Hotfixes all the way down

.envdev

@@ -4,7 +4,7 @@ WEB_RESET_ADDRESS=localhost/reset
 WEB_PORT=3200
 WEB_ORIGIN=http://localhost:3001
 
-DB_HOSTNAME=database
+DB_HOSTNAME=localhost
 DB_DATABASE=auth
 DB_USERNAME=auth
 DB_PASSWORD=charizard

Dockerfile

@@ -1,5 +1,5 @@
 
-FROM node:18-bullseye-slim
+FROM node:21-bookworm-slim
 WORKDIR "/app"
 COPY package*.json /app
 RUN npm install --production

configure-script.js

@@ -55,8 +55,7 @@ const question = (prompt, def = null) => {
 
 	//generate the files
 	const ymlfile = `
-version: '3'
-
+version: '3.8'
 services:
   ${appName}:
     build:
@@ -108,7 +107,7 @@ services:
       - ./startup.sql:/docker-entrypoint-initdb.d/startup.sql:ro
   traefik_${appName}:
     container_name: ${appName}_traefik
-    image: "traefik:v2.4"
+    image: "traefik:v2.10"
     container_name: "traefik"
     command:
       - "--log.level=ERROR"
@@ -133,7 +132,7 @@ networks:
 `;
 
 	const dockerfile = `
-FROM node:18-bullseye-slim
+FROM node:21-bookworm-slim
 WORKDIR "/app"
 COPY package*.json ./
 RUN npm install --production

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.7.10",
+  "version": "1.8.3",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
@@ -24,18 +24,15 @@
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "express": "^4.18.2",
-    "jsonwebtoken": "^9.0.0",
-    "mariadb": "^3.2.0",
-    "node-cron": "^3.0.2",
-    "node-fetch": "^2.6.11",
-    "nodemailer": "^6.9.3",
-    "npm": "^9.7.2",
-    "sequelize": "^6.32.1"
+    "jsonwebtoken": "^9.0.2",
+    "mariadb": "^3.2.3",
+    "node-cron": "^3.0.3",
+    "node-fetch": "^2.7.0",
+    "nodemailer": "^6.9.7",
+    "npm": "^9.9.2",
+    "sequelize": "^6.35.2"
   },
   "devDependencies": {
-    "nodemon": "^2.0.22"
-  },
-  "overrides": {
-    "semver": "^7.5.2"
+    "nodemon": "^3.0.2"
   }
 }

server/auth/index.js

@@ -5,15 +5,13 @@ const { accounts } = require('../database/models');
 
 //middleware
 const tokenAuth = require('../utilities/token-auth');
+const tokenDecode = require('../utilities/token-decode');
 
 //signup -> validate -> login all without a token
 router.post('/signup', require('./signup'));
 router.get('/validation', require('./validation'));
 router.post('/login', require('./login'));
 
-//refresh token
-router.post('/token', require('./token'));
-
 //password recover and reset
 router.post('/recover', require('./password-recover'));
 router.get('/reset', require('./password-redirect'));
@@ -22,9 +20,10 @@ router.patch('/reset', require('./password-reset'));
 //logouts allowed when banned, and when the token itself is invalid
 router.delete('/logout', require('./logout'));
 
-//middleware
-router.use(tokenAuth);
+//authenticate token
+router.use(tokenDecode);
 
+//middleware
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
@@ -43,6 +42,12 @@ router.use(async (req, res, next) => {
 	next();
 });
 
+//refresh token
+router.post('/token', require('./token'));
+
+//authenticate token
+router.use(tokenAuth);
+
 //basic account management (needs a token)
 router.get('/account', require('./account-query'));
 router.patch('/account', require('./account-update'));

server/auth/login.js

@@ -49,7 +49,7 @@ const route = async (req, res) => {
 	}
 
 	//generate the JWTs
-	const { accessToken, refreshToken } = tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
+	const { accessToken, refreshToken } = await tokenGenerateRefresh(account.index, account.email, account.username, account.type, account.admin, account.mod);
 
 	//set the cookie
 	res.cookie('refreshToken', refreshToken, { path: '/', httpOnly: true, secure: true, sameSite: 'none', maxAge: 60 * 60 * 24 * 30 * 1000 }); //30 days

server/auth/token.js

@@ -1,10 +1,8 @@
-const jwt = require('jsonwebtoken');
-
 const tokenRefresh = require('../utilities/token-refresh');
 
 //auth/token
 module.exports = async (req, res) => {
-	return tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
+	return await tokenRefresh(req.cookies.refreshToken || '', (err, accessToken, refreshToken) => {
 		if (err) {
 			return res.status(err).end();
 		}

server/auth/validation.js

@@ -44,7 +44,7 @@ const route = async (req, res) => {
 			hooks = JSON.parse(process.env.HOOK_POST_VALIDATION_ARRAY);
 
 			if (!Array.isArray(hooks)) {
-				throw 'isArray() check failed';
+				throw 'post validation hook isArray() check failed';
 			}
 
 			//authenticate the hooks

server/utilities/token-auth.js

@@ -6,7 +6,7 @@ module.exports = (req, res, next) => {
 	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
 
 	if (!accessToken) {
-		return res.status(401).send('No access token found');
+		return res.status(401).send('No access token provided');
 	}
 
 	return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {

server/utilities/token-decode.js

@@ -0,0 +1,21 @@
+const jwt = require('jsonwebtoken');
+
+//middleware to decode the JWT token
+module.exports = (req, res, next) => {
+	const authHeader = req.headers['authorization'];
+	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
+
+	if (!accessToken) {
+		return res.status(401).send('No access token provided');
+	}
+
+	return jwt.decode(accessToken, process.env.SECRET_ACCESS, (err, user) => {
+		if (err) {
+			return res.status(403).send(err);
+		}
+
+		req.user = user;
+
+		return next();
+	});
+};

server/utilities/token-destroy.js

@@ -1,7 +1,7 @@
 const { tokens } = require('../database/models');
 
-module.exports = (refreshToken) => {
-	tokens.destroy({
+module.exports = async (refreshToken) => {
+	await tokens.destroy({
 		where: {
 			token: refreshToken || ''
 		}

server/utilities/token-generate-refresh.js

@@ -2,7 +2,7 @@ const jwt = require('jsonwebtoken');
 const { tokens } = require('../database/models');
 
 //generates a JWT token based on the given arguments
-module.exports = (index, email, username, type, admin, mod) => {
+module.exports = async (index, email, username, type, admin, mod) => {
 	const content = {
 		index,
 		email,
@@ -16,7 +16,7 @@ module.exports = (index, email, username, type, admin, mod) => {
 	const accessToken = jwt.sign(content, process.env.SECRET_ACCESS, { expiresIn: '10m', issuer: 'auth' });
 	const refreshToken = jwt.sign(content, process.env.SECRET_REFRESH, { expiresIn: '30d', issuer: 'auth' });
 
-	tokens.create({ token: refreshToken, email: email });
+	await tokens.create({ token: refreshToken, email: email });
 
 	return { accessToken, refreshToken };
 };

server/utilities/token-refresh.js

@@ -19,15 +19,15 @@ module.exports = async (oldRefreshToken, callback) => {
 		return callback(403);
 	}
 
-	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, (err, user) => {
+	jwt.verify(oldRefreshToken, process.env.SECRET_REFRESH, async (err, user) => {
 		if (err) {
 			return callback(403);
 		}
 
-		const { accessToken, refreshToken } = generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
+		await destroy(oldRefreshToken);
 
-		destroy(oldRefreshToken);
+		const { accessToken, refreshToken } = await generate(user.index, user.email, user.username, user.type, user.admin, user.mod);
 
-		return callback(null, accessToken, refreshToken);
+		return await callback(null, accessToken, refreshToken);
 	});
 };

tools/migrations/v1.3.1.sql

@@ -1 +0,0 @@
-ALTER TABLE `accounts` CHANGE `id` `index` INT( 11 ) NOT NULL AUTO_INCREMENT;

tools/migrations/v1.4.0.sql

@@ -1 +0,0 @@
-DROP TABLE tokens;

tools/react/token-provider.jsx

@@ -31,7 +31,7 @@ const TokenProvider = props => {
 		let bearer = accessToken;
 
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp + 600) < Date.now();
+		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//BUGFIX: if logging out, just skip over the refresh token
@@ -80,7 +80,7 @@ const TokenProvider = props => {
 	//access the refreshed token via callback
 	const tokenCallback = async (cb) => {
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp * 1000) < Date.now();
+		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//ping the auth server for a new token