Mike/freno-dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

undone

Browse Source
This commit is contained in:
Michael Freno
2025-12-19 22:41:13 -05:00
parent 3e606d2354
commit ee9db9f674
14 changed files with 136 additions and 443 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
src/server/api/routers/auth.ts
View File

@@ -7,13 +7,6 @@ import { ConnectionFactory, hashPassword, checkPassword } from "~/server/utils";
import { SignJWT, jwtVerify } from "jose";
import { setCookie, getCookie } from "vinxi/http";
import type { User } from "~/types/user";
import {
emailSchema,
passwordSchema,
registrationSchema,
loginSchema,
passwordResetSchema
} from "~/server/api/schemas/validation";
// Helper to create JWT token
async function createJWT(
@@ -246,7 +239,7 @@ export const authRouter = createTRPCRouter({
emailLogin: publicProcedure
.input(
z.object({
email: emailSchema,
email: z.string().email(),
token: z.string(),
rememberMe: z.boolean().optional()
})
@@ -324,7 +317,7 @@ export const authRouter = createTRPCRouter({
emailVerification: publicProcedure
.input(
z.object({
email: emailSchema,
email: z.string().email(),
token: z.string()
})
)
@@ -367,9 +360,22 @@ export const authRouter = createTRPCRouter({
// Email/password registration
emailRegistration: publicProcedure
.input(registrationSchema)
.input(
z.object({
email: z.string().email(),
password: z.string().min(8),
passwordConfirmation: z.string().min(8)
})
)
.mutation(async ({ input, ctx }) => {
const { email, password } = input;
const { email, password, passwordConfirmation } = input;
if (password !== passwordConfirmation) {
throw new TRPCError({
code: "BAD_REQUEST",
message: "passwordMismatch"
});
}
const passwordHash = await hashPassword(password);
const conn = ConnectionFactory();
@@ -405,7 +411,13 @@ export const authRouter = createTRPCRouter({
// Email/password login
emailPasswordLogin: publicProcedure
.input(loginSchema)
.input(
z.object({
email: z.string().email(),
password: z.string(),
rememberMe: z.boolean().optional()
})
)
.mutation(async ({ input, ctx }) => {
const { email, password, rememberMe } = input;
@@ -465,7 +477,7 @@ export const authRouter = createTRPCRouter({
requestEmailLinkLogin: publicProcedure
.input(
z.object({
email: emailSchema,
email: z.string().email(),
rememberMe: z.boolean().optional()
})
)
@@ -570,7 +582,7 @@ export const authRouter = createTRPCRouter({
// Request password reset
requestPasswordReset: publicProcedure
.input(z.object({ email: emailSchema }))
.input(z.object({ email: z.string().email() }))
.mutation(async ({ input, ctx }) => {
const { email } = input;
@@ -669,9 +681,22 @@ export const authRouter = createTRPCRouter({
// Reset password with token
resetPassword: publicProcedure
.input(passwordResetSchema)
.input(
z.object({
token: z.string(),
newPassword: z.string().min(8),
newPasswordConfirmation: z.string().min(8)
})
)
.mutation(async ({ input, ctx }) => {
const { token, newPassword } = input;
const { token, newPassword, newPasswordConfirmation } = input;
if (newPassword !== newPasswordConfirmation) {
throw new TRPCError({
code: "BAD_REQUEST",
message: "Password Mismatch"
});
}
try {
// Verify JWT token
@@ -718,7 +743,7 @@ export const authRouter = createTRPCRouter({
// Resend email verification
resendEmailVerification: publicProcedure
.input(z.object({ email: emailSchema }))
.input(z.object({ email: z.string().email() }))
.mutation(async ({ input, ctx }) => {
const { email } = input;
@@ -827,3 +852,4 @@ export const authRouter = createTRPCRouter({
return { success: true };
})
});

52
src/server/api/routers/user.ts
View File

@@ -11,13 +11,6 @@ import {
import { setCookie } from "vinxi/http";
import type { User } from "~/types/user";
import { toUserProfile } from "~/types/user";
import {
updateEmailSchema,
updateDisplayNameSchema,
passwordChangeSchema,
passwordSetSchema,
deleteAccountSchema
} from "~/server/api/schemas/validation";
export const userRouter = createTRPCRouter({
// Get current user profile
@@ -50,7 +43,7 @@ export const userRouter = createTRPCRouter({
// Update email
updateEmail: publicProcedure
.input(updateEmailSchema)
.input(z.object({ email: z.string().email() }))
.mutation(async ({ input, ctx }) => {
const userId = await getUserID(ctx.event.nativeEvent);
@@ -87,7 +80,7 @@ export const userRouter = createTRPCRouter({
// Update display name
updateDisplayName: publicProcedure
.input(updateDisplayNameSchema)
.input(z.object({ displayName: z.string().min(1).max(50) }))
.mutation(async ({ input, ctx }) => {
const userId = await getUserID(ctx.event.nativeEvent);
@@ -118,9 +111,7 @@ export const userRouter = createTRPCRouter({
// Update profile image
updateProfileImage: publicProcedure
.input(
z.object({ imageUrl: z.string().url().optional().or(z.literal("")) })
)
.input(z.object({ imageUrl: z.string() }))
.mutation(async ({ input, ctx }) => {
const userId = await getUserID(ctx.event.nativeEvent);
@@ -151,7 +142,13 @@ export const userRouter = createTRPCRouter({
// Change password (requires old password)
changePassword: publicProcedure
.input(passwordChangeSchema)
.input(
z.object({
oldPassword: z.string(),
newPassword: z.string().min(8),
newPasswordConfirmation: z.string().min(8)
})
)
.mutation(async ({ input, ctx }) => {
const userId = await getUserID(ctx.event.nativeEvent);
@@ -162,7 +159,14 @@ export const userRouter = createTRPCRouter({
});
}
const { oldPassword, newPassword } = input;
const { oldPassword, newPassword, newPasswordConfirmation } = input;
if (newPassword !== newPasswordConfirmation) {
throw new TRPCError({
code: "BAD_REQUEST",
message: "Password Mismatch"
});
}
const conn = ConnectionFactory();
const res = await conn.execute({
@@ -220,7 +224,12 @@ export const userRouter = createTRPCRouter({
// Set password (for OAuth users who don't have password)
setPassword: publicProcedure
.input(passwordSetSchema)
.input(
z.object({
newPassword: z.string().min(8),
newPasswordConfirmation: z.string().min(8)
})
)
.mutation(async ({ input, ctx }) => {
const userId = await getUserID(ctx.event.nativeEvent);
@@ -231,7 +240,14 @@ export const userRouter = createTRPCRouter({
});
}
const { password } = input;
const { newPassword, newPasswordConfirmation } = input;
if (newPassword !== newPasswordConfirmation) {
throw new TRPCError({
code: "BAD_REQUEST",
message: "Password Mismatch"
});
}
const conn = ConnectionFactory();
const res = await conn.execute({
@@ -256,7 +272,7 @@ export const userRouter = createTRPCRouter({
}
// Set password
const passwordHash = await hashPassword(password);
const passwordHash = await hashPassword(newPassword);
await conn.execute({
sql: "UPDATE User SET password_hash = ? WHERE id = ?",
args: [passwordHash, userId]
@@ -277,7 +293,7 @@ export const userRouter = createTRPCRouter({
// Delete account (anonymize data)
deleteAccount: publicProcedure
.input(deleteAccountSchema)
.input(z.object({ password: z.string() }))
.mutation(async ({ input, ctx }) => {
const userId = await getUserID(ctx.event.nativeEvent);

153
src/server/api/schemas/validation.ts
View File

@@ -1,153 +0,0 @@
import { z } from "zod";
/**
* Validation Schemas for tRPC Procedures
*
* These schemas are the source of truth for server-side validation.
* Client-side validation (src/lib/validation.ts) is optional for UX only.
*/
// ============================================================================
// Base Schemas
// ============================================================================
/**
* Email validation schema
* - Must be valid email format
* - Min 3 chars, max 255 chars
* - Trimmed and lowercased automatically
*/
export const emailSchema = z
.string()
.trim()
.toLowerCase()
.email("Invalid email address")
.min(3, "Email too short")
.max(255, "Email too long");
/**
* Password validation schema
* - Minimum 8 characters
* - Maximum 128 characters
* - Can add additional complexity requirements if needed
*/
export const passwordSchema = z
.string()
.min(8, "Password must be at least 8 characters")
.max(128, "Password too long");
/**
* Display name validation schema
* - Minimum 1 character (after trim)
* - Maximum 50 characters
*/
export const displayNameSchema = z
.string()
.trim()
.min(1, "Display name is required")
.max(50, "Display name too long");
/**
* Comment body validation schema
* - Minimum 1 character (after trim)
* - Maximum 10,000 characters
*/
export const commentBodySchema = z
.string()
.trim()
.min(1, "Comment cannot be empty")
.max(10000, "Comment too long (max 10,000 characters)");
// ============================================================================
// Composed Schemas
// ============================================================================
/**
* Email/password login schema
*/
export const loginSchema = z.object({
email: emailSchema,
password: passwordSchema,
rememberMe: z.boolean().optional()
});
/**
* Email/password registration schema with password confirmation
*/
export const registrationSchema = z
.object({
email: emailSchema,
password: passwordSchema,
passwordConfirmation: passwordSchema,
displayName: displayNameSchema.optional()
})
.refine((data) => data.password === data.passwordConfirmation, {
message: "Passwords do not match",
path: ["passwordConfirmation"]
});
/**
* Password change schema (requires old password)
*/
export const passwordChangeSchema = z
.object({
oldPassword: passwordSchema,
newPassword: passwordSchema,
newPasswordConfirmation: passwordSchema
})
.refine((data) => data.newPassword === data.newPasswordConfirmation, {
message: "New passwords do not match",
path: ["newPasswordConfirmation"]
})
.refine((data) => data.oldPassword !== data.newPassword, {
message: "New password must be different from old password",
path: ["newPassword"]
});
/**
* Password reset schema (no old password required)
*/
export const passwordResetSchema = z
.object({
token: z.string(),
newPassword: passwordSchema,
newPasswordConfirmation: passwordSchema
})
.refine((data) => data.newPassword === data.newPasswordConfirmation, {
message: "Passwords do not match",
path: ["newPasswordConfirmation"]
});
/**
* Password set schema (for OAuth users setting password first time)
*/
export const passwordSetSchema = z
.object({
password: passwordSchema,
passwordConfirmation: passwordSchema
})
.refine((data) => data.password === data.passwordConfirmation, {
message: "Passwords do not match",
path: ["passwordConfirmation"]
});
/**
* Update email schema
*/
export const updateEmailSchema = z.object({
email: emailSchema
});
/**
* Update display name schema
*/
export const updateDisplayNameSchema = z.object({
displayName: displayNameSchema
});
/**
* Account deletion schema
*/
export const deleteAccountSchema = z.object({
password: passwordSchema
});

124
src/server/date-utils.ts
View File

@@ -1,124 +0,0 @@
/**
* Server-side Date/Time Utilities
*
* All dates are handled in UTC to avoid timezone issues.
* Database should store dates in UTC format.
*/
/**
* Get current UTC date/time formatted for SQL insert
*
* @returns SQL-formatted date string (YYYY-MM-DD HH:MM:SS) in UTC
* @example
* getSQLFormattedDate() // "2024-12-19 15:30:45"
*/
export function getSQLFormattedDate(): string {
const now = new Date();
const year = now.getUTCFullYear();
const month = String(now.getUTCMonth() + 1).padStart(2, "0");
const day = String(now.getUTCDate()).padStart(2, "0");
const hours = String(now.getUTCHours()).padStart(2, "0");
const minutes = String(now.getUTCMinutes()).padStart(2, "0");
const seconds = String(now.getUTCSeconds()).padStart(2, "0");
return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
}
/**
* Format a Date object for SQL insert
*
* @param date Date object to format
* @returns SQL-formatted date string (YYYY-MM-DD HH:MM:SS) in UTC
* @example
* formatDateForSQL(new Date()) // "2024-12-19 15:30:45"
*/
export function formatDateForSQL(date: Date): string {
const year = date.getUTCFullYear();
const month = String(date.getUTCMonth() + 1).padStart(2, "0");
const day = String(date.getUTCDate()).padStart(2, "0");
const hours = String(date.getUTCHours()).padStart(2, "0");
const minutes = String(date.getUTCMinutes()).padStart(2, "0");
const seconds = String(date.getUTCSeconds()).padStart(2, "0");
return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
}
/**
* Parse a client-provided date string to Date object
*
* @param dateString ISO 8601 date string from client
* @returns Date object or null if invalid
* @example
* parseClientDate("2024-12-19T15:30:45.000Z") // Date object
* parseClientDate("invalid") // null
*/
export function parseClientDate(dateString: string): Date | null {
try {
const date = new Date(dateString);
return isNaN(date.getTime()) ? null : date;
} catch {
return null;
}
}
/**
* Format a date for display with relative time
* Handles "X minutes ago", "X hours ago", etc.
*
* @param dateString SQL date string or ISO string
* @returns Formatted relative time string
* @example
* formatRelativeDate("2024-12-19 15:00:00") // "30m ago" (if now is 15:30)
*/
export function formatRelativeDate(dateString: string): string {
const date = new Date(dateString);
const now = new Date();
const diffMs = now.getTime() - date.getTime();
const diffMins = Math.floor(diffMs / 60000);
const diffHours = Math.floor(diffMs / 3600000);
const diffDays = Math.floor(diffMs / 86400000);
if (diffMins < 1) {
return "just now";
} else if (diffMins < 60) {
return `${diffMins}m ago`;
} else if (diffHours < 24) {
return `${diffHours}h ago`;
} else if (diffDays < 7) {
return `${diffDays}d ago`;
} else {
// For older dates, return formatted date
return date.toLocaleDateString("en-US", {
month: "short",
day: "numeric",
year: diffDays > 365 ? "numeric" : undefined
});
}
}
/**
* Format a date for display
*
* @param dateString SQL date string or ISO string
* @returns Formatted date string (e.g., "Dec 19, 2024")
* @example
* formatDateForDisplay("2024-12-19 15:30:45") // "Dec 19, 2024"
*/
export function formatDateForDisplay(dateString: string): string {
const date = new Date(dateString);
return date.toLocaleDateString("en-US", {
month: "short",
day: "numeric",
year: "numeric"
});
}
/**
* Get timestamp in milliseconds (UTC)
*
* @returns Current timestamp in ms
*/
export function getCurrentTimestamp(): number {
return Date.now();
}

9
src/server/utils.ts
View File

@@ -17,12 +17,3 @@ export {
export { hashPassword, checkPassword } from "./password";
export { sendEmailVerification, LINEAGE_JWT_EXPIRY } from "./email";
export {
getSQLFormattedDate,
formatDateForSQL,
parseClientDate,
formatRelativeDate,
formatDateForDisplay,
getCurrentTimestamp
} from "./date-utils";