to much to say

auth.js

@@ -1,31 +0,0 @@
-const {JWTManager} = require("auth-guardian");
-const dotenv = require("dotenv");
-
-dotenv.config();
-
-const jwtAuth = new JWTManager.jwtAuth(process.env.JWT_SECRET);
-
-function generateAccesToken(user){
-    return jwtAuth.generateJWT({user: user}, {expiresIn: "1h"});
-}
-
-function generateRefreshToken(user){
-    return jwtAuth.generateJWT({user: user}, {expiresIn: "7d"});
-}
-
-function generatePermtoken(user){
-    return jwtAuth.generateJWT({user: user}, {expiresIn: "60d"});
-}
-
-function verifyToken(token){
-    return jwtAuth.verifyJWT(token);
-}
-
-function verifyRefreshToken(token){
-    return jwtAuth.verifyJWT(token);
-}
-
-function verifyPermtoken(token){
-    return jwtAuth.verifyJWT(token);
-}
-

auth/auth.js

@@ -0,0 +1,34 @@
+const {JWTAuth} = require("auth-guardian");
+const dotenv = require("dotenv");
+
+dotenv.config();
+ 
+const jwtAuth = new JWTAuth(process.env.JWT_SECRET);
+
+function generateAccesToken(user, expiresIn = "1h"){
+    return jwtAuth.generateJWT({user: user}, {expiresIn: expiresIn});
+}
+
+function generateRefreshToken(user, expiresIn = "5d"){
+    return jwtAuth.generateJWT({user: user}, {expiresIn: expiresIn});
+}
+
+function generatePermtoken(user, expiresIn = "60d"){
+    return jwtAuth.generateJWT({user: user}, {expiresIn: expiresIn});
+}
+
+function verifyToken(token){
+    try{
+        return jwtAuth.verifyJWT(token);
+    }
+    catch(err){
+        return false;
+    }
+}
+
+module.exports = {
+    generateAccesToken,
+    generateRefreshToken,
+    generatePermtoken,
+    verifyToken
+}

auth/auth.test.js

@@ -0,0 +1,81 @@
+const dotenv = require("dotenv");
+const { generateAccesToken, generateRefreshToken, generatePermtoken, verifyToken} = require("./auth");
+
+dotenv.config();
+
+describe('Auth.js Tests', () => {
+    const user = { id: 1, name: 'Test User' };
+
+    test('generateAccesToken should return a valid JWT', () => {
+        const token = generateAccesToken(user);
+        const decoded = verifyToken(token);
+        expect(decoded.user).toEqual(user);
+    });
+
+    test('generateRefreshToken should return a valid JWT', () => {
+        const token = generateRefreshToken(user);
+        const decoded = verifyToken(token);
+        expect(decoded.user).toEqual(user);
+    });
+
+    test('generatePermtoken should return a valid JWT', () => {
+        const token = generatePermtoken(user);
+        const decoded = verifyToken(token);
+        expect(decoded.user).toEqual(user);
+    });
+
+    test('verifyToken should return user for a valid token', () => {
+        const token = generateAccesToken(user);
+        const result = verifyToken(token);
+        expect(result.user).toEqual(user);
+    });
+
+    test('verifyRefreshToken should return true for a valid token', () => {
+        const token = generateRefreshToken(user);
+        const result = verifyToken(token);
+        expect(result.user).toEqual(user);
+    });
+
+    test('verifyPermtoken should return true for a valid token', () => {
+        const token = generatePermtoken(user);
+        const result = verifyToken(token);
+        expect(result.user).toEqual(user);
+    });
+
+
+    test('verifyToken should return false for an expired token', () => {
+        const token = generateAccesToken(user, "1ms");
+        const result = verifyToken(token);
+        expect(result.user).toEqual(undefined);
+    });
+
+    test('verifyRefreshToken should return false for an expired token', () => {
+        const token = generateAccesToken(user, "1ms");
+        const result = verifyToken(token);
+        expect(result.user).toEqual(undefined);
+    });
+
+    test('verifyPermtoken should return false for an expired token', () => {
+        const token = generateAccesToken(user, "1ms");
+        const result = verifyToken(token);
+        expect(result.user).toEqual(undefined);
+    });
+
+    test('verifyToken should return false for a token with an invalid signature', () => {
+        const token = generateAccesToken(user);
+        const result = verifyToken(token + 'a');
+        expect(result).toBe(false);
+    });
+
+    test('verifyRefreshToken should return false for a token with an invalid signature', () => {
+        const token = generateRefreshToken(user);
+        const result = verifyToken(token + 'a');
+        expect(result).toBe(false);
+    });
+
+    test('verifyPermtoken should return false for a token with an invalid signature', () => {
+        const token = generatePermtoken(user);
+        const result = verifyToken(token + 'a');
+        expect(result).toBe(false);
+    });
+});

auth/middleware.js

@@ -0,0 +1,50 @@
+const {verifyToken, generateAccesToken, generateRefreshToken} = require("./auth");
+
+const auth = (req, res, next) => {
+    const refreshToken = req.cookies.refreshToken;
+    const accessToken = req.cookies.accessToken;
+    const permtoken = req.cookies.permtoken;
+    if(!refreshToken && !accessToken && !permtoken) return res.status(401).json({error: "Unauthorized"});
+
+    if(accessToken){
+        const result = verifyToken(accessToken);
+        if(result.user){
+            req.user = result.user;
+            return next();
+        }
+    }
+
+    else if(refreshToken && !accessToken){
+        const result = verifyToken(refreshToken);
+        if(result != false){
+            //create new access token
+            const newAccessToken = generateAccesToken(result.user);
+            res.cookie("accessToken", newAccessToken, {httpOnly: true});
+        }
+        if(result.user){
+            req.user = result.user;
+            return next();
+        }
+    }
+
+    else if(permtoken){
+        const result = verifyToken(permtoken);
+        if(result != false){
+            //create new access token
+            const newAccessToken = generateAccesToken(result.user);
+            res.cookie("accessToken", newAccessToken, {httpOnly: true});
+
+            //create new refresh token
+            const newRefreshToken = generateRefreshToken(result.user);
+            res.cookie("refreshToken", newRefreshToken, {httpOnly: true});
+        }
+        if(result.user){
+            req.user = result.user;
+            return next();
+        }
+    }
+
+    return res.status(401).json({error: "Unauthorized"});
+}
+
+module.exports = auth;

auth/middleware.test.js

@@ -0,0 +1,98 @@
+const dotenv = require("dotenv");
+const { generateAccesToken, generateRefreshToken, generatePermtoken, verifyToken} = require("./auth");
+const middleware = require("./middleware");
+dotenv.config();
+
+describe('Middleware.js Tests', () => {
+    let req, res, next;
+
+    const user = { id: 1, name: 'Test User' };
+
+    beforeEach(() => {
+        req = { cookies: {} };
+        res = { 
+            cookie: jest.fn(),
+            status: jest.fn(function() {
+                return this;
+            }),
+            json: jest.fn()
+        };
+        next = jest.fn();
+    });
+
+    test('should call next() if access token is valid', () => {
+        const token = generateAccesToken(user);
+        req.cookies.accessToken = token;
+        middleware(req, res, next);
+        expect(next).toHaveBeenCalled();
+    });
+
+    test('should call next() if refresh token is valid', () => {
+        const token = generateRefreshToken(user);
+        req.cookies.refreshToken = token;
+        middleware(req, res, next);
+        expect(next).toHaveBeenCalled();
+    });
+
+    test('should call next() if permtoken is valid', () => {
+        const token = generatePermtoken(user);
+        req.cookies.permtoken = token;
+        middleware(req, res, next);
+        expect(next).toHaveBeenCalled();
+    });
+
+    test('should return 401 if no tokens are present', () => {
+        middleware(req, res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+    });
+
+    test('should return 401 if access token is invalid', () => {
+        const token = generateAccesToken(user);
+        req.cookies.accessToken = token + 'a';
+        middleware(req, res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+    });
+
+    test('should return 401 if refresh token is invalid', () => {
+        const token = generateRefreshToken(user);
+        req.cookies.refreshToken = token + 'a';
+        middleware(req, res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+    });
+
+    test('should return 401 if permtoken is invalid', () => {
+        const token = generatePermtoken(user);
+        req.cookies.permtoken = token + 'a';
+        middleware(req, res, next);
+        expect(res.status).toHaveBeenCalledWith(401);
+    });
+
+    test('should return access token if refresh token is valid', () => {
+        const token = generateRefreshToken(user);
+        req.cookies.refreshToken = token;
+        middleware(req, res, next);
+        expect(res.cookie).toHaveBeenCalledWith('accessToken', expect.any(String), { httpOnly: true });
+    });
+
+    test('should return access token and refresh if permtoken is valid', () => {
+        const token = generatePermtoken(user);
+        req.cookies.permtoken = token;
+        middleware(req, res, next);
+        expect(res.cookie).toHaveBeenCalledWith('accessToken', expect.any(String), { httpOnly: true });
+        expect(res.cookie).toHaveBeenCalledWith('refreshToken', expect.any(String), { httpOnly: true });
+    });
+
+    test('should not return refresh token if access token is valid', () => {
+        const token = generateAccesToken(user);
+        req.cookies.accessToken = token;
+        middleware(req, res, next);
+        expect(res.cookie).not.toHaveBeenCalledWith('refreshToken', expect.any(String), { httpOnly: true });
+    });
+
+    test('should not return permtoken token if refresh is valid', () => {
+        const token = generatePermtoken(user);
+        req.cookies.permtoken = token;
+        middleware(req, res, next);
+        expect(res.cookie).not.toHaveBeenCalledWith('permtoken', expect.any(String), { httpOnly: true });
+    });
+});

auth/password.js

@@ -0,0 +1,38 @@
+const {PassCheck, PasswordGenerator } = require("auth-guardian")
+
+const passwordPolicyOptions = {
+    minLength: process.env.PASSMINLENGTH,
+    maxLength: process.env.PASSMAXLENGTH,
+    minLower: process.env.PASSMINLOWERCASE,
+    minUpper: process.env.PASSMINUPPERCASE,
+    minNum: process.env.PASSMINNUMBERS,
+    minSpecial: process.env.PASSMINSYMBOLS,
+    specialChars: process.env.PASSSYMBOLS
+}
+
+const passwordPolicyOptionsGenerate = {
+    minLength:  12,
+    maxLength: 18,
+    minLower: process.env.PASSMINLOWERCASE,
+    minUpper: process.env.PASSMINUPPERCASE,
+    minNum: process.env.PASSMINNUMBERS,
+    minSpecial: process.env.PASSMINSYMBOLS,
+    specialChars: process.env.PASSSYMBOLS
+}
+
+const passWordCheck = new PassCheck(parseInt(process.env.SaltRounds), passwordPolicyOptions)
+const passwordGen = new PasswordGenerator({passwordPolicyOptionsGenerate})
+
+function verify(password, hash){
+    return passWordCheck.verifyPassword(password, hash)
+}
+
+function hash(password){
+    return passWordCheck.hashPassword(password)
+}
+
+function generatePassword(){
+    return passwordGen.Generate()
+}
+
+module.exports = {verify, hash, generatePassword}

auth/password.test.js

@@ -0,0 +1,31 @@
+const dotenv = require("dotenv");
+const {verify, hash, generatePassword} = require("./password");
+
+dotenv.config();
+
+describe('Password.js Tests', () => {
+    const password = 'password';
+    test('hash should return a hashed password', async () => {
+        const hashedPassword = await hash(password);
+        expect(hashedPassword).not.toEqual(password);
+    });
+
+    test('verify should return true for a valid password', async () => {
+        const hashedPassword = await hash(password);
+        const result = await verify(password, hashedPassword);
+        expect(result).toBe(true);
+    });
+
+    test('verify should return false for an invalid password', async () => {
+        const hashedPassword = await hash(password);
+        const result = await verify(password + 'a', hashedPassword);
+        expect(result).toBe(false);
+    });
+
+    test('generatePassword should return a valid password', async () => {
+        const generatedPassword = await generatePassword();
+        const hashedpass = await hash(generatedPassword);
+        const result = await verify(generatedPassword, hashedpass);
+        expect(result).toBe(true);
+    });
+});

index.js

@@ -1,4 +1,24 @@
 const express = require('express');
 const dotenv = require('dotenv');
 const cors = require('cors');
-const auth = require('./auth.js');
+const auth = require('./auth/middleware');
+const cookieParser = require('cookie-parser');
+
+dotenv.config();
+
+const app = express();
+app.use(cookieParser());
+app.use(express.json());
+app.use(cors());
+
+app.listen(process.env.PORT || 5000, () => {
+    console.log(`Server is running on port ${process.env.PORT || 5000}`);
+});
+
+app.use('/register', require('./routes/register.js'));
+app.use('/login', require('./routes/login.js'));
+app.use('/user', require('./routes/user.js'));
+app.use('/create', auth, require('./routes/create.js'));
+app.use('/post',auth, require('./routes/posts.js'));
+
+module.exports = app;

package.json

@@ -4,18 +4,21 @@
   "description": "backend for forum",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "jest",
+    "start": "nodemon index.js"
   },
   "author": "kaj van schalkwijk",
   "license": "MIT",
   "dependencies": {
-    "auth-guardian": "^1.0.2",
+    "auth-guardian": "^1.1.1",
     "bcrypt": "^5.1.1",
     "cookie-parser": "^1.4.6",
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "express": "^4.18.2",
+    "jest": "^29.7.0",
     "jsonwebtoken": "^9.0.2",
+    "supertest": "^6.3.4",
     "surrealdb.node": "^0.3.0",
     "timestringconverter": "^1.0.0"
   },

routes/create.js

@@ -0,0 +1,57 @@
+const db = require('../surreal');
+const router = require('express').Router();
+
+router.post('/', async (req, res) => {
+    try{
+        const username = req.user;
+        const {title, content} = req.body;
+
+        if(title.length > process.env.MAXTITLELENGTH) return res.status(400).json({error: "Title is too long"});
+        if(content.length > process.env.MAXCONTENTLENGTH) return res.status(400).json({error: "Content is too long"});
+        if(!title || !content) return res.status(400).json({error: "Missing title or content"});
+        if(title.length < process.env.MINTITLELENGTH) return res.status(400).json({error: "Title is too short"});
+        if(content.length < process.env.MINCONTENTLENGTH) return res.status(400).json({error: "Content is too short"});
+        if(!username) return res.status(400).json({error: "Missing username"});
+
+        const currentDate = new Date();
+        const formattedDateAndTime = currentDate.toLocaleTimeString('en-gb', { timeStyle: 'short' });
+        const formattedDate = currentDate.toLocaleDateString('en-gb');
+        const date = formattedDateAndTime + " " + formattedDate;
+
+        const newPost = await db.create('posts', {title: title, content: content, author: username, date: date});
+        postId = (newPost[0].id).slice(6);
+
+        const update = await db.query(`UPDATE users SET posts += "${postId}" WHERE username = string::lowercase("${username}")`)
+
+        res.status(200).json({message: "Post created"});
+    }
+    catch(err){
+        console.log(err);
+        res.status(500).json({error: "Internal server error"});
+    }
+});
+
+router.delete('/:id', async (req, res) => {
+    try{
+        const username = req.user;
+        const id = 'posts:' + req.params.id;
+
+        if(!username) return res.status(400).json({error: "Missing username"});
+        if(!id) return res.status(400).json({error: "Missing id"});
+
+        const post = await db.query(`SELECT * FROM posts WHERE id = "${id}"`);
+        if(post.length == 0) return res.status(400).json({error: "Post does not exist"});
+        if(post[0].author != username) return res.status(400).json({error: "You are not the author of this post"});
+
+        const deletePost = await db.query(`DELETE FROM posts WHERE id = "${id}"`);
+        const update = await db.query(`UPDATE users SET posts -= "${id}" WHERE username = string::lowercase("${username}")`)
+
+        res.status(200).json({message: "Post deleted"});
+    }
+    catch(err){
+        console.log(err);
+        res.status(500).json({error: "Internal server error"});
+    }
+});
+
+module.exports = router;

routes/login.js

@@ -0,0 +1,38 @@
+const db = require('../surreal');
+const {generateAccesToken, generateRefreshToken, generatePermtoken} = require("../auth/auth");
+const {verify} = require("../auth/password");
+const router = require('express').Router();
+const timestringconverter = require('timestringconverter');
+
+
+router.post('/', async (req, res) => {
+    const {username, password, remember} = req.body;
+
+    console.log(username)
+
+    if(!username) return res.status(400).json({error: "Username not provided"});
+    if(!password) return res.status(400).json({error: "Password not provided"});
+
+    const user = await db.query(`SELECT * FROM users WHERE username = string::lowercase("${username}")`);
+
+    if (user.length == 0) {
+        return res.status(400).json({error: 'Wrong credentials'});
+    }
+
+    const validPass = await verify(password, user[0].password);
+
+    if(!validPass) return res.status(400).json({error: "Wrong credentials"});
+
+    const accessToken = generateAccesToken(user[0].username);
+    const refreshToken = generateRefreshToken(user[0].username);
+    if(remember == true){
+        const permtoken = generatePermtoken(user[0].username);
+        res.cookie('permtoken', permtoken, {httpOnly: true, maxAge: 1000 * timestringconverter.ToSec(process.env.PERMTOKENAGE), path: '/permtoken'});
+    }
+
+    res.cookie('accessToken', accessToken, {httpOnly: true, maxAge: 1000 * timestringconverter.ToSec(process.env.ACCESSTOKENAGE)});
+    res.cookie('refreshToken', refreshToken, {httpOnly: true, maxAge: 1000 * timestringconverter.ToSec(process.env.REFRESHTOKENAGE), path: '/refreshtoken'});
+    res.status(200).json({message: 'Logged in'});
+});
+
+module.exports = router;

routes/posts.js

@@ -0,0 +1,29 @@
+const db = require('../surreal');
+const router = require('express').Router();
+
+router.post('/like/:postId', async (req, res) => {
+    const username = req.user;
+    const postId = 'posts:' + req.params.postId;
+
+    if(!username) return res.status(400).json({error: "Missing username"});
+    if(!postId) return res.status(400).json({error: "Missing postId"});
+
+    const postData = await db.query(`SELECT * FROM posts WHERE id = "${postId}"`);
+
+    //check if user already liked post
+    for(let i = 0; i < postData[0].likes.length; i++){
+        if(postData[0].likes[i] === username){
+            const post = await db.query(`UPDATE posts SET likes -= "${username}" WHERE id = "${postId}"`);
+            const user = await db.query(`UPDATE users SET likedPosts -= "${req.params.postId}" WHERE username = string::lowercase("${username}")`);
+
+            return res.status(200).json({message: "Post unliked"});
+        }
+    }
+
+    const post = await db.query(`UPDATE posts SET likes += "${username}" WHERE id = "${postId}"`);
+    const user = await db.query(`UPDATE users SET likedPosts += "${req.params.postId}" WHERE username = string::lowercase("${username}")`);
+
+    res.status(200).json({message: "Post liked"});
+});
+
+module.exports = router;

routes/register.js

@@ -0,0 +1,65 @@
+const db = require('../surreal');
+const { generateAccesToken, generateRefreshToken, generatePermtoken } = require("../auth/auth");
+const { hash, generatePassword } = require("../auth/password");
+const router = require('express').Router();
+const timestringconverter = require('timestringconverter');
+
+router.get('/password', async (req, res) => {
+    res.json({ password: generatePassword() });
+});
+
+router.post('/', async (req, res) => {
+    const { username, password, remember } = req.body;
+
+    if (!username) return res.status(400).json({ error: "Username not provided" });
+    if (!password) return res.status(400).json({ error: "Password not provided" });
+
+    if (username.length > process.env.USERNAMELENGTH) return res.status(400).json({ error: "Username too long" });
+
+    if (password.length < process.env.PASSMINLENGTH) return res.status(400).json({ error: "Password too short" });
+
+    if (password.length > process.env.PASSMAXLENGTH) return res.status(400).json({ error: "Password too long" });
+
+    if ((password.match(/[a-z]/g) || []).length < process.env.PASSMINLOWERCASE) return res.status(400).json({ error: "Password does not contain enough lowercase letters" });
+
+    if ((password.match(/[A-Z]/g) || []).length < process.env.PASSMINUPPERCASE) return res.status(400).json({ error: "Password does not contain enough uppercase letters" });
+
+    if ((password.match(/[0-9]/g) || []).length < process.env.PASSMINNUMBERS) return res.status(400).json({ error: "Password does not contain enough numbers" });
+
+    if ((password.match(/[!@#$%^&*()_+~`|}{[\]:;?><,./-]/g) || []).length < process.env.PASSMINSYMBOLS) return res.status(400).json({ error: "Password does not contain enough symbols" });
+
+    const userExists = await db.query(`SELECT * FROM users WHERE username = string::lowercase("${username}")`);
+
+    if (userExists.length != 0) {
+        return res.status(400).json({ message: 'Username already exists' });
+    }
+
+    const hashedPassword = await hash(password);
+
+    const currentDate = new Date();
+
+    const user = {
+        username: username,
+        password: hashedPassword,
+        creation: currentDate.toLocaleDateString('en-gb'),
+    }
+
+    console.log(user)
+
+    const newUser = await db.create('users', user);
+    console.log(newUser);
+
+    const accessToken = generateAccesToken(newUser[0].username);
+    const refreshToken = generateRefreshToken(newUser[0].username);
+    if (remember == true) {
+        const permtoken = generatePermtoken(newUser[0].username);
+        res.cookie('permtoken', permtoken, { httpOnly: true, maxAge: 1000 * timestringconverter.ToSec(process.env.PERMTOKENAGE), path: '/permtoken' });
+    }
+
+    res.cookie('accessToken', accessToken, { httpOnly: true, maxAge: 1000 * timestringconverter.ToSec(process.env.ACCESSTOKENAGE) });
+    res.cookie('refreshToken', refreshToken, { httpOnly: true, maxAge: 1000 * timestringconverter.ToSec(process.env.REFRESHTOKENAGE), path: '/refreshtoken' });
+
+    res.status(200).json({ message: 'User created' });
+});
+
+module.exports = router;

routes/user.js

@@ -0,0 +1,49 @@
+const db = require('../surreal');
+const router = require('express').Router();
+const middleware = require('../auth/middleware');
+
+router.get('/:username', async (req, res) => {
+    try{
+        const username = req.params.username;
+
+        if(!username) return res.status(400).json({error: "Missing username"});
+
+        const user = await db.query(`SELECT description, creation FROM users WHERE username = string::lowercase("${username}")`);
+        if(user.length == 0) return res.status(400).json({error: "User does not exist"});
+
+        const posts = await db.query(`SELECT * FROM posts WHERE author = string::lowercase("${username}")`);
+
+        const returnData = {
+            description: user[0].description,
+            creation: user[0].creation,
+            posts: posts
+        }
+
+        res.status(200).json({returnData});
+    }
+    catch(err){
+        console.log(err);
+        res.status(500).json({error: "Internal server error"});
+    }
+});
+
+router.put('/description', middleware, async (req, res) => {
+    try{
+        const username = req.user;
+        const {description} = req.body;
+
+        if(!username) return res.status(400).json({error: "Missing username"});
+        if(!description) return res.status(400).json({error: "Missing description"});
+        if(description.length > process.env.MAXDESCRIPTIONLENGTH) return res.status(400).json({error: "Description is too long"});
+
+        const update = await db.query(`UPDATE users SET description = "${description}" WHERE username = string::lowercase("${username}")`);
+
+        res.status(200).json({message: "Description updated"});
+    }
+    catch(err){
+        console.log(err);
+        res.status(500).json({error: "Internal server error"});
+    }
+});
+
+module.exports = router;

surreal.js

@@ -17,6 +17,7 @@ async function main() {
         // Select a specific namespace / database
         await db.use({ ns: 'forum', db: 'forum' });
 
+
     } catch (e) {
         console.error('ERROR', e);
     }