This is a test email sent from the admin panel of ${config.hostname}
`, + ].join("\n")}); + + res.status(200).send(out); +} \ No newline at end of file diff --git a/source/server/routes/api/v1/stats/index.ts b/source/server/routes/api/v1/admin/stats/index.ts similarity index 89% rename from source/server/routes/api/v1/stats/index.ts rename to source/server/routes/api/v1/admin/stats/index.ts index 88778ae0..94b7a3ab 100644 --- a/source/server/routes/api/v1/stats/index.ts +++ b/source/server/routes/api/v1/admin/stats/index.ts @@ -1,5 +1,5 @@ import { Request, Response } from "express"; -import { getVfs } from "../../../../utils/locals.js"; +import { getVfs } from "../../../../../utils/locals.js"; diff --git a/source/server/routes/api/v1/index.ts b/source/server/routes/api/v1/index.ts index c0669908..7acb2d0b 100644 --- a/source/server/routes/api/v1/index.ts +++ b/source/server/routes/api/v1/index.ts @@ -1,10 +1,12 @@ import path from "path"; import { Router } from "express"; +import { rateLimit } from 'express-rate-limit' + import User from "../../../auth/User.js"; import UserManager from "../../../auth/UserManager.js"; import { BadRequestError } from "../../../utils/errors.js"; -import { canAdmin, canRead, getUserManager, isAdministrator, isAdministratorOrOpen, isUser } from "../../../utils/locals.js"; +import { canAdmin, canRead, either, getUserManager, isAdministrator, isAdministratorOrOpen, isUser } from "../../../utils/locals.js"; import wrap from "../../../utils/wrapAsync.js"; import bodyParser from "body-parser"; import { getLogin, getLoginLink, sendLoginLink, postLogin } from "./login.js"; @@ -21,10 +23,10 @@ import postUser from "./users/post.js"; import handleDeleteUser from "./users/uid/delete.js"; import { handlePatchUser } from "./users/uid/patch.js"; import { postSceneHistory } from "./scenes/scene/history/post.js"; -import handleGetStats from "./stats/index.js"; +import handleGetStats from "./admin/stats/index.js"; import postScenes from "./scenes/post.js"; import patchScene from "./scenes/scene/patch.js"; - +import handleMailtest from "./admin/mailtest.js"; const router = Router(); @@ -36,9 +38,10 @@ router.use((req, res, next)=>{ //Browser should always make the request res.set("Cache-Control", "max-age=0, must-revalidate"); next(); -}) +}); -router.get("/stats", isAdministrator, wrap(handleGetStats)); +router.get("/admin/stats", isAdministrator, wrap(handleGetStats)); +router.post("/admin/mailtest", isAdministrator, wrap(handleMailtest)); router.use("/login", (req, res, next)=>{ res.append("Cache-Control", "private"); @@ -47,7 +50,14 @@ router.use("/login", (req, res, next)=>{ router.get("/login", wrap(getLogin)); router.post("/login", bodyParser.json(), postLogin); router.get("/login/:username/link", isAdministrator, wrap(getLoginLink)); -router.post("/login/:username/link", wrap(sendLoginLink)); +router.post("/login/:username/link", either(isAdministrator, rateLimit({ + //Special case of real low rate-limiting for non-admin users to send emails + windowMs: 1 * 60 * 1000, // 1 minute + limit: 1, // Limit each IP to 1 request per `window`. + standardHeaders: 'draft-7', + legacyHeaders: false, +})), wrap(sendLoginLink)); + router.post("/logout", postLogout); diff --git a/source/server/routes/api/v1/login.ts b/source/server/routes/api/v1/login.ts index 06e67756..f42313ad 100644 --- a/source/server/routes/api/v1/login.ts +++ b/source/server/routes/api/v1/login.ts @@ -2,9 +2,8 @@ import { createHmac } from "crypto"; import { Request, RequestHandler, Response } from "express"; import User, { SafeUser } from "../../../auth/User.js"; import { BadRequestError, ForbiddenError, HTTPError } from "../../../utils/errors.js"; -import { getHost, getUser, getUserManager } from "../../../utils/locals.js"; +import { AppLocals, getHost, getUser, getUserManager } from "../../../utils/locals.js"; import sendmail from "../../../utils/mails/send.js"; -import { recoverAccount } from "../../../utils/mails/templates.js"; /** * * @type {RequestHandler} @@ -102,7 +101,6 @@ export async function getLoginLink(req :Request, res :Response){ export async function sendLoginLink(req :Request, res :Response){ let {username} = req.params; - let requester = getUser(req); let userManager = getUserManager(req); let user = await userManager.getUserByName(username); @@ -115,8 +113,19 @@ export async function sendLoginLink(req :Request, res :Response){ payload, getHost(req) ); - let content = recoverAccount({link: link.toString(), expires:payload.expires}); - await sendmail(user.email, content); + + let lang = "fr"; + const mail_content = await (res.app.locals as AppLocals).templates.render(`emails/connection_${lang}`, { + name: user.username, + lang: "fr", + url: link.toString() + }); + await sendmail({ + to: user.email, + subject: "Votre lien de connexion à eCorpus", + html: mail_content, + }); + console.log("sent an account recovery mail to :", user.email); res.status(204).send(); } diff --git a/source/server/server.ts b/source/server/server.ts index 9c093b55..27c7b5d5 100644 --- a/source/server/server.ts +++ b/source/server/server.ts @@ -3,7 +3,6 @@ import path from "path"; import util from "util"; import cookieSession from "cookie-session"; import express from "express"; -import { engine } from 'express-handlebars'; import UserManager from "./auth/UserManager.js"; import { BadRequestError, HTTPError } from "./utils/errors.js"; @@ -15,6 +14,7 @@ import openDatabase from "./vfs/helpers/db.js"; import Vfs from "./vfs/index.js"; import defaultConfig from "./utils/config.js"; import User from "./auth/User.js"; +import Templates from "./utils/templates.js"; export default async function createServer(config = defaultConfig) :PromiseHi {{name}},
+Click the link below to connect automatically:
+ +This link stays valid for 30 days
+You might want to change your password in user settings to be able to reconnect in the future
+Have a great day!
diff --git a/source/server/templates/emails/connection_fr.hbs b/source/server/templates/emails/connection_fr.hbs new file mode 100644 index 00000000..199695f2 --- /dev/null +++ b/source/server/templates/emails/connection_fr.hbs @@ -0,0 +1,22 @@ + +Bonjour {{name}},
+
+ Nous venons de recevoir une demande de lien de connexion pour un compte lié à votre adresse.
+ Si vous n'êtes pas à l'origine de cette demande, vous pouvez ignorer cet email.
+
+ Sinon, vous pouvez vous connecter en cliquant sur le bouton ci-dessous. +
++ Connectez-vous +
++ Pour des raisons de sécurité, ce lien expirera dans 30 jours. +
++ Une fois connecté, n'oubliez pas de réinitialiser votre mot de passe! +
++ Pour rapporter toute erreur, vous pouvez nous contacter sur la page du projet eThesaurus +
diff --git a/source/server/templates/layouts/email.hbs b/source/server/templates/layouts/email.hbs new file mode 100644 index 00000000..b1a13682 --- /dev/null +++ b/source/server/templates/layouts/email.hbs @@ -0,0 +1,27 @@ + + + + + + + + + + {{{body}}} + + \ No newline at end of file diff --git a/source/server/utils/config.ts b/source/server/utils/config.ts index 15a9421f..ef0e96e8 100644 --- a/source/server/utils/config.ts +++ b/source/server/utils/config.ts @@ -1,4 +1,5 @@ import path from "path" +import {hostname} from "os"; const values = { @@ -15,9 +16,9 @@ const values = { dist_dir: [({root_dir}:{root_dir:string})=> path.resolve(root_dir,"dist"), toPath], assets_dir: [({root_dir}:{root_dir:string})=> path.resolve(root_dir,"assets"), toPath], trust_proxy: [true, toBool], - hostname: ["ecorpus.holusion.net", toString], + hostname: [hostname(), toString], hot_reload:[false, toBool], - smart_host: ["localhost", toString], + smart_host: ["smtp://localhost", toString], verbose: [false, toBool], } as const; diff --git a/source/server/utils/locals.test.ts b/source/server/utils/locals.test.ts new file mode 100644 index 00000000..b808f678 --- /dev/null +++ b/source/server/utils/locals.test.ts @@ -0,0 +1,55 @@ +import express, { Express, NextFunction, Request, RequestHandler, Response } from "express"; +import request from "supertest"; +import { InternalError, UnauthorizedError } from "./errors.js"; +import { either } from "./locals.js"; + +//Dummy middlewares +function pass(req :Request, res :Response, next :NextFunction){ + next(); +} + +function fail(req :Request, res :Response, next :NextFunction){ + next(new UnauthorizedError()); +} + +function err(req :Request, res :Response, next :NextFunction){ + next(new InternalError()); +} + +function h(req:Request, res:Response){ + res.status(204).send(); +} + +describe("either() middleware", function(){ + let app :Express; + let handler :RequestHandler; + this.beforeEach(function(){ + app = express(); + //small trick to allow error handling : + process.nextTick(()=>{ + app.use((err:Error, req :Request, res:Response, next :NextFunction)=>{ + res.status((err as any).code ?? 500).send(err.message); + }); + }); + }); + + it("checks each middleware for a pass", async function(){ + app.get("/", either(fail, fail, pass), h); + await request(app).get("/").expect(204); + }); + + it("uses first middleware to pass", async function(){ + app.get("/", either(pass, fail), h); + await request(app).get("/").expect(204); + }); + + it("doesn't allow errors other than UnauthoriezError", async function(){ + app.get("/", either(fail, err), h); + await request(app).get("/").expect(500); + }); + + it("throws if no middleware passed", async function(){ + app.get("/", either(fail, fail), h); + await request(app).get("/").expect(401); + }); +}); \ No newline at end of file diff --git a/source/server/utils/locals.ts b/source/server/utils/locals.ts index c48a9921..cf0d0350 100644 --- a/source/server/utils/locals.ts +++ b/source/server/utils/locals.ts @@ -5,12 +5,14 @@ import User, { SafeUser } from "../auth/User.js"; import UserManager, { AccessType, AccessTypes } from "../auth/UserManager.js"; import Vfs, { GetFileParams } from "../vfs/index.js"; import { BadRequestError, ForbiddenError, HTTPError, InternalError, NotFoundError, UnauthorizedError } from "./errors.js"; +import Templates from "./templates.js"; export interface AppLocals extends Record- Bonjour, -
-
- Nous venons de recevoir une demande de lien de connexion pour un compte lié à votre adresse.
- Si vous n'êtes pas à l'origine de cette demande, vous pouvez ignorer cet email.
-
- Sinon, vous pouvez vous connecter en cliquant sur le bouton ci-dessous. -
-- Connectez-vous -
-- Pour des raisons de sécurité, ce lien expirera le ${p.expires.toLocaleDateString("fr")} à ${p.expires.toLocaleTimeString("fr")}. -
-- Une fois connecté, n'oubliez pas de réinitialiser votre mot de passe! -
-Pour rapporter toute erreur, vous pouvez nous contacter sur la page du projet eThesaurus -`, - -'text':` - Bonjour, - \tNous venons de recevoir une demande de lien de connexion pour un compte lié à votre adresse. - Si vous n'êtes pas à l'origine de cette demande, vous pouvez ignorer cet email. - - Sinon, vous pouvez vous connecter en cliquant sur le lien ci-dessous. - - ${p.link} - - Pour des raisons de sécurité, ce lien expirera le ${p.expires.toLocaleDateString("fr")} à ${p.expires.toLocaleTimeString("fr")}. - - Une fois connecté, n'oubliez pas de réinitialiser votre mot de passe! - - Pour rapporter toute erreur, vous pouvez nous contacter sur la page du projet eThesaurus: https://github.com/Holusion/e-thesaurus -`.replace(/^ +/gm, ""), -}) diff --git a/source/server/utils/templates.test.ts b/source/server/utils/templates.test.ts new file mode 100644 index 00000000..2ff75879 --- /dev/null +++ b/source/server/utils/templates.test.ts @@ -0,0 +1,141 @@ +import fs from "fs/promises"; +import {tmpdir} from "os"; +import path from "path"; +import { fileURLToPath } from 'url'; + +import Templates from "./templates.js"; +import express, { Express, NextFunction, Request, Response } from "express"; +import request from "supertest"; + +const thisDir = path.dirname(fileURLToPath(import.meta.url)); + +describe("Templates", function(){ + + describe("in test directory", function(){ + let dir:string; + this.beforeAll(async function(){ + dir = await fs.mkdtemp(path.join(tmpdir(), "ecorpus_templates_test")); + await fs.mkdir(path.join(dir, "layouts")); + }); + + this.afterAll(async function(){ + await fs.rm(dir, {recursive: true}); + }); + + describe("with a basic template", function(){ + let tmpl :string; + let t :Templates + this.beforeAll(async function(){ + tmpl = path.join(dir, "home.hbs"); + await fs.writeFile(tmpl, "Hello {{name}}"); + t = new Templates({dir, cache: false}); + }); + this.afterAll(async function(){ + await fs.rm(tmpl); + }) + + it("renders a template", async function(){ + let txt = await t.render(tmpl, {name: "World", layout: null}); + expect(txt).to.be.a.string; + expect(txt).to.equal("Hello World"); + }); + + it("renders a template with relative path", async function(){ + let txt = await t.render(path.basename(tmpl), {name: "World", layout: null}); + expect(txt).to.be.a.string; + expect(txt).to.equal("Hello World"); + }); + + it("renders a template without file extension", async function(){ + let txt = await t.render(path.basename(tmpl.slice(0,-4)), {name: "World", layout: null}); + expect(txt).to.be.a.string; + expect(txt).to.equal("Hello World"); + }); + + it("renders a template with default layout", async function(){ + await fs.writeFile(path.join(dir, "layouts", "main.hbs"), "