backend: Mot de passe oublié + Securité Next maj
TODO: Page de connexion frontend et profil public
This commit is contained in:
parent
49da9d5d48
commit
8c37dbaaf4
@ -1,4 +1,5 @@
|
|||||||
HOST = "http://localhost:8080"
|
HOST = "http://localhost:8080"
|
||||||
|
FRONT_END_HOST = "http://localhost:3000"
|
||||||
OpenWeatherMap_API_KEY = ""
|
OpenWeatherMap_API_KEY = ""
|
||||||
DB_HOST = ""
|
DB_HOST = ""
|
||||||
DB_NAME = ""
|
DB_NAME = ""
|
||||||
|
@ -1,6 +1,7 @@
|
|||||||
const config = {
|
const config = {
|
||||||
PORT: process.env.PORT || 8080,
|
PORT: process.env.PORT || 8080,
|
||||||
HOST: process.env.HOST,
|
HOST: process.env.HOST,
|
||||||
|
FRONT_END_HOST: process.env.FRONT_END_HOST,
|
||||||
WEATHER_API_KEY: process.env.OpenWeatherMap_API_KEY,
|
WEATHER_API_KEY: process.env.OpenWeatherMap_API_KEY,
|
||||||
DATABASE: {
|
DATABASE: {
|
||||||
host: process.env.DB_HOST,
|
host: process.env.DB_HOST,
|
||||||
|
@ -1,14 +1,14 @@
|
|||||||
const { validationResult } = require('express-validator');
|
const { validationResult } = require('express-validator');
|
||||||
const bcrypt = require('bcryptjs');
|
const bcrypt = require('bcryptjs');
|
||||||
const jwt = require('jsonwebtoken');
|
const jwt = require('jsonwebtoken');
|
||||||
const uuid = require('uuid');
|
const uuid = require('uuid');
|
||||||
const errorHandling = require('../assets/utils/errorHandling');
|
const errorHandling = require('../assets/utils/errorHandling');
|
||||||
const { serverError, generalError } = require('../assets/config/errors');
|
const { serverError, generalError } = require('../assets/config/errors');
|
||||||
const { JWT_SECRET } = require('../assets/config/config');
|
const { JWT_SECRET, FRONT_END_HOST } = require('../assets/config/config');
|
||||||
const transporter = require('../assets/config/transporter');
|
const transporter = require('../assets/config/transporter');
|
||||||
const { EMAIL_INFO, HOST } = require('../assets/config/config');
|
const { EMAIL_INFO, HOST } = require('../assets/config/config');
|
||||||
const { emailTemplate } = require('../assets/config/emails');
|
const { emailTemplate } = require('../assets/config/emails');
|
||||||
const Users = require('../models/users');
|
const Users = require('../models/users');
|
||||||
|
|
||||||
exports.register = async (req, res, next) => {
|
exports.register = async (req, res, next) => {
|
||||||
const { name, email, password } = req.body;
|
const { name, email, password } = req.body;
|
||||||
@ -18,7 +18,7 @@ exports.register = async (req, res, next) => {
|
|||||||
}
|
}
|
||||||
try {
|
try {
|
||||||
const hashedPassword = await bcrypt.hash(password, 12);
|
const hashedPassword = await bcrypt.hash(password, 12);
|
||||||
const tempToken = uuid.v4();
|
const tempToken = uuid.v4();
|
||||||
await Users.create({ email, name, password: hashedPassword, tempToken });
|
await Users.create({ email, name, password: hashedPassword, tempToken });
|
||||||
await transporter.sendMail({
|
await transporter.sendMail({
|
||||||
from: `"FunctionProject" <${EMAIL_INFO.auth.user}>`,
|
from: `"FunctionProject" <${EMAIL_INFO.auth.user}>`,
|
||||||
@ -67,7 +67,58 @@ exports.confirmEmail = async (req, res, next) => {
|
|||||||
user.tempToken = null;
|
user.tempToken = null;
|
||||||
user.isConfirmed = true;
|
user.isConfirmed = true;
|
||||||
await user.save();
|
await user.save();
|
||||||
return res.redirect('https://function.divlo.fr');
|
return res.redirect(`${FRONT_END_HOST}/login`);
|
||||||
|
} catch (error) {
|
||||||
|
console.log(error);
|
||||||
|
errorHandling(next, serverError);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
exports.resetPassword = async (req, res, next) => {
|
||||||
|
const { email } = req.body;
|
||||||
|
const errors = validationResult(req);
|
||||||
|
if (!errors.isEmpty()) {
|
||||||
|
return errorHandling(next, { message: errors.array()[0].msg, statusCode: 400 });
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
const user = await Users.findOne({ where: { email, tempToken: null } });
|
||||||
|
if (!user) {
|
||||||
|
return errorHandling(next, { message: "L'adresse email n'existe pas ou une demande est déjà en cours.", statusCode: 400 });
|
||||||
|
}
|
||||||
|
const tempToken = uuid.v4();
|
||||||
|
user.tempExpirationToken = Date.now() + 3600000; // 1 heure
|
||||||
|
user.tempToken = tempToken;
|
||||||
|
await user.save();
|
||||||
|
await transporter.sendMail({
|
||||||
|
from: `"FunctionProject" <${EMAIL_INFO.auth.user}>`,
|
||||||
|
to: email,
|
||||||
|
subject: "FunctionProject - Réinitialisation du mot de passe",
|
||||||
|
html: emailTemplate("Veuillez confirmer la réinitialisation du mot de passe", "Oui, je change mon mot de passe.", `${FRONT_END_HOST}/new-password?token=${tempToken}`, "Si vous avez reçu ce message par erreur, il suffit de le supprimer. Votre mot de passe ne sera pas réinitialiser si vous ne cliquez pas sur le lien ci-dessus. Par ailleurs, pour la sécurité de votre compte, la réinitialisation du mot de passe est disponible pendant un délai de 1 heure, passez ce temps, la réinitialisation ne sera plus valide.")
|
||||||
|
});
|
||||||
|
return res.status(200).json({ result: "Demande de réinitialisation du mot de passe réussi, veuillez vérifier vos emails!" });
|
||||||
|
} catch (error) {
|
||||||
|
console.log(error);
|
||||||
|
errorHandling(next, serverError);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
exports.newPassword = async (req, res, next) => {
|
||||||
|
const { tempToken, password } = req.body;
|
||||||
|
const errors = validationResult(req);
|
||||||
|
if (!errors.isEmpty()) {
|
||||||
|
return errorHandling(next, { message: errors.array()[0].msg, statusCode: 400 });
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
const user = await Users.findOne({ where: { tempToken } });
|
||||||
|
if (!user && parseInt(tempExpirationToken) < Date.now()) {
|
||||||
|
return errorHandling(next, { message: "Le token n'est pas valide.", statusCode: 400 });
|
||||||
|
}
|
||||||
|
const hashedPassword = await bcrypt.hash(password, 12);
|
||||||
|
user.password = hashedPassword;
|
||||||
|
user.tempToken = null;
|
||||||
|
user.tempExpirationToken = null;
|
||||||
|
await user.save();
|
||||||
|
return res.status(200).json({ result: "Le mot de passe a bien été modifié!" });
|
||||||
} catch (error) {
|
} catch (error) {
|
||||||
console.log(error);
|
console.log(error);
|
||||||
errorHandling(next, serverError);
|
errorHandling(next, serverError);
|
||||||
|
@ -8,6 +8,9 @@ const UsersRouter = Router();
|
|||||||
// Permet de se connecter
|
// Permet de se connecter
|
||||||
UsersRouter.post('/login', usersController.login);
|
UsersRouter.post('/login', usersController.login);
|
||||||
|
|
||||||
|
// TODO: Récupère les informations public d'un profil
|
||||||
|
// UsersRouter.get('/profile/:userName', usersController.getUserInfo);
|
||||||
|
|
||||||
// Permet de s'inscrire
|
// Permet de s'inscrire
|
||||||
UsersRouter.post('/register', [
|
UsersRouter.post('/register', [
|
||||||
body('email')
|
body('email')
|
||||||
@ -53,4 +56,18 @@ UsersRouter.post('/register', [
|
|||||||
// Confirme l'inscription
|
// Confirme l'inscription
|
||||||
UsersRouter.get('/confirm-email/:tempToken', usersController.confirmEmail);
|
UsersRouter.get('/confirm-email/:tempToken', usersController.confirmEmail);
|
||||||
|
|
||||||
|
// Demande une réinitialisation du mot de passe
|
||||||
|
UsersRouter.post('/reset-password', [
|
||||||
|
body('email')
|
||||||
|
.isEmail()
|
||||||
|
.withMessage("Veuillez rentré une adresse mail valide.")
|
||||||
|
], usersController.resetPassword);
|
||||||
|
|
||||||
|
// Nouveau mot de passe
|
||||||
|
UsersRouter.put('/reset-password', [
|
||||||
|
body('password')
|
||||||
|
.isLength({ min: 4 })
|
||||||
|
.withMessage("Votre mot de passe est trop court!")
|
||||||
|
], usersController.newPassword);
|
||||||
|
|
||||||
module.exports = UsersRouter;
|
module.exports = UsersRouter;
|
4211
website/package-lock.json
generated
4211
website/package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@ -11,7 +11,7 @@
|
|||||||
"@zeit/next-css": "^1.0.1",
|
"@zeit/next-css": "^1.0.1",
|
||||||
"axios": "^0.19.2",
|
"axios": "^0.19.2",
|
||||||
"html-react-parser": "^0.10.2",
|
"html-react-parser": "^0.10.2",
|
||||||
"next": "9.3.1",
|
"next": "9.3.2",
|
||||||
"next-fonts": "^1.0.3",
|
"next-fonts": "^1.0.3",
|
||||||
"nprogress": "^0.2.0",
|
"nprogress": "^0.2.0",
|
||||||
"react": "16.13.0",
|
"react": "16.13.0",
|
||||||
|
39
website/pages/login.js
Normal file
39
website/pages/login.js
Normal file
@ -0,0 +1,39 @@
|
|||||||
|
import { Fragment } from 'react';
|
||||||
|
import HeadTag from '../components/HeadTag';
|
||||||
|
import '../public/css/pages/register-login.css';
|
||||||
|
|
||||||
|
const Login = () => {
|
||||||
|
|
||||||
|
return (
|
||||||
|
<Fragment>
|
||||||
|
<HeadTag
|
||||||
|
title="Se connecter"
|
||||||
|
description="Connexion à FunctionProject."
|
||||||
|
/>
|
||||||
|
<div className="container Register-Login__container">
|
||||||
|
<div className="row Register-Login__row justify-content-center">
|
||||||
|
<div className="col-20">
|
||||||
|
<h1 className="Register-Login__title">Se connecter</h1>
|
||||||
|
<form>
|
||||||
|
<div className="form-group">
|
||||||
|
<label className="form-label" htmlFor="name">Email :</label>
|
||||||
|
<input type="email" name="email" id="email" className="form-control" placeholder="email@gmail.com" />
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div className="form-group">
|
||||||
|
<label className="form-label" htmlFor="name">Mot de passe :</label>
|
||||||
|
<input type="password" name="password" id="password" className="form-control" placeholder="******" />
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div className="form-group text-center">
|
||||||
|
<button type="submit" className="btn btn-dark">Envoyer</button>
|
||||||
|
</div>
|
||||||
|
</form>
|
||||||
|
<div className="form-result text-center"></div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</Fragment>
|
||||||
|
);
|
||||||
|
}
|
||||||
|
export default Login;
|
Reference in New Issue
Block a user