feat(server): remove phone number from authentication process

packages/server/src/services/Authentication/AuthApplication.ts

@@ -0,0 +1,56 @@
+import { Service, Inject, Container } from 'typedi';
+import { IRegisterDTO, ISystemUser, IPasswordReset } from '@/interfaces';
+import { AuthSigninService } from './AuthSignin';
+import { AuthSignupService } from './AuthSignup';
+import { AuthSendResetPassword } from './AuthSendResetPassword';
+
+@Service()
+export default class AuthenticationApplication {
+  @Inject()
+  private authSigninService: AuthSigninService;
+
+  @Inject()
+  private authSignupService: AuthSignupService;
+
+  @Inject()
+  private authResetPasswordService: AuthSendResetPassword;
+
+  /**
+   * Signin and generates JWT token.
+   * @throws {ServiceError}
+   * @param {string} email - Email address.
+   * @param {string} password - Password.
+   * @return {Promise<{user: IUser, token: string}>}
+   */
+  public async signIn(email: string, password: string) {
+    return this.authSigninService.signIn(email, password);
+  }
+
+  /**
+   * Signup a new user.
+   * @param {IRegisterDTO} signupDTO
+   * @returns {Promise<ISystemUser>}
+   */
+  public async signUp(signupDTO: IRegisterDTO): Promise<ISystemUser> {
+    return this.authSignupService.signUp(signupDTO);
+  }
+
+  /**
+   * Generates and retrieve password reset token for the given user email.
+   * @param {string} email
+   * @return {<Promise<IPasswordReset>}
+   */
+  public async sendResetPassword(email: string): Promise<IPasswordReset> {
+    return this.authResetPasswordService.sendResetPassword(email);
+  }
+
+  /**
+   * Resets a user password from given token.
+   * @param {string} token - Password reset token.
+   * @param {string} password - New Password.
+   * @return {Promise<void>}
+   */
+  public async resetPassword(token: string, password: string): Promise<void> {
+    return this.authResetPasswordService.resetPassword(token, password);
+  }
+}

packages/server/src/services/Authentication/AuthSendResetPassword.ts

@@ -0,0 +1,130 @@
+import { Inject, Service } from 'typedi';
+import uniqid from 'uniqid';
+import moment from 'moment';
+import config from '@/config';
+import {
+  IAuthResetedPasswordEventPayload,
+  IAuthSendedResetPassword,
+  IAuthSendingResetPassword,
+  IPasswordReset,
+  ISystemUser,
+} from '@/interfaces';
+import { EventPublisher } from '@/lib/EventPublisher/EventPublisher';
+import events from '@/subscribers/events';
+import { PasswordReset } from '@/system/models';
+import { ERRORS } from './_constants';
+import { ServiceError } from '@/exceptions';
+import { hashPassword } from '@/utils';
+
+@Service()
+export class AuthSendResetPassword {
+  @Inject()
+  private eventPublisher: EventPublisher;
+
+  @Inject('repositories')
+  private sysRepositories: any;
+
+  /**
+   * Generates and retrieve password reset token for the given user email.
+   * @param {string} email
+   * @return {<Promise<IPasswordReset>}
+   */
+  public async sendResetPassword(email: string): Promise<PasswordReset> {
+    const user = await this.validateEmailExistance(email);
+
+    const token: string = uniqid();
+
+    // Triggers sending reset password event.
+    await this.eventPublisher.emitAsync(events.auth.sendingResetPassword, {
+      user,
+      token,
+    } as IAuthSendingResetPassword);
+
+    // Delete all stored tokens of reset password that associate to the give email.
+    this.deletePasswordResetToken(email);
+
+    // Creates a new password reset row with unique token.
+    const passwordReset = await PasswordReset.query().insert({ email, token });
+
+    // Triggers sent reset password event.
+    await this.eventPublisher.emitAsync(events.auth.sendResetPassword, {
+      user,
+      token,
+    } as IAuthSendedResetPassword);
+
+    return passwordReset;
+  }
+
+  /**
+   * Resets a user password from given token.
+   * @param {string} token - Password reset token.
+   * @param {string} password - New Password.
+   * @return {Promise<void>}
+   */
+  public async resetPassword(token: string, password: string): Promise<void> {
+    const { systemUserRepository } = this.sysRepositories;
+
+    // Finds the password reset token.
+    const tokenModel: IPasswordReset = await PasswordReset.query().findOne(
+      'token',
+      token
+    );
+    // In case the password reset token not found throw token invalid error..
+    if (!tokenModel) {
+      throw new ServiceError(ERRORS.TOKEN_INVALID);
+    }
+    // Different between tokne creation datetime and current time.
+    if (
+      moment().diff(tokenModel.createdAt, 'seconds') >
+      config.resetPasswordSeconds
+    ) {
+      // Deletes the expired token by expired token email.
+      await this.deletePasswordResetToken(tokenModel.email);
+      throw new ServiceError(ERRORS.TOKEN_EXPIRED);
+    }
+    const user = await systemUserRepository.findOneByEmail(tokenModel.email);
+
+    if (!user) {
+      throw new ServiceError(ERRORS.USER_NOT_FOUND);
+    }
+    const hashedPassword = await hashPassword(password);
+
+    await systemUserRepository.update(
+      { password: hashedPassword },
+      { id: user.id }
+    );
+    // Deletes the used token.
+    await this.deletePasswordResetToken(tokenModel.email);
+
+    // Triggers `onResetPassword` event.
+    await this.eventPublisher.emitAsync(events.auth.resetPassword, {
+      user,
+      token,
+      password,
+    } as IAuthResetedPasswordEventPayload);
+  }
+
+  /**
+   * Deletes the password reset token by the given email.
+   * @param {string} email
+   * @returns {Promise}
+   */
+  private async deletePasswordResetToken(email: string) {
+    return PasswordReset.query().where('email', email).delete();
+  }
+
+  /**
+   * Validates the given email existance on the storage.
+   * @throws {ServiceError}
+   * @param {string} email - email address.
+   */
+  private async validateEmailExistance(email: string): Promise<ISystemUser> {
+    const { systemUserRepository } = this.sysRepositories;
+    const userByEmail = await systemUserRepository.findOneByEmail(email);
+
+    if (!userByEmail) {
+      throw new ServiceError(ERRORS.EMAIL_NOT_FOUND);
+    }
+    return userByEmail;
+  }
+}

packages/server/src/services/Authentication/AuthSignin.ts

@@ -0,0 +1,101 @@
+import { Container, Inject } from 'typedi';
+import { cloneDeep } from 'lodash';
+import { Tenant } from '@/system/models';
+import {
+  IAuthSigningInEventPayload,
+  IAuthSignInPOJO,
+  ISystemUser,
+} from '@/interfaces';
+import { ServiceError } from '@/exceptions';
+import events from '@/subscribers/events';
+import { EventPublisher } from '@/lib/EventPublisher/EventPublisher';
+import { generateToken } from './_utils';
+import { ERRORS } from './_constants';
+
+@Inject()
+export class AuthSigninService {
+  @Inject()
+  private eventPublisher: EventPublisher;
+
+  @Inject('repositories')
+  private sysRepositories: any;
+
+  /**
+   * Validates the given email and password.
+   * @param {ISystemUser} user 
+   * @param {string} email 
+   * @param {string} password 
+   */
+  public async validateSignIn(
+    user: ISystemUser,
+    email: string,
+    password: string
+  ) {
+    const loginThrottler = Container.get('rateLimiter.login');
+
+    // Validate if the user is not exist.
+    if (!user) {
+      await loginThrottler.hit(email);
+      throw new ServiceError(ERRORS.INVALID_DETAILS);
+    }
+    // Validate if the given user's password is wrong.
+    if (!user.verifyPassword(password)) {
+      await loginThrottler.hit(email);
+      throw new ServiceError(ERRORS.INVALID_DETAILS);
+    }
+    // Validate if the given user is inactive.
+    if (!user.active) {
+      throw new ServiceError(ERRORS.USER_INACTIVE);
+    }
+  }
+
+  /**
+   * Signin and generates JWT token.
+   * @throws {ServiceError}
+   * @param {string} email - Email address.
+   * @param {string} password - Password.
+   * @return {Promise<{user: IUser, token: string}>}
+   */
+  public async signIn(
+    email: string,
+    password: string
+  ): Promise<IAuthSignInPOJO> {
+    const { systemUserRepository } = this.sysRepositories;
+
+    // Finds the user of the given email address.
+    const user = await systemUserRepository.findOneByEmail(email);
+
+    // Validate the given email and password.
+    await this.validateSignIn(user, email, password);
+
+    // Triggers on signing-in event.
+    await this.eventPublisher.emitAsync(events.auth.logining, {
+      email,
+      password,
+      user,
+    } as IAuthSigningInEventPayload);
+
+    const token = generateToken(user);
+
+    // Update the last login at of the user.
+    await systemUserRepository.patchLastLoginAt(user.id);
+
+    // Triggers `onLogin` event.
+    await this.eventPublisher.emitAsync(events.auth.login, {
+      email,
+      password,
+      user,
+    });
+    const tenant = await Tenant.query()
+      .findById(user.tenantId)
+      .withGraphFetched('metadata');
+
+    // Keep the user object immutable.
+    const outputUser = cloneDeep(user);
+
+    // Remove password property from user object.
+    Reflect.deleteProperty(outputUser, 'password');
+
+    return { user: outputUser, token, tenant };
+  }
+}

packages/server/src/services/Authentication/AuthSignup.ts

@@ -0,0 +1,77 @@
+import { omit } from 'lodash';
+import moment from 'moment';
+import { ServiceError } from '@/exceptions';
+import {
+  IAuthSignedUpEventPayload,
+  IAuthSigningUpEventPayload,
+  IRegisterDTO,
+  ISystemUser,
+} from '@/interfaces';
+import { ERRORS } from './_constants';
+import { Inject } from 'typedi';
+import { EventPublisher } from '@/lib/EventPublisher/EventPublisher';
+import TenantsManagerService from '../Tenancy/TenantsManager';
+import events from '@/subscribers/events';
+import { hashPassword } from '@/utils';
+
+export class AuthSignupService {
+  @Inject()
+  private eventPublisher: EventPublisher;
+
+  @Inject('repositories')
+  private sysRepositories: any;
+
+  @Inject()
+  private tenantsManager: TenantsManagerService;
+
+  /**
+   * Registers a new tenant with user from user input.
+   * @throws {ServiceErrors}
+   * @param {IRegisterDTO} signupDTO
+   * @returns {Promise<ISystemUser>}
+   */
+  public async signUp(signupDTO: IRegisterDTO): Promise<ISystemUser> {
+    const { systemUserRepository } = this.sysRepositories;
+
+    // Validates the given email uniqiness.
+    await this.validateEmailUniqiness(signupDTO.email);
+
+    const hashedPassword = await hashPassword(signupDTO.password);
+
+    // Triggers signin up event.
+    await this.eventPublisher.emitAsync(events.auth.registering, {
+      signupDTO,
+    } as IAuthSigningUpEventPayload);
+
+    const tenant = await this.tenantsManager.createTenant();
+    const registeredUser = await systemUserRepository.create({
+      ...omit(signupDTO, 'country'),
+      active: true,
+      password: hashedPassword,
+      tenantId: tenant.id,
+      inviteAcceptedAt: moment().format('YYYY-MM-DD'),
+    });
+    // Triggers signed up event.
+    await this.eventPublisher.emitAsync(events.auth.register, {
+      signupDTO,
+      tenant,
+      user: registeredUser,
+    } as IAuthSignedUpEventPayload);
+
+    return registeredUser;
+  }
+
+  /**
+   * Validates email uniqiness on the storage.
+   * @throws {ServiceErrors}
+   * @param  {string} email - Email address
+   */
+  private async validateEmailUniqiness(email: string) {
+    const { systemUserRepository } = this.sysRepositories;
+    const isEmailExists = await systemUserRepository.findOneByEmail(email);
+
+    if (isEmailExists) {
+      throw new ServiceError(ERRORS.EMAIL_EXISTS);
+    }
+  }
+}

packages/server/src/services/Authentication/_constants.ts

@@ -0,0 +1,10 @@
+export const ERRORS = {
+  INVALID_DETAILS: 'INVALID_DETAILS',
+  USER_INACTIVE: 'USER_INACTIVE',
+  EMAIL_NOT_FOUND: 'EMAIL_NOT_FOUND',
+  TOKEN_INVALID: 'TOKEN_INVALID',
+  USER_NOT_FOUND: 'USER_NOT_FOUND',
+  TOKEN_EXPIRED: 'TOKEN_EXPIRED',
+  PHONE_NUMBER_EXISTS: 'PHONE_NUMBER_EXISTS',
+  EMAIL_EXISTS: 'EMAIL_EXISTS',
+};

packages/server/src/services/Authentication/_utils.ts

@@ -0,0 +1,22 @@
+import JWT from 'jsonwebtoken';
+import { ISystemUser } from '@/interfaces';
+import config from '@/config';
+
+/**
+ * Generates JWT token for the given user.
+ * @param {ISystemUser} user
+ * @return {string} token
+ */
+export const generateToken = (user: ISystemUser): string => {
+  const today = new Date();
+  const exp = new Date(today);
+  exp.setDate(today.getDate() + 60);
+
+  return JWT.sign(
+    {
+      id: user.id, // We are gonna use this in the middleware 'isAuth'
+      exp: exp.getTime() / 1000,
+    },
+    config.jwtSecret
+  );
+};

packages/server/src/services/Authentication/index.ts

@@ -1,322 +0,0 @@
-import { Service, Inject, Container } from 'typedi';
-import JWT from 'jsonwebtoken';
-import uniqid from 'uniqid';
-import { omit, cloneDeep } from 'lodash';
-import moment from 'moment';
-import { PasswordReset, Tenant } from '@/system/models';
-import {
-  IRegisterDTO,
-  ITenant,
-  ISystemUser,
-  IPasswordReset,
-  IAuthenticationService,
-} from '@/interfaces';
-import { hashPassword } from 'utils';
-import { ServiceError, ServiceErrors } from '@/exceptions';
-import config from '@/config';
-import events from '@/subscribers/events';
-import AuthenticationMailMessages from '@/services/Authentication/AuthenticationMailMessages';
-import TenantsManager from '@/services/Tenancy/TenantsManager';
-import { EventPublisher } from '@/lib/EventPublisher/EventPublisher';
-
-const ERRORS = {
-  INVALID_DETAILS: 'INVALID_DETAILS',
-  USER_INACTIVE: 'USER_INACTIVE',
-  EMAIL_NOT_FOUND: 'EMAIL_NOT_FOUND',
-  TOKEN_INVALID: 'TOKEN_INVALID',
-  USER_NOT_FOUND: 'USER_NOT_FOUND',
-  TOKEN_EXPIRED: 'TOKEN_EXPIRED',
-  PHONE_NUMBER_EXISTS: 'PHONE_NUMBER_EXISTS',
-  EMAIL_EXISTS: 'EMAIL_EXISTS',
-};
-@Service()
-export default class AuthenticationService implements IAuthenticationService {
-  @Inject('logger')
-  logger: any;
-
-  @Inject()
-  eventPublisher: EventPublisher;
-
-  @Inject()
-  mailMessages: AuthenticationMailMessages;
-
-  @Inject('repositories')
-  sysRepositories: any;
-
-  @Inject()
-  tenantsManager: TenantsManager;
-
-  /**
-   * Signin and generates JWT token.
-   * @throws  {ServiceError}
-   * @param  {string} emailOrPhone - Email or phone number.
-   * @param  {string} password - Password.
-   * @return {Promise<{user: IUser, token: string}>}
-   */
-  public async signIn(
-    emailOrPhone: string,
-    password: string
-  ): Promise<{
-    user: ISystemUser;
-    token: string;
-    tenant: ITenant;
-  }> {
-    this.logger.info('[login] Someone trying to login.', {
-      emailOrPhone,
-      password,
-    });
-    const { systemUserRepository } = this.sysRepositories;
-    const loginThrottler = Container.get('rateLimiter.login');
-
-    // Finds the user of the given email or phone number.
-    const user = await systemUserRepository.findByCrediential(emailOrPhone);
-
-    if (!user) {
-      // Hits the loging throttler to the given crediential.
-      await loginThrottler.hit(emailOrPhone);
-
-      this.logger.info('[login] invalid data');
-      throw new ServiceError(ERRORS.INVALID_DETAILS);
-    }
-
-    this.logger.info('[login] check password validation.', {
-      emailOrPhone,
-      password,
-    });
-    if (!user.verifyPassword(password)) {
-      // Hits the loging throttler to the given crediential.
-      await loginThrottler.hit(emailOrPhone);
-
-      throw new ServiceError(ERRORS.INVALID_DETAILS);
-    }
-    if (!user.active) {
-      this.logger.info('[login] user inactive.', { userId: user.id });
-      throw new ServiceError(ERRORS.USER_INACTIVE);
-    }
-
-    this.logger.info('[login] generating JWT token.', { userId: user.id });
-    const token = this.generateToken(user);
-
-    this.logger.info('[login] updating user last login at.', {
-      userId: user.id,
-    });
-    await systemUserRepository.patchLastLoginAt(user.id);
-
-    this.logger.info('[login] Logging success.', { user, token });
-
-    // Triggers `onLogin` event.
-    await this.eventPublisher.emitAsync(events.auth.login, {
-      emailOrPhone,
-      password,
-      user,
-    });
-    const tenant = await Tenant.query().findById(user.tenantId).withGraphFetched('metadata');
-
-    // Keep the user object immutable.
-    const outputUser = cloneDeep(user);
-
-    // Remove password property from user object.
-    Reflect.deleteProperty(outputUser, 'password');
-
-    return { user: outputUser, token, tenant };
-  }
-
-  /**
-   * Validates email and phone number uniqiness on the storage.
-   * @throws {ServiceErrors}
-   * @param  {IRegisterDTO} registerDTO - Register data object.
-   */
-  private async validateEmailAndPhoneUniqiness(registerDTO: IRegisterDTO) {
-    const { systemUserRepository } = this.sysRepositories;
-
-    const isEmailExists = await systemUserRepository.findOneByEmail(
-      registerDTO.email
-    );
-    const isPhoneExists = await systemUserRepository.findOneByPhoneNumber(
-      registerDTO.phoneNumber
-    );
-    const errorReasons: ServiceError[] = [];
-
-    if (isPhoneExists) {
-      this.logger.info('[register] phone number exists on the storage.');
-      errorReasons.push(new ServiceError(ERRORS.PHONE_NUMBER_EXISTS));
-    }
-    if (isEmailExists) {
-      this.logger.info('[register] email exists on the storage.');
-      errorReasons.push(new ServiceError(ERRORS.EMAIL_EXISTS));
-    }
-    if (errorReasons.length > 0) {
-      throw new ServiceErrors(errorReasons);
-    }
-  }
-
-  /**
-   * Registers a new tenant with user from user input.
-   * @throws {ServiceErrors}
-   * @param {IUserDTO} user
-   */
-  public async register(registerDTO: IRegisterDTO): Promise<ISystemUser> {
-    this.logger.info('[register] Someone trying to register.');
-    await this.validateEmailAndPhoneUniqiness(registerDTO);
-
-    this.logger.info('[register] Creating a new tenant organization.');
-    const tenant = await this.newTenantOrganization();
-
-    this.logger.info('[register] Trying hashing the password.');
-    const hashedPassword = await hashPassword(registerDTO.password);
-
-    const { systemUserRepository } = this.sysRepositories;
-    const registeredUser = await systemUserRepository.create({
-      ...omit(registerDTO, 'country'),
-      active: true,
-      password: hashedPassword,
-      tenantId: tenant.id,
-      inviteAcceptedAt: moment().format('YYYY-MM-DD'),
-    });
-    // Triggers `onRegister` event.
-    await this.eventPublisher.emitAsync(events.auth.register, {
-      registerDTO,
-      tenant,
-      user: registeredUser,
-    });
-    return registeredUser;
-  }
-
-  /**
-   * Generates and insert new tenant organization id.
-   * @async
-   * @return {Promise<ITenant>}
-   */
-  private async newTenantOrganization(): Promise<ITenant> {
-    return this.tenantsManager.createTenant();
-  }
-
-  /**
-   * Validate the given email existance on the storage.
-   * @throws {ServiceError}
-   * @param  {string} email - email address.
-   */
-  private async validateEmailExistance(email: string): Promise<ISystemUser> {
-    const { systemUserRepository } = this.sysRepositories;
-    const userByEmail = await systemUserRepository.findOneByEmail(email);
-
-    if (!userByEmail) {
-      this.logger.info('[send_reset_password] The given email not found.');
-      throw new ServiceError(ERRORS.EMAIL_NOT_FOUND);
-    }
-    return userByEmail;
-  }
-
-  /**
-   * Generates and retrieve password reset token for the given user email.
-   * @param {string} email
-   * @return {<Promise<IPasswordReset>}
-   */
-  public async sendResetPassword(email: string): Promise<IPasswordReset> {
-    this.logger.info('[send_reset_password] Trying to send reset password.');
-    const user = await this.validateEmailExistance(email);
-
-    // Delete all stored tokens of reset password that associate to the give email.
-    this.logger.info(
-      '[send_reset_password] trying to delete all tokens by email.'
-    );
-    this.deletePasswordResetToken(email);
-
-    const token: string = uniqid();
-
-    this.logger.info('[send_reset_password] insert the generated token.');
-    const passwordReset = await PasswordReset.query().insert({ email, token });
-
-    // Triggers `onSendResetPassword` event.
-    await this.eventPublisher.emitAsync(events.auth.sendResetPassword, {
-      user,
-      token,
-    });
-    return passwordReset;
-  }
-
-  /**
-   * Resets a user password from given token.
-   * @param {string} token - Password reset token.
-   * @param {string} password - New Password.
-   * @return {Promise<void>}
-   */
-  public async resetPassword(token: string, password: string): Promise<void> {
-    const { systemUserRepository } = this.sysRepositories;
-
-    // Finds the password reset token.
-    const tokenModel: IPasswordReset = await PasswordReset.query().findOne(
-      'token',
-      token
-    );
-    // In case the password reset token not found throw token invalid error..
-    if (!tokenModel) {
-      this.logger.info('[reset_password] token invalid.');
-      throw new ServiceError(ERRORS.TOKEN_INVALID);
-    }
-    // Different between tokne creation datetime and current time.
-    if (
-      moment().diff(tokenModel.createdAt, 'seconds') >
-      config.resetPasswordSeconds
-    ) {
-      this.logger.info('[reset_password] token expired.');
-
-      // Deletes the expired token by expired token email.
-      await this.deletePasswordResetToken(tokenModel.email);
-      throw new ServiceError(ERRORS.TOKEN_EXPIRED);
-    }
-    const user = await systemUserRepository.findOneByEmail(tokenModel.email);
-
-    if (!user) {
-      throw new ServiceError(ERRORS.USER_NOT_FOUND);
-    }
-    const hashedPassword = await hashPassword(password);
-
-    this.logger.info('[reset_password] saving a new hashed password.');
-    await systemUserRepository.update(
-      { password: hashedPassword },
-      { id: user.id }
-    );
-
-    // Deletes the used token.
-    await this.deletePasswordResetToken(tokenModel.email);
-
-    // Triggers `onResetPassword` event.
-    await this.eventPublisher.emitAsync(events.auth.resetPassword, {
-      user,
-      token,
-      password,
-    });
-    this.logger.info('[reset_password] reset password success.');
-  }
-
-  /**
-   * Deletes the password reset token by the given email.
-   * @param  {string} email
-   * @returns {Promise}
-   */
-  private async deletePasswordResetToken(email: string) {
-    this.logger.info('[reset_password] trying to delete all tokens by email.');
-    return PasswordReset.query().where('email', email).delete();
-  }
-
-  /**
-   * Generates JWT token for the given user.
-   * @param {ISystemUser} user
-   * @return {string} token
-   */
-  generateToken(user: ISystemUser): string {
-    const today = new Date();
-    const exp = new Date(today);
-    exp.setDate(today.getDate() + 60);
-
-    this.logger.silly(`Sign JWT for userId: ${user.id}`);
-    return JWT.sign(
-      {
-        id: user.id, // We are gonna use this in the middleware 'isAuth'
-        exp: exp.getTime() / 1000,
-      },
-      config.jwtSecret
-    );
-  }
-}