node-user-accounts-boilerplate/setup.js

"use strict";

const audit = require('./helper/audit');
const access = require('./helper/access');
const bootstrap = require('./helper/bootstrap');
const cookieParser = require('cookie-parser');
const expressSession = require('express-session');
const json = require('body-parser')
  .json();
const parseFilters = require('./filters/parse');
const passport = require('passport');

const CollectionSessionStore = require('./session/CollectionSessionStore');
const MemorySessionStore = require('./session/MemorySessionStore');

/**
 * Library entry point
 * 
 * @param {Express} app result of express()
 * @param {Config} config configuration
 */
function setup(app, config)
{
  // PASSPORT BOILERPLATE
  app.use(bootstrap(app, config));
  app.use(cookieParser());
  app.use(expressSession({
    secret: Math.round(Date.now() / 1000 / 3600 / 24)
      .toString(16),
    resave: true,
    saveUninitialized: false,
    store: config.sessions ? new CollectionSessionStore(config.sessions, config) : new MemorySessionStore(config),
  }));
  app.use(passport.initialize());
  app.use(passport.session());

  config.users = config.users || config.collection;

  // User serialisation
  passport.serializeUser(function (user, done)
  {
    done(null, user.id || 'none');
  });
  passport.deserializeUser(function (user, done)
  {
    done(null, config.users.lookup[user] || {});
  });

  // API endpoint
  config.prefix = config.prefix || '/api/accounts';

  // setup APIs
  setupAuthAPI(app, config);
  setupAccountsAPI(app, config);
}

function setupAuthAPI(app, config)
{
  config.custom = config.custom || {};

  const prefix = config.prefix;

  // login/registration
  const methods = [];

  for (let auth of config.auth || [])
  {
    methods.push(auth.description);
    auth.install(app, `${prefix}/${auth.method}`, passport);
  }
  app.get(`${prefix}/methods.json`, (req, res) =>
  {
    res.json(methods);
  });

  // self read
  app.get(`${prefix}/current.json`, (req, res) =>
  {
    if (req.user && req.user.id)
    {
      let output = Object.assign({}, req.user);

      if (output.password)
      {
        output.password = true;
      }
      res.json(output);
    }
    else
    {
      res.json(false);
    }
  });

  // self update
  app.put(`${prefix}/current.json`, access.LOGGEDIN, json, (req, res) =>
  {
    let user = req.user;

    if (req.body && req.body.password)
    {
      if (!config.crypt)
      {
        return res.error('A crypt is not configured', audit.INVALID_REQUEST);
      }
      if (config.auth.filter((a) => a.description.usesPassword)
        .length === 0)
      {
        return res.error('Not using any modules that use password', audit.INVALID_REQUEST);
      }
      config.crypt.hash(req.body.password)
        .then((hash) =>
        {
          user.password = hash;
          res.resolve(config.users.updateRecord(user), 'Password set', audit.ACCOUNT_CHANGE_PASSWORD);
        }, res.reject(audit.ACCOUNT_CHANGE_PASSWORD_FAILURE));
    }
    else
    {
      try
      {
        updateUserRecord(user, req.body || {}, false, config.custom);
        res.resolve(config.users.updateRecord(user), 'Done', audit.ACCOUNT_CHANGE);
      }
      catch (e)
      {
        res.error(e.message, `${audit.ACCOUNT_CHANGE}_FAILURE`)
      }
    }
  });

  // logout
  app.all(`${prefix}/logout.json`, (req, res) =>
  {
    res.success('Logged out', audit.LOGOUT);
    req.logout();
    req.session.destroy();
  });
}

function setupAccountsAPI(app, config)
{
  // ACCOUNT MANAGEMENT API
  const prefix = config.prefix;
  const collection = config.users;

  // discover
  const USER_DATA_ACCESS = access.ROLE_ONE_OF(config.administratorRoles || {});

  app.all(`${prefix}/search.json`, USER_DATA_ACCESS, (req, res) =>
  {
    let query = parseFilters(collection.searchMeta, req.query);

    res.resolve(collection.searchRecords(query), false, audit.ACCOUNT_SEARCH, JSON.stringify(query));
  });

  // create - not needed in this model. TODO: might be worth implementing later
  /*
  app.post(`${prefix}/:user.json`, USER_DATA_ACCESS, json, (req, res) =>
  {
    res.json('TODO');
  });
  */

  // read
  app.get(`${prefix}/:user.json`, USER_DATA_ACCESS, (req, res) =>
  {
    let query = {};

    query[collection.primaryKey] = req.params.user;
    collection.readRecord(query)
      .then((user) =>
      {
        let output = Object.assign({}, user);

        if (output.password)
        {
          output.password = true;
        }
        res.json(output);
        res.audit(audit.ACCOUNT_READ + audit.SUCCESS, JSON.stringify(query));
      }, res.reject(audit.ACCOUNT_READ + audit.FAILURE), JSON.stringify(query));
  });

  // update
  app.put(`${prefix}/:user.json`, USER_DATA_ACCESS, json, (req, res) =>
  {
    let query = {};

    query[collection.primaryKey] = req.params.user;
    collection.readRecord(query)
      .then((record) =>
      {
        let params = Object.keys(req.body);

        params = JSON.stringify(Object.assign({
          params
        }, query));
        try
        {
          updateUserRecord(record, req.body, req.user, config.custom);
          res.resolve(collection.updateRecord(record), 'Done', audit.ACCOUNT_UPDATE, params);
        }
        catch (e)
        {
          res.error(e.message, audit.ACCOUNT_UPDATE + audit.FAILURE, params);
        }
      }, res.reject(audit.ACCOUNT_UPDATE + audit.FAILURE, JSON.stringify(query)));
  });

  // delete
  app.delete(`${prefix}/:user.json`, USER_DATA_ACCESS, (req, res) =>
  {
    let query = {};

    query[collection.primaryKey] = req.params.user;
    if (req.params.user !== req.user.id)
    {
      res.resolve(collection.deleteRecord(query), 'User deleted', audit.ACCOUNT_DELETE, JSON.stringify(req.params));
    }
    else
    {
      res.error("Can't delete yourself", audit.ACCOUNT_DELETE + audit.FAILURE);
    }
  });

}

function updateUserRecord(user, update, loginUser = false, custom)
{
  for (let field in update)
  {
    let value = update[field];

    if (custom[field])
    {
      if (custom[field].validate)
      {
        custom[field].validate(value);
      }
      user[field] = value;
      continue;
    }

    switch (field)
    {
    case 'displayName':
      //~ case 'notificationInterval':
      if (typeof value !== 'string')
      {
        throw new Error(`${field} value is not string`);
      }
      user[field] = value;
      break;
    case 'password':
      delete user[field];
      break;
    case 'roles':
      if (!loginUser || loginUser.id === user.id)
      {
        throw new Error(`Can't update your own ${field}`);
      }
      user[field] = value;
      break;
      //~ case 'notificationSubscriptions':
      //~ if (typeof value !== 'object')
      //~ {
      //~ throw new Error(`${field} value is not object`);
      //~ }
      //~ for (let valueField in value)
      //~ {
      //~ if (typeof value[valueField] !== 'boolean')
      //~ {
      //~ throw new Error(`${valueField} value is not boolean`);
      //~ }
      //~ }
      //~ user[field] = value;
      //~ break;
    default:
      throw new Error(`${field} not editable`);
    }
  }
}

module.exports = setup;