api/controllers/UserController.ts

/**
* This file is part of SudoBot.
* 
* Copyright (C) 2021-2022 OSN Inc.
*
* SudoBot is free software; you can redistribute it and/or modify it
* under the terms of the GNU Affero General Public License as published by 
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
* 
* SudoBot is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of 
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License 
* along with SudoBot. If not, see <https://www.gnu.org/licenses/>.
*/

import Request from "../Request";
import User from "../../models/User";
import Controller from "../Controller";
import { body } from 'express-validator';
import bcrypt from 'bcrypt';
import jwt from 'jsonwebtoken';
import KeyValuePair from "../../types/KeyValuePair";
import { NextFunction, Response as ExpressResponse } from "express";
import ValidatorError from "../middleware/ValidatorError";
import RequireAuth from "../middleware/RequireAuth";

function RequireAdmin(request: Request, response: ExpressResponse, next: NextFunction) {
    if (!request.user?.isAdmin) {
        response.status(403).send({ error: "Forbidden", code: 403 });
        return;
    }

    next();
}

export default class UserController extends Controller {
    middleware(): KeyValuePair<Function[]> {
        return {
            index: [RequireAuth, RequireAdmin],
            create: [
                RequireAuth,
                RequireAdmin,
                body(["password"]).isLength({ min: 2 }), 
                body(["username"]).custom(async username => {
                    const user = await User.findOne({ username });

                    if (user) {
                        return Promise.reject("Username is already in use");
                    }

                    return username;
                }),
                body(["discord_id"]).custom(value => /\d+/g.test(value) ? value : Promise.reject("Invalid Snowflake Given"))
            ],
            login: [
                body(["username", "password"]).isLength({ min: 2 }),
            ],
            delete: [
                RequireAuth,
                body(["username", "password"]).isLength({ min: 2 }),
            ]
        };
    }

    globalMiddleware(): Function[] {
        return [ValidatorError];
    }

    public async index() {
        return await User.find().select(["_id", "username", "createdAt"]).limit(30);
    }

    public async create(request: Request) {
        const user = new User();

        user.username = request.body.username;
        user.discord_id = request.body.discord_id;
        user.createdAt = new Date();
        user.tokenUpdatedAt = new Date();

        try {
            await user.save();
        }
        catch (e) {
            return { error: "DB validation error", error_type: 'db_validation' };
        }

        const salt = await bcrypt.genSalt();
        user.password = await bcrypt.hash(request.body.password, salt);

        const token = await jwt.sign({
            username: user.username,
            discord_id: user.discord_id,
            _id: user.id
        }, process.env.JWT_SECRET!, {
            expiresIn: "2 days",
            issuer: "SudoBot API",
        });

        user.token = token;
        
        try {
            await user.save();
        }
        catch (e) {
            return { error: "Token signing error", error_type: 'token_signing' };
        }

        user.password = undefined;
        return user;
    }

    public async delete(request: Request) {
        const { username, password } = request.body;
        const user = await User.findOne({ username });

        if (!user) {
            return { error: "Username is incorrect." };
        }

        if (!(await bcrypt.compare(password, user.password!))) {
            return { error: "Password is incorrect." };
        }

        await user.delete();

        user.password = undefined;
        user.token = undefined;
        user.tokenUpdatedAt = undefined;

        return {
            message: "Account deletion successful",
            user
        };
    }

    public async login(request: Request) {
        const { username, password } = request.body;
        const user = await User.findOne({ username });

        if (!user) {
            return { error: "Username is incorrect." };
        }

        if (!(await bcrypt.compare(password, user.password!))) {
            return { error: "Password is incorrect." };
        }

        let { token } = user;

        try {
            if (!token) {
                throw new Error("Token is not set");
            }

            if (!jwt.verify(token, process.env.JWT_SECRET!)) {
                throw new Error("Token is not valid");
            }
        }
        catch (e) {
            console.log(e);    
            
            const newToken = await jwt.sign({
                username: user.username,
                discord_id: user.discord_id,
                _id: user.id
            }, process.env.JWT_SECRET!, {
                expiresIn: "2 days",
                issuer: "SudoBot API",
            });    

            token = newToken;
            user.tokenUpdatedAt = new Date();
            user.token = newToken;
            await user.save();
        }

        return {
            message: "Login successful",
            username,
            token,
            expires: new Date(user.tokenUpdatedAt!.getTime() + (2 * 24 * 60 * 60 * 1000)),
            guilds: this.client.guilds.cache.filter(g => user.guilds.includes(g.id) ?? false)
        };
    }
}
1	/**
2	* This file is part of SudoBot.
3	*
4	* Copyright (C) 2021-2022 OSN Inc.
5	*
6	* SudoBot is free software; you can redistribute it and/or modify it
7	* under the terms of the GNU Affero General Public License as published by
8	* the Free Software Foundation, either version 3 of the License, or
9	* (at your option) any later version.
10	*
11	* SudoBot is distributed in the hope that it will be useful, but
12	* WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	* GNU Affero General Public License for more details.
15	*
16	* You should have received a copy of the GNU Affero General Public License
17	* along with SudoBot. If not, see <https://www.gnu.org/licenses/>.
18	*/
19
20	import Request from "../Request";
21	import User from "../../models/User";
22	import Controller from "../Controller";
23	import { body } from 'express-validator';
24	import bcrypt from 'bcrypt';
25	import jwt from 'jsonwebtoken';
26	import KeyValuePair from "../../types/KeyValuePair";
27	import { NextFunction, Response as ExpressResponse } from "express";
28	import ValidatorError from "../middleware/ValidatorError";
29	import RequireAuth from "../middleware/RequireAuth";
30
31	function RequireAdmin(request: Request, response: ExpressResponse, next: NextFunction) {
32	if (!request.user?.isAdmin) {
33	response.status(403).send({ error: "Forbidden", code: 403 });
34	return;
35	}
36
37	next();
38	}
39
40	export default class UserController extends Controller {
41	middleware(): KeyValuePair<Function[]> {
42	return {
43	index: [RequireAuth, RequireAdmin],
44	create: [
45	RequireAuth,
46	RequireAdmin,
47	body(["password"]).isLength({ min: 2 }),
48	body(["username"]).custom(async username => {
49	const user = await User.findOne({ username });
50
51	if (user) {
52	return Promise.reject("Username is already in use");
53	}
54
55	return username;
56	}),
57	body(["discord_id"]).custom(value => /\d+/g.test(value) ? value : Promise.reject("Invalid Snowflake Given"))
58	],
59	login: [
60	body(["username", "password"]).isLength({ min: 2 }),
61	],
62	delete: [
63	RequireAuth,
64	body(["username", "password"]).isLength({ min: 2 }),
65	]
66	};
67	}
68
69	globalMiddleware(): Function[] {
70	return [ValidatorError];
71	}
72
73	public async index() {
74	return await User.find().select(["_id", "username", "createdAt"]).limit(30);
75	}
76
77	public async create(request: Request) {
78	const user = new User();
79
80	user.username = request.body.username;
81	user.discord_id = request.body.discord_id;
82	user.createdAt = new Date();
83	user.tokenUpdatedAt = new Date();
84
85	try {
86	await user.save();
87	}
88	catch (e) {
89	return { error: "DB validation error", error_type: 'db_validation' };
90	}
91
92	const salt = await bcrypt.genSalt();
93	user.password = await bcrypt.hash(request.body.password, salt);
94
95	const token = await jwt.sign({
96	username: user.username,
97	discord_id: user.discord_id,
98	_id: user.id
99	}, process.env.JWT_SECRET!, {
100	expiresIn: "2 days",
101	issuer: "SudoBot API",
102	});
103
104	user.token = token;
105
106	try {
107	await user.save();
108	}
109	catch (e) {
110	return { error: "Token signing error", error_type: 'token_signing' };
111	}
112
113	user.password = undefined;
114	return user;
115	}
116
117	public async delete(request: Request) {
118	const { username, password } = request.body;
119	const user = await User.findOne({ username });
120
121	if (!user) {
122	return { error: "Username is incorrect." };
123	}
124
125	if (!(await bcrypt.compare(password, user.password!))) {
126	return { error: "Password is incorrect." };
127	}
128
129	await user.delete();
130
131	user.password = undefined;
132	user.token = undefined;
133	user.tokenUpdatedAt = undefined;
134
135	return {
136	message: "Account deletion successful",
137	user
138	};
139	}
140
141	public async login(request: Request) {
142	const { username, password } = request.body;
143	const user = await User.findOne({ username });
144
145	if (!user) {
146	return { error: "Username is incorrect." };
147	}
148
149	if (!(await bcrypt.compare(password, user.password!))) {
150	return { error: "Password is incorrect." };
151	}
152
153	let { token } = user;
154
155	try {
156	if (!token) {
157	throw new Error("Token is not set");
158	}
159
160	if (!jwt.verify(token, process.env.JWT_SECRET!)) {
161	throw new Error("Token is not valid");
162	}
163	}
164	catch (e) {
165	console.log(e);
166
167	const newToken = await jwt.sign({
168	username: user.username,
169	discord_id: user.discord_id,
170	_id: user.id
171	}, process.env.JWT_SECRET!, {
172	expiresIn: "2 days",
173	issuer: "SudoBot API",
174	});
175
176	token = newToken;
177	user.tokenUpdatedAt = new Date();
178	user.token = newToken;
179	await user.save();
180	}
181
182	return {
183	message: "Login successful",
184	username,
185	token,
186	expires: new Date(user.tokenUpdatedAt!.getTime() + (2 * 24 * 60 * 60 * 1000)),
187	guilds: this.client.guilds.cache.filter(g => user.guilds.includes(g.id) ?? false)
188	};
189	}
190	}