underpost 2.8.87 → 2.8.88

package/src/api/user/postman_collection.json

@@ -0,0 +1,216 @@
+{
+  "info": {
+    "_postman_id": "a1b2c3d4-e5f6-7890-1234-567890abcdef",
+    "name": "User API",
+    "description": "A collection of requests for the User API.",
+    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
+  },
+  "item": [
+    {
+      "name": "user",
+      "item": [
+        {
+          "name": "Log in",
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json",
+                "type": "text"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n    \"email\": \"user@example.com\",\n    \"password\": \"Password123\"\n}",
+              "options": {
+                "raw": {
+                  "language": "json"
+                }
+              }
+            },
+            "url": {
+              "raw": "{{baseUrl}}/user/auth",
+              "host": ["{{baseUrl}}"],
+              "path": ["user", "auth"]
+            },
+            "description": "This endpoint get a JWT for authenticated user"
+          },
+          "response": [
+            {
+              "name": "User logged in successfully",
+              "originalRequest": {
+                "method": "POST",
+                "header": [],
+                "body": {
+                  "mode": "raw",
+                  "raw": ""
+                },
+                "url": {
+                  "raw": "{{baseUrl}}/user/auth",
+                  "host": ["{{baseUrl}}"],
+                  "path": ["user", "auth"]
+                }
+              },
+              "status": "OK",
+              "code": 200,
+              "_postman_previewlanguage": "json",
+              "header": [
+                {
+                  "key": "Content-Type",
+                  "value": "application/json"
+                }
+              ],
+              "cookie": [],
+              "body": "{\n    \"status\": \"success\",\n    \"data\": {\n        \"token\": \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7Il9pZCI6IjY2YzM3N2Y1N2Y5OWU1OTY5YjgxZG...\",\n        \"user\": {\n            \"_id\": \"66c377f57f99e5969b81de89\",\n            \"email\": \"user@example.com\",\n            \"emailConfirmed\": false,\n            \"username\": \"user123\",\n            \"role\": \"user\",\n            \"profileImageId\": \"66c377f57f99e5969b81de87\"\n        }\n    }\n}"
+            }
+          ]
+        },
+        {
+          "name": "Create user",
+          "request": {
+            "method": "POST",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json",
+                "type": "text"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n    \"username\": \"user123\",\n    \"password\": \"Password123\",\n    \"email\": \"user@example.com\"\n}",
+              "options": {
+                "raw": {
+                  "language": "json"
+                }
+              }
+            },
+            "url": {
+              "raw": "{{baseUrl}}/user",
+              "host": ["{{baseUrl}}"],
+              "path": ["user"]
+            },
+            "description": "This endpoint will create a new user account"
+          },
+          "response": []
+        },
+        {
+          "name": "Get user data by ID",
+          "request": {
+            "auth": {
+              "type": "bearer",
+              "bearer": [
+                {
+                  "key": "token",
+                  "value": "{{authToken}}",
+                  "type": "string"
+                }
+              ]
+            },
+            "method": "GET",
+            "header": [],
+            "url": {
+              "raw": "{{baseUrl}}/user/:id",
+              "host": ["{{baseUrl}}"],
+              "path": ["user", ":id"],
+              "variable": [
+                {
+                  "key": "id",
+                  "value": "your_user_id"
+                }
+              ]
+            },
+            "description": "This endpoint get user data by ID"
+          },
+          "response": []
+        },
+        {
+          "name": "Update user data by ID",
+          "request": {
+            "auth": {
+              "type": "bearer",
+              "bearer": [
+                {
+                  "key": "token",
+                  "value": "{{authToken}}",
+                  "type": "string"
+                }
+              ]
+            },
+            "method": "PUT",
+            "header": [
+              {
+                "key": "Content-Type",
+                "value": "application/json",
+                "type": "text"
+              }
+            ],
+            "body": {
+              "mode": "raw",
+              "raw": "{\n    \"username\": \"newuser123\",\n    \"password\": \"NewPassword123\",\n    \"email\": \"newuser@example.com\"\n}",
+              "options": {
+                "raw": {
+                  "language": "json"
+                }
+              }
+            },
+            "url": {
+              "raw": "{{baseUrl}}/user/:id",
+              "host": ["{{baseUrl}}"],
+              "path": ["user", ":id"],
+              "variable": [
+                {
+                  "key": "id",
+                  "value": "your_user_id"
+                }
+              ]
+            },
+            "description": "This endpoint will update user data by ID"
+          },
+          "response": []
+        },
+        {
+          "name": "Delete user data by ID",
+          "request": {
+            "auth": {
+              "type": "bearer",
+              "bearer": [
+                {
+                  "key": "token",
+                  "value": "{{authToken}}",
+                  "type": "string"
+                }
+              ]
+            },
+            "method": "DELETE",
+            "header": [],
+            "url": {
+              "raw": "{{baseUrl}}/user/:id",
+              "host": ["{{baseUrl}}"],
+              "path": ["user", ":id"],
+              "variable": [
+                {
+                  "key": "id",
+                  "value": "your_user_id"
+                }
+              ]
+            },
+            "description": "This endpoint deletes user data by ID, the path ID must match with the ID of the authenticated user"
+          },
+          "response": []
+        }
+      ]
+    }
+  ],
+  "variable": [
+    {
+      "key": "baseUrl",
+      "value": "http://localhost:3000/api"
+    },
+    {
+      "key": "authToken",
+      "value": ""
+    }
+  ]
+}

package/src/api/user/user.controller.js

@@ -3,68 +3,33 @@ import { UserService } from './user.service.js';
 
 const logger = loggerFactory(import.meta);
 
-const UserController = {
-  post: async (req, res, options) => {
-    try {
-      const result = await UserService.post(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
-    }
-  },
-  get: async (req, res, options) => {
-    try {
-      const result = await UserService.get(req, res, options);
-      if (result instanceof Buffer) return res.status(200).end(result);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
-    }
-  },
-  delete: async (req, res, options) => {
-    try {
-      const result = await UserService.delete(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
+const handleRequest = (serviceMethod) => async (req, res, options) => {
+  try {
+    const result = await serviceMethod(req, res, options);
+    if (res.headersSent) {
+      return;
     }
-  },
-  put: async (req, res, options) => {
-    try {
-      const result = await UserService.put(req, res, options);
-      return res.status(200).json({
-        status: 'success',
-        data: result,
-      });
-    } catch (error) {
-      logger.error(error, error.stack);
-      return res.status(400).json({
-        status: 'error',
-        message: error.message,
-      });
+    if (result instanceof Buffer) {
+      return res.status(200).end(result);
     }
-  },
+    return res.status(200).json({
+      status: 'success',
+      data: result,
+    });
+  } catch (error) {
+    logger.error(error, error.stack);
+    return res.status(400).json({
+      status: 'error',
+      message: error.message,
+    });
+  }
+};
+
+const UserController = {
+  post: handleRequest(UserService.post),
+  get: handleRequest(UserService.get),
+  delete: handleRequest(UserService.delete),
+  put: handleRequest(UserService.put),
 };
 
 export { UserController };

package/src/api/user/user.model.js

@@ -1,7 +1,7 @@
 import { Schema, model } from 'mongoose';
 import validator from 'validator';
 import { userRoleEnum } from '../../client/components/core/CommonJs.js';
-
+import crypto from 'crypto';
 // https://mongoosejs.com/docs/2.7.x/docs/schematypes.html
 
 const UserSchema = new Schema(
@@ -22,6 +22,19 @@ const UserSchema = new Schema(
     password: { type: String, trim: true, required: 'Password is required' },
     username: { type: String, trim: true, unique: true, required: 'Username is required' },
     role: { type: String, enum: userRoleEnum, default: 'guest' },
+    activeSessions: {
+      type: [
+        {
+          tokenHash: { type: String, required: true },
+          ip: { type: String },
+          userAgent: { type: String },
+          expiresAt: { type: Date, required: true },
+          host: { type: String },
+          path: { type: String },
+        },
+      ],
+      default: [],
+    },
     profileImageId: { type: Schema.Types.ObjectId, ref: 'File' },
     phoneNumbers: [
       {
@@ -63,15 +76,24 @@ const UserDto = {
       return { _id: 1, username: 1, email: 1, role: 1, emailConfirmed: 1, profileImageId: 1 };
     },
     getAll: () => {
-      return { _id: 1, name: 1 };
+      return { _id: 1 };
     },
   },
   auth: {
-    // TODO: -> set login device, location, ip, fingerprint
-    //          and validate on authorization middleware
-    //       -> dynamic refresh 100 tokens per session with 12h interval
-    //       -> back secret per user, registrarion user model -> secret: { type: String }
-    payload: (user) => ({ _id: user._id.toString(), role: user.role, email: user.email }),
+    payload: (user, jwtid, ip, userAgent, host, path) => {
+      const tokenPayload = {
+        _id: user._id.toString(),
+        role: user.role,
+        email: user.email,
+        ip,
+        userAgent,
+        host,
+        path,
+        jwtid: jwtid ?? crypto.randomBytes(8).toString('hex'),
+        refreshExpiresAt: Date.now() + parseInt(process.env.REFRESH_EXPIRE_MINUTES) * 60 * 1000,
+      };
+      return tokenPayload;
+    },
   },
 };
 

package/src/api/user/user.router.js

@@ -1,25 +1,28 @@
-import { authMiddleware, hashPassword } from '../../server/auth.js';
+import { hashPassword } from '../../server/auth.js';
 import fs from 'fs-extra';
 import { loggerFactory } from '../../server/logger.js';
 import { UserController } from './user.controller.js';
 import express from 'express';
 import { DataBaseProvider } from '../../db/DataBaseProvider.js';
 import { FileFactory } from '../file/file.service.js';
+import { s4 } from '../../client/components/core/CommonJs.js';
 
 const logger = loggerFactory(import.meta);
 
 const UserRouter = (options) => {
   const router = express.Router();
+  const authMiddleware = options.authMiddleware;
 
   (async () => {
     // admin user seed
     try {
       const models = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models;
+      let adminUser;
       if (models.User) {
-        const adminUser = await models.User.findOne({ role: 'admin' });
+        adminUser = await models.User.findOne({ role: 'admin' });
         if (!adminUser) {
           const defaultPassword = process.env.DEFAULT_ADMIN_PASSWORD || 'changethis';
-          const hashedPassword = hashPassword(defaultPassword);
+          const hashedPassword = await hashPassword(defaultPassword);
 
           const result = await models.User.create({
             username: 'admin',
@@ -45,6 +48,9 @@ const UserRouter = (options) => {
         check: fs.readFileSync(`./src/client/public/default/assets/mailer/api-user-check.png`),
       },
       header: (res) => {
+        res.set('Cross-Origin-Resource-Policy', 'cross-origin');
+        res.set('Access-Control-Allow-Origin', '*');
+        res.set('Access-Control-Allow-Headers', '*');
         res.set('Content-Type', 'image/png');
       },
     };

package/src/api/user/user.service.js

@@ -1,5 +1,16 @@
 import { loggerFactory } from '../../server/logger.js';
-import { hashPassword, verifyPassword, hashJWT, verifyJWT, validatePasswordMiddleware } from '../../server/auth.js';
+import {
+  hashPassword,
+  verifyPassword,
+  verifyJWT,
+  createSessionAndUserToken,
+  createUserAndSession,
+  refreshSessionAndToken,
+  hashToken,
+  jwtSign,
+  getBearerToken,
+  validatePasswordMiddleware,
+} from '../../server/auth.js';
 import { MailerProvider } from '../../mailer/MailerProvider.js';
 import { CoreWsMailerManagement } from '../../ws/core/management/core.ws.mailer.js';
 import { CoreWsEmit } from '../../ws/core/core.ws.emit.js';
@@ -27,8 +38,8 @@ const UserService = {
 
       if (!user) throw new Error('Email address does not exist');
 
-      const token = hashJWT({ email: req.body.email }, '15m');
-      const payloadToken = hashJWT({ email: req.body.email }, '15m');
+      const token = jwtSign({ email: req.body.email }, options, 15);
+      const payloadToken = jwtSign({ email: req.body.email }, options, 15);
       const id = `${options.host}${options.path}`;
       const translate = MailerProvider.instance[id].translateTemplates.recoverEmail;
       const recoverUrl = `${process.env.NODE_ENV === 'development' ? 'http://' : 'https://'}${req.body.hostname}${
@@ -65,7 +76,7 @@ const UserService = {
     if (req.path.startsWith('/mailer') && req.params.id === 'verify-email') {
       if (!validator.isEmail(req.body.email)) throw { message: 'invalid email' };
 
-      const token = hashJWT({ email: req.body.email });
+      const token = jwtSign({ email: req.body.email }, options, 15);
       const id = `${options.host}${options.path}`;
       const user = await User.findById(req.auth.user._id);
 
@@ -145,8 +156,13 @@ const UserService = {
                     runValidators: true,
                   },
                 );
+
+                const { jwtid } = await createSessionAndUserToken(user, User, req, res, options);
                 return {
-                  token: hashJWT({ user: UserDto.auth.payload(user) }),
+                  token: jwtSign(
+                    UserDto.auth.payload(user, jwtid, req.ip, req.headers['user-agent'], options.host, options.path),
+                    options,
+                  ),
                   user,
                 };
               } else throw new Error(accountLocketMessage());
@@ -193,33 +209,24 @@ const UserService = {
             } catch (error) {
               logger.error(error, { params: req.params, body: req.body });
             }
-            throw new Error(`invalid email or password, remaining attempts: ${5 - user.failedLoginAttempts}`);
+            throw new Error(`Invalid credentials. Remaining attempts: ${5 - user.failedLoginAttempts}`);
           }
-        } else throw new Error('invalid email or password');
+        } else throw new Error('Invalid credentials');
 
       case 'guest': {
         const user = await ValkeyAPI.valkeyObjectFactory(options, 'user');
         await ValkeyAPI.setValkeyObject(options, user.email, user);
         return {
-          token: hashJWT({ user: UserDto.auth.payload(user) }),
+          token: jwtSign(
+            UserDto.auth.payload(user, null, req.ip, req.headers['user-agent'], options.host, options.path),
+            options,
+          ),
           user: selectDtoFactory(user, UserDto.select.get()),
         };
       }
 
       default: {
-        const validatePassword = validatePasswordMiddleware(req.body.password);
-        if (validatePassword.status === 'error') throw new Error(validatePassword.message);
-        req.body.password = await hashPassword(req.body.password);
-        req.body.role = req.body.role === 'guest' ? 'guest' : 'user';
-        req.body.profileImageId = await options.getDefaultProfileImageId(File);
-        const { _id } = await new User(req.body).save();
-        if (_id) {
-          const user = await User.findOne({ _id }).select(UserDto.select.get());
-          return {
-            token: hashJWT({ user: UserDto.auth.payload(user) }),
-            user,
-          };
-        } else throw new Error('failed to create user');
+        return await createUserAndSession(req, res, User, File, options);
       }
     }
   },
@@ -239,7 +246,7 @@ const UserService = {
     if (req.path.startsWith('/recover')) {
       let payload;
       try {
-        payload = verifyJWT(req.params.id);
+        payload = verifyJWT(req.params.id, options);
       } catch (error) {
         logger.error(error, { 'req.params.id': req.params.id });
         options.png.header(res);
@@ -254,7 +261,7 @@ const UserService = {
           _id,
           { recoverTimeOut: new Date(+new Date() + 1000 * 60 * 15) },
           { runValidators: true },
-        ); // 15m
+        );
         options.png.header(res);
         return options.png.buffer['recover'];
       } else {
@@ -266,7 +273,7 @@ const UserService = {
     if (req.path.startsWith('/mailer')) {
       let payload;
       try {
-        payload = verifyJWT(req.params.id);
+        payload = verifyJWT(req.params.id, options);
       } catch (error) {
         logger.error(error, { 'req.params.id': req.params.id });
         options.png.header(res);
@@ -294,8 +301,24 @@ const UserService = {
     }
 
     switch (req.params.id) {
-      case 'all':
-        return await User.find().select(UserDto.select.getAll());
+      case 'all': {
+        if (req.auth.user.role === 'admin') {
+          const page = parseInt(req.query.page) || 1;
+          const limit = parseInt(req.query.limit) || 10;
+          const skip = (page - 1) * limit;
+
+          const data = await User.find().select(UserDto.select.get()).skip(skip).limit(limit);
+          const total = await User.countDocuments();
+
+          return {
+            data,
+            page,
+            limit,
+            total,
+            totalPages: Math.ceil(total / limit),
+          };
+        } else throw new Error(`Invalid token user id`);
+      }
 
       case 'auth': {
         let user;
@@ -307,6 +330,8 @@ const UserService = {
             _id: req.auth.user._id,
           });
 
+        if (!user) throw new Error('user not found');
+
         const file = await File.findOne({ _id: user.profileImageId });
 
         if (!file && !(await ValkeyAPI.getValkeyObject(options, req.auth.user.email))) {
@@ -318,11 +343,20 @@ const UserService = {
             },
           );
         }
-        return (await ValkeyAPI.getValkeyObject(options, req.auth.user.email))
-          ? selectDtoFactory(await ValkeyAPI.getValkeyObject(options, req.auth.user.email), UserDto.select.get())
-          : await User.findOne({
-              _id: req.auth.user._id,
-            }).select(UserDto.select.get());
+
+        const guestUser = await ValkeyAPI.getValkeyObject(options, req.auth.user.email);
+        if (guestUser)
+          return {
+            user: selectDtoFactory(guestUser, UserDto.select.get()),
+            token: getBearerToken(req),
+          };
+
+        return {
+          token: await refreshSessionAndToken(req, res, User, options),
+          user: await User.findOne({
+            _id: req.auth.user._id,
+          }).select(UserDto.select.get()),
+        };
       }
 
       default: {
@@ -346,6 +380,20 @@ const UserService = {
   delete: async (req, res, options) => {
     /** @type {import('./user.model.js').UserModel} */
     const User = DataBaseProvider.instance[`${options.host}${options.path}`].mongoose.models.User;
+
+    if (req.params.id === 'logout') {
+      const refreshToken = req.cookies?.refreshToken;
+      if (refreshToken) {
+        const hashedToken = hashToken(refreshToken);
+        await User.updateOne(
+          { 'activeSessions.tokenHash': hashedToken },
+          { $pull: { activeSessions: { tokenHash: hashedToken } } },
+        );
+      }
+      res.clearCookie('refreshToken');
+      return { message: 'Logged out successfully' };
+    }
+
     switch (req.params.id) {
       default: {
         const user = await User.findOne({
@@ -401,10 +449,14 @@ const UserService = {
     }
 
     if (req.path.startsWith('/recover')) {
-      const payload = verifyJWT(req.params.id);
+      const payload = verifyJWT(req.params.id, options);
       const user = await User.findOne({
         email: payload.email,
       });
+      if (process.env.NODE_ENV === 'development') {
+        logger.warn('Only production check image token request on mailer GET /user/recover, set fallback timeout');
+        user.recoverTimeOut = new Date(+new Date() + 1000 * 60 * 15);
+      }
       if (user && new Date().getTime() < new Date(user.recoverTimeOut).getTime()) {
         const validatePassword = validatePasswordMiddleware(req.body.password);
         if (validatePassword.status === 'error') throw new Error(validatePassword.message);