Version bump

Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.10 to 7.0.11.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.10...v7.0.11)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 7.0.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.envdev

@@ -5,6 +5,8 @@ WEB_PORT=3200
 WEB_ORIGIN=http://localhost:3001
 
 DB_HOSTNAME=localhost
+DB_PORTNAME=3306
+
 DB_DATABASE=auth
 DB_USERNAME=auth
 DB_PASSWORD=charizard
@@ -20,6 +22,9 @@ ADMIN_DEFAULT_USERNAME=admin
 # Give this a value to generate the default admin account (must be at least 8 characters)
 ADMIN_DEFAULT_PASSWORD=password
 
+# Give this a value to generate teh default admin account (must be a valid domain name, to pass the initial email check)
+ADMIN_DEFAULT_HOSTNAME=example.com
+
 # Select a "TZ database name" that suits your needs: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 DB_TIMEZONE=Australia/Sydney
 

.github/dependabot.yml

@@ -0,0 +1,10 @@
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+

.github/workflows/docker.yml

@@ -5,19 +5,21 @@ on:
   push:
     tags:
       - v1.*
+  workflow_dispatch:
+
 jobs:
   push_to_registry:
     name: Push Docker Image to Docker Hub
     runs-on: ubuntu-latest
     steps:
-      - name: Check Out The Repo
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@v5
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
 
       - name: Get Smart Tag
         id: prepare
@@ -26,13 +28,13 @@ jobs:
           docker_image: krgamestudios/auth-server
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Push to Docker Hub
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           push: true
           tags: ${{ steps.prepare.outputs.tag }}

Dockerfile

@@ -1,8 +1,8 @@
 
-FROM node:21-bookworm-slim
+FROM node:22-bookworm-slim
 WORKDIR "/app"
 COPY package*.json /app
-RUN npm install --production
+RUN npm install --omit=dev
 COPY . /app
 EXPOSE 3200
 USER node

README.md

@@ -6,7 +6,7 @@ This server is available via docker hub at krgamestudios/auth-server.
 
 # Setup
 
-There are multiple ways to run this app - it can run on it's own via `npm start` (for production) or `npm run dev` (for development). it can also run inside docker using `docker-compose up --build` - run `node configure-script.js` to generate docker-compose.yml and startup.sql.
+There are multiple ways to run this app - it can run on it's own via `npm start` (for production) or `npm run dev` (for development). it can also run inside docker using `docker compose up --build` - run `node configure-script.js` to generate docker-compose.yml and startup.sql.
 
 # API
 
@@ -79,7 +79,7 @@ Cookie: refreshToken
 ###
 
 
-//DOCS: Retreives the private account data, results vary
+//DOCS: Retrieves the private account data, results vary
 GET /auth/account
 Authorization: Bearer accessToken
 

configure-script.js

@@ -36,6 +36,25 @@ const question = (prompt, def = null) => {
 	const resetAddress = await question('Reset Addr', `example.com/reset`);
 	const appPort = await question('App Port', '3200');
 
+  //configure the database address
+  let dbLocation = '';
+  while (typeof dbLocation != 'string' || /^[le]/i.test(dbLocation[0]) == false) {
+    dbLocation = await question('[l]ocal or [e]xternal database?');
+  }
+
+  let appDBHost = '';
+  let appDBPort = '';
+
+  if (/^[l]/i.test(dbLocation[0])) {
+    appDBHost = 'database';
+    appDBPort = '3306';
+  }
+  else {
+    appDBHost = await question('DB Host');
+    appDBPort = await question('DB Port', '3306');
+  }
+
+  //configure the database account
 	const appDBUser = await question('DB User', appName);
 	const appDBPass = await question('DB Pass', 'charizard');
 	const dbRootPass = await question('DB Root Pass');
@@ -46,6 +65,7 @@ const question = (prompt, def = null) => {
 	const appMailPhysical = await question('Mail Physical');
 
 	const appDefaultUser = await question('App Default User', '');
+	const appDefaultHost = await question('App Default Host', '');
 	const appDefaultPass = await question('App Default Pass', '');
 
 	const appSecretAccess = await question('Access Token Secret', uuid(32));
@@ -55,20 +75,19 @@ const question = (prompt, def = null) => {
 
 	//generate the files
 	const ymlfile = `
-version: '3.8'
 services:
   ${appName}:
     build:
       context: .
     ports:
-      - "${appPort}"
+      - ${appPort}
     labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.${appName}router.rule=Host(\`${appWebAddress}\`)"
-      - "traefik.http.routers.${appName}router.entrypoints=websecure"
-      - "traefik.http.routers.${appName}router.tls.certresolver=myresolver"
-      - "traefik.http.routers.${appName}router.service=${appName}service@docker"
-      - "traefik.http.services.${appName}service.loadbalancer.server.port=${appPort}"
+      - traefik.enable=true
+      - traefik.http.routers.${appName}router.rule=Host(\`${appWebAddress}\`)
+      - traefik.http.routers.${appName}router.entrypoints=websecure
+      - traefik.http.routers.${appName}router.tls.certresolver=myresolver
+      - traefik.http.routers.${appName}router.service=${appName}service@docker
+      - traefik.http.services.${appName}service.loadbalancer.server.port=${appPort}
     environment:
       - WEB_PROTOCOL=${appWebProtocol}
       - WEB_ORIGIN=${appWebOrigin}
@@ -76,7 +95,8 @@ services:
       - HOOK_POST_VALIDATION_ARRAY=${postValidationHookArray}
       - WEB_RESET_ADDRESS=${resetAddress}
       - WEB_PORT=${appPort}
-      - DB_HOSTNAME=database
+      - DB_HOSTNAME=${appDBHost}
+      - DB_PORTNAME=${appDBPort}
       - DB_DATABASE=${appName}
       - DB_USERNAME=${appDBUser}
       - DB_PASSWORD=${appDBPass}
@@ -86,17 +106,23 @@ services:
       - MAIL_PASSWORD=${appMailPass}
       - MAIL_PHYSICAL=${appMailPhysical}
       - ADMIN_DEFAULT_USERNAME=${appDefaultUser}
+      - ADMIN_DEFAULT_HOSTNAME=${appDefaultHost}
       - ADMIN_DEFAULT_PASSWORD=${appDefaultPass}
       - SECRET_ACCESS=${appSecretAccess}
       - SECRET_REFRESH=${appSecretRefresh}
+    volumes:
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
     networks:
-      - app-network
+      - app-network${ appDBHost != 'database' ? '' : `
     depends_on:
       - database
+
   database:
     image: mariadb:latest
     environment:
       MYSQL_DATABASE: ${appName}
+      MYSQL_TCP_PORT: ${appDBPort}
       MYSQL_USER: ${appDBUser}
       MYSQL_PASSWORD: ${appDBPass}
       MYSQL_ROOT_PASSWORD: ${dbRootPass}
@@ -105,37 +131,43 @@ services:
     volumes:
       - ./mysql:/var/lib/mysql
       - ./startup.sql:/docker-entrypoint-initdb.d/startup.sql:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro`}
+
   traefik_${appName}:
     container_name: ${appName}_traefik
-    image: "traefik:v2.10"
-    container_name: "traefik"
+    image: traefik:latest
+    container_name: traefik
     command:
-      - "--log.level=ERROR"
-      - "--api.insecure=false"
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--entrypoints.websecure.address=:443"
-      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
-      - "--certificatesresolvers.myresolver.acme.email=${supportEmail}"
-      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
+      - --log.level=ERROR
+      - --api.insecure=false
+      - --providers.docker=true
+      - --providers.docker.exposedbydefault=false
+      - --entrypoints.websecure.address=:443
+      - --certificatesresolvers.myresolver.acme.tlschallenge=true
+      - --certificatesresolvers.myresolver.acme.email=${supportEmail}
+      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
     ports:
-      - "80:80"
-      - "443:443"
+      - 80:80
+      - 443:443
     volumes:
-      - "./letsencrypt:/letsencrypt"
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      - ./letsencrypt:/letsencrypt
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
     networks:
       - app-network
+
 networks:
   app-network:
     driver: bridge
 `;
 
 	const dockerfile = `
-FROM node:21-bookworm-slim
+FROM node:22-bookworm-slim
 WORKDIR "/app"
 COPY package*.json ./
-RUN npm install --production
+RUN npm install --omit=dev
 COPY . /app
 EXPOSE ${appPort}
 USER node

package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth-server",
-  "version": "1.8.2",
+  "version": "1.8.11",
   "description": "An API centric auth server. Uses Sequelize and mariaDB by default.",
   "main": "server/server.js",
   "scripts": {
@@ -13,26 +13,25 @@
     "url": "git+https://github.com/krgamestudios/auth-server.git"
   },
   "author": "Kayne Ruse",
-  "license": "ISC",
+  "license": "Zlib",
   "bugs": {
     "url": "https://github.com/krgamestudios/auth-server/issues"
   },
   "homepage": "https://github.com/krgamestudios/auth-server#readme",
   "dependencies": {
-    "bcryptjs": "^2.4.3",
-    "cookie-parser": "^1.4.6",
+    "bcryptjs": "^3.0.3",
+    "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "dotenv": "^16.3.1",
-    "express": "^4.18.2",
-    "jsonwebtoken": "^9.0.2",
-    "mariadb": "^3.2.3",
-    "node-cron": "^3.0.3",
-    "node-fetch": "^2.7.0",
-    "nodemailer": "^6.9.7",
-    "npm": "^9.9.2",
-    "sequelize": "^6.35.2"
+    "dotenv": "^17.2.3",
+    "express": "^5.2.1",
+    "jsonwebtoken": "^9.0.3",
+    "mariadb": "^3.4.5",
+    "node-cron": "^4.2.1",
+    "node-fetch": "^3.3.2",
+    "nodemailer": "^7.0.11",
+    "sequelize": "^6.37.7"
   },
   "devDependencies": {
-    "nodemon": "^3.0.2"
+    "nodemon": "^3.1.11"
   }
 }

server/admin/default-account.js

@@ -7,7 +7,7 @@ module.exports = async () => {
 	await sequelize.sync(); //this whole file is just one big BUGFIX
 
 	//validate env variables
-	if (!process.env.ADMIN_DEFAULT_USERNAME || !process.env.ADMIN_DEFAULT_PASSWORD) {
+	if (!process.env.ADMIN_DEFAULT_USERNAME || !process.env.ADMIN_DEFAULT_HOSTNAME || !process.env.ADMIN_DEFAULT_PASSWORD) {
 		//skip this if arguments are missing
 		return;
 	}
@@ -25,9 +25,8 @@ module.exports = async () => {
 	});
 
 	if (adminRecord == null) {
-		const webAddress = process.env.WEB_ADDRESS == 'localhost:3000' ? 'example.com' : process.env.WEB_ADDRESS; //can't log in as "localhost"
 		await accounts.create({
-			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}`,
+			email: `${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.ADMIN_DEFAULT_HOSTNAME}`,
 			username: `${process.env.ADMIN_DEFAULT_USERNAME}`,
 			hash: await bcrypt.hash(`${process.env.ADMIN_DEFAULT_PASSWORD}`, await bcrypt.genSalt(11)),
 			type: 'normal',
@@ -35,6 +34,6 @@ module.exports = async () => {
 			mod: true
 		});
 
-		console.warn(`Created default admin account (email: ${process.env.ADMIN_DEFAULT_USERNAME}@${webAddress}; password: ${process.env.ADMIN_DEFAULT_PASSWORD})`);
+		console.warn(`Created default admin account (email: ${process.env.ADMIN_DEFAULT_USERNAME}@${process.env.ADMIN_DEFAULT_HOSTNAME}; password: ${process.env.ADMIN_DEFAULT_PASSWORD})`);
 	}
 };

server/auth/index.js

@@ -5,6 +5,7 @@ const { accounts } = require('../database/models');
 
 //middleware
 const tokenAuth = require('../utilities/token-auth');
+const tokenDecode = require('../utilities/token-decode');
 
 //signup -> validate -> login all without a token
 router.post('/signup', require('./signup'));
@@ -20,13 +21,13 @@ router.patch('/reset', require('./password-reset'));
 router.delete('/logout', require('./logout'));
 
 //authenticate token
-router.use(tokenAuth);
+router.use(tokenDecode);
 
 //middleware
 router.use(async (req, res, next) => {
 	const record = await accounts.findOne({
 		where: {
-			email: req.user.email || ''
+			email: req.user?.email || ''
 		}
 	});
 
@@ -44,6 +45,9 @@ router.use(async (req, res, next) => {
 //refresh token
 router.post('/token', require('./token'));
 
+//authenticate token
+router.use(tokenAuth);
+
 //basic account management (needs a token)
 router.get('/account', require('./account-query'));
 router.patch('/account', require('./account-update'));

server/auth/validation.js

@@ -1,5 +1,5 @@
 const { pendingSignups, accounts } = require('../database/models');
-const fetch = require('node-fetch');
+const fetch = (...args) => import('node-fetch').then(({default: fetch}) => fetch(...args));
 const jwt = require('jsonwebtoken');
 
 //auth/validation

server/database/index.js

@@ -2,11 +2,10 @@ const Sequelize = require('sequelize');
 
 const sequelize = new Sequelize(process.env.DB_DATABASE, process.env.DB_USERNAME, process.env.DB_PASSWORD, {
 	host: process.env.DB_HOSTNAME,
+	port: process.env.DB_PORTNAME,
 	dialect: 'mariadb',
 	timezone: process.env.DB_TIMEZONE,
 	logging: process.env.DB_LOGGING ? console.log : false
 });
 
-sequelize.sync();
-
 module.exports = sequelize;

server/server.js

@@ -33,7 +33,7 @@ app.use('/admin', require('./admin'));
 app.use('/auth', require('./auth'));
 
 //error on access
-app.get('*', (req, res) => {
+app.get('/{*any}', (req, res) => {
 	res.redirect('https://github.com/krgamestudios/auth-server');
 });
 
@@ -41,4 +41,5 @@ app.get('*', (req, res) => {
 server.listen(process.env.WEB_PORT || 3200, async (err) => {
 	await database.sync();
 	console.log(`listening to localhost:${process.env.WEB_PORT || 3200}`);
+	console.log(`database located at ${process.env.DB_HOSTNAME || '<default>'}:${process.env.DB_PORTNAME || '<default>'}`);
 });

server/utilities/token-auth.js

@@ -6,7 +6,7 @@ module.exports = (req, res, next) => {
 	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
 
 	if (!accessToken) {
-		return res.status(401).send('No access token found');
+		return res.status(401).send('No access token provided');
 	}
 
 	return jwt.verify(accessToken, process.env.SECRET_ACCESS, (err, user) => {

server/utilities/token-decode.js

@@ -0,0 +1,17 @@
+const jwt = require('jsonwebtoken');
+
+//middleware to decode the JWT token
+module.exports = (req, res, next) => {
+	const authHeader = req.headers['authorization'];
+	const accessToken = authHeader?.split(' ')[1]; //'Bearer token'
+
+	if (!accessToken) {
+		return res.status(401).send('No access token provided');
+	}
+
+	const decoded = jwt.decode(accessToken);
+
+	req.user = decoded;
+
+	return next();
+};

tools/debug-startup.sql

@@ -1,4 +1,4 @@
 #use this while debugging
-CREATE DATABASE IF NOT EXISTS auth;
-CREATE USER IF NOT EXISTS 'auth'@'%' IDENTIFIED BY 'charizard';
+CREATE DATABASE auth;
+CREATE USER 'auth'@'%' IDENTIFIED BY 'charizard';
 GRANT ALL PRIVILEGES ON auth.* TO 'auth'@'%';

tools/react/token-provider.jsx

@@ -1,5 +1,5 @@
 import React, { useState, useEffect, createContext } from 'react';
-import decode from 'jwt-decode';
+import { jwtDecode } from 'jwt-decode';
 
 export const TokenContext = createContext();
 
@@ -31,7 +31,7 @@ const TokenProvider = props => {
 		let bearer = accessToken;
 
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
+		const expired = new Date(jwtDecode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//BUGFIX: if logging out, just skip over the refresh token
@@ -48,6 +48,9 @@ const TokenProvider = props => {
 			//ping the auth server for a new access token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
+				headers: {
+					'Authorization': `Bearer ${bearer}`
+				},
 				credentials: 'include'
 			});
 
@@ -79,13 +82,19 @@ const TokenProvider = props => {
 
 	//access the refreshed token via callback
 	const tokenCallback = async (cb) => {
+		//use this?
+		let bearer = accessToken;
+
 		//if expired (10 minutes, normally)
-		const expired = new Date(decode(accessToken).exp) < Date.now() / 1000;
+		const expired = new Date(jwtDecode(accessToken).exp) < Date.now() / 1000;
 
 		if (expired) {
 			//ping the auth server for a new token
 			const response = await fetch(`${process.env.AUTH_URI}/auth/token`, {
 				method: 'POST',
+				headers: {
+					'Authorization': `Bearer ${bearer}`
+				},
 				credentials: 'include'
 			});
 
@@ -110,7 +119,7 @@ const TokenProvider = props => {
 	};
 
 	return (
-		<TokenContext.Provider value={{ accessToken, setAccessToken, tokenFetch, tokenCallback, getPayload: () => decode(accessToken) }}>
+		<TokenContext.Provider value={{ accessToken, setAccessToken, tokenFetch, tokenCallback, getPayload: () => jwtDecode(accessToken) }}>
 			{props.children}
 		</TokenContext.Provider>
 	)