Hotfix a hotfix

omit physical address line from validation email where no physical address provided

.envdev

@@ -2,8 +2,9 @@ WEB_PROTOCOL=http
 WEB_ADDRESS=localhost
 WEB_RESET_ADDRESS=localhost/reset
 WEB_PORT=3200
+WEB_ORIGIN=http://localhost:3001
 
-DB_HOSTNAME=database
+DB_HOSTNAME=localhost
 DB_DATABASE=auth
 DB_USERNAME=auth
 DB_PASSWORD=charizard
@@ -30,3 +31,6 @@ SECRET_ACCESS=access
 
 # Make sure this value is kept secret
 SECRET_REFRESH=refresh
+
+# Post-signup hook JSON array (MUST include http:// or https://)
+HOOK_POST_VALIDATION_ARRAY=

.github/FUNDING.yml

@@ -0,0 +1,5 @@
+# These are supported funding model platforms
+
+patreon: krgamestudios
+ko_fi: krgamestudios
+custom: ["https://www.paypal.com/donate/?hosted_button_id=73Q82T2ZHV8AA"]

Dockerfile

@@ -1,7 +1,7 @@
 
-FROM node:16
+FROM node:21-bookworm-slim
 WORKDIR "/app"
-COPY package*.json ./
+COPY package*.json /app
 RUN npm install --production
 COPY . /app
 EXPOSE 3200

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2021 Kayne Ruse, KR Game Studios
+Copyright (c) 2021-2023 Kayne Ruse, KR Game Studios
 
 This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.
 

README.md

@@ -2,6 +2,8 @@
 
 An API centric auth server. Uses Sequelize and mariaDB by default.
 
+This server is available via docker hub at krgamestudios/auth-server.
+
 # Setup
 
 There are multiple ways to run this app - it can run on it's own via `npm start` (for production) or `npm run dev` (for development). it can also run inside docker using `docker-compose up --build` - run `node configure-script.js` to generate docker-compose.yml and startup.sql.
@@ -26,8 +28,10 @@ Content-Type: application/json
 //DOCS: Used for validating the email address specified above
 GET /auth/validation?username=example&token=12345678
 
-//DOCS: If the environment variable HOOK_POST_VALIDATION is set to a URL, then the server will send a GET message to that URL with the newly created account's index
-GET https://{HOOK_POST_VALIDATION}?accountIndex={index}
+//DOCS: If the environment variable HOOK_POST_VALIDATION_ARRAY is set to a JSON array of valid URLs, then the server will send a GET message to each URL with the newly created account's index
+//DOCS: The GET requests will have a JWT authorization header
+HOOK_POST_VALIDATION_ARRAY=["http://example.com", "http://example2.com"]
+GET {HOOK_POST_VALIDATION_ARRAY[i]}?accountIndex={index}
 
 ###
 
@@ -42,41 +46,35 @@ Content-Type: application/json
 }
 
 //DOCS: Result (access token's value is your authorization key below)
+Set-Cookie: refreshToken
+
 {
-	"accessToken": "abcde",
-	"refreshToken": "fghij"
+	"accessToken": "abcde"
 }
 
 
 ###
 
 
-//DOCS: Replace an expired authToken pair with new values
+//DOCS: Replace an expired accessToken with a new value
 POST /auth/token
-Content-Type: application/json
-
-{
-	"token": "refreshToken"
-}
+Cookie: refreshToken
 
 //DOCS: Result
+Set-Cookie: refreshToken
+
 {
-	"accessToken": "abcde",
-	"refreshToken": "fghij"
+	"accessToken": "abcde"
 }
 
 
 ###
 
 
-//DOCS: After this is called, the refresh route will no longer work
+//DOCS: After this is called, the /auth/token route will no longer work
 DELETE /auth/logout
 Authorization: Bearer accessToken
-
-{
-	"token": "refreshToken"
-}
-
+Cookie: refreshToken
 
 ###
 
@@ -121,7 +119,7 @@ POST /auth/recover
 Content-Type: application/json
 
 {
-	"email": "kayneruse@gmail.com"
+	"email": "example@example.com"
 }
 
 

configure-script.js

@@ -29,13 +29,15 @@ const question = (prompt, def = null) => {
 (async () => {
 	//project configuration
 	const appName = await question('App Name', 'auth');
+	const appWebProtocol = await question('Web Protocol', 'https');
 	const appWebAddress = await question('Web Addr', `${appName}.example.com`);
-	const postValidationHook = await question('Post Validation Hook', '');
+	const appWebOrigin = await question('Web Origin', `${appWebProtocol}://example.com`); //TODO: clean these up properly
+	const postValidationHookArray = await question('Post Validation Hook Array', '');
 	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
 
 	const appDBUser = await question('DB User', appName);
-	const appDBPass = await question('DB Pass', uuid());
+	const appDBPass = await question('DB Pass', 'charizard');
 	const dbRootPass = await question('DB Root Pass');
 
 	const appMailSMTP = await question('Mail SMTP', 'smtp.example.com');
@@ -53,8 +55,7 @@ const question = (prompt, def = null) => {
 
 	//generate the files
 	const ymlfile = `
-version: '3'
-
+version: '3.8'
 services:
   ${appName}:
     build:
@@ -69,9 +70,10 @@ services:
       - "traefik.http.routers.${appName}router.service=${appName}service@docker"
       - "traefik.http.services.${appName}service.loadbalancer.server.port=${appPort}"
     environment:
-      - WEB_PROTOCOL=https
+      - WEB_PROTOCOL=${appWebProtocol}
+      - WEB_ORIGIN=${appWebOrigin}
       - WEB_ADDRESS=${appWebAddress}
-      - HOOK_POST_VALIDATION=${postValidationHook}
+      - HOOK_POST_VALIDATION_ARRAY=${postValidationHookArray}
       - WEB_RESET_ADDRESS=${resetAddress}
       - WEB_PORT=${appPort}
       - DB_HOSTNAME=database
@@ -105,7 +107,7 @@ services:
       - ./startup.sql:/docker-entrypoint-initdb.d/startup.sql:ro
   traefik_${appName}:
     container_name: ${appName}_traefik
-    image: "traefik:v2.4"
+    image: "traefik:v2.10"
     container_name: "traefik"
     command:
       - "--log.level=ERROR"
@@ -130,7 +132,7 @@ networks:
 `;
 
 	const dockerfile = `
-FROM node:16
+FROM node:21-bookworm-slim
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.4.6",
+  "version": "1.8.2",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
@@ -20,17 +20,19 @@
   "homepage": "https://github.com/krgamestudios/auth-server#readme",
   "dependencies": {
     "bcryptjs": "^2.4.3",
+    "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
-    "dotenv": "^8.6.0",
-    "express": "^4.17.1",
-    "jsonwebtoken": "^8.5.1",
-    "mariadb": "^2.5.4",
-    "node-cron": "^2.0.3",
-    "node-fetch": "^3.1.0",
-    "nodemailer": "^6.6.3",
-    "sequelize": "^6.6.5"
+    "dotenv": "^16.3.1",
+    "express": "^4.18.2",
+    "jsonwebtoken": "^9.0.2",
+    "mariadb": "^3.2.3",
+    "node-cron": "^3.0.3",
+    "node-fetch": "^2.7.0",
+    "nodemailer": "^6.9.7",
+    "npm": "^9.9.2",
+    "sequelize": "^6.35.2"
   },
   "devDependencies": {
-    "nodemon": "^2.0.12"
+    "nodemon": "^3.0.2"
   }
 }

server/admin/default-account.js

@@ -25,7 +25,7 @@ module.exports = async () => {
 	});
 
 	if (adminRecord == null) {
-		const webAddress = process.env.WEB_ADDRESS == 'localhost' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
+		const webAddress = process.env.WEB_ADDRESS == 'localhost:3000' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
 		await accounts.create({
 			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
 			username: `${process.env.ADMIN_DEFAULT_USERNAME}`,

server/auth/index.js

@@ -11,9 +11,6 @@ router.post('/signup', require('./signup'));
 router.get('/validation', require('./validation'));
 router.post('/login', require('./login'));
 
-//refresh token
-router.post('/token', require('./token'));
-
 //password recover and reset
 router.post('/recover', require('./password-recover'));
 router.get('/reset', require('./password-redirect'));
@@ -22,9 +19,10 @@ router.patch('/reset', require('./password-reset'));
 //logouts allowed when banned, and when the token itself is invalid
 router.delete('/logout', require('./logout'));
 
-//middleware
+//authenticate token
 router.use(tokenAuth);
 
+//middleware
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
@@ -43,6 +41,9 @@ router.use(async (req, res, next) => {
 	next();
 });
 
+//refresh token
+router.post('/token', require('./token'));
+
 //basic account management (needs a token)
 router.get('/account', require('./account-query'));
 router.patch('/account', require('./account-update'));

server/auth/login.js

@@ -3,7 +3,7 @@ const utils = require('util');
 const bcrypt = require('bcryptjs');
 
 const { accounts } = require('../database/models');
-const tokenGenerate = require('../utilities/token-generate');
+const tokenGenerateRefresh = require('../utilities/token-generate-refresh');
 
 //utilities
 const validateEmail = require('../utilities/validate-email');
@@ -13,7 +13,7 @@ const route = async (req, res) => {
 	//validate the given details
 	const validateErr = await validateDetails(req.body);
 	if (validateErr) {
-		return res.status(401).end(validateErr);
+		return res.status(401).send(validateErr);
 	}
 
 	//get the existing account
@@ -29,6 +29,7 @@ const route = async (req, res) => {
 
 	//compare passwords
 	const compare = utils.promisify(bcrypt.compare);
+
 	const match = await compare(req.body.password, account.hash);
 
 	if (!match) {
@@ -47,11 +48,15 @@ const route = async (req, res) => {
 		return res.status(403).send('this account has been banned');
 	}
 
-	//generate the JWT
-	const token = tokenGenerate(account.index, account.email, account.username, account.type, account.admin, account.mod);
+	//generate the JWTs
+	const { accessToken, refreshToken } = await tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
+
+	//set the cookie
+	res.cookie('refreshToken', refreshToken, { path: '/', httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 * 1000 }); //30 days
 
 	//finally
-	res.status(200).json(token);
+	res.status(200).send(accessToken);
+	return null;
 };
 
 const validateDetails = async (body) => {

server/auth/logout.js

@@ -2,7 +2,10 @@ const tokenDestroy = require('../utilities/token-destroy');
 
 //auth/logout
 const route = (req, res) => {
-	tokenDestroy(req.body.token);
+	//stored in the cookie
+	tokenDestroy(req.cookies.refreshToken);
+
+	res.clearCookie('refreshToken');
 
 	return res.status(200).end();
 };

server/auth/password-redirect.js

@@ -5,7 +5,7 @@ const route = async (req, res) => {
 	//verify the recovery record exists
 	const record = await recovery.findOne({
 		where: {
-			token: req.query.token
+			token: req.query.token || ''
 		}
 	});
 

server/auth/signup.js

@@ -19,6 +19,13 @@ const route = async (req, res) => {
 		return res.status(401).send(validateErr);
 	}
 
+	//script throttle
+	const throttle = await checkThrottle(req.body.email);
+	if (throttle) {
+		console.warn(`Spam Throttled\t${req.body.email} (${req.body.username})`);
+		return res.status(401).send(throttle);
+	}
+
 	//generate the password hash
 	const hash = await bcrypt.hash(req.body.password, await bcrypt.genSalt(11));
 
@@ -52,9 +59,6 @@ const validateDetails = async (body) => {
 		return 'Invalid username';
 	}
 
-	//check for existing (banned)
-	//TODO: re-add banned email checks
-
 	//check for existing email
 	const emailRecord = await accounts.findOne({
 		where: {
@@ -86,6 +90,10 @@ const validateDetails = async (body) => {
 		return 'Missing password';
 	}
 
+	if (typeof body.password != "string") {
+		return 'Invalid password';
+	}
+
 	if (body.password.length < 8) {
 		return 'Password too short';
 	}
@@ -93,8 +101,41 @@ const validateDetails = async (body) => {
 	return null;
 };
 
+const checkThrottle = async (email) => {
+	//check email delay
+	const prev = await pendingSignups.findOne({
+		where: {
+			email: email,
+		}
+	});
+
+	const DateOffset = ( offset ) => { //Thanks, SO!
+		return new Date( +new Date + offset );
+	}
+
+	if (!!prev && prev.updatedAt > DateOffset( -5000 )) {
+		return "An unknown error occurred";
+	}
+
+	return null;
+}
+
 const registerPendingSignup = async (body, hash, token) => {
-	const record = await pendingSignups.upsert({
+	//BUGFIX: delete existing pending signups that clash
+	await pendingSignups.destroy({
+		where: {
+			email: body.email
+		}
+	});
+
+	await pendingSignups.destroy({
+		where: {
+			username: body.username
+		}
+	});
+
+	//record it
+	const record = await pendingSignups.create({
 		email: body.email,
 		username: body.username,
 		hash: hash,
@@ -107,12 +148,12 @@ const registerPendingSignup = async (body, hash, token) => {
 
 const sendValidationEmail = async (email, username, token) => {
 	const addr = `${process.env.WEB_PROTOCOL}://${process.env.WEB_ADDRESS}/auth/validation?username=${username}&token=${token}`;
-	const msg = `Hello ${username}!
-
-Please visit the following link to validate your account: ${addr}
-
-You can contact us directly at our physical mailing address here: ${process.env.MAIL_PHYSICAL}
-`;
+	const msg =
+  `Hello ${username}!\n\n` +
+  `Please visit the following link to validate your account: ${addr}\n` +
+  (process.env.MAIL_PHYSICAL
+    ? `\nYou can contact us directly at our physical mailing address here: ${process.env.MAIL_PHYSICAL}\n`
+    : ``);
 
 	let transporter, info;
 

server/auth/token.js

@@ -1,16 +1,15 @@
-const jwt = require('jsonwebtoken');
-
 const tokenRefresh = require('../utilities/token-refresh');
 
 //auth/token
 module.exports = async (req, res) => {
-	const refreshToken = req.body.token;
-
-	return tokenRefresh(refreshToken, (err, token) => {
+	return await tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
 		if (err) {
 			return res.status(err).end();
 		}
 
-		return res.status(200).send(token);
+		//set the cookie
+		res.cookie('refreshToken', refreshToken, { path: '/', httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 * 1000 }); //30 days
+
+		return res.status(200).send({ accessToken });
 	});
 };

server/auth/validation.js

@@ -1,5 +1,6 @@
 const { pendingSignups, accounts } = require('../database/models');
 const fetch = require('node-fetch');
+const jwt = require('jsonwebtoken');
 
 //auth/validation
 const route = async (req, res) => {
@@ -20,7 +21,7 @@ const route = async (req, res) => {
 	}
 
 	//move data to the accounts table
-	const [account] = await accounts.upsert({
+	const account = await accounts.create({
 		email: info.email,
 		username: info.username,
 		hash: info.hash,
@@ -30,7 +31,7 @@ const route = async (req, res) => {
 	//delete the pending signup
 	pendingSignups.destroy({
 		where: {
-			username: req.query.username || ''
+			username: info.username || ''
 		}
 	});
 
@@ -38,18 +39,42 @@ const route = async (req, res) => {
 	res.status(200).send('Validation succeeded!');
 
 	//post-validation hook
-	if (process.env.HOOK_POST_VALIDATION) {
-		const probe = await fetch(`https://${process.env.HOOK_POST_VALIDATION}?accountIndex=${account.index}`);
+	if (process.env.HOOK_POST_VALIDATION_ARRAY) {
+		try {
+			hooks = JSON.parse(process.env.HOOK_POST_VALIDATION_ARRAY);
+
+			if (!Array.isArray(hooks)) {
+				throw 'post validation hook isArray() check failed';
+			}
+
+			//authenticate the hooks
+			const bearer = jwt.sign({ type: 'hook authentication' }, process.env.SECRET_ACCESS, { expiresIn: '5m', issuer: 'auth' });
+
+			//promise for each given hook
+			const promises = hooks.map(async hook => {
+				if (typeof hook != 'string') {
+					throw 'hook is not a string';
+				}
+
+				const probe = await fetch(`${hook}?accountIndex=${account.index}`, {
+					method: 'GET',
+					headers: {
+						'Authorization': `Bearer ${bearer}`
+					}
+				});
 
 				if (!probe.ok) {
-			console.error('Could not probe the post validation hook');
-		} else {
-			console.log('Validation hook probe successful'); //TODO: remove this
+					throw `Could not probe the post validation hook: ${hook} with accountIndex = ${account.index}`;
 				}
 
 				//discard the result
-	} else {
-		console.log('No validation hook'); //TODO: remove this
+			});
+
+			await Promise.all(promises);
+		}
+		catch(e) {
+			console.error('HOOK_POST_VALIDATION_ARRAY is not a valid array of strings in JSON format: ' + e);
+		}
 	}
 };
 

server/database/models/banned-ip-addresses.js

@@ -0,0 +1,17 @@
+const Sequelize = require('sequelize');
+const sequelize = require('..');
+
+//DOCS: this isn't set by anything - it's a stub for now
+
+module.exports = sequelize.define('bannedIPAddresses', {
+	content: {
+		type: 'varchar(320)',
+		unique: true
+	},
+
+	expiry: {
+		type: 'DATETIME',
+		allowNull: true,
+		defaultValue: null
+	},
+});

server/database/models/index.js

@@ -2,5 +2,6 @@ module.exports = {
 	tokens: require('./tokens'),
 	accounts: require('./accounts'),
 	pendingSignups: require('./pending-signups'),
-	recovery: require('./recovery')
+	recovery: require('./recovery'),
+	bannedIPAddresses: require("./banned-ip-addresses"),
 };

server/server.js

@@ -6,14 +6,26 @@ const express = require('express');
 const app = express();
 const server = require('http').Server(app);
 const cors = require('cors');
+const cookieParser = require('cookie-parser');
 
 //config
 app.use(express.json());
-app.use(cors());
+
+app.use(cors({
+	credentials: true,
+	origin: [`${process.env.WEB_ORIGIN}`],
+	allowedHeaders: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'Authorization', 'Set-Cookie'],
+	exposedHeaders: ['Origin', 'X-Requested-With', 'Content-Type', 'Accept', 'Authorization', 'Set-Cookie'],
+}));
+
+app.use(cookieParser());
 
 //database connection
 const database = require('./database');
 
+//ip-based management
+app.use(require('./utilities/banned-ip-addresses-middleware'));
+
 //access the admin
 app.use('/admin', require('./admin'));
 

server/utilities/banned-ip-addresses-middleware.js

@@ -0,0 +1,33 @@
+const { Op } = require("sequelize");
+const { bannedIPAddresses } = require('../database/models');
+
+//middleware to manage banned IP addresses
+module.exports = async (req, res, next) => {
+	const address = req.header('x-forwarded-for') || req.socket.remoteAddress;
+
+	const record = await bannedIPAddresses.findOne({
+		where: {
+			content: address,
+
+			expiry: {
+				[Op.or]: {
+					//future or forever
+					[Op.gt]: Date.now(),
+					[Op.eq]: null,
+				}
+			}
+		}
+	});
+
+	//log the access timestamp
+	const date = new Date();
+
+	if (!!record) {
+		console.log(`IP blocked\t${address}\t\t\t${date.toTimeString()}`);
+		return res.status(403).send("IP address banned");
+	}
+
+	// console.log(`IP allowed\t${address}\t\t\t${date.toTimeString()}`);
+
+	return next();
+};

server/utilities/token-auth.js

@@ -3,13 +3,13 @@ const jwt = require('jsonwebtoken');
 //middleware to authenticate the JWT token
 module.exports = (req, res, next) => {
 	const authHeader = req.headers['authorization'];
-	const token = authHeader?.split (' ')[1]; //'Bearer token'
+	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
 
-	if (!token) {
-		return res.status(401).send('No token found');
+	if (!accessToken) {
+		return res.status(401).send('No access token found');
 	}
 
-	return jwt.verify(token, process.env.SECRET_ACCESS, (err, user) => {
+	return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {
 		if (err) {
 			return res.status(403).send(err);
 		}

server/utilities/token-destroy.js

@@ -1,9 +1,9 @@
 const { tokens } = require('../database/models');
 
-module.exports = (token) => {
-	tokens.destroy({
+module.exports = async (refreshToken) => {
+	await tokens.destroy({
 		where: {
-			token: token || ''
+			token: refreshToken || ''
 		}
 	});
 }

server/utilities/token-generate-refresh.js

@@ -2,7 +2,7 @@ const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
 //generates a JWT token based on the given arguments
-module.exports = (index, email, username, type, admin, mod) => {
+module.exports = async (index, email, username, type, admin, mod) => {
 	const content = {
 		index,
 		email,
@@ -12,10 +12,11 @@ module.exports = (index, email, username, type, admin, mod) => {
 		mod,
 	};
 
+	//these are strings
 	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
 	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 
-	tokens.create({ token: refreshToken, email: email });
+	await tokens.create({ token: refreshToken, email: email });
 
 	return { accessToken, refreshToken };
 };

server/utilities/token-refresh.js

@@ -1,17 +1,17 @@
 const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
-const generate = require('./token-generate');
+const generate = require('./token-generate-refresh');
 const destroy = require('./token-destroy');
 
-module.exports = async (token, callback) => {
-	if (!token) {
+module.exports = async (oldRefreshToken, callback) => {
+	if (!oldRefreshToken) {
 		return callback(401);
 	}
 
 	const tokenRecord = await tokens.findOne({
 		where: {
-			token: token || ''
+			token: oldRefreshToken || ''
 		}
 	});
 
@@ -19,15 +19,15 @@ module.exports = async (token, callback) => {
 		return callback(403);
 	}
 
-	jwt.verify(token, process.env.SECRET_REFRESH, (err, user) => {
+	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, async (err, user) => {
 		if (err) {
 			return callback(403);
 		}
 
-		const result = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
+		await destroy(oldRefreshToken);
 
-		destroy(token);
+		const { accessToken, refreshToken } = await generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
-		return callback(null, result);
+		return await callback(null, accessToken, refreshToken);
 	});
 };

sql/migrations/v1.3.1.sql

@@ -1 +0,0 @@
-ALTER TABLE `accounts` CHANGE `id` `index` INT( 11 ) NOT NULL AUTO_INCREMENT;

sql/migrations/v1.4.0.sql

@@ -1 +0,0 @@
-DROP TABLE tokens;

test/dev-auth-requests.rest

@@ -1,68 +0,0 @@
-#Signup
-POST https://dev-auth.eggtrainer.com/auth/signup HTTP/1.1
-Content-Type: application/json
-
-{
-	"email": "kayneruse@gmail.com",
-	"username": "Ratstail91",
-	"password": "helloworld"
-}
-
-###
-
-#Login
-POST https://dev-auth.eggtrainer.com/auth/login HTTP/1.1
-Content-Type: application/json
-
-{
-	"email": "kayneruse@gmail.com",
-	"password": "helloworld"
-}
-
-###
-
-#Query data
-GET https://dev-auth.eggtrainer.com/auth/account HTTP/1.1
-Authorization: Bearer
-
-###
-
-#Logout
-DELETE https://dev-auth.eggtrainer.com/auth/logout HTTP/1.1
-Authorization: Bearer
-
-{
-	"token": ""
-}
-
-###
-
-#Refresh
-POST https://dev-auth.eggtrainer.com/auth/token HTTP/1.1
-Content-Type: application/json
-
-{
-	"token": ""
-}
-
-###
-
-#Update account data
-PATCH https://dev-auth.eggtrainer.com/auth/update HTTP/1.1
-Content-Type: application/json
-Authorization: Bearer
-
-{
-	"contact": "true"
-}
-
-###
-
-#Delete account
-DELETE https://dev-auth.eggtrainer.com/auth/deletion HTTP/1.1
-Authorization: Bearer
-Content-Type: application/json
-
-{
-	"password": "helloworld"
-}

tools/debug-startup.sql

@@ -1,4 +1,4 @@
 #use this while debugging
 CREATE DATABASE IF NOT EXISTS auth;
-CREATE USER IF NOT EXISTS 'auth'@'%' IDENTIFIED BY 'venusaur';
+CREATE USER IF NOT EXISTS 'auth'@'%' IDENTIFIED BY 'charizard';
 GRANT ALL PRIVILEGES ON auth.* TO 'auth'@'%';

tools/dev-auth-requests.rest

@@ -0,0 +1,68 @@
+#Signup
+POST https://dev-auth.krgamestudios.com/auth/signup HTTP/1.1
+Content-Type: application/json
+
+{
+	"email": "example@example.com",
+	"username": "Example",
+	"password": "helloworld"
+}
+
+###
+
+#Login
+POST https://dev-auth.krgamestudios.com/auth/login HTTP/1.1
+Content-Type: application/json
+
+{
+	"email": "example@example.com",
+	"password": "helloworld"
+}
+
+###
+
+#Query data
+GET https://dev-auth.krgamestudios.com/auth/account HTTP/1.1
+Authorization: Bearer
+
+###
+
+#Logout
+DELETE https://dev-auth.krgamestudios.com/auth/logout HTTP/1.1
+Authorization: Bearer
+
+{
+	"token": ""
+}
+
+###
+
+#Refresh
+POST https://dev-auth.krgamestudios.com/auth/token HTTP/1.1
+Content-Type: application/json
+
+{
+	"token": ""
+}
+
+###
+
+#Update account data
+PATCH https://dev-auth.krgamestudios.com/auth/update HTTP/1.1
+Content-Type: application/json
+Authorization: Bearer
+
+{
+	"contact": "true"
+}
+
+###
+
+#Delete account
+DELETE https://dev-auth.krgamestudios.com/auth/deletion HTTP/1.1
+Authorization: Bearer
+Content-Type: application/json
+
+{
+	"password": "helloworld"
+}

tools/localhost-requests.rest

@@ -3,8 +3,8 @@ POST http://127.0.0.1:3200/auth/signup HTTP/1.1
 Content-Type: application/json
 
 {
-	"email": "kayneruse@gmail.com",
-	"username": "Ratstail91",
+	"email": "example@example.com",
+	"username": "Example",
 	"password": "helloworld"
 }
 
@@ -15,8 +15,8 @@ POST http://127.0.0.1:3200/auth/login HTTP/1.1
 Content-Type: application/json
 
 {
-	"email": "admin@example.com",
-	"password": "password"
+	"email": "example@example.com",
+	"password": "helloworld"
 }
 
 ###

tools/react/README.md

@@ -0,0 +1,53 @@
+# TokenProvider
+
+The MERN-template utilizes React's `useContext()` hook to share the auth-server's access token, effectively globally. Here is a quick rundown of how it works.
+
+# Enabling TokenProvider
+
+To enable the TokenProvider component, wrap your App component with it, like so:
+
+```jsx
+import React from 'react';
+import ReactDOM from 'react-dom';
+
+import App from './pages/app';
+import TokenProvider from './pages/utilities/token-provider';
+
+ReactDOM.render(
+	<TokenProvider>
+		<App />
+	</TokenProvider>,
+	document.querySelector('#root')
+);
+```
+
+# Accessing The Access Token
+
+To access the access token from your app, you simply use the `useContext` hook, like so:
+
+```jsx
+import React, { useContext } from 'react';
+import { TokenContext } from '../utilities/token-provider';
+
+const Component = props => {
+	//context
+	const authTokens = useContext(TokenContext);
+
+	//use the access token
+	console.log(authTokens.accessToken);
+
+	return <div />;
+};
+
+export default Component;
+```
+
+# Most Useful Features Provided
+
+The most useful features provided by TokenProvider are:
+
+* `tokenFetch()`, which wraps the `fetch()` API to ensure that your access token is valid
+* `tokenCallback()`, which passes the accessToken as a parameter to any function passed into it
+* `getPayload()`, which returns the payload of the accessToken (including as "email", "username", "admin", and "mod")
+* `accessToken`, this will be falsy if the user is not logged in
+

tools/react/token-provider.jsx

@@ -0,0 +1,119 @@
+import React, { useState, useEffect, createContext } from 'react';
+import decode from 'jwt-decode';
+
+export const TokenContext = createContext();
+
+//DOCS: tokenFetch() and tokenCallback() are actually closures here
+
+const TokenProvider = props => {
+	//state to be used
+	const [accessToken, setAccessToken] = useState('');
+
+	//force a logout under certain conditions
+	const forceLogout = () => {
+		localStorage.removeItem("accessToken");
+		setAccessToken("");
+	};
+
+	//make the access token persist between reloads
+	useEffect(() => {
+		setAccessToken(localStorage.getItem("accessToken") || '');
+	}, []);
+
+	//update the stored copies
+	useEffect(() => {
+		localStorage.setItem("accessToken", accessToken);
+	}, [accessToken]);
+
+	//wrap the default fetch function
+	const tokenFetch = async (url, options) => {
+		//use this?
+		let bearer = accessToken;
+
+		//if expired (10 minutes, normally)
+		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
+
+		if (expired) {
+			//BUGFIX: if logging out, just skip over the refresh token
+			if (url === `${process.env.AUTH_URI}/auth/logout`) {
+				return fetch(url, {
+					method: 'DELETE',
+					headers: {
+						'Authorization': `Bearer ${bearer}`
+					},
+					credentials: 'include'
+				});
+			}
+
+			//ping the auth server for a new access token
+			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
+				method: 'POST',
+				credentials: 'include'
+			});
+
+			//any errors, throw them
+			if (!response.ok) {
+				if (response.status == 403) {
+					forceLogout();
+				}
+				throw `${response.status}: ${await response.text()}`;
+			}
+
+			//save the new auth stuff (setting bearer as well)
+			const newAuth = await response.json();
+
+			setAccessToken(newAuth.accessToken);
+			bearer = newAuth.accessToken;
+		}
+
+		//finally, delegate to fetch
+		return fetch(url, {
+			...(options || {}),
+			headers: {
+				...(options || { headers: {} }).headers,
+				'Authorization': `Bearer ${bearer}`
+			},
+			credentials: 'include'
+		});
+	};
+
+	//access the refreshed token via callback
+	const tokenCallback = async (cb) => {
+		//if expired (10 minutes, normally)
+		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
+
+		if (expired) {
+			//ping the auth server for a new token
+			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
+				method: 'POST',
+				credentials: 'include'
+			});
+
+			//any errors, throw them
+			if (!response.ok) {
+				if (response.status == 403) {
+					forceLogout();
+				}
+				throw `${response.status}: ${await response.text()}`;
+			}
+
+			//save the new auth stuff (setting bearer as well)
+			const newAuth = await response.json();
+
+			setAccessToken(newAuth.accessToken);
+
+			//finally
+			return cb(newAuth.accessToken);
+		} else {
+			return cb(accessToken);
+		}
+	};
+
+	return (
+		<TokenContext.Provider value={{ accessToken, setAccessToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
+			{props.children}
+		</TokenContext.Provider>
+	)
+};
+
+export default TokenProvider;