404
+Page not found
++ The page you requested does not exist or may have been moved. +
+ + Go to login + +Follow the link below to activate your account:
+ ${link} + `, + }); +} + +function sendEmailChangeConfirmation(email, token) { + const serverUrl = process.env.SERVER_URL || 'http://localhost:4000'; + const link = `${serverUrl}/email-change/confirm/${encodeURIComponent(token)}`; + + return send({ + to: email, + subject: 'Confirm your new email address', + text: `Follow this link to confirm your new email address: ${link}`, + html: ` +Follow the link below to confirm your new email address:
+ ${link} + `, + }); +} + +function sendEmailChangeNotification(email, newEmail) { + return send({ + to: email, + subject: 'Your email address was changed', + text: `Your account email was changed to ${newEmail}. If this was not you, please contact support immediately.`, + html: ` +Your account email was changed to ${newEmail}.
+If this was not you, please contact support immediately.
+ `, + }); +} + +function sendPasswordResetLink(email, token) { + const clientUrl = process.env.CLIENT_URL || 'http://localhost:5173'; + const link = `${clientUrl}/reset-password/confirm?token=${encodeURIComponent(token)}`; + + return send({ + to: email, + subject: 'Reset your password', + text: `Follow this link to reset your password: ${link}`, + html: ` +Follow the link below to choose a new password:
+ ${link} + `, + }); +} + +module.exports = { + sendActivationLink, + sendEmailChangeConfirmation, + sendEmailChangeNotification, + sendPasswordResetLink, +}; diff --git a/src/backend/src/services/socialAccount.service.js b/src/backend/src/services/socialAccount.service.js new file mode 100644 index 00000000..dce94e01 --- /dev/null +++ b/src/backend/src/services/socialAccount.service.js @@ -0,0 +1,70 @@ +'use strict'; + +const { SocialAccount } = require('../models/socialAccount.model'); +const { ApiError } = require('../utils/ApiError'); +const userService = require('./user.service'); + +const GITHUB_PROVIDER = 'github'; + +function normalize(account) { + return { + provider: account.provider, + }; +} + +function findByProviderAccount(provider, providerUserId, options = {}) { + return SocialAccount.findOne({ + where: { provider, providerUserId }, + ...options, + }); +} + +function findByUserAndProvider(userId, provider, options = {}) { + return SocialAccount.findOne({ + where: { userId, provider }, + ...options, + }); +} + +function listByUserId(userId, options = {}) { + return SocialAccount.findAll({ + where: { userId }, + order: [['createdAt', 'ASC']], + ...options, + }); +} + +async function removeByUserAndProvider({ userId, provider }) { + const user = await userService.findById(userId); + + if (!user) { + throw ApiError.notFound('User not found'); + } + + const socialAccount = await findByUserAndProvider(userId, provider); + + if (!socialAccount) { + throw ApiError.notFound('Social account not found'); + } + + const linkedAccountsCount = await SocialAccount.count({ + where: { userId }, + }); + + if (!user.password && linkedAccountsCount <= 1) { + throw ApiError.badRequest( + 'Set a password before removing your only social sign-in method.', + ); + } + + await socialAccount.destroy(); +} + +module.exports = { + GITHUB_PROVIDER, + normalize, + findByProviderAccount, + findByUserAndProvider, + listByUserId, + removeByUserAndProvider, +}; diff --git a/src/backend/src/services/user.service.js b/src/backend/src/services/user.service.js new file mode 100644 index 00000000..36d68b0f --- /dev/null +++ b/src/backend/src/services/user.service.js @@ -0,0 +1,238 @@ +/* eslint-disable indent */ +'use strict'; + +const bcrypt = require('bcryptjs'); +const { col, fn, where } = require('sequelize'); + +const { User } = require('../models/user.model'); +const { SocialAccount } = require('../models/socialAccount.model'); +const { ApiError } = require('../utils/ApiError'); +const { + validatePassword, + validateName, + validateEmail, +} = require('../utils/validate'); +const jwtService = require('./jwt.service'); +const mailService = require('./mail.service'); + +function normalize(user) { + return { + id: user.id, + name: user.name, + email: user.email, + hasPassword: Boolean(user.password), + socialAccounts: Array.isArray(user.socialAccounts) + ? user.socialAccounts.map((socialAccount) => ({ + provider: socialAccount.provider, + })) + : [], + }; +} + +function findByEmail(email, options = {}) { + return User.findOne({ where: { email }, ...options }); +} + +function findByEmailCaseInsensitive(email, options = {}) { + return User.findOne({ + where: where(fn('lower', col('email')), String(email).trim().toLowerCase()), + ...options, + }); +} + +function findByActivationToken(activationToken, options = {}) { + return User.findOne({ where: { activationToken }, ...options }); +} + +function findById(id, options = {}) { + return User.findByPk(id, options); +} + +async function getProfile(userId) { + const user = await findById(userId, { + include: [ + { + model: SocialAccount, + as: 'socialAccounts', + }, + ], + }); + + if (!user) { + throw ApiError.notFound('User not found'); + } + + return normalize(user); +} + +async function changePassword({ userId, oldPassword, newPassword }) { + const user = await findById(userId); + + if (!user) { + throw ApiError.notFound('User not found'); + } + + const errors = {}; + const requiresCurrentPassword = Boolean(user.password); + + if (requiresCurrentPassword && !oldPassword) { + errors.oldPassword = 'Old password is required'; + } + + const newPasswordError = validatePassword(newPassword); + + if (newPasswordError) { + errors.newPassword = newPasswordError; + } + + if (Object.keys(errors).length > 0) { + throw ApiError.badRequest('Validation failed', errors); + } + + if (requiresCurrentPassword) { + const isPasswordValid = await bcrypt.compare(oldPassword, user.password); + + if (!isPasswordValid) { + throw ApiError.badRequest('Validation failed', { + oldPassword: 'Old password is incorrect', + }); + } + } + + user.password = await bcrypt.hash(newPassword, 10); + await user.save(); + + return requiresCurrentPassword + ? 'Password changed successfully.' + : 'Password set successfully.'; +} + +async function changeName({ userId, newName }) { + const nameError = validateName(newName); + + if (nameError) { + throw ApiError.badRequest('Validation failed', { newName: nameError }); + } + + const user = await findById(userId); + + if (!user) { + throw ApiError.notFound('User not found'); + } + + user.name = String(newName).trim(); + await user.save(); +} + +async function requestEmailChange({ userId, password, newEmail }) { + const user = await findById(userId); + + if (!user) { + throw ApiError.notFound('User not found'); + } + + if (!user.password) { + throw ApiError.badRequest( + 'Set a password before changing your email address.', + { + password: 'Set a password before changing your email address.', + }, + ); + } + + const errors = {}; + const normalizedEmail = String(newEmail).trim(); + + if (!password) { + errors.password = 'Password is required'; + } + + const emailError = validateEmail(normalizedEmail); + + if (emailError) { + errors.newEmail = emailError; + } + + if (Object.keys(errors).length > 0) { + throw ApiError.badRequest('Validation failed', errors); + } + + const isPasswordValid = await bcrypt.compare(password, user.password); + + if (!isPasswordValid) { + throw ApiError.badRequest('Validation failed', { + password: 'Password is incorrect', + }); + } + + if (user.email.toLowerCase() === normalizedEmail.toLowerCase()) { + throw ApiError.badRequest('Validation failed', { + newEmail: 'New email must be different from current email', + }); + } + + const existingUser = await findByEmail(normalizedEmail); + + if (existingUser && existingUser.id !== user.id) { + throw ApiError.badRequest('Validation failed', { + newEmail: 'Email is already taken', + }); + } + + const token = jwtService.signEmailChangeToken({ + type: 'email-change', + userId: user.id, + currentEmail: user.email, + newEmail: normalizedEmail, + }); + + await mailService.sendEmailChangeConfirmation(normalizedEmail, token); +} + +async function confirmEmailChange(token) { + const payload = jwtService.verifyEmailChangeToken(token); + + if (!payload || payload.type !== 'email-change') { + throw ApiError.notFound('Invalid email change token'); + } + + const user = await findById(payload.userId); + + if (!user) { + throw ApiError.notFound('User not found'); + } + + if (user.email !== payload.currentEmail) { + throw ApiError.badRequest('Email change request is no longer valid'); + } + + const existingUser = await findByEmail(payload.newEmail); + + if (existingUser && existingUser.id !== user.id) { + throw ApiError.badRequest('Validation failed', { + newEmail: 'Email is already taken', + }); + } + + const oldEmail = user.email; + + user.email = payload.newEmail; + await user.save(); + + await mailService.sendEmailChangeNotification(oldEmail, payload.newEmail); + + return user; +} + +module.exports = { + normalize, + findByEmail, + findByEmailCaseInsensitive, + findByActivationToken, + findById, + getProfile, + changePassword, + changeName, + requestEmailChange, + confirmEmailChange, +}; diff --git a/src/backend/src/utils/ApiError.js b/src/backend/src/utils/ApiError.js new file mode 100644 index 00000000..6494d324 --- /dev/null +++ b/src/backend/src/utils/ApiError.js @@ -0,0 +1,23 @@ +'use strict'; + +class ApiError extends Error { + constructor({ status, message, errors = {} }) { + super(message); + this.status = status; + this.errors = errors; + } + + static badRequest(message, errors) { + return new ApiError({ status: 400, message, errors }); + } + + static unauthorized(message = 'Unauthorized') { + return new ApiError({ status: 401, message }); + } + + static notFound(message = 'Not found') { + return new ApiError({ status: 404, message }); + } +} + +module.exports = { ApiError }; diff --git a/src/backend/src/utils/validate.js b/src/backend/src/utils/validate.js new file mode 100644 index 00000000..e34f8605 --- /dev/null +++ b/src/backend/src/utils/validate.js @@ -0,0 +1,33 @@ +'use strict'; + +const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; + +function validateName(name) { + if (!name || String(name).trim().length === 0) { + return 'Name is required'; + } + + return null; +} + +function validateEmail(email) { + if (!email || !EMAIL_REGEX.test(email)) { + return 'Invalid email address'; + } + + return null; +} + +function validatePassword(password) { + if (!password || password.length < 12) { + return 'Password must be at least 12 characters'; + } + + if ((password.match(/\d/g) || []).length < 2) { + return 'Password must contain at least 2 numbers'; + } + + return null; +} + +module.exports = { validateName, validateEmail, validatePassword }; diff --git a/src/frontend/.gitignore b/src/frontend/.gitignore new file mode 100644 index 00000000..a547bf36 --- /dev/null +++ b/src/frontend/.gitignore @@ -0,0 +1,24 @@ +# Logs +logs +*.log +npm-debug.log* +yarn-debug.log* +yarn-error.log* +pnpm-debug.log* +lerna-debug.log* + +node_modules +dist +dist-ssr +*.local + +# Editor directories and files +.vscode/* +!.vscode/extensions.json +.idea +.DS_Store +*.suo +*.ntvs* +*.njsproj +*.sln +*.sw? diff --git a/src/frontend/README.md b/src/frontend/README.md new file mode 100644 index 00000000..7dbf7ebf --- /dev/null +++ b/src/frontend/README.md @@ -0,0 +1,73 @@ +# React + TypeScript + Vite + +This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules. + +Currently, two official plugins are available: + +- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Oxc](https://oxc.rs) +- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) + +## React Compiler + +The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation). + +## Expanding the ESLint configuration + +If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules: + +```js +export default defineConfig([ + globalIgnores(['dist']), + { + files: ['**/*.{ts,tsx}'], + extends: [ + // Other configs... + + // Remove tseslint.configs.recommended and replace with this + tseslint.configs.recommendedTypeChecked, + // Alternatively, use this for stricter rules + tseslint.configs.strictTypeChecked, + // Optionally, add this for stylistic rules + tseslint.configs.stylisticTypeChecked, + + // Other configs... + ], + languageOptions: { + parserOptions: { + project: ['./tsconfig.node.json', './tsconfig.app.json'], + tsconfigRootDir: import.meta.dirname, + }, + // other options... + }, + }, +]) +``` + +You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules: + +```js +// eslint.config.js +import reactX from 'eslint-plugin-react-x' +import reactDom from 'eslint-plugin-react-dom' + +export default defineConfig([ + globalIgnores(['dist']), + { + files: ['**/*.{ts,tsx}'], + extends: [ + // Other configs... + // Enable lint rules for React + reactX.configs['recommended-typescript'], + // Enable lint rules for React DOM + reactDom.configs.recommended, + ], + languageOptions: { + parserOptions: { + project: ['./tsconfig.node.json', './tsconfig.app.json'], + tsconfigRootDir: import.meta.dirname, + }, + // other options... + }, + }, +]) +``` diff --git a/src/frontend/eslint.config.js b/src/frontend/eslint.config.js new file mode 100644 index 00000000..2ebd0b7d --- /dev/null +++ b/src/frontend/eslint.config.js @@ -0,0 +1,34 @@ +import js from '@eslint/js'; +import globals from 'globals'; +import reactHooks from 'eslint-plugin-react-hooks'; +import reactRefresh from 'eslint-plugin-react-refresh'; +import tseslint from 'typescript-eslint'; +import { globalIgnores } from 'eslint/config'; + +export default tseslint.config([ + globalIgnores(['dist']), + { + files: ['**/*.{ts,tsx}'], + extends: [js.configs.recommended, ...tseslint.configs.recommended], + languageOptions: { + ecmaVersion: 2020, + globals: globals.browser, + parserOptions: { + ecmaFeatures: { + jsx: true, + }, + }, + }, + plugins: { + 'react-hooks': reactHooks, + 'react-refresh': reactRefresh, + }, + rules: { + ...reactHooks.configs.recommended.rules, + 'react-refresh/only-export-components': [ + 'warn', + { allowConstantExport: true }, + ], + }, + }, +]); diff --git a/src/frontend/index.html b/src/frontend/index.html new file mode 100644 index 00000000..4e16af5b --- /dev/null +++ b/src/frontend/index.html @@ -0,0 +1,19 @@ + + + + + + + + + +We sent an activation link to {email}. Follow it to activate your account.
+{loadError}
+Loading...
+| + Name + | ++ {user.name} + | +
|---|---|
| + Email + | ++ {user.email} + | +
{successMessage}
+ )} + + {pageError && ( +{pageError}
+ )} + +GitHub
++ {isGithubConnected + ? 'Connected and ready to use for sign-in.' + : 'Connect GitHub to sign in without typing a password.'} +
++ Set a password before removing GitHub so your account keeps another + way to sign in. +
+ )} ++ This account was created with GitHub. Set a password if you also want + to use email/password sign-in and email changes. +
+ )} + + {activeSection === 'name' && ( ++ {isEmailChange + ? 'Your new email address has been confirmed. Redirecting to your account page...' + : 'You have successfully verified your email address. Redirecting to your account page...'} +
+404
++ The page you requested does not exist or may have been moved. +
+ + Go to login + +Password Reset
++ This password reset link is missing or incomplete. Request a new one + to keep going. +
+ + Request a new link + +Password Reset
++ {email ? ( + <> + We sent a password reset link to {email}. Open the + email and follow the link to choose a new password. + + ) : ( + 'If an account exists for that email, we sent a password reset link. Open the email and follow the link to choose a new password.' + )} +
+ + Back to login + +Password Reset
++ Your password has been reset successfully. You can now sign in with + your new password. +
+ + Go to login + +