302 lines
10 KiB
TypeScript
302 lines
10 KiB
TypeScript
import { Router, Response } from 'express';
|
|
import bcrypt from 'bcryptjs';
|
|
import jwt from 'jsonwebtoken';
|
|
import { users, refreshTokens, resetTokens } from '../db';
|
|
import { requireAuth } from '../middleware/requireAuth';
|
|
import { EmailService } from '../email/EmailService';
|
|
import { checkForgotPasswordRate, checkLoginRate, checkRegisterRate, sleep } from '../rateLimiter';
|
|
import { isSuperAdmin } from '../roles';
|
|
|
|
const router = Router();
|
|
|
|
const ACCESS_TOKEN_TTL = '1h';
|
|
const COOKIE_DOMAIN = process.env.COOKIE_DOMAIN ?? '.rokojori.com';
|
|
const RESET_BASE_URL = process.env.RESET_BASE_URL ?? 'https://account.rokojori.com';
|
|
const ACCOUNT_BASE_URL = process.env.RESET_BASE_URL ?? 'https://account.rokojori.com';
|
|
|
|
function issueAccessToken( userId: string ): string
|
|
{
|
|
const user = users.findById( userId )!;
|
|
const payload =
|
|
{
|
|
userId: user.id,
|
|
email: user.email,
|
|
roles: user.roles,
|
|
products: user.products.map( p => p.id ),
|
|
settings: user.settings
|
|
};
|
|
return jwt.sign( payload, process.env.JWT_SECRET ?? '', { expiresIn: ACCESS_TOKEN_TTL } );
|
|
}
|
|
|
|
function cookieOptions( maxAge: number )
|
|
{
|
|
return {
|
|
domain: COOKIE_DOMAIN,
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'lax' as const,
|
|
path: '/'
|
|
};
|
|
}
|
|
|
|
function setTokenCookie( res: Response, accessToken: string ): void
|
|
{
|
|
res.cookie( 'accessToken', accessToken, { ...cookieOptions( 60 * 60 * 1000 ), maxAge: 60 * 60 * 1000 } );
|
|
}
|
|
|
|
function setRefreshTokenCookie( res: Response, token: string ): void
|
|
{
|
|
res.cookie( 'refreshToken', token, { ...cookieOptions( 30 * 24 * 60 * 60 * 1000 ), maxAge: 30 * 24 * 60 * 60 * 1000 } );
|
|
}
|
|
|
|
function clearAuthCookies( res: Response ): void
|
|
{
|
|
const base = { domain: COOKIE_DOMAIN, path: '/' };
|
|
res.clearCookie( 'accessToken', base );
|
|
res.clearCookie( 'refreshToken', base );
|
|
}
|
|
|
|
function issueTokenPair( res: Response, userId: string ): { accessToken: string; refreshToken: string }
|
|
{
|
|
const accessToken = issueAccessToken( userId );
|
|
const refreshRecord = refreshTokens.create( userId );
|
|
setTokenCookie( res, accessToken );
|
|
setRefreshTokenCookie( res, refreshRecord.token );
|
|
return { accessToken, refreshToken: refreshRecord.token };
|
|
}
|
|
|
|
// POST /api/auth/register
|
|
router.post( '/register', async ( req, res ) =>
|
|
{
|
|
const ip = req.ip ?? 'unknown';
|
|
const { blocked } = checkRegisterRate( ip );
|
|
if ( blocked ) { res.status( 429 ).json( { error: 'Too many registrations. Try again later.' } ); return; }
|
|
|
|
const { email, password } = req.body as { email?: string; password?: string };
|
|
if ( !email || !password )
|
|
{
|
|
res.status( 400 ).json( { error: 'Email and password required' } );
|
|
return;
|
|
}
|
|
try
|
|
{
|
|
const passwordHash = await bcrypt.hash( password, 10 );
|
|
const user = users.create( email, passwordHash );
|
|
|
|
const superadminEmail = process.env.INITIAL_SUPERADMIN_EMAIL?.toLowerCase();
|
|
if ( superadminEmail && email.toLowerCase() === superadminEmail )
|
|
{
|
|
const alreadyHasSuperAdmin = users.all().some( u => u.id !== user.id && isSuperAdmin( u.roles ) );
|
|
if ( !alreadyHasSuperAdmin )
|
|
users.update( user.id, { roles: [ 'superadmin', 'user' ] } );
|
|
}
|
|
|
|
const tokens = issueTokenPair( res, user.id );
|
|
|
|
// Welcome email — non-blocking
|
|
EmailService.sendEmail(
|
|
email,
|
|
'Welcome to rokojori',
|
|
`Hi,\n\nYour account has been created at ${ACCOUNT_BASE_URL}.\n\nIf you did not create this account or want to delete it, visit:\n${ACCOUNT_BASE_URL}/profile.html\n\nYou can delete your account there at any time.`
|
|
).catch( () => {} );
|
|
|
|
res.json( tokens );
|
|
}
|
|
catch
|
|
{
|
|
res.status( 409 ).json( { error: 'Email already registered' } );
|
|
}
|
|
} );
|
|
|
|
// POST /api/auth/login
|
|
router.post( '/login', async ( req, res ) =>
|
|
{
|
|
const ip = req.ip ?? 'unknown';
|
|
const { blocked, delay } = checkLoginRate( ip );
|
|
if ( blocked ) { res.status( 429 ).json( { error: 'Too many attempts. Try again later.' } ); return; }
|
|
if ( delay ) await sleep( delay );
|
|
|
|
const { email, password } = req.body as { email?: string; password?: string };
|
|
const user = email ? users.findByEmail( email ) : undefined;
|
|
if ( !user || !password || !( await bcrypt.compare( password, user.passwordHash ) ) )
|
|
{
|
|
res.status( 401 ).json( { error: 'Invalid credentials' } );
|
|
return;
|
|
}
|
|
res.json( issueTokenPair( res, user.id ) );
|
|
} );
|
|
|
|
// POST /api/auth/logout
|
|
router.post( '/logout', ( req, res ) =>
|
|
{
|
|
const tokenFromBody = ( req.body as { refreshToken?: string } ).refreshToken;
|
|
const tokenFromCookie = req.cookies?.refreshToken as string | undefined;
|
|
const token = tokenFromBody ?? tokenFromCookie;
|
|
if ( token ) refreshTokens.delete( token );
|
|
clearAuthCookies( res );
|
|
res.json( { ok: true } );
|
|
} );
|
|
|
|
// POST /api/auth/refresh — non-browser clients (token in body)
|
|
router.post( '/refresh', ( req, res ) =>
|
|
{
|
|
const { refreshToken } = req.body as { refreshToken?: string };
|
|
if ( !refreshToken ) { res.status( 400 ).json( { error: 'Refresh token required' } ); return; }
|
|
|
|
const record = refreshTokens.find( refreshToken );
|
|
if ( !record || new Date( record.expiresAt ) < new Date() )
|
|
{
|
|
res.status( 401 ).json( { error: 'Invalid or expired refresh token' } );
|
|
return;
|
|
}
|
|
const user = users.findById( record.userId );
|
|
if ( !user ) { res.status( 401 ).json( { error: 'User not found' } ); return; }
|
|
|
|
refreshTokens.delete( refreshToken );
|
|
res.json( issueTokenPair( res, user.id ) );
|
|
} );
|
|
|
|
// GET /api/auth/refresh-session?redirect=... — browser clients (token from cookie)
|
|
router.get( '/refresh-session', ( req, res ) =>
|
|
{
|
|
const redirectTo = req.query.redirect as string | undefined;
|
|
const loginFallback = redirectTo
|
|
? `/login.html?redirect=${encodeURIComponent( redirectTo )}`
|
|
: '/login.html';
|
|
|
|
const token = req.cookies?.refreshToken as string | undefined;
|
|
if ( !token ) { res.redirect( loginFallback ); return; }
|
|
|
|
const record = refreshTokens.find( token );
|
|
if ( !record || new Date( record.expiresAt ) < new Date() )
|
|
{
|
|
clearAuthCookies( res );
|
|
res.redirect( loginFallback );
|
|
return;
|
|
}
|
|
const user = users.findById( record.userId );
|
|
if ( !user ) { clearAuthCookies( res ); res.redirect( loginFallback ); return; }
|
|
|
|
refreshTokens.delete( token );
|
|
issueTokenPair( res, user.id );
|
|
res.redirect( redirectTo ?? '/profile.html' );
|
|
} );
|
|
|
|
// POST /api/auth/forgot-password — rate-limited with escalating delay
|
|
router.post( '/forgot-password', async ( req, res ) =>
|
|
{
|
|
const ip = req.ip ?? 'unknown';
|
|
const { blocked, delay } = checkForgotPasswordRate( ip );
|
|
if ( blocked ) { res.status( 429 ).json( { error: 'Too many attempts. Try again later.' } ); return; }
|
|
await sleep( delay );
|
|
|
|
const { email } = req.body as { email?: string };
|
|
if ( !email ) { res.status( 400 ).json( { error: 'Email required' } ); return; }
|
|
|
|
const user = users.findByEmail( email );
|
|
if ( user )
|
|
{
|
|
const token = resetTokens.create( user.id );
|
|
const link = `${RESET_BASE_URL}/reset-password.html?token=${token.token}`;
|
|
await EmailService.sendEmail(
|
|
email,
|
|
'Reset your password — rokojori',
|
|
`Hi,\n\nClick the link below to reset your password. It expires in 1 hour.\n\n${link}\n\nIf you did not request this, you can safely ignore this email.`
|
|
);
|
|
}
|
|
|
|
res.json( { ok: true } );
|
|
} );
|
|
|
|
// POST /api/auth/reset-password
|
|
router.post( '/reset-password', async ( req, res ) =>
|
|
{
|
|
const { token, password } = req.body as { token?: string; password?: string };
|
|
if ( !token || !password ) { res.status( 400 ).json( { error: 'Token and password required' } ); return; }
|
|
|
|
const record = resetTokens.find( token );
|
|
if ( !record || new Date( record.expiresAt ) < new Date() )
|
|
{
|
|
res.status( 400 ).json( { error: 'Invalid or expired token' } );
|
|
return;
|
|
}
|
|
const passwordHash = await bcrypt.hash( password, 10 );
|
|
users.update( record.userId, { passwordHash } );
|
|
resetTokens.delete( token );
|
|
res.json( { ok: true } );
|
|
} );
|
|
|
|
// GET /api/auth/reset-token-email
|
|
router.get( '/reset-token-email', ( req, res ) =>
|
|
{
|
|
const token = req.query.token as string | undefined;
|
|
const record = token ? resetTokens.find( token ) : undefined;
|
|
if ( !record || new Date( record.expiresAt ) < new Date() )
|
|
{
|
|
res.status( 400 ).json( { error: 'Invalid or expired token' } );
|
|
return;
|
|
}
|
|
const user = users.findById( record.userId );
|
|
if ( !user ) { res.status( 400 ).json( { error: 'User not found' } ); return; }
|
|
res.json( { email: user.email } );
|
|
} );
|
|
|
|
// GET /api/auth/me
|
|
router.get( '/me', requireAuth, ( req, res ) =>
|
|
{
|
|
const user = users.findById( req.auth!.userId );
|
|
if ( !user ) { res.status( 404 ).json( { error: 'User not found' } ); return; }
|
|
res.json(
|
|
{
|
|
id: user.id,
|
|
email: user.email,
|
|
roles: user.roles,
|
|
products: user.products,
|
|
settings: user.settings
|
|
} );
|
|
} );
|
|
|
|
// PATCH /api/auth/me/settings
|
|
router.patch( '/me/settings', requireAuth, ( req, res ) =>
|
|
{
|
|
const user = users.findById( req.auth!.userId );
|
|
if ( !user ) { res.status( 404 ).json( { error: 'User not found' } ); return; }
|
|
const settings = { ...user.settings, ...( req.body as Record<string, unknown> ) };
|
|
users.update( req.auth!.userId, { settings } );
|
|
res.json( { settings } );
|
|
} );
|
|
|
|
// POST /api/auth/me/password
|
|
router.post( '/me/password', requireAuth, async ( req, res ) =>
|
|
{
|
|
const { currentPassword, newPassword } = req.body as { currentPassword?: string; newPassword?: string };
|
|
if ( !currentPassword || !newPassword )
|
|
{
|
|
res.status( 400 ).json( { error: 'Current and new password required' } );
|
|
return;
|
|
}
|
|
const user = users.findById( req.auth!.userId );
|
|
if ( !user ) { res.status( 404 ).json( { error: 'User not found' } ); return; }
|
|
if ( !( await bcrypt.compare( currentPassword, user.passwordHash ) ) )
|
|
{
|
|
res.status( 401 ).json( { error: 'Current password is incorrect' } );
|
|
return;
|
|
}
|
|
const passwordHash = await bcrypt.hash( newPassword, 10 );
|
|
users.update( user.id, { passwordHash } );
|
|
res.json( { ok: true } );
|
|
} );
|
|
|
|
// DELETE /api/auth/me
|
|
router.delete( '/me', requireAuth, ( req, res ) =>
|
|
{
|
|
const userId = req.auth!.userId;
|
|
refreshTokens.deleteForUser( userId );
|
|
resetTokens.deleteForUser( userId );
|
|
users.delete( userId );
|
|
clearAuthCookies( res );
|
|
res.json( { ok: true } );
|
|
} );
|
|
|
|
export default router;
|