Updated dependencies

omit physical address line from validation email where no physical address provided

.dockerignore

@@ -0,0 +1,10 @@
+.git*
+
+tools*
+mysql*
+letsencrypt*
+test*
+
+.env*
+.github*
+LICENSE*

.envdev

@@ -1,20 +1,32 @@
 WEB_PROTOCOL=http
 WEB_ADDRESS=localhost
+WEB_RESET_ADDRESS=localhost/reset
 WEB_PORT=3200
 
 DB_HOSTNAME=database
 DB_DATABASE=auth
 DB_USERNAME=auth
-DB_PASSWORD=venusaur
-DB_TIMEZONE=Australia/Sydney
+DB_PASSWORD=charizard
 
 MAIL_SMTP=smtp.example.com
 MAIL_USERNAME=foobar@example.com
 MAIL_PASSWORD=examplepassword
 MAIL_PHYSICAL=42 Placeholder Ave, Placeholder, 0000, USA
 
+# Give this a value to generate the default admin account
 ADMIN_DEFAULT_USERNAME=admin
+
+# Give this a value to generate the default admin account (must be at least 8 characters)
 ADMIN_DEFAULT_PASSWORD=password
 
+# Select a "TZ database name" that suits your needs: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+DB_TIMEZONE=Australia/Sydney
+
+# Give this any value to enable database logging (such as "true")
+DB_LOGGING=
+
+# Make sure this value matches the system that you connect to
 SECRET_ACCESS=access
+
+# Make sure this value is kept secret
 SECRET_REFRESH=refresh

.github/FUNDING.yml

@@ -0,0 +1,5 @@
+# These are supported funding model platforms
+
+patreon: krgamestudios
+ko_fi: krgamestudios
+custom: ["https://www.paypal.com/donate/?hosted_button_id=73Q82T2ZHV8AA"]

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: Node.js CI
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+jobs:
+  build:
+    name: Run test suites
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [16.x]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v2
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+    - run: npm ci
+    - run: npm run build --if-present
+    - run: npm test

Dockerfile

@@ -1,4 +1,5 @@
-FROM node:15
+
+FROM node:16
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

README.md

@@ -2,11 +2,11 @@
 
 An API centric auth server. Uses Sequelize and mariaDB by default.
 
+This server is available via docker hub at krgamestudios/auth-server.
+
 # Setup
 
-TODO: Dockerize this project
-
-TODO: Write setup instructions, once dockerized
+There are multiple ways to run this app - it can run on it's own via `npm start` (for production) or `npm run dev` (for development). it can also run inside docker using `docker-compose up --build` - run `node configure-script.js` to generate docker-compose.yml and startup.sql.
 
 # API
 
@@ -21,9 +21,19 @@ Content-Type: application/json
 	"password": "helloworld"
 }
 
-//DOCS: Used for validating the email address above
+
+###
+
+
+//DOCS: Used for validating the email address specified above
 GET /auth/validation?username=example&token=12345678
 
+//DOCS: If the environment variable HOOK_POST_VALIDATION is set to a URL, then the server will send a GET message to that URL with the newly created account's index
+GET https://{HOOK_POST_VALIDATION}?accountIndex={index}
+
+###
+
+
 //DOCS: Login after validation
 POST /auth/login
 Content-Type: application/json
@@ -33,15 +43,33 @@ Content-Type: application/json
 	"password": "helloworld"
 }
 
-//Result (access token's value is your authorization key below)
+//DOCS: Result (access token's value is your authorization key below)
 {
 	"accessToken": "abcde",
 	"refreshToken": "fghij"
 }
 
-//DOCS: Retreives the private account data, results vary
-GET /auth/account
-Authorization: Bearer accessToken
+
+###
+
+
+//DOCS: Replace an expired authToken pair with new values
+POST /auth/token
+Content-Type: application/json
+
+{
+	"token": "refreshToken"
+}
+
+//DOCS: Result
+{
+	"accessToken": "abcde",
+	"refreshToken": "fghij"
+}
+
+
+###
+
 
 //DOCS: After this is called, the refresh route will no longer work
 DELETE /auth/logout
@@ -51,27 +79,34 @@ Authorization: Bearer accessToken
 	"token": "refreshToken"
 }
 
-//Replace an expired authToken pair with these values
-POST /auth/token
-Content-Type: application/json
 
-{
-	"token": "refreshToken"
-}
+###
 
-//Result
-{
-	"accessToken": "abcde",
-	"refreshToken": "fghij"
-}
 
-//DOCS: Update account data, input varies, but is always JSON
-PATCH /auth/update
+//DOCS: Retreives the private account data, results vary
+GET /auth/account
+Authorization: Bearer accessToken
+
+
+###
+
+
+//DOCS: Update account data
+PATCH /auth/account
 Content-Type: application/json
 Authorization: Bearer accessToken
 
+{
+	"password": "helloworld",
+	"contact": true
+}
+
+
+###
+
+
 //DOCS: Sets the timer, account will be deleted after 2 days
-DELETE /auth/deletion
+DELETE /auth/account
 Authorization: Bearer accessToken
 Content-Type: application/json
 
@@ -79,4 +114,39 @@ Content-Type: application/json
 	"password": "helloworld"
 }
 
+
+###
+
+
+//DOCS: Send the link to recover a forgotten password
+POST /auth/recover
+Content-Type: application/json
+
+{
+	"email": "example@example.com"
+}
+
+
+###
+
+
+//DOCS: Redirect the link to recover a password to the front-end
+GET /auth/reset?token=<token>
+
+//DOCS: Result
+301 -> ${WEB_RESET_ADDRESS}?email=<email>&token=<token>
+
+
+###
+
+
+//DOCS: Resets a password for the given email, correct token is required
+PATCH /auth/reset?email=<email>&token=<token>
+
+{
+	"password": "password"
+}
+
+
+###
 ```

configure-script.js

@@ -30,10 +30,12 @@ const question = (prompt, def = null) => {
 	//project configuration
 	const appName = await question('App Name', 'auth');
 	const appWebAddress = await question('Web Addr', `${appName}.example.com`);
+	const postValidationHook = await question('Post Validation Hook', '');
+	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
 
 	const appDBUser = await question('DB User', appName);
-	const appDBPass = await question('DB Pass', uuid());
+	const appDBPass = await question('DB Pass', 'charizard');
 	const dbRootPass = await question('DB Root Pass');
 
 	const appMailSMTP = await question('Mail SMTP', 'smtp.example.com');
@@ -54,7 +56,7 @@ const question = (prompt, def = null) => {
 version: '3'
 
 services:
-  app:
+  ${appName}:
     build:
       context: .
     ports:
@@ -69,6 +71,8 @@ services:
     environment:
       - WEB_PROTOCOL=https
       - WEB_ADDRESS=${appWebAddress}
+      - HOOK_POST_VALIDATION=${postValidationHook}
+      - WEB_RESET_ADDRESS=${resetAddress}
       - WEB_PORT=${appPort}
       - DB_HOSTNAME=database
       - DB_DATABASE=${appName}
@@ -98,7 +102,9 @@ services:
       - app-network
     volumes:
       - ./mysql:/var/lib/mysql
-  traefik:
+      - ./startup.sql:/docker-entrypoint-initdb.d/startup.sql:ro
+  traefik_${appName}:
+    container_name: ${appName}_traefik
     image: "traefik:v2.4"
     container_name: "traefik"
     command:
@@ -116,7 +122,6 @@ services:
     volumes:
       - "./letsencrypt:/letsencrypt"
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./startup.sql:/docker-entrypoint-initdb.d/startup.sql:ro"
     networks:
       - app-network
 networks:
@@ -125,7 +130,7 @@ networks:
 `;
 
 	const dockerfile = `
-FROM node:15
+FROM node:16
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

package.json

@@ -1,12 +1,13 @@
 {
   "name": "auth-server",
-  "version": "1.0.0",
+  "version": "1.4.12",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
     "start": "node server/server.js",
     "dev": "npm run watch:server",
-    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'"
+    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'",
+    "test": "jest --coverage --collectCoverageFrom=server/**/*.{js,jsx}"
   },
   "repository": {
     "type": "git",
@@ -20,17 +21,18 @@
   "homepage": "https://github.com/krgamestudios/auth-server#readme",
   "dependencies": {
     "bcryptjs": "^2.4.3",
-    "body-parser": "^1.19.0",
     "cors": "^2.8.5",
-    "dotenv": "^8.2.0",
+    "dotenv": "^8.6.0",
     "express": "^4.17.1",
     "jsonwebtoken": "^8.5.1",
-    "mariadb": "^2.5.2",
+    "mariadb": "^2.5.4",
     "node-cron": "^2.0.3",
-    "nodemailer": "^6.5.0",
-    "sequelize": "^6.5.0"
+    "node-fetch": "^2.6.6",
+    "nodemailer": "^6.6.3",
+    "sequelize": "^6.6.5"
   },
   "devDependencies": {
-    "nodemon": "^2.0.7"
+    "jest": "^27.5.1",
+    "nodemon": "^2.0.12"
   }
 }

server/admin/ban-user.js

@@ -0,0 +1,37 @@
+const { accounts, tokens } = require('../database/models');
+const Sequelize = require('sequelize');
+const Op = Sequelize.Op;
+
+//admin/banuser
+const route = async (req, res) => {
+	const updated = await accounts.update({
+		banned: true
+	}, {
+		where: {
+			username: {
+				[Op.eq]: req.body.username || ''
+			},
+			admin: {
+				[Op.not]: true
+			},
+			mod: {
+				[Op.not]: true
+			}
+		}
+	});
+
+	if (!updated[0]) {
+		return res.status(500).send('Failed to set banned status');
+	}
+
+	//forcibly logout
+	tokens.destroy({
+		where: {
+			email: req.body.email || ''
+		}
+	});
+
+	res.status(200).end();
+};
+
+module.exports = route;

server/admin/default-account.js

@@ -20,18 +20,21 @@ module.exports = async () => {
 	//check for an existing admin account
 	const adminRecord = await accounts.findOne({
 		where: {
-			privilege: 'administrator'
+			admin: true
 		}
 	});
 
 	if (adminRecord == null) {
+		const webAddress = process.env.WEB_ADDRESS == 'localhost' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
 		await accounts.create({
-			privilege: 'administrator',
-			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.WEB_ADDRESS}`,
+			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
 			username: `${process.env.ADMIN_DEFAULT_USERNAME}`,
-			hash: await bcrypt.hash(`${process.env.ADMIN_DEFAULT_PASSWORD}`, await bcrypt.genSalt(11))
+			hash: await bcrypt.hash(`${process.env.ADMIN_DEFAULT_PASSWORD}`, await bcrypt.genSalt(11)),
+			type: 'normal',
+			admin: true,
+			mod: true
 		});
 
-		console.warn(`Created default admin account (email: ${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.WEB_ADDRESS}; password: ${process.env.ADMIN_DEFAULT_PASSWORD})`);
+		console.warn(`Created default admin account (email: ${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}; password: ${process.env.ADMIN_DEFAULT_PASSWORD})`);
 	}
 };

server/admin/grant-admin.js

@@ -0,0 +1,25 @@
+const { accounts } = require('../database/models');
+const Sequelize = require('sequelize');
+const Op = Sequelize.Op;
+
+//admin/admin
+const route = async (req, res) => {
+	const updated = await accounts.update({
+		admin: true,
+		mod: true
+	}, {
+		where: {
+			username: {
+				[Op.eq]: req.body.username || ''
+			}
+		}
+	});
+
+	if (!updated[0]) {
+		return res.status(500).send('Failed to set admin status');
+	}
+
+	res.status(200).end();
+};
+
+module.exports = route;

server/admin/grant-mod.js

@@ -0,0 +1,24 @@
+const { accounts } = require('../database/models');
+const Sequelize = require('sequelize');
+const Op = Sequelize.Op;
+
+//admin/mod
+const route = async (req, res) => {
+	const updated = await accounts.update({
+		mod: true
+	}, {
+		where: {
+			username: {
+				[Op.eq]: req.body.username || ''
+			}
+		}
+	});
+
+	if (!updated[0]) {
+		return res.status(500).send('Failed to set mod status');
+	}
+
+	res.status(200).end();
+};
+
+module.exports = route;

server/admin/index.js

@@ -1,3 +1,61 @@
-module.exports = {
-	defaultAccount: require('./default-account')
-};
+const express = require('express');
+const router = express.Router();
+
+const { accounts } = require('../database/models');
+
+//middleware
+const tokenAuth = require('../utilities/token-auth');
+
+router.use(tokenAuth);
+
+//handle ban stuff
+router.use(async (req, res, next) => {
+	const record = await accounts.findOne({
+		where: {
+			email: req.user.email || ''
+		}
+	});
+
+	if (!record) {
+		return res.status(500).send('Account not found in banning middleware');
+	}
+
+	if (record.banned) {
+		return res.status(403).send('This account has been banned');
+	}
+
+	next();
+});
+
+//handle mod stuff
+router.use((req, res, next) => {
+	//check the user's mod status
+	if (!req.user.mod) {
+		return res.status(401).send('Mods only');
+	}
+
+	next();
+});
+
+//routes
+router.post('/banuser', require('./ban-user'));
+
+//handle admin stuff
+router.use((req, res, next) => {
+	//check the user's admin status
+	if (!req.user.admin) {
+		return res.status(401).send('Admin only');
+	}
+
+	next();
+});
+
+require('./default-account')(); //generate the default accouunt
+
+//basic route management
+router.post('/admin', require('./grant-admin'));
+router.delete('/admin', require('./remove-admin'));
+router.post('/mod', require('./grant-mod'));
+router.delete('/mod', require('./remove-mod'));
+
+module.exports = router;

server/admin/remove-admin.js

@@ -0,0 +1,24 @@
+const { accounts } = require('../database/models');
+const Sequelize = require('sequelize');
+const Op = Sequelize.Op;
+
+//admin/admin
+const route = async (req, res) => {
+	const updated = await accounts.update({
+		admin: false
+	}, {
+		where: {
+			username: {
+				[Op.eq]: req.body.username || ''
+			}
+		}
+	});
+
+	if (!updated[0]) {
+		return res.status(500).send('Failed to set admin status');
+	}
+
+	res.status(200).end();
+};
+
+module.exports = route;

server/admin/remove-mod.js

@@ -0,0 +1,25 @@
+const { accounts } = require('../database/models');
+const Sequelize = require('sequelize');
+const Op = Sequelize.Op;
+
+//admin/admin
+const route = async (req, res) => {
+	const updated = await accounts.update({
+		admin: false,
+		mod: false
+	}, {
+		where: {
+			username: {
+				[Op.eq]: req.body.username || ''
+			}
+		}
+	});
+
+	if (!updated[0]) {
+		return res.status(500).send('Failed to set mod status');
+	}
+
+	res.status(200).end();
+};
+
+module.exports = route;

server/auth/account-delete.js

@@ -9,18 +9,26 @@ const { accounts } = require('../database/models');
 
 //auth/deletion
 const route = async (req, res) => {
+	if (!req.body.password) {
+		return res.status(401).end('Missing password');
+	}
+
 	const account = await accounts.findOne({
 		where: {
-			id: req.user.id
+			index: req.user.index || ''
 		}
 	});
 
+	if (!account) {
+		return res.status(401).end('Missing account');
+	}
+
 	//compare the user's password
 	const compare = utils.promisify(bcrypt.compare);
 	const match = await compare(req.body.password, account.hash);
 
 	if (!match) {
-		return res.status(401).send('incorrect password');
+		return res.status(401).send('Incorrect password');
 	}
 
 	//set the deletion time (2 days from now)
@@ -30,7 +38,7 @@ const route = async (req, res) => {
 	},
 	{
 		where: {
-			id: req.user.id
+			index: req.user.index
 		}
 	});
 

server/auth/account-query.js

@@ -4,17 +4,17 @@ const { accounts } = require('../database/models');
 const route = async (req, res) => {
 	const account = await accounts.findOne({
 		where: {
-			id: req.user.id
+			index: req.user.index || ''
 		}
 	});
 
 	if (!account) {
-		res.status(401).send('Unknown account');
+		return res.status(401).end('Unknown account');
 	}
 
 	//respond with the private-facing data
-	res.status(200).json({
-		contact: await account.contact
+	return res.status(200).json({
+		contact: account.contact
 	});
 };
 

server/auth/account-update.js

@@ -3,20 +3,20 @@ const { accounts } = require('../database/models');
 
 //auth/update
 const route = async (req, res) => {
-	//generate the password hash
-	let hash;
-
-	if (req.body.password) {
-		hash = await bcrypt.hash(req.body.password, await bcrypt.genSalt(11));
+	if (!req.body.password) {
+		return res.status(401).end('Missing password');
 	}
 
+	//generate the password hash
+	let hash = await bcrypt.hash(req.body.password, await bcrypt.genSalt(11));
+
 	//update the account
 	await accounts.update({
 		contact: req.body.contact,
 		hash: hash
 	}, {
 		where: {
-			id: req.user.id
+			index: req.user.index
 		}
 	});
 

server/auth/index.js

@@ -1,8 +1,10 @@
 const express = require('express');
 const router = express.Router();
 
+const { accounts } = require('../database/models');
+
 //middleware
-const authToken = require('../utilities/token-auth');
+const tokenAuth = require('../utilities/token-auth');
 
 //signup -> validate -> login all without a token
 router.post('/signup', require('./signup'));
@@ -12,13 +14,38 @@ router.post('/login', require('./login'));
 //refresh token
 router.post('/token', require('./token'));
 
+//password recover and reset
+router.post('/recover', require('./password-recover'));
+router.get('/reset', require('./password-redirect'));
+router.patch('/reset', require('./password-reset'));
+
+//logouts allowed when banned, and when the token itself is invalid
+router.delete('/logout', require('./logout'));
+
 //middleware
-router.use(authToken);
+router.use(tokenAuth);
+
+router.use(async (req, res, next) => {
+	const record = await accounts.findOne({
+		where: {
+			email: req.user.email || ''
+		}
+	});
+
+	if (!record) {
+		return res.status(500).send('Account not found in banning middleware');
+	}
+
+	if (record.banned) {
+		return res.status(403).send('This account has been banned');
+	}
+
+	next();
+});
 
 //basic account management (needs a token)
-router.delete('/logout', require('./logout'));
-router.get('/account', require('./account'));
-router.patch('/update', require('./update'));
-router.delete('/deletion', require('./deletion'));
+router.get('/account', require('./account-query'));
+router.patch('/account', require('./account-update'));
+router.delete('/account', require('./account-delete'));
 
 module.exports = router;

server/auth/login.js

@@ -3,7 +3,7 @@ const utils = require('util');
 const bcrypt = require('bcryptjs');
 
 const { accounts } = require('../database/models');
-const generate = require('../utilities/token-generate');
+const tokenGenerate = require('../utilities/token-generate');
 
 //utilities
 const validateEmail = require('../utilities/validate-email');
@@ -19,7 +19,7 @@ const route = async (req, res) => {
 	//get the existing account
 	const account = await accounts.findOne({
 		where: {
-			email: req.body.email
+			email: req.body.email || ''
 		}
 	});
 
@@ -29,6 +29,7 @@ const route = async (req, res) => {
 
 	//compare passwords
 	const compare = utils.promisify(bcrypt.compare);
+
 	const match = await compare(req.body.password, account.hash);
 
 	if (!match) {
@@ -38,25 +39,36 @@ const route = async (req, res) => {
 	//cancel deletion if any
 	await accounts.update({ deletion: null }, {
 		where: {
-			id: account.id
+			index: account.index
 		}
 	});
 
-	//generate the JWT
-	const tokens = generate(account.id, account.username, account.privilege);
+	//reject on banned
+	if (account.banned) {
+		return res.status(403).send('this account has been banned');
+	}
+
+	//generate the JWTs
+	const tokens = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
 
 	//finally
 	res.status(200).json(tokens);
+	return null;
 };
 
 const validateDetails = async (body) => {
-	//basic formatting (with an exception for the default admin account)
-	if (!validateEmail(body.email) && body.email != `${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.WEB_ADDRESS}`) {
-		return 'invalid email';
+	if (!body.email) {
+		return 'Missing email';
 	}
 
-	//check for existing (banned)
-	//TODO: restore banning
+	if (!body.password) {
+		return 'Missing password';
+	}
+
+	//basic formatting (with an exception for the default admin account)
+	if (!validateEmail(body.email) && body.email != `${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.WEB_ADDRESS}`) {
+		return 'Invalid email';
+	}
 
 	return null;
 }

server/auth/logout.js

@@ -1,8 +1,8 @@
-const destroy = require('../utilities/token-destroy');
+const tokenDestroy = require('../utilities/token-destroy');
 
 //auth/logout
 const route = (req, res) => {
-	destroy(req.body.token);
+	tokenDestroy(req.body.token);
 
 	return res.status(200).end();
 };

server/auth/password-recover.js

@@ -0,0 +1,106 @@
+//libraries
+const nodemailer = require('nodemailer');
+
+const { accounts, recovery } = require('../database/models');
+
+//utilities
+const uuid = require('../utilities/uuid');
+const validateEmail = require('../utilities/validate-email');
+
+//auth/recover
+const route = async (req, res) => {
+	//validate details
+	const validateErr = await validateDetails(req.body);
+	if (validateErr) {
+		return res.status(401).end(validateErr);
+	}
+
+	//recovery token
+	const token = uuid(32);
+
+	//send the recovery email
+	const emailErr = await sendRecoveryEmail(req.body.email, token);
+	if (emailErr) {
+		return res.status(500).send(emailErr);
+	}
+
+	//save the token
+	await recovery.upsert({
+		email: req.body.email,
+		token: token
+	});
+
+	//finally
+	res.status(200).send("Recovery email sent!");
+	return null;
+};
+
+const validateDetails = async (body) => {
+	//basic formatting
+	if (!validateEmail(body.email)) {
+		return 'Invalid email';
+	}
+
+	//check for existing email
+	const emailRecord = await accounts.findOne({
+		where: {
+			email: body.email
+		}
+	});
+
+	if (!emailRecord) {
+		return 'Invalid email';
+	}
+
+	//OK
+	return null;
+};
+
+const sendRecoveryEmail = async (email, token) => {
+	const addr = `${process.env.WEB_PROTOCOL}://${process.env.WEB_ADDRESS}/auth/reset?token=${token}`;
+	const msg = `Hello,
+
+Please visit the following link to reset your password: ${addr}
+
+If you did not request a password reset, you can safely ignore this message.
+`;
+
+	let transporter, info;
+
+	//what exactly is a transport?
+	try {
+		transporter = nodemailer.createTransport({
+			host: process.env.MAIL_SMTP,
+			port: 465,
+			secure: true,
+			auth: {
+			  user: process.env.MAIL_USERNAME,
+			  pass: process.env.MAIL_PASSWORD
+			},
+		});
+	}
+	catch(e) {
+		return `failed to create a mail transport: ${e}`;
+	}
+
+	// send mail with defined transport object
+	try {
+		info = await transporter.sendMail({
+			from: `recovery@${process.env.WEB_ADDRESS}`, //WARNING: google overwrites this
+			to: email,
+			subject: 'Password Recovery',
+			text: msg
+		});
+	}
+	catch(e) {
+		return `failed to send validation mail: ${e}`;
+	}
+
+	if (info.accepted[0] != email) {
+		return 'recovery email failed to send';
+	}
+
+	return null;
+};
+
+module.exports = route;

server/auth/password-redirect.js

@@ -0,0 +1,21 @@
+const { accounts, recovery } = require('../database/models');
+
+//auth/reset
+const route = async (req, res) => {
+	//verify the recovery record exists
+	const record = await recovery.findOne({
+		where: {
+			token: req.query.token || ''
+		}
+	});
+
+	if (!record) {
+		return res.status(401).end('Failed to recover a password');
+	}
+
+	//redirect to the front-end
+	res.redirect(`${process.env.WEB_PROTOCOL}://${process.env.WEB_RESET_ADDRESS}?email=${record.email}&token=${record.token}`);
+	return null;
+};
+
+module.exports = route;

server/auth/password-reset.js

@@ -0,0 +1,62 @@
+//libraries
+const bcrypt = require('bcryptjs');
+
+const { accounts, recovery } = require('../database/models');
+
+//auth/reset
+const route = async (req, res) => {
+	//validate the given details
+	const validateErr = await validateDetails(req.query, req.body);
+	if (validateErr) {
+		return res.status(401).send(validateErr);
+	}
+
+	//generate the password hash
+	const hash = await bcrypt.hash(req.body.password, await bcrypt.genSalt(11));
+
+	//update the account data
+	await accounts.update({
+		hash: hash
+	}, {
+		where: {
+			email: req.query.email
+		}
+	})
+
+	//delete from the recovery table
+	await recovery.destroy({
+		where: {
+			email: req.query.email
+		}
+	});
+
+	res.status(200).end();
+	return null;
+};
+
+const validateDetails = async (query, body) => {
+	//verify the recovery record exists
+	const record = await recovery.findOne({
+		where: {
+			email: query.email,
+			token: query.token
+		}
+	});
+
+	if (!record) {
+		return 'Failed to recover a password';
+	}
+
+	//validate password
+	if (!body.password) {
+		return 'Missing password';
+	}
+
+	if (body.password.length < 8) {
+		return 'Password too short';
+	}
+
+	return null;
+};
+
+module.exports = route;

server/auth/signup.js

@@ -6,7 +6,6 @@ const Op = Sequelize.Op;
 
 const { accounts, pendingSignups } = require('../database/models');
 
-
 //utilities
 const uuid = require('../utilities/uuid');
 const validateEmail = require('../utilities/validate-email');
@@ -46,16 +45,13 @@ const route = async (req, res) => {
 const validateDetails = async (body) => {
 	//basic formatting
 	if (!validateEmail(body.email)) {
-		return 'invalid email';
+		return 'Invalid email';
 	}
 
 	if (!validateUsername(body.username)) {
-		return 'invalid username';
+		return 'Invalid username';
 	}
 
-	//check for existing (banned)
-	//TODO: re-add banned email checks
-
 	//check for existing email
 	const emailRecord = await accounts.findOne({
 		where: {
@@ -64,7 +60,11 @@ const validateDetails = async (body) => {
 	});
 
 	if (emailRecord) {
-		return 'email already exists';
+		return 'Email already exists';
+	}
+
+	if (!body.username) {
+		return 'Missing username';
 	}
 
 	//check for existing username
@@ -75,12 +75,16 @@ const validateDetails = async (body) => {
 	});
 
 	if (usernameRecord) {
-		return 'username already exists';
+		return 'Username already exists';
 	}
 
 	//validate password
+	if (!body.password) {
+		return 'Missing password';
+	}
+
 	if (body.password.length < 8) {
-		return 'password too short';
+		return 'Password too short';
 	}
 
 	return null;
@@ -100,12 +104,12 @@ const registerPendingSignup = async (body, hash, token) => {
 
 const sendValidationEmail = async (email, username, token) => {
 	const addr = `${process.env.WEB_PROTOCOL}://${process.env.WEB_ADDRESS}/auth/validation?username=${username}&token=${token}`;
-	const msg = `Hello ${username}!
-
-Please visit the following link to validate your account: ${addr}
-
-You can contact us directly at our physical mailing address here: ${process.env.MAIL_PHYSICAL}
-`;
+	const msg =
+  `Hello ${username}!\n\n` +
+  `Please visit the following link to validate your account: ${addr}\n` +
+  (process.env.MAIL_PHYSICAL
+    ? `\nYou can contact us directly at our physical mailing address here: ${process.env.MAIL_PHYSICAL}\n`
+    : ``);
 
 	let transporter, info;
 

server/auth/token.js

@@ -1,16 +1,16 @@
 const jwt = require('jsonwebtoken');
 
-const refresh = require('../utilities/token-refresh');
+const tokenRefresh = require('../utilities/token-refresh');
 
 //auth/token
 module.exports = async (req, res) => {
 	const refreshToken = req.body.token;
 
-	return refresh(refreshToken, (err, tokens) => {
+	return tokenRefresh(refreshToken, (err, token) => {
 		if (err) {
 			return res.status(err).end();
 		}
 
-		return res.status(200).send(tokens);
+		return res.status(200).send(token);
 	});
 };

server/auth/validation.js

@@ -1,25 +1,26 @@
 const { pendingSignups, accounts } = require('../database/models');
+const fetch = require('node-fetch');
 
 //auth/validation
 const route = async (req, res) => {
 	//get the existing pending signup
 	const info = await pendingSignups.findOne({
 		where: {
-			username: req.query.username
+			username: req.query.username || ''
 		}
 	});
 
 	//check the given info
 	if (!info) {
-		return res.status(401).send('validation failed');
+		return res.status(401).send('Validation failed');
 	}
 
 	if (info.token != req.query.token) {
-		return res.status(401).send('tokens do not match');
+		return res.status(401).send('Tokens do not match');
 	}
 
 	//move data to the accounts table
-	accounts.create({
+	const account = await accounts.create({
 		email: info.email,
 		username: info.username,
 		hash: info.hash,
@@ -29,12 +30,23 @@ const route = async (req, res) => {
 	//delete the pending signup
 	pendingSignups.destroy({
 		where: {
-			username: req.query.username
+			username: info.username || ''
 		}
 	});
 
 	//finally
 	res.status(200).send('Validation succeeded!');
+
+	//post-validation hook
+	if (process.env.HOOK_POST_VALIDATION) {
+		const probe = await fetch(`https://${process.env.HOOK_POST_VALIDATION}?accountIndex=${account.index}`);
+
+		if (!probe.ok) {
+			console.error('Could not probe the post validation hook');
+		}
+
+		//discard the result
+	}
 };
 
 module.exports = route;

server/database/index.js

@@ -4,7 +4,7 @@ const sequelize = new Sequelize(process.env.DB_DATABASE, process.env.DB_USERNAME
 	host: process.env.DB_HOSTNAME,
 	dialect: 'mariadb',
 	timezone: process.env.DB_TIMEZONE,
-	logging: false
+	logging: process.env.DB_LOGGING ? console.log : false
 });
 
 sequelize.sync();

server/database/models/accounts.js

@@ -2,7 +2,7 @@ const Sequelize = require('sequelize');
 const sequelize = require('..');
 
 module.exports = sequelize.define('accounts', {
-	id: {
+	index: {
 		type: Sequelize.INTEGER(11),
 		allowNull: false,
 		autoIncrement: true,
@@ -10,12 +10,6 @@ module.exports = sequelize.define('accounts', {
 		unique: true
 	},
 
-	privilege: {
-		type: Sequelize.ENUM,
-		values: ['administrator', 'moderator', 'alpha', 'beta', 'gamma', 'normal'],
-		defaultValue: 'normal'
-	},
-
 	email: {
 		type: 'varchar(320)',
 		unique: true
@@ -28,6 +22,30 @@ module.exports = sequelize.define('accounts', {
 
 	hash: 'varchar(100)', //for passwords
 
+	type: {
+		type: Sequelize.ENUM,
+		values: ['normal', 'alpha', 'beta', 'gamma'],
+		defaultValue: 'normal'
+	},
+
+	admin: {
+		type: Sequelize.BOOLEAN,
+		allowNull: false,
+		defaultValue: false
+	},
+
+	mod: {
+		type: Sequelize.BOOLEAN,
+		allowNull: false,
+		defaultValue: false
+	},
+
+	banned: {
+		type: Sequelize.BOOLEAN,
+		allowNull: false,
+		defaultValue: false
+	},
+
 	contact: {
 		type: Sequelize.BOOLEAN,
 		allowNull: false,

server/database/models/index.js

@@ -1,5 +1,6 @@
 module.exports = {
 	tokens: require('./tokens'),
 	accounts: require('./accounts'),
-	pendingSignups: require('./pending-signups')
+	pendingSignups: require('./pending-signups'),
+	recovery: require('./recovery')
 };

server/database/models/recovery.js

@@ -0,0 +1,6 @@
+const sequelize = require('..');
+
+module.exports = sequelize.define('recovery', {
+	token: 'varchar(320)',
+	email: 'varchar(320)'
+});

server/database/models/tokens.js

@@ -3,4 +3,5 @@ const sequelize = require('..');
 
 module.exports = sequelize.define('tokens', {
 	token: 'varchar(320)',
+	email: 'varchar(320)'
 });

server/server.js

@@ -5,18 +5,17 @@ require('dotenv').config();
 const express = require('express');
 const app = express();
 const server = require('http').Server(app);
-const bodyParser = require('body-parser');
 const cors = require('cors');
 
 //config
-app.use(bodyParser.json());
+app.use(express.json());
 app.use(cors());
 
 //database connection
 const database = require('./database');
 
-const admin = require('./admin');
-admin.defaultAccount();
+//access the admin
+app.use('/admin', require('./admin'));
 
 //access the auth
 app.use('/auth', require('./auth'));

server/utilities/token-auth.js

@@ -6,16 +6,16 @@ module.exports = (req, res, next) => {
 	const token = authHeader?.split (' ')[1]; //'Bearer token'
 
 	if (!token) {
-		return res.status(401).end();
+		return res.status(401).send('No token found');
 	}
 
-	jwt.verify(token, process.env.SECRET_ACCESS, (err, user) => {
+	return jwt.verify(token, process.env.SECRET_ACCESS, (err, user) => {
 		if (err) {
-			return res.status(403).end();
+			return res.status(403).send(err);
 		}
 
 		req.user = user;
 
-		next();
+		return next();
 	});
 };

server/utilities/token-generate.js

@@ -2,17 +2,21 @@ const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
 //generates a JWT token based on the given arguments
-module.exports = (id, username, privilege) => {
+module.exports = (index, email, username, type, admin, mod) => {
 	const content = {
-		id,
+		index,
+		email,
 		username,
-		privilege
+		type,
+		admin,
+		mod,
 	};
 
-	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m' });
-	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d' });
+	//these are strings
+	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
+	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 
-	tokens.create({ token: refreshToken });
+	tokens.create({ token: refreshToken, email: email });
 
 	return { accessToken, refreshToken };
 };

server/utilities/token-refresh.js

@@ -4,12 +4,12 @@ const { tokens } = require('../database/models');
 const generate = require('./token-generate');
 const destroy = require('./token-destroy');
 
-module.exports = (token, callback) => {
+module.exports = async (token, callback) => {
 	if (!token) {
 		return callback(401);
 	}
 
-	const tokenRecord = tokens.findOne({
+	const tokenRecord = await tokens.findOne({
 		where: {
 			token: token || ''
 		}
@@ -24,7 +24,7 @@ module.exports = (token, callback) => {
 			return callback(403);
 		}
 
-		const result = generate(user.id, user.username, user.privilege);
+		const result = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
 		destroy(token);
 

test/auth/login.test.js

@@ -0,0 +1,117 @@
+describe('POST /auth/login', () => {
+	beforeEach(() => {
+		jest.resetModules();
+
+		//fix util with jest (used by bcrypt's compare)
+		jest.doMock('util', () => ({
+			promisify: f => async () => f()
+		}));
+
+		//mock out bcrypt
+		jest.doMock('bcryptjs', () => ({
+			genSalt: async amount => {
+				expect(amount).toBe(11);
+				return 'salt';
+			},
+			hash: async (password, salt) => {
+				expect(password).toBe('password');
+				return 'hashed-password';
+			},
+			compare: (lhs, rhs) => {
+				return lhs === rhs;
+			}
+		}));
+
+		//mock out jsonwebtoken
+		jest.doMock('jsonwebtoken', () => ({
+			sign: (content, secretAccess, opts) => {
+				return JSON.stringify(content);
+			},
+
+			verify: (token, secretAccess, callback) => {
+				return callback(null, JSON.parse(token));
+			},
+		}));
+
+		//mock out the sequelize library
+		jest.doMock('sequelize', () => {
+			return {
+				Op: {
+					//
+				}
+			}
+		});
+
+		//mock out the database object
+		jest.doMock('../../server/database', () => {
+			const mSequelize = {
+				authenticate: jest.fn(),
+				define: jest.fn(),
+			};
+
+			const actualSequelize = jest.requireActual('sequelize');
+			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
+		});
+
+		//mock out the database models
+		jest.doMock('../../server/database/models', () => ({
+			accounts: {
+				findOne: async (config) => { //can't find any (signup state)
+					expect(config?.where?.email).toBe('email@example.com');
+					return {
+						index: 0,
+						email: config?.where?.email,
+						username: 'username',
+						type: 'alpha',
+						admin: false,
+						mod: false,
+					};
+				},
+
+				update: async (values, config) => {
+					//Do nothing
+				}
+			},
+
+			tokens: {
+				create: async (record) => {
+					//Do nothing
+				}
+			}
+		}));
+	});
+
+	test('Basic valid login attempt', async () => {
+		//arguments
+		const req = {
+			body: {
+				email: 'email@example.com',
+				password: 'password',
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(200);
+				return {
+					json: tokens => {
+						//decode and analyze the JWT payload
+						const accessToken = JSON.parse(tokens.accessToken);
+
+						expect(accessToken.email).toBe('email@example.com');
+						expect(accessToken.username).toBe('username');
+					},
+					send: msg => { throw msg; },
+					end: () => null
+				}
+			}
+		}
+
+		//test
+		const route = require('../../server/auth/login');
+
+		const result = await route(req, res);
+
+		expect(result).toBe(null);
+	});
+});

test/auth/signup.test.js

@@ -0,0 +1,98 @@
+describe('POST /auth/signup', () => {
+	beforeEach(() => {
+		jest.resetModules();
+
+		//mock out bcrypt
+		jest.doMock('bcryptjs', () => ({
+			genSalt: async amount => {
+				expect(amount).toBe(11);
+				return 'salt';
+			},
+			hash: async (password, salt) => {
+				expect(password).toBe('password');
+				return 'hashed-password';
+			}
+		}));
+
+		//mock out nodemailer
+		jest.doMock('nodemailer', () => ({
+			createTransport: jest.fn(config => {
+				//TODO: test config?
+				return { //return a fake transport object
+					sendMail: async email => {
+						expect(email.to).toBe('email@example.com');
+						return { //return a fake info object
+							accepted: [ email.to ]
+						}
+					}
+				};
+			}),
+		}));
+
+		//mock out the sequelize library
+		jest.doMock('sequelize', () => {
+			return {
+				Op: {
+					//
+				}
+			}
+		});
+
+		//mock out the database object
+		jest.doMock('../../server/database', () => {
+			const mSequelize = {
+				authenticate: jest.fn(),
+				define: jest.fn(),
+			};
+
+			const actualSequelize = jest.requireActual('sequelize');
+			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
+		});
+
+		//mock out the database models
+		jest.doMock('../../server/database/models', () => ({
+			accounts: {
+				findOne: () => null //can't find any (signup state)
+			},
+
+			pendingSignups: {
+				upsert: jest.fn(async record => {
+					expect(record.email).toBe('email@example.com');
+					expect(record.username).toBe('username');
+					expect(record.hash).toBe('hashed-password');
+					expect(record.contact).toBe(true);
+					//token is a random UUID
+				})
+			}
+		}));
+	});
+
+	test('Basic valid signup attempt', async () => {
+		//arguments
+		const req = {
+			body: {
+				email: 'email@example.com',
+				username: 'username',
+				password: 'password',
+				contact: true
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(200);
+				return {
+					send: msg => expect(msg).toBe('Validation email sent!'),
+					end: () => null
+				}
+			}
+		}
+
+		//test
+		const route = require('../../server/auth/signup');
+
+		const result = await route(req, res);
+
+		expect(result).toBe(null);
+	});
+});

test/dev-auth-requests.rest

@@ -1,68 +0,0 @@
-#Signup
-POST https://dev-auth.eggtrainer.com/auth/signup HTTP/1.1
-Content-Type: application/json
-
-{
-	"email": "kayneruse@gmail.com",
-	"username": "Ratstail91",
-	"password": "helloworld"
-}
-
-###
-
-#Login
-POST https://dev-auth.eggtrainer.com/auth/login HTTP/1.1
-Content-Type: application/json
-
-{
-	"email": "kayneruse@gmail.com",
-	"password": "helloworld"
-}
-
-###
-
-#Query data
-GET https://dev-auth.eggtrainer.com/auth/account HTTP/1.1
-Authorization: Bearer
-
-###
-
-#Logout
-DELETE https://dev-auth.eggtrainer.com/auth/logout HTTP/1.1
-Authorization: Bearer
-
-{
-	"token": ""
-}
-
-###
-
-#Refresh
-POST https://dev-auth.eggtrainer.com/auth/token HTTP/1.1
-Content-Type: application/json
-
-{
-	"token": ""
-}
-
-###
-
-#Update account data
-PATCH https://dev-auth.eggtrainer.com/auth/update HTTP/1.1
-Content-Type: application/json
-Authorization: Bearer
-
-{
-	"contact": "true"
-}
-
-###
-
-#Delete account
-DELETE https://dev-auth.eggtrainer.com/auth/deletion HTTP/1.1
-Authorization: Bearer
-Content-Type: application/json
-
-{
-	"password": "helloworld"
-}

tools/debug-startup.sql

@@ -1,4 +1,4 @@
 #use this while debugging
 CREATE DATABASE IF NOT EXISTS auth;
-CREATE USER IF NOT EXISTS 'auth'@'%' IDENTIFIED BY 'venusaur';
+CREATE USER IF NOT EXISTS 'auth'@'%' IDENTIFIED BY 'charizard';
 GRANT ALL PRIVILEGES ON auth.* TO 'auth'@'%';

tools/dev-auth-requests.rest

@@ -0,0 +1,68 @@
+#Signup
+POST https://dev-auth.krgamestudios.com/auth/signup HTTP/1.1
+Content-Type: application/json
+
+{
+	"email": "example@example.com",
+	"username": "Example",
+	"password": "helloworld"
+}
+
+###
+
+#Login
+POST https://dev-auth.krgamestudios.com/auth/login HTTP/1.1
+Content-Type: application/json
+
+{
+	"email": "example@example.com",
+	"password": "helloworld"
+}
+
+###
+
+#Query data
+GET https://dev-auth.krgamestudios.com/auth/account HTTP/1.1
+Authorization: Bearer
+
+###
+
+#Logout
+DELETE https://dev-auth.krgamestudios.com/auth/logout HTTP/1.1
+Authorization: Bearer
+
+{
+	"token": ""
+}
+
+###
+
+#Refresh
+POST https://dev-auth.krgamestudios.com/auth/token HTTP/1.1
+Content-Type: application/json
+
+{
+	"token": ""
+}
+
+###
+
+#Update account data
+PATCH https://dev-auth.krgamestudios.com/auth/update HTTP/1.1
+Content-Type: application/json
+Authorization: Bearer
+
+{
+	"contact": "true"
+}
+
+###
+
+#Delete account
+DELETE https://dev-auth.krgamestudios.com/auth/deletion HTTP/1.1
+Authorization: Bearer
+Content-Type: application/json
+
+{
+	"password": "helloworld"
+}

tools/localhost-requests.rest

@@ -3,8 +3,8 @@ POST http://127.0.0.1:3200/auth/signup HTTP/1.1
 Content-Type: application/json
 
 {
-	"email": "kayneruse@gmail.com",
-	"username": "Ratstail91",
+	"email": "example@example.com",
+	"username": "Example",
 	"password": "helloworld"
 }
 
@@ -15,7 +15,7 @@ POST http://127.0.0.1:3200/auth/login HTTP/1.1
 Content-Type: application/json
 
 {
-	"email": "kayneruse@gmail.com",
+	"email": "example@example.com",
 	"password": "helloworld"
 }
 
@@ -66,3 +66,5 @@ Content-Type: application/json
 {
 	"password": "helloworld"
 }
+
+###

tools/migrations/v1.3.1.sql

@@ -0,0 +1 @@
+ALTER TABLE `accounts` CHANGE `id` `index` INT( 11 ) NOT NULL AUTO_INCREMENT;

tools/migrations/v1.4.0.sql

@@ -0,0 +1 @@
+DROP TABLE tokens;

tools/react/README.md

@@ -0,0 +1,53 @@
+# TokenProvider
+
+The MERN-template utilizes React's `useContext()` hook to share the auth-server's access token, effectively globally. Here is a quick rundown of how it works.
+
+# Enabling TokenProvider
+
+To enable the TokenProvider component, wrap your App component with it, like so:
+
+```jsx
+import React from 'react';
+import ReactDOM from 'react-dom';
+
+import App from './pages/app';
+import TokenProvider from './pages/utilities/token-provider';
+
+ReactDOM.render(
+	<TokenProvider>
+		<App />
+	</TokenProvider>,
+	document.querySelector('#root')
+);
+```
+
+# Accessing The Access Token
+
+To access the access token from your app, you simply use the `useContext` hook, like so:
+
+```jsx
+import React, { useContext } from 'react';
+import { TokenContext } from '../utilities/token-provider';
+
+const Component = props => {
+	//context
+	const authTokens = useContext(TokenContext);
+
+	//use the access token
+	console.log(authTokens.accessToken);
+
+	return <div />;
+};
+
+export default Component;
+```
+
+# Most Useful Features Provided
+
+The most useful features provided by TokenProvider are:
+
+* `tokenFetch()`, which wraps the `fetch()` API to ensure that your access token is valid
+* `tokenCallback()`, which passes the authTokens as a parameter to any function passed into it
+* `getPayload()`, which returns the payload of the accessToken (including as "email", "username", "admin", and "mod")
+* `accessToken`, this will be falsy if the user is not logged in
+

tools/react/token-provider.jsx

@@ -0,0 +1,127 @@
+import React, { useState, useEffect, createContext } from 'react';
+import decode from 'jwt-decode';
+
+export const TokenContext = createContext();
+
+//DOCS: tokenFetch() and tokenCallback() are actually closures here
+
+const TokenProvider = props => {
+	//state to be used
+	const [accessToken, setAccessToken] = useState('');
+	const [refreshToken, setRefreshToken] = useState('');
+
+	//make the access and refresh tokens persist between reloads
+	useEffect(() => {
+		setAccessToken(localStorage.getItem("accessToken") || '');
+		setRefreshToken(localStorage.getItem("refreshToken") || '');
+	}, []);
+
+	//update the stored copies
+	useEffect(() => {
+		localStorage.setItem("accessToken", accessToken);
+		localStorage.setItem("refreshToken", refreshToken);
+	}, [accessToken, refreshToken]);
+
+	//wrap the default fetch function
+	const tokenFetch = async (url, options) => {
+		//use this?
+		let bearer = accessToken;
+
+		//if expired (10 minutes, normally)
+		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+
+		if (expired) {
+			//BUGFIX: if logging out, just skip over the refresh token
+			if (url === `${process.env.AUTH_URI}/auth/logout`) {
+				return fetch(url, {
+					method: 'DELETE',
+					headers: {
+						'Content-Type': 'application/json',
+						'Access-Control-Allow-Origin': '*',
+						'Authorization': `Bearer ${bearer}`
+					},
+					body: JSON.stringify({
+						token: refreshToken
+					})
+				});
+			}
+
+			//ping the auth server for a new token
+			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/json',
+					'Access-Control-Allow-Origin': '*'
+				},
+				body: JSON.stringify({
+					token: refreshToken
+				})
+			});
+
+			//any errors, throw them
+			if (!response.ok) {
+				throw `${response.status}: ${await response.text()}`;
+			}
+
+			//save the new auth stuff (setting bearer as well)
+			const newAuth = await response.json();
+
+			setAccessToken(newAuth.accessToken);
+			setRefreshToken(newAuth.refreshToken);
+			bearer = newAuth.accessToken;
+		}
+
+		//finally, delegate to fetch
+		return fetch(url, {
+			...(options || {}),
+			headers: {
+				...(options || { headers: {} }).headers,
+				'Authorization': `Bearer ${bearer}`
+			}
+		});
+	};
+
+	//access the refreshed token via callback
+	const tokenCallback = async (cb) => {
+		//if expired (10 minutes, normally)
+		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+
+		if (expired) {
+			//ping the auth server for a new token
+			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/json',
+					'Access-Control-Allow-Origin': '*'
+				},
+				body: JSON.stringify({
+					token: refreshToken
+				})
+			});
+
+			//any errors, throw them
+			if (!response.ok) {
+				throw `${response.status}: ${await response.text()}`;
+			}
+
+			//save the new auth stuff (setting bearer as well)
+			const newAuth = await response.json();
+
+			setAccessToken(newAuth.accessToken);
+			setRefreshToken(newAuth.refreshToken);
+
+			//finally
+			return cb(newAuth.accessToken);
+		} else {
+			return cb(accessToken);
+		}
+	};
+
+	return (
+		<TokenContext.Provider value={{ accessToken, refreshToken, setAccessToken, setRefreshToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
+			{props.children}
+		</TokenContext.Provider>
+	)
+};
+
+export default TokenProvider;