Updated libraries

.github/workflows/test.yml

@@ -1,23 +0,0 @@
-name: Node.js CI
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-jobs:
-  build:
-    name: Run test suites
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [16.x]
-    steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-    - run: npm ci
-    - run: npm run build --if-present
-    - run: npm test

Dockerfile

@@ -1,5 +1,4 @@
-
-FROM node:16
+FROM node:18
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

configure-script.js

@@ -30,8 +30,8 @@ const question = (prompt, def = null) => {
 	//project configuration
 	const appName = await question('App Name', 'auth');
 	const appWebProtocol = await question('Web Protocol', 'https');
-	const appWebOrigin = await question('Web Origin', `${appWebProtocol}://example.com`); //TODO: clean these up properly
 	const appWebAddress = await question('Web Addr', `${appName}.example.com`);
+	const appWebOrigin = await question('Web Origin', `${appWebProtocol}://example.com`); //TODO: clean these up properly
 	const postValidationHookArray = await question('Post Validation Hook Array', '');
 	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
@@ -133,7 +133,7 @@ networks:
 `;
 
 	const dockerfile = `
-FROM node:16
+FROM node:18
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

package.json

@@ -1,13 +1,12 @@
 {
   "name": "auth-server",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
     "start": "node server/server.js",
     "dev": "npm run watch:server",
-    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'",
-    "test": "jest --coverage --collectCoverageFrom=server/**/*.{js,jsx}"
+    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'"
   },
   "repository": {
     "type": "git",
@@ -23,17 +22,16 @@
     "bcryptjs": "^2.4.3",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
-    "dotenv": "^8.6.0",
-    "express": "^4.17.1",
-    "jsonwebtoken": "^8.5.1",
-    "mariadb": "^2.5.4",
-    "node-cron": "^2.0.3",
-    "node-fetch": "^2.6.6",
-    "nodemailer": "^6.6.3",
-    "sequelize": "^6.6.5"
+    "dotenv": "^16.0.3",
+    "express": "^4.18.2",
+    "jsonwebtoken": "^9.0.0",
+    "mariadb": "^3.0.2",
+    "node-cron": "^3.0.2",
+    "node-fetch": "^2.6.7",
+    "nodemailer": "^6.8.0",
+    "sequelize": "^6.25.8"
   },
   "devDependencies": {
-    "jest": "^27.5.1",
-    "nodemon": "^2.0.12"
+    "nodemon": "^2.0.20"
   }
 }

server/server.js

@@ -36,6 +36,17 @@ app.get('*', (req, res) => {
 
 //startup
 server.listen(process.env.WEB_PORT || 3200, async (err) => {
+	//BUGFIX: clear out old refresh tokens
+	const { Op } = require('sequelize');
+	const { tokens } = require('./database/models');
+	tokens.destroy({
+		where: {
+			createdAt: {
+				[Op.lt]: new Date(new Date().setDate(new Date().getDate() - 30))
+			}
+		}
+	});
+
 	await database.sync();
 	console.log(`listening to localhost:${process.env.WEB_PORT || 3200}`);
 });

test/auth/login.test.js

@@ -1,117 +0,0 @@
-describe('POST /auth/login', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//fix util with jest (used by bcrypt's compare)
-		jest.doMock('util', () => ({
-			promisify: f => async () => f()
-		}));
-
-		//mock out bcrypt
-		jest.doMock('bcryptjs', () => ({
-			genSalt: async amount => {
-				expect(amount).toBe(11);
-				return 'salt';
-			},
-			hash: async (password, salt) => {
-				expect(password).toBe('password');
-				return 'hashed-password';
-			},
-			compare: (lhs, rhs) => {
-				return lhs === rhs;
-			}
-		}));
-
-		//mock out jsonwebtoken
-		jest.doMock('jsonwebtoken', () => ({
-			sign: (content, secretAccess, opts) => {
-				return JSON.stringify(content);
-			},
-
-			verify: (token, secretAccess, callback) => {
-				return callback(null, JSON.parse(token));
-			},
-		}));
-
-		//mock out the sequelize library
-		jest.doMock('sequelize', () => {
-			return {
-				Op: {
-					//
-				}
-			}
-		});
-
-		//mock out the database object
-		jest.doMock('../../server/database', () => {
-			const mSequelize = {
-				authenticate: jest.fn(),
-				define: jest.fn(),
-			};
-
-			const actualSequelize = jest.requireActual('sequelize');
-			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
-		});
-
-		//mock out the database models
-		jest.doMock('../../server/database/models', () => ({
-			accounts: {
-				findOne: async (config) => { //can't find any (signup state)
-					expect(config?.where?.email).toBe('email@example.com');
-					return {
-						index: 0,
-						email: config?.where?.email,
-						username: 'username',
-						type: 'alpha',
-						admin: false,
-						mod: false,
-					};
-				},
-
-				update: async (values, config) => {
-					//Do nothing
-				}
-			},
-
-			tokens: {
-				create: async (record) => {
-					//Do nothing
-				}
-			}
-		}));
-	});
-
-	test('Basic valid login attempt', async () => {
-		//arguments
-		const req = {
-			body: {
-				email: 'email@example.com',
-				password: 'password',
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(200);
-				return {
-					json: tokens => {
-						//decode and analyze the JWT payload
-						const accessToken = JSON.parse(tokens.accessToken);
-
-						expect(accessToken.email).toBe('email@example.com');
-						expect(accessToken.username).toBe('username');
-					},
-					send: msg => { throw msg; },
-					end: () => null
-				}
-			}
-		}
-
-		//test
-		const route = require('../../server/auth/login');
-
-		const result = await route(req, res);
-
-		expect(result).toBe(null);
-	});
-});

test/auth/signup.test.js

@@ -1,98 +0,0 @@
-describe('POST /auth/signup', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//mock out bcrypt
-		jest.doMock('bcryptjs', () => ({
-			genSalt: async amount => {
-				expect(amount).toBe(11);
-				return 'salt';
-			},
-			hash: async (password, salt) => {
-				expect(password).toBe('password');
-				return 'hashed-password';
-			}
-		}));
-
-		//mock out nodemailer
-		jest.doMock('nodemailer', () => ({
-			createTransport: jest.fn(config => {
-				//TODO: test config?
-				return { //return a fake transport object
-					sendMail: async email => {
-						expect(email.to).toBe('email@example.com');
-						return { //return a fake info object
-							accepted: [ email.to ]
-						}
-					}
-				};
-			}),
-		}));
-
-		//mock out the sequelize library
-		jest.doMock('sequelize', () => {
-			return {
-				Op: {
-					//
-				}
-			}
-		});
-
-		//mock out the database object
-		jest.doMock('../../server/database', () => {
-			const mSequelize = {
-				authenticate: jest.fn(),
-				define: jest.fn(),
-			};
-
-			const actualSequelize = jest.requireActual('sequelize');
-			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
-		});
-
-		//mock out the database models
-		jest.doMock('../../server/database/models', () => ({
-			accounts: {
-				findOne: () => null //can't find any (signup state)
-			},
-
-			pendingSignups: {
-				upsert: jest.fn(async record => {
-					expect(record.email).toBe('email@example.com');
-					expect(record.username).toBe('username');
-					expect(record.hash).toBe('hashed-password');
-					expect(record.contact).toBe(true);
-					//token is a random UUID
-				})
-			}
-		}));
-	});
-
-	test('Basic valid signup attempt', async () => {
-		//arguments
-		const req = {
-			body: {
-				email: 'email@example.com',
-				username: 'username',
-				password: 'password',
-				contact: true
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(200);
-				return {
-					send: msg => expect(msg).toBe('Validation email sent!'),
-					end: () => null
-				}
-			}
-		}
-
-		//test
-		const route = require('../../server/auth/signup');
-
-		const result = await route(req, res);
-
-		expect(result).toBe(null);
-	});
-});

test/server.test.js

@@ -1,65 +0,0 @@
-describe('Integration Test Suite', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//mock dotenv
-		jest.doMock('dotenv', () => ({
-			config: () => null
-		}));
-
-		//mock express
-		jest.doMock('express', () => {
-			const express = () => ({
-				identity: 'app',
-				use: () => null,
-				get: () => null,
-			});
-
-			express.Router = () => ({
-				identity: 'Router',
-				use: () => null,
-				get: () => null,
-				post: () => null,
-				patch: () => null,
-				delete: () => null,
-			});
-
-			express.json = () => 'json';
-
-			return express;
-		});
-
-		//mock http
-		jest.doMock('http', () => ({
-			Server: app => {
-				expect(app.identity).toBe('app');
-
-				return {
-					listen: (port, cb) => cb()
-				}
-			}
-		}));
-
-		//mock sequelize
-		class Seq {
-			sync() {}
-			define() {}
-			static INTEGER() {}
-		};
-	
-		jest.doMock('sequelize', () => {
-			return Seq;
-		});
-
-		//mock node-cron
-		jest.doMock('node-cron', () => {
-			return {
-				schedule: () => null
-			}
-		});
-	});
-
-	test('Start The Server', () => {
-		const serv = require('../server/server');
-	});
-});

test/utilities/token-auth.test.js

@@ -1,87 +0,0 @@
-describe('token-auth', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//mock out jsonwebtoken
-		jest.doMock('jsonwebtoken', () => ({
-			verify: (token, secretAccess, callback) => {
-				if (token != 'invalid') {
-					expect(token).toBe('testtoken');
-					return callback(null, { username: 'username' });
-				} else {
-					expect(token).toBe('invalid');
-					return callback('Misc. error');
-				}
-			},
-		}));
-	});
-
-	test('Required Functionality', () => {
-		const tokenAuth = require('../../server/utilities/token-auth');
-
-		const req = {
-			headers: {
-				authorization: 'Bearer testtoken'
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(null);
-				return msg => { throw msg; };
-			}
-		};
-
-		tokenAuth(req, res, () => null);
-
-		expect(req.user.username).toBe('username');
-	});
-
-	test('Missing Token', () => {
-		const tokenAuth = require('../../server/utilities/token-auth');
-
-		const req = {
-			headers: {
-				//
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(401);
-				return {
-					send: msg => {
-						expect(msg).toBe('No token found');
-						return null;
-					}
-				};
-			}
-		};
-
-		tokenAuth(req, res, () => null);
-	});
-
-	test('Invalid Token', () => {
-		const tokenAuth = require('../../server/utilities/token-auth');
-
-		const req = {
-			headers: {
-				authorization: 'Bearer invalid'
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(403);
-				return {
-					send: msg => {
-						expect(msg).toBe('Misc. error');
-						return null;
-					}
-				};
-			}
-		};
-
-		tokenAuth(req, res, () => null);
-	});
-});

tools/react/token-provider.jsx

@@ -9,6 +9,12 @@ const TokenProvider = props => {
 	//state to be used
 	const [accessToken, setAccessToken] = useState('');
 
+	//force a logout under certain conditions
+	const forceLogout = () => {
+		localStorage.removeItem("accessToken");
+		setAccessToken("");
+	};
+
 	//make the access token persist between reloads
 	useEffect(() => {
 		setAccessToken(localStorage.getItem("accessToken") || '');
@@ -47,6 +53,9 @@ const TokenProvider = props => {
 
 			//any errors, throw them
 			if (!response.ok) {
+				if (response.status == 403) {
+					forceLogout();
+				}
 				throw `${response.status}: ${await response.text()}`;
 			}
 
@@ -82,6 +91,9 @@ const TokenProvider = props => {
 
 			//any errors, throw them
 			if (!response.ok) {
+				if (response.status == 403) {
+					forceLogout();
+				}
 				throw `${response.status}: ${await response.text()}`;
 			}