d', this.secureRoutes.length)
@@ -13,6 +15,7 @@ async function afterAppBoot () {
   await collectTeam.call(this)
   this.log.trace('teamRoutes%d', this.teamRoutes.length)
   this.log.trace('teamNegRoutes%d', this.teamNegRoutes.length)
+  await runHook(`${this.name}:afterBoot`)
 }
 
 export default afterAppBoot

package/bajo/intl/id.json

@@ -77,8 +77,8 @@
   "forgotPasswordLink": "Tautan Lupa Kata Sandi",
   "forgotPasswordChanged": "Kata Sandi Sukses Diubah",
   "collectingTeamGuards": "Mengoleksi pertahanan tim:",
-  "teamRoutes%d": "- Akses: %d",
-  "teamNegRoutes%d": "- Akses, dinegasikan: %d",
+  "teamRoutes%d": "- Jalur: %d",
+  "teamNegRoutes%d": "- Jalur, dinegasikan: %d",
   "moreInfoContactAdmin": "Mohon <c:a href='sumba:/help/contact-form'>hubungi</c:a> Admin Anda untuk keterangan lebih lanjut, terima kasih!",
   "restricted": "Pembatasan",
   "fullscreen": "Layar Penuh",

package/dobo/schema/user.json

@@ -15,6 +15,11 @@
     "type": "string",
     "maxLength": 50,
     "index": true
+  }, {
+    "name": "salt",
+    "type": "string",
+    "maxLength": 50,
+    "required": true
   }, {
     "name": "email",
     "type": "string",
@@ -43,7 +48,7 @@
     "fields": ["email", "siteId"],
     "unique": true
   }],
-  "hidden": ["password"],
+  "hidden": ["password", "token"],
   "feature": {
     "sumba.address": true,
     "sumba.social": true,

package/lib/check-user-id.js

@@ -29,10 +29,10 @@ async function mergeSetting (req) {
 }
 
 async function checkUserId (req, reply, source) {
-  const { isEmpty, camelCase } = this.app.bajo.lib._
+  const { isEmpty, camelCase, get } = this.app.bajo.lib._
   const { routePath } = this.app.waibu
 
-  const ctx = this.app[source].instance
+  const webApp = get(req, 'routeOptions.config.webApp', 'waibu')
   if (!req.routeOptions.url) {
     if (!req.session) return
     await setUser.call(this, req)
@@ -65,13 +65,13 @@ async function checkUserId (req, reply, source) {
       await setUser.call(this, req)
       return
     }
-    const authMethods = this.config.auth[securePath.source].methods ?? []
+    const authMethods = this.config.auth[webApp].methods ?? []
     if (isEmpty(authMethods)) throw this.error('noAuthMethod', { statusCode: 500 })
     let success
     for (const m of authMethods) {
       const handler = this[camelCase(`verify ${m}`)]
       if (!handler) throw this.error('invalidAuthMethod%s', m, { statusCode: 500 })
-      const check = await handler(req, reply, source, ctx)
+      const check = await handler(req, reply, source)
       if (check) {
         success = check
         break

package/lib/collect-routes.js

@@ -1,18 +1,19 @@
 export async function collect ({ type = '', handler, container, file, ns, dir }) {
   const { readConfig } = this.app.bajo
-  const { routePath } = this.app.waibu
-  const { camelCase, find, isString } = this.app.bajo.lib._
+  const { routePath, routePathHandlers } = this.app.waibu
+  const { camelCase, find, isString, isEmpty } = this.app.bajo.lib._
   const items = await readConfig(file, { ignoreError: true })
-  const [item] = file.replace(dir, '').split('@')
-  let [source, subNs] = item.split('.').map(s => camelCase(s))
-  subNs = subNs ? `.${subNs}` : ''
 
   for (let item of items) {
     if (isString(item)) item = { path: item }
-    item.source = source
+    const routeHandler = item.routeHandler
+    delete item.routeHandler
+    if (!isEmpty(routeHandler) && !routePathHandlers[routeHandler]) continue
+    const rns = routeHandler ? routePathHandlers[routeHandler].ns : 'waibuMpa'
+    if (!this.app[rns]) continue
     const isNeg = item.path[0] === '!'
     if (isNeg) item.path = item.path.slice(1)
-    item.path = routePath(`${ns}${subNs}:${item.path}`)
+    item.path = routePath(`${ns}${routeHandler ? ('.' + routeHandler) : ''}:${item.path}`)
     item.methods = item.methods ?? ['*']
     if (handler) await handler.call(this, item)
     const guards = this[camelCase(`${type} ${isNeg ? 'Neg' : ''} ${container}`)]
@@ -31,18 +32,10 @@ function handler (item) {
 
 async function collectRoutes (type) {
   const { eachPlugins } = this.app.bajo
-
-  this[`${type}Routes`] = this[`${type}Routes`] ?? []
-  this[`${type}NegRoutes`] = this[`${type}NegRoutes`] ?? []
-  const items = []
-  if (this.app.waibuStatic) items.push('waibuStatic.asset', 'waibuStatic.virtual', 'waibu-static.asset', 'waibu-static.virtual')
-  if (this.app.waibuRestApi) items.push('waibuRestApi.restapi', 'waibu-rest-api.restapi')
-  if (this.app.waibuMpa) items.push('waibuMpa', 'waibu-mpa')
-  const pattern = `{${items.join(',')}}@${type}-routes.*`
   const me = this
   await eachPlugins(async function ({ file, ns, dir }) {
     await collect.call(me, { type, container: 'Routes', handler, file, ns, dir })
-  }, { glob: pattern, prefix: this.name })
+  }, { glob: `route/${type}.*`, prefix: this.name })
 }
 
 export default collectRoutes

package/lib/collect-team.js

@@ -10,18 +10,10 @@ function handler (item) {
 
 async function collectTeam () {
   const { eachPlugins } = this.app.bajo
-
-  this.teamRoutes = this.teamRoutes ?? []
-  this.teamNegRoutes = this.teamNegRoutes ?? []
-  const items = []
-  if (this.app.waibuStatic) items.push('waibuStatic.asset', 'waibuStatic.virtual', 'waibu-static.asset', 'waibu-static.virtual')
-  if (this.app.waibuRestApi) items.push('waibuRestApi', 'waibu-rest-api')
-  if (this.app.waibuMpa) items.push('waibuMpa', 'waibu-mpa')
-  const pattern = `{${items.join(',')}}@team-routes.*`
   const me = this
   await eachPlugins(async function ({ file, ns, dir }) {
     await collect.call(me, { type: 'team', container: 'Routes', handler, file, ns, dir })
-  }, { glob: pattern, prefix: this.name })
+  }, { glob: 'route/team.*', prefix: this.name })
 }
 
 export default collectTeam

package/lib/reset-token.js

@@ -0,0 +1,9 @@
+async function resetToken (salt) {
+  const { generateId } = this.app.bajo
+  const { hash } = this.app.bajoExtra
+  salt = salt ?? generateId()
+  const token = await hash(await hash(salt))
+  return { salt, token }
+}
+
+export default resetToken

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sumba",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "Bajo Framework's Biz Suite",
   "main": "index.js",
   "scripts": {

package/plugin/factory.js

@@ -104,6 +104,13 @@ async function factory (pkgName) {
       this.unsafeUserFields = ['password']
     }
 
+    init = async () => {
+      for (const type of ['secure', 'anonymous', 'team']) {
+        this[`${type}Routes`] = this[`${type}Routes`] ?? []
+        this[`${type}NegRoutes`] = this[`${type}NegRoutes`] ?? []
+      }
+    }
+
     hasColumn = async (name, model) => {
       const { getInfo } = this.app.dobo
       const { find } = this.app.bajo.lib._

package/sumba/route/anonymous.json

@@ -0,0 +1,11 @@
+[{
+  "path": "/user/**/*",
+  "methods": ["*"]
+}, {
+  "path": "/signin",
+  "methods": ["*"]
+}, {
+  "path": "/user/access-token/**/*",
+  "routeHandler": "restapi",
+  "methods": ["*"]
+}]

package/sumba/route/secure.json

@@ -0,0 +1,11 @@
+[
+  "/my-stuff/**/*",
+  "/signout",
+  "/help/trouble-tickets/**/*",
+{
+  "path": "/user/api-key",
+  "routeHandler": "restapi"
+}, {
+  "path": "/my-stuff/**/*",
+  "routeHandler": "restapi"
+}]

package/waibuMpa/route/my-stuff/profile.js

@@ -6,7 +6,7 @@ const profile = {
     const options = { forceNoHidden: true, noHook: true, noCache: true, attachment: true, mimeType: true }
     const resp = await recordGet({ model: 'SumbaUser', req, id: req.user.id, options })
     const form = resp.data
-    form.token = await hash(form.token)
+    form.token = await hash(form.salt)
     return reply.view('sumba.template:/my-stuff/profile/view.html', { form })
   }
 }

package/waibuMpa/route/my-stuff/reset-api-key.js

@@ -9,7 +9,7 @@ const resetApiKey = {
     const delay = await importPkg('delay')
     const bcrypt = await importPkg('bajoExtra:bcrypt')
     const Joi = await importPkg('dobo:joi')
-    const form = defaultsDeep(req.body, { apiKey: await hash(req.user.token) })
+    const form = defaultsDeep(req.body, { apiKey: await hash(req.user.salt) })
     let error
     if (req.method === 'POST') {
       try {
@@ -24,7 +24,7 @@ const resetApiKey = {
         const rec = await recordGet(model, req.user.id, { forceNoHidden: true })
         const verified = await bcrypt.compare(req.body.password, rec.password)
         if (!verified) throw this.error('validationError', { details: [{ field: 'password', error: 'invalidPassword' }], statusCode: 400 })
-        await recordUpdate(model, req.user.id, { token: generateId() }, { req, reply, noFlash: true })
+        await recordUpdate(model, req.user.id, { salt: generateId() }, { req, reply, noFlash: true })
         await delay(2000) // ensure req.user cache is expired
         req.flash('notify', req.t('resetApiKeySuccessfull'))
         return reply.redirectTo('sumba:/my-stuff/profile')

package/waibuMpa/route/user/activation.js

@@ -4,15 +4,15 @@ const userActivation = {
   method: ['GET', 'POST'],
   handler: async function (req, reply) {
     const { defaultsDeep } = this.app.bajo
-    const { recordFind, recordUpdate } = this.app.waibuDb
+    const { recordFind, recordUpdate } = this.app.dobo
     const form = defaultsDeep(req.body, { key: req.query.key })
     let error
     if (req.method === 'POST') {
       try {
         const query = { status: 'UNVERIFIED', token: req.body.key }
-        const result = await recordFind({ model, req, reply, options: { dataOnly: true, query, limit: 1, noHook: true } })
+        const result = await recordFind(model, { query, limit: 1 })
         if (result.length === 0) throw this.error('validationError', { details: [{ field: 'key', error: 'invalidActivationKey' }] })
-        await recordUpdate({ model, req, reply, id: result[0].id, body: { status: 'ACTIVE' }, options: { noValidation: true, noFlash: true } })
+        await recordUpdate(model, result[0].id, { status: 'ACTIVE' }, { noValidation: true, noFlash: true })
         req.flash('notify', req.t('userActivated'))
         return reply.redirectTo(this.config.redirect.signin, req)
       } catch (err) {

package/waibuRestApi/route/my-stuff/api-key/get.js

@@ -0,0 +1,14 @@
+import { response } from './update.js'
+
+async function get ({ ctx }) {
+  const { hash } = this.app.bajoExtra
+  const { recordGet } = this.app.dobo
+  const schema = { response: await response.call(this) }
+  const handler = async function get (req, reply) {
+    const rec = await recordGet('SumbaUser', req.user.id, { forceNoHidden: true })
+    return { data: { token: await hash(rec.salt) } }
+  }
+  return { schema, handler }
+}
+
+export default get

package/waibuRestApi/route/my-stuff/api-key/update.js

@@ -0,0 +1,44 @@
+import { data } from '../../../../lib/token-schema.js'
+
+export function response () {
+  return {
+    '2xx': {
+      description: 'Successfull response',
+      type: 'object',
+      properties: this.app.waibuRestApi.transformResult({ data })
+    }
+  }
+}
+
+export const body = {
+  type: 'object',
+  properties: {
+    password: {
+      type: 'string'
+    }
+  }
+}
+
+const model = 'SumbaUser'
+
+async function update ({ ctx }) {
+  const { importPkg, generateId } = this.app.bajo
+  const { recordGet, recordUpdate } = this.app.dobo
+  const { hash } = this.app.bajoExtra
+  const bcrypt = await importPkg('bajoExtra:bcrypt')
+
+  const schema = { body, response: await response.call(this) }
+
+  const handler = async function get (req, reply, options) {
+    const rec = await recordGet(model, req.user.id, { forceNoHidden: true })
+    const verified = await bcrypt.compare(req.body.password, rec.password)
+    if (!verified) throw this.error('invalidPassword', { details: [{ field: 'password', error: 'invalidPassword' }], statusCode: 400 })
+    const input = { salt: generateId() }
+    const resp = await recordUpdate(model, req.user.id, input, { forceNoHidden: true })
+    return { data: { token: await hash(resp.salt) } }
+  }
+
+  return { schema, handler }
+}
+
+export default update

package/waibuRestApi/route/my-stuff/change-password/update.js

@@ -40,7 +40,7 @@ async function update ({ ctx }) {
   }
 
   const handler = async function get (req, reply, options) {
-    const rec = await recordGet(model, req.user.id)
+    const rec = await recordGet(model, req.user.id, { forceNoHidden: true })
     const verified = await bcrypt.compare(req.body.currentPassword, rec.password)
     if (!verified) throw this.error('invalidCurrentPassword', { details: [{ field: 'current', error: 'invalidPassword' }], statusCode: 400 })
     const input = { password: req.body.password }

package/waibuRestApi/route/my-stuff/profile/get.js

@@ -1,5 +1,5 @@
 const model = 'SumbaUser'
-const hidden = ['password', 'token', 'siteId']
+const hidden = ['password', 'token', 'siteId', 'salt']
 
 async function get ({ ctx }) {
   const { recordGet } = this.app.waibuDb

package/waibuRestApi/route/user/access-token/@type/create.js

@@ -22,7 +22,7 @@ async function create () {
       const jwt = await createJwtFromUserRecord(rec)
       return { data: jwt }
     }
-    return { data: { token: await hash(rec.password) } }
+    return { data: { token: await hash(rec.salt) } }
   }
   return { schema, handler }
 }

package/sumba/waibu-mpa@anonymous-routes.json

@@ -1,7 +0,0 @@
-[{
-  "path": "/user/**/*",
-  "methods": ["*"]
-}, {
-  "path": "/signin",
-  "methods": ["*"]
-}]

package/sumba/waibu-mpa@secure-routes.json

@@ -1,10 +0,0 @@
-[{
-  "path": "/my-stuff/**/*",
-  "methods": ["*"]
-}, {
-  "path": "/signout",
-  "methods": ["*"]
-}, {
-  "path": "/help/trouble-tickets/**/*",
-  "methods": ["*"]
-}]

package/sumba/waibu-rest-api.restapi@anonymous-routes.json

@@ -1,4 +0,0 @@
-[{
-  "path": "/user/access-token/**/*",
-  "methods": ["*"]
-}]

package/sumba/waibu-rest-api.restapi@secure-routes.json

@@ -1,7 +0,0 @@
-[{
-  "path": "/user/api-key",
-  "methods": ["*"]
-}, {
-  "path": "/my-stuff/**/*",
-  "methods": ["*"]
-}]