From ea4e19554b10118de47d5e60fd0cd44f90072d10 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Thu, 24 Oct 2024 10:58:25 +0800 Subject: [PATCH 1/6] 403 -> 401 for incorrect password since 403 will be used for refresh tokens later --- Server/controllers/authController.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Server/controllers/authController.js b/Server/controllers/authController.js index fa59b4d05..3948934a2 100644 --- a/Server/controllers/authController.js +++ b/Server/controllers/authController.js @@ -279,10 +279,10 @@ const editUser = async (req, res, next) => { const user = await req.db.getUserByEmail(email); // Compare passwords const match = await user.comparePassword(req.body.password); - // If not a match, throw a 403 + // If not a match, throw a 401 if (!match) { const error = new Error(errorMessages.AUTH_INCORRECT_PASSWORD); - error.status = 403; + error.status = 401; next(error); return; } From 084ef9b9527646d4bd509f04b8dbbf8ef99577b2 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Thu, 24 Oct 2024 10:59:46 +0800 Subject: [PATCH 2/6] Remove redundant check for user in requestRecovery method --- Server/controllers/authController.js | 41 ++++++++++++---------------- 1 file changed, 18 insertions(+), 23 deletions(-) diff --git a/Server/controllers/authController.js b/Server/controllers/authController.js index 3948934a2..ee701c111 100644 --- a/Server/controllers/authController.js +++ b/Server/controllers/authController.js @@ -346,32 +346,27 @@ const requestRecovery = async (req, res, next) => { try { const { email } = req.body; const user = await req.db.getUserByEmail(email); - if (user) { - const recoveryToken = await req.db.requestRecoveryToken(req, res); - const name = user.firstName; - const email = req.body.email; - const { clientHost } = req.settingsService.getSettings(); - const url = `${clientHost}/set-new-password/${recoveryToken.token}`; + const recoveryToken = await req.db.requestRecoveryToken(req, res); + const name = user.firstName; + const { clientHost } = req.settingsService.getSettings(); + const url = `${clientHost}/set-new-password/${recoveryToken.token}`; - const msgId = await req.emailService.buildAndSendEmail( - "passwordResetTemplate", - { - name, - email, - url, - }, + const msgId = await req.emailService.buildAndSendEmail( + "passwordResetTemplate", + { + name, email, - "Bluewave Uptime Password Reset" - ); + url, + }, + email, + "Bluewave Uptime Password Reset" + ); - return res.status(200).json({ - success: true, - msg: successMessages.AUTH_CREATE_RECOVERY_TOKEN, - data: msgId, - }); - } else { - throw new Error(errorMessages.FRIENDLY_ERROR); - } + return res.status(200).json({ + success: true, + msg: successMessages.AUTH_CREATE_RECOVERY_TOKEN, + data: msgId, + }); } catch (error) { next(handleError(error, SERVICE_NAME, "recoveryRequestController")); } From bc8e509b173a2c34dd8748226f1777c107019873 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Thu, 24 Oct 2024 11:00:45 +0800 Subject: [PATCH 3/6] remove redundant user check in deleteUser --- Server/controllers/authController.js | 7 ------- 1 file changed, 7 deletions(-) diff --git a/Server/controllers/authController.js b/Server/controllers/authController.js index ee701c111..b718f3c8e 100644 --- a/Server/controllers/authController.js +++ b/Server/controllers/authController.js @@ -350,7 +350,6 @@ const requestRecovery = async (req, res, next) => { const name = user.firstName; const { clientHost } = req.settingsService.getSettings(); const url = `${clientHost}/set-new-password/${recoveryToken.token}`; - const msgId = await req.emailService.buildAndSendEmail( "passwordResetTemplate", { @@ -425,7 +424,6 @@ const resetPassword = async (req, res, next) => { } try { const user = await req.db.resetPassword(req, res); - const appSettings = await req.settingsService.getSettings(); const token = issueToken(user._doc, tokenType.ACCESS_TOKEN, appSettings); res.status(200).json({ @@ -455,11 +453,6 @@ const deleteUser = async (req, res, next) => { // Check if the user exists const user = await req.db.getUserByEmail(email); - if (!user) { - next(new Error(errorMessages.DB_USER_NOT_FOUND)); - return; - } - // 1. Find all the monitors associated with the team ID if superadmin const result = await req.db.getMonitorsByTeamId({ From 18081ceb77cf0f3fcb5d0daad11d986524262111 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Thu, 24 Oct 2024 11:01:17 +0800 Subject: [PATCH 4/6] fix typo in userModule --- Server/db/mongo/modules/userModule.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Server/db/mongo/modules/userModule.js b/Server/db/mongo/modules/userModule.js index 7afe04763..f90e2e354 100644 --- a/Server/db/mongo/modules/userModule.js +++ b/Server/db/mongo/modules/userModule.js @@ -68,7 +68,7 @@ const insertUser = async (userData, imageFile) => { const getUserByEmail = async (email) => { try { // Need the password to be able to compare, removed .select() - // We can strip the hash before returing the user + // We can strip the hash before returning the user const user = await UserModel.findOne({ email: email }).select("-profileImage"); if (user) { return user; From 73dcc3f4ed765d4a0947e0dcbbcfbaabab91e65f Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Thu, 24 Oct 2024 11:06:05 +0800 Subject: [PATCH 5/6] Fix test for deleteUser --- Server/tests/controllers/authController.test.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Server/tests/controllers/authController.test.js b/Server/tests/controllers/authController.test.js index d9329e54e..9b9c64cd5 100644 --- a/Server/tests/controllers/authController.test.js +++ b/Server/tests/controllers/authController.test.js @@ -812,9 +812,9 @@ describe("Auth Controller - deleteUser", () => { afterEach(() => { sinon.restore(); }); - it("should return 404 if user is not found", async () => { + it("should throw an error if user is not found", async () => { jwt.decode.returns({ email: "test@example.com" }); - req.db.getUserByEmail.resolves(null); + req.db.getUserByEmail.throws(new Error(errorMessages.DB_USER_NOT_FOUND)); await deleteUser(req, res, next); From 86eaae1754b2993db4000ddf3b677c2452909cfd Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Thu, 24 Oct 2024 11:06:40 +0800 Subject: [PATCH 6/6] Fix test to expect 401 instead of 403 --- Server/tests/controllers/authController.test.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Server/tests/controllers/authController.test.js b/Server/tests/controllers/authController.test.js index 9b9c64cd5..cff7554cd 100644 --- a/Server/tests/controllers/authController.test.js +++ b/Server/tests/controllers/authController.test.js @@ -467,7 +467,7 @@ describe("Auth Controller - editUser", async () => { }); await editUser(req, res, next); expect(next.firstCall.args[0]).to.be.an("error"); - expect(next.firstCall.args[0].status).to.equal(403); + expect(next.firstCall.args[0].status).to.equal(401); expect(next.firstCall.args[0].message).to.equal( errorMessages.AUTH_INCORRECT_PASSWORD );