fix auth + add passwd

tacxou · tacxou · commit a1950920843d · 2024-03-28T17:13:20.000+01:00
diff --git a/src/core/agents/_schemas/_parts/security.part.schema.ts b/src/core/agents/_schemas/_parts/security.part.schema.ts
diff --git a/src/core/agents/_schemas/_parts/state.part.schema.ts b/src/core/agents/_schemas/_parts/state.part.schema.ts
diff --git a/src/core/agents/_schemas/agents.schema.ts b/src/core/agents/_schemas/agents.schema.ts
@@ -1,7 +1,7 @@
 import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
 import { AbstractSchema } from '~/_common/abstracts/schemas/abstract.schema';
-import { StatePart, StatePartSchema } from '~/core/agents/_schemas/parts/state.part.schema';
-import { SecurityPart, SecurityPartSchema } from '~/core/agents/_schemas/parts/security.part.schema';
+import { StatePart, StatePartSchema } from '~/core/agents/_schemas/_parts/state.part.schema';
+import { SecurityPart, SecurityPartSchema } from '~/core/agents/_schemas/_parts/security.part.schema';
 import { MixedValue } from '~/_common/types/mixed-value.type';
 
 const DEFAULT_THIRD_PARTY_AUTH = 'local';
diff --git a/src/core/agents/agents.controller.ts b/src/core/agents/agents.controller.ts
@@ -22,6 +22,7 @@ export class AgentsController extends AbstractController {
     // entityId: 1,
     username: 1,
     displayName: 1,
+    email: 1,
     state: 1,
     hidden: 1,
   };
diff --git a/src/core/agents/agents.service.ts b/src/core/agents/agents.service.ts
@@ -1,12 +1,45 @@
 import { Injectable } from '@nestjs/common';
 import { InjectModel } from '@nestjs/mongoose';
 import { Agents } from '~/core/agents/_schemas/agents.schema';
-import { Model } from 'mongoose';
+import { Document, Model, ModifyResult, Query, QueryOptions, SaveOptions, Types, UpdateQuery } from 'mongoose';
 import { AbstractServiceSchema } from '~/_common/abstracts/abstract.service.schema';
+import { AgentsCreateDto } from './_dto/agents.dto';
+import { hash } from 'argon2';
 
 @Injectable()
 export class AgentsService extends AbstractServiceSchema {
   constructor(@InjectModel(Agents.name) protected _model: Model<Agents>) {
     super();
   }
+
+  public async create<T extends Agents | Document>(
+    data?: AgentsCreateDto,
+    options?: SaveOptions,
+  ): Promise<Document<T, any, T>> {
+    data.password = await hash(data.password);
+    return await super.create(data, options);
+  }
+
+  public async update<T extends Agents | Document>(
+    _id: Types.ObjectId | any,
+    update: UpdateQuery<T> & any,
+    options?: QueryOptions<T>,
+  ): Promise<ModifyResult<Query<T, T, any, T>>> {
+    if (update.password) {
+      update.password = await hash(update.password);
+    }
+    if (update.$set?.password) {
+      update.$set.password = await hash(update.$set.password);
+    }
+    return await super.update(
+      _id,
+      {
+        ...update,
+        $set: {
+          ...(update?.$set || {}),
+        },
+      },
+      options,
+    );
+  }
 }
diff --git a/src/core/logger/_schemas/_parts/data.part.schema.ts b/src/core/logger/_schemas/_parts/data.part.schema.ts
@@ -0,0 +1,21 @@
+import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
+import { Document } from 'mongoose';
+
+export const DEFAULT_DATA_TYPE = 'default';
+
+@Schema({ _id: false })
+export class DataPart extends Document {
+  @Prop({
+    type: String,
+    default: DEFAULT_DATA_TYPE,
+  })
+  public type?: string;
+
+  @Prop({
+    type: String,
+    required: true,
+  })
+  public message: string;
+}
+
+export const DataPartSchema = SchemaFactory.createForClass(DataPart);
diff --git a/src/core/logger/_schemas/logger.schema.ts b/src/core/logger/_schemas/logger.schema.ts
@@ -0,0 +1,46 @@
+import { Prop, Schema, SchemaFactory } from '@nestjs/mongoose';
+import { Document } from 'mongoose';
+import { AbstractSchema } from '~/_common/abstracts/schemas/abstract.schema';
+import { DataPart, DataPartSchema } from './_parts/data.part.schema';
+
+export const DEFAULT_CONTEXT = 'default';
+export type LoggerDocument = Logger & Document;
+
+@Schema({ versionKey: false })
+export class Logger extends AbstractSchema {
+  @Prop({
+    type: String,
+    required: true,
+  })
+  public level: string;
+
+  @Prop({
+    type: DataPartSchema,
+    required: true,
+    default: {},
+  })
+  public data: DataPart;
+
+  /**
+   * @description The context of the log message.
+   * @example 'identity'
+   */
+  @Prop({ type: String })
+  public context?: string;
+
+  /**
+   * @description The concerned document in collection of the log message.
+   * @example '5f7b1b3b7f7b1b3b7f7b1b3b'
+   */
+  @Prop({ type: String })
+  public concerned?: string;
+}
+
+export const LoggerSchema = SchemaFactory.createForClass(Logger).pre(
+  'save',
+  function (this: Logger, next: () => void): void {
+    this.context = this.context.toLocaleLowerCase() || DEFAULT_CONTEXT;
+    this.concerned = this.concerned.toLocaleLowerCase() || null;
+    next();
+  },
+);
diff --git a/src/core/logger/internal.logger.ts b/src/core/logger/internal.logger.ts
@@ -144,7 +144,6 @@ export class InternalLogger extends ConsoleLogger {
     },
     options: InternalLogOptions,
   ): void {
-    console.log('logging');
     const data = payload.message instanceof Object ? payload.message : { message: payload.message };
     const metadata = {
       createdAt: new Date(),
@@ -161,8 +160,8 @@ export class InternalLogger extends ConsoleLogger {
         metadata,
       });
     } catch (e) {
-      super.error('Failed to log to the database', e, this.constructor.name);
-      console.log('Failed to log to the database', e);
+      super.fatal('Failed to log to the database', e, this.constructor.name);
+      super[payload.level](payload.message, ...payload.context);
     }
   }
 }
diff --git a/src/core/logger/logger.module.ts b/src/core/logger/logger.module.ts
@@ -1,6 +1,6 @@
 import { Module } from '@nestjs/common';
 import { MongooseModule } from '@nestjs/mongoose';
-import { LoggerSchema, Logger } from './schemas/logger.schema';
+import { LoggerSchema, Logger } from './_schemas/logger.schema';
 import { LoggerService } from './logger.service';
 import { LoggerController } from './logger.controller';
 
diff --git a/src/core/logger/schemas/logger.schema.ts b/src/core/logger/schemas/logger.schema.ts
diff --git a/src/management/passwd/dto/ask-token.dto.ts b/src/management/passwd/dto/ask-token.dto.ts
@@ -0,0 +1,10 @@
+import { IsInt, IsString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+export class AskTokenDto {
+    @IsString()
+    @ApiProperty({ example: 'paul.bismuth',description: 'User  Uid' })
+    uid: string;
+    @ApiProperty({ example: 'monemail@mondomaine.com',description: 'secondary mail' })
+    @IsString()
+    mail: string
+}
diff --git a/src/management/passwd/dto/change-password.dto.ts b/src/management/passwd/dto/change-password.dto.ts
@@ -0,0 +1,13 @@
+import { IsInt, IsString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+export class ChangePasswordDto {
+    @IsString()
+    @ApiProperty({ example: 'paul.bismuth',description: 'User  Uid' })
+    uid: string;
+    @ApiProperty({ example: 'MyOldPassword',description: 'Old Password' })
+    @IsString()
+    oldPassword:string;
+    @ApiProperty({ example: 'MyNewPassword',description: 'New Password' })
+    @IsString()
+    newPassword: string;
+}
diff --git a/src/management/passwd/dto/reset-password.dto.ts b/src/management/passwd/dto/reset-password.dto.ts
@@ -0,0 +1,10 @@
+import { IsInt, IsString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+export class ResetPasswordDto {
+    @IsString()
+    @ApiProperty({ example: 'S9nv9vjxdW7bS0haoWUmdJ3XPbSJ7dSdRj2ND1z9RvqLK/sF1LKZpfnWDvLX1dZuG0WGEyAb9A==',description: 'Token' })
+    token: string;
+    @ApiProperty({ example: 'MyNewPassword',description: 'New Password' })
+    @IsString()
+    newPassword: string;
+}
diff --git a/src/management/passwd/dto/verify-token.dto.ts b/src/management/passwd/dto/verify-token.dto.ts
@@ -0,0 +1,7 @@
+import { IsInt, IsString } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+export class VerifyTokenDto {
+    @ApiProperty({ example: 'S9nv9vjxdW7bS0haoWUmdJ3XPbSJ7dSdRj2ND1z9RvqLK/sF1LKZpfnWDvLX1dZuG0WGEyAb9A==',description: 'token received by getToken' })
+    @IsString()
+    token: string
+}
diff --git a/src/management/passwd/passwd.controller.ts b/src/management/passwd/passwd.controller.ts
@@ -0,0 +1,80 @@
+import { Controller, Post, Body, Res, UseGuards, Logger } from '@nestjs/common';
+import { PasswdService } from './passwd.service';
+import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth } from '@nestjs/swagger';
+import { Response } from 'express';
+import { ChangePasswordDto } from './dto/change-password.dto';
+import { AuthGuard } from '@nestjs/passport';
+import { AskTokenDto } from './dto/ask-token.dto';
+import { VerifyTokenDto } from './dto/verify-token.dto';
+import { ResetPasswordDto } from './dto/reset-password.dto';
+
+@Controller('passwd')
+@ApiTags('passwd')
+export class PasswdController {
+  private readonly logger = new Logger(PasswdController.name);
+
+  constructor(private passwdService: PasswdService) {}
+
+  @Post('change')
+  @ApiOperation({ summary: 'change password' })
+  @ApiResponse({ status: 200, description: 'Password has been successfully changed.' })
+  @ApiResponse({ status: 403, description: 'Old password wrong' })
+  @ApiResponse({ status: 500, description: 'Backend error' })
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard('api-key'))
+  async change(@Body() cpwd: ChangePasswordDto, @Res() res: Response): Promise<Response> {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const [_, data] = await this.passwdService.change(cpwd);
+    data.data.uid = cpwd.uid;
+    this.logger.log('call passwd change for : ' + cpwd.uid);
+
+    if (data.data.status === 0) {
+      return res.status(200).json(data);
+    } else {
+      if (data.data.status === 1) {
+        return res.status(403).json(data);
+      }
+      return res.status(200).json(data);
+    }
+  }
+
+  @Post('gettoken')
+  @ApiOperation({ summary: 'ask token for reseting password' })
+  @ApiResponse({ status: 200, description: 'Token', content: {} })
+  @ApiResponse({ status: 500, description: 'Backend error' })
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard('api-key'))
+  async gettoken(@Body() asktoken: AskTokenDto, @Res() res: Response): Promise<Response> {
+    this.logger.log('GetToken for : ' + asktoken.uid);
+    const data = await this.passwdService.askToken(asktoken);
+    const ret = { token: data };
+    return res.status(200).json(ret);
+  }
+  @Post('verifytoken')
+  @ApiOperation({ summary: 'ask token for reseting password' })
+  @ApiResponse({ status: 201, description: 'Token OK' })
+  @ApiResponse({ status: 500, description: 'Token KO' })
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard('api-key'))
+  async verifyToken(@Body() token: VerifyTokenDto, @Res() res: Response): Promise<Response> {
+    this.logger.log('Verify token : ' + token.token);
+    if (await this.passwdService.verifyToken(token.token)) {
+      return res.status(200).json({ status: 0 });
+    }
+    return res.status(200).json({ status: 1 });
+  }
+  @Post('reset')
+  @ApiOperation({ summary: 'reset password' })
+  @ApiResponse({ status: 200, description: 'Reset OK' })
+  @ApiResponse({ status: 500, description: 'Reset KO' })
+  @ApiBearerAuth()
+  @UseGuards(AuthGuard('api-key'))
+  async reset(@Body() data: ResetPasswordDto, @Res() res: Response): Promise<Response> {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const [_, resetData] = await this.passwdService.reset(data);
+    if (resetData.status === 0) {
+      return res.status(200).json(resetData);
+    }
+    return res.status(200).json({ status: 1, error: 'invalid token' });
+  }
+}
diff --git a/src/management/passwd/passwd.module.ts b/src/management/passwd/passwd.module.ts
@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { PasswdService } from './passwd.service';
+import { PasswdController } from './passwd.controller';
+import {ConfigModule} from "@nestjs/config";
+
+@Module({
+  imports: [PasswdModule,ConfigModule
+  ],
+  controllers: [PasswdController],
+  providers: [PasswdService],
+})
+export class PasswdModule {}
diff --git a/src/management/passwd/passwd.service.ts b/src/management/passwd/passwd.service.ts
@@ -0,0 +1,72 @@
+import { Injectable } from '@nestjs/common';
+import { ChangePasswordDto } from './dto/change-password.dto';
+import { Job, Queue, QueueEvents } from 'bullmq';
+import * as crypto from 'crypto';
+import { AskTokenDto } from './dto/ask-token.dto';
+import Redis from 'ioredis';
+import { ResetPasswordDto } from './dto/reset-password.dto';
+import { ActionType } from '~/core/backends/_enum/action-type.enum';
+import { AbstractService } from '~/_common/abstracts/abstract.service';
+import { BackendsService } from '~/core/backends/backends.service';
+import { InjectRedis } from '@nestjs-modules/ioredis';
+
+@Injectable()
+export class PasswdService extends AbstractService {
+  public constructor(
+    protected backends: BackendsService,
+    @InjectRedis() private readonly redis: Redis,
+  ) {
+    super();
+  }
+
+  public async change(passwd: ChangePasswordDto): Promise<[Job, any]> {
+    return await this.backends.executeJob(ActionType.IDENTITY_PASSWORD_CHANGE, passwd, {
+      async: false,
+    });
+  }
+
+  public async askToken(askToken: AskTokenDto): Promise<string> {
+    const iv = crypto.randomBytes(12).toString('base64');
+    const key = crypto.randomBytes(16).toString('hex');
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const dataStruct = { uid: askToken.uid, mail: askToken.mail };
+    let ciphertext = cipher.update(JSON.stringify(dataStruct), 'utf8', 'base64');
+    ciphertext += cipher.final('base64');
+    const tag = cipher.getAuthTag();
+    const tokenStruct = JSON.stringify({ k: key, iv: iv, tag: tag });
+    await this.redis.set(ciphertext, tokenStruct);
+    await this.redis.expire(ciphertext, 3600);
+    return ciphertext;
+  }
+
+  public async verifyToken(token: string): Promise<boolean> {
+    const data = await this.decryptToken(token);
+    return Object.keys(data).length === 0;
+  }
+
+  public async decryptToken(token: string): Promise<any> {
+    if (!(await this.redis.exists(token))) {
+      throw new Error('Token not found');
+    }
+
+    const result = await this.redis.get(token);
+    const cypherData = JSON.parse(result);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', cypherData.k, cypherData.iv);
+    decipher.setAuthTag(Buffer.from(cypherData.tag, 'base64'));
+    const plaintext = decipher.update(token, 'base64', 'ascii');
+
+    return JSON.parse(plaintext);
+  }
+
+  public async reset(data: ResetPasswordDto): Promise<[Job, any]> {
+    const tokenData = await this.decryptToken(data.token);
+    if (Object.keys(tokenData).length === 0) {
+      throw new Error('Invalid token');
+    }
+
+    const backendData = { uid: tokenData.uid, newPassword: data.newPassword };
+    return await this.backends.executeJob(ActionType.IDENTITY_PASSWORD_RESET, backendData, {
+      async: false,
+    });
+  }
+}

Original file line number	Diff line number	Diff line change
`@@ -144,7 +144,6 @@ export class InternalLogger extends ConsoleLogger {`
`144`	`144`	`},`
`145`	`145`	`options: InternalLogOptions,`
`146`	`146`	`): void {`
`147`		`- console.log('logging');`
`148`	`147`	`const data = payload.message instanceof Object ? payload.message : { message: payload.message };`
`149`	`148`	`const metadata = {`
`150`	`149`	`createdAt: new Date(),`
`@@ -161,8 +160,8 @@ export class InternalLogger extends ConsoleLogger {`
`161`	`160`	`metadata,`
`162`	`161`	`});`
`163`	`162`	`} catch (e) {`
`164`		`- super.error('Failed to log to the database', e, this.constructor.name);`
`165`		`- console.log('Failed to log to the database', e);`
	`163`	`+ super.fatal('Failed to log to the database', e, this.constructor.name);`
	`164`	`+ super[payload.level](payload.message, ...payload.context);`
`166`	`165`	`}`
`167`	`166`	`}`
`168`	`167`	`}`