From e9645610d2aac8d318a0e0835e8583ec25db68b7 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 14 Feb 2024 08:08:47 +0100 Subject: [PATCH 01/52] refs #6427 feat: use query for multiple models --- back/methods/vn-user/recover-password.js | 34 +++++++++++++++++++----- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/back/methods/vn-user/recover-password.js b/back/methods/vn-user/recover-password.js index b0f7122b4..c1a5f67d7 100644 --- a/back/methods/vn-user/recover-password.js +++ b/back/methods/vn-user/recover-password.js @@ -1,3 +1,5 @@ +const server = require('vn-loopback/server/server'); + module.exports = Self => { Self.remoteMethod('recoverPassword', { description: 'Send email to the user', @@ -21,20 +23,38 @@ module.exports = Self => { }); Self.recoverPassword = async function(user, app) { - const models = Self.app.models; + // const models = Self.app.models; - const usesEmail = user.indexOf('@') !== -1; + // const usesEmail = user.indexOf('@') !== -1; + const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(user); + /* if (usesPhone) { + const worker = await models.Client.findOne({ + fields: ['email', 'phone'], + where: {or: [{name: user, phone: user}]} + }); + if (!worker) return; + user = worker.email; + } if (!usesEmail) { const account = await models.VnUser.findOne({ - fields: ['email'], - where: {name: user} + fields: ['email', 'phone'], + where: {or: [{name: user, phone: user}]} }); if (!account) return; user = account.email; - } - + }*/ + const account = await Self.app.models.Application.rawSql( + `SELECT c.id, c.phone, u.email from account.user u, vn.client c + where c.id=u.id and( u.email = ? or u.name = ? or c.phone = ?)`, + [user, user, user]); + if (!account || account.length > 1) return; + const {email, phone} = account[0]; try { - await Self.resetPassword({email: user, emailTemplate: 'recover-password', app}); + // if (usesPhone) { + // await models.Sms.send(ctx, user, Self.resetPassword({email: user, usesPhone})); + // } else { + await Self.resetPassword({email, phone, emailTemplate: 'recover-password', app, usesPhone}); + // } } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; -- 2.40.1 From 039de2f48516a97df6c5cda5d344269baf35c127 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 14 Feb 2024 08:09:51 +0100 Subject: [PATCH 02/52] refs #6427 db: add phone for client in fixtures --- back/methods/vn-user/recover-password.js | 26 ++---------------------- back/models/vn-user.js | 9 +++++--- db/dump/fixtures.before.sql | 6 +++++- 3 files changed, 13 insertions(+), 28 deletions(-) diff --git a/back/methods/vn-user/recover-password.js b/back/methods/vn-user/recover-password.js index c1a5f67d7..be3bdadb7 100644 --- a/back/methods/vn-user/recover-password.js +++ b/back/methods/vn-user/recover-password.js @@ -1,4 +1,3 @@ -const server = require('vn-loopback/server/server'); module.exports = Self => { Self.remoteMethod('recoverPassword', { @@ -23,38 +22,17 @@ module.exports = Self => { }); Self.recoverPassword = async function(user, app) { - // const models = Self.app.models; - - // const usesEmail = user.indexOf('@') !== -1; const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(user); - /* if (usesPhone) { - const worker = await models.Client.findOne({ - fields: ['email', 'phone'], - where: {or: [{name: user, phone: user}]} - }); - if (!worker) return; - user = worker.email; - } - if (!usesEmail) { - const account = await models.VnUser.findOne({ - fields: ['email', 'phone'], - where: {or: [{name: user, phone: user}]} - }); - if (!account) return; - user = account.email; - }*/ const account = await Self.app.models.Application.rawSql( `SELECT c.id, c.phone, u.email from account.user u, vn.client c where c.id=u.id and( u.email = ? or u.name = ? or c.phone = ?)`, [user, user, user]); + if (!account || account.length > 1) return; const {email, phone} = account[0]; + try { - // if (usesPhone) { - // await models.Sms.send(ctx, user, Self.resetPassword({email: user, usesPhone})); - // } else { await Self.resetPassword({email, phone, emailTemplate: 'recover-password', app, usesPhone}); - // } } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; diff --git a/back/models/vn-user.js b/back/models/vn-user.js index 3a416d7e3..f293ca3d3 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -118,10 +118,13 @@ module.exports = function(Self) { const options = Object.assign({}, info.options); for (const param in options) params[param] = options[param]; + if (info.options?.usesPhone) + await Self.app.models.Sms.send({req: {accessToken: info.accessToken}}, +info.options.phone, params.url); + else { + const email = new Email(options.emailTemplate, params); - const email = new Email(options.emailTemplate, params); - - return email.send(); + return email.send(); + } }); /** diff --git a/db/dump/fixtures.before.sql b/db/dump/fixtures.before.sql index 094b956af..1e701d58c 100644 --- a/db/dump/fixtures.before.sql +++ b/db/dump/fixtures.before.sql @@ -728,7 +728,7 @@ INSERT INTO `vn`.`route`(`id`, `time`, `workerFk`, `created`, `vehicleFk`, `agen INSERT INTO `vn`.`ticket`(`id`, `priority`, `agencyModeFk`,`warehouseFk`,`routeFk`, `shipped`, `landed`, `clientFk`,`nickname`, `addressFk`, `refFk`, `isDeleted`, `zoneFk`, `zonePrice`, `zoneBonus`, `created`, `weight`, `cmrFk`) VALUES (1 , 3, 1, 1, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -1 MONTH), DATE_ADD(DATE_ADD(util.VN_CURDATE(),INTERVAL -1 MONTH), INTERVAL +1 DAY), 1101, 'Bat cave', 121, NULL, 0, 1, 5, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -1 MONTH), 1, 1), - (2 , 1, 1, 1, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -1 MONTH), DATE_ADD(DATE_ADD(util.VN_CURDATE(),INTERVAL -1 MONTH), INTERVAL +1 DAY), 1101, 'Bat cave', 1, NULL, 0, 1, 5, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -1 MONTH), 2, 2), + (2 , 1, 1, 1, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -1 MONTH), DATE_ADD(DATE_ADD(util.VN_CURDATE(),INTERVAL -1 MONTH), INTERVAL +1 DAY), 1101, 'Bat cave', 1, NULL, 0, 1, 5, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -1 MONTH), 2, 2), (3 , 1, 7, 1, 6, DATE_ADD(util.VN_CURDATE(), INTERVAL -2 MONTH), DATE_ADD(DATE_ADD(util.VN_CURDATE(),INTERVAL -2 MONTH), INTERVAL +1 DAY), 1104, 'Stark tower', 124, NULL, 0, 3, 5, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -2 MONTH), NULL, 3), (4 , 3, 2, 1, 2, DATE_ADD(util.VN_CURDATE(), INTERVAL -3 MONTH), DATE_ADD(DATE_ADD(util.VN_CURDATE(),INTERVAL -3 MONTH), INTERVAL +1 DAY), 1104, 'Stark tower', 124, NULL, 0, 9, 5, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -3 MONTH), NULL, NULL), (5 , 3, 3, 3, 3, DATE_ADD(util.VN_CURDATE(), INTERVAL -4 MONTH), DATE_ADD(DATE_ADD(util.VN_CURDATE(),INTERVAL -4 MONTH), INTERVAL +1 DAY), 1104, 'Stark tower', 124, NULL, 0, 10, 5, 1, DATE_ADD(util.VN_CURDATE(), INTERVAL -4 MONTH), NULL, NULL), @@ -3067,3 +3067,7 @@ INSERT INTO `vn`.`cmr` (id,truckPlate,observations,senderInstruccions,paymentIns VALUES (1,'123456A','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet',442,1,2,1,'Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet'), (2,'123456N','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet',69,3,4,2,'Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet'), (3,'123456B','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet',567,5,6,69,'Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet','Lorem ipsum dolor sit amet'); + +UPDATE `vn`.`client` + SET phone= 432978106 + WHERE id=9; -- 2.40.1 From c86089ea6da1a03da871a8e5dfc1fd7eeff6dd7c Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 14 Feb 2024 08:10:01 +0100 Subject: [PATCH 03/52] refs #6427 feat: front --- .../components/recover-password/index.html | 23 +++++++++++++++---- .../components/recover-password/index.js | 7 ++++++ .../components/recover-password/locale/es.yml | 2 ++ 3 files changed, 28 insertions(+), 4 deletions(-) diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 5121f81bd..feb641efc 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -1,13 +1,28 @@
Recover password
+ + -
- We will sent you an email to recover your password + + +
+ + We will sent you a sms + + + We will sent you an email to recover your password +
diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 5ffc305f9..edb623237 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -10,6 +10,13 @@ export default class Controller { $translate, $state }); + $scope.$watch('$ctrl.user', function(nuevoValor, antiguoValor) { + // Esta función se ejecutará cada vez que numeroMovil cambie + console.log($scope); + let isSms = /([+]\d{2})?\d{9}$/ig.test(nuevoValor ?? ''); + $scope.$ctrl.sms = isSms; + // Aquí puedes realizar las acciones que desees con el nuevo valor + }); } goToLogin() { diff --git a/front/salix/components/recover-password/locale/es.yml b/front/salix/components/recover-password/locale/es.yml index 69777fa65..5fd032bd5 100644 --- a/front/salix/components/recover-password/locale/es.yml +++ b/front/salix/components/recover-password/locale/es.yml @@ -1,4 +1,6 @@ Recover password: Recuperar contraseña We will sent you an email to recover your password: Te enviaremos un correo para restablecer tu contraseña +We will sent you a sms: Te enviaremos un sms para restablecer tu contraseña Notification sent!: ¡Notificación enviada! User or recovery email: Usuario o correo de recuperación +User's phone: Móvil del usuario -- 2.40.1 From 91c3100a6d44e8a639e94519186cc5df3f19aea9 Mon Sep 17 00:00:00 2001 From: JAVIER SEGARRA MARTINEZ Date: Wed, 14 Feb 2024 11:00:36 +0000 Subject: [PATCH 04/52] refs #6427 feat: comments --- front/salix/components/recover-password/index.js | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index edb623237..79df29b78 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -10,12 +10,10 @@ export default class Controller { $translate, $state }); - $scope.$watch('$ctrl.user', function(nuevoValor, antiguoValor) { - // Esta función se ejecutará cada vez que numeroMovil cambie - console.log($scope); + $scope.$watch('$ctrl.user', function(nuevoValor) { let isSms = /([+]\d{2})?\d{9}$/ig.test(nuevoValor ?? ''); + // Evaluo si el valor introducido es un número y se marca o desmarca el checkbox de revibir por sms $scope.$ctrl.sms = isSms; - // Aquí puedes realizar las acciones que desees con el nuevo valor }); } -- 2.40.1 From fa63efd42bd21732c9eaecd551feb3fff3682be3 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Mon, 18 Mar 2024 12:48:38 +0100 Subject: [PATCH 05/52] refs #6427 feat: alter account.user table --- db/versions/10958-orangeDendro/00-firstScript.sql | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 db/versions/10958-orangeDendro/00-firstScript.sql diff --git a/db/versions/10958-orangeDendro/00-firstScript.sql b/db/versions/10958-orangeDendro/00-firstScript.sql new file mode 100644 index 000000000..20d93e48f --- /dev/null +++ b/db/versions/10958-orangeDendro/00-firstScript.sql @@ -0,0 +1,2 @@ +-- Place your SQL code here +ALTER TABLE account.`user` ADD recoveryPhone varchar(20) NULL; -- 2.40.1 From 6a4749318017ff2abc9def02f054308126ee2f49 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Mon, 18 Mar 2024 14:58:33 +0100 Subject: [PATCH 06/52] refs #6427 feat: copy phone from vn.client --- .../10958-orangeDendro/01-updateUserPhoneColumn.vn.sql | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql diff --git a/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql b/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql new file mode 100644 index 000000000..390d6c4c1 --- /dev/null +++ b/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql @@ -0,0 +1,5 @@ + +-- Actualiza los valores de la nueva columna con los valores correspondientes de la tabla userInfo +UPDATE `account`.`user` as `user` +JOIN vn.client `client` ON `user`.id = `client`.id +SET `user`.recoveryPhone = `client`.phone; -- 2.40.1 From 01f23abec969defa3802efc2495a15483e931cdc Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 20 Mar 2024 13:48:54 +0100 Subject: [PATCH 07/52] refs #6427 perf: restore method --- back/methods/vn-user/recover-password.js | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/back/methods/vn-user/recover-password.js b/back/methods/vn-user/recover-password.js index be3bdadb7..b0f7122b4 100644 --- a/back/methods/vn-user/recover-password.js +++ b/back/methods/vn-user/recover-password.js @@ -1,4 +1,3 @@ - module.exports = Self => { Self.remoteMethod('recoverPassword', { description: 'Send email to the user', @@ -22,17 +21,20 @@ module.exports = Self => { }); Self.recoverPassword = async function(user, app) { - const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(user); - const account = await Self.app.models.Application.rawSql( - `SELECT c.id, c.phone, u.email from account.user u, vn.client c - where c.id=u.id and( u.email = ? or u.name = ? or c.phone = ?)`, - [user, user, user]); + const models = Self.app.models; - if (!account || account.length > 1) return; - const {email, phone} = account[0]; + const usesEmail = user.indexOf('@') !== -1; + if (!usesEmail) { + const account = await models.VnUser.findOne({ + fields: ['email'], + where: {name: user} + }); + if (!account) return; + user = account.email; + } try { - await Self.resetPassword({email, phone, emailTemplate: 'recover-password', app, usesPhone}); + await Self.resetPassword({email: user, emailTemplate: 'recover-password', app}); } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; -- 2.40.1 From bfc8cda8a21f4bc655ce2df2875cad0dddc8efb1 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 20 Mar 2024 13:49:49 +0100 Subject: [PATCH 08/52] refs #6427 feat restorePassWordSMS --- back/methods/vn-user/recover-passwordSMS.js | 103 ++++++++++++++++++++ back/models/vn-user.js | 1 + back/models/vn-user.json | 7 ++ db/dump/fixtures.after.sql | 5 + db/dump/fixtures.before.sql | 4 - loopback/locale/es.json | 5 +- 6 files changed, 120 insertions(+), 5 deletions(-) create mode 100644 back/methods/vn-user/recover-passwordSMS.js diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js new file mode 100644 index 000000000..af9b99f41 --- /dev/null +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -0,0 +1,103 @@ +const UserError = require('vn-loopback/util/user-error'); +const OTP_CHAR = ':'; +function original({id, phone}) { + // Suma el número de teléfono y el número aleatorio + let suma = parseInt(phone) + parseInt(id); + + // Convierte la suma a una cadena y toma solo los últimos 6 dígitos + let resultado = suma.toString().slice(-6); + + // Devuelve los últimos 6 dígitos + return parseInt(resultado); // Devolvemos un número entero, no una cadena +} +function reverse(params) { + const _original = original(params); + return parseInt(_original.toString().split('').reverse().join('')); +} + +function generateOTP(params, _otpType) { + const otpIndex = Math.floor(Math.random() * Object.keys(OTP_TYPES).length); + const otpType = _otpType ?? Object.keys(OTP_TYPES)[otpIndex]; + const otp = OTP_TYPES[otpType](params); + return formatOTP(otpType, otp); +} + +function formatOTP(otpType, otpValue) { + return `${otpType}${OTP_CHAR}${otpValue}`; +} + +function checkOTP(params, otp) { + const [otpType, value] = otp.split(OTP_CHAR); + return generateOTP(params, otpType) === formatOTP(otpType, value); +} + +const OTP_TYPES = { + // 'A': original, + 'B': reverse, +}; +module.exports = Self => { + Self.remoteMethod('recoverPasswordSMS', { + description: 'Send SMS to the user', + accepts: [ + { + arg: 'ctx', + type: 'Object', + http: {source: 'context'} + }, + { + arg: 'id', + type: 'string', + description: 'The user id', + required: true + }, + { + arg: 'phone', + type: 'string', + description: 'The user name or email', + required: true + }, + { + arg: 'otp', + type: 'string', + description: 'The directory for mail' + } + ], + returns: { + type: 'Object', + root: true + }, + http: { + path: `/recoverPasswordSMS`, + verb: 'POST' + } + }); + + Self.recoverPasswordSMS = async function(ctx, id, phone, otp) { + const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(+phone); + + if (!usesPhone) throw new UserError('Phone not valid'); + + let query = { + fields: ['id', 'phone', 'email'], + where: {id, phone} + }; + + const user = await Self.findOne(query); + if (!user) throw new UserError('Credentials not valid'); + + try { + if (otp) { + return { + valid: checkOTP(query.where, otp), + token: await user.accessTokens.create({}) + }; + } + return {otp: generateOTP(query.where)}; + } catch (err) { + if (err.code === 'EMAIL_NOT_FOUND') + return; + else + throw err; + } + }; +}; diff --git a/back/models/vn-user.js b/back/models/vn-user.js index 4a92da8c4..e700217d8 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -10,6 +10,7 @@ module.exports = function(Self) { require('../methods/vn-user/sign-in')(Self); require('../methods/vn-user/acl')(Self); require('../methods/vn-user/recover-password')(Self); + require('../methods/vn-user/recover-passwordSMS')(Self); require('../methods/vn-user/privileges')(Self); require('../methods/vn-user/validate-auth')(Self); require('../methods/vn-user/renew-token')(Self); diff --git a/back/models/vn-user.json b/back/models/vn-user.json index 5f6ac3f47..a4c4f4966 100644 --- a/back/models/vn-user.json +++ b/back/models/vn-user.json @@ -106,6 +106,13 @@ "principalId": "$everyone", "permission": "ALLOW" }, + { + "property": "recoverPasswordSMS", + "accessType": "EXECUTE", + "principalType": "ROLE", + "principalId": "$everyone", + "permission": "ALLOW" + }, { "property": "validateAuth", "accessType": "EXECUTE", diff --git a/db/dump/fixtures.after.sql b/db/dump/fixtures.after.sql index d7f3b22e8..0746dca65 100644 --- a/db/dump/fixtures.after.sql +++ b/db/dump/fixtures.after.sql @@ -324,4 +324,9 @@ INSERT INTO mysql.roles_mapping (`User`, `Host`, `Role`, `Admin_option`) FROM mysql.roles_mapping WHERE `User` LIKE @prefixedLike AND `Host` = @genRoleHost; +-- Actualiza los valores de la nueva columna con los valores correspondientes de la tabla userInfo +UPDATE `account`.`user` as `user` +JOIN vn.client `client` ON `user`.id = `client`.id +SET `user`.recoveryPhone = `client`.phone; + FLUSH PRIVILEGES; diff --git a/db/dump/fixtures.before.sql b/db/dump/fixtures.before.sql index 549feb5aa..21134afd9 100644 --- a/db/dump/fixtures.before.sql +++ b/db/dump/fixtures.before.sql @@ -3071,10 +3071,6 @@ UPDATE `vn`.`client` SET phone= 432978106 WHERE id=9; -UPDATE `vn`.`client` - SET phone= 432978106 - WHERE id=9; - UPDATE vn.department SET workerFk = null; diff --git a/loopback/locale/es.json b/loopback/locale/es.json index 7730d4a8c..2940a5672 100644 --- a/loopback/locale/es.json +++ b/loopback/locale/es.json @@ -348,5 +348,8 @@ "You are not allowed to modify the alias": "No estás autorizado a modificar el alias", "The address of the customer must have information about Incoterms and Customs Agent": "El consignatario del cliente debe tener informado Incoterms y Agente de aduanas", "This password can only be changed by the user themselves": "Esta contraseña solo puede ser modificada por el propio usuario", - "They're not your subordinate": "No es tu subordinado/a." + "They're not your subordinate": "No es tu subordinado/a.", + "Phone not valid": "Teléfono no es válido", + "User not valid": "Usuario no válido", + "Credentials not valid": "Credenciales no válidas" } -- 2.40.1 From 8d6fc401a1fe64ba5981bf8854cda42db71b5fe5 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 20 Mar 2024 13:50:37 +0100 Subject: [PATCH 09/52] refs #6427 feat: front restorePasswordSMS --- .../components/recover-password/index.html | 19 ++++++++ .../components/recover-password/index.js | 48 +++++++++++++++---- .../components/recover-password/locale/es.yml | 2 + .../salix/components/reset-password/index.js | 2 +- 4 files changed, 60 insertions(+), 11 deletions(-) diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index feb641efc..cb8bbe06d 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -12,10 +12,29 @@ + + + +
We will sent you a sms diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 79df29b78..723dd47c1 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -1,14 +1,16 @@ +import UserError from '../../../core/lib/user-error'; import ngModule from '../../module'; export default class Controller { - constructor($scope, $element, $http, vnApp, $translate, $state) { + constructor($scope, $element, $http, vnApp, $translate, $state, $location) { Object.assign(this, { $scope, $element, $http, vnApp, $translate, - $state + $state, + $location }); $scope.$watch('$ctrl.user', function(nuevoValor) { let isSms = /([+]\d{2})?\d{9}$/ig.test(nuevoValor ?? ''); @@ -16,24 +18,50 @@ export default class Controller { $scope.$ctrl.sms = isSms; }); } + // ONLY FOR TESTS + // $onInit() { + // this.$scope.$ctrl.sms = true; + // this.$scope.$ctrl.userId = '9'; + // this.$scope.$ctrl.user = '432978106'; + // } goToLogin() { this.vnApp.showSuccess(this.$translate.instant('Notification sent!')); this.$state.go('login'); } + goToChangePassword({valid: isValid, token}) { + if (!isValid) + this.vnApp.showError(this.$translate.instant('Invalid login')); + else { + this.$state.params.userId = this.userId; + this.$location.path('/reset-password').search('access_token', token.id); + } + } + goToOTP(otp) { + this.otp = true; + this.$state.params.otp = otp; + this.code = otp; + } submit() { - const params = { - user: this.user - }; + if (!this.user || (this.sms && !this.userId) || (this.otp && !this.code)) + throw new UserError(`Credentials not valid`); - this.$http.post('VnUsers/recoverPassword', params) - .then(() => { - this.goToLogin(); - }); + if (this.sms || this.otp) { + this.$http.post('VnUsers/recoverPasswordSMS', {id: this.userId, phone: this.user, otp: this.code}) + .then(({data}) => { + data.otp && this.goToOTP(data.otp); + data.valid && this.goToChangePassword(data); + }); + } else { + this.$http.post('VnUsers/recoverPassword', {user: this.user}) + .then(() => { + this.goToLogin(); + }); + } } } -Controller.$inject = ['$scope', '$element', '$http', 'vnApp', '$translate', '$state']; +Controller.$inject = ['$scope', '$element', '$http', 'vnApp', '$translate', '$state', '$location']; ngModule.vnComponent('vnRecoverPassword', { template: require('./index.html'), diff --git a/front/salix/components/recover-password/locale/es.yml b/front/salix/components/recover-password/locale/es.yml index 5fd032bd5..167f45e69 100644 --- a/front/salix/components/recover-password/locale/es.yml +++ b/front/salix/components/recover-password/locale/es.yml @@ -4,3 +4,5 @@ We will sent you a sms: Te enviaremos un sms para restablecer tu contraseña Notification sent!: ¡Notificación enviada! User or recovery email: Usuario o correo de recuperación User's phone: Móvil del usuario +User's id: Id del usuario +Credentials not valid: Credenciales no válidas diff --git a/front/salix/components/reset-password/index.js b/front/salix/components/reset-password/index.js index c0a10cc52..ba1240b45 100644 --- a/front/salix/components/reset-password/index.js +++ b/front/salix/components/reset-password/index.js @@ -28,7 +28,7 @@ export default class Controller { throw new UserError(`Passwords don't match`); const headers = { - Authorization: this.$location.$$search.access_token + Authorization: this.$location.$$search.access_token ?? this.$state.params.access_token }; const newPassword = this.newPassword; -- 2.40.1 From f75bd04736259346889da07d08ec776edb86afa6 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 20 Mar 2024 14:11:05 +0100 Subject: [PATCH 10/52] refs #6427 perf: restorePasswordSMS --- back/methods/vn-user/recover-passwordSMS.js | 38 ++++++++++++--------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index af9b99f41..3305805c0 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -1,29 +1,29 @@ const UserError = require('vn-loopback/util/user-error'); const OTP_CHAR = ':'; function original({id, phone}) { - // Suma el número de teléfono y el número aleatorio - let suma = parseInt(phone) + parseInt(id); + const total = parseInt(phone) + parseInt(id); + const value = total.toString().slice(-6); - // Convierte la suma a una cadena y toma solo los últimos 6 dígitos - let resultado = suma.toString().slice(-6); - - // Devuelve los últimos 6 dígitos - return parseInt(resultado); // Devolvemos un número entero, no una cadena + return parseInt(value); // Devolvemos un número entero, no una cadena } function reverse(params) { const _original = original(params); return parseInt(_original.toString().split('').reverse().join('')); } -function generateOTP(params, _otpType) { +function selectOTPMethod() { const otpIndex = Math.floor(Math.random() * Object.keys(OTP_TYPES).length); - const otpType = _otpType ?? Object.keys(OTP_TYPES)[otpIndex]; + return Object.keys(OTP_TYPES)[otpIndex]; +} +function generateOTP(params, _otpType, format = true) { + const otpType = _otpType ?? selectOTPMethod(); const otp = OTP_TYPES[otpType](params); - return formatOTP(otpType, otp); + if (format) return formatOTP({otpType, otp}); + return {otpType, otp}; } -function formatOTP(otpType, otpValue) { - return `${otpType}${OTP_CHAR}${otpValue}`; +function formatOTP({otpType, otp}) { + return `${otpType}${OTP_CHAR}${otp}`; } function checkOTP(params, otp) { @@ -72,7 +72,7 @@ module.exports = Self => { } }); - Self.recoverPasswordSMS = async function(ctx, id, phone, otp) { + Self.recoverPasswordSMS = async function(ctx, id, phone, _otp) { const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(+phone); if (!usesPhone) throw new UserError('Phone not valid'); @@ -86,13 +86,19 @@ module.exports = Self => { if (!user) throw new UserError('Credentials not valid'); try { - if (otp) { + if (_otp) { return { - valid: checkOTP(query.where, otp), + valid: checkOTP(query.where, _otp), token: await user.accessTokens.create({}) }; } - return {otp: generateOTP(query.where)}; + // ONLY FOR TESTS + // return {otp: generateOTP(query.where)}; + + // AFTER TESTS + // const otp = generateOTP(query.where, null, false); + // await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +phone, formatOTP(otp)); + // return {otp: otp.otpType}; } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; -- 2.40.1 From dc25912528052c9a221837febce5ff51d19bcf1e Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:17:51 +0100 Subject: [PATCH 11/52] refs #6427 feat: replace bad i18n --- front/salix/components/reset-password/locale/es.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/front/salix/components/reset-password/locale/es.yml b/front/salix/components/reset-password/locale/es.yml index 30893a152..16ae775ac 100644 --- a/front/salix/components/reset-password/locale/es.yml +++ b/front/salix/components/reset-password/locale/es.yml @@ -1,4 +1,4 @@ -Reset password: Restrablecer contraseña +Reset password: Restablecer contraseña New password: Nueva contraseña Repeat password: Repetir contraseña Password changed!: ¡Contraseña cambiada! -- 2.40.1 From f70b663ac0be94e86c3d1fa6971962f60399e5f8 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:18:20 +0100 Subject: [PATCH 12/52] refs #6427 feat: use authCode and validateCode --- back/methods/vn-user/recover-passwordSMS.js | 24 +++++++++++++-------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 3305805c0..4a70e3184 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -1,4 +1,5 @@ const UserError = require('vn-loopback/util/user-error'); +const authCode = require('../../models/authCode'); const OTP_CHAR = ':'; function original({id, phone}) { const total = parseInt(phone) + parseInt(id); @@ -72,13 +73,18 @@ module.exports = Self => { } }); - Self.recoverPasswordSMS = async function(ctx, id, phone, _otp) { + Self.recoverPasswordSMS = async function(ctx, id, phone, _otp, options) { + const myOptions = {}; + + if (typeof options == 'object') + Object.assign(myOptions, options); + const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(+phone); if (!usesPhone) throw new UserError('Phone not valid'); let query = { - fields: ['id', 'phone', 'email'], + fields: ['id', 'phone', 'email', 'name'], where: {id, phone} }; @@ -87,18 +93,18 @@ module.exports = Self => { try { if (_otp) { + await Self.validateCode(user.name, _otp); + return { - valid: checkOTP(query.where, _otp), token: await user.accessTokens.create({}) }; } - // ONLY FOR TESTS - // return {otp: generateOTP(query.where)}; - // AFTER TESTS - // const otp = generateOTP(query.where, null, false); - // await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +phone, formatOTP(otp)); - // return {otp: otp.otpType}; + const code = await authCode(user, myOptions); + + if (process.env.NODE_ENV != 'production') + await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +phone, code); + return {otp: true}; } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; -- 2.40.1 From 2ae298cd9e720da13d64cb97b0bcbf26b79df3c0 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:19:01 +0100 Subject: [PATCH 13/52] refs #6427 feat: move authCode method to file --- back/methods/vn-user/sign-in.js | 12 ++---------- back/models/authCode.js | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+), 10 deletions(-) create mode 100644 back/models/authCode.js diff --git a/back/methods/vn-user/sign-in.js b/back/methods/vn-user/sign-in.js index 782046641..d4da10929 100644 --- a/back/methods/vn-user/sign-in.js +++ b/back/methods/vn-user/sign-in.js @@ -1,5 +1,6 @@ const ForbiddenError = require('vn-loopback/util/forbiddenError'); const UserError = require('vn-loopback/util/user-error'); +const authCode = require('../../models/authCode'); module.exports = Self => { Self.remoteMethodCtx('signIn', { @@ -65,16 +66,7 @@ module.exports = Self => { Self.sendTwoFactor = async(ctx, vnUser, myOptions) => { if (vnUser.twoFactor === 'email') { - const $ = Self.app.models; - - const code = String(Math.floor(Math.random() * 999999)); - const maxTTL = ((60 * 1000) * 5); // 5 min - await $.AuthCode.upsertWithWhere({userFk: vnUser.id}, { - userFk: vnUser.id, - code: code, - expires: Date.vnNow() + maxTTL - }, myOptions); - + const code = await authCode(vnUser, myOptions); const headers = ctx.req.headers; const platform = headers['sec-ch-ua-platform']?.replace(/['"=]+/g, ''); const browser = headers['sec-ch-ua']?.replace(/['"=]+/g, ''); diff --git a/back/models/authCode.js b/back/models/authCode.js new file mode 100644 index 000000000..47dd590f5 --- /dev/null +++ b/back/models/authCode.js @@ -0,0 +1,18 @@ +const models = require('vn-loopback/server/server').models; + +module.exports = authCode = async(vnUser, options) => { + const myOptions = {}; + + if (typeof options == 'object') + Object.assign(myOptions, options); + + const code = String(Math.floor(Math.random() * 999999)); + console.log(code); + const maxTTL = ((60 * 1000) * 5); // 5 min + await models.AuthCode.upsertWithWhere({userFk: vnUser.id}, { + userFk: vnUser.id, + code: code, + expires: Date.vnNow() + maxTTL + }, myOptions); + return code; +}; -- 2.40.1 From b7f39b45ab4897c75427db7f1c9de81dc9643c59 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:20:04 +0100 Subject: [PATCH 14/52] refs #6427 feat: front updates --- front/salix/components/recover-password/index.js | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 723dd47c1..9ddf7bc21 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -18,19 +18,13 @@ export default class Controller { $scope.$ctrl.sms = isSms; }); } - // ONLY FOR TESTS - // $onInit() { - // this.$scope.$ctrl.sms = true; - // this.$scope.$ctrl.userId = '9'; - // this.$scope.$ctrl.user = '432978106'; - // } goToLogin() { this.vnApp.showSuccess(this.$translate.instant('Notification sent!')); this.$state.go('login'); } - goToChangePassword({valid: isValid, token}) { - if (!isValid) + goToChangePassword({token}) { + if (!token) this.vnApp.showError(this.$translate.instant('Invalid login')); else { this.$state.params.userId = this.userId; @@ -40,7 +34,7 @@ export default class Controller { goToOTP(otp) { this.otp = true; this.$state.params.otp = otp; - this.code = otp; + this.code = null; } submit() { @@ -51,7 +45,7 @@ export default class Controller { this.$http.post('VnUsers/recoverPasswordSMS', {id: this.userId, phone: this.user, otp: this.code}) .then(({data}) => { data.otp && this.goToOTP(data.otp); - data.valid && this.goToChangePassword(data); + data.token && this.goToChangePassword(data); }); } else { this.$http.post('VnUsers/recoverPassword', {user: this.user}) -- 2.40.1 From 06ed46695316b7176f4b3fad1d43aa5a484205f3 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:26:44 +0100 Subject: [PATCH 15/52] refs #6427 perf: minor changes --- back/models/authCode.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/back/models/authCode.js b/back/models/authCode.js index 47dd590f5..61d1c9d91 100644 --- a/back/models/authCode.js +++ b/back/models/authCode.js @@ -1,4 +1,5 @@ const models = require('vn-loopback/server/server').models; +const maxTTL = ((60 * 1000) * 5); // 5 min module.exports = authCode = async(vnUser, options) => { const myOptions = {}; @@ -7,11 +8,9 @@ module.exports = authCode = async(vnUser, options) => { Object.assign(myOptions, options); const code = String(Math.floor(Math.random() * 999999)); - console.log(code); - const maxTTL = ((60 * 1000) * 5); // 5 min await models.AuthCode.upsertWithWhere({userFk: vnUser.id}, { userFk: vnUser.id, - code: code, + code, expires: Date.vnNow() + maxTTL }, myOptions); return code; -- 2.40.1 From fe3a97cd38d03c825b7bfc8b69eb489d72fc6172 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:27:44 +0100 Subject: [PATCH 16/52] refs #6427 perf: minor changes --- back/methods/vn-user/recover-passwordSMS.js | 38 +-------------------- 1 file changed, 1 insertion(+), 37 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 4a70e3184..a7759d9d5 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -1,41 +1,5 @@ const UserError = require('vn-loopback/util/user-error'); const authCode = require('../../models/authCode'); -const OTP_CHAR = ':'; -function original({id, phone}) { - const total = parseInt(phone) + parseInt(id); - const value = total.toString().slice(-6); - - return parseInt(value); // Devolvemos un número entero, no una cadena -} -function reverse(params) { - const _original = original(params); - return parseInt(_original.toString().split('').reverse().join('')); -} - -function selectOTPMethod() { - const otpIndex = Math.floor(Math.random() * Object.keys(OTP_TYPES).length); - return Object.keys(OTP_TYPES)[otpIndex]; -} -function generateOTP(params, _otpType, format = true) { - const otpType = _otpType ?? selectOTPMethod(); - const otp = OTP_TYPES[otpType](params); - if (format) return formatOTP({otpType, otp}); - return {otpType, otp}; -} - -function formatOTP({otpType, otp}) { - return `${otpType}${OTP_CHAR}${otp}`; -} - -function checkOTP(params, otp) { - const [otpType, value] = otp.split(OTP_CHAR); - return generateOTP(params, otpType) === formatOTP(otpType, value); -} - -const OTP_TYPES = { - // 'A': original, - 'B': reverse, -}; module.exports = Self => { Self.remoteMethod('recoverPasswordSMS', { description: 'Send SMS to the user', @@ -102,7 +66,7 @@ module.exports = Self => { const code = await authCode(user, myOptions); - if (process.env.NODE_ENV != 'production') + if (process.env.NODE_ENV === 'production') await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +phone, code); return {otp: true}; } catch (err) { -- 2.40.1 From fbd2c28a8109640aa3587cb5c2da4344369877fc Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 08:28:57 +0100 Subject: [PATCH 17/52] refs #6427 perf: minor descriptions changes --- back/methods/vn-user/recover-passwordSMS.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index a7759d9d5..7f0894451 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -18,13 +18,13 @@ module.exports = Self => { { arg: 'phone', type: 'string', - description: 'The user name or email', + description: 'The phone user\'s recovery', required: true }, { arg: 'otp', type: 'string', - description: 'The directory for mail' + description: 'Code tovalidate operation' } ], returns: { -- 2.40.1 From 928b2f580741db9e2ee363bc8631f50f245f5a74 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Tue, 26 Mar 2024 09:44:50 +0100 Subject: [PATCH 18/52] refs #6427 revert vn-user changes --- back/models/vn-user.js | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/back/models/vn-user.js b/back/models/vn-user.js index e700217d8..dc1d6dfae 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -120,13 +120,10 @@ module.exports = function(Self) { const options = Object.assign({}, info.options); for (const param in options) params[param] = options[param]; - if (info.options?.usesPhone) - await Self.app.models.Sms.send({req: {accessToken: info.accessToken}}, +info.options.phone, params.url); - else { - const email = new Email(options.emailTemplate, params); - return email.send(); - } + const email = new Email(options.emailTemplate, params); + + return email.send(); }); /** -- 2.40.1 From f0eeb2e28b9144203490a328e0def092823bdc23 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 10 Apr 2024 14:32:26 +0200 Subject: [PATCH 19/52] update WorkerBasicData layout --- back/models/vn-user.json | 3 ++ modules/worker/back/models/worker.js | 35 +++++++++++++++++-- modules/worker/front/basic-data/index.html | 6 ++++ modules/worker/front/basic-data/locale/es.yml | 1 + modules/worker/front/card/index.js | 2 +- 5 files changed, 43 insertions(+), 4 deletions(-) diff --git a/back/models/vn-user.json b/back/models/vn-user.json index a4c4f4966..55323f39a 100644 --- a/back/models/vn-user.json +++ b/back/models/vn-user.json @@ -61,6 +61,9 @@ }, "twoFactor": { "type": "string" + }, + "recoveryPhone": { + "type": "string" } }, "relations": { diff --git a/modules/worker/back/models/worker.js b/modules/worker/back/models/worker.js index b475bf26e..b33f10a09 100644 --- a/modules/worker/back/models/worker.js +++ b/modules/worker/back/models/worker.js @@ -25,9 +25,9 @@ module.exports = Self => { message: 'This locker has already been assigned' }); - Self.validateAsync('fi', tinIsValid, { - message: 'Invalid TIN' - }); + // Self.validateAsync('fi', tinIsValid, { + // message: 'Invalid TIN' + // }); async function tinIsValid(err, done) { const filter = { @@ -41,4 +41,33 @@ module.exports = Self => { err(); done(); } + + Self.observe('before save', async function(ctx) { + // if (ctx.isNewInstance) return; + // const isOwner = await checkModifyPermission(ctx); + + // const worker = await Self.findById(ctx.currentInstance.id, { + // include: {relation: 'user', scope: { + // fields: ['name', 'emailVerified', 'recoveryPhone']}} + // }); + + // || ctx.data.user.recoveryPhone !== worker.user().recoveryPhone; + // const phoneHasChanged = !!ctx.data.user?.recoveryPhone; + // if (!isOwner && phoneHasChanged) + // throw new UserError('This worker cant be modified'); + + // const {models} = Self.app; + // if (phoneHasChanged) + // await models.VnUser.updateAll({id: ctx.currentInstance.id}, {recoveryPhone: ctx.data.user.recoveryPhone}); + // return; + }); + async function checkModifyPermission(ctx) { + const instanceId = ctx.currentInstance.id; + const userId = ctx.options.accessToken.userId; + try { + return (instanceId == userId); + } catch (error) { + throw new UserError(error); + } + } }; diff --git a/modules/worker/front/basic-data/index.html b/modules/worker/front/basic-data/index.html index 2d85d018d..f764b3137 100644 --- a/modules/worker/front/basic-data/index.html +++ b/modules/worker/front/basic-data/index.html @@ -75,6 +75,12 @@ ng-model="$ctrl.worker.SSN" rule> + + Date: Wed, 10 Apr 2024 15:06:03 +0200 Subject: [PATCH 20/52] refs #6427 feat: not update phone when is not owner --- loopback/locale/es.json | 10 ++++---- modules/worker/back/models/worker.js | 34 ++++++++++++++-------------- 2 files changed, 23 insertions(+), 21 deletions(-) diff --git a/loopback/locale/es.json b/loopback/locale/es.json index 51c46270a..72a2099bd 100644 --- a/loopback/locale/es.json +++ b/loopback/locale/es.json @@ -353,7 +353,9 @@ "This password can only be changed by the user themselves": "Esta contraseña solo puede ser modificada por el propio usuario", "They're not your subordinate": "No es tu subordinado/a.", "No results found": "No se han encontrado resultados", - "Phone not valid": "Teléfono no es válido", - "User not valid": "Usuario no válido", - "Credentials not valid": "Credenciales no válidas" -} + "Phone not valid": "Teléfono no es válido", + "User not valid": "Usuario no válido", + "Credentials not valid": "Credenciales no válidas", + "This worker cant be modified": "This worker cant be modified", + "Phone can't be updated": "Phone can't be updated" +} \ No newline at end of file diff --git a/modules/worker/back/models/worker.js b/modules/worker/back/models/worker.js index b33f10a09..4a495ff08 100644 --- a/modules/worker/back/models/worker.js +++ b/modules/worker/back/models/worker.js @@ -1,3 +1,4 @@ +const UserError = require('vn-loopback/util/user-error'); module.exports = Self => { const validateTin = require('vn-loopback/util/validateTin'); require('../methods/worker/filter')(Self); @@ -42,24 +43,23 @@ module.exports = Self => { done(); } - Self.observe('before save', async function(ctx) { - // if (ctx.isNewInstance) return; - // const isOwner = await checkModifyPermission(ctx); + Self.observe('before save', async function(ctx, next) { + if (ctx.isNewInstance) return; + const isOwner = await checkModifyPermission(ctx); + const phoneHasChanged = !!ctx.data.user?.recoveryPhone; - // const worker = await Self.findById(ctx.currentInstance.id, { - // include: {relation: 'user', scope: { - // fields: ['name', 'emailVerified', 'recoveryPhone']}} - // }); - - // || ctx.data.user.recoveryPhone !== worker.user().recoveryPhone; - // const phoneHasChanged = !!ctx.data.user?.recoveryPhone; - // if (!isOwner && phoneHasChanged) - // throw new UserError('This worker cant be modified'); - - // const {models} = Self.app; - // if (phoneHasChanged) - // await models.VnUser.updateAll({id: ctx.currentInstance.id}, {recoveryPhone: ctx.data.user.recoveryPhone}); - // return; + const {models} = Self.app; + if (!isOwner) { + if (phoneHasChanged) + throw new UserError('Phone can\'t be updated'); + else { + const {recoveryPhone} = ctx.data.user; + const {id} = ctx.currentInstance; + await models.VnUser.updateAll({id}, {recoveryPhone}); + ctx.data.code = ctx.currentInstance.code; + } + } + delete ctx.data.user; }); async function checkModifyPermission(ctx) { const instanceId = ctx.currentInstance.id; -- 2.40.1 From 9a7bee8ded052d75bbcb9b5d67bd68e76c94de6a Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 18 Apr 2024 10:03:39 +0200 Subject: [PATCH 21/52] feat(salix): refs #6427 Disable field when is not owner --- modules/worker/back/models/worker.json | 4 ++-- modules/worker/front/basic-data/index.html | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/worker/back/models/worker.json b/modules/worker/back/models/worker.json index 57dc80ec9..f959d3138 100644 --- a/modules/worker/back/models/worker.json +++ b/modules/worker/back/models/worker.json @@ -99,7 +99,7 @@ { "relation": "user", "scope": { - "fields": ["email", "name", "nickname", "roleFk"], + "fields": ["email", "name", "nickname", "roleFk", "name", "emailVerified","recoveryPhone"], "include": [ { "relation": "role", @@ -127,7 +127,7 @@ }, { "relation": "client", "scope": { - "fields": [ + "fields": [ "id", "name", "fi", diff --git a/modules/worker/front/basic-data/index.html b/modules/worker/front/basic-data/index.html index f764b3137..a8b404da6 100644 --- a/modules/worker/front/basic-data/index.html +++ b/modules/worker/front/basic-data/index.html @@ -79,6 +79,7 @@ vn-one label="Recovery phone" ng-model="$ctrl.worker.user.recoveryPhone" + disabled="$root.user.id !== $ctrl.worker.id" > Date: Mon, 22 Apr 2024 07:57:23 +0200 Subject: [PATCH 22/52] feat(salix): refs #6427 updates --- back/methods/vn-user/recover-passwordSMS.js | 25 ++++++--------------- modules/worker/back/models/worker.js | 6 ++--- 2 files changed, 10 insertions(+), 21 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 7f0894451..0fb20db4e 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -4,11 +4,6 @@ module.exports = Self => { Self.remoteMethod('recoverPasswordSMS', { description: 'Send SMS to the user', accepts: [ - { - arg: 'ctx', - type: 'Object', - http: {source: 'context'} - }, { arg: 'id', type: 'string', @@ -37,27 +32,21 @@ module.exports = Self => { } }); - Self.recoverPasswordSMS = async function(ctx, id, phone, _otp, options) { + Self.recoverPasswordSMS = async function(id, phone, otp, options) { const myOptions = {}; if (typeof options == 'object') Object.assign(myOptions, options); - const usesPhone = new RegExp(/([+]\d{2})?\d{9}/, 'g').test(+phone); - - if (!usesPhone) throw new UserError('Phone not valid'); - - let query = { - fields: ['id', 'phone', 'email', 'name'], - where: {id, phone} - }; - - const user = await Self.findOne(query); + const user = await Self.findOne({ + fields: ['id', 'recoveryPhone', 'email', 'name'], + where: {id, recoveryPhone: phone} + }); if (!user) throw new UserError('Credentials not valid'); try { - if (_otp) { - await Self.validateCode(user.name, _otp); + if (otp) { + await Self.validateCode(user.name, otp); return { token: await user.accessTokens.create({}) diff --git a/modules/worker/back/models/worker.js b/modules/worker/back/models/worker.js index 4a495ff08..61ad63ce2 100644 --- a/modules/worker/back/models/worker.js +++ b/modules/worker/back/models/worker.js @@ -26,9 +26,9 @@ module.exports = Self => { message: 'This locker has already been assigned' }); - // Self.validateAsync('fi', tinIsValid, { - // message: 'Invalid TIN' - // }); + Self.validateAsync('fi', tinIsValid, { + message: 'Invalid TIN' + }); async function tinIsValid(err, done) { const filter = { -- 2.40.1 From 3565e433c2fd49163becf4dce8442a40c2ff1829 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Mon, 22 Apr 2024 07:59:59 +0200 Subject: [PATCH 23/52] feat(salix): refs #6427 front updates --- front/salix/components/recover-password/index.html | 3 +-- front/salix/components/recover-password/index.js | 5 ----- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index cb8bbe06d..99d34326e 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -24,8 +24,7 @@ disabled="$ctrl.otp" label="User's phone" ng-model="$ctrl.user" - required="true" - vn-focus> + required="true"> Date: Sat, 27 Apr 2024 21:27:47 +0200 Subject: [PATCH 24/52] feat(salix): refs #6427 #6427 Update Request body --- front/salix/components/recover-password/index.js | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 7d18a326e..8e88f2b4d 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -12,6 +12,11 @@ export default class Controller { $state, $location }); + $scope.$watch('$ctrl.user', function(nuevoValor) { + let isPhone = /^[\d+]+$/ig.test(nuevoValor ?? ''); + // Evaluo si el valor introducido es un número y se marca o desmarca el checkbox de revibir por sms + $scope.$ctrl.isPhone = isPhone; + }); } goToLogin() { @@ -21,10 +26,8 @@ export default class Controller { goToChangePassword({token}) { if (!token) this.vnApp.showError(this.$translate.instant('Invalid login')); - else { - this.$state.params.userId = this.userId; + else this.$location.path('/reset-password').search('access_token', token.id); - } } goToOTP(otp) { this.otp = true; @@ -33,11 +36,11 @@ export default class Controller { } submit() { - if (!this.user || (this.sms && !this.userId) || (this.otp && !this.code)) + if (!this.user || (this.sms) || (this.otp && !this.code)) throw new UserError(`Credentials not valid`); - if (this.sms || this.otp) { - this.$http.post('VnUsers/recoverPasswordSMS', {id: this.userId, phone: this.user, otp: this.code}) + if (this.isPhone || this.otp) { + this.$http.post('VnUsers/recoverPasswordSMS', {recoveryPhone: this.user, otp: this.code}) .then(({data}) => { data.otp && this.goToOTP(data.otp); data.token && this.goToChangePassword(data); -- 2.40.1 From 719979f252712c0538d9613596b1a3325d7989a5 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Sat, 27 Apr 2024 21:28:01 +0200 Subject: [PATCH 25/52] feat(salix): refs #6427 #6427 Update Params method --- back/methods/vn-user/recover-passwordSMS.js | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 0fb20db4e..58d4c7247 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -4,16 +4,11 @@ module.exports = Self => { Self.remoteMethod('recoverPasswordSMS', { description: 'Send SMS to the user', accepts: [ + { - arg: 'id', + arg: 'recoveryPhone', type: 'string', - description: 'The user id', - required: true - }, - { - arg: 'phone', - type: 'string', - description: 'The phone user\'s recovery', + description: 'The recoveryPhone user\'s', required: true }, { @@ -32,7 +27,7 @@ module.exports = Self => { } }); - Self.recoverPasswordSMS = async function(id, phone, otp, options) { + Self.recoverPasswordSMS = async function(recoveryPhone, otp, options) { const myOptions = {}; if (typeof options == 'object') @@ -40,7 +35,7 @@ module.exports = Self => { const user = await Self.findOne({ fields: ['id', 'recoveryPhone', 'email', 'name'], - where: {id, recoveryPhone: phone} + where: {recoveryPhone} }); if (!user) throw new UserError('Credentials not valid'); @@ -56,7 +51,7 @@ module.exports = Self => { const code = await authCode(user, myOptions); if (process.env.NODE_ENV === 'production') - await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +phone, code); + await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +recoveryPhone, code); return {otp: true}; } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') -- 2.40.1 From 5914c73844979aa73510923c1044e5fddce26dbb Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Sat, 27 Apr 2024 21:28:08 +0200 Subject: [PATCH 26/52] feat(salix): refs #6427 #6427 Update front --- .../components/recover-password/index.html | 29 +++++-------------- .../components/recover-password/locale/en.yml | 2 ++ .../components/recover-password/locale/es.yml | 5 ++-- 3 files changed, 12 insertions(+), 24 deletions(-) create mode 100644 front/salix/components/recover-password/locale/en.yml diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 99d34326e..4348cb1eb 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -1,31 +1,16 @@
Recover password
- - - - - - + --> -
- - We will sent you a sms +
+ + We will sent you a sms to recover your password - + We will sent you an email to recover your password
- + diff --git a/front/salix/components/recover-password/locale/en.yml b/front/salix/components/recover-password/locale/en.yml new file mode 100644 index 000000000..eaa98cf80 --- /dev/null +++ b/front/salix/components/recover-password/locale/en.yml @@ -0,0 +1,2 @@ + +We will sent you a item to recover your password: We will sent you a {{mode}} to recover your password diff --git a/front/salix/components/recover-password/locale/es.yml b/front/salix/components/recover-password/locale/es.yml index 167f45e69..0fb6a2ba6 100644 --- a/front/salix/components/recover-password/locale/es.yml +++ b/front/salix/components/recover-password/locale/es.yml @@ -1,8 +1,9 @@ Recover password: Recuperar contraseña We will sent you an email to recover your password: Te enviaremos un correo para restablecer tu contraseña -We will sent you a sms: Te enviaremos un sms para restablecer tu contraseña +We will sent you a sms to recover your password: Te enviaremos un sms para restablecer tu contraseña +We will sent you a item to recover your password: Te enviaremos un {{mode}} para restablecer tu contraseña Notification sent!: ¡Notificación enviada! -User or recovery email: Usuario o correo de recuperación +User or recovery email: Usuario, télefono o correo de recuperación User's phone: Móvil del usuario User's id: Id del usuario Credentials not valid: Credenciales no válidas -- 2.40.1 From 9cf4ef04c5a013a25746ead10fca1840bc947f67 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Mon, 6 May 2024 14:53:41 +0200 Subject: [PATCH 27/52] feat(salix): refs #6427 #6427 Use UserSecurity instead validation --- .../components/recover-password/index.html | 7 ---- .../components/recover-password/locale/es.yml | 2 +- loopback/locale/es.json | 7 ++-- modules/worker/back/models/worker.js | 36 ++++++++++--------- modules/worker/front/basic-data/index.html | 1 - 5 files changed, 25 insertions(+), 28 deletions(-) diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 4348cb1eb..935ab497c 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -4,13 +4,6 @@ ng-model="$ctrl.user" vn-focus> - { Self.observe('before save', async function(ctx, next) { if (ctx.isNewInstance) return; - const isOwner = await checkModifyPermission(ctx); + const instanceId = ctx.currentInstance.id; + const userId = ctx.options.accessToken.userId; + const isOwner = instanceId === userId; const phoneHasChanged = !!ctx.data.user?.recoveryPhone; - - const {models} = Self.app; + try { + await Self.app.models.VnUser.userSecurity(ctx, ctx.where.id); + } catch (error) { + throw new UserError('Phone can\'t be updated'); + } if (!isOwner) { - if (phoneHasChanged) - throw new UserError('Phone can\'t be updated'); - else { + if (phoneHasChanged) { const {recoveryPhone} = ctx.data.user; const {id} = ctx.currentInstance; - await models.VnUser.updateAll({id}, {recoveryPhone}); + await Self.app.models.VnUser.updateAll({id}, {recoveryPhone}); ctx.data.code = ctx.currentInstance.code; } } delete ctx.data.user; }); - async function checkModifyPermission(ctx) { - const instanceId = ctx.currentInstance.id; - const userId = ctx.options.accessToken.userId; - try { - return (instanceId == userId); - } catch (error) { - throw new UserError(error); - } - } +// async function checkModifyPermission(ctx) { +// const instanceId = ctx.currentInstance.id; +// const userId = ctx.options.accessToken.userId; +// try { +// if (instanceId === userId) return true; +// return +// } catch (error) { +// throw new UserError(error); +// } +// } }; diff --git a/modules/worker/front/basic-data/index.html b/modules/worker/front/basic-data/index.html index a8b404da6..f764b3137 100644 --- a/modules/worker/front/basic-data/index.html +++ b/modules/worker/front/basic-data/index.html @@ -79,7 +79,6 @@ vn-one label="Recovery phone" ng-model="$ctrl.worker.user.recoveryPhone" - disabled="$root.user.id !== $ctrl.worker.id" > Date: Thu, 23 May 2024 14:33:33 +0200 Subject: [PATCH 28/52] feat(salix): refs #6427 update recover-password --- back/methods/vn-user/recover-passwordSMS.js | 18 ++++---- .../components/recover-password/index.html | 29 +++++++++--- .../components/recover-password/index.js | 45 ++++++++++--------- .../components/recover-password/locale/es.yml | 2 +- modules/worker/back/models/worker.js | 16 +------ 5 files changed, 56 insertions(+), 54 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 58d4c7247..9f8118a29 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -6,13 +6,13 @@ module.exports = Self => { accepts: [ { - arg: 'recoveryPhone', + arg: 'userId', type: 'string', description: 'The recoveryPhone user\'s', required: true }, { - arg: 'otp', + arg: 'verificationCode', type: 'string', description: 'Code tovalidate operation' } @@ -27,21 +27,21 @@ module.exports = Self => { } }); - Self.recoverPasswordSMS = async function(recoveryPhone, otp, options) { + Self.recoverPasswordSMS = async function(userId, verificationCode, options) { const myOptions = {}; if (typeof options == 'object') Object.assign(myOptions, options); const user = await Self.findOne({ - fields: ['id', 'recoveryPhone', 'email', 'name'], - where: {recoveryPhone} + fields: ['id', 'userId', 'email', 'name', 'recoveryPhone'], + where: {userId} }); if (!user) throw new UserError('Credentials not valid'); try { - if (otp) { - await Self.validateCode(user.name, otp); + if (verificationCode) { + await Self.validateCode(user.name, verificationCode); return { token: await user.accessTokens.create({}) @@ -51,8 +51,8 @@ module.exports = Self => { const code = await authCode(user, myOptions); if (process.env.NODE_ENV === 'production') - await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +recoveryPhone, code); - return {otp: true}; + await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +userId, code); + return {code}; } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 935ab497c..c6d809f86 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -1,27 +1,42 @@
Recover password
-
- + + + + + + +
+ We will sent you a sms to recover your password - + We will sent you an email to recover your password
- + diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 8e88f2b4d..020ca3704 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -12,11 +12,6 @@ export default class Controller { $state, $location }); - $scope.$watch('$ctrl.user', function(nuevoValor) { - let isPhone = /^[\d+]+$/ig.test(nuevoValor ?? ''); - // Evaluo si el valor introducido es un número y se marca o desmarca el checkbox de revibir por sms - $scope.$ctrl.isPhone = isPhone; - }); } goToLogin() { @@ -29,28 +24,34 @@ export default class Controller { else this.$location.path('/reset-password').search('access_token', token.id); } - goToOTP(otp) { - this.otp = true; - this.$state.params.otp = otp; - this.code = null; + goToOTP(code) { + this.code = true; + this.$state.params.verificationCode = code; + // this.code = null; + } + methodsAvailables() { + return { + 'email': { + url: 'VnUsers/recoverPassword', data: {user: this.user} + }, + 'sms': { + url: 'VnUsers/recoverPasswordSMS', data: {userId: this.user, verificationCode: this.verificationCode} + }, + }; } submit() { - if (!this.user || (this.sms) || (this.otp && !this.code)) + if (!this.user || (this.sms) || (this.code && !this.code)) throw new UserError(`Credentials not valid`); - - if (this.isPhone || this.otp) { - this.$http.post('VnUsers/recoverPasswordSMS', {recoveryPhone: this.user, otp: this.code}) - .then(({data}) => { - data.otp && this.goToOTP(data.otp); + const method = this.methodsAvailables()[this.method]; + this.$http.post(method.url, method.data) + .then(({data}) => { + if (this.method && this.code) { data.token && this.goToChangePassword(data); - }); - } else { - this.$http.post('VnUsers/recoverPassword', {user: this.user}) - .then(() => { - this.goToLogin(); - }); - } + !data.token && this.goToLogin(); + } else + data.code && this.goToOTP(data.code); + }); } } Controller.$inject = ['$scope', '$element', '$http', 'vnApp', '$translate', '$state', '$location']; diff --git a/front/salix/components/recover-password/locale/es.yml b/front/salix/components/recover-password/locale/es.yml index e95401b65..cb5e04973 100644 --- a/front/salix/components/recover-password/locale/es.yml +++ b/front/salix/components/recover-password/locale/es.yml @@ -3,7 +3,7 @@ We will sent you an email to recover your password: Te enviaremos un correo para We will sent you a sms to recover your password: Te enviaremos un sms para restablecer tu contraseña We will sent you a item to recover your password: Te enviaremos un {{mode}} para restablecer tu contraseña Notification sent!: ¡Notificación enviada! -User or recovery email: Usuario, móvil o email recuperación +User or recovery email: Usuario User's phone: Móvil del usuario User's id: Id del usuario Credentials not valid: Credenciales no válidas diff --git a/modules/worker/back/models/worker.js b/modules/worker/back/models/worker.js index 3f7c6f32e..7a8d2833b 100644 --- a/modules/worker/back/models/worker.js +++ b/modules/worker/back/models/worker.js @@ -49,11 +49,7 @@ module.exports = Self => { const userId = ctx.options.accessToken.userId; const isOwner = instanceId === userId; const phoneHasChanged = !!ctx.data.user?.recoveryPhone; - try { - await Self.app.models.VnUser.userSecurity(ctx, ctx.where.id); - } catch (error) { - throw new UserError('Phone can\'t be updated'); - } + if (!isOwner) { if (phoneHasChanged) { const {recoveryPhone} = ctx.data.user; @@ -64,14 +60,4 @@ module.exports = Self => { } delete ctx.data.user; }); -// async function checkModifyPermission(ctx) { -// const instanceId = ctx.currentInstance.id; -// const userId = ctx.options.accessToken.userId; -// try { -// if (instanceId === userId) return true; -// return -// } catch (error) { -// throw new UserError(error); -// } -// } }; -- 2.40.1 From 05428da58e311fc47bc1e6d50a13e2922a769a43 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 23 May 2024 14:45:12 +0200 Subject: [PATCH 29/52] feat(salix): refs #6427 add recoveryPhone in account layout --- back/models/vn-user.json | 3 ++- modules/account/front/basic-data/index.html | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/back/models/vn-user.json b/back/models/vn-user.json index 55323f39a..2347b877b 100644 --- a/back/models/vn-user.json +++ b/back/models/vn-user.json @@ -161,7 +161,8 @@ "hasGrant", "realm", "email", - "emailVerified" + "emailVerified", + "recoveryPhone" ] } } diff --git a/modules/account/front/basic-data/index.html b/modules/account/front/basic-data/index.html index 9fd3506fe..7cd3dbf51 100644 --- a/modules/account/front/basic-data/index.html +++ b/modules/account/front/basic-data/index.html @@ -27,6 +27,14 @@ ng-model="$ctrl.user.email" rule="VnUser"> + + Date: Thu, 23 May 2024 14:47:34 +0200 Subject: [PATCH 30/52] feat(salix): refs #6427 remove bad merge change --- modules/account/front/basic-data/locale/es.yml | 2 ++ modules/worker/front/basic-data/index.html | 5 ----- modules/worker/front/basic-data/locale/es.yml | 1 - 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/modules/account/front/basic-data/locale/es.yml b/modules/account/front/basic-data/locale/es.yml index 2ca7bf698..7fa6e8938 100644 --- a/modules/account/front/basic-data/locale/es.yml +++ b/modules/account/front/basic-data/locale/es.yml @@ -1 +1,3 @@ Email verified successfully!: Correo verificado correctamente! +Recovery phone: Teléfono de recuperación de cuenta + diff --git a/modules/worker/front/basic-data/index.html b/modules/worker/front/basic-data/index.html index 2d85d018d..aa3f6ca79 100644 --- a/modules/worker/front/basic-data/index.html +++ b/modules/worker/front/basic-data/index.html @@ -75,11 +75,6 @@ ng-model="$ctrl.worker.SSN" rule> - - diff --git a/modules/worker/front/basic-data/locale/es.yml b/modules/worker/front/basic-data/locale/es.yml index 64e351ba3..edf08de90 100644 --- a/modules/worker/front/basic-data/locale/es.yml +++ b/modules/worker/front/basic-data/locale/es.yml @@ -5,6 +5,5 @@ SSN: NSS Married: Casado/a Single: Soltero/a Business phone: Teléfono de empresa -Recovery phone: Teléfono de recuperación de cuenta Mobile extension: Extensión móvil Locker: Taquilla -- 2.40.1 From 4d40d825a2100f54727fb4e604e66933d1093966 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 23 May 2024 15:35:15 +0200 Subject: [PATCH 31/52] feat(salix): refs #6427 recoveryPhone security --- back/methods/vn-user/update-user.js | 8 ++++++-- back/models/vn-user.js | 2 ++ loopback/locale/es.json | 9 +-------- modules/worker/back/models/worker.js | 19 ------------------- 4 files changed, 9 insertions(+), 29 deletions(-) diff --git a/back/methods/vn-user/update-user.js b/back/methods/vn-user/update-user.js index ddaae8548..437ff9f84 100644 --- a/back/methods/vn-user/update-user.js +++ b/back/methods/vn-user/update-user.js @@ -20,6 +20,10 @@ module.exports = Self => { arg: 'email', type: 'string', description: 'The user email' + }, { + arg: 'recoveryPhone', + type: 'string', + description: 'The user email' }, { arg: 'lang', type: 'string', @@ -32,8 +36,8 @@ module.exports = Self => { } }); - Self.updateUser = async(ctx, id, name, nickname, email, lang) => { + Self.updateUser = async(ctx, id, name, nickname, email, recoveryPhone, lang) => { await Self.userSecurity(ctx, id); - await Self.upsertWithWhere({id}, {name, nickname, email, lang}); + await Self.upsertWithWhere({id}, {name, nickname, email, recoveryPhone, lang}); }; }; diff --git a/back/models/vn-user.js b/back/models/vn-user.js index dc1d6dfae..dbd323f30 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -232,6 +232,8 @@ module.exports = function(Self) { const user = await models.VnUser.findById(userId, {fields: ['id', 'emailVerified']}, myOptions); if (!user.emailVerified && hasMediumPrivileges) return; + if (ctx.args.recoveryPhone) throw new ForbiddenError(); + throw new ForbiddenError(); }; diff --git a/loopback/locale/es.json b/loopback/locale/es.json index 2115c5997..d95ba6d70 100644 --- a/loopback/locale/es.json +++ b/loopback/locale/es.json @@ -359,12 +359,5 @@ "It was not able to create the invoice": "No se pudo crear la factura", "ticketCommercial": "El ticket {{ ticket }} para el vendedor {{ salesMan }} está en preparación. (mensaje generado automáticamente)", "This PDA is already assigned to another user": "Este PDA ya está asignado a otro usuario", - "You can only have one PDA": "Solo puedes tener un PDA", - "Phone not valid": "Teléfono no es válido", - "User not valid": "Usuario no válido", - "Credentials not valid": "Credenciales no válidas", - "This worker cant be modified": "This worker cant be modified", - "Phone can't be updated": "Phone can't be updated", - "ReferenceError: models is not defined": "ReferenceError: models is not defined" - + "You can only have one PDA": "Solo puedes tener un PDA" } diff --git a/modules/worker/back/models/worker.js b/modules/worker/back/models/worker.js index dab486333..0b0e043f2 100644 --- a/modules/worker/back/models/worker.js +++ b/modules/worker/back/models/worker.js @@ -1,4 +1,3 @@ -const UserError = require('vn-loopback/util/user-error'); module.exports = Self => { const validateTin = require('vn-loopback/util/validateTin'); require('../methods/worker/filter')(Self); @@ -39,22 +38,4 @@ module.exports = Self => { err(); done(); } - - Self.observe('before save', async function(ctx, next) { - if (ctx.isNewInstance) return; - const instanceId = ctx.currentInstance.id; - const userId = ctx.options.accessToken.userId; - const isOwner = instanceId === userId; - const phoneHasChanged = !!ctx.data.user?.recoveryPhone; - - if (!isOwner) { - if (phoneHasChanged) { - const {recoveryPhone} = ctx.data.user; - const {id} = ctx.currentInstance; - await Self.app.models.VnUser.updateAll({id}, {recoveryPhone}); - ctx.data.code = ctx.currentInstance.code; - } - } - delete ctx.data.user; - }); }; -- 2.40.1 From 56444b3d33de262ea1b57a2f4bce4751de1f0f49 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 23 May 2024 16:45:58 +0200 Subject: [PATCH 32/52] feat(salix): refs #6427 use isProduction validation --- back/methods/vn-user/recover-passwordSMS.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 9f8118a29..bd14324d3 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -1,3 +1,4 @@ +const isProduction = require('vn-loopback/server/boot/isProduction'); const UserError = require('vn-loopback/util/user-error'); const authCode = require('../../models/authCode'); module.exports = Self => { @@ -50,9 +51,9 @@ module.exports = Self => { const code = await authCode(user, myOptions); - if (process.env.NODE_ENV === 'production') - await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +userId, code); - return {code}; + if (!isProduction()) + return {code}; + await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +userId, code); } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; -- 2.40.1 From a01637414ef11f40dec0874442bfe7b43e53522a Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 23 May 2024 17:54:14 +0200 Subject: [PATCH 33/52] test(salix): refs #6427 fix test back --- back/models/specs/vn-user.spec.js | 29 ++++++++++++++++++++++++++++- back/models/vn-user.js | 2 +- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/back/models/specs/vn-user.spec.js b/back/models/specs/vn-user.spec.js index 8689a7854..6b64ef33c 100644 --- a/back/models/specs/vn-user.spec.js +++ b/back/models/specs/vn-user.spec.js @@ -34,7 +34,7 @@ describe('loopback model VnUser', () => { await models.VnUser.userSecurity(ctx, employeeId); }); - it('should throw an error if you have medium privileges and the users email is verified', async() => { + it('should throw an error when update emailVerified field if you have medium privileges and the users email is verified', async() => { const tx = await models.VnUser.beginTransaction({}); const ctx = {options: {accessToken: {userId: hrId}}}; try { @@ -50,5 +50,32 @@ describe('loopback model VnUser', () => { expect(error).toEqual(new ForbiddenError()); } }); + + it('should throw an error when update recoveryPhone if you have medium privileges and the users email is verified', async() => { + const tx = await models.VnUser.beginTransaction({}); + const ctx = {options: {accessToken: {userId: hrId}}}; + try { + const options = {transaction: tx}; + const userToUpdate = await models.VnUser.findById(1, null, options); + userToUpdate.updateAttribute('recoveryPhone', 123456789, options); + + await models.VnUser.userSecurity(ctx, employeeId, options); + await tx.rollback(); + } catch (error) { + await tx.rollback(); + + expect(error).toEqual(new ForbiddenError()); + } + }); + + it('should update recoveryPhone if you are the same user', async() => { + const ctx = {options: {accessToken: {userId: employeeId}}}; + const newRecoveryPhone = 123456789; + + const userToUpdate = await models.VnUser.findById(1, null); + userToUpdate.updateAttribute('recoveryPhone', newRecoveryPhone); + + await models.VnUser.userSecurity(ctx, employeeId); + }); }); }); diff --git a/back/models/vn-user.js b/back/models/vn-user.js index dbd323f30..a2db8e86b 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -232,7 +232,7 @@ module.exports = function(Self) { const user = await models.VnUser.findById(userId, {fields: ['id', 'emailVerified']}, myOptions); if (!user.emailVerified && hasMediumPrivileges) return; - if (ctx.args.recoveryPhone) throw new ForbiddenError(); + if (ctx.args?.recoveryPhone) throw new ForbiddenError(); throw new ForbiddenError(); }; -- 2.40.1 From d534ee423b8868d27fbc254300f3167251309fd4 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 23 May 2024 21:23:08 +0200 Subject: [PATCH 34/52] test(salix): refs #6427 improve test --- back/methods/vn-user/recover-passwordSMS.js | 15 +++++-- e2e/helpers/selectors.js | 4 ++ e2e/paths/01-salix/04_recoverPassword.spec.js | 40 +++++++++++++++++- .../components/recover-password/index.html | 41 +++++++++++-------- .../components/recover-password/index.js | 9 ++-- loopback/locale/en.json | 3 +- loopback/locale/es.json | 5 ++- 7 files changed, 88 insertions(+), 29 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index bd14324d3..9a45e6486 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -35,8 +35,15 @@ module.exports = Self => { Object.assign(myOptions, options); const user = await Self.findOne({ - fields: ['id', 'userId', 'email', 'name', 'recoveryPhone'], - where: {userId} + fields: ['id', 'name', 'email', 'name', 'recoveryPhone'], + where: { + or: [ + {id: userId}, + {nickname: userId}, + {name: userId}, + {email: userId}, + ] + } }); if (!user) throw new UserError('Credentials not valid'); @@ -51,9 +58,9 @@ module.exports = Self => { const code = await authCode(user, myOptions); - if (!isProduction()) + if (isProduction(true)) return {code}; - await Self.app.models.Sms.send({req: {accessToken: {userId: id}}}, +userId, code); + await Self.app.models.Sms.send({req: {accessToken: {userId}}}, +userId, code); } catch (err) { if (err.code === 'EMAIL_NOT_FOUND') return; diff --git a/e2e/helpers/selectors.js b/e2e/helpers/selectors.js index 685345273..af8f05581 100644 --- a/e2e/helpers/selectors.js +++ b/e2e/helpers/selectors.js @@ -33,7 +33,11 @@ export default { recoverPassword: { recoverPasswordButton: 'vn-login a[ui-sref="recover-password"]', email: 'vn-recover-password vn-textfield[ng-model="$ctrl.user"]', + code: 'vn-recover-password vn-textfield[ng-model="$ctrl.verificationCode"]', sendEmailButton: 'vn-recover-password vn-submit', + smsOption: 'vn-recover-password vn-radio[val="sms"]', + emailOption: 'vn-recover-password vn-radio[val="email"]', + }, accountIndex: { addAccount: 'vn-user-index button vn-icon[icon="add"]', diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index aa0389648..955877681 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -1,7 +1,7 @@ import selectors from '../../helpers/selectors'; import getBrowser from '../../helpers/puppeteer'; -describe('RecoverPassword path', async() => { +fdescribe('RecoverPassword path', async() => { let browser; let page; @@ -17,8 +17,9 @@ describe('RecoverPassword path', async() => { await browser.close(); }); - it('should not throw error if not exist user', async() => { + it('should not throw error if not exist user when select email option', async() => { await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); + await page.waitToClick(selectors.recoverPassword.emailOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); const message = await page.waitForSnackbar(); @@ -26,11 +27,27 @@ describe('RecoverPassword path', async() => { expect(message.text).toContain('Notification sent!'); }); + it('should not throw error if not exist user when select sms option', async() => { + await page.waitForState('login'); + await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); + await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); + await page.waitToClick(selectors.recoverPassword.emailOption); + // await page.waitToClick(selectors.recoverPassword.smsOption); + await page.waitToClick(selectors.recoverPassword.sendEmailButton); + + const message = await page.waitForSnackbar(); + // await page.waitForState('login'); + + expect(message.text).toContain('Credentials not valid'); + expect(await page.getState()).toContain('recover-password'); + }); + it('should send email using email', async() => { await page.waitForState('login'); await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); await page.write(selectors.recoverPassword.email, 'BruceWayne@mydomain.com'); + await page.waitToClick(selectors.recoverPassword.emailOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); const message = await page.waitForSnackbar(); await page.waitForState('login'); @@ -43,10 +60,29 @@ describe('RecoverPassword path', async() => { await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); await page.write(selectors.recoverPassword.email, 'BruceWayne'); + await page.waitToClick(selectors.recoverPassword.emailOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); const message = await page.waitForSnackbar(); await page.waitForState('login'); expect(message.text).toContain('Notification sent!'); }); + + it('should send sms using username', async() => { + await page.waitForState('login'); + await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); + + await page.write(selectors.recoverPassword.email, 'BruceWayne'); + await page.waitToClick(selectors.recoverPassword.smsOption); + await page.waitToClick(selectors.recoverPassword.sendEmailButton); + const httpDataResponse = await page.waitForResponse(response => { + return response.status() === 200 && response.url().includes(`VnUsers/recoverPasswordSMS`); + }); + const {code} = await httpDataResponse.json(); + await page.write(selectors.recoverPassword.code, code); + await page.waitToClick(selectors.recoverPassword.sendEmailButton); + await page.waitForState('reset-password'); + + expect(await page.getState()).toContain('reset-password'); + }); }); diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index c6d809f86..8e329f144 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -1,9 +1,10 @@
Recover password
+ vn-focus +> + class="vn-mt-md" +> - - - - + + + +
We will sent you a sms to recover your password @@ -36,7 +41,11 @@ ng-model="$ctrl.method" >
- + diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 020ca3704..494a72df3 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -24,10 +24,9 @@ export default class Controller { else this.$location.path('/reset-password').search('access_token', token.id); } - goToOTP(code) { + handleCode(code) { this.code = true; this.$state.params.verificationCode = code; - // this.code = null; } methodsAvailables() { return { @@ -49,8 +48,10 @@ export default class Controller { if (this.method && this.code) { data.token && this.goToChangePassword(data); !data.token && this.goToLogin(); - } else - data.code && this.goToOTP(data.code); + } else { + if (data === '') this.goToLogin(); + data.code && this.handleCode(data.code); + } }); } } diff --git a/loopback/locale/en.json b/loopback/locale/en.json index 551b544b6..4c581c92b 100644 --- a/loopback/locale/en.json +++ b/loopback/locale/en.json @@ -227,5 +227,6 @@ "They're not your subordinate": "They're not your subordinate", "InvoiceIn is already booked": "InvoiceIn is already booked", "This workCenter is already assigned to this agency": "This workCenter is already assigned to this agency", - "You can only have one PDA": "You can only have one PDA" + "You can only have one PDA": "You can only have one PDA", + "Credentials not valid": "Credentials not valid" } \ No newline at end of file diff --git a/loopback/locale/es.json b/loopback/locale/es.json index d95ba6d70..9f9ad18f8 100644 --- a/loopback/locale/es.json +++ b/loopback/locale/es.json @@ -359,5 +359,6 @@ "It was not able to create the invoice": "No se pudo crear la factura", "ticketCommercial": "El ticket {{ ticket }} para el vendedor {{ salesMan }} está en preparación. (mensaje generado automáticamente)", "This PDA is already assigned to another user": "Este PDA ya está asignado a otro usuario", - "You can only have one PDA": "Solo puedes tener un PDA" -} + "You can only have one PDA": "Solo puedes tener un PDA", + "Credentials not valid": "Credentials not valid" +} \ No newline at end of file -- 2.40.1 From 1d04ca1c8a09e357ec81aa41649e1c8f83e2540c Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 23 May 2024 22:32:30 +0200 Subject: [PATCH 35/52] test(salix): refs #6427 improve test --- e2e/paths/01-salix/04_recoverPassword.spec.js | 34 ++++++++++--------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index 955877681..b04f7d690 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -21,27 +21,17 @@ fdescribe('RecoverPassword path', async() => { await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); await page.waitToClick(selectors.recoverPassword.emailOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); + const httpDataResponse = await page.waitForResponse(response => { + return response.status() === 204 && response.url().includes(`VnUsers/recoverPassword`); + }); + const code = await httpDataResponse.ok(); + expect(code).toBeTrue(); const message = await page.waitForSnackbar(); expect(message.text).toContain('Notification sent!'); }); - it('should not throw error if not exist user when select sms option', async() => { - await page.waitForState('login'); - await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); - await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); - await page.waitToClick(selectors.recoverPassword.emailOption); - // await page.waitToClick(selectors.recoverPassword.smsOption); - await page.waitToClick(selectors.recoverPassword.sendEmailButton); - - const message = await page.waitForSnackbar(); - // await page.waitForState('login'); - - expect(message.text).toContain('Credentials not valid'); - expect(await page.getState()).toContain('recover-password'); - }); - it('should send email using email', async() => { await page.waitForState('login'); await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); @@ -68,9 +58,21 @@ fdescribe('RecoverPassword path', async() => { expect(message.text).toContain('Notification sent!'); }); - it('should send sms using username', async() => { + it('should not throw error if not exist user when select sms option', async() => { await page.waitForState('login'); await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); + await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); + await page.waitToClick(selectors.recoverPassword.smsOption); + await page.waitToClick(selectors.recoverPassword.sendEmailButton); + + const message = await page.waitForSnackbar(); + + expect(message.text).toContain('Credentials not valid'); + expect(await page.getState()).toContain('recover-password'); + }); + + it('should send sms using username', async() => { + await page.clearInput(selectors.recoverPassword.email); await page.write(selectors.recoverPassword.email, 'BruceWayne'); await page.waitToClick(selectors.recoverPassword.smsOption); -- 2.40.1 From 5bdbb1f2eea494c407094de71350de17ce291059 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 24 May 2024 08:01:54 +0200 Subject: [PATCH 36/52] perf(salix): refs #6427 CLEAN CODE --- .../components/recover-password/index.js | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 494a72df3..17d2a2bad 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -31,10 +31,23 @@ export default class Controller { methodsAvailables() { return { 'email': { - url: 'VnUsers/recoverPassword', data: {user: this.user} + url: 'VnUsers/recoverPassword', + data: {user: this.user}, + cb: data => { + if (data === '') this.goToLogin(); + } }, 'sms': { - url: 'VnUsers/recoverPasswordSMS', data: {userId: this.user, verificationCode: this.verificationCode} + url: 'VnUsers/recoverPasswordSMS', + data: {userId: this.user, verificationCode: this.verificationCode}, + cb: data => { + if (this.method && this.code) { + data.token && this.goToChangePassword(data); + !data.token && this.goToLogin(); + } else + + data.code && this.handleCode(data.code); + } }, }; } @@ -44,15 +57,7 @@ export default class Controller { throw new UserError(`Credentials not valid`); const method = this.methodsAvailables()[this.method]; this.$http.post(method.url, method.data) - .then(({data}) => { - if (this.method && this.code) { - data.token && this.goToChangePassword(data); - !data.token && this.goToLogin(); - } else { - if (data === '') this.goToLogin(); - data.code && this.handleCode(data.code); - } - }); + .then(({data}) => method.cb(data)); } } Controller.$inject = ['$scope', '$element', '$http', 'vnApp', '$translate', '$state', '$location']; -- 2.40.1 From 9953df2f4fb564bf243aec1c018d5e371beb7335 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 24 May 2024 11:11:22 +0200 Subject: [PATCH 37/52] perf(salix): refs #6427 imrpove --- back/methods/vn-user/recover-passwordSMS.js | 54 ++++++++----------- e2e/paths/01-salix/04_recoverPassword.spec.js | 20 ++----- .../components/recover-password/index.js | 9 ++-- 3 files changed, 31 insertions(+), 52 deletions(-) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 9a45e6486..f5787610a 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -7,7 +7,7 @@ module.exports = Self => { accepts: [ { - arg: 'userId', + arg: 'user', type: 'string', description: 'The recoveryPhone user\'s', required: true @@ -28,44 +28,36 @@ module.exports = Self => { } }); - Self.recoverPasswordSMS = async function(userId, verificationCode, options) { + Self.recoverPasswordSMS = async function(user, verificationCode, options) { + const models = Self.app.models; const myOptions = {}; if (typeof options == 'object') Object.assign(myOptions, options); - const user = await Self.findOne({ - fields: ['id', 'name', 'email', 'name', 'recoveryPhone'], - where: { - or: [ - {id: userId}, - {nickname: userId}, - {name: userId}, - {email: userId}, - ] - } + const usesEmail = user.indexOf('@') !== -1; + const filter = usesEmail ? {email: user} : {name: user}; + // if (!usesEmail) { + const account = await models.VnUser.findOne({ + fields: ['id', 'name', 'recoveryPhone'], + where: filter }); - if (!user) throw new UserError('Credentials not valid'); + if (!account) return; + user = account; + // } - try { - if (verificationCode) { - await Self.validateCode(user.name, verificationCode); + if (verificationCode) { + await Self.validateCode(user.name, verificationCode); - return { - token: await user.accessTokens.create({}) - }; - } - - const code = await authCode(user, myOptions); - - if (isProduction(true)) - return {code}; - await Self.app.models.Sms.send({req: {accessToken: {userId}}}, +userId, code); - } catch (err) { - if (err.code === 'EMAIL_NOT_FOUND') - return; - else - throw err; + return { + token: await user.accessTokens.create({}) + }; } + + const code = await authCode(user, myOptions); + + if (isProduction(true)) + return {code}; + await Self.app.models.Sms.send({req: {accessToken: {user: user.id}}}, +user.recoveryPhone, code); }; }; diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index b04f7d690..3a5bc7ef3 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -8,6 +8,10 @@ fdescribe('RecoverPassword path', async() => { beforeAll(async() => { browser = await getBrowser(); page = browser.page; + }); + + beforeEach(async() => { + await page.waitForState('login'); await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); await page.waitForState('recover-password'); @@ -33,47 +37,33 @@ fdescribe('RecoverPassword path', async() => { }); it('should send email using email', async() => { - await page.waitForState('login'); - await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); - await page.write(selectors.recoverPassword.email, 'BruceWayne@mydomain.com'); await page.waitToClick(selectors.recoverPassword.emailOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); const message = await page.waitForSnackbar(); - await page.waitForState('login'); expect(message.text).toContain('Notification sent!'); }); it('should send email using username', async() => { - await page.waitForState('login'); - await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); - await page.write(selectors.recoverPassword.email, 'BruceWayne'); await page.waitToClick(selectors.recoverPassword.emailOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); const message = await page.waitForSnackbar(); - await page.waitForState('login'); expect(message.text).toContain('Notification sent!'); }); it('should not throw error if not exist user when select sms option', async() => { - await page.waitForState('login'); - await page.waitToClick(selectors.recoverPassword.recoverPasswordButton); await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); await page.waitToClick(selectors.recoverPassword.smsOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); - const message = await page.waitForSnackbar(); - expect(message.text).toContain('Credentials not valid'); - expect(await page.getState()).toContain('recover-password'); + expect(message.text).toContain('Notification sent!'); }); it('should send sms using username', async() => { - await page.clearInput(selectors.recoverPassword.email); - await page.write(selectors.recoverPassword.email, 'BruceWayne'); await page.waitToClick(selectors.recoverPassword.smsOption); await page.waitToClick(selectors.recoverPassword.sendEmailButton); diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index 17d2a2bad..a982daba7 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -33,19 +33,16 @@ export default class Controller { 'email': { url: 'VnUsers/recoverPassword', data: {user: this.user}, - cb: data => { - if (data === '') this.goToLogin(); - } + }, 'sms': { url: 'VnUsers/recoverPasswordSMS', - data: {userId: this.user, verificationCode: this.verificationCode}, + data: {user: this.user, verificationCode: this.verificationCode}, cb: data => { if (this.method && this.code) { data.token && this.goToChangePassword(data); !data.token && this.goToLogin(); } else - data.code && this.handleCode(data.code); } }, @@ -57,7 +54,7 @@ export default class Controller { throw new UserError(`Credentials not valid`); const method = this.methodsAvailables()[this.method]; this.$http.post(method.url, method.data) - .then(({data}) => method.cb(data)); + .then(({data}) => data === '' ? this.goToLogin() : method.cb(data)); } } Controller.$inject = ['$scope', '$element', '$http', 'vnApp', '$translate', '$state', '$location']; -- 2.40.1 From 739391243b491d31b58624c514e131ebc4fff0d6 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Mon, 27 May 2024 09:15:30 +0200 Subject: [PATCH 38/52] perf(salix): refs #6427 rellocated condition --- back/models/vn-user.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/back/models/vn-user.js b/back/models/vn-user.js index a2db8e86b..b374050a8 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -220,6 +220,7 @@ module.exports = function(Self) { const ctxToken = {req: {accessToken}}; if (userId === accessToken.userId) return; + // if (ctx.args?.recoveryPhone) throw new ForbiddenError(); const myOptions = {}; if (typeof options == 'object') @@ -232,8 +233,6 @@ module.exports = function(Self) { const user = await models.VnUser.findById(userId, {fields: ['id', 'emailVerified']}, myOptions); if (!user.emailVerified && hasMediumPrivileges) return; - if (ctx.args?.recoveryPhone) throw new ForbiddenError(); - throw new ForbiddenError(); }; -- 2.40.1 From 61d0d3545ce61550ae788a9e39f3f928f0c9a0c3 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 30 May 2024 14:41:37 +0200 Subject: [PATCH 39/52] feat(salix): refs #6427 #6427 change radio buttons labels --- front/salix/components/recover-password/index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 8e329f144..ff7c8d4fb 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -19,14 +19,14 @@ -- 2.40.1 From 4205baf71a7a79e00dbac891dd5525488e123206 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Thu, 30 May 2024 20:44:26 +0200 Subject: [PATCH 40/52] feat(salix): refs #6427 #6427 refactor send sms got dependency --- back/methods/sms/sendSms.js | 31 +++++++++++++++++++ back/methods/vn-user/recover-passwordSMS.js | 14 +++++---- back/models/specs/user.spec.js | 30 +++++++++++++----- back/models/vn-user.js | 1 - e2e/paths/01-salix/04_recoverPassword.spec.js | 28 ++++++++++++++++- e2e/tests.js | 17 ++-------- modules/client/back/methods/sms/send.js | 22 ++----------- 7 files changed, 92 insertions(+), 51 deletions(-) create mode 100644 back/methods/sms/sendSms.js diff --git a/back/methods/sms/sendSms.js b/back/methods/sms/sendSms.js new file mode 100644 index 000000000..b50d9ec29 --- /dev/null +++ b/back/methods/sms/sendSms.js @@ -0,0 +1,31 @@ +const got = require('got'); +const isProduction = require('vn-loopback/server/boot/isProduction'); +const {models} = require('vn-loopback/server/server'); + +module.exports = async(destination, message) => { + const smsConfig = await models.SmsConfig.findOne(); + + const params = { + api_key: smsConfig.apiKey, + messages: [{ + from: smsConfig.title, + to: destination, + text: message + }] + }; + + let response; + try { + if (!isProduction(false)) + response = {result: [{status: 'ok'}]}; + else { + const jsonTest = { + json: params + }; + response = await got.post(smsConfig.uri, jsonTest).json(); + } + } catch (e) { + response = e; + } + return response; +}; diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index f5787610a..3eabd9514 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -1,5 +1,4 @@ const isProduction = require('vn-loopback/server/boot/isProduction'); -const UserError = require('vn-loopback/util/user-error'); const authCode = require('../../models/authCode'); module.exports = Self => { Self.remoteMethod('recoverPasswordSMS', { @@ -37,14 +36,12 @@ module.exports = Self => { const usesEmail = user.indexOf('@') !== -1; const filter = usesEmail ? {email: user} : {name: user}; - // if (!usesEmail) { const account = await models.VnUser.findOne({ fields: ['id', 'name', 'recoveryPhone'], where: filter }); if (!account) return; user = account; - // } if (verificationCode) { await Self.validateCode(user.name, verificationCode); @@ -56,8 +53,13 @@ module.exports = Self => { const code = await authCode(user, myOptions); - if (isProduction(true)) - return {code}; - await Self.app.models.Sms.send({req: {accessToken: {user: user.id}}}, +user.recoveryPhone, code); + if (!isProduction()) { + try { + await Self.app.models.Sms.send(+user.recoveryPhone, code); + } catch (e) { + throw new UserError(`We weren't able to send this SMS`); + } + } + return {code: true}; }; }; diff --git a/back/models/specs/user.spec.js b/back/models/specs/user.spec.js index 78835e6eb..0550169c6 100644 --- a/back/models/specs/user.spec.js +++ b/back/models/specs/user.spec.js @@ -1,7 +1,6 @@ const models = require('vn-loopback/server/server').models; const LoopBackContext = require('loopback-context'); - -describe('VnUser recoverPassword()', () => { +describe('VnUser recoverPassword', () => { const userId = 1107; const activeCtx = { @@ -19,14 +18,29 @@ describe('VnUser recoverPassword()', () => { }); }); - it('should send email with token', async() => { - const userId = 1107; - const user = await models.VnUser.findById(userId); + describe('By email', () => { + it('should send email with token', async() => { + const userId = 1107; + const user = await models.VnUser.findById(userId); - await models.VnUser.recoverPassword(user.email); + await models.VnUser.recoverPassword(user.email); - const result = await models.AccessToken.findOne({where: {userId: userId}}); + const result = await models.AccessToken.findOne({where: {userId: userId}}); - expect(result).toBeDefined(); + expect(result).toBeDefined(); + }); + }); + + describe('By SMS()', () => { + it('should send sms with token', async() => { + const userId = 1107; + const user = await models.VnUser.findById(userId); + + await models.VnUser.recoverPasswordSMS(user.email); + + const result = await models.AuthCode.findOne({where: {userId: userId}}); + + expect(result).toBeDefined(); + }); }); }); diff --git a/back/models/vn-user.js b/back/models/vn-user.js index 625139911..2ee4b15ae 100644 --- a/back/models/vn-user.js +++ b/back/models/vn-user.js @@ -221,7 +221,6 @@ module.exports = function(Self) { const ctxToken = {req: {accessToken}}; if (userId === accessToken.userId) return; - // if (ctx.args?.recoveryPhone) throw new ForbiddenError(); const myOptions = {}; if (typeof options == 'object') diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index 3a5bc7ef3..edde847e1 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -1,13 +1,14 @@ import selectors from '../../helpers/selectors'; import getBrowser from '../../helpers/puppeteer'; -fdescribe('RecoverPassword path', async() => { +describe('RecoverPassword path', async() => { let browser; let page; beforeAll(async() => { browser = await getBrowser(); page = browser.page; + await page.setRequestInterception(true); }); beforeEach(async() => { @@ -66,6 +67,31 @@ fdescribe('RecoverPassword path', async() => { it('should send sms using username', async() => { await page.write(selectors.recoverPassword.email, 'BruceWayne'); await page.waitToClick(selectors.recoverPassword.smsOption); + page.on('request', request => { + if (request.url().includes('recoverPasswordSMS')) { + const body = JSON.parse(request.postData()); + const isVerificationCode = Object.keys(body).includes('verificationCode'); + if (!isVerificationCode) { + request.respond({ + content: 'application/json', + headers: {'Access-Control-Allow-Origin': '*'}, + body: JSON.stringify({code: '123456'}) + }); + } else { + request.respond({ + content: 'application/json', + headers: {'Access-Control-Allow-Origin': '*'}, + body: JSON.stringify({token: { + 'id': 'A7al0KNofU7RFL5XPNubKsVjOAj80eoydXhm9i6rF4gj5kom6nEx4BG2bubzLocm', + 'ttl': 1209600, + 'created': '2024-05-30T10:43:36.014Z', + 'userId': 9 + }}) + }); + } + } else + request.continue(); + }); await page.waitToClick(selectors.recoverPassword.sendEmailButton); const httpDataResponse = await page.waitForResponse(response => { return response.status() === 200 && response.url().includes(`VnUsers/recoverPasswordSMS`); diff --git a/e2e/tests.js b/e2e/tests.js index 829056f4c..2916eb1ee 100644 --- a/e2e/tests.js +++ b/e2e/tests.js @@ -23,8 +23,8 @@ async function test() { const opts = getopts(process.argv.slice(2), { boolean: ['show'] }); - if (opts.show) - process.env.E2E_SHOW = true; + // if (opts.show) + process.env.E2E_SHOW = true; console.log('Building and running DB container.'); const myt = new Myt(); @@ -37,19 +37,6 @@ async function test() { const specFiles = [ `./e2e/paths/01*/*[sS]pec.js`, - `./e2e/paths/02*/*[sS]pec.js`, - `./e2e/paths/03*/*[sS]pec.js`, - `./e2e/paths/04*/*[sS]pec.js`, - `./e2e/paths/05*/*[sS]pec.js`, - `./e2e/paths/06*/*[sS]pec.js`, - `./e2e/paths/07*/*[sS]pec.js`, - `./e2e/paths/08*/*[sS]pec.js`, - `./e2e/paths/09*/*[sS]pec.js`, - `./e2e/paths/10*/*[sS]pec.js`, - `./e2e/paths/11*/*[sS]pec.js`, - `./e2e/paths/12*/*[sS]pec.js`, - `./e2e/paths/13*/*[sS]pec.js`, - `./e2e/paths/**/*[sS]pec.js` ]; jasmine.loadConfig({ diff --git a/modules/client/back/methods/sms/send.js b/modules/client/back/methods/sms/send.js index 2b5674f86..9694edf1b 100644 --- a/modules/client/back/methods/sms/send.js +++ b/modules/client/back/methods/sms/send.js @@ -1,6 +1,5 @@ -const got = require('got'); const UserError = require('vn-loopback/util/user-error'); -const isProduction = require('vn-loopback/server/boot/isProduction'); +const sendSms = require('../../../../../back/methods/sms/sendSms'); module.exports = Self => { Self.remoteMethod('send', { @@ -30,32 +29,15 @@ module.exports = Self => { Self.send = async(ctx, destination, message) => { const userId = ctx.req.accessToken.userId; - const smsConfig = await Self.app.models.SmsConfig.findOne(); if (destination.length == 9) { const spainPrefix = '0034'; destination = spainPrefix + destination; } - const params = { - api_key: smsConfig.apiKey, - messages: [{ - from: smsConfig.title, - to: destination, - text: message - }] - }; - let response; try { - if (!isProduction(false)) - response = {result: [{status: 'ok'}]}; - else { - const jsonTest = { - json: params - }; - response = await got.post(smsConfig.uri, jsonTest).json(); - } + response = await sendSms(destination, message); } catch (e) { console.error(e); } -- 2.40.1 From a29ec116529f90faac0cfc95dda214011dca7bb5 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 31 May 2024 08:15:35 +0200 Subject: [PATCH 41/52] test(salix): refs #6427 fix test e2e --- db/dump/fixtures.after.sql | 2 +- .../01-updateUserPhoneColumn.vn.sql | 2 +- e2e/helpers/selectors.js | 1 - e2e/paths/01-salix/04_recoverPassword.spec.js | 3 ++- e2e/tests.js | 17 +++++++++++++++-- .../components/recover-password/index.html | 2 +- .../components/recover-password/locale/en.yml | 2 -- .../components/recover-password/locale/es.yml | 1 - modules/account/front/basic-data/index.html | 1 - 9 files changed, 20 insertions(+), 11 deletions(-) delete mode 100644 front/salix/components/recover-password/locale/en.yml diff --git a/db/dump/fixtures.after.sql b/db/dump/fixtures.after.sql index fe05414da..f0741e78b 100644 --- a/db/dump/fixtures.after.sql +++ b/db/dump/fixtures.after.sql @@ -316,7 +316,7 @@ INSERT INTO mysql.roles_mapping (`User`, `Host`, `Role`, `Admin_option`) WHERE `User` LIKE @prefixedLike AND `Host` = @genRoleHost; -- Actualiza los valores de la nueva columna con los valores correspondientes de la tabla userInfo -UPDATE `account`.`user` as `user` +UPDATE `account`.`user` as `user` JOIN vn.client `client` ON `user`.id = `client`.id SET `user`.recoveryPhone = `client`.phone; diff --git a/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql b/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql index 390d6c4c1..3d908ecff 100644 --- a/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql +++ b/db/versions/10958-orangeDendro/01-updateUserPhoneColumn.vn.sql @@ -1,5 +1,5 @@ -- Actualiza los valores de la nueva columna con los valores correspondientes de la tabla userInfo -UPDATE `account`.`user` as `user` +UPDATE `account`.`user` as `user` JOIN vn.client `client` ON `user`.id = `client`.id SET `user`.recoveryPhone = `client`.phone; diff --git a/e2e/helpers/selectors.js b/e2e/helpers/selectors.js index af8f05581..758f420c5 100644 --- a/e2e/helpers/selectors.js +++ b/e2e/helpers/selectors.js @@ -37,7 +37,6 @@ export default { sendEmailButton: 'vn-recover-password vn-submit', smsOption: 'vn-recover-password vn-radio[val="sms"]', emailOption: 'vn-recover-password vn-radio[val="email"]', - }, accountIndex: { addAccount: 'vn-user-index button vn-icon[icon="add"]', diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index edde847e1..007cbecd3 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -8,7 +8,6 @@ describe('RecoverPassword path', async() => { beforeAll(async() => { browser = await getBrowser(); page = browser.page; - await page.setRequestInterception(true); }); beforeEach(async() => { @@ -65,6 +64,8 @@ describe('RecoverPassword path', async() => { }); it('should send sms using username', async() => { + await page.setRequestInterception(true); + await page.write(selectors.recoverPassword.email, 'BruceWayne'); await page.waitToClick(selectors.recoverPassword.smsOption); page.on('request', request => { diff --git a/e2e/tests.js b/e2e/tests.js index 2916eb1ee..829056f4c 100644 --- a/e2e/tests.js +++ b/e2e/tests.js @@ -23,8 +23,8 @@ async function test() { const opts = getopts(process.argv.slice(2), { boolean: ['show'] }); - // if (opts.show) - process.env.E2E_SHOW = true; + if (opts.show) + process.env.E2E_SHOW = true; console.log('Building and running DB container.'); const myt = new Myt(); @@ -37,6 +37,19 @@ async function test() { const specFiles = [ `./e2e/paths/01*/*[sS]pec.js`, + `./e2e/paths/02*/*[sS]pec.js`, + `./e2e/paths/03*/*[sS]pec.js`, + `./e2e/paths/04*/*[sS]pec.js`, + `./e2e/paths/05*/*[sS]pec.js`, + `./e2e/paths/06*/*[sS]pec.js`, + `./e2e/paths/07*/*[sS]pec.js`, + `./e2e/paths/08*/*[sS]pec.js`, + `./e2e/paths/09*/*[sS]pec.js`, + `./e2e/paths/10*/*[sS]pec.js`, + `./e2e/paths/11*/*[sS]pec.js`, + `./e2e/paths/12*/*[sS]pec.js`, + `./e2e/paths/13*/*[sS]pec.js`, + `./e2e/paths/**/*[sS]pec.js` ]; jasmine.loadConfig({ diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index ff7c8d4fb..25b4aabd7 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -36,7 +36,7 @@ We will sent you a sms to recover your password - + We will sent you an email to recover your password
diff --git a/front/salix/components/recover-password/locale/en.yml b/front/salix/components/recover-password/locale/en.yml deleted file mode 100644 index eaa98cf80..000000000 --- a/front/salix/components/recover-password/locale/en.yml +++ /dev/null @@ -1,2 +0,0 @@ - -We will sent you a item to recover your password: We will sent you a {{mode}} to recover your password diff --git a/front/salix/components/recover-password/locale/es.yml b/front/salix/components/recover-password/locale/es.yml index cb5e04973..e8d1b4d57 100644 --- a/front/salix/components/recover-password/locale/es.yml +++ b/front/salix/components/recover-password/locale/es.yml @@ -1,7 +1,6 @@ Recover password: Recuperar contraseña We will sent you an email to recover your password: Te enviaremos un correo para restablecer tu contraseña We will sent you a sms to recover your password: Te enviaremos un sms para restablecer tu contraseña -We will sent you a item to recover your password: Te enviaremos un {{mode}} para restablecer tu contraseña Notification sent!: ¡Notificación enviada! User or recovery email: Usuario User's phone: Móvil del usuario diff --git a/modules/account/front/basic-data/index.html b/modules/account/front/basic-data/index.html index 7cd3dbf51..605f915cc 100644 --- a/modules/account/front/basic-data/index.html +++ b/modules/account/front/basic-data/index.html @@ -32,7 +32,6 @@ label="Recovery phone" ng-model="$ctrl.user.recoveryPhone" disabled="$root.user.id !== $ctrl.user.id" - > Date: Fri, 31 May 2024 08:55:06 +0200 Subject: [PATCH 42/52] feat(salix): refs #6427 #6427 handle Send sms from app --- back/methods/sms/sendSms.js | 98 ++++++++++++++----- .../methods/sms/specs}/send.spec.js | 0 back/models/sms.js | 3 + {modules/client/back => back}/models/sms.json | 2 +- modules/client/back/methods/sms/send.js | 62 ------------ 5 files changed, 77 insertions(+), 88 deletions(-) rename {modules/client/back/methods/sms => back/methods/sms/specs}/send.spec.js (100%) create mode 100644 back/models/sms.js rename {modules/client/back => back}/models/sms.json (96%) delete mode 100644 modules/client/back/methods/sms/send.js diff --git a/back/methods/sms/sendSms.js b/back/methods/sms/sendSms.js index b50d9ec29..104dbe7b7 100644 --- a/back/methods/sms/sendSms.js +++ b/back/methods/sms/sendSms.js @@ -2,30 +2,78 @@ const got = require('got'); const isProduction = require('vn-loopback/server/boot/isProduction'); const {models} = require('vn-loopback/server/server'); -module.exports = async(destination, message) => { - const smsConfig = await models.SmsConfig.findOne(); - - const params = { - api_key: smsConfig.apiKey, - messages: [{ - from: smsConfig.title, - to: destination, - text: message - }] - }; - - let response; - try { - if (!isProduction(false)) - response = {result: [{status: 'ok'}]}; - else { - const jsonTest = { - json: params - }; - response = await got.post(smsConfig.uri, jsonTest).json(); +module.exports = Self => { + Self.remoteMethod('send', { + description: 'Sends SMS to a destination phone', + accessType: 'WRITE', + accepts: [ + { + arg: 'destination', + type: 'string', + required: true, + }, + { + arg: 'message', + type: 'string', + required: true, + } + ], + returns: { + type: 'object', + root: true + }, + http: { + path: `/send`, + verb: 'POST' } - } catch (e) { - response = e; - } - return response; + }); + Self.send = async(ctx, destination, message) => { + const smsConfig = await models.SmsConfig.findOne(); + const userId = ctx.req.accessToken.userId; + + if (destination.length == 9) { + const spainPrefix = '0034'; + destination = spainPrefix + destination; + } + + const params = { + api_key: smsConfig.apiKey, + messages: [{ + from: smsConfig.title, + to: destination, + text: message + }] + }; + + let response; + try { + if (!isProduction(false)) + response = {result: [{status: 'ok'}]}; + else { + const jsonTest = { + json: params + }; + response = await got.post(smsConfig.uri, jsonTest).json(); + } + } catch (e) { + console.error(e); + } + // return response; + const [result] = response.result; + const error = result.error_id; + + const newSms = { + senderFk: userId, + destination: destination, + message: message, + status: error + }; + + const sms = await Self.create(newSms); + + if (error) + throw new UserError(`We weren't able to send this SMS`); + + return sms; + }; }; diff --git a/modules/client/back/methods/sms/send.spec.js b/back/methods/sms/specs/send.spec.js similarity index 100% rename from modules/client/back/methods/sms/send.spec.js rename to back/methods/sms/specs/send.spec.js diff --git a/back/models/sms.js b/back/models/sms.js new file mode 100644 index 000000000..47a5b72d0 --- /dev/null +++ b/back/models/sms.js @@ -0,0 +1,3 @@ +module.exports = Self => { + require('../methods/sms/sendSms')(Self); +}; diff --git a/modules/client/back/models/sms.json b/back/models/sms.json similarity index 96% rename from modules/client/back/models/sms.json rename to back/models/sms.json index 4639131ef..14a3fba4f 100644 --- a/modules/client/back/models/sms.json +++ b/back/models/sms.json @@ -4,7 +4,7 @@ "base": "VnModel", "options": { "mysql": { - "table": "sms" + "table": "vn.sms" } }, "properties": { diff --git a/modules/client/back/methods/sms/send.js b/modules/client/back/methods/sms/send.js deleted file mode 100644 index 9694edf1b..000000000 --- a/modules/client/back/methods/sms/send.js +++ /dev/null @@ -1,62 +0,0 @@ -const UserError = require('vn-loopback/util/user-error'); -const sendSms = require('../../../../../back/methods/sms/sendSms'); - -module.exports = Self => { - Self.remoteMethod('send', { - description: 'Sends SMS to a destination phone', - accessType: 'WRITE', - accepts: [ - { - arg: 'destination', - type: 'string', - required: true, - }, - { - arg: 'message', - type: 'string', - required: true, - } - ], - returns: { - type: 'object', - root: true - }, - http: { - path: `/send`, - verb: 'POST' - } - }); - - Self.send = async(ctx, destination, message) => { - const userId = ctx.req.accessToken.userId; - - if (destination.length == 9) { - const spainPrefix = '0034'; - destination = spainPrefix + destination; - } - - let response; - try { - response = await sendSms(destination, message); - } catch (e) { - console.error(e); - } - - const [result] = response.result; - const error = result.error_id; - - const newSms = { - senderFk: userId, - destination: destination, - message: message, - status: error - }; - - const sms = await Self.create(newSms); - - if (error) - throw new UserError(`We weren't able to send this SMS`); - - return sms; - }; -}; -- 2.40.1 From 806fe91cd00dad539824e6c88616fec4103592b1 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 14:25:24 +0200 Subject: [PATCH 43/52] feat(Salix): refs #6427 #6427 change front --- front/salix/components/recover-password/index.js | 7 +++++-- front/salix/components/recover-password/locale/es.yml | 1 + 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index a982daba7..ea52192bc 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -33,6 +33,9 @@ export default class Controller { 'email': { url: 'VnUsers/recoverPassword', data: {user: this.user}, + cb: data => { + data === '' && this.goToLogin(); + } }, 'sms': { @@ -43,7 +46,7 @@ export default class Controller { data.token && this.goToChangePassword(data); !data.token && this.goToLogin(); } else - data.code && this.handleCode(data.code); + this.handleCode(data.code); } }, }; @@ -54,7 +57,7 @@ export default class Controller { throw new UserError(`Credentials not valid`); const method = this.methodsAvailables()[this.method]; this.$http.post(method.url, method.data) - .then(({data}) => data === '' ? this.goToLogin() : method.cb(data)); + .then(({data}) => method.cb(data)); } } Controller.$inject = ['$scope', '$element', '$http', 'vnApp', '$translate', '$state', '$location']; diff --git a/front/salix/components/recover-password/locale/es.yml b/front/salix/components/recover-password/locale/es.yml index e8d1b4d57..f8c8268b5 100644 --- a/front/salix/components/recover-password/locale/es.yml +++ b/front/salix/components/recover-password/locale/es.yml @@ -6,3 +6,4 @@ User or recovery email: Usuario User's phone: Móvil del usuario User's id: Id del usuario Credentials not valid: Credenciales no válidas +E-mail: Correo electrónico -- 2.40.1 From 49687794f5bcb548b55cbe488495de9239ef07e3 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 14:25:59 +0200 Subject: [PATCH 44/52] feat(Salix): refs #6427 #6427 rename method --- back/methods/sms/{sendSms.js => send.js} | 0 back/models/sms.js | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename back/methods/sms/{sendSms.js => send.js} (100%) diff --git a/back/methods/sms/sendSms.js b/back/methods/sms/send.js similarity index 100% rename from back/methods/sms/sendSms.js rename to back/methods/sms/send.js diff --git a/back/models/sms.js b/back/models/sms.js index 47a5b72d0..b4102f80d 100644 --- a/back/models/sms.js +++ b/back/models/sms.js @@ -1,3 +1,3 @@ module.exports = Self => { - require('../methods/sms/sendSms')(Self); + require('../methods/sms/send')(Self); }; -- 2.40.1 From 9c43c3fab1bbf882ccf48141e8dd9a94f9bc5498 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 14:26:19 +0200 Subject: [PATCH 45/52] feat(Salix): refs #6427 #6427 move sms-config --- {modules/client/back => back}/models/sms-config.json | 2 +- modules/client/back/models/sms.js | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-) rename {modules/client/back => back}/models/sms-config.json (92%) delete mode 100644 modules/client/back/models/sms.js diff --git a/modules/client/back/models/sms-config.json b/back/models/sms-config.json similarity index 92% rename from modules/client/back/models/sms-config.json rename to back/models/sms-config.json index ba78e4a8d..36962c0d9 100644 --- a/modules/client/back/models/sms-config.json +++ b/back/models/sms-config.json @@ -4,7 +4,7 @@ "base": "VnModel", "options": { "mysql": { - "table": "smsConfig" + "table": "vn.smsConfig" } }, "properties": { diff --git a/modules/client/back/models/sms.js b/modules/client/back/models/sms.js deleted file mode 100644 index a823d864a..000000000 --- a/modules/client/back/models/sms.js +++ /dev/null @@ -1,4 +0,0 @@ -module.exports = Self => { - // Methods - require('../methods/sms/send')(Self); -}; -- 2.40.1 From 5f1086d9e3f5561d13da6a0f6102dbc97c7ffc7a Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 15:45:40 +0200 Subject: [PATCH 46/52] test(Salix): refs #6427 #6427 change front --- e2e/paths/01-salix/04_recoverPassword.spec.js | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index 007cbecd3..ebf157800 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -1,7 +1,7 @@ import selectors from '../../helpers/selectors'; import getBrowser from '../../helpers/puppeteer'; -describe('RecoverPassword path', async() => { +fdescribe('RecoverPassword path', async() => { let browser; let page; @@ -54,15 +54,6 @@ describe('RecoverPassword path', async() => { expect(message.text).toContain('Notification sent!'); }); - it('should not throw error if not exist user when select sms option', async() => { - await page.write(selectors.recoverPassword.email, 'fakeEmail@mydomain.com'); - await page.waitToClick(selectors.recoverPassword.smsOption); - await page.waitToClick(selectors.recoverPassword.sendEmailButton); - const message = await page.waitForSnackbar(); - - expect(message.text).toContain('Notification sent!'); - }); - it('should send sms using username', async() => { await page.setRequestInterception(true); -- 2.40.1 From cd7f0e3c24412948600ed3f46deb1811902e161f Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 15:48:30 +0200 Subject: [PATCH 47/52] feat(Salix): refs #6427 #6427 unpublish send method --- back/methods/sms/send.js | 36 ++++----------------- back/methods/vn-user/recover-passwordSMS.js | 8 +++-- 2 files changed, 11 insertions(+), 33 deletions(-) diff --git a/back/methods/sms/send.js b/back/methods/sms/send.js index 104dbe7b7..2d2a87311 100644 --- a/back/methods/sms/send.js +++ b/back/methods/sms/send.js @@ -3,33 +3,8 @@ const isProduction = require('vn-loopback/server/boot/isProduction'); const {models} = require('vn-loopback/server/server'); module.exports = Self => { - Self.remoteMethod('send', { - description: 'Sends SMS to a destination phone', - accessType: 'WRITE', - accepts: [ - { - arg: 'destination', - type: 'string', - required: true, - }, - { - arg: 'message', - type: 'string', - required: true, - } - ], - returns: { - type: 'object', - root: true - }, - http: { - path: `/send`, - verb: 'POST' - } - }); - Self.send = async(ctx, destination, message) => { + Self.send = async(senderFk, destination, message, options) => { const smsConfig = await models.SmsConfig.findOne(); - const userId = ctx.req.accessToken.userId; if (destination.length == 9) { const spainPrefix = '0034'; @@ -50,25 +25,26 @@ module.exports = Self => { if (!isProduction(false)) response = {result: [{status: 'ok'}]}; else { - const jsonTest = { + const body = { json: params }; - response = await got.post(smsConfig.uri, jsonTest).json(); + response = await got.post(smsConfig.uri, body).json(); } } catch (e) { console.error(e); } + if (!options?.insert) return; // return response; const [result] = response.result; const error = result.error_id; + if (senderFk) senderFk = ctx.req.accessToken.userId; const newSms = { - senderFk: userId, + senderFk, destination: destination, message: message, status: error }; - const sms = await Self.create(newSms); if (error) diff --git a/back/methods/vn-user/recover-passwordSMS.js b/back/methods/vn-user/recover-passwordSMS.js index 3eabd9514..1ee540b35 100644 --- a/back/methods/vn-user/recover-passwordSMS.js +++ b/back/methods/vn-user/recover-passwordSMS.js @@ -1,10 +1,10 @@ +const UserError = require('vn-loopback/util/user-error'); const isProduction = require('vn-loopback/server/boot/isProduction'); const authCode = require('../../models/authCode'); module.exports = Self => { Self.remoteMethod('recoverPasswordSMS', { description: 'Send SMS to the user', accepts: [ - { arg: 'user', type: 'string', @@ -40,10 +40,12 @@ module.exports = Self => { fields: ['id', 'name', 'recoveryPhone'], where: filter }); - if (!account) return; + if (!account && !verificationCode) return; user = account; if (verificationCode) { + if (!account) + throw new UserError('Invalid or expired verification code'); await Self.validateCode(user.name, verificationCode); return { @@ -55,7 +57,7 @@ module.exports = Self => { if (!isProduction()) { try { - await Self.app.models.Sms.send(+user.recoveryPhone, code); + await Self.app.models.Sms.send(null, +user.recoveryPhone, code, {insert: false}); } catch (e) { throw new UserError(`We weren't able to send this SMS`); } -- 2.40.1 From aa3b58433c2428836e3564923244d6c7841f797b Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 15:53:58 +0200 Subject: [PATCH 48/52] feat(Salix): refs #6427 #6427 add option parameter --- back/methods/sms/send.js | 2 +- front/salix/components/recover-password/index.js | 2 +- modules/client/back/methods/client/sendSms.js | 2 +- modules/route/back/methods/route/sendSms.js | 2 +- modules/ticket/back/methods/ticket/sendSms.js | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/back/methods/sms/send.js b/back/methods/sms/send.js index 2d2a87311..b4293151d 100644 --- a/back/methods/sms/send.js +++ b/back/methods/sms/send.js @@ -38,7 +38,7 @@ module.exports = Self => { const [result] = response.result; const error = result.error_id; - if (senderFk) senderFk = ctx.req.accessToken.userId; + if (senderFk) senderFk = senderFk.req.accessToken.userId; const newSms = { senderFk, destination: destination, diff --git a/front/salix/components/recover-password/index.js b/front/salix/components/recover-password/index.js index ea52192bc..8bae19c92 100644 --- a/front/salix/components/recover-password/index.js +++ b/front/salix/components/recover-password/index.js @@ -44,7 +44,7 @@ export default class Controller { cb: data => { if (this.method && this.code) { data.token && this.goToChangePassword(data); - !data.token && this.goToLogin(); + if (!data.token) throw new UserError(`Credentials not valid`); } else this.handleCode(data.code); } diff --git a/modules/client/back/methods/client/sendSms.js b/modules/client/back/methods/client/sendSms.js index 270d7e5b5..f9e164fe4 100644 --- a/modules/client/back/methods/client/sendSms.js +++ b/modules/client/back/methods/client/sendSms.js @@ -32,7 +32,7 @@ module.exports = Self => { Self.sendSms = async(ctx, id, destination, message) => { const models = Self.app.models; - const sms = await models.Sms.send(ctx, destination, message); + const sms = await models.Sms.send(ctx, destination, message, {insert: true}); await models.ClientSms.create({ clientFk: id, diff --git a/modules/route/back/methods/route/sendSms.js b/modules/route/back/methods/route/sendSms.js index d1c3efa35..9326bc8c7 100644 --- a/modules/route/back/methods/route/sendSms.js +++ b/modules/route/back/methods/route/sendSms.js @@ -30,7 +30,7 @@ module.exports = Self => { const allSms = []; for (let client of targetClients) { - let sms = await Self.app.models.Sms.send(ctx, client, message); + let sms = await Self.app.models.Sms.send(ctx, client, message, {insert: true}); allSms.push(sms); } diff --git a/modules/ticket/back/methods/ticket/sendSms.js b/modules/ticket/back/methods/ticket/sendSms.js index 36e52fe3d..de8b7c282 100644 --- a/modules/ticket/back/methods/ticket/sendSms.js +++ b/modules/ticket/back/methods/ticket/sendSms.js @@ -32,7 +32,7 @@ module.exports = Self => { Self.sendSms = async(ctx, id, destination, message) => { const models = Self.app.models; - const sms = await models.Sms.send(ctx, destination, message); + const sms = await models.Sms.send(ctx, destination, message, {insert: true}); const {clientFk} = await models.Ticket.findById(id); await models.ClientSms.create({ clientFk, -- 2.40.1 From 1c093342aa6f9a9e840f8c87231ffe564cc61489 Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Fri, 14 Jun 2024 15:54:10 +0200 Subject: [PATCH 49/52] test(Salix): refs #6427 #6427 add option parameter --- back/methods/sms/specs/send.spec.js | 9 ++++++++- db/versions/10958-orangeDendro/00-firstScript.sql | 4 +++- e2e/paths/01-salix/04_recoverPassword.spec.js | 2 +- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/back/methods/sms/specs/send.spec.js b/back/methods/sms/specs/send.spec.js index 8eee85bd6..e63537cb4 100644 --- a/back/methods/sms/specs/send.spec.js +++ b/back/methods/sms/specs/send.spec.js @@ -3,8 +3,15 @@ const app = require('vn-loopback/server/server'); describe('sms send()', () => { it('should not return status error', async() => { const ctx = {req: {accessToken: {userId: 1}}}; - const result = await app.models.Sms.send(ctx, '123456789', 'My SMS Body'); + const result = await app.models.Sms.send(ctx, '123456789', 'My SMS Body', {insert: true}); expect(result.status).toBeUndefined(); }); + + it('should not insert', async() => { + const ctx = {req: {accessToken: {userId: 1}}}; + const result = await app.models.Sms.send(ctx, '123456789', 'My SMS Body', {insert: false}); + + expect(result).toBeUndefined(); + }); }); diff --git a/db/versions/10958-orangeDendro/00-firstScript.sql b/db/versions/10958-orangeDendro/00-firstScript.sql index 20d93e48f..0162aed76 100644 --- a/db/versions/10958-orangeDendro/00-firstScript.sql +++ b/db/versions/10958-orangeDendro/00-firstScript.sql @@ -1,2 +1,4 @@ --- Place your SQL code here +#6427 -- Place your SQL code here ALTER TABLE account.`user` ADD recoveryPhone varchar(20) NULL; + +-- ALTER TABLE vn.`sms` MODIFY COLUMN senderFk int(10) unsigned NULL; diff --git a/e2e/paths/01-salix/04_recoverPassword.spec.js b/e2e/paths/01-salix/04_recoverPassword.spec.js index ebf157800..277504623 100644 --- a/e2e/paths/01-salix/04_recoverPassword.spec.js +++ b/e2e/paths/01-salix/04_recoverPassword.spec.js @@ -1,7 +1,7 @@ import selectors from '../../helpers/selectors'; import getBrowser from '../../helpers/puppeteer'; -fdescribe('RecoverPassword path', async() => { +describe('RecoverPassword path', async() => { let browser; let page; -- 2.40.1 From 04520cafcf2855ad8a8b6e915be057a2bf27eaaf Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Mon, 17 Jun 2024 14:26:40 +0200 Subject: [PATCH 50/52] feat(Salix): refs #6427 #6427 Add loggable to models --- modules/account/back/models/account.json | 3 +++ modules/client/back/models/client-unpaid.json | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/modules/account/back/models/account.json b/modules/account/back/models/account.json index 6c2784696..284f1b25e 100644 --- a/modules/account/back/models/account.json +++ b/modules/account/back/models/account.json @@ -1,6 +1,9 @@ { "name": "Account", "base": "VnModel", + "mixins": { + "Loggable": true + }, "options": { "mysql": { "table": "account.account" diff --git a/modules/client/back/models/client-unpaid.json b/modules/client/back/models/client-unpaid.json index 0fc3a9195..d4c0a5f25 100644 --- a/modules/client/back/models/client-unpaid.json +++ b/modules/client/back/models/client-unpaid.json @@ -1,6 +1,10 @@ { "name": "ClientUnpaid", "base": "VnModel", + + "mixins": { + "Loggable": true + }, "options": { "mysql": { "table": "clientUnpaid" @@ -25,4 +29,4 @@ "foreignKey": "clientFk" } } -} \ No newline at end of file +} -- 2.40.1 From 580c2c6f108751e444e77d4bfd3d58396410124b Mon Sep 17 00:00:00 2001 From: Javier Segarra Date: Wed, 2 Oct 2024 11:28:34 +0200 Subject: [PATCH 51/52] perf(salix): refs #6427 #6427 comments --- back/methods/sms/send.js | 9 +++++---- front/salix/components/recover-password/index.html | 5 +++-- modules/account/front/basic-data/index.html | 8 ++++---- 3 files changed, 12 insertions(+), 10 deletions(-) diff --git a/back/methods/sms/send.js b/back/methods/sms/send.js index b4293151d..69d89939a 100644 --- a/back/methods/sms/send.js +++ b/back/methods/sms/send.js @@ -6,10 +6,11 @@ module.exports = Self => { Self.send = async(senderFk, destination, message, options) => { const smsConfig = await models.SmsConfig.findOne(); - if (destination.length == 9) { - const spainPrefix = '0034'; + const [{prefix: spainPrefix}] = await Self.rawSql( + 'SELECT prefix FROM pbx.prefix WHERE country = ?', ['es'], options + ); + if (destination.length == 9) destination = spainPrefix + destination; - } const params = { api_key: smsConfig.apiKey, @@ -34,7 +35,7 @@ module.exports = Self => { console.error(e); } if (!options?.insert) return; - // return response; + const [result] = response.result; const error = result.error_id; diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 25b4aabd7..05ccedde3 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -30,8 +30,9 @@ val="email" ng-model="$ctrl.method" > - + + +
We will sent you a sms to recover your password diff --git a/modules/account/front/basic-data/index.html b/modules/account/front/basic-data/index.html index 605f915cc..946474433 100644 --- a/modules/account/front/basic-data/index.html +++ b/modules/account/front/basic-data/index.html @@ -28,10 +28,10 @@ rule="VnUser"> Date: Fri, 8 Nov 2024 12:15:38 +0100 Subject: [PATCH 52/52] style: refs #6427 #6427 fix tab --- front/salix/components/recover-password/index.html | 9 +++------ modules/account/front/basic-data/index.html | 5 ++--- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/front/salix/components/recover-password/index.html b/front/salix/components/recover-password/index.html index 05ccedde3..ef6006eec 100644 --- a/front/salix/components/recover-password/index.html +++ b/front/salix/components/recover-password/index.html @@ -12,8 +12,7 @@ ng-model="$ctrl.verificationCode" vn-name="verificationCode" autocomplete="false" - class="vn-mt-md" -> + class="vn-mt-md"> @@ -21,15 +20,13 @@ disabled="$ctrl.code" label="Teléfono móvil" val="sms" - ng-model="$ctrl.method" - > + ng-model="$ctrl.method"> + ng-model="$ctrl.method"> diff --git a/modules/account/front/basic-data/index.html b/modules/account/front/basic-data/index.html index 946474433..02351bc93 100644 --- a/modules/account/front/basic-data/index.html +++ b/modules/account/front/basic-data/index.html @@ -31,9 +31,8 @@ vn-one label="Recovery phone" ng-model="$ctrl.user.recoveryPhone" - disabled="$root.user.id !== $ctrl.user.id" - > - + disabled="$root.user.id !== $ctrl.user.id"> +