395 lines
13 KiB
JavaScript
395 lines
13 KiB
JavaScript
const express = require('express');
|
|
const bcrypt = require('bcryptjs');
|
|
const jwt = require('jsonwebtoken');
|
|
const { getUserByUsername, updateUserPassword, updateUserUsername, updateUserAccountName, updateUserProfilePicture, getDB } = require('../database');
|
|
const router = express.Router();
|
|
const multer = require('multer');
|
|
const path = require('path');
|
|
const fs = require('fs');
|
|
|
|
const storage = multer.diskStorage({
|
|
destination: (req, file, cb) => {
|
|
const dir = path.join(__dirname, '..', 'uploads');
|
|
if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
|
|
cb(null, dir);
|
|
},
|
|
filename: (req, file, cb) => {
|
|
const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1E9);
|
|
cb(null, 'profile-' + uniqueSuffix + path.extname(file.originalname));
|
|
}
|
|
});
|
|
const upload = multer({ storage });
|
|
|
|
const JWT_SECRET = process.env.JWT_SECRET || 'super-secret-backone-key';
|
|
|
|
router.post('/login', (req, res) => {
|
|
const { username, password } = req.body;
|
|
if (!username || !password) {
|
|
return res.status(400).json({ error: 'Username and password are required' });
|
|
}
|
|
|
|
const user = getUserByUsername(username);
|
|
if (!user) {
|
|
return res.status(401).json({ error: 'Invalid credentials' });
|
|
}
|
|
|
|
const isValid = bcrypt.compareSync(password, user.password_hash);
|
|
if (!isValid) {
|
|
return res.status(401).json({ error: 'Invalid credentials' });
|
|
}
|
|
|
|
const token = jwt.sign(
|
|
{ id: user.id, username: user.username, account_name: user.account_name, profile_picture: user.profile_picture, role: user.role, site_uuid: user.site_uuid, agent_uuid: user.agent_uuid },
|
|
JWT_SECRET,
|
|
{ expiresIn: '1d' }
|
|
);
|
|
|
|
// Set HttpOnly cookie
|
|
res.cookie('token', token, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
maxAge: 24 * 60 * 60 * 1000 // 1 day
|
|
});
|
|
|
|
res.json({
|
|
message: 'Login successful',
|
|
user: { id: user.id, username: user.username, account_name: user.account_name, profile_picture: user.profile_picture, role: user.role, site_uuid: user.site_uuid, agent_uuid: user.agent_uuid }
|
|
});
|
|
});
|
|
|
|
router.get('/me', (req, res) => {
|
|
const token = req.cookies?.token;
|
|
if (!token) {
|
|
return res.status(401).json({ error: 'Not authenticated' });
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
res.json({ user: decoded });
|
|
} catch (err) {
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
});
|
|
|
|
router.post('/change-password', (req, res) => {
|
|
const token = req.cookies?.token;
|
|
if (!token) {
|
|
return res.status(401).json({ error: 'Not authenticated' });
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
const { currentPassword, newPassword } = req.body;
|
|
|
|
if (!currentPassword || !newPassword) {
|
|
return res.status(400).json({ error: 'Current password and new password are required' });
|
|
}
|
|
|
|
// 1. Get user details from database
|
|
const user = getUserByUsername(decoded.username);
|
|
if (!user) {
|
|
return res.status(404).json({ error: 'User not found' });
|
|
}
|
|
|
|
// 2. Verify current password
|
|
const isCurrentValid = bcrypt.compareSync(currentPassword, user.password_hash);
|
|
if (!isCurrentValid) {
|
|
return res.status(400).json({ error: 'Password saat ini salah' });
|
|
}
|
|
|
|
// 3. Validate new password strength
|
|
const passwordRegex = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{6,}$/;
|
|
if (!passwordRegex.test(newPassword)) {
|
|
return res.status(400).json({
|
|
error: 'Password baru tidak memenuhi kriteria: minimal 6 karakter, serta mengandung huruf besar, huruf kecil, dan angka.'
|
|
});
|
|
}
|
|
|
|
// 4. Hash new password and save to DB
|
|
const newHash = bcrypt.hashSync(newPassword, 10);
|
|
updateUserPassword(user.id, newHash);
|
|
|
|
return res.json({ ok: true, message: 'Password berhasil diubah!' });
|
|
} catch (err) {
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
});
|
|
|
|
router.post('/change-username', (req, res) => {
|
|
const token = req.cookies?.token;
|
|
if (!token) {
|
|
return res.status(401).json({ error: 'Not authenticated' });
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
const { currentPassword, newUsername } = req.body;
|
|
|
|
if (!currentPassword || !newUsername) {
|
|
return res.status(400).json({ error: 'Current password and new username are required' });
|
|
}
|
|
|
|
if (newUsername.length < 4 || /[^a-zA-Z0-9_]/.test(newUsername)) {
|
|
return res.status(400).json({ error: 'Username baru tidak valid (minimal 4 karakter, hanya huruf, angka, dan underscore).' });
|
|
}
|
|
|
|
// 1. Get user details from database
|
|
const user = getUserByUsername(decoded.username);
|
|
if (!user) {
|
|
return res.status(404).json({ error: 'User not found' });
|
|
}
|
|
|
|
// 2. Verify current password
|
|
const isCurrentValid = bcrypt.compareSync(currentPassword, user.password_hash);
|
|
if (!isCurrentValid) {
|
|
return res.status(400).json({ error: 'Password saat ini salah' });
|
|
}
|
|
|
|
// 3. Check if new username is already taken
|
|
const existingUser = getUserByUsername(newUsername);
|
|
if (existingUser) {
|
|
return res.status(400).json({ error: 'Username sudah digunakan oleh akun lain' });
|
|
}
|
|
|
|
// 4. Update username in DB
|
|
updateUserUsername(user.id, newUsername);
|
|
|
|
// 5. Generate new token with updated username
|
|
const newToken = jwt.sign(
|
|
{ id: user.id, username: newUsername, account_name: user.account_name, profile_picture: user.profile_picture, role: user.role, site_uuid: user.site_uuid, agent_uuid: user.agent_uuid },
|
|
JWT_SECRET,
|
|
{ expiresIn: '1d' }
|
|
);
|
|
|
|
// Set new HttpOnly cookie
|
|
res.cookie('token', newToken, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
maxAge: 24 * 60 * 60 * 1000 // 1 day
|
|
});
|
|
|
|
return res.json({ ok: true, message: 'Username berhasil diubah!', newUsername });
|
|
} catch (err) {
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
});
|
|
|
|
router.post('/change-account-name', (req, res) => {
|
|
const token = req.cookies?.token;
|
|
if (!token) {
|
|
return res.status(401).json({ error: 'Not authenticated' });
|
|
}
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
const { currentPassword, newAccountName } = req.body;
|
|
|
|
if (!currentPassword || newAccountName === undefined || newAccountName === null) {
|
|
return res.status(400).json({ error: 'Current password and new account name are required' });
|
|
}
|
|
|
|
if (newAccountName.trim().length === 0) {
|
|
return res.status(400).json({ error: 'Nama akun tidak boleh kosong' });
|
|
}
|
|
|
|
// 1. Get user details from database
|
|
const user = getUserByUsername(decoded.username);
|
|
if (!user) {
|
|
return res.status(404).json({ error: 'User not found' });
|
|
}
|
|
|
|
// 2. Verify current password
|
|
const isCurrentValid = bcrypt.compareSync(currentPassword, user.password_hash);
|
|
if (!isCurrentValid) {
|
|
return res.status(400).json({ error: 'Password saat ini salah' });
|
|
}
|
|
|
|
// 3. Update account name in DB
|
|
updateUserAccountName(user.id, newAccountName.trim());
|
|
|
|
// 4. Generate new token with updated account name
|
|
const newToken = jwt.sign(
|
|
{ id: user.id, username: user.username, account_name: newAccountName.trim(), profile_picture: user.profile_picture, role: user.role, site_uuid: user.site_uuid, agent_uuid: user.agent_uuid },
|
|
JWT_SECRET,
|
|
{ expiresIn: '1d' }
|
|
);
|
|
|
|
// Set new HttpOnly cookie
|
|
res.cookie('token', newToken, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
maxAge: 24 * 60 * 60 * 1000 // 1 day
|
|
});
|
|
|
|
return res.json({ ok: true, message: 'Nama akun berhasil diubah!', newAccountName: newAccountName.trim() });
|
|
} catch (err) {
|
|
return res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
});
|
|
|
|
router.post('/upload-profile-picture', upload.single('profile_picture'), (req, res) => {
|
|
const token = req.cookies?.token;
|
|
if (!token) return res.status(401).json({ error: 'Not authenticated' });
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
if (!req.file) {
|
|
return res.status(400).json({ error: 'No image uploaded' });
|
|
}
|
|
|
|
const user = getUserByUsername(decoded.username);
|
|
if (!user) return res.status(404).json({ error: 'User not found' });
|
|
|
|
updateUserProfilePicture(user.id, req.file.filename);
|
|
|
|
const newToken = jwt.sign(
|
|
{ id: user.id, username: user.username, account_name: user.account_name, profile_picture: req.file.filename, role: user.role, site_uuid: user.site_uuid, agent_uuid: user.agent_uuid },
|
|
JWT_SECRET,
|
|
{ expiresIn: '1d' }
|
|
);
|
|
|
|
res.cookie('token', newToken, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
maxAge: 24 * 60 * 60 * 1000
|
|
});
|
|
|
|
res.json({ ok: true, message: 'Foto profil berhasil diperbarui', profile_picture: req.file.filename });
|
|
} catch (err) {
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
});
|
|
|
|
router.post('/remove-profile-picture', (req, res) => {
|
|
const token = req.cookies?.token;
|
|
if (!token) return res.status(401).json({ error: 'Not authenticated' });
|
|
|
|
try {
|
|
const decoded = jwt.verify(token, JWT_SECRET);
|
|
const user = getUserByUsername(decoded.username);
|
|
if (!user) return res.status(404).json({ error: 'User not found' });
|
|
|
|
if (user.profile_picture) {
|
|
const filePath = path.join(__dirname, '..', 'uploads', user.profile_picture);
|
|
if (fs.existsSync(filePath)) {
|
|
fs.unlinkSync(filePath);
|
|
}
|
|
}
|
|
|
|
updateUserProfilePicture(user.id, null);
|
|
|
|
const newToken = jwt.sign(
|
|
{ id: user.id, username: user.username, account_name: user.account_name, profile_picture: null, role: user.role, site_uuid: user.site_uuid, agent_uuid: user.agent_uuid },
|
|
JWT_SECRET,
|
|
{ expiresIn: '1d' }
|
|
);
|
|
|
|
res.cookie('token', newToken, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
maxAge: 24 * 60 * 60 * 1000
|
|
});
|
|
|
|
res.json({ ok: true, message: 'Foto profil berhasil dihapus' });
|
|
} catch (err) {
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
});
|
|
|
|
router.post('/logout', (req, res) => {
|
|
res.clearCookie('token');
|
|
res.json({ message: 'Logged out successfully' });
|
|
});
|
|
|
|
router.get('/geoip', async (req, res) => {
|
|
const ip = req.query.ip;
|
|
if (!ip) {
|
|
return res.status(400).json({ error: 'IP is required' });
|
|
}
|
|
|
|
const d = getDB();
|
|
try {
|
|
// 1. Check local cache
|
|
let cached = d.prepare("SELECT * FROM geoip_cache WHERE ip_address = ?").get(ip);
|
|
if (cached) {
|
|
return res.json(cached);
|
|
}
|
|
|
|
// 2. Check if private IP (IPv4 and IPv6 link local)
|
|
const parts = ip.split('.');
|
|
let isPrivate = false;
|
|
if (parts.length === 4) {
|
|
const o1 = parseInt(parts[0], 10);
|
|
const o2 = parseInt(parts[1], 10);
|
|
if (o1 === 10) isPrivate = true;
|
|
else if (o1 === 192 && o2 === 168) isPrivate = true;
|
|
else if (o1 === 172 && (o2 >= 16 && o2 <= 31)) isPrivate = true;
|
|
else if (o1 === 127) isPrivate = true;
|
|
else if (o1 === 169 && o2 === 254) isPrivate = true;
|
|
} else if (ip.startsWith('fe80:') || ip === '::1' || ip.startsWith('fd')) {
|
|
isPrivate = true;
|
|
}
|
|
|
|
if (isPrivate) {
|
|
const privateInfo = {
|
|
ip_address: ip,
|
|
isp: 'Intranet / Private Network',
|
|
country: 'Local',
|
|
city: 'Local',
|
|
as_org: 'RFC 1918 Private Range'
|
|
};
|
|
d.prepare("INSERT OR IGNORE INTO geoip_cache (ip_address, isp, country, city, as_org) VALUES (?, ?, ?, ?, ?)").run(
|
|
privateInfo.ip_address, privateInfo.isp, privateInfo.country, privateInfo.city, privateInfo.as_org
|
|
);
|
|
return res.json(privateInfo);
|
|
}
|
|
|
|
// 3. Query public GeoIP API (ip-api.com) with timeout
|
|
const controller = new AbortController();
|
|
const timeoutId = setTimeout(() => controller.abort(), 3000); // 3-second timeout
|
|
|
|
const response = await fetch(`http://ip-api.com/json/${ip}`, { signal: controller.signal });
|
|
clearTimeout(timeoutId);
|
|
|
|
const geo = await response.json();
|
|
if (geo && geo.status === 'success') {
|
|
const publicInfo = {
|
|
ip_address: ip,
|
|
isp: geo.isp || 'Unknown ISP',
|
|
country: geo.country || 'Unknown Country',
|
|
city: geo.city || 'Unknown City',
|
|
as_org: geo.as || geo.org || 'Data Center'
|
|
};
|
|
|
|
d.prepare("INSERT OR IGNORE INTO geoip_cache (ip_address, isp, country, city, as_org) VALUES (?, ?, ?, ?, ?)").run(
|
|
publicInfo.ip_address, publicInfo.isp, publicInfo.country, publicInfo.city, publicInfo.as_org
|
|
);
|
|
return res.json(publicInfo);
|
|
} else {
|
|
// Return temporary/fallback details for lookup failures without caching
|
|
return res.json({
|
|
ip_address: ip,
|
|
isp: 'Public IP',
|
|
country: 'Remote',
|
|
city: 'Remote',
|
|
as_org: 'Public Network'
|
|
});
|
|
}
|
|
} catch (err) {
|
|
return res.json({
|
|
ip_address: ip,
|
|
isp: 'Public IP',
|
|
country: 'Remote',
|
|
city: 'Remote',
|
|
as_org: 'Public Network'
|
|
});
|
|
}
|
|
});
|
|
|
|
module.exports = router;
|