import { type Injector } from 'graphql-modules'; import type { Request, Response, NextFunction } from 'express'; import AccountsPassword from '../accounts-password'; import { body, matchedData, param, validationResult } from 'express-validator'; import { getClientIp } from 'request-ip'; function matchOrThrow = Record>( ...args: Parameters ): T { if (!validationResult(args[0]).isEmpty()) { throw new Error('Validation error'); } return matchedData(...args) as T; } const getUserAgent = (req: Request) => { let userAgent: string = (req.headers['user-agent'] as string) || ''; if (req.headers['x-ucbrowser-ua']) { // special case of UC Browser userAgent = req.headers['x-ucbrowser-ua'] as string; } return userAgent; }; function getHtml(title: string, body: string) { return ` ${title} ${body} `; } export const infosMiddleware = (req: Request, _res: Response, next: NextFunction) => { req.infos = { userAgent: getUserAgent(req), ip: getClientIp(req) ?? req.ip, }; next(); }; export const verifyEmail = (accountsPasswordOrInjector: Injector | AccountsPassword) => [ param('token').isString().notEmpty(), async (req: Request, res: Response) => { try { const { token } = matchOrThrow<{ token: string }>(req); const accountsPassword = accountsPasswordOrInjector instanceof AccountsPassword ? accountsPasswordOrInjector : accountsPasswordOrInjector.get(AccountsPassword); await accountsPassword.verifyEmail(token); res.send( getHtml( 'Email successfully verified', `

The email address has been successfully verified.

` ) ); } catch (err: any) { res.send( //codeql[js/xss-through-exception] getHtml( 'Email verification error', `

The email address couldn't be verified: ${err.message ?? 'unknown error'}

` ) ); } }, ]; export const resetPassword = (accountsPasswordOrInjector: Injector | AccountsPassword) => [ body('token').isString().notEmpty(), body('newPassword').isString().notEmpty(), async (req: Request, res: Response) => { try { const { token, newPassword } = matchOrThrow<{ token: string; newPassword: string }>(req); const accountsPassword = accountsPasswordOrInjector instanceof AccountsPassword ? accountsPasswordOrInjector : accountsPasswordOrInjector.get(AccountsPassword); await accountsPassword.resetPassword(token, newPassword, req.infos); res.send( getHtml( 'Password successfully changed', `

The password has been successfully changed.

` ) ); } catch (err: any) { //codeql[js/xss-through-exception] res.send( getHtml( 'Password reset error', `

The password couldn't be changed: ${err.message ?? 'unknown error'}

` ) ); } }, ]; export const resetPasswordForm = [ param('token').isString().notEmpty().escape(), (req: Request, res: Response) => { try { const { token } = matchOrThrow<{ token: string }>(req); res.send( getHtml( 'Reset password', `

Reset your password

` ) ); } catch (err: any) { //codeql[js/xss-through-exception] res.send( getHtml( 'Password reset error', `

The password couldn't be changed: ${err.message ?? 'unknown error'}

` ) ); } }, ];