fix security
This commit is contained in:
David
parent
3a2a14b5b7
commit
9e8f157d70
@ -18,11 +18,19 @@ REDIS_PORT=6379
|
||||
REDIS_PASSWORD=xpeditis_redis_password
|
||||
REDIS_DB=0
|
||||
|
||||
# JWT
|
||||
# JWT (JWT_SECRET must be at least 32 characters)
|
||||
JWT_SECRET=your-super-secret-jwt-key-change-this-in-production
|
||||
JWT_ACCESS_EXPIRATION=15m
|
||||
JWT_REFRESH_EXPIRATION=7d
|
||||
|
||||
# Auth cookies — domain shared between frontend and API in production
|
||||
# (e.g. .xpeditis.com). Leave unset for localhost development.
|
||||
# COOKIE_DOMAIN=.xpeditis.com
|
||||
|
||||
# Secret used to derive carrier document passwords (min 16 chars).
|
||||
# Falls back to JWT_SECRET when unset.
|
||||
# DOCUMENT_PASSWORD_SECRET=your-document-password-secret
|
||||
|
||||
# OAuth2 - Google
|
||||
GOOGLE_CLIENT_ID=your-google-client-id
|
||||
GOOGLE_CLIENT_SECRET=your-google-client-secret
|
||||
|
||||
@ -74,7 +74,7 @@ EXPOSE 4000
|
||||
|
||||
# Health check
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
|
||||
CMD node -e "require('http').get('http://localhost:4000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
|
||||
CMD node -e "require('http').get('http://localhost:4000/api/v1/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
|
||||
|
||||
# Set environment variables
|
||||
ENV NODE_ENV=production \
|
||||
|
||||
3378
apps/backend/package-lock.json
generated
3378
apps/backend/package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@ -51,6 +51,7 @@
|
||||
"class-transformer": "^0.5.1",
|
||||
"class-validator": "^0.14.2",
|
||||
"compression": "^1.8.1",
|
||||
"cookie-parser": "^1.4.7",
|
||||
"csv-parse": "^6.1.0",
|
||||
"exceljs": "^4.4.0",
|
||||
"handlebars": "^4.7.8",
|
||||
@ -87,6 +88,7 @@
|
||||
"@nestjs/testing": "^10.2.10",
|
||||
"@types/bcrypt": "^5.0.2",
|
||||
"@types/compression": "^1.8.1",
|
||||
"@types/cookie-parser": "^1.4.10",
|
||||
"@types/express": "^4.17.21",
|
||||
"@types/jest": "^29.5.11",
|
||||
"@types/multer": "^2.0.0",
|
||||
|
||||
@ -39,6 +39,7 @@ import { CsvRateModule } from './infrastructure/carriers/csv-loader/csv-rate.mod
|
||||
|
||||
// Import global guards
|
||||
import { ApiKeyOrJwtGuard } from './application/guards/api-key-or-jwt.guard';
|
||||
import { HealthController } from './application/controllers/health.controller';
|
||||
import { CustomThrottlerGuard } from './application/guards/throttle.guard';
|
||||
|
||||
@Module({
|
||||
@ -59,9 +60,14 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
|
||||
REDIS_HOST: Joi.string().required(),
|
||||
REDIS_PORT: Joi.number().default(6379),
|
||||
REDIS_PASSWORD: Joi.string().required(),
|
||||
JWT_SECRET: Joi.string().required(),
|
||||
JWT_SECRET: Joi.string().min(32).required(),
|
||||
JWT_ACCESS_EXPIRATION: Joi.string().default('15m'),
|
||||
JWT_REFRESH_EXPIRATION: Joi.string().default('7d'),
|
||||
// Cookie domain for auth cookies (e.g. ".xpeditis.com" so the frontend
|
||||
// and API subdomains share them). Unset = host-only (fine for localhost).
|
||||
COOKIE_DOMAIN: Joi.string().optional(),
|
||||
// Secret used to derive carrier document passwords (falls back to JWT_SECRET)
|
||||
DOCUMENT_PASSWORD_SECRET: Joi.string().min(16).optional(),
|
||||
// SMTP Configuration
|
||||
SMTP_HOST: Joi.string().required(),
|
||||
SMTP_PORT: Joi.number().default(2525),
|
||||
@ -185,7 +191,7 @@ import { CustomThrottlerGuard } from './application/guards/throttle.guard';
|
||||
ApiKeysModule,
|
||||
LogsModule,
|
||||
],
|
||||
controllers: [],
|
||||
controllers: [HealthController],
|
||||
providers: [
|
||||
// Global authentication guard — supports both JWT (frontend) and API key (Gold/Platinium)
|
||||
// All routes are protected by default, use @Public() to bypass
|
||||
|
||||
@ -21,6 +21,7 @@ import {
|
||||
} from '@domain/ports/out/organization.repository';
|
||||
import { Organization } from '@domain/entities/organization.entity';
|
||||
import { EmailPort, EMAIL_PORT } from '@domain/ports/out/email.port';
|
||||
import { CachePort, CACHE_PORT } from '@domain/ports/out/cache.port';
|
||||
import { v4 as uuidv4 } from 'uuid';
|
||||
import { RegisterOrganizationDto } from '../dto/auth-login.dto';
|
||||
import { SubscriptionService } from '../services/subscription.service';
|
||||
@ -34,6 +35,7 @@ export interface JwtPayload {
|
||||
plan?: string; // subscription plan (BRONZE, SILVER, GOLD, PLATINIUM)
|
||||
planFeatures?: string[]; // plan feature flags
|
||||
type: 'access' | 'refresh';
|
||||
rememberMe?: boolean; // drives auth cookie persistence across refreshes
|
||||
}
|
||||
|
||||
@Injectable()
|
||||
@ -47,6 +49,8 @@ export class AuthService {
|
||||
private readonly organizationRepository: OrganizationRepository,
|
||||
@Inject(EMAIL_PORT)
|
||||
private readonly emailService: EmailPort,
|
||||
@Inject(CACHE_PORT)
|
||||
private readonly cache: CachePort,
|
||||
@InjectRepository(PasswordResetTokenOrmEntity)
|
||||
private readonly passwordResetTokenRepository: Repository<PasswordResetTokenOrmEntity>,
|
||||
private readonly jwtService: JwtService,
|
||||
@ -93,6 +97,11 @@ export class AuthService {
|
||||
// - Otherwise, default to USER
|
||||
let userRole: UserRole;
|
||||
if (invitationRole) {
|
||||
// Invitations can only grant non-admin roles — reject anything else
|
||||
const allowedInvitationRoles: UserRole[] = [UserRole.MANAGER, UserRole.USER, UserRole.VIEWER];
|
||||
if (!allowedInvitationRoles.includes(invitationRole as UserRole)) {
|
||||
throw new BadRequestException('Invalid invitation role');
|
||||
}
|
||||
userRole = invitationRole as UserRole;
|
||||
} else if (organizationData) {
|
||||
// User creating a new organization becomes MANAGER
|
||||
@ -146,7 +155,8 @@ export class AuthService {
|
||||
*/
|
||||
async login(
|
||||
email: string,
|
||||
password: string
|
||||
password: string,
|
||||
rememberMe = false
|
||||
): Promise<{ accessToken: string; refreshToken: string; user: any }> {
|
||||
this.logger.log(`Login attempt for: ${email}`);
|
||||
|
||||
@ -166,7 +176,7 @@ export class AuthService {
|
||||
throw new UnauthorizedException('Invalid credentials');
|
||||
}
|
||||
|
||||
const tokens = await this.generateTokens(user);
|
||||
const tokens = await this.generateTokens(user, rememberMe);
|
||||
|
||||
this.logger.log(`User logged in successfully: ${email}`);
|
||||
|
||||
@ -188,7 +198,7 @@ export class AuthService {
|
||||
*/
|
||||
async refreshAccessToken(
|
||||
refreshToken: string
|
||||
): Promise<{ accessToken: string; refreshToken: string }> {
|
||||
): Promise<{ accessToken: string; refreshToken: string; rememberMe: boolean }> {
|
||||
try {
|
||||
const payload = await this.jwtService.verifyAsync<JwtPayload>(refreshToken, {
|
||||
secret: this.configService.get('JWT_SECRET'),
|
||||
@ -198,23 +208,66 @@ export class AuthService {
|
||||
throw new UnauthorizedException('Invalid token type');
|
||||
}
|
||||
|
||||
if (await this.isRefreshTokenRevoked(refreshToken)) {
|
||||
throw new UnauthorizedException('Refresh token has been revoked');
|
||||
}
|
||||
|
||||
const user = await this.userRepository.findById(payload.sub);
|
||||
|
||||
if (!user || !user.isActive) {
|
||||
throw new UnauthorizedException('User not found or inactive');
|
||||
}
|
||||
|
||||
const tokens = await this.generateTokens(user);
|
||||
const rememberMe = payload.rememberMe === true;
|
||||
const tokens = await this.generateTokens(user, rememberMe);
|
||||
|
||||
this.logger.log(`Access token refreshed for user: ${user.email}`);
|
||||
|
||||
return tokens;
|
||||
return { ...tokens, rememberMe };
|
||||
} catch (error: any) {
|
||||
this.logger.error(`Token refresh failed: ${error?.message || 'Unknown error'}`);
|
||||
throw new UnauthorizedException('Invalid or expired refresh token');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout — revoke the refresh token so it can no longer be used.
|
||||
* The revocation list lives in Redis with a TTL matching the token's
|
||||
* remaining lifetime, so entries clean themselves up.
|
||||
*/
|
||||
async logout(refreshToken?: string): Promise<void> {
|
||||
if (!refreshToken) {
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
const payload = this.jwtService.decode(refreshToken) as JwtPayload & { exp?: number };
|
||||
const remainingSeconds = payload?.exp
|
||||
? Math.max(payload.exp - Math.floor(Date.now() / 1000), 1)
|
||||
: 7 * 24 * 60 * 60;
|
||||
|
||||
await this.cache.set(this.revokedTokenKey(refreshToken), true, remainingSeconds);
|
||||
this.logger.log(`Refresh token revoked for user: ${payload?.email ?? 'unknown'}`);
|
||||
} catch (error) {
|
||||
// Never block logout on revocation failures — log and continue
|
||||
this.logger.error(`Failed to revoke refresh token: ${error}`);
|
||||
}
|
||||
}
|
||||
|
||||
private async isRefreshTokenRevoked(refreshToken: string): Promise<boolean> {
|
||||
try {
|
||||
return (await this.cache.get<boolean>(this.revokedTokenKey(refreshToken))) === true;
|
||||
} catch (error) {
|
||||
this.logger.error(`Failed to check refresh token revocation: ${error}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
private revokedTokenKey(refreshToken: string): string {
|
||||
const hash = crypto.createHash('sha256').update(refreshToken).digest('hex');
|
||||
return `auth:revoked-refresh:${hash}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initiate password reset — generates token and sends email
|
||||
*/
|
||||
@ -234,13 +287,15 @@ export class AuthService {
|
||||
{ usedAt: new Date() }
|
||||
);
|
||||
|
||||
// Generate a secure random token
|
||||
// Generate a secure random token; only its hash is stored so a database
|
||||
// leak cannot be used to take over accounts via pending reset tokens
|
||||
const token = crypto.randomBytes(32).toString('hex');
|
||||
const tokenHash = this.hashResetToken(token);
|
||||
const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
|
||||
|
||||
await this.passwordResetTokenRepository.save({
|
||||
userId: user.id,
|
||||
token,
|
||||
token: tokenHash,
|
||||
expiresAt,
|
||||
usedAt: null,
|
||||
});
|
||||
@ -254,7 +309,9 @@ export class AuthService {
|
||||
* Reset password using token from email
|
||||
*/
|
||||
async resetPassword(token: string, newPassword: string): Promise<void> {
|
||||
const resetToken = await this.passwordResetTokenRepository.findOne({ where: { token } });
|
||||
const resetToken = await this.passwordResetTokenRepository.findOne({
|
||||
where: { token: this.hashResetToken(token) },
|
||||
});
|
||||
|
||||
if (!resetToken) {
|
||||
throw new BadRequestException('Token de réinitialisation invalide ou expiré');
|
||||
@ -293,6 +350,10 @@ export class AuthService {
|
||||
this.logger.log(`Password reset successfully for user: ${user.email}`);
|
||||
}
|
||||
|
||||
private hashResetToken(token: string): string {
|
||||
return crypto.createHash('sha256').update(token).digest('hex');
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate user from JWT payload
|
||||
*/
|
||||
@ -309,7 +370,10 @@ export class AuthService {
|
||||
/**
|
||||
* Generate access and refresh tokens
|
||||
*/
|
||||
private async generateTokens(user: User): Promise<{ accessToken: string; refreshToken: string }> {
|
||||
private async generateTokens(
|
||||
user: User,
|
||||
rememberMe = false
|
||||
): Promise<{ accessToken: string; refreshToken: string }> {
|
||||
// ADMIN users always get PLATINIUM plan with no expiration
|
||||
let plan = 'BRONZE';
|
||||
let planFeatures: string[] = [];
|
||||
@ -355,6 +419,7 @@ export class AuthService {
|
||||
plan,
|
||||
planFeatures,
|
||||
type: 'refresh',
|
||||
rememberMe,
|
||||
};
|
||||
|
||||
const [accessToken, refreshToken] = await Promise.all([
|
||||
|
||||
@ -35,7 +35,11 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
|
||||
private readonly authService: AuthService
|
||||
) {
|
||||
super({
|
||||
jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
|
||||
jwtFromRequest: ExtractJwt.fromExtractors([
|
||||
ExtractJwt.fromAuthHeaderAsBearerToken(),
|
||||
// httpOnly cookie set by the auth endpoints (XSS-safe storage)
|
||||
(req: { cookies?: Record<string, string> }) => req?.cookies?.accessToken ?? null,
|
||||
]),
|
||||
ignoreExpiration: false,
|
||||
secretOrKey: configService.get<string>('JWT_SECRET'),
|
||||
});
|
||||
|
||||
@ -8,10 +8,15 @@ import {
|
||||
Get,
|
||||
Inject,
|
||||
NotFoundException,
|
||||
UnauthorizedException,
|
||||
InternalServerErrorException,
|
||||
Logger,
|
||||
Req,
|
||||
Res,
|
||||
} from '@nestjs/common';
|
||||
import type { Request, Response } from 'express';
|
||||
import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth } from '@nestjs/swagger';
|
||||
import { Throttle } from '@nestjs/throttler';
|
||||
import { AuthService } from '../auth/auth.service';
|
||||
import {
|
||||
LoginDto,
|
||||
@ -29,6 +34,24 @@ import { JwtAuthGuard } from '../guards/jwt-auth.guard';
|
||||
import { UserRepository, USER_REPOSITORY } from '@domain/ports/out/user.repository';
|
||||
import { UserMapper } from '../mappers/user.mapper';
|
||||
import { InvitationService } from '../services/invitation.service';
|
||||
import {
|
||||
AUTH_COOKIE_NAMES,
|
||||
authCookieOptions,
|
||||
} from '../../infrastructure/security/security.config';
|
||||
|
||||
const REFRESH_COOKIE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
|
||||
|
||||
/**
|
||||
* Escape user-provided text before interpolating it into HTML emails
|
||||
*/
|
||||
function escapeHtml(value: string): string {
|
||||
return value
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/"/g, '"')
|
||||
.replace(/'/g, ''');
|
||||
}
|
||||
|
||||
/**
|
||||
* Authentication Controller
|
||||
@ -52,6 +75,33 @@ export class AuthController {
|
||||
@Inject(EMAIL_PORT) private readonly emailService: EmailPort
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Deliver tokens as httpOnly cookies so they are out of reach of XSS.
|
||||
* When rememberMe is false the cookies are session-scoped (cleared when
|
||||
* the browser closes); otherwise they persist for the refresh window.
|
||||
*/
|
||||
private setAuthCookies(
|
||||
res: Response,
|
||||
tokens: { accessToken: string; refreshToken: string },
|
||||
rememberMe: boolean
|
||||
): void {
|
||||
const maxAgeMs = rememberMe ? REFRESH_COOKIE_MAX_AGE_MS : undefined;
|
||||
res.cookie(AUTH_COOKIE_NAMES.accessToken, tokens.accessToken, authCookieOptions({ maxAgeMs }));
|
||||
res.cookie(
|
||||
AUTH_COOKIE_NAMES.refreshToken,
|
||||
tokens.refreshToken,
|
||||
authCookieOptions({ maxAgeMs })
|
||||
);
|
||||
// Readable flag (no token inside) so the frontend knows a session exists
|
||||
res.cookie(AUTH_COOKIE_NAMES.session, '1', authCookieOptions({ maxAgeMs, httpOnly: false }));
|
||||
}
|
||||
|
||||
private clearAuthCookies(res: Response): void {
|
||||
res.clearCookie(AUTH_COOKIE_NAMES.accessToken, authCookieOptions());
|
||||
res.clearCookie(AUTH_COOKIE_NAMES.refreshToken, authCookieOptions());
|
||||
res.clearCookie(AUTH_COOKIE_NAMES.session, authCookieOptions({ httpOnly: false }));
|
||||
}
|
||||
|
||||
/**
|
||||
* Register a new user
|
||||
*
|
||||
@ -61,6 +111,7 @@ export class AuthController {
|
||||
* @returns Access token, refresh token, and user info
|
||||
*/
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 5, ttl: 60000 } })
|
||||
@Post('register')
|
||||
@HttpCode(HttpStatus.CREATED)
|
||||
@ApiOperation({
|
||||
@ -80,7 +131,10 @@ export class AuthController {
|
||||
status: 400,
|
||||
description: 'Validation error (invalid email, weak password, etc.)',
|
||||
})
|
||||
async register(@Body() dto: RegisterDto): Promise<AuthResponseDto> {
|
||||
async register(
|
||||
@Body() dto: RegisterDto,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
): Promise<AuthResponseDto> {
|
||||
// If invitation token is provided, verify and use it
|
||||
let invitationOrganizationId: string | undefined;
|
||||
let invitationRole: string | undefined;
|
||||
@ -101,12 +155,14 @@ export class AuthController {
|
||||
dto.lastName = dto.lastName || invitation.lastName;
|
||||
}
|
||||
|
||||
// Joining an existing organization is only allowed through a verified
|
||||
// invitation token — never from a caller-supplied organization ID.
|
||||
const result = await this.authService.register(
|
||||
dto.email,
|
||||
dto.password,
|
||||
dto.firstName,
|
||||
dto.lastName,
|
||||
invitationOrganizationId || dto.organizationId,
|
||||
invitationOrganizationId,
|
||||
dto.organization,
|
||||
invitationRole
|
||||
);
|
||||
@ -116,6 +172,8 @@ export class AuthController {
|
||||
await this.invitationService.markInvitationAsUsed(dto.invitationToken);
|
||||
}
|
||||
|
||||
this.setAuthCookies(res, result, false);
|
||||
|
||||
return {
|
||||
accessToken: result.accessToken,
|
||||
refreshToken: result.refreshToken,
|
||||
@ -132,6 +190,7 @@ export class AuthController {
|
||||
* @returns Access token, refresh token, and user info
|
||||
*/
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 5, ttl: 60000 } })
|
||||
@Post('login')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOperation({
|
||||
@ -147,8 +206,14 @@ export class AuthController {
|
||||
status: 401,
|
||||
description: 'Invalid credentials or inactive account',
|
||||
})
|
||||
async login(@Body() dto: LoginDto): Promise<AuthResponseDto> {
|
||||
const result = await this.authService.login(dto.email, dto.password);
|
||||
async login(
|
||||
@Body() dto: LoginDto,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
): Promise<AuthResponseDto> {
|
||||
const rememberMe = dto.rememberMe === true;
|
||||
const result = await this.authService.login(dto.email, dto.password, rememberMe);
|
||||
|
||||
this.setAuthCookies(res, result, rememberMe);
|
||||
|
||||
return {
|
||||
accessToken: result.accessToken,
|
||||
@ -166,6 +231,7 @@ export class AuthController {
|
||||
* @returns New access token
|
||||
*/
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 20, ttl: 60000 } })
|
||||
@Post('refresh')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOperation({
|
||||
@ -175,10 +241,10 @@ export class AuthController {
|
||||
})
|
||||
@ApiResponse({
|
||||
status: 200,
|
||||
description: 'Token refreshed successfully',
|
||||
description: 'Token refreshed successfully — new tokens are set as httpOnly cookies',
|
||||
schema: {
|
||||
properties: {
|
||||
accessToken: { type: 'string', example: 'eyJhbGciOiJIUzI1NiIs...' },
|
||||
success: { type: 'boolean', example: true },
|
||||
},
|
||||
},
|
||||
})
|
||||
@ -186,27 +252,40 @@ export class AuthController {
|
||||
status: 401,
|
||||
description: 'Invalid or expired refresh token',
|
||||
})
|
||||
async refresh(@Body() dto: RefreshTokenDto): Promise<{ accessToken: string }> {
|
||||
const result = await this.authService.refreshAccessToken(dto.refreshToken);
|
||||
async refresh(
|
||||
@Body() dto: RefreshTokenDto,
|
||||
@Req() req: Request,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
): Promise<{ success: boolean }> {
|
||||
// Prefer the httpOnly cookie; fall back to the body for legacy clients
|
||||
const refreshToken = req.cookies?.[AUTH_COOKIE_NAMES.refreshToken] || dto.refreshToken;
|
||||
|
||||
return { accessToken: result.accessToken };
|
||||
if (!refreshToken) {
|
||||
this.clearAuthCookies(res);
|
||||
throw new UnauthorizedException('No refresh token provided');
|
||||
}
|
||||
|
||||
const result = await this.authService.refreshAccessToken(refreshToken);
|
||||
|
||||
this.setAuthCookies(res, result, result.rememberMe);
|
||||
|
||||
// Tokens are intentionally NOT returned in the body: an XSS payload could
|
||||
// otherwise call this endpoint and exfiltrate a fresh access token.
|
||||
return { success: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout (placeholder)
|
||||
* Logout
|
||||
*
|
||||
* Currently a no-op endpoint. With JWT, logout is typically handled client-side
|
||||
* by removing tokens. For more security, implement token blacklisting with Redis.
|
||||
*
|
||||
* @returns Success message
|
||||
* Revokes the refresh token (Redis blacklist) and clears the auth cookies.
|
||||
* The access token naturally expires within 15 minutes.
|
||||
*/
|
||||
@UseGuards(JwtAuthGuard)
|
||||
@Public()
|
||||
@Post('logout')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiBearerAuth()
|
||||
@ApiOperation({
|
||||
summary: 'Logout',
|
||||
description: 'Logout the current user. Currently handled client-side by removing tokens.',
|
||||
description: 'Revoke the refresh token and clear authentication cookies.',
|
||||
})
|
||||
@ApiResponse({
|
||||
status: 200,
|
||||
@ -217,9 +296,15 @@ export class AuthController {
|
||||
},
|
||||
},
|
||||
})
|
||||
async logout(): Promise<{ message: string }> {
|
||||
// TODO: Implement token blacklisting with Redis for more security
|
||||
// For now, logout is handled client-side by removing tokens
|
||||
async logout(
|
||||
@Req() req: Request,
|
||||
@Res({ passthrough: true }) res: Response
|
||||
): Promise<{ message: string }> {
|
||||
const refreshToken = req.cookies?.[AUTH_COOKIE_NAMES.refreshToken];
|
||||
|
||||
await this.authService.logout(refreshToken);
|
||||
this.clearAuthCookies(res);
|
||||
|
||||
return { message: 'Logout successful' };
|
||||
}
|
||||
|
||||
@ -227,6 +312,7 @@ export class AuthController {
|
||||
* Contact form — forwards message to contact@xpeditis.com
|
||||
*/
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 3, ttl: 60000 } })
|
||||
@Post('contact')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOperation({
|
||||
@ -245,7 +331,13 @@ export class AuthController {
|
||||
other: 'Autre',
|
||||
};
|
||||
|
||||
const subjectLabel = subjectLabels[dto.subject] || dto.subject;
|
||||
const subjectLabel = escapeHtml(subjectLabels[dto.subject] || dto.subject);
|
||||
const firstName = escapeHtml(dto.firstName);
|
||||
const lastName = escapeHtml(dto.lastName);
|
||||
const email = escapeHtml(dto.email);
|
||||
const company = dto.company ? escapeHtml(dto.company) : undefined;
|
||||
const phone = dto.phone ? escapeHtml(dto.phone) : undefined;
|
||||
const message = escapeHtml(dto.message);
|
||||
|
||||
const html = `
|
||||
<div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
|
||||
@ -256,14 +348,14 @@ export class AuthController {
|
||||
<table style="width: 100%; border-collapse: collapse;">
|
||||
<tr>
|
||||
<td style="padding: 8px 0; color: #666; width: 130px; font-size: 14px;">Nom</td>
|
||||
<td style="padding: 8px 0; color: #222; font-weight: bold; font-size: 14px;">${dto.firstName} ${dto.lastName}</td>
|
||||
<td style="padding: 8px 0; color: #222; font-weight: bold; font-size: 14px;">${firstName} ${lastName}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="padding: 8px 0; color: #666; font-size: 14px;">Email</td>
|
||||
<td style="padding: 8px 0; font-size: 14px;"><a href="mailto:${dto.email}" style="color: #34CCCD;">${dto.email}</a></td>
|
||||
<td style="padding: 8px 0; font-size: 14px;"><a href="mailto:${email}" style="color: #34CCCD;">${email}</a></td>
|
||||
</tr>
|
||||
${dto.company ? `<tr><td style="padding: 8px 0; color: #666; font-size: 14px;">Entreprise</td><td style="padding: 8px 0; color: #222; font-size: 14px;">${dto.company}</td></tr>` : ''}
|
||||
${dto.phone ? `<tr><td style="padding: 8px 0; color: #666; font-size: 14px;">Téléphone</td><td style="padding: 8px 0; color: #222; font-size: 14px;">${dto.phone}</td></tr>` : ''}
|
||||
${company ? `<tr><td style="padding: 8px 0; color: #666; font-size: 14px;">Entreprise</td><td style="padding: 8px 0; color: #222; font-size: 14px;">${company}</td></tr>` : ''}
|
||||
${phone ? `<tr><td style="padding: 8px 0; color: #666; font-size: 14px;">Téléphone</td><td style="padding: 8px 0; color: #222; font-size: 14px;">${phone}</td></tr>` : ''}
|
||||
<tr>
|
||||
<td style="padding: 8px 0; color: #666; font-size: 14px;">Sujet</td>
|
||||
<td style="padding: 8px 0; color: #222; font-size: 14px;">${subjectLabel}</td>
|
||||
@ -271,7 +363,7 @@ export class AuthController {
|
||||
</table>
|
||||
<div style="margin-top: 16px; padding-top: 16px; border-top: 1px solid #ddd;">
|
||||
<p style="color: #666; font-size: 14px; margin: 0 0 8px 0;">Message :</p>
|
||||
<p style="color: #222; font-size: 14px; white-space: pre-wrap; margin: 0;">${dto.message}</p>
|
||||
<p style="color: #222; font-size: 14px; white-space: pre-wrap; margin: 0;">${message}</p>
|
||||
</div>
|
||||
</div>
|
||||
<div style="background: #f0f0f0; padding: 12px 24px; border-radius: 0 0 8px 8px; text-align: center;">
|
||||
@ -284,7 +376,7 @@ export class AuthController {
|
||||
await this.emailService.send({
|
||||
to: 'contact@xpeditis.com',
|
||||
replyTo: dto.email,
|
||||
subject: `[Contact] ${subjectLabel} — ${dto.firstName} ${dto.lastName}`,
|
||||
subject: `[Contact] ${subjectLabels[dto.subject] || dto.subject} — ${dto.firstName} ${dto.lastName}`,
|
||||
html,
|
||||
});
|
||||
} catch (error) {
|
||||
@ -301,6 +393,7 @@ export class AuthController {
|
||||
* Forgot password — sends reset email
|
||||
*/
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 3, ttl: 60000 } })
|
||||
@Post('forgot-password')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOperation({
|
||||
@ -319,6 +412,7 @@ export class AuthController {
|
||||
* Reset password using token from email
|
||||
*/
|
||||
@Public()
|
||||
@Throttle({ default: { limit: 5, ttl: 60000 } })
|
||||
@Post('reset-password')
|
||||
@HttpCode(HttpStatus.OK)
|
||||
@ApiOperation({
|
||||
|
||||
@ -248,18 +248,7 @@ export class RegisterDto {
|
||||
invitationToken?: string;
|
||||
|
||||
@ApiPropertyOptional({
|
||||
example: '550e8400-e29b-41d4-a716-446655440000',
|
||||
description:
|
||||
'Organization ID (optional - for invited users). If not provided, organization data must be provided.',
|
||||
required: false,
|
||||
})
|
||||
@IsString()
|
||||
@IsOptional()
|
||||
organizationId?: string;
|
||||
|
||||
@ApiPropertyOptional({
|
||||
description:
|
||||
'Organization data (required if organizationId and invitationToken are not provided)',
|
||||
description: 'Organization data (required if invitationToken is not provided)',
|
||||
type: RegisterOrganizationDto,
|
||||
required: false,
|
||||
})
|
||||
@ -304,10 +293,11 @@ export class AuthResponseDto {
|
||||
}
|
||||
|
||||
export class RefreshTokenDto {
|
||||
@ApiProperty({
|
||||
@ApiPropertyOptional({
|
||||
example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
|
||||
description: 'Refresh token',
|
||||
description: 'Refresh token (optional — the httpOnly cookie is preferred)',
|
||||
})
|
||||
@IsString()
|
||||
refreshToken: string;
|
||||
@IsOptional()
|
||||
refreshToken?: string;
|
||||
}
|
||||
|
||||
@ -8,6 +8,7 @@ import {
|
||||
} from '@nestjs/common';
|
||||
import { v4 as uuidv4 } from 'uuid';
|
||||
import * as argon2 from 'argon2';
|
||||
import * as crypto from 'crypto';
|
||||
import { CsvBooking, CsvBookingStatus, DocumentType } from '@domain/entities/csv-booking.entity';
|
||||
import { PortCode } from '@domain/value-objects/port-code.vo';
|
||||
import { TypeOrmCsvBookingRepository } from '../../infrastructure/persistence/typeorm/repositories/csv-booking.repository';
|
||||
@ -81,17 +82,54 @@ export class CsvBookingService {
|
||||
const year = new Date().getFullYear();
|
||||
const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // No 0, O, 1, I for clarity
|
||||
let code = '';
|
||||
const randomBytes = crypto.randomBytes(6);
|
||||
for (let i = 0; i < 6; i++) {
|
||||
code += chars.charAt(Math.floor(Math.random() * chars.length));
|
||||
code += chars.charAt(randomBytes[i] % chars.length);
|
||||
}
|
||||
return `XPD-${year}-${code}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract the password from booking number (last 6 characters)
|
||||
* Derive the document-access password for a booking.
|
||||
*
|
||||
* The password is an HMAC of the booking ID keyed with a server-side secret,
|
||||
* so it can be re-computed when (re)sending carrier emails but cannot be
|
||||
* guessed from any data visible to third parties (unlike the previous
|
||||
* scheme, which reused the last 6 characters of the booking number).
|
||||
*/
|
||||
private extractPasswordFromBookingNumber(bookingNumber: string): string {
|
||||
return bookingNumber.split('-').pop() || bookingNumber.slice(-6);
|
||||
private deriveDocumentPassword(bookingId: string): string {
|
||||
const secret = process.env.DOCUMENT_PASSWORD_SECRET || process.env.JWT_SECRET || '';
|
||||
const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // No 0, O, 1, I for clarity
|
||||
const digest = crypto.createHmac('sha256', secret).update(`doc-password:${bookingId}`).digest();
|
||||
let password = '';
|
||||
for (let i = 0; i < 8; i++) {
|
||||
password += chars.charAt(digest[i] % chars.length);
|
||||
}
|
||||
return password;
|
||||
}
|
||||
|
||||
/**
|
||||
* Re-sync the stored password hash with the derived password and return the
|
||||
* plaintext for inclusion in the carrier email. Self-heals bookings created
|
||||
* before the HMAC-based scheme.
|
||||
*/
|
||||
private async syncDocumentPassword(bookingId: string): Promise<string> {
|
||||
const password = this.deriveDocumentPassword(bookingId);
|
||||
|
||||
const ormBooking = await this.csvBookingRepository['repository'].findOne({
|
||||
where: { id: bookingId },
|
||||
});
|
||||
if (ormBooking) {
|
||||
const matches = ormBooking.passwordHash
|
||||
? await argon2.verify(ormBooking.passwordHash, password).catch(() => false)
|
||||
: false;
|
||||
if (!matches) {
|
||||
ormBooking.passwordHash = await argon2.hash(password);
|
||||
await this.csvBookingRepository['repository'].save(ormBooking);
|
||||
}
|
||||
}
|
||||
|
||||
return password;
|
||||
}
|
||||
|
||||
/**
|
||||
@ -114,7 +152,7 @@ export class CsvBookingService {
|
||||
const confirmationToken = uuidv4();
|
||||
const bookingId = uuidv4();
|
||||
const bookingNumber = this.generateBookingNumber();
|
||||
const documentPassword = this.extractPasswordFromBookingNumber(bookingNumber);
|
||||
const documentPassword = this.deriveDocumentPassword(bookingId);
|
||||
|
||||
// Hash the password for storage
|
||||
const passwordHash = await argon2.hash(documentPassword);
|
||||
@ -292,9 +330,7 @@ export class CsvBookingService {
|
||||
where: { id: bookingId },
|
||||
});
|
||||
const bookingNumber = ormBooking?.bookingNumber;
|
||||
const documentPassword = bookingNumber
|
||||
? this.extractPasswordFromBookingNumber(bookingNumber)
|
||||
: undefined;
|
||||
const documentPassword = await this.syncDocumentPassword(booking.id);
|
||||
|
||||
// NOW send email to carrier
|
||||
try {
|
||||
@ -464,9 +500,7 @@ export class CsvBookingService {
|
||||
where: { id: bookingId },
|
||||
});
|
||||
const bookingNumber = ormBooking?.bookingNumber;
|
||||
const documentPassword = bookingNumber
|
||||
? this.extractPasswordFromBookingNumber(bookingNumber)
|
||||
: undefined;
|
||||
const documentPassword = await this.syncDocumentPassword(booking.id);
|
||||
|
||||
await this.emailAdapter.sendCsvBookingRequest(booking.carrierEmail, {
|
||||
bookingId: booking.id,
|
||||
@ -521,9 +555,7 @@ export class CsvBookingService {
|
||||
where: { id: bookingId },
|
||||
});
|
||||
const bookingNumber = ormBooking?.bookingNumber;
|
||||
const documentPassword = bookingNumber
|
||||
? this.extractPasswordFromBookingNumber(bookingNumber)
|
||||
: undefined;
|
||||
const documentPassword = await this.syncDocumentPassword(booking.id);
|
||||
|
||||
// Send email to carrier
|
||||
try {
|
||||
@ -784,9 +816,7 @@ export class CsvBookingService {
|
||||
|
||||
// Extract password from booking number for the email
|
||||
const bookingNumber = ormBooking?.bookingNumber;
|
||||
const documentPassword = bookingNumber
|
||||
? this.extractPasswordFromBookingNumber(bookingNumber)
|
||||
: undefined;
|
||||
const documentPassword = await this.syncDocumentPassword(booking.id);
|
||||
|
||||
// Send document access email to carrier
|
||||
try {
|
||||
|
||||
@ -107,21 +107,6 @@ export const corsConfig = {
|
||||
maxAge: 86400, // 24 hours
|
||||
};
|
||||
|
||||
/**
|
||||
* Session Configuration
|
||||
*/
|
||||
export const sessionConfig = {
|
||||
secret: process.env.SESSION_SECRET || 'change-this-secret',
|
||||
resave: false,
|
||||
saveUninitialized: false,
|
||||
cookie: {
|
||||
httpOnly: true,
|
||||
secure: process.env.NODE_ENV === 'production', // HTTPS only in production
|
||||
sameSite: 'strict' as const,
|
||||
maxAge: 7200000, // 2 hours
|
||||
},
|
||||
};
|
||||
|
||||
/**
|
||||
* Password Policy
|
||||
*/
|
||||
@ -155,19 +140,36 @@ export const fileUploadConfig = {
|
||||
};
|
||||
|
||||
/**
|
||||
* JWT Configuration
|
||||
* Auth Cookie Configuration
|
||||
*
|
||||
* Tokens are delivered as httpOnly cookies so they are not readable from
|
||||
* JavaScript (XSS mitigation). COOKIE_DOMAIN must be set in production when
|
||||
* the API and the frontend live on different subdomains (e.g. ".xpeditis.com").
|
||||
*/
|
||||
export const jwtConfig = {
|
||||
accessToken: {
|
||||
secret: process.env.JWT_SECRET || 'change-this-secret',
|
||||
expiresIn: '15m', // 15 minutes
|
||||
},
|
||||
refreshToken: {
|
||||
secret: process.env.JWT_REFRESH_SECRET || 'change-this-refresh-secret',
|
||||
expiresIn: '7d', // 7 days
|
||||
},
|
||||
algorithm: 'HS256' as const,
|
||||
};
|
||||
export const AUTH_COOKIE_NAMES = {
|
||||
accessToken: 'accessToken',
|
||||
refreshToken: 'refreshToken',
|
||||
/** Non-httpOnly flag the frontend reads to know a session exists (contains no token) */
|
||||
session: 'xpeditis_session',
|
||||
} as const;
|
||||
|
||||
export function authCookieOptions(options?: { maxAgeMs?: number; httpOnly?: boolean }): {
|
||||
httpOnly: boolean;
|
||||
secure: boolean;
|
||||
sameSite: 'lax';
|
||||
path: string;
|
||||
domain?: string;
|
||||
maxAge?: number;
|
||||
} {
|
||||
return {
|
||||
httpOnly: options?.httpOnly ?? true,
|
||||
secure: process.env.NODE_ENV === 'production',
|
||||
sameSite: 'lax',
|
||||
path: '/',
|
||||
...(process.env.COOKIE_DOMAIN ? { domain: process.env.COOKIE_DOMAIN } : {}),
|
||||
...(options?.maxAgeMs ? { maxAge: options.maxAgeMs } : {}),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Brute Force Protection
|
||||
|
||||
@ -5,6 +5,7 @@ import { ConfigService } from '@nestjs/config';
|
||||
import { I18nService, I18nValidationExceptionFilter, I18nValidationPipe } from 'nestjs-i18n';
|
||||
import helmet from 'helmet';
|
||||
import compression from 'compression';
|
||||
import cookieParser from 'cookie-parser';
|
||||
import { AppModule } from './app.module';
|
||||
import { Logger } from 'nestjs-pino';
|
||||
import { helmetConfig, corsConfig } from './infrastructure/security/security.config';
|
||||
@ -33,6 +34,9 @@ async function bootstrap() {
|
||||
// Compression for API responses
|
||||
app.use(compression());
|
||||
|
||||
// Parse cookies (httpOnly auth cookies)
|
||||
app.use(cookieParser());
|
||||
|
||||
// CORS with strict configuration
|
||||
app.enableCors(corsConfig);
|
||||
|
||||
|
||||
@ -6,6 +6,7 @@ import { ArrowLeft, Calendar, User, Tag, Clock, Share2, BookOpen, Anchor } from
|
||||
import { Link } from '@/i18n/navigation';
|
||||
import { LandingHeader, LandingFooter } from '@/components/layout';
|
||||
import { getBlogPost, type BlogPost } from '@/lib/api/blog';
|
||||
import DOMPurify from 'isomorphic-dompurify';
|
||||
|
||||
const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';
|
||||
|
||||
@ -107,9 +108,9 @@ export default function BlogPostContent({ slug }: { slug: string }) {
|
||||
if (notFound || !post) return <NotFoundView />;
|
||||
|
||||
const readingTime = estimateReadingTime(post.content);
|
||||
const processedContent = post.content.replace(
|
||||
/src="(\/api\/v1\/blog\/images\/[^"]+)"/g,
|
||||
`src="${API_BASE_URL}$1"`
|
||||
// Sanitize the admin-authored HTML before rendering (stored-XSS defense in depth)
|
||||
const processedContent = DOMPurify.sanitize(
|
||||
post.content.replace(/src="(\/api\/v1\/blog\/images\/[^"]+)"/g, `src="${API_BASE_URL}$1"`)
|
||||
);
|
||||
|
||||
const handleShare = () => {
|
||||
|
||||
@ -3,7 +3,6 @@
|
||||
import { useState, useEffect, useCallback, useRef } from 'react';
|
||||
import { useTranslations, useLocale } from 'next-intl';
|
||||
import { listCsvBookings, CsvBookingResponse } from '@/lib/api/bookings';
|
||||
import { getAuthToken } from '@/lib/api/client';
|
||||
import { FileText, Image as ImageIcon, FileEdit, FileSpreadsheet, Paperclip } from 'lucide-react';
|
||||
import type { ReactNode } from 'react';
|
||||
import ExportButton from '@/components/ExportButton';
|
||||
@ -278,10 +277,9 @@ export default function UserDocumentsPage() {
|
||||
const formData = new FormData();
|
||||
addFiles.forEach(file => formData.append('documents', file));
|
||||
|
||||
const token = getAuthToken();
|
||||
const response = await fetch(
|
||||
`${process.env.NEXT_PUBLIC_API_URL}/api/v1/csv-bookings/${selectedBookingId}/documents`,
|
||||
{ method: 'POST', headers: { Authorization: `Bearer ${token}` }, body: formData }
|
||||
{ method: 'POST', credentials: 'include', body: formData }
|
||||
);
|
||||
|
||||
if (!response.ok) {
|
||||
@ -336,10 +334,9 @@ export default function UserDocumentsPage() {
|
||||
const formData = new FormData();
|
||||
formData.append('document', replaceFile);
|
||||
|
||||
const token = getAuthToken();
|
||||
const response = await fetch(
|
||||
`${process.env.NEXT_PUBLIC_API_URL}/api/v1/csv-bookings/${documentToReplace.bookingId}/documents/${documentToReplace.id}`,
|
||||
{ method: 'PATCH', headers: { Authorization: `Bearer ${token}` }, body: formData }
|
||||
{ method: 'PATCH', credentials: 'include', body: formData }
|
||||
);
|
||||
|
||||
if (!response.ok) {
|
||||
|
||||
@ -68,7 +68,14 @@ export default function ForgotPasswordPage() {
|
||||
<p
|
||||
className="text-body text-neutral-600"
|
||||
dangerouslySetInnerHTML={{
|
||||
__html: t('successMessage', { email }),
|
||||
__html: t('successMessage', {
|
||||
// Escape the user-typed email before HTML interpolation
|
||||
email: email
|
||||
.replace(/&/g, '&')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/"/g, '"'),
|
||||
}),
|
||||
}}
|
||||
/>
|
||||
<p className="text-body-sm text-neutral-500 mt-3">{t('successHint')}</p>
|
||||
|
||||
@ -1,11 +1,11 @@
|
||||
'use client';
|
||||
|
||||
import { useState, useEffect } from 'react';
|
||||
import { useState, useEffect, Suspense } from 'react';
|
||||
import { useSearchParams } from 'next/navigation';
|
||||
import { Link, useRouter } from '@/i18n/navigation';
|
||||
import { useTranslations } from 'next-intl';
|
||||
|
||||
export default function VerifyEmailPage() {
|
||||
function VerifyEmailContent() {
|
||||
const t = useTranslations('auth.verifyEmail');
|
||||
const searchParams = useSearchParams();
|
||||
const router = useRouter();
|
||||
@ -140,3 +140,12 @@ export default function VerifyEmailPage() {
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
export default function VerifyEmailPage() {
|
||||
// useSearchParams() requires a Suspense boundary for prerendering (Next 14.2+)
|
||||
return (
|
||||
<Suspense fallback={null}>
|
||||
<VerifyEmailContent />
|
||||
</Suspense>
|
||||
);
|
||||
}
|
||||
|
||||
6
apps/frontend/app/api/health/route.ts
Normal file
6
apps/frontend/app/api/health/route.ts
Normal file
@ -0,0 +1,6 @@
|
||||
/**
|
||||
* Health check endpoint used by the Docker HEALTHCHECK.
|
||||
*/
|
||||
export function GET() {
|
||||
return Response.json({ status: 'ok', timestamp: new Date().toISOString() });
|
||||
}
|
||||
829
apps/frontend/package-lock.json
generated
829
apps/frontend/package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@ -42,9 +42,10 @@
|
||||
"date-fns": "^4.1.0",
|
||||
"file-saver": "^2.0.5",
|
||||
"framer-motion": "^12.23.24",
|
||||
"isomorphic-dompurify": "^3.16.0",
|
||||
"leaflet": "^1.9.4",
|
||||
"lucide-react": "^0.294.0",
|
||||
"next": "14.0.4",
|
||||
"next": "^14.2.35",
|
||||
"next-intl": "^4.9.1",
|
||||
"react": "^18.2.0",
|
||||
"react-dom": "^18.2.0",
|
||||
|
||||
@ -41,9 +41,7 @@ export function useBookings(initialFilters?: BookingFilters) {
|
||||
queryParams.append('pageSize', String(filters.pageSize || 20));
|
||||
|
||||
const response = await fetch(`/api/v1/bookings/advanced/search?${queryParams.toString()}`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${localStorage.getItem('accessToken')}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
@ -102,9 +100,9 @@ export function useBookings(initialFilters?: BookingFilters) {
|
||||
try {
|
||||
const response = await fetch('/api/v1/bookings/export', {
|
||||
method: 'POST',
|
||||
credentials: 'include',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
Authorization: `Bearer ${localStorage.getItem('accessToken')}`,
|
||||
},
|
||||
body: JSON.stringify({
|
||||
format: options.format,
|
||||
|
||||
@ -108,11 +108,7 @@ export async function exportAuditLogs(params?: {
|
||||
`${process.env.NEXT_PUBLIC_API_URL}/api/v1/audit/export?${queryParams.toString()}`,
|
||||
{
|
||||
method: 'GET',
|
||||
headers: {
|
||||
Authorization: `Bearer ${
|
||||
typeof window !== 'undefined' ? localStorage.getItem('access_token') : ''
|
||||
}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
}
|
||||
);
|
||||
|
||||
|
||||
@ -4,7 +4,7 @@
|
||||
* Endpoints for user authentication and session management
|
||||
*/
|
||||
|
||||
import { get, post, setAuthTokens, clearAuthTokens } from './client';
|
||||
import { get, post, clearAuthTokens } from './client';
|
||||
import type {
|
||||
RegisterRequest,
|
||||
LoginRequest,
|
||||
@ -19,12 +19,8 @@ import type {
|
||||
* POST /api/v1/auth/register
|
||||
*/
|
||||
export async function register(data: RegisterRequest): Promise<AuthResponse> {
|
||||
const response = await post<AuthResponse>('/api/v1/auth/register', data, false);
|
||||
|
||||
// Store tokens
|
||||
setAuthTokens(response.accessToken, response.refreshToken);
|
||||
|
||||
return response;
|
||||
// Tokens are delivered as httpOnly cookies by the backend
|
||||
return post<AuthResponse>('/api/v1/auth/register', data, false);
|
||||
}
|
||||
|
||||
/**
|
||||
@ -32,21 +28,18 @@ export async function register(data: RegisterRequest): Promise<AuthResponse> {
|
||||
* POST /api/v1/auth/login
|
||||
*/
|
||||
export async function login(data: LoginRequest & { rememberMe?: boolean }): Promise<AuthResponse> {
|
||||
const { rememberMe, ...loginData } = data;
|
||||
const response = await post<AuthResponse>('/api/v1/auth/login', loginData, false);
|
||||
|
||||
// Store tokens — localStorage if rememberMe, sessionStorage otherwise
|
||||
setAuthTokens(response.accessToken, response.refreshToken, rememberMe ?? false);
|
||||
|
||||
return response;
|
||||
// Tokens are delivered as httpOnly cookies by the backend;
|
||||
// rememberMe drives cookie persistence server-side
|
||||
return post<AuthResponse>('/api/v1/auth/login', data, false);
|
||||
}
|
||||
|
||||
/**
|
||||
* Refresh access token
|
||||
* POST /api/v1/auth/refresh
|
||||
*/
|
||||
export async function refreshToken(data: RefreshTokenRequest): Promise<{ accessToken: string }> {
|
||||
return post<{ accessToken: string }>('/api/v1/auth/refresh', data, false);
|
||||
export async function refreshToken(data?: RefreshTokenRequest): Promise<{ success: boolean }> {
|
||||
// The backend reads the httpOnly refresh cookie and rotates the cookies
|
||||
return post<{ success: boolean }>('/api/v1/auth/refresh', data ?? {}, false);
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@ -181,11 +181,7 @@ export async function exportBookings(params: {
|
||||
`${process.env.NEXT_PUBLIC_API_URL}/api/v1/bookings/export?${queryParams.toString()}`,
|
||||
{
|
||||
method: 'GET',
|
||||
headers: {
|
||||
Authorization: `Bearer ${
|
||||
typeof window !== 'undefined' ? localStorage.getItem('access_token') : ''
|
||||
}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
}
|
||||
);
|
||||
|
||||
|
||||
@ -1,47 +1,37 @@
|
||||
/**
|
||||
* API Client Base
|
||||
*
|
||||
* Core HTTP client with authentication and error handling
|
||||
* Core HTTP client with authentication and error handling.
|
||||
*
|
||||
* Authentication relies on httpOnly cookies set by the backend
|
||||
* (`accessToken` / `refreshToken`), so no token is ever stored in
|
||||
* localStorage or readable from JavaScript (XSS mitigation).
|
||||
* The non-httpOnly `xpeditis_session` flag cookie (which contains no
|
||||
* token) tells the frontend whether a session exists.
|
||||
*/
|
||||
|
||||
const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';
|
||||
|
||||
const SESSION_FLAG_COOKIE = 'xpeditis_session';
|
||||
|
||||
// Track if we're currently refreshing to avoid multiple simultaneous refresh requests
|
||||
let isRefreshing = false;
|
||||
let refreshSubscribers: Array<(token: string) => void> = [];
|
||||
let refreshSubscribers: Array<() => void> = [];
|
||||
|
||||
/**
|
||||
* Get authentication token — checks localStorage first (remember me), then sessionStorage
|
||||
* Whether an authenticated session exists (based on the readable flag cookie
|
||||
* set by the backend alongside the httpOnly token cookies).
|
||||
*/
|
||||
export function getAuthToken(): string | null {
|
||||
if (typeof window === 'undefined') return null;
|
||||
return localStorage.getItem('access_token') || sessionStorage.getItem('access_token');
|
||||
export function hasSession(): boolean {
|
||||
if (typeof document === 'undefined') return false;
|
||||
return document.cookie.split('; ').some(cookie => cookie.startsWith(`${SESSION_FLAG_COOKIE}=`));
|
||||
}
|
||||
|
||||
/**
|
||||
* Get refresh token — checks localStorage first (remember me), then sessionStorage
|
||||
*/
|
||||
export function getRefreshToken(): string | null {
|
||||
if (typeof window === 'undefined') return null;
|
||||
return localStorage.getItem('refresh_token') || sessionStorage.getItem('refresh_token');
|
||||
}
|
||||
|
||||
/**
|
||||
* Set authentication tokens.
|
||||
* rememberMe=true → localStorage (persists across browser sessions)
|
||||
* rememberMe=false → sessionStorage (cleared when browser closes)
|
||||
*/
|
||||
export function setAuthTokens(accessToken: string, refreshToken: string, rememberMe = false): void {
|
||||
if (typeof window === 'undefined') return;
|
||||
const storage = rememberMe ? localStorage : sessionStorage;
|
||||
storage.setItem('access_token', accessToken);
|
||||
storage.setItem('refresh_token', refreshToken);
|
||||
// Sync to cookie so Next.js middleware can read it for route protection
|
||||
document.cookie = `accessToken=${accessToken}; path=/; SameSite=Lax`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear authentication tokens from both storages
|
||||
* Clear client-side auth state.
|
||||
* Token cookies are httpOnly and are cleared by the backend on logout;
|
||||
* this removes the user cache and any tokens left over from the legacy
|
||||
* localStorage-based auth.
|
||||
*/
|
||||
export function clearAuthTokens(): void {
|
||||
if (typeof window === 'undefined') return;
|
||||
@ -51,41 +41,39 @@ export function clearAuthTokens(): void {
|
||||
sessionStorage.removeItem('access_token');
|
||||
sessionStorage.removeItem('refresh_token');
|
||||
sessionStorage.removeItem('user');
|
||||
// Expire the middleware cookie
|
||||
// Expire the legacy middleware cookie and the session flag (best effort —
|
||||
// the backend clears the authoritative httpOnly cookies)
|
||||
document.cookie = 'accessToken=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; SameSite=Lax';
|
||||
document.cookie = `${SESSION_FLAG_COOKIE}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; SameSite=Lax`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add subscriber to be notified when token is refreshed
|
||||
* Add subscriber to be notified when the session is refreshed
|
||||
*/
|
||||
function subscribeTokenRefresh(callback: (token: string) => void): void {
|
||||
function subscribeTokenRefresh(callback: () => void): void {
|
||||
refreshSubscribers.push(callback);
|
||||
}
|
||||
|
||||
/**
|
||||
* Notify all subscribers that token has been refreshed
|
||||
* Notify all subscribers that the session has been refreshed
|
||||
*/
|
||||
function onTokenRefreshed(token: string): void {
|
||||
refreshSubscribers.forEach(callback => callback(token));
|
||||
function onTokenRefreshed(): void {
|
||||
refreshSubscribers.forEach(callback => callback());
|
||||
refreshSubscribers = [];
|
||||
}
|
||||
|
||||
/**
|
||||
* Refresh access token using refresh token
|
||||
* Refresh the session — the backend reads the httpOnly refresh cookie and
|
||||
* sets new token cookies on success.
|
||||
*/
|
||||
async function refreshAccessToken(): Promise<string> {
|
||||
const refreshToken = getRefreshToken();
|
||||
|
||||
if (!refreshToken) {
|
||||
throw new Error('No refresh token available');
|
||||
}
|
||||
|
||||
async function refreshSession(): Promise<void> {
|
||||
const response = await fetch(`${API_BASE_URL}/api/v1/auth/refresh`, {
|
||||
method: 'POST',
|
||||
credentials: 'include',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
},
|
||||
body: JSON.stringify({ refreshToken }),
|
||||
body: JSON.stringify({}),
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
@ -95,54 +83,24 @@ async function refreshAccessToken(): Promise<string> {
|
||||
if (typeof window !== 'undefined') {
|
||||
window.location.href = '/login';
|
||||
}
|
||||
throw new Error('Failed to refresh token');
|
||||
throw new Error('Failed to refresh session');
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
const newAccessToken = data.accessToken;
|
||||
|
||||
// Update access token in the same storage that holds the refresh token
|
||||
if (typeof window !== 'undefined') {
|
||||
const storage = localStorage.getItem('refresh_token') ? localStorage : sessionStorage;
|
||||
storage.setItem('access_token', newAccessToken);
|
||||
document.cookie = `accessToken=${newAccessToken}; path=/; SameSite=Lax`;
|
||||
}
|
||||
|
||||
return newAccessToken;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create headers with authentication
|
||||
* Create headers (auth is carried by httpOnly cookies, not headers)
|
||||
*/
|
||||
export function createHeaders(includeAuth = true): HeadersInit {
|
||||
const headers: HeadersInit = {
|
||||
export function createHeaders(_includeAuth = true): HeadersInit {
|
||||
return {
|
||||
'Content-Type': 'application/json',
|
||||
};
|
||||
|
||||
if (includeAuth) {
|
||||
const token = getAuthToken();
|
||||
if (token) {
|
||||
headers['Authorization'] = `Bearer ${token}`;
|
||||
}
|
||||
}
|
||||
|
||||
return headers;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create headers for multipart form data
|
||||
*/
|
||||
export function createMultipartHeaders(includeAuth = true): HeadersInit {
|
||||
const headers: HeadersInit = {};
|
||||
|
||||
if (includeAuth) {
|
||||
const token = getAuthToken();
|
||||
if (token) {
|
||||
headers['Authorization'] = `Bearer ${token}`;
|
||||
}
|
||||
}
|
||||
|
||||
return headers;
|
||||
export function createMultipartHeaders(_includeAuth = true): HeadersInit {
|
||||
return {};
|
||||
}
|
||||
|
||||
/**
|
||||
@ -160,7 +118,7 @@ export class ApiError extends Error {
|
||||
}
|
||||
|
||||
/**
|
||||
* Make API request with automatic token refresh on 401
|
||||
* Make API request with automatic session refresh on 401
|
||||
*/
|
||||
export async function apiRequest<T>(
|
||||
endpoint: string,
|
||||
@ -171,6 +129,7 @@ export async function apiRequest<T>(
|
||||
|
||||
const response = await fetch(url, {
|
||||
...options,
|
||||
credentials: 'include',
|
||||
headers: {
|
||||
...options.headers,
|
||||
},
|
||||
@ -184,10 +143,8 @@ export async function apiRequest<T>(
|
||||
endpoint.includes('/auth/refresh');
|
||||
|
||||
if (response.status === 401 && !isRetry && !isAuthEndpoint) {
|
||||
// Check if we have a refresh token
|
||||
const refreshToken = getRefreshToken();
|
||||
if (!refreshToken) {
|
||||
// No refresh token, redirect to login
|
||||
if (!hasSession()) {
|
||||
// No session, redirect to login
|
||||
clearAuthTokens();
|
||||
if (typeof window !== 'undefined') {
|
||||
window.location.href = '/login';
|
||||
@ -195,46 +152,21 @@ export async function apiRequest<T>(
|
||||
throw new ApiError('Session expired', 401);
|
||||
}
|
||||
|
||||
// Try to refresh the token
|
||||
// Try to refresh the session (cookies are updated server-side)
|
||||
try {
|
||||
if (!isRefreshing) {
|
||||
isRefreshing = true;
|
||||
const newAccessToken = await refreshAccessToken();
|
||||
await refreshSession();
|
||||
isRefreshing = false;
|
||||
onTokenRefreshed(newAccessToken);
|
||||
onTokenRefreshed();
|
||||
|
||||
// Retry the original request with new token
|
||||
const newHeaders = { ...options.headers };
|
||||
if (newHeaders && typeof newHeaders === 'object' && 'Authorization' in newHeaders) {
|
||||
(newHeaders as any)['Authorization'] = `Bearer ${newAccessToken}`;
|
||||
}
|
||||
|
||||
return apiRequest<T>(
|
||||
endpoint,
|
||||
{
|
||||
...options,
|
||||
headers: newHeaders,
|
||||
},
|
||||
true
|
||||
);
|
||||
return apiRequest<T>(endpoint, options, true);
|
||||
} else {
|
||||
// Already refreshing, wait for the new token
|
||||
// Already refreshing, wait for it to complete
|
||||
return new Promise((resolve, reject) => {
|
||||
subscribeTokenRefresh(async (newAccessToken: string) => {
|
||||
const newHeaders = { ...options.headers };
|
||||
if (newHeaders && typeof newHeaders === 'object' && 'Authorization' in newHeaders) {
|
||||
(newHeaders as any)['Authorization'] = `Bearer ${newAccessToken}`;
|
||||
}
|
||||
|
||||
subscribeTokenRefresh(async () => {
|
||||
try {
|
||||
const result = await apiRequest<T>(
|
||||
endpoint,
|
||||
{
|
||||
...options,
|
||||
headers: newHeaders,
|
||||
},
|
||||
true
|
||||
);
|
||||
const result = await apiRequest<T>(endpoint, options, true);
|
||||
resolve(result);
|
||||
} catch (error) {
|
||||
reject(error);
|
||||
@ -320,23 +252,20 @@ export async function upload<T>(
|
||||
|
||||
const response = await fetch(url, {
|
||||
method: 'POST',
|
||||
credentials: 'include',
|
||||
headers: createMultipartHeaders(includeAuth),
|
||||
body: formData,
|
||||
});
|
||||
|
||||
// Handle 401 Unauthorized for file uploads
|
||||
if (response.status === 401) {
|
||||
const refreshToken = getRefreshToken();
|
||||
if (refreshToken) {
|
||||
if (response.status === 401 && hasSession()) {
|
||||
try {
|
||||
const newAccessToken = await refreshAccessToken();
|
||||
// Retry upload with new token
|
||||
await refreshSession();
|
||||
// Retry upload with refreshed cookies
|
||||
const retryResponse = await fetch(url, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
...createMultipartHeaders(includeAuth),
|
||||
Authorization: `Bearer ${newAccessToken}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
headers: createMultipartHeaders(includeAuth),
|
||||
body: formData,
|
||||
});
|
||||
|
||||
@ -358,7 +287,6 @@ export async function upload<T>(
|
||||
throw refreshError;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
const error = await response.json().catch(() => ({}));
|
||||
@ -384,22 +312,19 @@ export async function download(
|
||||
|
||||
const response = await fetch(url, {
|
||||
method: 'GET',
|
||||
credentials: 'include',
|
||||
headers: createHeaders(includeAuth),
|
||||
});
|
||||
|
||||
// Handle 401 Unauthorized for downloads
|
||||
if (response.status === 401) {
|
||||
const refreshToken = getRefreshToken();
|
||||
if (refreshToken) {
|
||||
if (response.status === 401 && hasSession()) {
|
||||
try {
|
||||
const newAccessToken = await refreshAccessToken();
|
||||
// Retry download with new token
|
||||
await refreshSession();
|
||||
// Retry download with refreshed cookies
|
||||
const retryResponse = await fetch(url, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
...createHeaders(includeAuth),
|
||||
Authorization: `Bearer ${newAccessToken}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
headers: createHeaders(includeAuth),
|
||||
});
|
||||
|
||||
if (!retryResponse.ok) {
|
||||
@ -424,7 +349,6 @@ export async function download(
|
||||
throw refreshError;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (!response.ok) {
|
||||
throw new ApiError(`Download failed: ${response.statusText}`, response.status);
|
||||
|
||||
@ -14,27 +14,12 @@ import {
|
||||
const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';
|
||||
|
||||
/**
|
||||
* Get authentication token from localStorage
|
||||
*/
|
||||
function getAuthToken(): string | null {
|
||||
if (typeof window === 'undefined') return null;
|
||||
return localStorage.getItem('access_token');
|
||||
}
|
||||
|
||||
/**
|
||||
* Create headers with authentication
|
||||
* Create headers — auth is carried by httpOnly cookies (credentials: 'include')
|
||||
*/
|
||||
function createHeaders(): HeadersInit {
|
||||
const headers: HeadersInit = {
|
||||
return {
|
||||
'Content-Type': 'application/json',
|
||||
};
|
||||
|
||||
const token = getAuthToken();
|
||||
if (token) {
|
||||
headers['Authorization'] = `Bearer ${token}`;
|
||||
}
|
||||
|
||||
return headers;
|
||||
}
|
||||
|
||||
/**
|
||||
@ -45,6 +30,7 @@ export async function searchCsvRates(
|
||||
): Promise<CsvRateSearchResponse> {
|
||||
const response = await fetch(`${API_BASE_URL}/api/v1/rates/search-csv`, {
|
||||
method: 'POST',
|
||||
credentials: 'include',
|
||||
headers: createHeaders(),
|
||||
body: JSON.stringify(request),
|
||||
});
|
||||
@ -63,6 +49,7 @@ export async function searchCsvRates(
|
||||
export async function getAvailableCompanies(): Promise<AvailableCompanies> {
|
||||
const response = await fetch(`${API_BASE_URL}/api/v1/rates/companies`, {
|
||||
method: 'GET',
|
||||
credentials: 'include',
|
||||
headers: createHeaders(),
|
||||
});
|
||||
|
||||
@ -79,6 +66,7 @@ export async function getAvailableCompanies(): Promise<AvailableCompanies> {
|
||||
export async function getFilterOptions(): Promise<FilterOptions> {
|
||||
const response = await fetch(`${API_BASE_URL}/api/v1/rates/filters/options`, {
|
||||
method: 'GET',
|
||||
credentials: 'include',
|
||||
headers: createHeaders(),
|
||||
});
|
||||
|
||||
|
||||
@ -53,11 +53,7 @@ export interface GdprDataExportResponse {
|
||||
export async function requestDataExport(): Promise<Blob> {
|
||||
const response = await fetch(`${process.env.NEXT_PUBLIC_API_URL}/api/v1/gdpr/export`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
Authorization: `Bearer ${
|
||||
typeof window !== 'undefined' ? localStorage.getItem('accessToken') : ''
|
||||
}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
@ -74,11 +70,7 @@ export async function requestDataExport(): Promise<Blob> {
|
||||
export async function requestDataExportCSV(): Promise<Blob> {
|
||||
const response = await fetch(`${process.env.NEXT_PUBLIC_API_URL}/api/v1/gdpr/export/csv`, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
Authorization: `Bearer ${
|
||||
typeof window !== 'undefined' ? localStorage.getItem('accessToken') : ''
|
||||
}`,
|
||||
},
|
||||
credentials: 'include',
|
||||
});
|
||||
|
||||
if (!response.ok) {
|
||||
@ -96,11 +88,9 @@ export async function requestDataExportCSV(): Promise<Blob> {
|
||||
export async function requestAccountDeletion(confirmEmail: string, reason?: string): Promise<void> {
|
||||
const response = await fetch(`${process.env.NEXT_PUBLIC_API_URL}/api/v1/gdpr/delete-account`, {
|
||||
method: 'DELETE',
|
||||
credentials: 'include',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
Authorization: `Bearer ${
|
||||
typeof window !== 'undefined' ? localStorage.getItem('accessToken') : ''
|
||||
}`,
|
||||
},
|
||||
body: JSON.stringify({ confirmEmail, reason }),
|
||||
});
|
||||
|
||||
@ -10,8 +10,7 @@
|
||||
|
||||
// Base client utilities
|
||||
export {
|
||||
getAuthToken,
|
||||
setAuthTokens,
|
||||
hasSession,
|
||||
clearAuthTokens,
|
||||
createHeaders,
|
||||
apiRequest,
|
||||
|
||||
@ -34,12 +34,6 @@ export interface PortSearchResponse {
|
||||
* Search ports by query (autocomplete)
|
||||
*/
|
||||
export async function searchPorts(params: PortSearchParams): Promise<PortSearchResponse> {
|
||||
// Use the same key as the rest of the app: 'access_token' with underscore
|
||||
const token = typeof window !== 'undefined' ? localStorage.getItem('access_token') : null;
|
||||
if (!token) {
|
||||
throw new Error('No access token found');
|
||||
}
|
||||
|
||||
const queryParams = new URLSearchParams({
|
||||
query: params.query,
|
||||
});
|
||||
@ -54,9 +48,9 @@ export async function searchPorts(params: PortSearchParams): Promise<PortSearchR
|
||||
|
||||
const response = await fetch(`${API_BASE_URL}/api/v1/ports/search?${queryParams.toString()}`, {
|
||||
method: 'GET',
|
||||
credentials: 'include',
|
||||
headers: {
|
||||
'Content-Type': 'application/json',
|
||||
Authorization: `Bearer ${token}`,
|
||||
},
|
||||
});
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ import {
|
||||
logout as apiLogout,
|
||||
getCurrentUser,
|
||||
} from '../api/auth';
|
||||
import { getAuthToken } from '../api/client';
|
||||
import { hasSession, clearAuthTokens } from '../api/client';
|
||||
import type { UserPayload } from '@/types/api';
|
||||
|
||||
interface AuthContextType {
|
||||
@ -45,16 +45,9 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
|
||||
const [loading, setLoading] = useState(true);
|
||||
const router = useRouter();
|
||||
|
||||
// Helper function to check if user is authenticated
|
||||
// Helper function to check if user is authenticated (session flag cookie)
|
||||
const isAuthenticated = () => {
|
||||
return !!getAuthToken();
|
||||
};
|
||||
|
||||
// Helper function to get stored user
|
||||
const getStoredUser = (): UserPayload | null => {
|
||||
if (typeof window === 'undefined') return null;
|
||||
const storedUser = localStorage.getItem('user');
|
||||
return storedUser ? JSON.parse(storedUser) : null;
|
||||
return hasSession();
|
||||
};
|
||||
|
||||
useEffect(() => {
|
||||
@ -62,31 +55,20 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
|
||||
const checkAuth = async () => {
|
||||
try {
|
||||
if (isAuthenticated()) {
|
||||
// Try to fetch current user from API (will auto-refresh token if expired)
|
||||
// Try to fetch current user from API (will auto-refresh the session if expired)
|
||||
try {
|
||||
const currentUser = await getCurrentUser();
|
||||
setUser(currentUser);
|
||||
// Update stored user
|
||||
localStorage.setItem('user', JSON.stringify(currentUser));
|
||||
} catch (apiError) {
|
||||
console.error('Failed to fetch user from API:', apiError);
|
||||
// If API fails after token refresh attempt, clear everything
|
||||
if (typeof window !== 'undefined') {
|
||||
localStorage.removeItem('access_token');
|
||||
localStorage.removeItem('refresh_token');
|
||||
localStorage.removeItem('user');
|
||||
}
|
||||
// If API fails after session refresh attempt, clear everything
|
||||
clearAuthTokens();
|
||||
setUser(null);
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('Auth check failed, clearing tokens:', error);
|
||||
// Token invalid or no user data, clear storage
|
||||
if (typeof window !== 'undefined') {
|
||||
localStorage.removeItem('access_token');
|
||||
localStorage.removeItem('refresh_token');
|
||||
localStorage.removeItem('user');
|
||||
}
|
||||
console.error('Auth check failed, clearing session:', error);
|
||||
clearAuthTokens();
|
||||
setUser(null);
|
||||
} finally {
|
||||
setLoading(false);
|
||||
@ -122,14 +104,9 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
|
||||
) => {
|
||||
try {
|
||||
await apiLogin({ email, password, rememberMe });
|
||||
// Fetch complete user profile after login
|
||||
// Fetch complete user profile after login (session lives in httpOnly cookies)
|
||||
const currentUser = await getCurrentUser();
|
||||
setUser(currentUser);
|
||||
// Store user in the same storage as the tokens
|
||||
if (typeof window !== 'undefined') {
|
||||
const storage = rememberMe ? localStorage : sessionStorage;
|
||||
storage.setItem('user', JSON.stringify(currentUser));
|
||||
}
|
||||
router.push(redirectTo);
|
||||
} catch (error) {
|
||||
throw error;
|
||||
@ -144,14 +121,10 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
|
||||
organizationId: string;
|
||||
}) => {
|
||||
try {
|
||||
const response = await apiRegister(data);
|
||||
await apiRegister(data);
|
||||
// Fetch complete user profile after registration
|
||||
const currentUser = await getCurrentUser();
|
||||
setUser(currentUser);
|
||||
// Store user in localStorage
|
||||
if (typeof window !== 'undefined') {
|
||||
localStorage.setItem('user', JSON.stringify(currentUser));
|
||||
}
|
||||
router.push('/dashboard');
|
||||
} catch (error) {
|
||||
throw error;
|
||||
@ -163,10 +136,6 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
|
||||
await apiLogout();
|
||||
} finally {
|
||||
setUser(null);
|
||||
// Clear user from localStorage
|
||||
if (typeof window !== 'undefined') {
|
||||
localStorage.removeItem('user');
|
||||
}
|
||||
router.push('/login');
|
||||
}
|
||||
};
|
||||
@ -175,9 +144,6 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
|
||||
try {
|
||||
const currentUser = await getCurrentUser();
|
||||
setUser(currentUser);
|
||||
if (typeof window !== 'undefined') {
|
||||
localStorage.setItem('user', JSON.stringify(currentUser));
|
||||
}
|
||||
} catch (error) {
|
||||
console.error('Failed to refresh user:', error);
|
||||
}
|
||||
|
||||
@ -13,7 +13,7 @@ import {
|
||||
updateConsentPreferences,
|
||||
type CookiePreferences,
|
||||
} from '../api/gdpr';
|
||||
import { getAuthToken } from '../api/client';
|
||||
import { hasSession } from '../api/client';
|
||||
|
||||
const STORAGE_KEY = 'cookieConsent';
|
||||
const STORAGE_DATE_KEY = 'cookieConsentDate';
|
||||
@ -49,7 +49,7 @@ export function CookieProvider({ children }: { children: React.ReactNode }) {
|
||||
|
||||
// Check if user is authenticated
|
||||
const isAuthenticated = useCallback(() => {
|
||||
return !!getAuthToken();
|
||||
return hasSession();
|
||||
}, []);
|
||||
|
||||
// Load preferences from localStorage
|
||||
|
||||
@ -27,7 +27,6 @@ export interface RegisterRequest {
|
||||
firstName: string;
|
||||
lastName: string;
|
||||
invitationToken?: string; // For invited users (token-based)
|
||||
organizationId?: string; // For invited users (ID-based)
|
||||
organization?: RegisterOrganizationData; // For new users
|
||||
}
|
||||
|
||||
|
||||
@ -103,8 +103,8 @@ services:
|
||||
REDIS_PASSWORD: xpeditis_redis_password
|
||||
REDIS_DB: 0
|
||||
|
||||
# JWT
|
||||
JWT_SECRET: dev-secret-jwt-key-for-docker
|
||||
# JWT (must be at least 32 characters — enforced at startup)
|
||||
JWT_SECRET: dev-secret-jwt-key-for-docker-local-only-0123456789
|
||||
JWT_ACCESS_EXPIRATION: 15m
|
||||
JWT_REFRESH_EXPIRATION: 7d
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user