Merge pull request #18 from foyzulkarim/feature/apply-role-based-access-control

Email Verification System & Role-Based Access Control

Author: foyzulkarim

.gitignore

@@ -130,3 +130,7 @@ dist
 config.development.json
 config.production.json
 config.test.json
+
+# Debug emails
+**/debug/**
+.DS_Store

package-lock.json

@@ -17,13 +17,15 @@
     "logs:prod": "pm2 logs src/start.js",
     "restart:prod": "NODE_ENV=production pm2 restart src/start.js",
     "create-domain": "zx scripts/dev/domain-generator.js",
-    "bump-version": "npm version patch -m 'Bump version to %s'"
+    "bump-version": "npm version patch -m 'Bump version to %s'",
+    "migrate": "node src/migration-runner.js"
   },
   "keywords": [],
   "author": "",
   "license": "ISC",
   "dependencies": {
     "@octokit/rest": "^20.1.1",
+    "@sendgrid/mail": "^8.1.4",
     "bcrypt": "^5.1.1",
     "compression": "^1.7.4",
     "connect-mongo": "^5.1.0",

package.json

@@ -1,3 +1,4 @@
 GITHUB_CLIENT_ID=123
 GITHUB_CLIENT_SECRET=123
 ENCRYPTION_KEY=123
+SUPERADMIN_PASSWORD=123

src/.env.example

@@ -5,7 +5,7 @@ const {
   getGitHubStrategy,
   getOrCreateUserFromGitHubProfile,
 } = require('./githubStrategy');
-const { localStrategy, registerUser } = require('./localStrategy');
+const { localStrategy, registerUser, verifyEmail, resendVerificationEmail } = require('./localStrategy');
 const {
   getGoogleStrategy,
   getOrCreateUserFromGoogleProfile,
@@ -29,4 +29,6 @@ module.exports = {
   registerUser,
   getGoogleStrategy,
   getOrCreateUserFromGoogleProfile,
+  verifyEmail,
+  resendVerificationEmail,
 };

src/auth/index.js

@@ -1,28 +1,39 @@
 const LocalStrategy = require('passport-local').Strategy;
 const bcrypt = require('bcrypt');
+const crypto = require('crypto');
 const {
   getByUsername,
   getByEmail,
   create,
+  updateById,
+  findByVerificationToken,
+  refreshVerificationToken,
+  completeEmailVerification,
 } = require('../domains/user/service');
 const { AppError } = require('../libraries/error-handling/AppError');
+const { sendVerificationEmail } = require('../libraries/email/emailService');
 
 const verifyCallback = async (username, password, done) => {
   try {
     // Find user by email (since we're using email as username)
     const user = await getByEmail(username);
-    
+
     if (!user) {
       return done(null, false, { message: 'Incorrect email.' });
     }
 
     // Verify this is a local auth user
     if (user.authType !== 'local') {
-      return done(null, false, { 
-        message: `Please use ${user.authType} authentication for this account.` 
+      return done(null, false, {
+        message: `Please use ${user.authType} authentication for this account.`
       });
     }
 
+    // Check if email is verified
+    if (!user.isVerified) {
+      return done(null, false, { message: 'Please verify your email address before signing in.', reason: 'email-not-verified' });
+    }
+
     // Verify password
     const isValidPassword = await bcrypt.compare(password, user.local.password);
     if (!isValidPassword) {
@@ -40,6 +51,10 @@ const verifyCallback = async (username, password, done) => {
   }
 };
 
+const generateVerificationToken = () => {
+  return crypto.randomBytes(32).toString('hex');
+};
+
 const registerUser = async ({ email, password }) => {
   try {
     // Check if user already exists
@@ -52,23 +67,35 @@ const registerUser = async ({ email, password }) => {
     const salt = await bcrypt.genSalt(10);
     const hashedPassword = await bcrypt.hash(password, salt);
 
+    // Generate verification token
+    const verificationToken = generateVerificationToken();
+    const verificationTokenExpiry = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours from now
+
     // Create user payload matching new schema structure
     const payload = {
       email,
       displayName: email,
-      authType: 'local', // Specify auth type
+      authType: 'local',
       local: {
         username: email,
         password: hashedPassword,
       },
       isDemo: false,
       isVerified: false,
       isAdmin: false,
+      verificationToken,
+      verificationTokenExpiry,
+      isDeactivated: false, // we activate the user after email verification
+      role: 'Visitor',
+      roleId: null,
     };
 
     // Create the user
     const newUser = await create(payload);
 
+    // Send verification email
+    await sendVerificationEmail(email, verificationToken);
+
     // Prepare the user object for the session
     const userObj = newUser.toObject();
     const trimmedPayloadForSession = {
@@ -87,6 +114,50 @@ const registerUser = async ({ email, password }) => {
   }
 };
 
+const verifyEmail = async (token) => {
+  try {
+    const user = await findByVerificationToken(token);
+
+    if (!user) {
+      throw new AppError('invalid-token', 'Invalid or expired verification token', 400);
+    }
+
+    // Update user as verified
+    await completeEmailVerification(user._id);
+
+    return { message: 'Email verified successfully' };
+  } catch (error) {
+    if (error instanceof AppError) {
+      throw error;
+    }
+    throw new AppError('verification-failed', error.message, 400);
+  }
+};
+
+const resendVerificationEmail = async (email) => {
+  try {
+    const { user, verificationToken } = await refreshVerificationToken(email);
+    
+    // Send new verification email
+    await sendVerificationEmail(email, verificationToken);
+    
+    return { 
+      message: 'Verification email sent successfully',
+      email: user.email
+    };
+  } catch (error) {
+    if (error instanceof AppError) {
+      throw error;
+    }
+    throw new AppError('resend-verification-failed', error.message, 400);
+  }
+};
+
 const localStrategy = new LocalStrategy(verifyCallback);
 
-module.exports = { localStrategy, registerUser };
+module.exports = { 
+  localStrategy, 
+  registerUser, 
+  verifyEmail,
+  resendVerificationEmail,
+};

src/auth/localStrategy.js

@@ -1,6 +1,7 @@
 {
   "NODE_ENV": "development",
   "MONGODB_URI": "mongodb://localhost:27017/mydatabase",
+  "DB_NAME": "mydatabase",
   "RATE": 40,
   "PORT": 4000
 }

src/configs/config.example.json

@@ -5,6 +5,7 @@ const schema = Joi.object({
     .valid('development', 'production', 'test')
     .default('development'),
   MONGODB_URI: Joi.string().required(),
+  DB_NAME: Joi.string().required(),
   RATE: Joi.number().min(0).required(),
   PORT: Joi.number().min(1000).default(4000),
   // LOGGLY is required when NODE_ENV is production
@@ -30,6 +31,11 @@ const schema = Joi.object({
   SESSION_SECRET: Joi.string().required(),
   ENCRYPTION_KEY: Joi.string().required(),
   ADMIN_USERNAMES: Joi.array().items(Joi.string()).required(),
+  SUPERADMIN_EMAIL: Joi.string().email().required(),
+  SUPERADMIN_PASSWORD: Joi.string().min(8).required(),
+  // SendGrid Configuration
+  SENDGRID_API_KEY: Joi.string().required(),
+  SENDGRID_FROM_EMAIL: Joi.string().email().required(),
 });
 
 module.exports = schema;