# [`miniURL`][miniurl] - a `TinyApp` Project

[`miniurl`][miniurl] is a full stack web application, built with [`Node`][node] and [`Express`][express], that allows users to shorten long URLs (simillar to [bit.ly][bit.ly]). This project was built as a *proof of concept* for  for learning purposes. 

**_BEWARE:_ This application _does not store_ Users and URL databases to hard disk or external databases. Once the application is restarted all changes are lost, thus changes to [lookupURL.js][lookupURL] and [lookupUser.js][lookupUser] are needed to store these values.**

# Usage
Install it:
```bash
  npm install @rahmatsaeedi/miniurl
```

Run it:
```bash
  node express_server
```
# Security Issues
The application uses unsigned cookies, with  32 alphanumeral-characters (a-z, A-Z, 0-9) as the session identity; hence, being vulnerable to [`Pass the Cookie`][passTheCookie] attack, and [`session hijacking`][sessionHijacking] if used without TLS/SSL connection.

Also, [lookupURL.js][lookupURL] and [lookupUser.js][lookupUser] contains two registered users  ([`admin@example.com`][lookupUser] and [`example@example.com`][lookupUser]) and a session cookie ( [`sessionID`][lookupURL] ) for demonistration purposes. These `users`, their associated [`URLs`][lookupURL], and the `session` can be safely deleted.

# Dependencies
  * [`Node.js`][node]
  * [`Express`][express]
  * [`EJS`][ejs]
  * [`bcrypt`][bcrypt]
  * [`body-parser`][bparser]
  * [`cookie-parser`][cparser]

# Documentations
[`views`](/views) folder contain webpage templates.

[`express_server.js`](express_server.js) contain server logics, routing routes, and overall behaviours settings.

[`lookupURL.js`](lookupURL.js) contains logics related to processing stored shorcode for URLs, such as: 
  * `addURL (shortURL, longURL, userID)` : Stores the short/long url pair to URL database of the logged-in user with the session id `userID`.
  * `removeURL (shortURL, userID) ` : Removes the stored URL with shortcode `shortURL` from URL database of the logged-in user with session id `userID`.
  * `updateURL (shortURL, longURL, userID)` : Updates the short/long url pair of the logged-in user with the session id `userID`.
  * `getURL (shortURL, incrementVisit = false)` : Returns the url object with the shortcode `shortURL`.

  * Example of a URL object stored within the DB
    ```js
      "g" : {
        shortURL : "g",
        longURL : "https://www.google.ca",
        userID : "userID",
        lastUpdated : Date.now(),
        'visits' : 50
      }
    ```

[`lookupUser.js`](lookupUser.js) : contains logics related to processing stored shorcode for URLs: 

  * `initSessions ()` : Sets an interval to delete expired sessions routinly. Cleaning happens once every _localVariables.sessionDuration_ minutes.
  * `authenticate (email, pass)` : Authenticates plaintext password *pass* of user with email *email* against the stored hashed password.
  * `createSession (email, pass)` : Creates and returns a session key for the user with given _email_ and plaintext _pass_.
  * `destroySession (sessionID)` : Deletes the given session from _sessions_ object.
  * `extendSession (sessionID)` : Changes the expiry time of the session with given session id to _Date.now() + localVariables.sessionDuration_.
  * `getSessionUserID (sessionID)` : Returns _user id_ of the _session user_ with the given _session id_.
  * `getUserEmailByID (userID)` : Returns _email address_ of the _session user_ with the given _session id_.
  * `getSessionExpires (sessionID)` : Returns _expiry time_ of the _session_ with the given _session id_.
  * `authenticateSession (sessionID)` : Returns a _boolean_ if the session exists and has not expired yet.
  * `registerNewUser (email, pass)` : Adds a new _user object_ to the _users object_. `pass` is plaintext password, and the _user object_ contains the _hashe password_.
  * `isRegistered (email)` : Returns a _true_, if a _user object_ with the given _email address_ exists. Else, returns _false_.
  * `addToURI (uri, value, sessionID)` : Adds the object/array/value `value` to the _user object_ of the session-holder with the given _sessionID_. `uri` is a string, a key within the _user object_. 
  * `deleteFromURI (uri, value, sessionID)` : Removes the object/array/value `value` from the _user object_ of the session-holder with the given _sessionID_. `uri` is a string, a key within the _user object_.
  * `getURI (uri, sessionID)` : For the session-holder `XYZ`, this returns the value of `XYZ[uri]`. _uri_ is a string, a key, within the _user object_.

[`generateRandomString.js`](generateRandomString.js) :
  * `generateRandomString(length = 7)` generates a random string that starts with an alphabet and given _length_.

***Document Tree***

```
│
├─── doc
│   ├─── errors.PNG
│   ├─── login.PNG
│   ├─── register.PNG
│   ├─── urls.edit.PNG
│   └─── urls.PNG
│
├─── node_modules
│   ├─── ...
│   ...
│
├─── views
│   ├─── favicon.ico
│   ├─── urls_errors.ejs
│   ├─── urls_index.ejs
│   ├─── urls_login.ejs
│   ├─── urls_new.ejs
│   ├─── urls_register.ejs
│   ├─── urls_show.ejs
│   └─── _header.ejs
├─── .gitignore
├─── express_server.js
├─── generateRandomString.js
├─── lookupURL.js
├─── lookupUser.js
├─── package-lock.json
├─── package.json
└─── readme.md
```


# Final Product
## Login Page
![Login Page][login]

## Registeration Page
![Registeration Page][register]

## URLs Index
![Registered URLs][urls]

## URLs Edit / Show
![Edit / Show URLs][urls.edit]

## Example Errors
![Example Errors][errors]




[miniurl]: https://www.npmjs.com/package/@rahmatsaeedi/miniurl
[ejs]: https://www.npmjs.com/package/ejs
[bcrypt]: https://www.npmjs.com/package/bcrypt
[bparser]: https://www.npmjs.com/package/body-parser
[cparser]: https://www.npmjs.com/package/cookie-parser
[node]: https://github.com/nodejs/node
[express]: https://github.com/expressjs/express
[bit.ly]: https://bitly.com/
[passTheCookie]: https://wunderwuzzi23.github.io/blog/passthecookie.html
[sessionHijacking]: https://en.wikipedia.org/wiki/Session_hijacking
[login]: /doc/login.PNG
[register]: /doc/register.PNG
[urls]: /doc/urls.PNG
[urls.edit]: /doc/urls.edit.PNG
[errors]: /doc/errors.PNG
[lookupUser]: lookupUser.js
[lookupURL]: lookupURL.js