Updated dependencies

.envdev

@@ -29,4 +29,7 @@ DB_LOGGING=
 SECRET_ACCESS=access
 
 # Make sure this value is kept secret
-SECRET_REFRESH=refresh
+SECRET_REFRESH=refresh
+
+# Post-signup hook JSON array (MUST include http:// or https://)
+HOOK_POST_VALIDATION_ARRAY=

.github/FUNDING.yml

@@ -0,0 +1,5 @@
+# These are supported funding model platforms
+
+patreon: krgamestudios
+ko_fi: krgamestudios
+custom: ["https://www.paypal.com/donate/?hosted_button_id=73Q82T2ZHV8AA"]

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: Node.js CI
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+jobs:
+  build:
+    name: Run test suites
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [16.x]
+    steps:
+    - uses: actions/checkout@v2
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v2
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+    - run: npm ci
+    - run: npm run build --if-present
+    - run: npm test

README.md

@@ -28,8 +28,10 @@ Content-Type: application/json
 //DOCS: Used for validating the email address specified above
 GET /auth/validation?username=example&token=12345678
 
-//DOCS: If the environment variable HOOK_POST_VALIDATION is set to a URL, then the server will send a GET message to that URL with the newly created account's index
-GET https://{HOOK_POST_VALIDATION}?accountIndex={index}
+//DOCS: If the environment variable HOOK_POST_VALIDATION_ARRAY is set to a JSON array of valid URLs, then the server will send a GET message to each URL with the newly created account's index
+//DOCS: The GET requests will have a JWT authorization header
+HOOK_POST_VALIDATION_ARRAY=["http://example.com", "http://example2.com"]
+GET {HOOK_POST_VALIDATION_ARRAY[i]}?accountIndex={index}
 
 ###
 
@@ -123,7 +125,7 @@ POST /auth/recover
 Content-Type: application/json
 
 {
-	"email": "kayneruse@gmail.com"
+	"email": "example@example.com"
 }
 
 

configure-script.js

@@ -30,7 +30,7 @@ const question = (prompt, def = null) => {
 	//project configuration
 	const appName = await question('App Name', 'auth');
 	const appWebAddress = await question('Web Addr', `${appName}.example.com`);
-	const postValidationHook = await question('Post Validation Hook', '');
+	const postValidationHookArray = await question('Post Validation Hook Array', '');
 	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
 
@@ -71,7 +71,7 @@ services:
     environment:
       - WEB_PROTOCOL=https
       - WEB_ADDRESS=${appWebAddress}
-      - HOOK_POST_VALIDATION=${postValidationHook}
+      - HOOK_POST_VALIDATION_ARRAY=${postValidationHookArray}
       - WEB_RESET_ADDRESS=${resetAddress}
       - WEB_PORT=${appPort}
       - DB_HOSTNAME=database

package.json

@@ -1,12 +1,13 @@
 {
   "name": "auth-server",
-  "version": "1.4.12",
+  "version": "1.4.14",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
     "start": "node server/server.js",
     "dev": "npm run watch:server",
-    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'"
+    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'",
+    "test": "jest --coverage --collectCoverageFrom=server/**/*.{js,jsx}"
   },
   "repository": {
     "type": "git",
@@ -31,6 +32,7 @@
     "sequelize": "^6.6.5"
   },
   "devDependencies": {
+    "jest": "^27.5.1",
     "nodemon": "^2.0.12"
   }
 }

server/auth/login.js

@@ -13,7 +13,7 @@ const route = async (req, res) => {
 	//validate the given details
 	const validateErr = await validateDetails(req.body);
 	if (validateErr) {
-		return res.status(401).end(validateErr);
+		return res.status(401).send(validateErr);
 	}
 
 	//get the existing account
@@ -29,6 +29,7 @@ const route = async (req, res) => {
 
 	//compare passwords
 	const compare = utils.promisify(bcrypt.compare);
+
 	const match = await compare(req.body.password, account.hash);
 
 	if (!match) {
@@ -47,11 +48,12 @@ const route = async (req, res) => {
 		return res.status(403).send('this account has been banned');
 	}
 
-	//generate the JWT
-	const token = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
+	//generate the JWTs
+	const tokens = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
 
 	//finally
-	res.status(200).json(token);
+	res.status(200).json(tokens);
+	return null;
 };
 
 const validateDetails = async (body) => {

server/auth/validation.js

@@ -1,5 +1,6 @@
 const { pendingSignups, accounts } = require('../database/models');
 const fetch = require('node-fetch');
+const jwt = require('jsonwebtoken');
 
 //auth/validation
 const route = async (req, res) => {
@@ -38,14 +39,42 @@ const route = async (req, res) => {
 	res.status(200).send('Validation succeeded!');
 
 	//post-validation hook
-	if (process.env.HOOK_POST_VALIDATION) {
-		const probe = await fetch(`https://${process.env.HOOK_POST_VALIDATION}?accountIndex=${account.index}`);
+	if (process.env.HOOK_POST_VALIDATION_ARRAY) {
+		try {
+			hooks = JSON.parse(process.env.HOOK_POST_VALIDATION_ARRAY);
 
-		if (!probe.ok) {
-			console.error('Could not probe the post validation hook');
+			if (!Array.isArray(hooks)) {
+				throw 'isArray() check failed';
+			}
+
+			//authenticate the hooks
+			const bearer = jwt.sign({ type: 'hook authentication' }, process.env.SECRET_ACCESS, { expiresIn: '5m', issuer: 'auth' });
+
+			//promise for each given hook
+			const promises = hooks.map(async hook => {
+				if (typeof hook != 'string') {
+					throw 'hook is not a string';
+				}
+
+				const probe = await fetch(`${hook}?accountIndex=${account.index}`, {
+					method: 'GET',
+					headers: {
+						'Authorization': `Bearer ${bearer}`
+					}
+				});
+
+				if (!probe.ok) {
+					throw `Could not probe the post validation hook: ${hook}`;
+				}
+
+				//discard the result
+			});
+
+			Promise.all(promises);
+		}
+		catch(e) {
+			console.error('HOOK_POST_VALIDATION_ARRAY is not a valid array of strings in JSON format: ' + e);
 		}
-
-		//discard the result
 	}
 };
 

server/utilities/token-auth.js

@@ -3,7 +3,7 @@ const jwt = require('jsonwebtoken');
 //middleware to authenticate the JWT token
 module.exports = (req, res, next) => {
 	const authHeader = req.headers['authorization'];
-	const token = authHeader?.split (' ')[1]; //'Bearer token'
+	const token = authHeader?.split(' ')[1]; //'Bearer token'
 
 	if (!token) {
 		return res.status(401).send('No token found');

server/utilities/token-generate.js

@@ -12,6 +12,7 @@ module.exports = (index, email, username, type, admin, mod) => {
 		mod,
 	};
 
+	//these are strings
 	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
 	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 

test/auth/login.test.js

@@ -0,0 +1,117 @@
+describe('POST /auth/login', () => {
+	beforeEach(() => {
+		jest.resetModules();
+
+		//fix util with jest (used by bcrypt's compare)
+		jest.doMock('util', () => ({
+			promisify: f => async () => f()
+		}));
+
+		//mock out bcrypt
+		jest.doMock('bcryptjs', () => ({
+			genSalt: async amount => {
+				expect(amount).toBe(11);
+				return 'salt';
+			},
+			hash: async (password, salt) => {
+				expect(password).toBe('password');
+				return 'hashed-password';
+			},
+			compare: (lhs, rhs) => {
+				return lhs === rhs;
+			}
+		}));
+
+		//mock out jsonwebtoken
+		jest.doMock('jsonwebtoken', () => ({
+			sign: (content, secretAccess, opts) => {
+				return JSON.stringify(content);
+			},
+
+			verify: (token, secretAccess, callback) => {
+				return callback(null, JSON.parse(token));
+			},
+		}));
+
+		//mock out the sequelize library
+		jest.doMock('sequelize', () => {
+			return {
+				Op: {
+					//
+				}
+			}
+		});
+
+		//mock out the database object
+		jest.doMock('../../server/database', () => {
+			const mSequelize = {
+				authenticate: jest.fn(),
+				define: jest.fn(),
+			};
+
+			const actualSequelize = jest.requireActual('sequelize');
+			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
+		});
+
+		//mock out the database models
+		jest.doMock('../../server/database/models', () => ({
+			accounts: {
+				findOne: async (config) => { //can't find any (signup state)
+					expect(config?.where?.email).toBe('email@example.com');
+					return {
+						index: 0,
+						email: config?.where?.email,
+						username: 'username',
+						type: 'alpha',
+						admin: false,
+						mod: false,
+					};
+				},
+
+				update: async (values, config) => {
+					//Do nothing
+				}
+			},
+
+			tokens: {
+				create: async (record) => {
+					//Do nothing
+				}
+			}
+		}));
+	});
+
+	test('Basic valid login attempt', async () => {
+		//arguments
+		const req = {
+			body: {
+				email: 'email@example.com',
+				password: 'password',
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(200);
+				return {
+					json: tokens => {
+						//decode and analyze the JWT payload
+						const accessToken = JSON.parse(tokens.accessToken);
+
+						expect(accessToken.email).toBe('email@example.com');
+						expect(accessToken.username).toBe('username');
+					},
+					send: msg => { throw msg; },
+					end: () => null
+				}
+			}
+		}
+
+		//test
+		const route = require('../../server/auth/login');
+
+		const result = await route(req, res);
+
+		expect(result).toBe(null);
+	});
+});

test/auth/signup.test.js

@@ -0,0 +1,98 @@
+describe('POST /auth/signup', () => {
+	beforeEach(() => {
+		jest.resetModules();
+
+		//mock out bcrypt
+		jest.doMock('bcryptjs', () => ({
+			genSalt: async amount => {
+				expect(amount).toBe(11);
+				return 'salt';
+			},
+			hash: async (password, salt) => {
+				expect(password).toBe('password');
+				return 'hashed-password';
+			}
+		}));
+
+		//mock out nodemailer
+		jest.doMock('nodemailer', () => ({
+			createTransport: jest.fn(config => {
+				//TODO: test config?
+				return { //return a fake transport object
+					sendMail: async email => {
+						expect(email.to).toBe('email@example.com');
+						return { //return a fake info object
+							accepted: [ email.to ]
+						}
+					}
+				};
+			}),
+		}));
+
+		//mock out the sequelize library
+		jest.doMock('sequelize', () => {
+			return {
+				Op: {
+					//
+				}
+			}
+		});
+
+		//mock out the database object
+		jest.doMock('../../server/database', () => {
+			const mSequelize = {
+				authenticate: jest.fn(),
+				define: jest.fn(),
+			};
+
+			const actualSequelize = jest.requireActual('sequelize');
+			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
+		});
+
+		//mock out the database models
+		jest.doMock('../../server/database/models', () => ({
+			accounts: {
+				findOne: () => null //can't find any (signup state)
+			},
+
+			pendingSignups: {
+				upsert: jest.fn(async record => {
+					expect(record.email).toBe('email@example.com');
+					expect(record.username).toBe('username');
+					expect(record.hash).toBe('hashed-password');
+					expect(record.contact).toBe(true);
+					//token is a random UUID
+				})
+			}
+		}));
+	});
+
+	test('Basic valid signup attempt', async () => {
+		//arguments
+		const req = {
+			body: {
+				email: 'email@example.com',
+				username: 'username',
+				password: 'password',
+				contact: true
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(200);
+				return {
+					send: msg => expect(msg).toBe('Validation email sent!'),
+					end: () => null
+				}
+			}
+		}
+
+		//test
+		const route = require('../../server/auth/signup');
+
+		const result = await route(req, res);
+
+		expect(result).toBe(null);
+	});
+});

test/server.test.js

@@ -0,0 +1,65 @@
+describe('Integration Test Suite', () => {
+	beforeEach(() => {
+		jest.resetModules();
+
+		//mock dotenv
+		jest.doMock('dotenv', () => ({
+			config: () => null
+		}));
+
+		//mock express
+		jest.doMock('express', () => {
+			const express = () => ({
+				identity: 'app',
+				use: () => null,
+				get: () => null,
+			});
+
+			express.Router = () => ({
+				identity: 'Router',
+				use: () => null,
+				get: () => null,
+				post: () => null,
+				patch: () => null,
+				delete: () => null,
+			});
+
+			express.json = () => 'json';
+
+			return express;
+		});
+
+		//mock http
+		jest.doMock('http', () => ({
+			Server: app => {
+				expect(app.identity).toBe('app');
+
+				return {
+					listen: (port, cb) => cb()
+				}
+			}
+		}));
+
+		//mock sequelize
+		class Seq {
+			sync() {}
+			define() {}
+			static INTEGER() {}
+		};
+	
+		jest.doMock('sequelize', () => {
+			return Seq;
+		});
+
+		//mock node-cron
+		jest.doMock('node-cron', () => {
+			return {
+				schedule: () => null
+			}
+		});
+	});
+
+	test('Start The Server', () => {
+		const serv = require('../server/server');
+	});
+});

test/utilities/token-auth.test.js

@@ -0,0 +1,87 @@
+describe('token-auth', () => {
+	beforeEach(() => {
+		jest.resetModules();
+
+		//mock out jsonwebtoken
+		jest.doMock('jsonwebtoken', () => ({
+			verify: (token, secretAccess, callback) => {
+				if (token != 'invalid') {
+					expect(token).toBe('testtoken');
+					return callback(null, { username: 'username' });
+				} else {
+					expect(token).toBe('invalid');
+					return callback('Misc. error');
+				}
+			},
+		}));
+	});
+
+	test('Required Functionality', () => {
+		const tokenAuth = require('../../server/utilities/token-auth');
+
+		const req = {
+			headers: {
+				authorization: 'Bearer testtoken'
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(null);
+				return msg => { throw msg; };
+			}
+		};
+
+		tokenAuth(req, res, () => null);
+
+		expect(req.user.username).toBe('username');
+	});
+
+	test('Missing Token', () => {
+		const tokenAuth = require('../../server/utilities/token-auth');
+
+		const req = {
+			headers: {
+				//
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(401);
+				return {
+					send: msg => {
+						expect(msg).toBe('No token found');
+						return null;
+					}
+				};
+			}
+		};
+
+		tokenAuth(req, res, () => null);
+	});
+
+	test('Invalid Token', () => {
+		const tokenAuth = require('../../server/utilities/token-auth');
+
+		const req = {
+			headers: {
+				authorization: 'Bearer invalid'
+			}
+		};
+
+		const res = {
+			status: code => {
+				expect(code).toBe(403);
+				return {
+					send: msg => {
+						expect(msg).toBe('Misc. error');
+						return null;
+					}
+				};
+			}
+		};
+
+		tokenAuth(req, res, () => null);
+	});
+});

tools/react/token-provider.jsx

@@ -37,7 +37,6 @@ const TokenProvider = props => {
 					method: 'DELETE',
 					headers: {
 						'Content-Type': 'application/json',
-						'Access-Control-Allow-Origin': '*',
 						'Authorization': `Bearer ${bearer}`
 					},
 					body: JSON.stringify({
@@ -50,8 +49,7 @@ const TokenProvider = props => {
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
 				headers: {
-					'Content-Type': 'application/json',
-					'Access-Control-Allow-Origin': '*'
+					'Content-Type': 'application/json'
 				},
 				body: JSON.stringify({
 					token: refreshToken
@@ -91,8 +89,7 @@ const TokenProvider = props => {
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
 				headers: {
-					'Content-Type': 'application/json',
-					'Access-Control-Allow-Origin': '*'
+					'Content-Type': 'application/json'
 				},
 				body: JSON.stringify({
 					token: refreshToken