sumba 1.1.4 → 1.1.5

package/bajo/hook/dobo.sumba-user@after-record-validation.js

@@ -1,9 +1,9 @@
 async function doboSumbaUserAfterRecordValidation (body, options) {
-  const { isBcrypt, isMd5, hash } = this.app.bajoExtra
+  const { isBcrypt, hash } = this.app.bajoExtra
   const { has } = this.app.bajo.lib._
 
   if (has(body, 'password') && !isBcrypt(body.password)) body.password = await hash(body.password, 'bcrypt')
-  if (has(body, 'token') && !isMd5(body.token)) body.token = await hash(body.password ?? body.token)
+  // if (has(body, 'token') && !isMd5(body.token)) body.token = await hash(body.token)
 }
 
 export default doboSumbaUserAfterRecordValidation

package/bajo/hook/dobo.sumba-user@before-record-create.js

@@ -0,0 +1,9 @@
+import resetToken from '../../lib/reset-token.js'
+
+async function afterRecordCreate (body, options = {}) {
+  const { token, salt } = await resetToken.call(this)
+  body.token = token
+  body.salt = salt
+}
+
+export default afterRecordCreate

package/bajo/hook/dobo.sumba-user@before-record-update.js

@@ -0,0 +1,11 @@
+import resetToken from '../../lib/reset-token.js'
+
+async function beforeRecordUpdate (id, body, options = {}) {
+  if (body.salt) {
+    const { token, salt } = await resetToken.call(this, body.salt)
+    body.token = token
+    body.salt = salt
+  }
+}
+
+export default beforeRecordUpdate

package/dobo/schema/user.json

@@ -15,6 +15,11 @@
     "type": "string",
     "maxLength": 50,
     "index": true
+  }, {
+    "name": "salt",
+    "type": "string",
+    "maxLength": 50,
+    "required": true
   }, {
     "name": "email",
     "type": "string",
@@ -43,7 +48,7 @@
     "fields": ["email", "siteId"],
     "unique": true
   }],
-  "hidden": ["password"],
+  "hidden": ["password", "token"],
   "feature": {
     "sumba.address": true,
     "sumba.social": true,

package/lib/reset-token.js

@@ -0,0 +1,9 @@
+async function resetToken (salt) {
+  const { generateId } = this.app.bajo
+  const { hash } = this.app.bajoExtra
+  salt = salt ?? generateId()
+  const token = await hash(await hash(salt))
+  return { salt, token }
+}
+
+export default resetToken

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sumba",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Bajo Framework's Biz Suite",
   "main": "index.js",
   "scripts": {

package/waibuMpa/route/my-stuff/profile.js

@@ -6,7 +6,7 @@ const profile = {
     const options = { forceNoHidden: true, noHook: true, noCache: true, attachment: true, mimeType: true }
     const resp = await recordGet({ model: 'SumbaUser', req, id: req.user.id, options })
     const form = resp.data
-    form.token = await hash(form.token)
+    form.token = await hash(form.salt)
     return reply.view('sumba.template:/my-stuff/profile/view.html', { form })
   }
 }

package/waibuMpa/route/my-stuff/reset-api-key.js

@@ -9,7 +9,7 @@ const resetApiKey = {
     const delay = await importPkg('delay')
     const bcrypt = await importPkg('bajoExtra:bcrypt')
     const Joi = await importPkg('dobo:joi')
-    const form = defaultsDeep(req.body, { apiKey: await hash(req.user.token) })
+    const form = defaultsDeep(req.body, { apiKey: await hash(req.user.salt) })
     let error
     if (req.method === 'POST') {
       try {
@@ -24,7 +24,7 @@ const resetApiKey = {
         const rec = await recordGet(model, req.user.id, { forceNoHidden: true })
         const verified = await bcrypt.compare(req.body.password, rec.password)
         if (!verified) throw this.error('validationError', { details: [{ field: 'password', error: 'invalidPassword' }], statusCode: 400 })
-        await recordUpdate(model, req.user.id, { token: generateId() }, { req, reply, noFlash: true })
+        await recordUpdate(model, req.user.id, { salt: generateId() }, { req, reply, noFlash: true })
         await delay(2000) // ensure req.user cache is expired
         req.flash('notify', req.t('resetApiKeySuccessfull'))
         return reply.redirectTo('sumba:/my-stuff/profile')

package/waibuMpa/route/user/activation.js

@@ -4,15 +4,15 @@ const userActivation = {
   method: ['GET', 'POST'],
   handler: async function (req, reply) {
     const { defaultsDeep } = this.app.bajo
-    const { recordFind, recordUpdate } = this.app.waibuDb
+    const { recordFind, recordUpdate } = this.app.dobo
     const form = defaultsDeep(req.body, { key: req.query.key })
     let error
     if (req.method === 'POST') {
       try {
         const query = { status: 'UNVERIFIED', token: req.body.key }
-        const result = await recordFind({ model, req, reply, options: { dataOnly: true, query, limit: 1, noHook: true } })
+        const result = await recordFind(model, { query, limit: 1 })
         if (result.length === 0) throw this.error('validationError', { details: [{ field: 'key', error: 'invalidActivationKey' }] })
-        await recordUpdate({ model, req, reply, id: result[0].id, body: { status: 'ACTIVE' }, options: { noValidation: true, noFlash: true } })
+        await recordUpdate(model, result[0].id, { status: 'ACTIVE' }, { noValidation: true, noFlash: true })
         req.flash('notify', req.t('userActivated'))
         return reply.redirectTo(this.config.redirect.signin, req)
       } catch (err) {

package/waibuRestApi/route/my-stuff/api-key/get.js

@@ -0,0 +1,14 @@
+import { response } from './update.js'
+
+async function get ({ ctx }) {
+  const { hash } = this.app.bajoExtra
+  const { recordGet } = this.app.dobo
+  const schema = { response: await response.call(this) }
+  const handler = async function get (req, reply) {
+    const rec = await recordGet('SumbaUser', req.user.id, { forceNoHidden: true })
+    return { data: { token: await hash(rec.salt) } }
+  }
+  return { schema, handler }
+}
+
+export default get

package/waibuRestApi/route/my-stuff/api-key/update.js

@@ -0,0 +1,44 @@
+import { data } from '../../../../lib/token-schema.js'
+
+export function response () {
+  return {
+    '2xx': {
+      description: 'Successfull response',
+      type: 'object',
+      properties: this.app.waibuRestApi.transformResult({ data })
+    }
+  }
+}
+
+export const body = {
+  type: 'object',
+  properties: {
+    password: {
+      type: 'string'
+    }
+  }
+}
+
+const model = 'SumbaUser'
+
+async function update ({ ctx }) {
+  const { importPkg, generateId } = this.app.bajo
+  const { recordGet, recordUpdate } = this.app.dobo
+  const { hash } = this.app.bajoExtra
+  const bcrypt = await importPkg('bajoExtra:bcrypt')
+
+  const schema = { body, response: await response.call(this) }
+
+  const handler = async function get (req, reply, options) {
+    const rec = await recordGet(model, req.user.id, { forceNoHidden: true })
+    const verified = await bcrypt.compare(req.body.password, rec.password)
+    if (!verified) throw this.error('invalidPassword', { details: [{ field: 'password', error: 'invalidPassword' }], statusCode: 400 })
+    const input = { salt: generateId() }
+    const resp = await recordUpdate(model, req.user.id, input, { forceNoHidden: true })
+    return { data: { token: await hash(resp.salt) } }
+  }
+
+  return { schema, handler }
+}
+
+export default update

package/waibuRestApi/route/my-stuff/change-password/update.js

@@ -40,7 +40,7 @@ async function update ({ ctx }) {
   }
 
   const handler = async function get (req, reply, options) {
-    const rec = await recordGet(model, req.user.id)
+    const rec = await recordGet(model, req.user.id, { forceNoHidden: true })
     const verified = await bcrypt.compare(req.body.currentPassword, rec.password)
     if (!verified) throw this.error('invalidCurrentPassword', { details: [{ field: 'current', error: 'invalidPassword' }], statusCode: 400 })
     const input = { password: req.body.password }

package/waibuRestApi/route/my-stuff/profile/get.js

@@ -1,5 +1,5 @@
 const model = 'SumbaUser'
-const hidden = ['password', 'token', 'siteId']
+const hidden = ['password', 'token', 'siteId', 'salt']
 
 async function get ({ ctx }) {
   const { recordGet } = this.app.waibuDb

package/waibuRestApi/route/user/access-token/@type/create.js

@@ -22,7 +22,7 @@ async function create () {
       const jwt = await createJwtFromUserRecord(rec)
       return { data: jwt }
     }
-    return { data: { token: await hash(rec.password) } }
+    return { data: { token: await hash(rec.salt) } }
   }
   return { schema, handler }
 }