Fully tested the remote database

Added configurable hostname for default account email

.envdev

@@ -4,7 +4,9 @@ WEB_RESET_ADDRESS=localhost/reset
 WEB_PORT=3200
 WEB_ORIGIN=http://localhost:3001
 
-DB_HOSTNAME=database
+DB_HOSTNAME=localhost
+DB_PORTNAME=3306
+
 DB_DATABASE=auth
 DB_USERNAME=auth
 DB_PASSWORD=charizard
@@ -20,6 +22,9 @@ ADMIN_DEFAULT_USERNAME=admin
 # Give this a value to generate the default admin account (must be at least 8 characters)
 ADMIN_DEFAULT_PASSWORD=password
 
+# Give this a value to generate teh default admin account (must be a valid domain name, to pass the initial email check)
+ADMIN_DEFAULT_HOSTNAME=example.com
+
 # Select a "TZ database name" that suits your needs: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 DB_TIMEZONE=Australia/Sydney
 

.github/workflows/test.yml

@@ -1,23 +0,0 @@
-name: Node.js CI
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-jobs:
-  build:
-    name: Run test suites
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [16.x]
-    steps:
-    - uses: actions/checkout@v2
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v2
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-    - run: npm ci
-    - run: npm run build --if-present
-    - run: npm test

Dockerfile

@@ -1,7 +1,7 @@
 
-FROM node:16
+FROM node:22-bookworm-slim
 WORKDIR "/app"
-COPY package*.json ./
+COPY package*.json /app
 RUN npm install --production
 COPY . /app
 EXPOSE 3200

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2021 Kayne Ruse, KR Game Studios
+Copyright (c) 2021-2023 Kayne Ruse, KR Game Studios
 
 This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.
 

README.md

@@ -6,7 +6,7 @@ This server is available via docker hub at krgamestudios/auth-server.
 
 # Setup
 
-There are multiple ways to run this app - it can run on it's own via `npm start` (for production) or `npm run dev` (for development). it can also run inside docker using `docker-compose up --build` - run `node configure-script.js` to generate docker-compose.yml and startup.sql.
+There are multiple ways to run this app - it can run on it's own via `npm start` (for production) or `npm run dev` (for development). it can also run inside docker using `docker compose up --build` - run `node configure-script.js` to generate docker-compose.yml and startup.sql.
 
 # API
 
@@ -79,7 +79,7 @@ Cookie: refreshToken
 ###
 
 
-//DOCS: Retreives the private account data, results vary
+//DOCS: Retrieves the private account data, results vary
 GET /auth/account
 Authorization: Bearer accessToken
 

configure-script.js

@@ -30,12 +30,31 @@ const question = (prompt, def = null) => {
 	//project configuration
 	const appName = await question('App Name', 'auth');
 	const appWebProtocol = await question('Web Protocol', 'https');
-	const appWebOrigin = await question('Web Origin', `${appWebProtocol}://example.com`); //TODO: clean these up properly
 	const appWebAddress = await question('Web Addr', `${appName}.example.com`);
+	const appWebOrigin = await question('Web Origin', `${appWebProtocol}://example.com`); //TODO: clean these up properly
 	const postValidationHookArray = await question('Post Validation Hook Array', '');
 	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
 
+  //configure the database address
+  let dbLocation = '';
+  while (typeof dbLocation != 'string' || /^[le]/i.test(dbLocation[0]) == false) {
+    dbLocation = await question('[l]ocal or [e]xternal database?');
+  }
+
+  let appDBHost = '';
+  let appDBPort = '';
+
+  if (/^[l]/i.test(dbLocation[0])) {
+    appDBHost = 'database';
+    appDBPort = '3306';
+  }
+  else {
+    appDBHost = await question('DB Host');
+    appDBPort = await question('DB Port', '3306');
+  }
+
+  //configure the database account
 	const appDBUser = await question('DB User', appName);
 	const appDBPass = await question('DB Pass', 'charizard');
 	const dbRootPass = await question('DB Root Pass');
@@ -46,6 +65,7 @@ const question = (prompt, def = null) => {
 	const appMailPhysical = await question('Mail Physical');
 
 	const appDefaultUser = await question('App Default User', '');
+	const appDefaultHost = await question('App Default Host', '');
 	const appDefaultPass = await question('App Default Pass', '');
 
 	const appSecretAccess = await question('Access Token Secret', uuid(32));
@@ -55,21 +75,19 @@ const question = (prompt, def = null) => {
 
 	//generate the files
 	const ymlfile = `
-version: '3'
-
 services:
   ${appName}:
     build:
       context: .
     ports:
-      - "${appPort}"
+      - ${appPort}
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.routers.${appName}router.rule=Host(\`${appWebAddress}\`)"
+      - traefik.http.routers.${appName}router.rule=Host(\`${appWebAddress}\`)
-      - "traefik.http.routers.${appName}router.entrypoints=websecure"
+      - traefik.http.routers.${appName}router.entrypoints=websecure
-      - "traefik.http.routers.${appName}router.tls.certresolver=myresolver"
+      - traefik.http.routers.${appName}router.tls.certresolver=myresolver
-      - "traefik.http.routers.${appName}router.service=${appName}service@docker"
+      - traefik.http.routers.${appName}router.service=${appName}service@docker
-      - "traefik.http.services.${appName}service.loadbalancer.server.port=${appPort}"
+      - traefik.http.services.${appName}service.loadbalancer.server.port=${appPort}
     environment:
       - WEB_PROTOCOL=${appWebProtocol}
       - WEB_ORIGIN=${appWebOrigin}
@@ -77,7 +95,8 @@ services:
       - HOOK_POST_VALIDATION_ARRAY=${postValidationHookArray}
       - WEB_RESET_ADDRESS=${resetAddress}
       - WEB_PORT=${appPort}
-      - DB_HOSTNAME=database
+      - DB_HOSTNAME=${appDBHost}
+      - DB_PORTNAME=${appDBPort}
       - DB_DATABASE=${appName}
       - DB_USERNAME=${appDBUser}
       - DB_PASSWORD=${appDBPass}
@@ -87,17 +106,23 @@ services:
       - MAIL_PASSWORD=${appMailPass}
       - MAIL_PHYSICAL=${appMailPhysical}
       - ADMIN_DEFAULT_USERNAME=${appDefaultUser}
+      - ADMIN_DEFAULT_HOSTNAME=${appDefaultHost}
       - ADMIN_DEFAULT_PASSWORD=${appDefaultPass}
       - SECRET_ACCESS=${appSecretAccess}
       - SECRET_REFRESH=${appSecretRefresh}
+    volumes:
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
     networks:
-      - app-network
+      - app-network${ appDBHost != 'database' ? '' : `
     depends_on:
       - database
+
   database:
     image: mariadb:latest
     environment:
       MYSQL_DATABASE: ${appName}
+      MYSQL_TCP_PORT: ${appDBPort}
       MYSQL_USER: ${appDBUser}
       MYSQL_PASSWORD: ${appDBPass}
       MYSQL_ROOT_PASSWORD: ${dbRootPass}
@@ -106,34 +131,40 @@ services:
     volumes:
       - ./mysql:/var/lib/mysql
       - ./startup.sql:/docker-entrypoint-initdb.d/startup.sql:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro`}
+
   traefik_${appName}:
     container_name: ${appName}_traefik
-    image: "traefik:v2.4"
+    image: traefik:latest
-    container_name: "traefik"
+    container_name: traefik
     command:
-      - "--log.level=ERROR"
+      - --log.level=ERROR
-      - "--api.insecure=false"
+      - --api.insecure=false
-      - "--providers.docker=true"
+      - --providers.docker=true
-      - "--providers.docker.exposedbydefault=false"
+      - --providers.docker.exposedbydefault=false
-      - "--entrypoints.websecure.address=:443"
+      - --entrypoints.websecure.address=:443
-      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
+      - --certificatesresolvers.myresolver.acme.tlschallenge=true
-      - "--certificatesresolvers.myresolver.acme.email=${supportEmail}"
+      - --certificatesresolvers.myresolver.acme.email=${supportEmail}
-      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
+      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
     ports:
-      - "80:80"
+      - 80:80
-      - "443:443"
+      - 443:443
     volumes:
-      - "./letsencrypt:/letsencrypt"
+      - ./letsencrypt:/letsencrypt
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
     networks:
       - app-network
+
 networks:
   app-network:
     driver: bridge
 `;
 
 	const dockerfile = `
-FROM node:16
+FROM node:22-bookworm-slim
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

package.json

@@ -1,20 +1,19 @@
 {
   "name": "auth-server",
-  "version": "1.6.2",
+  "version": "1.8.7",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
     "start": "node server/server.js",
     "dev": "npm run watch:server",
-    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'",
+    "watch:server": "nodemon . --ext js,jsx,json --ignore 'node_modules/*'"
-    "test": "jest --coverage --collectCoverageFrom=server/**/*.{js,jsx}"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/krgamestudios/auth-server.git"
   },
   "author": "Kayne Ruse",
-  "license": "ISC",
+  "license": "Zlib",
   "bugs": {
     "url": "https://github.com/krgamestudios/auth-server/issues"
   },
@@ -23,17 +22,16 @@
     "bcryptjs": "^2.4.3",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
-    "dotenv": "^8.6.0",
+    "dotenv": "^16.4.5",
-    "express": "^4.17.1",
+    "express": "^4.19.2",
-    "jsonwebtoken": "^8.5.1",
+    "jsonwebtoken": "^9.0.2",
-    "mariadb": "^2.5.4",
+    "mariadb": "^3.3.0",
-    "node-cron": "^2.0.3",
+    "node-cron": "^3.0.3",
-    "node-fetch": "^2.6.6",
+    "node-fetch": "^3.3.2",
-    "nodemailer": "^6.6.3",
+    "nodemailer": "^6.9.13",
-    "sequelize": "^6.6.5"
+    "sequelize": "^6.37.3"
   },
   "devDependencies": {
-    "jest": "^27.5.1",
+    "nodemon": "^3.1.0"
-    "nodemon": "^2.0.12"
   }
 }

server/admin/default-account.js

@@ -7,7 +7,7 @@ module.exports = async () => {
 	await sequelize.sync(); //this whole file is just one big BUGFIX
 
 	//validate env variables
-	if (!process.env.ADMIN_DEFAULT_USERNAME || !process.env.ADMIN_DEFAULT_PASSWORD) {
+	if (!process.env.ADMIN_DEFAULT_USERNAME || !process.env.ADMIN_DEFAULT_HOSTNAME || !process.env.ADMIN_DEFAULT_PASSWORD) {
 		//skip this if arguments are missing
 		return;
 	}
@@ -25,9 +25,8 @@ module.exports = async () => {
 	});
 
 	if (adminRecord == null) {
-		const webAddress = process.env.WEB_ADDRESS == 'localhost:3000' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
 		await accounts.create({
-			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
+			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.ADMIN_DEFAULT_HOSTNAME}`,
 			username: `${process.env.ADMIN_DEFAULT_USERNAME}`,
 			hash: await bcrypt.hash(`${process.env.ADMIN_DEFAULT_PASSWORD}`, await bcrypt.genSalt(11)),
 			type: 'normal',
@@ -35,6 +34,6 @@ module.exports = async () => {
 			mod: true
 		});
 
-		console.warn(`Created default admin account (email: ${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}; password: ${process.env.ADMIN_DEFAULT_PASSWORD})`);
+		console.warn(`Created default admin account (email: ${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.ADMIN_DEFAULT_HOSTNAME}; password: ${process.env.ADMIN_DEFAULT_PASSWORD})`);
 	}
 };

server/auth/index.js

@@ -5,15 +5,13 @@ const { accounts } = require('../database/models');
 
 //middleware
 const tokenAuth = require('../utilities/token-auth');
+const tokenDecode = require('../utilities/token-decode');
 
 //signup -> validate -> login all without a token
 router.post('/signup', require('./signup'));
 router.get('/validation', require('./validation'));
 router.post('/login', require('./login'));
 
-//refresh token
-router.post('/token', require('./token'));
-
 //password recover and reset
 router.post('/recover', require('./password-recover'));
 router.get('/reset', require('./password-redirect'));
@@ -22,13 +20,14 @@ router.patch('/reset', require('./password-reset'));
 //logouts allowed when banned, and when the token itself is invalid
 router.delete('/logout', require('./logout'));
 
-//middleware
+//authenticate token
-router.use(tokenAuth);
+router.use(tokenDecode);
 
+//middleware
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
-			email: req.user.email || ''
+			email: req.user?.email || ''
 		}
 	});
 
@@ -43,6 +42,12 @@ router.use(async (req, res, next) => {
 	next();
 });
 
+//refresh token
+router.post('/token', require('./token'));
+
+//authenticate token
+router.use(tokenAuth);
+
 //basic account management (needs a token)
 router.get('/account', require('./account-query'));
 router.patch('/account', require('./account-update'));

server/auth/login.js

@@ -49,7 +49,7 @@ const route = async (req, res) => {
 	}
 
 	//generate the JWTs
-	const { accessToken, refreshToken } = tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
+	const { accessToken, refreshToken } = await tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
 
 	//set the cookie
 	res.cookie('refreshToken', refreshToken, { path: '/', httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 * 1000 }); //30 days

server/auth/signup.js

@@ -19,6 +19,13 @@ const route = async (req, res) => {
 		return res.status(401).send(validateErr);
 	}
 
+	//script throttle
+	const throttle = await checkThrottle(req.body.email);
+	if (throttle) {
+		console.warn(`Spam Throttled\t${req.body.email} (${req.body.username})`);
+		return res.status(401).send(throttle);
+	}
+
 	//generate the password hash
 	const hash = await bcrypt.hash(req.body.password, await bcrypt.genSalt(11));
 
@@ -83,6 +90,10 @@ const validateDetails = async (body) => {
 		return 'Missing password';
 	}
 
+	if (typeof body.password != "string") {
+		return 'Invalid password';
+	}
+
 	if (body.password.length < 8) {
 		return 'Password too short';
 	}
@@ -90,8 +101,41 @@ const validateDetails = async (body) => {
 	return null;
 };
 
+const checkThrottle = async (email) => {
+	//check email delay
+	const prev = await pendingSignups.findOne({
+		where: {
+			email: email,
+		}
+	});
+
+	const DateOffset = ( offset ) => { //Thanks, SO!
+		return new Date( +new Date + offset );
+	}
+
+	if (!!prev && prev.updatedAt > DateOffset( -5000 )) {
+		return "An unknown error occurred";
+	}
+
+	return null;
+}
+
 const registerPendingSignup = async (body, hash, token) => {
-	const record = await pendingSignups.upsert({
+	//BUGFIX: delete existing pending signups that clash
+	await pendingSignups.destroy({
+		where: {
+			email: body.email
+		}
+	});
+
+	await pendingSignups.destroy({
+		where: {
+			username: body.username
+		}
+	});
+
+	//record it
+	const record = await pendingSignups.create({
 		email: body.email,
 		username: body.username,
 		hash: hash,

server/auth/token.js

@@ -1,10 +1,8 @@
-const jwt = require('jsonwebtoken');
-
 const tokenRefresh = require('../utilities/token-refresh');
 
 //auth/token
 module.exports = async (req, res) => {
-	return tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
+	return await tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
 		if (err) {
 			return res.status(err).end();
 		}

server/auth/validation.js

@@ -1,5 +1,5 @@
 const { pendingSignups, accounts } = require('../database/models');
-const fetch = require('node-fetch');
+const fetch = (...args) => import('node-fetch').then(({default: fetch}) => fetch(...args));
 const jwt = require('jsonwebtoken');
 
 //auth/validation
@@ -44,7 +44,7 @@ const route = async (req, res) => {
 			hooks = JSON.parse(process.env.HOOK_POST_VALIDATION_ARRAY);
 
 			if (!Array.isArray(hooks)) {
-				throw 'isArray() check failed';
+				throw 'post validation hook isArray() check failed';
 			}
 
 			//authenticate the hooks

server/database/index.js

@@ -2,11 +2,10 @@ const Sequelize = require('sequelize');
 
 const sequelize = new Sequelize(process.env.DB_DATABASE, process.env.DB_USERNAME, process.env.DB_PASSWORD, {
 	host: process.env.DB_HOSTNAME,
+	port: process.env.DB_PORTNAME,
 	dialect: 'mariadb',
 	timezone: process.env.DB_TIMEZONE,
 	logging: process.env.DB_LOGGING ? console.log : false
 });
 
-sequelize.sync();
-
 module.exports = sequelize;

server/database/models/banned-ip-addresses.js

@@ -0,0 +1,17 @@
+const Sequelize = require('sequelize');
+const sequelize = require('..');
+
+//DOCS: this isn't set by anything - it's a stub for now
+
+module.exports = sequelize.define('bannedIPAddresses', {
+	content: {
+		type: 'varchar(320)',
+		unique: true
+	},
+
+	expiry: {
+		type: 'DATETIME',
+		allowNull: true,
+		defaultValue: null
+	},
+});

server/database/models/index.js

@@ -2,5 +2,6 @@ module.exports = {
 	tokens: require('./tokens'),
 	accounts: require('./accounts'),
 	pendingSignups: require('./pending-signups'),
-	recovery: require('./recovery')
+	recovery: require('./recovery'),
+	bannedIPAddresses: require("./banned-ip-addresses"),
 };

server/server.js

@@ -23,6 +23,9 @@ app.use(cookieParser());
 //database connection
 const database = require('./database');
 
+//ip-based management
+app.use(require('./utilities/banned-ip-addresses-middleware'));
+
 //access the admin
 app.use('/admin', require('./admin'));
 
@@ -38,4 +41,5 @@ app.get('*', (req, res) => {
 server.listen(process.env.WEB_PORT || 3200, async (err) => {
 	await database.sync();
 	console.log(`listening to localhost:${process.env.WEB_PORT || 3200}`);
+	console.log(`database located at ${process.env.DB_HOSTNAME || '<default>'}:${process.env.DB_PORTNAME || '<default>'}`);
 });

server/utilities/banned-ip-addresses-middleware.js

@@ -0,0 +1,33 @@
+const { Op } = require("sequelize");
+const { bannedIPAddresses } = require('../database/models');
+
+//middleware to manage banned IP addresses
+module.exports = async (req, res, next) => {
+	const address = req.header('x-forwarded-for') || req.socket.remoteAddress;
+
+	const record = await bannedIPAddresses.findOne({
+		where: {
+			content: address,
+
+			expiry: {
+				[Op.or]: {
+					//future or forever
+					[Op.gt]: Date.now(),
+					[Op.eq]: null,
+				}
+			}
+		}
+	});
+
+	//log the access timestamp
+	const date = new Date();
+
+	if (!!record) {
+		console.log(`IP blocked\t${address}\t\t\t${date.toTimeString()}`);
+		return res.status(403).send("IP address banned");
+	}
+
+	// console.log(`IP allowed\t${address}\t\t\t${date.toTimeString()}`);
+
+	return next();
+};

server/utilities/token-auth.js

@@ -6,7 +6,7 @@ module.exports = (req, res, next) => {
 	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
 
 	if (!accessToken) {
-		return res.status(401).send('No access token found');
+		return res.status(401).send('No access token provided');
 	}
 
 	return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {

server/utilities/token-decode.js

@@ -0,0 +1,17 @@
+const jwt = require('jsonwebtoken');
+
+//middleware to decode the JWT token
+module.exports = (req, res, next) => {
+	const authHeader = req.headers['authorization'];
+	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
+
+	if (!accessToken) {
+		return res.status(401).send('No access token provided');
+	}
+
+	const decoded = jwt.decode(accessToken);
+
+	req.user = decoded;
+
+	return next();
+};

server/utilities/token-destroy.js

@@ -1,7 +1,7 @@
 const { tokens } = require('../database/models');
 
-module.exports = (refreshToken) => {
+module.exports = async (refreshToken) => {
-	tokens.destroy({
+	await tokens.destroy({
 		where: {
 			token: refreshToken || ''
 		}

server/utilities/token-generate-refresh.js

@@ -2,7 +2,7 @@ const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
 //generates a JWT token based on the given arguments
-module.exports = (index, email, username, type, admin, mod) => {
+module.exports = async (index, email, username, type, admin, mod) => {
 	const content = {
 		index,
 		email,
@@ -16,7 +16,7 @@ module.exports = (index, email, username, type, admin, mod) => {
 	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
 	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 
-	tokens.create({ token: refreshToken, email: email });
+	await tokens.create({ token: refreshToken, email: email });
 
 	return { accessToken, refreshToken };
 };

server/utilities/token-refresh.js

@@ -19,15 +19,15 @@ module.exports = async (oldRefreshToken, callback) => {
 		return callback(403);
 	}
 
-	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, (err, user) => {
+	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, async (err, user) => {
 		if (err) {
 			return callback(403);
 		}
 
-		const { accessToken, refreshToken } = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
+		await destroy(oldRefreshToken);
 
-		destroy(oldRefreshToken);
+		const { accessToken, refreshToken } = await generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
-		return callback(null, accessToken, refreshToken);
+		return await callback(null, accessToken, refreshToken);
 	});
 };

test/auth/login.test.js

@@ -1,117 +0,0 @@
-describe('POST /auth/login', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//fix util with jest (used by bcrypt's compare)
-		jest.doMock('util', () => ({
-			promisify: f => async () => f()
-		}));
-
-		//mock out bcrypt
-		jest.doMock('bcryptjs', () => ({
-			genSalt: async amount => {
-				expect(amount).toBe(11);
-				return 'salt';
-			},
-			hash: async (password, salt) => {
-				expect(password).toBe('password');
-				return 'hashed-password';
-			},
-			compare: (lhs, rhs) => {
-				return lhs === rhs;
-			}
-		}));
-
-		//mock out jsonwebtoken
-		jest.doMock('jsonwebtoken', () => ({
-			sign: (content, secretAccess, opts) => {
-				return JSON.stringify(content);
-			},
-
-			verify: (token, secretAccess, callback) => {
-				return callback(null, JSON.parse(token));
-			},
-		}));
-
-		//mock out the sequelize library
-		jest.doMock('sequelize', () => {
-			return {
-				Op: {
-					//
-				}
-			}
-		});
-
-		//mock out the database object
-		jest.doMock('../../server/database', () => {
-			const mSequelize = {
-				authenticate: jest.fn(),
-				define: jest.fn(),
-			};
-
-			const actualSequelize = jest.requireActual('sequelize');
-			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
-		});
-
-		//mock out the database models
-		jest.doMock('../../server/database/models', () => ({
-			accounts: {
-				findOne: async (config) => { //can't find any (signup state)
-					expect(config?.where?.email).toBe('email@example.com');
-					return {
-						index: 0,
-						email: config?.where?.email,
-						username: 'username',
-						type: 'alpha',
-						admin: false,
-						mod: false,
-					};
-				},
-
-				update: async (values, config) => {
-					//Do nothing
-				}
-			},
-
-			tokens: {
-				create: async (record) => {
-					//Do nothing
-				}
-			}
-		}));
-	});
-
-	test('Basic valid login attempt', async () => {
-		//arguments
-		const req = {
-			body: {
-				email: 'email@example.com',
-				password: 'password',
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(200);
-				return {
-					json: tokens => {
-						//decode and analyze the JWT payload
-						const accessToken = JSON.parse(tokens.accessToken);
-
-						expect(accessToken.email).toBe('email@example.com');
-						expect(accessToken.username).toBe('username');
-					},
-					send: msg => { throw msg; },
-					end: () => null
-				}
-			}
-		}
-
-		//test
-		const route = require('../../server/auth/login');
-
-		const result = await route(req, res);
-
-		expect(result).toBe(null);
-	});
-});

test/auth/signup.test.js

@@ -1,98 +0,0 @@
-describe('POST /auth/signup', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//mock out bcrypt
-		jest.doMock('bcryptjs', () => ({
-			genSalt: async amount => {
-				expect(amount).toBe(11);
-				return 'salt';
-			},
-			hash: async (password, salt) => {
-				expect(password).toBe('password');
-				return 'hashed-password';
-			}
-		}));
-
-		//mock out nodemailer
-		jest.doMock('nodemailer', () => ({
-			createTransport: jest.fn(config => {
-				//TODO: test config?
-				return { //return a fake transport object
-					sendMail: async email => {
-						expect(email.to).toBe('email@example.com');
-						return { //return a fake info object
-							accepted: [ email.to ]
-						}
-					}
-				};
-			}),
-		}));
-
-		//mock out the sequelize library
-		jest.doMock('sequelize', () => {
-			return {
-				Op: {
-					//
-				}
-			}
-		});
-
-		//mock out the database object
-		jest.doMock('../../server/database', () => {
-			const mSequelize = {
-				authenticate: jest.fn(),
-				define: jest.fn(),
-			};
-
-			const actualSequelize = jest.requireActual('sequelize');
-			return { Sequelize: jest.fn(() => mSequelize), DataTypes: actualSequelize.DataTypes };			
-		});
-
-		//mock out the database models
-		jest.doMock('../../server/database/models', () => ({
-			accounts: {
-				findOne: () => null //can't find any (signup state)
-			},
-
-			pendingSignups: {
-				upsert: jest.fn(async record => {
-					expect(record.email).toBe('email@example.com');
-					expect(record.username).toBe('username');
-					expect(record.hash).toBe('hashed-password');
-					expect(record.contact).toBe(true);
-					//token is a random UUID
-				})
-			}
-		}));
-	});
-
-	test('Basic valid signup attempt', async () => {
-		//arguments
-		const req = {
-			body: {
-				email: 'email@example.com',
-				username: 'username',
-				password: 'password',
-				contact: true
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(200);
-				return {
-					send: msg => expect(msg).toBe('Validation email sent!'),
-					end: () => null
-				}
-			}
-		}
-
-		//test
-		const route = require('../../server/auth/signup');
-
-		const result = await route(req, res);
-
-		expect(result).toBe(null);
-	});
-});

test/server.test.js

@@ -1,65 +0,0 @@
-describe('Integration Test Suite', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//mock dotenv
-		jest.doMock('dotenv', () => ({
-			config: () => null
-		}));
-
-		//mock express
-		jest.doMock('express', () => {
-			const express = () => ({
-				identity: 'app',
-				use: () => null,
-				get: () => null,
-			});
-
-			express.Router = () => ({
-				identity: 'Router',
-				use: () => null,
-				get: () => null,
-				post: () => null,
-				patch: () => null,
-				delete: () => null,
-			});
-
-			express.json = () => 'json';
-
-			return express;
-		});
-
-		//mock http
-		jest.doMock('http', () => ({
-			Server: app => {
-				expect(app.identity).toBe('app');
-
-				return {
-					listen: (port, cb) => cb()
-				}
-			}
-		}));
-
-		//mock sequelize
-		class Seq {
-			sync() {}
-			define() {}
-			static INTEGER() {}
-		};
-	
-		jest.doMock('sequelize', () => {
-			return Seq;
-		});
-
-		//mock node-cron
-		jest.doMock('node-cron', () => {
-			return {
-				schedule: () => null
-			}
-		});
-	});
-
-	test('Start The Server', () => {
-		const serv = require('../server/server');
-	});
-});

test/utilities/token-auth.test.js

@@ -1,87 +0,0 @@
-describe('token-auth', () => {
-	beforeEach(() => {
-		jest.resetModules();
-
-		//mock out jsonwebtoken
-		jest.doMock('jsonwebtoken', () => ({
-			verify: (token, secretAccess, callback) => {
-				if (token != 'invalid') {
-					expect(token).toBe('testtoken');
-					return callback(null, { username: 'username' });
-				} else {
-					expect(token).toBe('invalid');
-					return callback('Misc. error');
-				}
-			},
-		}));
-	});
-
-	test('Required Functionality', () => {
-		const tokenAuth = require('../../server/utilities/token-auth');
-
-		const req = {
-			headers: {
-				authorization: 'Bearer testtoken'
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(null);
-				return msg => { throw msg; };
-			}
-		};
-
-		tokenAuth(req, res, () => null);
-
-		expect(req.user.username).toBe('username');
-	});
-
-	test('Missing Token', () => {
-		const tokenAuth = require('../../server/utilities/token-auth');
-
-		const req = {
-			headers: {
-				//
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(401);
-				return {
-					send: msg => {
-						expect(msg).toBe('No token found');
-						return null;
-					}
-				};
-			}
-		};
-
-		tokenAuth(req, res, () => null);
-	});
-
-	test('Invalid Token', () => {
-		const tokenAuth = require('../../server/utilities/token-auth');
-
-		const req = {
-			headers: {
-				authorization: 'Bearer invalid'
-			}
-		};
-
-		const res = {
-			status: code => {
-				expect(code).toBe(403);
-				return {
-					send: msg => {
-						expect(msg).toBe('Misc. error');
-						return null;
-					}
-				};
-			}
-		};
-
-		tokenAuth(req, res, () => null);
-	});
-});

tools/debug-startup.sql

@@ -1,4 +1,4 @@
 #use this while debugging
-CREATE DATABASE IF NOT EXISTS auth;
+CREATE DATABASE auth;
-CREATE USER IF NOT EXISTS 'auth'@'%' IDENTIFIED BY 'charizard';
+CREATE USER 'auth'@'%' IDENTIFIED BY 'charizard';
 GRANT ALL PRIVILEGES ON auth.* TO 'auth'@'%';

tools/migrations/v1.3.1.sql

@@ -1 +0,0 @@
-ALTER TABLE `accounts` CHANGE `id` `index` INT( 11 ) NOT NULL AUTO_INCREMENT;

tools/migrations/v1.4.0.sql

@@ -1 +0,0 @@
-DROP TABLE tokens;

tools/react/token-provider.jsx

@@ -1,5 +1,5 @@
 import React, { useState, useEffect, createContext } from 'react';
-import decode from 'jwt-decode';
+import { jwtDecode } from 'jwt-decode';
 
 export const TokenContext = createContext();
 
@@ -9,6 +9,12 @@ const TokenProvider = props => {
 	//state to be used
 	const [accessToken, setAccessToken] = useState('');
 
+	//force a logout under certain conditions
+	const forceLogout = () => {
+		localStorage.removeItem("accessToken");
+		setAccessToken("");
+	};
+
 	//make the access token persist between reloads
 	useEffect(() => {
 		setAccessToken(localStorage.getItem("accessToken") || '');
@@ -25,7 +31,7 @@ const TokenProvider = props => {
 		let bearer = accessToken;
 
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+		const expired = new Date(jwtDecode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//BUGFIX: if logging out, just skip over the refresh token
@@ -42,11 +48,17 @@ const TokenProvider = props => {
 			//ping the auth server for a new access token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
+				headers: {
+					'Authorization': `Bearer ${bearer}`
+				},
 				credentials: 'include'
 			});
 
 			//any errors, throw them
 			if (!response.ok) {
+				if (response.status == 403) {
+					forceLogout();
+				}
 				throw `${response.status}: ${await response.text()}`;
 			}
 
@@ -70,18 +82,27 @@ const TokenProvider = props => {
 
 	//access the refreshed token via callback
 	const tokenCallback = async (cb) => {
+		//use this?
+		let bearer = accessToken;
+
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+		const expired = new Date(jwtDecode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//ping the auth server for a new token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
+				headers: {
+					'Authorization': `Bearer ${bearer}`
+				},
 				credentials: 'include'
 			});
 
 			//any errors, throw them
 			if (!response.ok) {
+				if (response.status == 403) {
+					forceLogout();
+				}
 				throw `${response.status}: ${await response.text()}`;
 			}
 
@@ -98,7 +119,7 @@ const TokenProvider = props => {
 	};
 
 	return (
-		<TokenContext.Provider value={{ accessToken, setAccessToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
+		<TokenContext.Provider value={{ accessToken, setAccessToken, tokenFetch, tokenCallback, getPayload: () => jwtDecode(accessToken) }}>
 			{props.children}
 		</TokenContext.Provider>
 	)