/rows/` endpoints. When creating or updating user data through this endpoint, we need to provide the raw passwords, which are then automatically hashed before being stored in the `_hashed_password` field. This extra step enhances the security of the stored passwords.
134 |
135 | When creating a user, the required fields are `username` and `password`. However, you also have the flexibility to include additional optional fields. To do this, you will need to modify the schema of the `_users` table in your database using a suitable database editor GUI tool. Simply add the desired field(s) to the database schema for the `_users` table. Once the schema is updated, you can pass the optional field(s) from your client application during user creation.
136 |
137 | Furthermore, when retrieving user data, the endpoint automatically filters out sensitive information such as the `_hashed_password` and `_salt` fields. This precautionary measure is in place to address security concerns and ensure that only necessary and non-sensitive information is included in the returned results.
138 |
139 | #### Revoked Refresh Tokens
140 |
141 | When you send a request to log in to Soul using the `/token/obtain` endpoint, you will receive `Access` and `Refresh` tokens. These tokens can be stored in a secure client environment. You can then send a request to the `/token/refresh` endpoint to refresh your access token when it expires.
142 |
143 | When you log out of Soul, the `Access` and `Refresh` tokens are removed. However, there might be instances where you log out before the refresh token expires, allowing these tokens to be reused by other users. To handle this issue, Soul saves removed refresh tokens temporarily in a table named `revoked_access_tokens`. Each time you attempt to refresh your access token, Soul checks if the `Refresh` token you are using is valid. If you try to reuse a revoked refresh token, Soul will throw an error.
144 |
--------------------------------------------------------------------------------
/src/controllers/auth/token.js:
--------------------------------------------------------------------------------
1 | const { authService } = require('../../services');
2 | const { responseMessages, authConstants } = require('../../constants');
3 | const config = require('../../config');
4 | const {
5 | comparePasswords,
6 | generateToken,
7 | decodeToken,
8 | toBoolean,
9 | } = require('../../utils');
10 |
11 | const { successMessage, errorMessage } = responseMessages;
12 |
13 | const obtainAccessToken = async (req, res) => {
14 | /*
15 | #swagger.tags = ['Auth']
16 | #swagger.summary = 'Obtain Access Token'
17 | #swagger.description = 'Endpoint to generate access and refresh tokens'
18 |
19 | #swagger.parameters['body'] = {
20 | in: 'body',
21 | required: true,
22 | type: 'object',
23 | schema: { $ref: '#/definitions/ObtainAccessTokenRequestBody' }
24 | }
25 | */
26 |
27 | // extract payload
28 | const { username, password } = req.body.fields;
29 |
30 | try {
31 | // check if the username exists in the Db
32 | const users = authService.getUsersByUsername({ username });
33 |
34 | if (users.length <= 0) {
35 | return res
36 | .status(401)
37 | .send({ message: errorMessage.INVALID_USERNAME_PASSWORD_ERROR });
38 | }
39 |
40 | // check if the password is valid
41 | const user = users[0];
42 | const isMatch = await comparePasswords(password, user.hashed_password);
43 |
44 | if (!isMatch) {
45 | return res
46 | .status(401)
47 | .send({ message: errorMessage.INVALID_USERNAME_PASSWORD_ERROR });
48 | /*
49 | #swagger.responses[401] = {
50 | description: 'Invalid username or password error',
51 | schema: {
52 | $ref: '#/definitions/InvalidCredentialErrorResponse'
53 | }
54 | }
55 | */
56 | }
57 |
58 | let roleIds;
59 |
60 | // if the user is not a superuser get the role and its permission from the DB
61 | if (!toBoolean(user.is_superuser)) {
62 | try {
63 | const roleData = getUsersRoleAndPermission({
64 | userId: user.id,
65 | res,
66 | });
67 |
68 | roleIds = roleData.roleIds;
69 | } catch (err) {
70 | return res
71 | .status(401)
72 | .send({ message: errorMessage.ROLE_NOT_FOUND_ERROR });
73 | }
74 | }
75 |
76 | const payload = {
77 | username: user.username,
78 | userId: user.id,
79 | isSuperuser: user.is_superuser,
80 | roleIds,
81 | };
82 |
83 | // generate an access token
84 | const accessToken = await generateToken(
85 | { subject: authConstants.ACCESS_TOKEN_SUBJECT, ...payload },
86 | config.tokenSecret,
87 | config.accessTokenExpirationTime,
88 | );
89 |
90 | // generate a refresh token
91 | const refreshToken = await generateToken(
92 | { subject: authConstants.REFRESH_TOKEN_SUBJECT, ...payload },
93 | config.tokenSecret,
94 | config.refreshTokenExpirationTime,
95 | );
96 |
97 | // set the token in the cookie
98 | let cookieOptions = { httpOnly: true, secure: false, Path: '/' };
99 | res.cookie(authConstants.ACCESS_TOKEN_SUBJECT, accessToken, cookieOptions);
100 | res.cookie(
101 | authConstants.REFRESH_TOKEN_SUBJECT,
102 | refreshToken,
103 | cookieOptions,
104 | );
105 |
106 | res
107 | .status(201)
108 | .send({ message: successMessage.SUCCESS, data: { userId: user.id } });
109 |
110 | /*
111 | #swagger.responses[201] = {
112 | description: 'Access token and Refresh token generated',
113 | schema: {
114 | $ref: '#/definitions/ObtainAccessTokenSuccessResponse'
115 | }
116 | }
117 | */
118 | } catch (error) {
119 | console.log(error);
120 | return res.status(500).json({
121 | message: errorMessage.SERVER_ERROR,
122 | });
123 | }
124 | };
125 |
126 | const refreshAccessToken = async (req, res) => {
127 | /*
128 | #swagger.tags = ['Auth']
129 | #swagger.summary = 'Refresh Access Token'
130 | #swagger.description = 'Endpoint to refresh access and refresh tokens'
131 | */
132 | const refreshTokenFromCookies = req.cookies.refreshToken;
133 |
134 | try {
135 | // check if the refresh token is revoked
136 | if (isRefreshTokenRevoked({ refreshToken: refreshTokenFromCookies })) {
137 | return res
138 | .status(403)
139 | .send({ message: errorMessage.INVALID_REFRESH_TOKEN_ERROR });
140 | }
141 |
142 | // extract the payload from the token and verify it
143 | const payload = await decodeToken(
144 | refreshTokenFromCookies,
145 | config.tokenSecret,
146 | );
147 |
148 | // find the user
149 | const users = authService.getUsersById({ userId: payload.userId });
150 |
151 | if (users.length <= 0) {
152 | return res
153 | .status(401)
154 | .send({ message: errorMessage.USER_NOT_FOUND_ERROR });
155 |
156 | /*
157 | #swagger.responses[401] = {
158 | description: 'User not found error',
159 | schema: {
160 | $ref: '#/definitions/UserNotFoundErrorResponse'
161 | }
162 | }
163 | */
164 | }
165 |
166 | let roleIds;
167 | const user = users[0];
168 |
169 | // if the user is not a superuser get the role and its permission from the DB
170 | if (!toBoolean(user.is_superuser)) {
171 | try {
172 | const roleData = getUsersRoleAndPermission({
173 | userId: user.id,
174 | });
175 |
176 | roleIds = roleData.roleIds;
177 | } catch (err) {
178 | return res
179 | .status(401)
180 | .send({ message: errorMessage.ROLE_NOT_FOUND_ERROR });
181 | }
182 | }
183 |
184 | const newPayload = {
185 | username: user.username,
186 | userId: user.id,
187 | isSuperuser: user.is_superuser,
188 | roleIds,
189 | };
190 |
191 | // generate an access token
192 | const accessToken = await generateToken(
193 | { subject: authConstants.ACCESS_TOKEN_SUBJECT, ...newPayload },
194 | config.tokenSecret,
195 | config.accessTokenExpirationTime,
196 | );
197 |
198 | // generate a refresh token
199 | const refreshToken = await generateToken(
200 | { subject: authConstants.REFRESH_TOKEN_SUBJECT, ...newPayload },
201 | config.tokenSecret,
202 | config.refreshTokenExpirationTime,
203 | );
204 |
205 | // set the token in the cookie
206 | let cookieOptions = { httpOnly: true, secure: false, Path: '/' };
207 | res.cookie(authConstants.ACCESS_TOKEN_SUBJECT, accessToken, cookieOptions);
208 | res.cookie(
209 | authConstants.REFRESH_TOKEN_SUBJECT,
210 | refreshToken,
211 | cookieOptions,
212 | );
213 |
214 | res
215 | .status(200)
216 | .send({ message: successMessage.SUCCESS, data: { userId: user.id } });
217 |
218 | /*
219 | #swagger.responses[200] = {
220 | description: 'Access token refreshed',
221 | schema: {
222 | $ref: '#/definitions/RefreshAccessTokenSuccessResponse'
223 | }
224 | }
225 | */
226 | } catch (error) {
227 | res.status(403).send({ message: errorMessage.INVALID_REFRESH_TOKEN_ERROR });
228 | /*
229 | #swagger.responses[401] = {
230 | description: 'Invalid refresh token error',
231 | schema: {
232 | $ref: '#/definitions/InvalidRefreshTokenErrorResponse'
233 | }
234 | }
235 | */
236 | }
237 | };
238 |
239 | const removeTokens = async (req, res) => {
240 | /*
241 | #swagger.tags = ['Auth']
242 | #swagger.summary = 'Remove Tokens'
243 | #swagger.description = 'Endpoint to remove access and refresh tokens'
244 | */
245 |
246 | const refreshToken = req.cookies.refreshToken;
247 |
248 | try {
249 | // decode the token
250 | const payload = await decodeToken(refreshToken, config.tokenSecret);
251 |
252 | // store the refresh token in the _revoked_refresh_tokens table
253 | authService.saveRevokedRefreshToken({
254 | refreshToken,
255 | expiresAt: payload.exp,
256 | });
257 |
258 | // remove the token from the cookie
259 | res.clearCookie(authConstants.ACCESS_TOKEN_SUBJECT);
260 | res.clearCookie(authConstants.REFRESH_TOKEN_SUBJECT);
261 |
262 | res
263 | .status(200)
264 | .send({ message: responseMessages.successMessage.LOGOUT_MESSAGE });
265 |
266 | /*
267 | #swagger.responses[200] = {
268 | description: 'Tokens Removed',
269 | schema: {
270 | $ref: '#/definitions/RemoveTokensResponse'
271 | }
272 | }
273 | */
274 | } catch (error) {
275 | res.status(500).send({ message: errorMessage.SERVER_ERROR });
276 | }
277 | };
278 |
279 | const removeRevokedRefreshTokens = () => {
280 | authService.deleteRevokedRefreshTokens({
281 | lookupField: `WHERE expires_at < CURRENT_TIMESTAMP`,
282 | });
283 | };
284 |
285 | const getUsersRoleAndPermission = ({ userId }) => {
286 | const userRoles = authService.getUserRoleByUserId({ userId });
287 |
288 | if (userRoles.length <= 0) {
289 | throw new Error(errorMessage.ROLE_NOT_FOUND_ERROR);
290 | }
291 |
292 | const roleIds = userRoles.map((role) => role.role_id);
293 |
294 | // get the permission of the role
295 | const permissions = authService.getPermissionByRoleIds({ roleIds });
296 |
297 | return { userRoles, roleIds, permissions };
298 | };
299 |
300 | const isRefreshTokenRevoked = ({ refreshToken }) => {
301 | const tokens = authService.getRevokedRefreshToken({ refreshToken });
302 | return tokens.length > 0;
303 | };
304 |
305 | module.exports = {
306 | obtainAccessToken,
307 | refreshAccessToken,
308 | removeTokens,
309 | removeRevokedRefreshTokens,
310 | };
311 |
--------------------------------------------------------------------------------
/src/controllers/auth/user.js:
--------------------------------------------------------------------------------
1 | const { rowService, authService } = require('../../services');
2 | const {
3 | apiConstants,
4 | dbConstants,
5 | responseMessages,
6 | authConstants,
7 | } = require('../../constants');
8 | const config = require('../../config');
9 | const {
10 | hashPassword,
11 | checkPasswordStrength,
12 | comparePasswords,
13 | } = require('../../utils');
14 |
15 | const { USERS_TABLE, USERS_ROLES_TABLE, tableFields } = dbConstants;
16 |
17 | const { SALT_ROUNDS } = authConstants;
18 |
19 | const { successMessage, errorMessage, infoMessage } = responseMessages;
20 |
21 | const updateSuperuser = async (fields) => {
22 | const { id, password, is_superuser } = fields;
23 | let newHashedPassword, newSalt;
24 | let fieldsString = '';
25 |
26 | try {
27 | // find the user by using the id field
28 | const users = authService.getUsersById({ userId: id });
29 |
30 | // abort if the id is invalid
31 | if (users.length === 0) {
32 | console.log(errorMessage.USER_NOT_FOUND_ERROR);
33 | process.exit(1);
34 | }
35 |
36 | // check if the is_superuser field is passed
37 | if (is_superuser !== undefined) {
38 | fieldsString = `${tableFields.IS_SUPERUSER} = '${is_superuser}'`;
39 | }
40 |
41 | // if the password is sent from the CLI, update it
42 | if (password) {
43 | // check if the password is weak
44 | if (
45 | [apiConstants.PASSWORD.TOO_WEAK, apiConstants.PASSWORD.WEAK].includes(
46 | checkPasswordStrength(password),
47 | )
48 | ) {
49 | console.log(errorMessage.WEAK_PASSWORD_ERROR);
50 | process.exit(1);
51 | }
52 |
53 | //hash the password
54 | const { hashedPassword, salt } = await hashPassword(
55 | password,
56 | SALT_ROUNDS,
57 | );
58 | newHashedPassword = hashedPassword;
59 | newSalt = salt;
60 |
61 | fieldsString = `${fieldsString ? fieldsString + ', ' : ''} ${
62 | tableFields.HASHED_PASSWORD
63 | } = '${newHashedPassword}', ${tableFields.SALT} = '${newSalt}'`;
64 | }
65 |
66 | // update the user
67 | rowService.update({
68 | tableName: USERS_TABLE,
69 | lookupField: tableFields.ID,
70 | fieldsString,
71 | pks: `${id}`,
72 | });
73 |
74 | console.log(successMessage.USER_UPDATE_SUCCESS);
75 | process.exit(1);
76 | } catch (error) {
77 | console.log(error);
78 | }
79 | };
80 |
81 | const registerUser = async (req, res) => {
82 | /*
83 | #swagger.tags = ['Auth']
84 | #swagger.summary = 'Register User'
85 | #swagger.description = 'Endpoint to signup'
86 |
87 | #swagger.parameters['username'] = {
88 | in: 'body',
89 | required: true,
90 | type: 'object',
91 | schema: { $ref: '#/definitions/UserRegistrationRequestBody' }
92 | }
93 | */
94 |
95 | const { username, password, ...optionalFields } = req.body.fields;
96 |
97 | try {
98 | if (!username) {
99 | return res
100 | .status(400)
101 | .send({ message: errorMessage.USERNAME_REQUIRED_ERROR });
102 | }
103 |
104 | if (!password) {
105 | return res
106 | .status(400)
107 | .send({ message: errorMessage.PASSWORD_REQUIRED_ERROR });
108 | }
109 |
110 | // check if the username is taken
111 | const users = authService.getUsersByUsername({ username });
112 |
113 | if (users.length > 0) {
114 | return res
115 | .status(409)
116 | .send({ message: errorMessage.USERNAME_TAKEN_ERROR });
117 |
118 | /*
119 | #swagger.responses[409] = {
120 | description: 'Username taken error',
121 | schema: {
122 | $ref: '#/definitions/UsernameTakenErrorResponse'
123 | }
124 | }
125 | */
126 | }
127 |
128 | // check if the password is weak
129 | if (
130 | [apiConstants.PASSWORD.TOO_WEAK, apiConstants.PASSWORD.WEAK].includes(
131 | checkPasswordStrength(password),
132 | )
133 | ) {
134 | return res.status(400).send({
135 | message: errorMessage.WEAK_PASSWORD_ERROR,
136 | });
137 |
138 | /*
139 | #swagger.responses[400] = {
140 | description: 'Weak password error',
141 | schema: {
142 | $ref: '#/definitions/WeakPasswordErrorResponse'
143 | }
144 | }
145 | */
146 | }
147 |
148 | // hash the password
149 | const { salt, hashedPassword } = await hashPassword(password, SALT_ROUNDS);
150 |
151 | // create the user
152 | const newUser = rowService.save({
153 | tableName: USERS_TABLE,
154 | fields: {
155 | username,
156 | salt,
157 | hashed_password: hashedPassword,
158 | is_superuser: 'false',
159 | ...optionalFields,
160 | },
161 | });
162 |
163 | // find the default role from the DB
164 | const defaultRole = authService.getDefaultRole();
165 |
166 | if (defaultRole.length <= 0) {
167 | return res.status(500).send({
168 | message: errorMessage.DEFAULT_ROLE_NOT_CREATED_ERROR,
169 | });
170 | /*
171 | #swagger.responses[500] = {
172 | description: 'Server error',
173 | schema: {
174 | $ref: '#/definitions/DefaultRoleNotCreatedErrorResponse'
175 | }
176 | }
177 | */
178 | }
179 |
180 | // create a role for the user
181 | rowService.save({
182 | tableName: USERS_ROLES_TABLE,
183 | fields: { user_id: newUser.lastInsertRowid, role_id: defaultRole[0].id },
184 | });
185 |
186 | res.status(201).send({ message: successMessage.ROW_INSERTED });
187 |
188 | /*
189 | #swagger.responses[201] = {
190 | description: 'Row inserted',
191 | schema: {
192 | $ref: '#/definitions/InsertRowSuccessResponse'
193 | }
194 | }
195 | */
196 | } catch (error) {
197 | console.log(error);
198 | res.status(500).send({ message: errorMessage.SERVER_ERROR });
199 | }
200 | };
201 |
202 | const changePassword = async (req, res) => {
203 | /*
204 | #swagger.tags = ['Auth']
205 | #swagger.summary = 'Change Password'
206 | #swagger.description = 'Endpoint to change a password'
207 |
208 | #swagger.parameters['body'] = {
209 | in: 'body',
210 | required: true,
211 | type: 'object',
212 | schema: {
213 | $ref: '#/definitions/ChangePasswordRequestBody'
214 | }
215 | }
216 | */
217 |
218 | const userInfo = req.user;
219 | const { currentPassword, newPassword } = req.body.fields;
220 |
221 | try {
222 | // get the user from the Db
223 | const users = authService.getUsersById({ userId: userInfo.userId });
224 |
225 | if (users.length <= 0) {
226 | return res
227 | .status(401)
228 | .send({ message: errorMessage.USER_NOT_FOUND_ERROR });
229 | }
230 |
231 | const user = users[0];
232 |
233 | // check if the users current password is valid
234 | const isMatch = await comparePasswords(
235 | currentPassword,
236 | user.hashed_password,
237 | );
238 |
239 | if (!isMatch) {
240 | return res
241 | .status(401)
242 | .send({ message: errorMessage.INVALID_CURRENT_PASSWORD_ERROR });
243 | /*
244 | #swagger.responses[401] = {
245 | description: 'User not found error',
246 | schema: {
247 | $ref: '#/definitions/InvalidPasswordErrorResponse'
248 | }
249 | }
250 | */
251 | }
252 |
253 | // check if the new password is strong
254 | if (
255 | [apiConstants.PASSWORD.TOO_WEAK, apiConstants.PASSWORD.WEAK].includes(
256 | checkPasswordStrength(newPassword),
257 | )
258 | ) {
259 | return res.status(400).send({
260 | message: errorMessage.WEAK_PASSWORD_ERROR,
261 | });
262 |
263 | /*
264 | #swagger.responses[400] = {
265 | description: 'Weak password error',
266 | schema: {
267 | $ref: '#/definitions/WeakPasswordErrorResponse'
268 | }
269 | }
270 | */
271 | }
272 |
273 | // hash the password
274 | const { salt, hashedPassword } = await hashPassword(
275 | newPassword,
276 | SALT_ROUNDS,
277 | );
278 |
279 | user.salt = salt;
280 | user.hashed_password = hashedPassword;
281 |
282 | // update the user
283 | rowService.update({
284 | tableName: USERS_TABLE,
285 | lookupField: tableFields.ID,
286 | fieldsString: `${tableFields.HASHED_PASSWORD} = '${hashedPassword}', ${tableFields.SALT} = '${salt}'`,
287 | pks: `${user.id}`,
288 | });
289 |
290 | res.status(200).send({
291 | message: successMessage.PASSWORD_UPDATE_SUCCESS,
292 | data: { id: user.id, username: user.username },
293 | });
294 |
295 | /*
296 | #swagger.responses[200] = {
297 | description: 'Weak password error',
298 | schema: {
299 | $ref: '#/definitions/ChangePasswordSuccessResponse'
300 | }
301 | }
302 | */
303 | } catch (error) {
304 | res.status(500).send({ message: errorMessage.SERVER_ERROR });
305 | }
306 | };
307 |
308 | const createInitialUser = async () => {
309 | // extract some fields from the environment variables or from the CLI
310 | const { initialUserUsername: username, initialUserPassword: password } =
311 | config;
312 |
313 | try {
314 | // check if there are users in the DB
315 | const users = authService.getAllUsers();
316 |
317 | if (users.length <= 0) {
318 | // check if initial users username is passed from the env or CLI
319 | if (!username) {
320 | console.error(errorMessage.INITIAL_USER_USERNAME_NOT_PASSED_ERROR);
321 | process.exit(1);
322 | }
323 |
324 | // check if initial users password is passed from the env or CLI
325 | if (!password) {
326 | console.error(errorMessage.INITIAL_USER_PASSWORD_NOT_PASSED_ERROR);
327 | process.exit(1);
328 | }
329 |
330 | // check if the usernmae is taken
331 | const users = authService.getUsersByUsername({ username });
332 |
333 | if (users.length > 0) {
334 | console.error(errorMessage.USERNAME_TAKEN_ERROR);
335 | process.exit(1);
336 | }
337 |
338 | // check if the password is strong
339 | if (
340 | [apiConstants.PASSWORD.TOO_WEAK, apiConstants.PASSWORD.WEAK].includes(
341 | checkPasswordStrength(password),
342 | )
343 | ) {
344 | console.error(errorMessage.WEAK_PASSWORD_ERROR);
345 | process.exit(1);
346 | }
347 |
348 | // hash the password
349 | const { hashedPassword, salt } = await hashPassword(
350 | password,
351 | SALT_ROUNDS,
352 | );
353 |
354 | // create the initial user
355 | const { lastInsertRowid: userId } = rowService.save({
356 | tableName: USERS_TABLE,
357 | fields: {
358 | username,
359 | hashed_password: hashedPassword,
360 | salt,
361 | is_superuser: 'false',
362 | },
363 | });
364 |
365 | // get the default role from the DB
366 | const roles = authService.getDefaultRole();
367 |
368 | if (roles.length <= 0) {
369 | console.log(errorMessage.DEFAULT_ROLE_NOT_CREATED_ERROR);
370 | process.exit(1);
371 | }
372 |
373 | const defaultRoleId = roles[0].id;
374 |
375 | // create a _users_role for the initial user
376 | rowService.save({
377 | tableName: USERS_ROLES_TABLE,
378 | fields: { user_id: userId, role_id: defaultRoleId },
379 | });
380 |
381 | console.log(successMessage.INITIAL_USER_CREATED_SUCCESS);
382 | } else {
383 | console.log(infoMessage.INITIAL_USER_ALREADY_CREATED);
384 | }
385 | } catch (error) {
386 | console.log(error);
387 | }
388 | };
389 |
390 | module.exports = {
391 | updateSuperuser,
392 | registerUser,
393 | changePassword,
394 | createInitialUser,
395 | };
396 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 |
2 | 
3 |
4 | A SQLite REST and Realtime server
5 |
6 |
7 |
8 | [](https://justforfunnoreally.dev)
9 | [](#contributors)
10 |
11 | ## Usage
12 |
13 | ### Docker
14 |
15 | > This is the preferred method as the dependency [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) is making of lot of assumptions about the system it will be installed and running on which in most cases will lead to errors when installing soul.
16 |
17 | Using the following Dockerfile:
18 |
19 |
20 | Dockerfile
21 |
22 | ```nginx
23 | # node:19-alpine amd64
24 | FROM node@sha256:d0ba7111bc031323ce2706f8e424afc868db289ba40ff55b05561cf59c123be1 AS node
25 |
26 | WORKDIR /app
27 |
28 | ENV NODE_ENV="production"
29 |
30 | COPY package-lock.json package.json ./
31 |
32 | RUN apk update && apk add python3=3.11.10-r1 build-base=0.5-r3 && npm ci
33 |
34 | COPY . .
35 |
36 | CMD [ "npm", "start" ]
37 | ```
38 |
39 |
40 | You can proceed [to building the application](https://docs.docker.com/get-started/workshop/02_our_app/#build-the-apps-image).
41 |
42 | ### npm
43 |
44 | ```bash
45 | npm install -g soul-cli
46 | ```
47 |
48 | ### 1. Running Soul
49 |
50 | Soul is command line tool, after installing it,
51 | Run `soul -d sqlite.db -p 8000` and it'll start a REST API on [http://localhost:8000](http://localhost:8000) and a Websocket server on [ws://localhost:8000](ws://localhost:8000).
52 |
53 | ```bash
54 | Usage: soul [options]
55 |
56 |
57 | Options:
58 | --version Show version number [boolean]
59 | -d, --database SQLite database file or :memory: [string] [required]
60 | -p, --port Port to listen on [number]
61 | -r, --rate-limit-enabled Enable rate limiting [boolean]
62 | -c, --cors CORS whitelist origins [string]
63 | --env, --envpath Path to load .env file [string]
64 | -a, --auth Enable authentication and authorization [boolean]
65 |
66 | --iuu, --initialuserusername Initial user username [string]
67 | --iup, --initialuserpassword Initial user password [string]
68 |
69 | --ts, --tokensecret Token Secret [string]
70 | --atet, --accesstokenexpirationtime Access Token Expiration Time (Default: 5H) [string]
71 | --rtet, --refreshtokenexpirationtime Refresh Token Expiration Time (Default: 1D) [string]
72 | -S, --studio Start Soul Studio in parallel
73 | --help Show help
74 |
75 | ```
76 |
77 | Then to test Soul is working run the following command
78 |
79 | ```bash
80 | curl http://localhost:8000/api/tables
81 | ```
82 |
83 | It should return a list of the tables inside `sqlite.db` database.
84 |
85 | ### 2. Running Soul in Auth mode
86 |
87 | To run Soul in auth mode, allowing login and signup features with authorization capabilities in your database tables, follow these steps:
88 |
89 | Run the Soul command with the necessary parameters:
90 |
91 | ```
92 |
93 | soul -d foobar.db -a --ts= --atet=4H --rtet=3D --iuu=john --iup=
94 |
95 | ```
96 |
97 | > Note: When configuring your JWT Secret, it is recommended to use a long string value for enhanced security. It is advisable to use a secret that is at least 10 characters in length.
98 |
99 | In this example:
100 |
101 | - The `-a` flag instructs Soul to run in auth mode.
102 | - The `--ts` flag allows you to pass a JWT secret value for the `access and refresh tokens` generation and verification. Replace with your desired secret value.
103 | - The `--atet` flag sets the JWT expiration time for the access token. In this case, it is set to four hours (4H), meaning the token will expire after 4 hours.
104 | - The `--rtet` flag sets the JWT expiration time for the refresh token. In this case, it is set to three days (3D), meaning the token will expire after 3 days.
105 | - The `--iuu` flag is used to pass a username for the initial user
106 | - The `--iup` flag is used to pass a password for the initial user
107 |
108 | Here are some example values for the `atet` and `rtet` flags
109 |
110 | - 60M: Represents a duration of 60 minutes.
111 | - 5H: Represents a duration of 5 hours.
112 | - 1D: Represents a duration of 1 day.
113 |
114 | NOTE: It is crucial to securely store a copy of the `--ts`(`Token Secret`) value used in Soul. Once you pass this values, make sure to keep a backup because you will need it every time you restart Soul. Losing this secret values can result in a situation where all of your users are blocked from accessing Soul.
115 |
116 | ### 3. Updating Super Users
117 |
118 | To modify a superuser information in a database, you can utilize the `updatesuperuser` command. This command allows you to change a superuser's `password` or upgrade/downgrade a normal user to a `superuser`. Below is an example of how to use it:
119 |
120 | ```
121 | soul -d foobar.db updatesuperuser --id=1 password= // Update the password for the superuser with ID 1
122 |
123 | soul -d foobar.db updatesuperuser --id=1 --is_superuser=true // Upgrade the user with ID 1 to a superuser
124 |
125 | soul -d foobar.db updatesuperuser --id=1 --is_superuser=false // Revoke the superuser role from the superuser with ID 1
126 | ```
127 |
128 | ### Passing Custom Path for .env File
129 |
130 | There might be cases where you want to pass a custom path for your `.env` file. For this, you can use the `--env` flag when running the `soul` command, providing the absolute file path of your `.env` file.
131 |
132 | ```shell
133 | soul -d foobar.db --env=/absolute/path/of/your/.env/file
134 | ```
135 |
136 | NOTE:
137 |
138 | - You should pass an absolute file path of the .env file.
139 | - Relative paths are not allowed.
140 | - Don't forget to include the .env file in the specified path.
141 |
142 | ## Documentation
143 |
144 | API documentation is available while the project is running at [http://localhost:8000/api/docs](http://localhost:8000/api/docs)
145 |
146 | There's also a list of all endpoints examples at [docs/api-examples.md](docs/api-examples.md)
147 |
148 | For websocket examples, check [docs/ws-examples.md](docs/ws-examples.md)
149 |
150 | For detailed information on how authentication works in Soul, please refer to the [docs/auth.md](docs/auth.md)
151 |
152 | ## Extending Soul
153 |
154 | Soul is able to be extended (e.g. Adding custom APIs) via extensions, you can find a list of extensions at [docs/extensions-examples.md](docs/extensions-examples.md)
155 |
156 | ## Soul-mates
157 |
158 | A collection of projects that revolve around the Soul ecosystem.
159 |
160 | - [Soul Studio](https://github.com/thevahidal/soul-studio) provides a GUI to work with your database.
161 |
162 | Right now Soul Studio is in early stages of development and not useful to work with.
163 |
164 |
165 | 
166 |
167 |
168 | - [RCO-Soul](https://github.com/DeepBlueCLtd/RCO-Soul) The purpose of this project is to demonstrate how to run a React admin client using Soul as a REST API service.
169 |
170 | - [dber](https://github.com/findyourmagic/dber) Database design tool based on entity relation diagram
171 |
172 | ## Development
173 |
174 | ```bash
175 | git clone https://github.com/thevahidal/soul # Clone project
176 |
177 | cp .env.sample .env # Duplicate sample environment variables
178 | vim .env # Update the environment variables
179 |
180 | npm install # Install dependencies
181 | npm run dev # Start the dev server
182 | ```
183 |
184 | ## Testing
185 |
186 | 1. Set the `AUTH` variable to true in your `.env` file.
187 | 2. Provide a username for the `INITIAL_USER_USERNAME` environment variable. The username should be a valid, meaningful username.
188 | 3. Provide a strong password for the `INITIAL_USER_PASSWORD` environment variable. The password should be at least 8 characters long and contain a combination of lowercase letters, uppercase letters, numbers, and special characters, for example: "Str0ng$Pw!".
189 | 4. Provider a secret for the `TOKEN_SECRET` environment variable.
190 | 5. Use the following command to run the tests:
191 |
192 | ```
193 | npm run test
194 | ```
195 |
196 | Make sure to replace the placeholders with the appropriate values for your environment.
197 |
198 | ## Hosting Static Content Using Soul
199 |
200 | You can host static content using Soul by utilizing its extensions feature. This allows you to expose your static application through Soul, enabling users to access your content without hosting multiple applications. please check [this](./docs/self-hosting.md) document
201 |
202 | ## Community
203 |
204 | [Join](https://bit.ly/soul-discord) the discussion in our Discord server and help making Soul together.
205 |
206 | ## License
207 |
208 | [MIT](https://choosealicense.com/licenses/mit/)
209 |
210 | ## Contributing
211 |
212 | Contributions are always welcome!
213 |
214 | See `CONTRIBUTING.md` for ways to get started and please adhere to `CODE OF CONDUCT`.
215 |
216 | ## Contributors ✨
217 |
218 | Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
219 |
220 |
221 |
222 |
223 |
236 |
237 |
238 |
239 |
240 |
241 |
242 | This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification.
243 |
--------------------------------------------------------------------------------
/src/controllers/rows.test.js:
--------------------------------------------------------------------------------
1 | const { not } = require('joi');
2 | const supertest = require('supertest');
3 |
4 | const app = require('../index');
5 | const config = require('../config');
6 | const { generateToken } = require('../utils');
7 |
8 | const requestWithSupertest = supertest(app);
9 |
10 | function queryString(params) {
11 | const queryString = Object.keys(params)
12 | .map((key) => `${key}=${params[key]}`)
13 | .join('&');
14 |
15 | return queryString;
16 | }
17 |
18 | describe('Rows Endpoints', () => {
19 | it('GET /tables/:name/rows should return a list of all rows', async () => {
20 | const accessToken = await generateToken(
21 | { username: 'John', isSuperuser: true },
22 | config.tokenSecret,
23 | '1H',
24 | );
25 |
26 | const res = await requestWithSupertest
27 | .get('/api/tables/users/rows')
28 | .set('Cookie', [`accessToken=${accessToken}`]);
29 |
30 | expect(res.status).toEqual(200);
31 | expect(res.type).toEqual(expect.stringContaining('json'));
32 | expect(res.body).toHaveProperty('data');
33 | expect(res.body.data).toEqual(expect.any(Array));
34 | expect(res.body.data[0]).toHaveProperty('id');
35 | expect(res.body.data[0]).toHaveProperty('firstName');
36 | expect(res.body.data[0]).toHaveProperty('lastName');
37 | });
38 |
39 | it('GET /tables/:name/rows?_limit=8&_schema=firstName,lastName&_ordering:-firstName&_page=2: should query the rows by the provided query params', async () => {
40 | const accessToken = await generateToken(
41 | { username: 'John', isSuperuser: true },
42 | config.tokenSecret,
43 | '1H',
44 | );
45 |
46 | const params = {
47 | _search: 'a',
48 | _ordering: '-firstName',
49 | _schema: 'firstName,lastName',
50 | _limit: 8,
51 | _page: 2,
52 | };
53 | const query = queryString(params);
54 | const res = await requestWithSupertest
55 | .get(`/api/tables/users/rows?${query}`)
56 | .set('Cookie', [`accessToken=${accessToken}`]);
57 |
58 | expect(res.status).toEqual(200);
59 | expect(res.type).toEqual(expect.stringContaining('json'));
60 | expect(res.body).toHaveProperty('data');
61 | expect(res.body.data).toEqual(expect.any(Array));
62 | expect(res.body.data[0]).toHaveProperty('firstName');
63 | expect(res.body.data[0]).toHaveProperty('lastName');
64 |
65 | expect(res.body.next).toEqual(
66 | `/tables/users/rows?${queryString({
67 | ...params,
68 | _page: params._page + 1,
69 | }).toString()}`,
70 | );
71 |
72 | expect(res.body.previous).toEqual(
73 | `/tables/users/rows?${queryString({
74 | ...params,
75 | _page: params._page - 1,
76 | }).toString()}`,
77 | );
78 | });
79 |
80 | it('GET /tables/:name/rows?_ordering:userId.firstName&_extend=userId: should return the rows ordered by the related table field', async () => {
81 | const accessToken = await generateToken(
82 | { username: 'John', isSuperuser: true },
83 | config.tokenSecret,
84 | '1H',
85 | );
86 |
87 | const params = {
88 | _ordering: 'userId.firstName',
89 | _extend: 'userId',
90 | };
91 | const query = queryString(params);
92 | const res = await requestWithSupertest
93 | .get(`/api/tables/posts/rows?${query}`)
94 | .set('Cookie', [`accessToken=${accessToken}`]);
95 |
96 | expect(res.status).toEqual(200);
97 | expect(res.type).toEqual(expect.stringContaining('json'));
98 | expect(res.body).toHaveProperty('data');
99 | expect(res.body.data).toEqual(expect.any(Array));
100 |
101 | const firstUserFirstName = res.body.data[1].userId_data.firstName;
102 | const secondUserFirstName = res.body.data[2].userId_data.firstName;
103 | const thirdUserFirstName = res.body.data[3].userId_data.firstName;
104 |
105 | expect(firstUserFirstName <= secondUserFirstName).toBe(true);
106 | expect(secondUserFirstName <= thirdUserFirstName).toBe(true);
107 | });
108 |
109 | it('GET /tables/:name/rows: should return a null field', async () => {
110 | const accessToken = await generateToken(
111 | { username: 'John', isSuperuser: true },
112 | config.tokenSecret,
113 | '1H',
114 | );
115 |
116 | const res = await requestWithSupertest
117 | .get('/api/tables/users/rows?_filters=firstName__null,lastName__notnull')
118 | .set('Cookie', [`accessToken=${accessToken}`]);
119 |
120 | expect(res.status).toEqual(200);
121 | expect(res.body.data[0].firstName).toBeNull();
122 | expect(res.body.data[0].lastName).not.toBeNull();
123 | });
124 |
125 | it('GET /tables/:name/rows: should successfully retrieve users created after 2010-01-01 00:00:00.', async () => {
126 | const accessToken = await generateToken(
127 | { username: 'John', isSuperuser: true },
128 | config.tokenSecret,
129 | '1H',
130 | );
131 |
132 | const date = '2010-01-01 00:00:00';
133 | const res = await requestWithSupertest
134 | .get(`/api/tables/users/rows?_filters=createdAt__gte:${date}`)
135 | .set('Cookie', [`accessToken=${accessToken}`]);
136 |
137 | res.body.data.map((user) => {
138 | const createdAt = new Date(user.createdAt);
139 | const referenceDate = new Date(date);
140 | expect(createdAt.getTime()).toBeGreaterThan(referenceDate.getTime());
141 | });
142 |
143 | expect(res.status).toEqual(200);
144 | expect(res.body.data[0]).toHaveProperty('id');
145 | expect(res.body.data[0]).toHaveProperty('firstName');
146 | expect(res.body.data[0]).toHaveProperty('lastName');
147 | expect(res.body.data[0]).toHaveProperty('createdAt');
148 | });
149 |
150 | it('GET /tables/:name/rows: should successfully retrieve users created before 2008-01-20 00:00:00.', async () => {
151 | const accessToken = await generateToken(
152 | { username: 'John', isSuperuser: true },
153 | config.tokenSecret,
154 | '1H',
155 | );
156 |
157 | const date = '2008-01-20 00:00:00';
158 | const res = await requestWithSupertest
159 | .get(`/api/tables/users/rows?_filters=createdAt__lte:${date}`)
160 | .set('Cookie', [`accessToken=${accessToken}`]);
161 |
162 | res.body.data.map((user) => {
163 | const createdAt = new Date(user.createdAt);
164 | const referenceDate = new Date(date);
165 | expect(createdAt.getTime()).toBeLessThan(referenceDate.getTime());
166 | });
167 |
168 | expect(res.status).toEqual(200);
169 | expect(res.body.data[0]).toHaveProperty('id');
170 | expect(res.body.data[0]).toHaveProperty('firstName');
171 | expect(res.body.data[0]).toHaveProperty('lastName');
172 | expect(res.body.data[0]).toHaveProperty('createdAt');
173 | });
174 |
175 | it('GET /tables/:name/rows: should successfully retrieve users created at 2013-01-08 00:00:00', async () => {
176 | const accessToken = await generateToken(
177 | { username: 'John', isSuperuser: true },
178 | config.tokenSecret,
179 | '1H',
180 | );
181 |
182 | const date = '2013-01-08 00:00:00';
183 | const res = await requestWithSupertest
184 | .get(`/api/tables/users/rows?_filters=createdAt__eq:${date}`)
185 | .set('Cookie', [`accessToken=${accessToken}`]);
186 |
187 | res.body.data.map((user) => {
188 | const createdAt = new Date(user.createdAt);
189 | const referenceDate = new Date(date);
190 | expect(createdAt.getTime()).toEqual(referenceDate.getTime());
191 | });
192 |
193 | expect(res.status).toEqual(200);
194 | expect(res.body.data[0]).toHaveProperty('id');
195 | expect(res.body.data[0]).toHaveProperty('firstName');
196 | expect(res.body.data[0]).toHaveProperty('lastName');
197 | expect(res.body.data[0]).toHaveProperty('createdAt');
198 | });
199 |
200 | it('GET /tables/:name/rows: should successfully retrieve users created at 2007-01-08 00:00:00', async () => {
201 | const accessToken = await generateToken(
202 | { username: 'John', isSuperuser: true },
203 | config.tokenSecret,
204 | '1H',
205 | );
206 |
207 | const date = '2007-01-08 00:00:00';
208 | const res = await requestWithSupertest
209 | .get(`/api/tables/users/rows?_filters=createdAt__eq:${date}`)
210 | .set('Cookie', [`accessToken=${accessToken}`]);
211 |
212 | //There are no users that are created at 2007-01-08 00:00:00 so the API should return empty data
213 | expect(res.body.data).toHaveLength(0);
214 | expect(res.status).toEqual(200);
215 | });
216 |
217 | it('GET /tables/:name/rows: should successfully retrieve users that are not created at 2021-01-08 00:00:00', async () => {
218 | const accessToken = await generateToken(
219 | { username: 'John', isSuperuser: true },
220 | config.tokenSecret,
221 | '1H',
222 | );
223 |
224 | const date = '2021-01-08 00:00:00';
225 | const res = await requestWithSupertest
226 | .get(`/api/tables/users/rows?_filters=createdAt__neq:${date}`)
227 | .set('Cookie', [`accessToken=${accessToken}`]);
228 |
229 | res.body.data.map((user) => {
230 | const createdAt = new Date(user.createdAt);
231 | const referenceDate = new Date(date);
232 | expect(createdAt.getTime()).not.toEqual(referenceDate.getTime());
233 | });
234 |
235 | expect(res.status).toEqual(200);
236 | expect(res.body.data[0]).toHaveProperty('id');
237 | expect(res.body.data[0]).toHaveProperty('firstName');
238 | expect(res.body.data[0]).toHaveProperty('lastName');
239 | expect(res.body.data[0]).toHaveProperty('createdAt');
240 | });
241 |
242 | it('POST /tables/:name/rows should insert a new row and return the lastInsertRowid', async () => {
243 | const accessToken = await generateToken(
244 | { username: 'John', isSuperuser: true },
245 | config.tokenSecret,
246 | '1H',
247 | );
248 |
249 | const res = await requestWithSupertest
250 | .post('/api/tables/users/rows')
251 | .set('Cookie', [`accessToken=${accessToken}`])
252 | .send({ fields: { firstName: 'Jane', lastName: 'Doe' } });
253 |
254 | expect(res.status).toEqual(201);
255 | expect(res.type).toEqual(expect.stringContaining('json'));
256 | expect(res.body).toHaveProperty('data');
257 | });
258 |
259 | it('GET /tables/:name/rows/:pks should return a row by its primary key', async () => {
260 | const accessToken = await generateToken(
261 | { username: 'John', isSuperuser: true },
262 | config.tokenSecret,
263 | '1H',
264 | );
265 |
266 | const res = await requestWithSupertest
267 | .get('/api/tables/users/rows/1')
268 | .set('Cookie', [`accessToken=${accessToken}`]);
269 |
270 | expect(res.status).toEqual(200);
271 | expect(res.type).toEqual(expect.stringContaining('json'));
272 | expect(res.body).toHaveProperty('data');
273 | expect(res.body.data[0]).toHaveProperty('id');
274 | expect(res.body.data[0]).toHaveProperty('firstName');
275 | expect(res.body.data[0]).toHaveProperty('lastName');
276 | });
277 |
278 | it('PUT /tables/:name/rows/:pks should update a row by its primary key and return the number of changes', async () => {
279 | const accessToken = await generateToken(
280 | { username: 'John', isSuperuser: true },
281 | config.tokenSecret,
282 | '1H',
283 | );
284 | const res = await requestWithSupertest
285 | .put('/api/tables/users/rows/1')
286 | .set('Cookie', [`accessToken=${accessToken}`])
287 | .send({ fields: { firstName: 'Jane', lastName: 'Doe' } });
288 | expect(res.status).toEqual(200);
289 | expect(res.type).toEqual(expect.stringContaining('json'));
290 | });
291 |
292 | it('DELETE /tables/:name/rows/:pks should delete a row by its primary key and return the number of changes', async () => {
293 | const accessToken = await generateToken(
294 | { username: 'John', isSuperuser: true },
295 | config.tokenSecret,
296 | '1H',
297 | );
298 |
299 | const res = await requestWithSupertest
300 | .delete('/api/tables/posts/rows/1')
301 | .set('Cookie', [`accessToken=${accessToken}`]);
302 |
303 | expect(res.status).toEqual(200);
304 | expect(res.type).toEqual(expect.stringContaining('json'));
305 | });
306 |
307 | it('POST /tables/:name/rows should insert a new row if any of the value of the object being inserted is null', async () => {
308 | const accessToken = await generateToken(
309 | { username: 'John', isSuperuser: true },
310 | config.tokenSecret,
311 | '1H',
312 | );
313 | const res = await requestWithSupertest
314 | .post('/api/tables/users/rows')
315 | .send({
316 | fields: {
317 | firstName: null,
318 | lastName: 'Doe',
319 | email: null,
320 | username: 'Jane',
321 | },
322 | })
323 | .set('Cookie', [`accessToken=${accessToken}`]);
324 | expect(res.status).toEqual(201);
325 | expect(res.type).toEqual(expect.stringContaining('json'));
326 | expect(res.body).toHaveProperty('data');
327 | });
328 |
329 | it('GET /tables/:name/rows should return values if any of the IDs from the array match the user ID.', async () => {
330 | const accessToken = await generateToken(
331 | { username: 'John', isSuperuser: true },
332 | config.tokenSecret,
333 | '1H',
334 | );
335 |
336 | const res = await requestWithSupertest
337 | .get('/api/tables/users/rows?_filters=id:[2,3]')
338 | .set('Cookie', [`accessToken=${accessToken}`]);
339 | expect(res.status).toEqual(200);
340 | expect(res.body).toHaveProperty('data');
341 | expect(res.body.data).toEqual(expect.any(Array));
342 | expect(res.body.data.length).toEqual(2);
343 | });
344 |
345 | it('GET /tables/:name/rows should return values if the provided ID matches the user ID.', async () => {
346 | const accessToken = await generateToken(
347 | { username: 'John', isSuperuser: true },
348 | config.tokenSecret,
349 | '1H',
350 | );
351 |
352 | const res = await requestWithSupertest
353 | .get(
354 | '/api/tables/users/rows?_filters=id:2,firstName:Michael,lastName:Lee',
355 | )
356 | .set('Cookie', [`accessToken=${accessToken}`]);
357 | expect(res.status).toEqual(200);
358 | expect(res.body).toHaveProperty('data');
359 | expect(res.body.data).toEqual(expect.any(Array));
360 | expect(res.body.data.length).toEqual(1);
361 | });
362 | });
363 |
--------------------------------------------------------------------------------
/src/controllers/auth.test.js:
--------------------------------------------------------------------------------
1 | const supertest = require('supertest');
2 |
3 | const app = require('../index');
4 | const config = require('../config');
5 | const { generateToken } = require('../utils');
6 | const { testData } = require('../tests/testData');
7 |
8 | const requestWithSupertest = supertest(app);
9 |
10 | describe('Auth Endpoints', () => {
11 | describe('User Endpoints', () => {
12 | it('POST /tables/_users/rows should register a user', async () => {
13 | const accessToken = await generateToken(
14 | { username: 'John', userId: 1, isSuperuser: true },
15 | config.tokenSecret,
16 | '1H',
17 | );
18 |
19 | const res = await requestWithSupertest
20 | .post('/api/tables/_users/rows')
21 | .set('Cookie', [`accessToken=${accessToken}`])
22 | .send({
23 | fields: {
24 | username: testData.users.user1.username,
25 | password: testData.strongPassword,
26 | },
27 | });
28 |
29 | expect(res.status).toEqual(201);
30 | expect(res.type).toEqual(expect.stringContaining('json'));
31 |
32 | expect(res.body).toHaveProperty('message');
33 | expect(res.body.message).toBe('Row Inserted');
34 |
35 | expect(res.body).not.toHaveProperty('password');
36 | expect(res.body).not.toHaveProperty('hashed_password');
37 | expect(res.body).not.toHaveProperty('salt');
38 | });
39 |
40 | it('POST /tables/_users/rows should throw 400 error if username is not passed', async () => {
41 | const accessToken = await generateToken(
42 | { username: 'John', isSuperuser: true },
43 | config.tokenSecret,
44 | '1H',
45 | );
46 |
47 | const res = await requestWithSupertest
48 | .post('/api/tables/_users/rows')
49 | .set('Cookie', [`accessToken=${accessToken}`])
50 | .send({
51 | fields: { password: testData.strongPassword },
52 | });
53 |
54 | expect(res.status).toEqual(400);
55 | expect(res.body.message).toBe('username is required');
56 |
57 | expect(res.body).not.toHaveProperty('password');
58 | expect(res.body).not.toHaveProperty('hashed_password');
59 | expect(res.body).not.toHaveProperty('salt');
60 | });
61 |
62 | it('POST /tables/_users/rows should throw 400 error if the password is not strong', async () => {
63 | const accessToken = await generateToken(
64 | { username: 'John', isSuperuser: true },
65 | config.tokenSecret,
66 | '1H',
67 | );
68 |
69 | const res = await requestWithSupertest
70 | .post('/api/tables/_users/rows')
71 | .set('Cookie', [`accessToken=${accessToken}`])
72 | .send({
73 | fields: {
74 | username: testData.users.user2.username,
75 | password: testData.weakPassword,
76 | },
77 | });
78 |
79 | expect(res.status).toEqual(400);
80 | expect(res.body.message).toBe(
81 | 'This password is weak, it should be at least 8 characters long and contain a combination of lowercase letters, uppercase letters, numbers, and special characters',
82 | );
83 |
84 | expect(res.body).not.toHaveProperty('password');
85 | expect(res.body).not.toHaveProperty('hashed_password');
86 | expect(res.body).not.toHaveProperty('salt');
87 | });
88 |
89 | it('POST /tables/_users/rows should throw 409 error if the username is taken', async () => {
90 | const accessToken = await generateToken(
91 | { username: 'John', isSuperuser: true },
92 | config.tokenSecret,
93 | '1H',
94 | );
95 |
96 | const res = await requestWithSupertest
97 | .post('/api/tables/_users/rows')
98 | .set('Cookie', [`accessToken=${accessToken}`])
99 | .send({
100 | fields: {
101 | username: testData.users.user1.username,
102 | password: testData.strongPassword,
103 | },
104 | });
105 |
106 | expect(res.status).toEqual(409);
107 | expect(res.body.message).toBe('This username is taken');
108 |
109 | expect(res.body).not.toHaveProperty('password');
110 | expect(res.body).not.toHaveProperty('hashed_password');
111 | expect(res.body).not.toHaveProperty('salt');
112 | });
113 |
114 | it('GET /tables/_users/rows should return list of users', async () => {
115 | const accessToken = await generateToken(
116 | { username: 'John', isSuperuser: true },
117 | config.tokenSecret,
118 | '1H',
119 | );
120 |
121 | const res = await requestWithSupertest
122 | .get('/api/tables/_users/rows')
123 | .set('Cookie', [`accessToken=${accessToken}`]);
124 |
125 | expect(res.status).toEqual(200);
126 | expect(res.body.data[0]).toHaveProperty('id');
127 | expect(res.body.data[0]).toHaveProperty('username');
128 | expect(res.body.data[0]).toHaveProperty('is_superuser');
129 | expect(res.body.data[0]).toHaveProperty('createdAt');
130 |
131 | expect(res.body.data[0]).not.toHaveProperty('password');
132 | expect(res.body.data[0]).not.toHaveProperty('hashed_password');
133 | expect(res.body.data[0]).not.toHaveProperty('salt');
134 | });
135 |
136 | it('GET /tables/_users/rows/:id should retrive a single user', async () => {
137 | const accessToken = await generateToken(
138 | { username: 'John', isSuperuser: true },
139 | config.tokenSecret,
140 | '1H',
141 | );
142 |
143 | const res = await requestWithSupertest
144 | .get('/api/tables/_users/rows/1')
145 | .set('Cookie', [`accessToken=${accessToken}`]);
146 |
147 | expect(res.status).toEqual(200);
148 | expect(res.body.data[0]).toHaveProperty('id');
149 | expect(res.body.data[0]).toHaveProperty('username');
150 | expect(res.body.data[0]).toHaveProperty('is_superuser');
151 | expect(res.body.data[0]).toHaveProperty('createdAt');
152 |
153 | expect(res.body.data[0]).not.toHaveProperty('password');
154 | expect(res.body.data[0]).not.toHaveProperty('hashed_password');
155 | expect(res.body.data[0]).not.toHaveProperty('salt');
156 | });
157 |
158 | it('PUT /tables/_users/rows/:id should update a user', async () => {
159 | const accessToken = await generateToken(
160 | { username: 'John', isSuperuser: true },
161 | config.tokenSecret,
162 | '1H',
163 | );
164 |
165 | const res = await requestWithSupertest
166 | .put('/api/tables/_users/rows/1')
167 | .set('Cookie', [`accessToken=${accessToken}`])
168 | .send({
169 | fields: {
170 | username: testData.users.user3.username,
171 | },
172 | });
173 |
174 | expect(res.status).toEqual(200);
175 | expect(res.type).toEqual(expect.stringContaining('json'));
176 |
177 | expect(res.body).toHaveProperty('message');
178 | expect(res.body.message).toBe('Row updated');
179 |
180 | expect(res.body).not.toHaveProperty('password');
181 | expect(res.body).not.toHaveProperty('hashed_password');
182 | expect(res.body).not.toHaveProperty('salt');
183 | });
184 |
185 | it('DELETE /tables/_users/rows/:id should remove a user', async () => {
186 | const accessToken = await generateToken(
187 | { username: 'John', isSuperuser: true },
188 | config.tokenSecret,
189 | '1H',
190 | );
191 |
192 | const res = await requestWithSupertest
193 | .delete('/api/tables/_users/rows/2')
194 | .set('Cookie', [`accessToken=${accessToken}`]);
195 |
196 | expect(res.status).toEqual(400);
197 | expect(res.body.message).toBe('FOREIGN KEY constraint failed');
198 |
199 | expect(res.body).not.toHaveProperty('password');
200 | expect(res.body).not.toHaveProperty('hashed_password');
201 | expect(res.body).not.toHaveProperty('salt');
202 | });
203 | });
204 |
205 | describe('Obtain Access Token Endpoint', () => {
206 | it('POST /auth/token/obtain should return an access token and refresh token values and a success message', async () => {
207 | const res = await requestWithSupertest
208 | .post('/api/auth/token/obtain')
209 | .send({
210 | fields: {
211 | username: testData.users.user1.username,
212 | password: testData.strongPassword,
213 | },
214 | });
215 |
216 | expect(res.status).toEqual(201);
217 | expect(res.type).toEqual(expect.stringContaining('json'));
218 | expect(res.body).toHaveProperty('message');
219 | expect(res.body.message).toBe('Success');
220 |
221 | expect(res.headers['set-cookie']).toBeDefined();
222 | expect(res.headers['set-cookie']).toEqual(
223 | expect.arrayContaining([
224 | expect.stringContaining('refreshToken='),
225 | expect.stringContaining('accessToken='),
226 | ]),
227 | );
228 |
229 | expect(res.body).not.toHaveProperty('password');
230 | expect(res.body).not.toHaveProperty('hashed_password');
231 | expect(res.body).not.toHaveProperty('salt');
232 | });
233 |
234 | it('POST /auth/token/obtain should throw a 401 error if the username does not exist in the DB', async () => {
235 | const res = await requestWithSupertest
236 | .post('/api/auth/token/obtain')
237 | .send({
238 | fields: {
239 | username: testData.invalidUsername,
240 | password: testData.strongPassword,
241 | },
242 | });
243 |
244 | expect(res.status).toEqual(401);
245 | expect(res.type).toEqual(expect.stringContaining('json'));
246 | expect(res.body).toHaveProperty('message');
247 | expect(res.body.message).toBe('Invalid username or password');
248 |
249 | expect(res.body).not.toHaveProperty('password');
250 | expect(res.body).not.toHaveProperty('hashed_password');
251 | expect(res.body).not.toHaveProperty('salt');
252 | });
253 |
254 | it('POST /auth/token/obtain should throw a 401 error if the password is invalid', async () => {
255 | const res = await requestWithSupertest
256 | .post('/api/auth/token/obtain')
257 | .send({
258 | fields: {
259 | username: testData.users.user1.username,
260 | password: testData.invalidPassword,
261 | },
262 | });
263 |
264 | expect(res.status).toEqual(401);
265 | expect(res.type).toEqual(expect.stringContaining('json'));
266 | expect(res.body).toHaveProperty('message');
267 | expect(res.body.message).toBe('Invalid username or password');
268 |
269 | expect(res.body).not.toHaveProperty('password');
270 | expect(res.body).not.toHaveProperty('hashed_password');
271 | expect(res.body).not.toHaveProperty('salt');
272 | });
273 | });
274 |
275 | describe('Refresh Access Token Endpoint', () => {
276 | it('GET /auth/token/refresh should refresh the access and refresh tokens', async () => {
277 | const refreshToken = await generateToken(
278 | { username: 'John', userId: 1, isSuperuser: true },
279 | config.tokenSecret,
280 | '1H',
281 | );
282 |
283 | const res = await requestWithSupertest
284 | .get('/api/auth/token/refresh')
285 | .set('Cookie', [`refreshToken=${refreshToken}`]);
286 |
287 | expect(res.status).toEqual(200);
288 | expect(res.type).toEqual(expect.stringContaining('json'));
289 | expect(res.body).toHaveProperty('message');
290 | expect(res.body.message).toBe('Success');
291 |
292 | expect(res.headers['set-cookie']).toBeDefined();
293 | expect(res.headers['set-cookie']).toEqual(
294 | expect.arrayContaining([
295 | expect.stringContaining('refreshToken='),
296 | expect.stringContaining('accessToken='),
297 | ]),
298 | );
299 | });
300 | });
301 |
302 | describe('Change Password Endpoint', () => {
303 | it('PUT /auth/change-password/ should change a password', async () => {
304 | const accessToken = await generateToken(
305 | { username: 'John', userId: 2, isSuperuser: true },
306 | config.tokenSecret,
307 | '1H',
308 | );
309 |
310 | const res = await requestWithSupertest
311 | .put('/api/auth/change-password')
312 | .set('Cookie', [`accessToken=${accessToken}`])
313 | .send({
314 | fields: {
315 | currentPassword: testData.strongPassword,
316 | newPassword: testData.strongPassword2,
317 | },
318 | });
319 |
320 | expect(res.status).toEqual(200);
321 | expect(res.type).toEqual(expect.stringContaining('json'));
322 | expect(res.body).toHaveProperty('message');
323 | expect(res.body.message).toBe('Password updated successfully');
324 |
325 | expect(res.body).not.toHaveProperty('password');
326 | expect(res.body).not.toHaveProperty('hashed_password');
327 | expect(res.body).not.toHaveProperty('salt');
328 |
329 | // check if the password is really updated
330 | const res2 = await requestWithSupertest
331 | .post('/api/auth/token/obtain')
332 | .send({
333 | fields: {
334 | username: testData.users.user1.username,
335 | password: testData.strongPassword2,
336 | },
337 | });
338 |
339 | expect(res2.status).toEqual(201);
340 | expect(res2.type).toEqual(expect.stringContaining('json'));
341 | expect(res2.body).toHaveProperty('message');
342 | expect(res2.body.message).toBe('Success');
343 | });
344 |
345 | it('PUT /auth/change-password/ should throw 401 error if the current password is not valid', async () => {
346 | const accessToken = await generateToken(
347 | { username: 'John', userId: 2, isSuperuser: true },
348 | config.tokenSecret,
349 | '1H',
350 | );
351 |
352 | const res = await requestWithSupertest
353 | .put('/api/auth/change-password')
354 | .set('Cookie', [`accessToken=${accessToken}`])
355 | .send({
356 | fields: {
357 | currentPassword: testData.invalidPassword,
358 | newPassword: testData.strongPassword2,
359 | },
360 | });
361 |
362 | expect(res.status).toEqual(401);
363 | expect(res.type).toEqual(expect.stringContaining('json'));
364 | expect(res.body).toHaveProperty('message');
365 | expect(res.body.message).toBe('Invalid current password');
366 |
367 | expect(res.body).not.toHaveProperty('password');
368 | expect(res.body).not.toHaveProperty('hashed_password');
369 | expect(res.body).not.toHaveProperty('salt');
370 | });
371 | });
372 | });
373 |
--------------------------------------------------------------------------------
