feat: backend API key auth context and settings hardening (#406)
* feat: add backend api-key auth context and settings hardening * fix: harden api key token hashing
This commit is contained in:
Daniel Volz
GitHub
@@ -0,0 +1,294 @@
|
||||
import { randomBytes } from "node:crypto";
|
||||
import { and, desc, eq } from "drizzle-orm";
|
||||
import type { FastifyInstance } from "fastify";
|
||||
import { z } from "zod";
|
||||
import { db } from "../db/client.js";
|
||||
import { apiKeys } from "../db/schema.js";
|
||||
import { hashApiKeyToken, requireAuth } from "../plugins/auth.js";
|
||||
import { env } from "../plugins/env.js";
|
||||
import type { AuthUser } from "../types/fastify.js";
|
||||
|
||||
const createApiKeySchema = z.object({
|
||||
name: z.string().trim().min(3).max(100),
|
||||
scope: z.enum(["read", "write"]).default("write"),
|
||||
expiresInDays: z.number().int().min(1).max(3650).optional(),
|
||||
});
|
||||
|
||||
const idParamSchema = z.object({
|
||||
id: z.string().regex(/^\d+$/),
|
||||
});
|
||||
|
||||
const protectedEndpointSecurity = [{ bearerAuth: [] }];
|
||||
const genericErrorSchema = {
|
||||
type: "object",
|
||||
properties: {
|
||||
error: { type: "string" },
|
||||
code: { type: "string" },
|
||||
},
|
||||
};
|
||||
|
||||
const apiKeyMetadataSchema = {
|
||||
type: "object",
|
||||
properties: {
|
||||
id: { type: "number" },
|
||||
name: { type: "string" },
|
||||
tokenPrefix: { type: "string" },
|
||||
scope: { type: "string", enum: ["read", "write"] },
|
||||
isActive: { type: "boolean" },
|
||||
lastUsedAt: { type: ["string", "null"], format: "date-time" },
|
||||
expiresAt: { type: ["string", "null"], format: "date-time" },
|
||||
createdAt: { type: ["string", "null"], format: "date-time" },
|
||||
updatedAt: { type: ["string", "null"], format: "date-time" },
|
||||
},
|
||||
};
|
||||
|
||||
function normalizeDateTime(value: unknown): string | null {
|
||||
if (value == null) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (value instanceof Date) {
|
||||
return Number.isNaN(value.getTime()) ? null : value.toISOString();
|
||||
}
|
||||
|
||||
if (typeof value === "number") {
|
||||
const timestampMs = value < 1_000_000_000_000 ? value * 1000 : value;
|
||||
const date = new Date(timestampMs);
|
||||
return Number.isNaN(date.getTime()) ? null : date.toISOString();
|
||||
}
|
||||
|
||||
if (typeof value === "string") {
|
||||
const date = new Date(value);
|
||||
return Number.isNaN(date.getTime()) ? null : date.toISOString();
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
function serializeApiKeyMetadata<
|
||||
T extends {
|
||||
id: number;
|
||||
name: string;
|
||||
tokenPrefix: string;
|
||||
scope: string;
|
||||
isActive: boolean;
|
||||
lastUsedAt: unknown;
|
||||
expiresAt: unknown;
|
||||
createdAt: unknown;
|
||||
updatedAt: unknown;
|
||||
},
|
||||
>(key: T) {
|
||||
return {
|
||||
id: key.id,
|
||||
name: key.name,
|
||||
tokenPrefix: key.tokenPrefix,
|
||||
scope: key.scope,
|
||||
isActive: key.isActive,
|
||||
lastUsedAt: normalizeDateTime(key.lastUsedAt),
|
||||
expiresAt: normalizeDateTime(key.expiresAt),
|
||||
createdAt: normalizeDateTime(key.createdAt),
|
||||
updatedAt: normalizeDateTime(key.updatedAt),
|
||||
};
|
||||
}
|
||||
|
||||
export async function apiKeyRoutes(app: FastifyInstance) {
|
||||
app.addHook("preHandler", requireAuth);
|
||||
|
||||
app.get(
|
||||
"/auth/api-keys",
|
||||
{
|
||||
schema: {
|
||||
tags: ["api-keys"],
|
||||
summary: "List API keys for the current user",
|
||||
description: "Returns API key metadata. Raw API key tokens are never returned.",
|
||||
security: protectedEndpointSecurity,
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
keys: {
|
||||
type: "array",
|
||||
items: apiKeyMetadataSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
400: genericErrorSchema,
|
||||
401: genericErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!env.AUTH_ENABLED) {
|
||||
return reply.status(400).send({ error: "API keys are unavailable when auth is disabled" });
|
||||
}
|
||||
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
if (!authUser) {
|
||||
return reply.status(401).send({ error: "User not authenticated", code: "AUTH_REQUIRED" });
|
||||
}
|
||||
|
||||
const keys = await db
|
||||
.select({
|
||||
id: apiKeys.id,
|
||||
name: apiKeys.name,
|
||||
tokenPrefix: apiKeys.tokenPrefix,
|
||||
scope: apiKeys.scope,
|
||||
isActive: apiKeys.isActive,
|
||||
lastUsedAt: apiKeys.lastUsedAt,
|
||||
expiresAt: apiKeys.expiresAt,
|
||||
createdAt: apiKeys.createdAt,
|
||||
updatedAt: apiKeys.updatedAt,
|
||||
})
|
||||
.from(apiKeys)
|
||||
.where(eq(apiKeys.userId, authUser.id))
|
||||
.orderBy(desc(apiKeys.createdAt));
|
||||
|
||||
return { keys: keys.map(serializeApiKeyMetadata) };
|
||||
}
|
||||
);
|
||||
|
||||
app.post<{ Body: z.infer<typeof createApiKeySchema> }>(
|
||||
"/auth/api-keys",
|
||||
{
|
||||
schema: {
|
||||
tags: ["api-keys"],
|
||||
summary: "Create and rotate API key",
|
||||
description:
|
||||
"Creates a new API key and deactivates previously active API keys for the current user. The new token is returned only once.",
|
||||
security: protectedEndpointSecurity,
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["name"],
|
||||
properties: {
|
||||
name: { type: "string", minLength: 3, maxLength: 100 },
|
||||
scope: { type: "string", enum: ["read", "write"], default: "write" },
|
||||
expiresInDays: { type: "number", minimum: 1, maximum: 3650 },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
201: {
|
||||
type: "object",
|
||||
properties: {
|
||||
key: apiKeyMetadataSchema,
|
||||
token: { type: "string" },
|
||||
note: { type: "string" },
|
||||
},
|
||||
},
|
||||
400: { anyOf: [genericErrorSchema, { type: "object" }] },
|
||||
401: genericErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!env.AUTH_ENABLED) {
|
||||
return reply.status(400).send({ error: "API keys are unavailable when auth is disabled" });
|
||||
}
|
||||
|
||||
const parsed = createApiKeySchema.safeParse(request.body);
|
||||
if (!parsed.success) {
|
||||
return reply.status(400).send(parsed.error.format());
|
||||
}
|
||||
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
if (!authUser) {
|
||||
return reply.status(401).send({ error: "User not authenticated", code: "AUTH_REQUIRED" });
|
||||
}
|
||||
|
||||
const { name, scope, expiresInDays } = parsed.data;
|
||||
const rawToken = `ma_${randomBytes(32).toString("hex")}`;
|
||||
const tokenPrefix = `${rawToken.slice(0, 12)}...`;
|
||||
const keyHash = hashApiKeyToken(rawToken);
|
||||
const expiresAt = expiresInDays ? new Date(Date.now() + expiresInDays * 24 * 60 * 60 * 1000) : null;
|
||||
|
||||
// Keep a single active key per user: creating a new key invalidates old ones.
|
||||
await db
|
||||
.update(apiKeys)
|
||||
.set({ isActive: false, updatedAt: new Date() })
|
||||
.where(and(eq(apiKeys.userId, authUser.id), eq(apiKeys.isActive, true)));
|
||||
|
||||
const [created] = await db
|
||||
.insert(apiKeys)
|
||||
.values({
|
||||
userId: authUser.id,
|
||||
name,
|
||||
keyHash,
|
||||
tokenPrefix,
|
||||
scope,
|
||||
expiresAt,
|
||||
})
|
||||
.returning({
|
||||
id: apiKeys.id,
|
||||
name: apiKeys.name,
|
||||
tokenPrefix: apiKeys.tokenPrefix,
|
||||
scope: apiKeys.scope,
|
||||
isActive: apiKeys.isActive,
|
||||
lastUsedAt: apiKeys.lastUsedAt,
|
||||
expiresAt: apiKeys.expiresAt,
|
||||
createdAt: apiKeys.createdAt,
|
||||
updatedAt: apiKeys.updatedAt,
|
||||
});
|
||||
|
||||
return reply.status(201).send({
|
||||
key: serializeApiKeyMetadata(created),
|
||||
token: rawToken,
|
||||
note: "Store this token now. It cannot be retrieved again.",
|
||||
});
|
||||
}
|
||||
);
|
||||
|
||||
app.delete<{ Params: { id: string } }>(
|
||||
"/auth/api-keys/:id",
|
||||
{
|
||||
schema: {
|
||||
tags: ["api-keys"],
|
||||
summary: "Deactivate API key",
|
||||
description: "Deactivates one API key belonging to the current user.",
|
||||
security: protectedEndpointSecurity,
|
||||
params: {
|
||||
type: "object",
|
||||
required: ["id"],
|
||||
properties: {
|
||||
id: { type: "string", pattern: "^\\d+$" },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
204: { type: "null" },
|
||||
400: { anyOf: [genericErrorSchema, { type: "object" }] },
|
||||
401: genericErrorSchema,
|
||||
404: genericErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!env.AUTH_ENABLED) {
|
||||
return reply.status(400).send({ error: "API keys are unavailable when auth is disabled" });
|
||||
}
|
||||
|
||||
const parsedParams = idParamSchema.safeParse(request.params);
|
||||
if (!parsedParams.success) {
|
||||
return reply.status(400).send(parsedParams.error.format());
|
||||
}
|
||||
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
if (!authUser) {
|
||||
return reply.status(401).send({ error: "User not authenticated", code: "AUTH_REQUIRED" });
|
||||
}
|
||||
|
||||
const keyId = Number(parsedParams.data.id);
|
||||
const [existing] = await db
|
||||
.select({ id: apiKeys.id, userId: apiKeys.userId })
|
||||
.from(apiKeys)
|
||||
.where(and(eq(apiKeys.id, keyId), eq(apiKeys.userId, authUser.id)));
|
||||
if (!existing) {
|
||||
return reply.status(404).send({ error: "API key not found", code: "API_KEY_NOT_FOUND" });
|
||||
}
|
||||
|
||||
await db
|
||||
.update(apiKeys)
|
||||
.set({ isActive: false, updatedAt: new Date() })
|
||||
.where(and(eq(apiKeys.id, keyId), eq(apiKeys.userId, authUser.id)));
|
||||
|
||||
return reply.status(204).send();
|
||||
}
|
||||
);
|
||||
}
|
||||
+252
-21
@@ -85,6 +85,38 @@ const updateProfileSchema = z.object({
|
||||
.optional(),
|
||||
});
|
||||
|
||||
const authEndpointSecurity: ReadonlyArray<Record<string, readonly string[]>> = [{ bearerAuth: [] }, { cookieAuth: [] }];
|
||||
const authErrorSchema = {
|
||||
type: "object",
|
||||
properties: {
|
||||
error: { type: "string" },
|
||||
code: { type: "string" },
|
||||
},
|
||||
};
|
||||
|
||||
function normalizeDateTime(value: unknown): string | null {
|
||||
if (value == null) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (value instanceof Date) {
|
||||
return Number.isNaN(value.getTime()) ? null : value.toISOString();
|
||||
}
|
||||
|
||||
if (typeof value === "number") {
|
||||
const timestampMs = value < 1_000_000_000_000 ? value * 1000 : value;
|
||||
const date = new Date(timestampMs);
|
||||
return Number.isNaN(date.getTime()) ? null : date.toISOString();
|
||||
}
|
||||
|
||||
if (typeof value === "string") {
|
||||
const date = new Date(value);
|
||||
return Number.isNaN(date.getTime()) ? null : date.toISOString();
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// Auth Routes
|
||||
// =============================================================================
|
||||
@@ -99,9 +131,33 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
// GET /auth/state - Public auth state (needed before login)
|
||||
// Exempt from rate limit - lightweight state check called frequently
|
||||
// ---------------------------------------------------------------------------
|
||||
app.get("/auth/state", { config: { rateLimit: false } }, async () => {
|
||||
return getAuthState();
|
||||
});
|
||||
app.get(
|
||||
"/auth/state",
|
||||
{
|
||||
config: { rateLimit: false },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Get authentication state",
|
||||
description: "Returns auth and login mode state before user login.",
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
authEnabled: { type: "boolean" },
|
||||
registrationEnabled: { type: "boolean" },
|
||||
formLoginEnabled: { type: "boolean" },
|
||||
oidcEnabled: { type: "boolean" },
|
||||
hasUsers: { type: "boolean" },
|
||||
oidcProviderName: { type: "string" },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
async () => {
|
||||
return getAuthState();
|
||||
}
|
||||
);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// POST /auth/register - User registration
|
||||
@@ -110,6 +166,36 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
"/auth/register",
|
||||
{
|
||||
config: { rateLimit: sensitiveRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Register local user",
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["username", "password"],
|
||||
properties: {
|
||||
username: { type: "string", minLength: 3, maxLength: 50 },
|
||||
password: { type: "string", minLength: 8, maxLength: 128 },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
201: {
|
||||
type: "object",
|
||||
properties: {
|
||||
ok: { type: "boolean" },
|
||||
user: {
|
||||
type: "object",
|
||||
properties: {
|
||||
id: { type: "number" },
|
||||
username: { type: "string" },
|
||||
},
|
||||
},
|
||||
message: { type: "string" },
|
||||
},
|
||||
},
|
||||
400: authErrorSchema,
|
||||
409: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
// Check auth state
|
||||
@@ -177,6 +263,37 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
"/auth/login",
|
||||
{
|
||||
config: { rateLimit: sensitiveRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Login with username and password",
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["username", "password"],
|
||||
properties: {
|
||||
username: { type: "string" },
|
||||
password: { type: "string" },
|
||||
rememberMe: { type: "boolean" },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
ok: { type: "boolean" },
|
||||
user: {
|
||||
type: "object",
|
||||
properties: {
|
||||
id: { type: "number" },
|
||||
username: { type: "string" },
|
||||
avatarUrl: { type: ["string", "null"] },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
400: authErrorSchema,
|
||||
401: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const state = await getAuthState();
|
||||
@@ -281,6 +398,15 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
"/auth/refresh",
|
||||
{
|
||||
config: { rateLimit: authRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Refresh access token",
|
||||
description: "Requires refresh token cookie context.",
|
||||
response: {
|
||||
200: { type: "object", properties: { ok: { type: "boolean" } } },
|
||||
401: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const refreshTokenCookie = request.cookies.refresh_token;
|
||||
@@ -350,6 +476,13 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
"/auth/logout",
|
||||
{
|
||||
config: { rateLimit: authRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Logout and clear auth cookies",
|
||||
response: {
|
||||
200: { type: "object", properties: { ok: { type: "boolean" } } },
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const refreshTokenCookie = request.cookies.refresh_token;
|
||||
@@ -375,26 +508,56 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
// ---------------------------------------------------------------------------
|
||||
// GET /auth/me - Get current user profile
|
||||
// ---------------------------------------------------------------------------
|
||||
app.get("/auth/me", { preHandler: requireAuth }, async (request, reply) => {
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
if (!authUser) {
|
||||
return reply.status(401).send({ error: "Not authenticated" });
|
||||
}
|
||||
app.get(
|
||||
"/auth/me",
|
||||
{
|
||||
preHandler: requireAuth,
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Get current user profile",
|
||||
security: authEndpointSecurity,
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
id: { type: "number" },
|
||||
username: { type: "string" },
|
||||
avatarUrl: { type: ["string", "null"] },
|
||||
authProvider: { type: "string" },
|
||||
createdAt: { type: "string", format: "date-time" },
|
||||
lastLoginAt: { type: ["string", "null"], format: "date-time" },
|
||||
},
|
||||
},
|
||||
401: authErrorSchema,
|
||||
404: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
if (!authUser) {
|
||||
return reply.status(401).send({ error: "Not authenticated" });
|
||||
}
|
||||
|
||||
const [user] = await db.select().from(users).where(eq(users.id, authUser.id));
|
||||
if (!user) {
|
||||
return reply.status(404).send({ error: "User not found" });
|
||||
}
|
||||
const [user] = await db.select().from(users).where(eq(users.id, authUser.id));
|
||||
if (!user) {
|
||||
return reply.status(404).send({ error: "User not found" });
|
||||
}
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
avatarUrl: user.avatarUrl,
|
||||
authProvider: user.authProvider,
|
||||
createdAt: user.createdAt,
|
||||
lastLoginAt: user.lastLoginAt,
|
||||
};
|
||||
});
|
||||
const createdAt =
|
||||
normalizeDateTime(user.createdAt) ?? normalizeDateTime(user.updatedAt) ?? new Date(0).toISOString();
|
||||
const lastLoginAt = normalizeDateTime(user.lastLoginAt);
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
username: user.username,
|
||||
avatarUrl: user.avatarUrl,
|
||||
authProvider: user.authProvider ?? "local",
|
||||
createdAt,
|
||||
lastLoginAt,
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// PUT /auth/me - Update current user profile
|
||||
@@ -404,6 +567,30 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
{
|
||||
preHandler: requireAuth,
|
||||
config: { rateLimit: authRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Update current user profile",
|
||||
security: authEndpointSecurity,
|
||||
body: {
|
||||
type: "object",
|
||||
properties: {
|
||||
currentPassword: { type: "string" },
|
||||
newPassword: { type: "string", minLength: 8, maxLength: 128 },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
ok: { type: "boolean" },
|
||||
message: { type: "string" },
|
||||
},
|
||||
},
|
||||
400: authErrorSchema,
|
||||
401: authErrorSchema,
|
||||
404: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
@@ -462,6 +649,24 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
{
|
||||
preHandler: requireAuth,
|
||||
config: { rateLimit: authRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Upload user avatar",
|
||||
description: "Uploads and optimizes a profile image using multipart/form-data.",
|
||||
security: authEndpointSecurity,
|
||||
consumes: ["multipart/form-data"],
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
ok: { type: "boolean" },
|
||||
avatarUrl: { type: "string" },
|
||||
},
|
||||
},
|
||||
400: authErrorSchema,
|
||||
401: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
@@ -517,6 +722,16 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
{
|
||||
preHandler: requireAuth,
|
||||
config: { rateLimit: authRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Delete user avatar",
|
||||
security: authEndpointSecurity,
|
||||
response: {
|
||||
200: { type: "object", properties: { ok: { type: "boolean" } } },
|
||||
401: authErrorSchema,
|
||||
404: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
@@ -547,6 +762,22 @@ export async function authRoutes(app: FastifyInstance) {
|
||||
{
|
||||
preHandler: requireAuth,
|
||||
config: { rateLimit: sensitiveRateLimitConfig },
|
||||
schema: {
|
||||
tags: ["auth"],
|
||||
summary: "Delete current user account",
|
||||
description: "Deletes the current account and related data (cascade delete).",
|
||||
security: authEndpointSecurity,
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
ok: { type: "boolean" },
|
||||
message: { type: "string" },
|
||||
},
|
||||
},
|
||||
401: authErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const authUser = request.user as unknown as AuthUser | null;
|
||||
|
||||
+37
-21
@@ -267,6 +267,7 @@ export async function doseRoutes(app: FastifyInstance) {
|
||||
userId,
|
||||
doseId,
|
||||
markedBy: null,
|
||||
takenAt: new Date(0),
|
||||
dismissed: true,
|
||||
});
|
||||
dismissedCount++;
|
||||
@@ -291,7 +292,9 @@ export async function doseRoutes(app: FastifyInstance) {
|
||||
.where(and(eq(doseTracking.userId, userId), eq(doseTracking.dismissed, true)));
|
||||
|
||||
for (const d of dismissed) {
|
||||
if (d.markedBy !== null || d.takenAt) {
|
||||
const hasRealTakenTimestamp = d.takenAt instanceof Date ? d.takenAt.getTime() > 0 : Boolean(d.takenAt);
|
||||
|
||||
if (d.markedBy !== null || hasRealTakenTimestamp) {
|
||||
// This was also marked as taken - just remove dismissed flag
|
||||
await db.update(doseTracking).set({ dismissed: false }).where(eq(doseTracking.id, d.id));
|
||||
} else {
|
||||
@@ -307,28 +310,41 @@ export async function doseRoutes(app: FastifyInstance) {
|
||||
// GET /share/:token/doses - PUBLIC: Get taken doses for a share link
|
||||
// Suppress request logs — polled every 5s by SharedSchedule
|
||||
// ---------------------------------------------------------------------------
|
||||
app.get<{ Params: { token: string } }>("/share/:token/doses", { logLevel: "warn" }, async (request, reply) => {
|
||||
const { token } = request.params;
|
||||
app.get<{ Params: { token: string } }>(
|
||||
"/share/:token/doses",
|
||||
{
|
||||
logLevel: "warn",
|
||||
config: {
|
||||
rateLimit: {
|
||||
max: 60,
|
||||
timeWindow: "1 minute",
|
||||
errorResponseBuilder: () => ({ error: "rate_limited" }),
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const { token } = request.params;
|
||||
|
||||
const { share, reason } = await getActiveShareToken(token);
|
||||
if (!share) {
|
||||
request.log.warn(`[ShareDose] Rejected read for token ${maskToken(token)} (reason=${reason})`);
|
||||
return reply.notFound("Share link not found");
|
||||
const { share, reason } = await getActiveShareToken(token);
|
||||
if (!share) {
|
||||
request.log.warn(`[ShareDose] Rejected read for token ${maskToken(token)} (reason=${reason})`);
|
||||
return reply.notFound("Share link not found");
|
||||
}
|
||||
|
||||
// Get all taken doses for this user (no time limit)
|
||||
const doses = await db.select().from(doseTracking).where(eq(doseTracking.userId, share.userId));
|
||||
|
||||
return {
|
||||
doses: doses.map((d) => ({
|
||||
doseId: d.doseId,
|
||||
takenAt: d.takenAt?.getTime() ?? Date.now(),
|
||||
markedBy: d.markedBy,
|
||||
takenSource: d.takenSource ?? "manual",
|
||||
dismissed: d.dismissed ?? false,
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
// Get all taken doses for this user (no time limit)
|
||||
const doses = await db.select().from(doseTracking).where(eq(doseTracking.userId, share.userId));
|
||||
|
||||
return {
|
||||
doses: doses.map((d) => ({
|
||||
doseId: d.doseId,
|
||||
takenAt: d.takenAt?.getTime() ?? Date.now(),
|
||||
markedBy: d.markedBy,
|
||||
takenSource: d.takenSource ?? "manual",
|
||||
dismissed: d.dismissed ?? false,
|
||||
})),
|
||||
};
|
||||
});
|
||||
);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// POST /share/:token/doses - PUBLIC: Mark a dose as taken via share link
|
||||
|
||||
@@ -6,6 +6,7 @@ import { medications, refillHistory } from "../db/schema.js";
|
||||
import { getAnonymousUserId, requireAuth } from "../plugins/auth.js";
|
||||
import { env } from "../plugins/env.js";
|
||||
import type { AuthUser } from "../types/fastify.js";
|
||||
import { isAmountBasedPackageType, normalizePackageType } from "../utils/package-profiles.js";
|
||||
|
||||
const refillSchema = z
|
||||
.object({
|
||||
@@ -52,9 +53,34 @@ export async function refillRoutes(app: FastifyInstance) {
|
||||
if (!med) return reply.notFound("Medication not found");
|
||||
|
||||
const { packsAdded, loosePillsAdded, usePrescription } = parsed.data;
|
||||
const isBottle = (med.packageType ?? "blister") === "bottle";
|
||||
const effectivePacksAdded = isBottle ? 0 : packsAdded;
|
||||
const effectiveLoosePillsAdded = loosePillsAdded;
|
||||
const packageType = normalizePackageType(med.packageType);
|
||||
const isBottle = packageType === "bottle";
|
||||
const isAmountBased = isAmountBasedPackageType(packageType);
|
||||
const isCountBasedAmountPackage = isAmountBased && !isBottle;
|
||||
|
||||
const configuredAmountPerPackage = Number(med.packageAmountValue ?? 0);
|
||||
const fallbackAmountPerPackage = Math.max(
|
||||
1,
|
||||
Math.round((med.totalPills ?? med.looseTablets ?? 0) / Math.max(1, med.packCount || 1))
|
||||
);
|
||||
const amountPerPackage =
|
||||
Number.isFinite(configuredAmountPerPackage) && configuredAmountPerPackage > 0
|
||||
? configuredAmountPerPackage
|
||||
: fallbackAmountPerPackage;
|
||||
|
||||
const requestedPackAdds = Math.max(0, packsAdded);
|
||||
const requestedAmountAdds = Math.max(0, loosePillsAdded);
|
||||
const derivedCountFromAmount = Math.max(0, Math.round(requestedAmountAdds / amountPerPackage));
|
||||
|
||||
let effectivePacksAdded = requestedPackAdds;
|
||||
if (isBottle) {
|
||||
effectivePacksAdded = 0;
|
||||
} else if (isCountBasedAmountPackage) {
|
||||
effectivePacksAdded = Math.max(requestedPackAdds, derivedCountFromAmount);
|
||||
}
|
||||
const effectiveLoosePillsAdded = isCountBasedAmountPackage
|
||||
? effectivePacksAdded * amountPerPackage
|
||||
: requestedAmountAdds;
|
||||
const remainingPrescriptionRefills = med.prescriptionRemainingRefills ?? 0;
|
||||
|
||||
if (effectivePacksAdded < 1 && effectiveLoosePillsAdded < 1) {
|
||||
@@ -76,6 +102,8 @@ export async function refillRoutes(app: FastifyInstance) {
|
||||
// Update medication stock
|
||||
const newPackCount = med.packCount + effectivePacksAdded;
|
||||
const newLooseTablets = med.looseTablets + effectiveLoosePillsAdded;
|
||||
const previousAmountBase = med.totalPills ?? med.looseTablets;
|
||||
const newTotalAmount = previousAmountBase + effectiveLoosePillsAdded;
|
||||
|
||||
let consumedRefills = 0;
|
||||
if (usePrescription) {
|
||||
@@ -85,14 +113,28 @@ export async function refillRoutes(app: FastifyInstance) {
|
||||
? Math.max(0, remainingPrescriptionRefills - consumedRefills)
|
||||
: (med.prescriptionRemainingRefills ?? null);
|
||||
|
||||
const updatePayload: {
|
||||
packCount: number;
|
||||
looseTablets: number;
|
||||
totalPills?: number;
|
||||
packageAmountValue?: number;
|
||||
prescriptionRemainingRefills: number | null;
|
||||
updatedAt: Date;
|
||||
} = {
|
||||
packCount: newPackCount,
|
||||
looseTablets: newLooseTablets,
|
||||
prescriptionRemainingRefills: newRemainingRefills,
|
||||
updatedAt: new Date(),
|
||||
};
|
||||
|
||||
if (isCountBasedAmountPackage) {
|
||||
updatePayload.totalPills = newTotalAmount;
|
||||
updatePayload.packageAmountValue = amountPerPackage;
|
||||
}
|
||||
|
||||
await db
|
||||
.update(medications)
|
||||
.set({
|
||||
packCount: newPackCount,
|
||||
looseTablets: newLooseTablets,
|
||||
prescriptionRemainingRefills: newRemainingRefills,
|
||||
updatedAt: new Date(),
|
||||
})
|
||||
.set(updatePayload)
|
||||
.where(and(eq(medications.id, medId), eq(medications.userId, userId)));
|
||||
|
||||
// Create refill history entry
|
||||
@@ -109,12 +151,15 @@ export async function refillRoutes(app: FastifyInstance) {
|
||||
|
||||
// Calculate pills added for response (packageType-aware)
|
||||
const pillsPerPack = isBottle ? 0 : med.blistersPerPack * med.pillsPerBlister;
|
||||
const totalPillsAdded = isBottle
|
||||
const totalPillsAdded = isAmountBased
|
||||
? effectiveLoosePillsAdded
|
||||
: effectivePacksAdded * pillsPerPack + effectiveLoosePillsAdded;
|
||||
const newTotalPills = isBottle
|
||||
? newLooseTablets + (med.stockAdjustment ?? 0)
|
||||
: newPackCount * pillsPerPack + newLooseTablets + (med.stockAdjustment ?? 0);
|
||||
let newTotalPills = newPackCount * pillsPerPack + newLooseTablets + (med.stockAdjustment ?? 0);
|
||||
if (isCountBasedAmountPackage) {
|
||||
newTotalPills = (newTotalAmount ?? 0) + (med.stockAdjustment ?? 0);
|
||||
} else if (isBottle) {
|
||||
newTotalPills = newLooseTablets + (med.stockAdjustment ?? 0);
|
||||
}
|
||||
|
||||
return {
|
||||
success: true,
|
||||
@@ -158,17 +203,19 @@ export async function refillRoutes(app: FastifyInstance) {
|
||||
const refills = await db
|
||||
.select()
|
||||
.from(refillHistory)
|
||||
.where(eq(refillHistory.medicationId, medId))
|
||||
.where(and(eq(refillHistory.medicationId, medId), eq(refillHistory.userId, userId)))
|
||||
.orderBy(desc(refillHistory.refillDate));
|
||||
|
||||
const isBottle = (med.packageType ?? "blister") === "bottle";
|
||||
const packageType = normalizePackageType(med.packageType);
|
||||
const isBottle = packageType === "bottle";
|
||||
const isAmountBased = isAmountBasedPackageType(packageType);
|
||||
const pillsPerPack = isBottle ? 0 : med.blistersPerPack * med.pillsPerBlister;
|
||||
|
||||
return refills.map((r) => ({
|
||||
id: r.id,
|
||||
packsAdded: r.packsAdded,
|
||||
loosePillsAdded: r.loosePillsAdded,
|
||||
totalPillsAdded: isBottle ? r.loosePillsAdded : r.packsAdded * pillsPerPack + r.loosePillsAdded,
|
||||
totalPillsAdded: isAmountBased ? r.loosePillsAdded : r.packsAdded * pillsPerPack + r.loosePillsAdded,
|
||||
usedPrescription: r.usedPrescription ?? false,
|
||||
refillDate: r.refillDate,
|
||||
}));
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import { eq } from "drizzle-orm";
|
||||
import { and, eq } from "drizzle-orm";
|
||||
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
|
||||
import { z } from "zod";
|
||||
import { db } from "../db/client.js";
|
||||
@@ -90,8 +90,11 @@ export async function reportRoutes(app: FastifyInstance) {
|
||||
|
||||
const sortedTaken = takenDoses.map((d) => d.takenAt.getTime()).sort((a, b) => a - b);
|
||||
|
||||
// Get refills for this medication
|
||||
const refills = await db.select().from(refillHistory).where(eq(refillHistory.medicationId, medId));
|
||||
// Get refills for this medication scoped to the authenticated user.
|
||||
const refills = await db
|
||||
.select()
|
||||
.from(refillHistory)
|
||||
.where(and(eq(refillHistory.medicationId, medId), eq(refillHistory.userId, userId)));
|
||||
|
||||
result[medId] = {
|
||||
dosesTaken: takenDoses.length,
|
||||
|
||||
+403
-216
@@ -85,6 +85,18 @@ type TestShoutrrrBody = {
|
||||
url: string;
|
||||
};
|
||||
|
||||
const settingsEndpointSecurity: ReadonlyArray<Record<string, readonly string[]>> = [
|
||||
{ bearerAuth: [] },
|
||||
{ cookieAuth: [] },
|
||||
];
|
||||
const settingsErrorSchema = {
|
||||
type: "object",
|
||||
properties: {
|
||||
error: { type: "string" },
|
||||
code: { type: "string" },
|
||||
},
|
||||
};
|
||||
|
||||
function maskEmail(email: string): string {
|
||||
const [localPart, domain] = email.split("@");
|
||||
if (!domain) return "invalid-email";
|
||||
@@ -122,6 +134,38 @@ function getDeliveryError(info: MailDeliveryInfo): string | null {
|
||||
return "SMTP did not confirm accepted recipients.";
|
||||
}
|
||||
|
||||
function classifyTestEmailFailure(error: unknown): { status: number; code: string; message: string } {
|
||||
const errorMessage = error instanceof Error ? error.message : "Unknown error";
|
||||
const normalizedMessage = errorMessage.toLowerCase();
|
||||
|
||||
if (
|
||||
normalizedMessage.includes("smtp rejected all recipients") ||
|
||||
normalizedMessage.includes("all recipients were rejected") ||
|
||||
normalizedMessage.includes("recipient address rejected") ||
|
||||
normalizedMessage.includes("nullmx")
|
||||
) {
|
||||
return {
|
||||
status: 400,
|
||||
code: "EMAIL_RECIPIENT_REJECTED",
|
||||
message: `Failed to send email: ${errorMessage}`,
|
||||
};
|
||||
}
|
||||
|
||||
if (errorMessage.includes("SMTP did not confirm accepted recipients")) {
|
||||
return {
|
||||
status: 502,
|
||||
code: "SMTP_DELIVERY_UNCONFIRMED",
|
||||
message: `Failed to send email: ${errorMessage}`,
|
||||
};
|
||||
}
|
||||
|
||||
return {
|
||||
status: 500,
|
||||
code: "TEST_EMAIL_FAILED",
|
||||
message: `Failed to send email: ${errorMessage}`,
|
||||
};
|
||||
}
|
||||
|
||||
function getNotificationProvider(url: string): string {
|
||||
if (url.startsWith("discord://")) return "discord";
|
||||
if (url.startsWith("telegram://")) return "telegram";
|
||||
@@ -322,201 +366,313 @@ export async function settingsRoutes(app: FastifyInstance) {
|
||||
|
||||
// Get settings for current user
|
||||
// Suppress request logs — polled every 30s for reminder status refresh
|
||||
app.get("/settings", { logLevel: "warn" }, async (request, reply) => {
|
||||
const userId = await getUserId(request, reply);
|
||||
app.get(
|
||||
"/settings",
|
||||
{
|
||||
logLevel: "warn",
|
||||
schema: {
|
||||
tags: ["settings"],
|
||||
summary: "Get current user settings",
|
||||
security: settingsEndpointSecurity,
|
||||
response: {
|
||||
200: { type: "object", additionalProperties: true },
|
||||
401: settingsErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const userId = await getUserId(request, reply);
|
||||
|
||||
const settings = await getOrCreateUserSettings(userId);
|
||||
const reminderHour = envInt("REMINDER_HOUR", 6);
|
||||
const reminderMinutesBefore = envInt("REMINDER_MINUTES_BEFORE", 15);
|
||||
const settings = await getOrCreateUserSettings(userId);
|
||||
const reminderHour = envInt("REMINDER_HOUR", 6);
|
||||
const reminderMinutesBefore = envInt("REMINDER_MINUTES_BEFORE", 15);
|
||||
|
||||
return reply.send({
|
||||
// User notification settings (from DB)
|
||||
emailEnabled: settings.emailEnabled,
|
||||
notificationEmail: settings.notificationEmail ?? "",
|
||||
reminderDaysBefore: settings.reminderDaysBefore,
|
||||
repeatDailyReminders: settings.repeatDailyReminders,
|
||||
lowStockDays: settings.lowStockDays,
|
||||
normalStockDays: settings.normalStockDays,
|
||||
highStockDays: settings.highStockDays,
|
||||
shoutrrrEnabled: settings.shoutrrrEnabled,
|
||||
shoutrrrUrl: settings.shoutrrrUrl ?? "",
|
||||
emailStockReminders: settings.emailStockReminders,
|
||||
emailIntakeReminders: settings.emailIntakeReminders,
|
||||
emailPrescriptionReminders: settings.emailPrescriptionReminders ?? true,
|
||||
shoutrrrStockReminders: settings.shoutrrrStockReminders,
|
||||
shoutrrrIntakeReminders: settings.shoutrrrIntakeReminders,
|
||||
shoutrrrPrescriptionReminders: settings.shoutrrrPrescriptionReminders ?? true,
|
||||
skipRemindersForTakenDoses: settings.skipRemindersForTakenDoses,
|
||||
repeatRemindersEnabled: settings.repeatRemindersEnabled ?? false,
|
||||
reminderRepeatIntervalMinutes: settings.reminderRepeatIntervalMinutes ?? 30,
|
||||
maxNaggingReminders: settings.maxNaggingReminders ?? 5,
|
||||
language: settings.language,
|
||||
stockCalculationMode: settings.stockCalculationMode ?? "automatic",
|
||||
shareStockStatus: settings.shareStockStatus ?? true,
|
||||
upcomingTodayOnly: settings.upcomingTodayOnly ?? false,
|
||||
shareScheduleTodayOnly: settings.shareScheduleTodayOnly ?? false,
|
||||
swapDashboardMainSections: settings.swapDashboardMainSections ?? false,
|
||||
// SMTP settings (from .env - shared/server-configured)
|
||||
smtpHost: process.env.SMTP_HOST ?? "",
|
||||
smtpPort: parseInt(process.env.SMTP_PORT ?? "587", 10),
|
||||
smtpUser: process.env.SMTP_USER ?? "",
|
||||
smtpFrom: process.env.SMTP_FROM ?? "",
|
||||
smtpSecure: process.env.SMTP_SECURE === "true",
|
||||
hasSmtpPassword: !!(process.env.SMTP_TOKEN || process.env.SMTP_PASS),
|
||||
// Reminder state for this user
|
||||
lastAutoEmailSent: settings.lastAutoEmailSent,
|
||||
lastNotificationType: settings.lastNotificationType,
|
||||
lastNotificationChannel: settings.lastNotificationChannel,
|
||||
lastReminderMedName: settings.lastReminderMedName ?? null,
|
||||
lastReminderTakenBy: settings.lastReminderTakenBy ?? null,
|
||||
// Stock reminder tracking (separate from intake)
|
||||
lastStockReminderSent: settings.lastStockReminderSent ?? null,
|
||||
lastStockReminderChannel: settings.lastStockReminderChannel ?? null,
|
||||
lastStockReminderMedNames: settings.lastStockReminderMedNames ?? null,
|
||||
// Prescription reminder tracking (separate from stock/intake)
|
||||
lastPrescriptionReminderSent: settings.lastPrescriptionReminderSent ?? null,
|
||||
lastPrescriptionReminderChannel: settings.lastPrescriptionReminderChannel ?? null,
|
||||
lastPrescriptionReminderMedNames: settings.lastPrescriptionReminderMedNames ?? null,
|
||||
// Server settings (from .env, read-only)
|
||||
reminderHour,
|
||||
reminderMinutesBefore,
|
||||
expiryWarningDays: parseInt(process.env.EXPIRY_WARNING_DAYS ?? "30", 10),
|
||||
});
|
||||
});
|
||||
return reply.send({
|
||||
// User notification settings (from DB)
|
||||
emailEnabled: settings.emailEnabled,
|
||||
notificationEmail: settings.notificationEmail ?? "",
|
||||
reminderDaysBefore: settings.reminderDaysBefore,
|
||||
repeatDailyReminders: settings.repeatDailyReminders,
|
||||
lowStockDays: settings.lowStockDays,
|
||||
normalStockDays: settings.normalStockDays,
|
||||
highStockDays: settings.highStockDays,
|
||||
shoutrrrEnabled: settings.shoutrrrEnabled,
|
||||
shoutrrrUrl: settings.shoutrrrUrl ?? "",
|
||||
emailStockReminders: settings.emailStockReminders,
|
||||
emailIntakeReminders: settings.emailIntakeReminders,
|
||||
emailPrescriptionReminders: settings.emailPrescriptionReminders ?? true,
|
||||
shoutrrrStockReminders: settings.shoutrrrStockReminders,
|
||||
shoutrrrIntakeReminders: settings.shoutrrrIntakeReminders,
|
||||
shoutrrrPrescriptionReminders: settings.shoutrrrPrescriptionReminders ?? true,
|
||||
skipRemindersForTakenDoses: settings.skipRemindersForTakenDoses,
|
||||
repeatRemindersEnabled: settings.repeatRemindersEnabled ?? false,
|
||||
reminderRepeatIntervalMinutes: settings.reminderRepeatIntervalMinutes ?? 30,
|
||||
maxNaggingReminders: settings.maxNaggingReminders ?? 5,
|
||||
language: settings.language,
|
||||
stockCalculationMode: settings.stockCalculationMode ?? "automatic",
|
||||
shareStockStatus: settings.shareStockStatus ?? true,
|
||||
upcomingTodayOnly: settings.upcomingTodayOnly ?? false,
|
||||
shareScheduleTodayOnly: settings.shareScheduleTodayOnly ?? false,
|
||||
swapDashboardMainSections: settings.swapDashboardMainSections ?? false,
|
||||
// SMTP settings (from .env - shared/server-configured)
|
||||
smtpHost: process.env.SMTP_HOST ?? "",
|
||||
smtpPort: parseInt(process.env.SMTP_PORT ?? "587", 10),
|
||||
smtpUser: process.env.SMTP_USER ?? "",
|
||||
smtpFrom: process.env.SMTP_FROM ?? "",
|
||||
smtpSecure: process.env.SMTP_SECURE === "true",
|
||||
hasSmtpPassword: !!(process.env.SMTP_TOKEN || process.env.SMTP_PASS),
|
||||
// Reminder state for this user
|
||||
lastAutoEmailSent: settings.lastAutoEmailSent,
|
||||
lastNotificationType: settings.lastNotificationType,
|
||||
lastNotificationChannel: settings.lastNotificationChannel,
|
||||
lastReminderMedName: settings.lastReminderMedName ?? null,
|
||||
lastReminderTakenBy: settings.lastReminderTakenBy ?? null,
|
||||
// Stock reminder tracking (separate from intake)
|
||||
lastStockReminderSent: settings.lastStockReminderSent ?? null,
|
||||
lastStockReminderChannel: settings.lastStockReminderChannel ?? null,
|
||||
lastStockReminderMedNames: settings.lastStockReminderMedNames ?? null,
|
||||
// Prescription reminder tracking (separate from stock/intake)
|
||||
lastPrescriptionReminderSent: settings.lastPrescriptionReminderSent ?? null,
|
||||
lastPrescriptionReminderChannel: settings.lastPrescriptionReminderChannel ?? null,
|
||||
lastPrescriptionReminderMedNames: settings.lastPrescriptionReminderMedNames ?? null,
|
||||
// Server settings (from .env, read-only)
|
||||
reminderHour,
|
||||
reminderMinutesBefore,
|
||||
expiryWarningDays: parseInt(process.env.EXPIRY_WARNING_DAYS ?? "30", 10),
|
||||
});
|
||||
}
|
||||
);
|
||||
|
||||
// Update settings for current user
|
||||
app.put<{ Body: SettingsBody }>("/settings", async (request, reply) => {
|
||||
const userId = await getUserId(request, reply);
|
||||
app.put<{ Body: SettingsBody }>(
|
||||
"/settings",
|
||||
{
|
||||
schema: {
|
||||
tags: ["settings"],
|
||||
summary: "Update current user settings",
|
||||
security: settingsEndpointSecurity,
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["emailEnabled", "notificationEmail", "reminderDaysBefore", "language"],
|
||||
properties: {
|
||||
emailEnabled: { type: "boolean" },
|
||||
notificationEmail: { type: "string" },
|
||||
reminderDaysBefore: { type: "number" },
|
||||
repeatDailyReminders: { type: "boolean" },
|
||||
lowStockDays: { type: "number" },
|
||||
normalStockDays: { type: "number" },
|
||||
highStockDays: { type: "number" },
|
||||
shoutrrrEnabled: { type: "boolean" },
|
||||
shoutrrrUrl: { type: "string" },
|
||||
emailStockReminders: { type: "boolean" },
|
||||
emailIntakeReminders: { type: "boolean" },
|
||||
emailPrescriptionReminders: { type: "boolean" },
|
||||
shoutrrrStockReminders: { type: "boolean" },
|
||||
shoutrrrIntakeReminders: { type: "boolean" },
|
||||
shoutrrrPrescriptionReminders: { type: "boolean" },
|
||||
skipRemindersForTakenDoses: { type: "boolean" },
|
||||
repeatRemindersEnabled: { type: "boolean" },
|
||||
reminderRepeatIntervalMinutes: { type: "number" },
|
||||
maxNaggingReminders: { type: "number" },
|
||||
language: { type: "string", enum: ["en", "de"] },
|
||||
stockCalculationMode: { type: "string", enum: ["automatic", "manual"] },
|
||||
shareStockStatus: { type: "boolean" },
|
||||
upcomingTodayOnly: { type: "boolean" },
|
||||
shareScheduleTodayOnly: { type: "boolean" },
|
||||
swapDashboardMainSections: { type: "boolean" },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
200: { type: "object", properties: { success: { type: "boolean" } } },
|
||||
401: settingsErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const userId = await getUserId(request, reply);
|
||||
|
||||
const body = request.body;
|
||||
const body = request.body;
|
||||
|
||||
// Check if any stock reminders are configured
|
||||
const hasEmailStock = body.emailEnabled && body.emailStockReminders && body.notificationEmail;
|
||||
const hasShoutrrrStock = body.shoutrrrEnabled && body.shoutrrrStockReminders && body.shoutrrrUrl;
|
||||
const hasAnyStockReminder = hasEmailStock || hasShoutrrrStock;
|
||||
// Check if any stock reminders are configured
|
||||
const hasEmailStock = body.emailEnabled && body.emailStockReminders && body.notificationEmail;
|
||||
const hasShoutrrrStock = body.shoutrrrEnabled && body.shoutrrrStockReminders && body.shoutrrrUrl;
|
||||
const hasAnyStockReminder = hasEmailStock || hasShoutrrrStock;
|
||||
|
||||
// Disable repeatDailyReminders if no stock reminders are configured
|
||||
const repeatDailyReminders = hasAnyStockReminder ? (body.repeatDailyReminders ?? false) : false;
|
||||
// Disable repeatDailyReminders if no stock reminders are configured
|
||||
const repeatDailyReminders = hasAnyStockReminder ? (body.repeatDailyReminders ?? false) : false;
|
||||
|
||||
// Update or insert user settings
|
||||
const existingSettings = await db.select().from(userSettings).where(eq(userSettings.userId, userId));
|
||||
// Update or insert user settings
|
||||
const existingSettings = await db.select().from(userSettings).where(eq(userSettings.userId, userId));
|
||||
|
||||
const settingsData = {
|
||||
emailEnabled: body.emailEnabled,
|
||||
notificationEmail: body.notificationEmail || null,
|
||||
emailStockReminders: body.emailStockReminders ?? true,
|
||||
emailIntakeReminders: body.emailIntakeReminders ?? true,
|
||||
emailPrescriptionReminders: body.emailPrescriptionReminders ?? true,
|
||||
shoutrrrEnabled: body.shoutrrrEnabled ?? false,
|
||||
shoutrrrUrl: body.shoutrrrUrl || null,
|
||||
shoutrrrStockReminders: body.shoutrrrStockReminders ?? true,
|
||||
shoutrrrIntakeReminders: body.shoutrrrIntakeReminders ?? true,
|
||||
shoutrrrPrescriptionReminders: body.shoutrrrPrescriptionReminders ?? true,
|
||||
reminderDaysBefore: body.reminderDaysBefore,
|
||||
repeatDailyReminders,
|
||||
skipRemindersForTakenDoses: body.skipRemindersForTakenDoses ?? false,
|
||||
repeatRemindersEnabled: body.repeatRemindersEnabled ?? false,
|
||||
reminderRepeatIntervalMinutes: body.reminderRepeatIntervalMinutes ?? 30,
|
||||
maxNaggingReminders: body.maxNaggingReminders ?? 5,
|
||||
lowStockDays: body.lowStockDays ?? 30,
|
||||
normalStockDays: body.normalStockDays ?? 90,
|
||||
highStockDays: body.highStockDays ?? 180,
|
||||
language: body.language ?? "en",
|
||||
stockCalculationMode: body.stockCalculationMode ?? "automatic",
|
||||
shareStockStatus: body.shareStockStatus ?? true,
|
||||
upcomingTodayOnly: body.upcomingTodayOnly ?? false,
|
||||
shareScheduleTodayOnly: body.shareScheduleTodayOnly ?? false,
|
||||
swapDashboardMainSections: body.swapDashboardMainSections ?? false,
|
||||
updatedAt: new Date(),
|
||||
};
|
||||
const settingsData = {
|
||||
emailEnabled: body.emailEnabled,
|
||||
notificationEmail: body.notificationEmail || null,
|
||||
emailStockReminders: body.emailStockReminders ?? true,
|
||||
emailIntakeReminders: body.emailIntakeReminders ?? true,
|
||||
emailPrescriptionReminders: body.emailPrescriptionReminders ?? true,
|
||||
shoutrrrEnabled: body.shoutrrrEnabled ?? false,
|
||||
shoutrrrUrl: body.shoutrrrUrl || null,
|
||||
shoutrrrStockReminders: body.shoutrrrStockReminders ?? true,
|
||||
shoutrrrIntakeReminders: body.shoutrrrIntakeReminders ?? true,
|
||||
shoutrrrPrescriptionReminders: body.shoutrrrPrescriptionReminders ?? true,
|
||||
reminderDaysBefore: body.reminderDaysBefore,
|
||||
repeatDailyReminders,
|
||||
skipRemindersForTakenDoses: body.skipRemindersForTakenDoses ?? false,
|
||||
repeatRemindersEnabled: body.repeatRemindersEnabled ?? false,
|
||||
reminderRepeatIntervalMinutes: body.reminderRepeatIntervalMinutes ?? 30,
|
||||
maxNaggingReminders: body.maxNaggingReminders ?? 5,
|
||||
lowStockDays: body.lowStockDays ?? 30,
|
||||
normalStockDays: body.normalStockDays ?? 90,
|
||||
highStockDays: body.highStockDays ?? 180,
|
||||
language: body.language ?? "en",
|
||||
stockCalculationMode: body.stockCalculationMode ?? "automatic",
|
||||
shareStockStatus: body.shareStockStatus ?? true,
|
||||
upcomingTodayOnly: body.upcomingTodayOnly ?? false,
|
||||
shareScheduleTodayOnly: body.shareScheduleTodayOnly ?? false,
|
||||
swapDashboardMainSections: body.swapDashboardMainSections ?? false,
|
||||
updatedAt: new Date(),
|
||||
};
|
||||
|
||||
if (existingSettings.length > 0) {
|
||||
await db.update(userSettings).set(settingsData).where(eq(userSettings.userId, userId));
|
||||
} else {
|
||||
await db.insert(userSettings).values({
|
||||
userId: userId,
|
||||
...settingsData,
|
||||
});
|
||||
if (existingSettings.length > 0) {
|
||||
await db.update(userSettings).set(settingsData).where(eq(userSettings.userId, userId));
|
||||
} else {
|
||||
await db.insert(userSettings).values({
|
||||
userId: userId,
|
||||
...settingsData,
|
||||
});
|
||||
}
|
||||
|
||||
return reply.send({ success: true });
|
||||
}
|
||||
|
||||
return reply.send({ success: true });
|
||||
});
|
||||
);
|
||||
|
||||
// Update only the language setting (lightweight, called on dropdown change)
|
||||
app.put<{ Body: { language: string } }>("/settings/language", async (request, reply) => {
|
||||
const userId = await getUserId(request, reply);
|
||||
const { language } = request.body;
|
||||
app.put<{ Body: { language: string } }>(
|
||||
"/settings/language",
|
||||
{
|
||||
schema: {
|
||||
tags: ["settings"],
|
||||
summary: "Update UI language",
|
||||
security: settingsEndpointSecurity,
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["language"],
|
||||
properties: {
|
||||
language: { type: "string", enum: ["en", "de"] },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
200: { type: "object", properties: { success: { type: "boolean" } } },
|
||||
400: settingsErrorSchema,
|
||||
401: settingsErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const userId = await getUserId(request, reply);
|
||||
const { language } = request.body;
|
||||
|
||||
if (!language || !["en", "de"].includes(language)) {
|
||||
return reply.status(400).send({ error: "Invalid language" });
|
||||
if (!language || !["en", "de"].includes(language)) {
|
||||
return reply.status(400).send({ error: "Invalid language" });
|
||||
}
|
||||
|
||||
const existingSettings = await db.select().from(userSettings).where(eq(userSettings.userId, userId));
|
||||
|
||||
if (existingSettings.length > 0) {
|
||||
await db.update(userSettings).set({ language, updatedAt: new Date() }).where(eq(userSettings.userId, userId));
|
||||
} else {
|
||||
await db.insert(userSettings).values({
|
||||
userId,
|
||||
...getDefaultSettings(),
|
||||
language,
|
||||
});
|
||||
}
|
||||
|
||||
return reply.send({ success: true });
|
||||
}
|
||||
|
||||
const existingSettings = await db.select().from(userSettings).where(eq(userSettings.userId, userId));
|
||||
|
||||
if (existingSettings.length > 0) {
|
||||
await db.update(userSettings).set({ language, updatedAt: new Date() }).where(eq(userSettings.userId, userId));
|
||||
} else {
|
||||
await db.insert(userSettings).values({
|
||||
userId,
|
||||
...getDefaultSettings(),
|
||||
language,
|
||||
});
|
||||
}
|
||||
|
||||
return reply.send({ success: true });
|
||||
});
|
||||
);
|
||||
|
||||
// Test email - use SMTP settings from process.env
|
||||
app.post<{ Body: TestEmailBody }>("/settings/test-email", async (request, reply) => {
|
||||
const { email } = request.body;
|
||||
|
||||
const smtpHost = process.env.SMTP_HOST;
|
||||
const smtpUser = process.env.SMTP_USER;
|
||||
const smtpPass = process.env.SMTP_TOKEN || process.env.SMTP_PASS;
|
||||
const smtpPort = parseInt(process.env.SMTP_PORT ?? "587", 10);
|
||||
const smtpSecure = process.env.SMTP_SECURE === "true";
|
||||
const smtpFrom = process.env.SMTP_FROM ?? smtpUser;
|
||||
|
||||
request.log.info(
|
||||
{
|
||||
to: maskEmail(email),
|
||||
hasSmtpHost: Boolean(smtpHost),
|
||||
hasSmtpUser: Boolean(smtpUser),
|
||||
hasSmtpPass: Boolean(smtpPass),
|
||||
hasSmtpFrom: Boolean(smtpFrom),
|
||||
smtpPort,
|
||||
smtpSecure,
|
||||
},
|
||||
"[Settings] Test email request received"
|
||||
);
|
||||
|
||||
if (!smtpHost || !smtpUser) {
|
||||
request.log.warn(
|
||||
{ to: maskEmail(email), hasSmtpHost: Boolean(smtpHost), hasSmtpUser: Boolean(smtpUser) },
|
||||
"[Settings] Test email skipped: SMTP not configured"
|
||||
);
|
||||
return reply.status(400).send({ error: "SMTP not configured" });
|
||||
}
|
||||
|
||||
try {
|
||||
const transporter = nodemailer.createTransport({
|
||||
host: smtpHost,
|
||||
port: smtpPort,
|
||||
secure: smtpSecure,
|
||||
auth: {
|
||||
user: smtpUser,
|
||||
pass: smtpPass ?? "",
|
||||
app.post<{ Body: TestEmailBody }>(
|
||||
"/settings/test-email",
|
||||
{
|
||||
schema: {
|
||||
tags: ["settings"],
|
||||
summary: "Send test email",
|
||||
description: "Sends a test message using configured SMTP settings.",
|
||||
security: settingsEndpointSecurity,
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["email"],
|
||||
properties: {
|
||||
email: { type: "string", format: "email" },
|
||||
},
|
||||
},
|
||||
});
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
success: { type: "boolean" },
|
||||
message: { type: "string" },
|
||||
},
|
||||
},
|
||||
400: settingsErrorSchema,
|
||||
401: settingsErrorSchema,
|
||||
500: settingsErrorSchema,
|
||||
502: settingsErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const { email } = request.body;
|
||||
|
||||
request.log.info({ to: maskEmail(email) }, "[Settings] Sending test email");
|
||||
const smtpHost = process.env.SMTP_HOST;
|
||||
const smtpUser = process.env.SMTP_USER;
|
||||
const smtpPass = process.env.SMTP_TOKEN || process.env.SMTP_PASS;
|
||||
const smtpPort = parseInt(process.env.SMTP_PORT ?? "587", 10);
|
||||
const smtpSecure = process.env.SMTP_SECURE === "true";
|
||||
const smtpFrom = process.env.SMTP_FROM ?? smtpUser;
|
||||
|
||||
const mailResult = await transporter.sendMail({
|
||||
from: smtpFrom,
|
||||
to: email,
|
||||
subject: "MedAssist-ng - Test Email",
|
||||
text: "This is a test email from MedAssist-ng. If you received this, your email configuration is working correctly!",
|
||||
html: `
|
||||
request.log.info(
|
||||
{
|
||||
to: maskEmail(email),
|
||||
hasSmtpHost: Boolean(smtpHost),
|
||||
hasSmtpUser: Boolean(smtpUser),
|
||||
hasSmtpPass: Boolean(smtpPass),
|
||||
hasSmtpFrom: Boolean(smtpFrom),
|
||||
smtpPort,
|
||||
smtpSecure,
|
||||
},
|
||||
"[Settings] Test email request received"
|
||||
);
|
||||
|
||||
if (!smtpHost || !smtpUser) {
|
||||
request.log.warn(
|
||||
{ to: maskEmail(email), hasSmtpHost: Boolean(smtpHost), hasSmtpUser: Boolean(smtpUser) },
|
||||
"[Settings] Test email skipped: SMTP not configured"
|
||||
);
|
||||
return reply.status(400).send({ error: "SMTP not configured" });
|
||||
}
|
||||
|
||||
try {
|
||||
const transporter = nodemailer.createTransport({
|
||||
host: smtpHost,
|
||||
port: smtpPort,
|
||||
secure: smtpSecure,
|
||||
auth: {
|
||||
user: smtpUser,
|
||||
pass: smtpPass ?? "",
|
||||
},
|
||||
});
|
||||
|
||||
request.log.info({ to: maskEmail(email) }, "[Settings] Sending test email");
|
||||
|
||||
const mailResult = await transporter.sendMail({
|
||||
from: smtpFrom,
|
||||
to: email,
|
||||
subject: "MedAssist-ng - Test Email",
|
||||
text: "This is a test email from MedAssist-ng. If you received this, your email configuration is working correctly!",
|
||||
html: `
|
||||
<div style="font-family: system-ui, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px;">
|
||||
<h2 style="color: #2563eb;">MedAssist-ng - Test Email</h2>
|
||||
<p>This is a test email from MedAssist-ng.</p>
|
||||
@@ -525,55 +681,86 @@ export async function settingsRoutes(app: FastifyInstance) {
|
||||
<p style="color: #6b7280; font-size: 14px;">Sent from MedAssist-ng Medication Planner</p>
|
||||
</div>
|
||||
`,
|
||||
});
|
||||
});
|
||||
|
||||
const deliveryError = getDeliveryError(mailResult);
|
||||
if (deliveryError) {
|
||||
throw new Error(deliveryError);
|
||||
const deliveryError = getDeliveryError(mailResult);
|
||||
if (deliveryError) {
|
||||
throw new Error(deliveryError);
|
||||
}
|
||||
|
||||
request.log.info({ to: maskEmail(email), messageId: mailResult.messageId }, "[Settings] Test email sent");
|
||||
|
||||
return reply.send({ success: true, message: "Test email sent successfully" });
|
||||
} catch (error) {
|
||||
request.log.error({ error, to: maskEmail(email) }, "[Settings] Test email failed");
|
||||
const failure = classifyTestEmailFailure(error);
|
||||
return reply.status(failure.status).send({ error: failure.message, code: failure.code });
|
||||
}
|
||||
|
||||
request.log.info({ to: maskEmail(email), messageId: mailResult.messageId }, "[Settings] Test email sent");
|
||||
|
||||
return reply.send({ success: true, message: "Test email sent successfully" });
|
||||
} catch (error) {
|
||||
request.log.error({ error, to: maskEmail(email) }, "[Settings] Test email failed");
|
||||
const errorMessage = error instanceof Error ? error.message : "Unknown error";
|
||||
return reply.status(500).send({ error: `Failed to send email: ${errorMessage}` });
|
||||
}
|
||||
});
|
||||
);
|
||||
|
||||
// Test Shoutrrr/ntfy notification
|
||||
app.post<{ Body: TestShoutrrrBody }>("/settings/test-shoutrrr", async (request, reply) => {
|
||||
const { url } = request.body;
|
||||
app.post<{ Body: TestShoutrrrBody }>(
|
||||
"/settings/test-shoutrrr",
|
||||
{
|
||||
schema: {
|
||||
tags: ["settings"],
|
||||
summary: "Send test push notification",
|
||||
description: "Sends a test notification via a Shoutrrr-compatible URL.",
|
||||
security: settingsEndpointSecurity,
|
||||
body: {
|
||||
type: "object",
|
||||
required: ["url"],
|
||||
properties: {
|
||||
url: { type: "string" },
|
||||
},
|
||||
},
|
||||
response: {
|
||||
200: {
|
||||
type: "object",
|
||||
properties: {
|
||||
success: { type: "boolean" },
|
||||
message: { type: "string" },
|
||||
},
|
||||
},
|
||||
400: settingsErrorSchema,
|
||||
401: settingsErrorSchema,
|
||||
500: settingsErrorSchema,
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const { url } = request.body;
|
||||
|
||||
if (!url) {
|
||||
return reply.status(400).send({ error: "Notification URL is required" });
|
||||
}
|
||||
|
||||
try {
|
||||
const provider = getNotificationProvider(url);
|
||||
const result = await sendShoutrrrNotification(
|
||||
url,
|
||||
"MedAssist-ng Test",
|
||||
"This is a test notification from MedAssist-ng. If you received this, your notification configuration is working correctly!"
|
||||
);
|
||||
|
||||
if (result.success) {
|
||||
request.log.info({ provider }, "[Settings] Test push notification sent");
|
||||
return reply.send({ success: true, message: "Test notification sent successfully" });
|
||||
} else {
|
||||
request.log.warn({ provider, error: result.error ?? "unknown" }, "[Settings] Test push notification failed");
|
||||
return reply.status(500).send({ error: result.error });
|
||||
if (!url) {
|
||||
return reply.status(400).send({ error: "Notification URL is required" });
|
||||
}
|
||||
|
||||
try {
|
||||
const provider = getNotificationProvider(url);
|
||||
const result = await sendShoutrrrNotification(
|
||||
url,
|
||||
"MedAssist-ng Test",
|
||||
"This is a test notification from MedAssist-ng. If you received this, your notification configuration is working correctly!"
|
||||
);
|
||||
|
||||
if (result.success) {
|
||||
request.log.info({ provider }, "[Settings] Test push notification sent");
|
||||
return reply.send({ success: true, message: "Test notification sent successfully" });
|
||||
} else {
|
||||
request.log.warn({ provider, error: result.error ?? "unknown" }, "[Settings] Test push notification failed");
|
||||
return reply.status(500).send({ error: result.error });
|
||||
}
|
||||
} catch (error) {
|
||||
request.log.error(
|
||||
{ provider: getNotificationProvider(url), error },
|
||||
"[Settings] Unexpected error while sending test push notification"
|
||||
);
|
||||
const errorMessage = error instanceof Error ? error.message : "Unknown error";
|
||||
return reply.status(500).send({ error: `Failed to send notification: ${errorMessage}` });
|
||||
}
|
||||
} catch (error) {
|
||||
request.log.error(
|
||||
{ provider: getNotificationProvider(url), error },
|
||||
"[Settings] Unexpected error while sending test push notification"
|
||||
);
|
||||
const errorMessage = error instanceof Error ? error.message : "Unknown error";
|
||||
return reply.status(500).send({ error: `Failed to send notification: ${errorMessage}` });
|
||||
}
|
||||
});
|
||||
);
|
||||
}
|
||||
|
||||
// Validate and sanitize URL to prevent SSRF attacks
|
||||
|
||||
+199
-113
@@ -3,9 +3,10 @@ import { and, eq } from "drizzle-orm";
|
||||
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
|
||||
import { z } from "zod";
|
||||
import { db } from "../db/client.js";
|
||||
import { medications, shareTokens, userSettings, users } from "../db/schema.js";
|
||||
import { doseTracking, medications, shareTokens, userSettings, users } from "../db/schema.js";
|
||||
import { getAnonymousUserId, requireAuth } from "../plugins/auth.js";
|
||||
import { env } from "../plugins/env.js";
|
||||
import { buildSharedMedicationOverview } from "../services/coverage.js";
|
||||
import type { AuthUser } from "../types/fastify.js";
|
||||
import { isAmountBasedPackageType, normalizePackageType } from "../utils/package-profiles.js";
|
||||
import {
|
||||
@@ -23,6 +24,8 @@ const createShareSchema = z.object({
|
||||
scheduleDays: z.number().int().min(1).max(365).default(30),
|
||||
});
|
||||
|
||||
const shareTokenPattern = /^[a-f0-9]{16}$/;
|
||||
|
||||
function maskToken(token: string): string {
|
||||
if (token.length <= 8) return token;
|
||||
return `${token.slice(0, 4)}...${token.slice(-4)}`;
|
||||
@@ -51,119 +54,202 @@ export async function shareRoutes(app: FastifyInstance) {
|
||||
// ---------------------------------------------------------------------------
|
||||
// GET /share/:token - PUBLIC: Get shared schedule by token
|
||||
// ---------------------------------------------------------------------------
|
||||
app.get<{ Params: { token: string } }>("/share/:token", async (request, reply) => {
|
||||
const { token } = request.params;
|
||||
|
||||
// Find share token
|
||||
const [share] = await db.select().from(shareTokens).where(eq(shareTokens.token, token));
|
||||
if (!share) {
|
||||
request.log.warn(`[Share] Invalid share token requested: ${maskToken(token)}`);
|
||||
return reply.status(404).send({
|
||||
error: "Share link not found",
|
||||
code: "NOT_FOUND",
|
||||
});
|
||||
}
|
||||
|
||||
// Check if token has expired
|
||||
if (share.expiresAt && share.expiresAt.getTime() < Date.now()) {
|
||||
request.log.warn(
|
||||
`[Share] Expired token requested: ${maskToken(token)} (owner=${share.userId}, takenBy=${share.takenBy})`
|
||||
);
|
||||
// Get the username of the owner to show in the expired message
|
||||
const [owner] = await db.select({ username: users.username }).from(users).where(eq(users.id, share.userId));
|
||||
return reply.status(410).send({
|
||||
error: "Share link has expired",
|
||||
code: "EXPIRED",
|
||||
ownerUsername: owner?.username ?? "the owner",
|
||||
takenBy: share.takenBy,
|
||||
expiredAt: share.expiresAt.toISOString(),
|
||||
});
|
||||
}
|
||||
|
||||
// Get user settings for stock thresholds
|
||||
const [settings] = await db.select().from(userSettings).where(eq(userSettings.userId, share.userId));
|
||||
|
||||
// Get the username of the owner who created this share link
|
||||
const [owner] = await db.select({ username: users.username }).from(users).where(eq(users.id, share.userId));
|
||||
|
||||
// Get medications for this user filtered by takenBy (search in JSON array)
|
||||
// Use SQLite JSON function to check if takenBy is in the array
|
||||
const allMeds = await db.select().from(medications).where(eq(medications.userId, share.userId));
|
||||
|
||||
// Filter medications where takenBy matches either medication-level OR any intake-level takenBy
|
||||
const meds = allMeds.filter((med) => {
|
||||
const takenByArray = parseTakenByJson(med.takenByJson);
|
||||
const intakes = parseIntakesJson(
|
||||
med.intakesJson,
|
||||
{ usageJson: med.usageJson, everyJson: med.everyJson, startJson: med.startJson },
|
||||
med.intakeRemindersEnabled ?? false
|
||||
);
|
||||
return personTakesMedication(share.takenBy, takenByArray, intakes);
|
||||
});
|
||||
|
||||
// Parse blisters and build schedule data
|
||||
const medicationsWithBlisters = meds.map((med) => {
|
||||
// Parse intakes from new format, falling back to legacy
|
||||
const intakes = parseIntakesJson(
|
||||
med.intakesJson,
|
||||
{ usageJson: med.usageJson, everyJson: med.everyJson, startJson: med.startJson },
|
||||
med.intakeRemindersEnabled ?? false
|
||||
);
|
||||
|
||||
// Convert to legacy blisters format for backward compat
|
||||
const blisters = intakes.map((i) => ({
|
||||
usage: i.usage,
|
||||
every: i.every,
|
||||
start: i.start,
|
||||
}));
|
||||
|
||||
// Parse takenBy JSON array
|
||||
const takenByArray = parseTakenByJson(med.takenByJson);
|
||||
|
||||
const totalPills = isAmountBasedPackageType(med.packageType)
|
||||
? med.looseTablets + (med.stockAdjustment ?? 0)
|
||||
: med.packCount * med.blistersPerPack * med.pillsPerBlister + med.looseTablets + (med.stockAdjustment ?? 0);
|
||||
return {
|
||||
id: med.id,
|
||||
name: med.name,
|
||||
genericName: med.genericName,
|
||||
pillWeightMg: med.pillWeightMg,
|
||||
doseUnit: med.doseUnit ?? "mg",
|
||||
imageUrl: med.imageUrl,
|
||||
totalPills,
|
||||
packageType: normalizePackageType(med.packageType),
|
||||
packCount: med.packCount,
|
||||
blistersPerPack: med.blistersPerPack,
|
||||
looseTablets: med.looseTablets,
|
||||
pillsPerBlister: med.pillsPerBlister,
|
||||
takenBy: takenByArray,
|
||||
intakes, // New unified format with per-intake takenBy
|
||||
blisters, // Legacy format for backward compat
|
||||
dismissedUntil: med.dismissedUntil,
|
||||
updatedAt: med.updatedAt, // For filtering out doses from previous schedule configurations
|
||||
lastStockCorrectionAt: med.lastStockCorrectionAt?.getTime() ?? null,
|
||||
stockAdjustment: med.stockAdjustment ?? 0,
|
||||
};
|
||||
});
|
||||
|
||||
return {
|
||||
takenBy: share.takenBy,
|
||||
sharedBy: owner?.username ?? null,
|
||||
scheduleDays: share.scheduleDays,
|
||||
medications: medicationsWithBlisters,
|
||||
stockThresholds: {
|
||||
lowStockDays: settings?.lowStockDays ?? 30,
|
||||
normalStockDays: settings?.normalStockDays ?? 60,
|
||||
highStockDays: settings?.highStockDays ?? 90,
|
||||
reminderDaysBefore: settings?.reminderDaysBefore ?? 7,
|
||||
expiryWarningDays: settings?.expiryWarningDays ?? 90,
|
||||
app.get<{ Params: { token: string } }>(
|
||||
"/share/:token",
|
||||
{
|
||||
config: {
|
||||
rateLimit: {
|
||||
max: 60,
|
||||
timeWindow: "1 minute",
|
||||
errorResponseBuilder: () => ({ error: "rate_limited" }),
|
||||
},
|
||||
},
|
||||
stockCalculationMode: (settings?.stockCalculationMode as "automatic" | "manual") ?? "automatic",
|
||||
shareStockStatus: settings?.shareStockStatus ?? true,
|
||||
upcomingTodayOnly: settings?.upcomingTodayOnly ?? false,
|
||||
shareScheduleTodayOnly: settings?.shareScheduleTodayOnly ?? false,
|
||||
};
|
||||
});
|
||||
},
|
||||
async (request, reply) => {
|
||||
const { token } = request.params;
|
||||
|
||||
// Find share token
|
||||
const [share] = await db.select().from(shareTokens).where(eq(shareTokens.token, token));
|
||||
if (!share) {
|
||||
request.log.warn(`[Share] Invalid share token requested: ${maskToken(token)}`);
|
||||
return reply.status(404).send({
|
||||
error: "Share link not found",
|
||||
code: "NOT_FOUND",
|
||||
});
|
||||
}
|
||||
|
||||
// Check if token has expired
|
||||
if (share.expiresAt && share.expiresAt.getTime() < Date.now()) {
|
||||
request.log.warn(
|
||||
`[Share] Expired token requested: ${maskToken(token)} (owner=${share.userId}, takenBy=${share.takenBy})`
|
||||
);
|
||||
// Get the username of the owner to show in the expired message
|
||||
const [owner] = await db.select({ username: users.username }).from(users).where(eq(users.id, share.userId));
|
||||
return reply.status(410).send({
|
||||
error: "Share link has expired",
|
||||
code: "EXPIRED",
|
||||
ownerUsername: owner?.username ?? "the owner",
|
||||
takenBy: share.takenBy,
|
||||
expiredAt: share.expiresAt.toISOString(),
|
||||
});
|
||||
}
|
||||
|
||||
// Get user settings for stock thresholds
|
||||
const [settings] = await db.select().from(userSettings).where(eq(userSettings.userId, share.userId));
|
||||
|
||||
// Get the username of the owner who created this share link
|
||||
const [owner] = await db.select({ username: users.username }).from(users).where(eq(users.id, share.userId));
|
||||
|
||||
// Get medications for this user filtered by takenBy (search in JSON array)
|
||||
// Use SQLite JSON function to check if takenBy is in the array
|
||||
const allMeds = await db.select().from(medications).where(eq(medications.userId, share.userId));
|
||||
|
||||
// Filter medications where takenBy matches either medication-level OR any intake-level takenBy
|
||||
const meds = allMeds.filter((med) => {
|
||||
const takenByArray = parseTakenByJson(med.takenByJson);
|
||||
const intakes = parseIntakesJson(
|
||||
med.intakesJson,
|
||||
{ usageJson: med.usageJson, everyJson: med.everyJson, startJson: med.startJson },
|
||||
med.intakeRemindersEnabled ?? false
|
||||
);
|
||||
return personTakesMedication(share.takenBy, takenByArray, intakes);
|
||||
});
|
||||
|
||||
// Parse blisters and build schedule data
|
||||
const medicationsWithBlisters = meds.map((med) => {
|
||||
// Parse intakes from new format, falling back to legacy
|
||||
const intakes = parseIntakesJson(
|
||||
med.intakesJson,
|
||||
{ usageJson: med.usageJson, everyJson: med.everyJson, startJson: med.startJson },
|
||||
med.intakeRemindersEnabled ?? false
|
||||
);
|
||||
|
||||
// Convert to legacy blisters format for backward compat
|
||||
const blisters = intakes.map((i) => ({
|
||||
usage: i.usage,
|
||||
every: i.every,
|
||||
start: i.start,
|
||||
}));
|
||||
|
||||
// Parse takenBy JSON array
|
||||
const takenByArray = parseTakenByJson(med.takenByJson);
|
||||
|
||||
const totalPills = isAmountBasedPackageType(med.packageType)
|
||||
? med.looseTablets + (med.stockAdjustment ?? 0)
|
||||
: med.packCount * med.blistersPerPack * med.pillsPerBlister + med.looseTablets + (med.stockAdjustment ?? 0);
|
||||
return {
|
||||
id: med.id,
|
||||
name: med.name,
|
||||
genericName: med.genericName,
|
||||
pillWeightMg: med.pillWeightMg,
|
||||
doseUnit: med.doseUnit ?? "mg",
|
||||
imageUrl: med.imageUrl,
|
||||
totalPills,
|
||||
packageType: normalizePackageType(med.packageType),
|
||||
packCount: med.packCount,
|
||||
blistersPerPack: med.blistersPerPack,
|
||||
looseTablets: med.looseTablets,
|
||||
pillsPerBlister: med.pillsPerBlister,
|
||||
takenBy: takenByArray,
|
||||
intakes, // New unified format with per-intake takenBy
|
||||
blisters, // Legacy format for backward compat
|
||||
dismissedUntil: med.dismissedUntil,
|
||||
updatedAt: med.updatedAt, // For filtering out doses from previous schedule configurations
|
||||
lastStockCorrectionAt: med.lastStockCorrectionAt?.getTime() ?? null,
|
||||
stockAdjustment: med.stockAdjustment ?? 0,
|
||||
};
|
||||
});
|
||||
|
||||
return {
|
||||
takenBy: share.takenBy,
|
||||
sharedBy: owner?.username ?? null,
|
||||
scheduleDays: share.scheduleDays,
|
||||
medications: medicationsWithBlisters,
|
||||
stockThresholds: {
|
||||
lowStockDays: settings?.lowStockDays ?? 30,
|
||||
normalStockDays: settings?.normalStockDays ?? 60,
|
||||
highStockDays: settings?.highStockDays ?? 90,
|
||||
reminderDaysBefore: settings?.reminderDaysBefore ?? 7,
|
||||
expiryWarningDays: settings?.expiryWarningDays ?? 90,
|
||||
},
|
||||
stockCalculationMode: (settings?.stockCalculationMode as "automatic" | "manual") ?? "automatic",
|
||||
shareStockStatus: settings?.shareStockStatus ?? true,
|
||||
upcomingTodayOnly: settings?.upcomingTodayOnly ?? false,
|
||||
shareScheduleTodayOnly: settings?.shareScheduleTodayOnly ?? false,
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// GET /share/:token/overview - PUBLIC: Read-only medication overview by token
|
||||
// ---------------------------------------------------------------------------
|
||||
app.get<{ Params: { token: string } }>(
|
||||
"/share/:token/overview",
|
||||
{
|
||||
config: {
|
||||
rateLimit: {
|
||||
max: 60,
|
||||
timeWindow: "1 minute",
|
||||
errorResponseBuilder: () => ({ error: "rate_limited" }),
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
reply.header("Cache-Control", "no-store");
|
||||
|
||||
const { token } = request.params;
|
||||
if (!shareTokenPattern.test(token)) {
|
||||
request.log.warn(`[ShareOverview] Rejected invalid token format: ${maskToken(token)}`);
|
||||
return reply.status(404).send({ error: "not_found" });
|
||||
}
|
||||
|
||||
const [share] = await db.select().from(shareTokens).where(eq(shareTokens.token, token));
|
||||
if (!share) {
|
||||
request.log.warn(`[ShareOverview] Unknown token requested: ${maskToken(token)}`);
|
||||
return reply.status(404).send({ error: "not_found" });
|
||||
}
|
||||
|
||||
if (share.expiresAt && share.expiresAt.getTime() < Date.now()) {
|
||||
request.log.warn(
|
||||
`[ShareOverview] Expired token requested: ${maskToken(token)} (owner=${share.userId}, takenBy=${share.takenBy})`
|
||||
);
|
||||
return reply.status(410).send({
|
||||
error: "expired",
|
||||
expiredAt: share.expiresAt.toISOString(),
|
||||
});
|
||||
}
|
||||
|
||||
const [settings] = await db.select().from(userSettings).where(eq(userSettings.userId, share.userId));
|
||||
const [owner] = await db.select({ username: users.username }).from(users).where(eq(users.id, share.userId));
|
||||
|
||||
const allMeds = await db.select().from(medications).where(eq(medications.userId, share.userId));
|
||||
const meds = allMeds.filter((med) => {
|
||||
const takenByArray = parseTakenByJson(med.takenByJson);
|
||||
const intakes = parseIntakesJson(
|
||||
med.intakesJson,
|
||||
{ usageJson: med.usageJson, everyJson: med.everyJson, startJson: med.startJson },
|
||||
med.intakeRemindersEnabled ?? false
|
||||
);
|
||||
return personTakesMedication(share.takenBy, takenByArray, intakes);
|
||||
});
|
||||
|
||||
const doses = await db.select().from(doseTracking).where(eq(doseTracking.userId, share.userId));
|
||||
|
||||
const overview = buildSharedMedicationOverview({
|
||||
medications: meds,
|
||||
doses,
|
||||
thresholdDays: settings?.lowStockDays ?? 30,
|
||||
shareStockStatus: settings?.shareStockStatus ?? true,
|
||||
});
|
||||
|
||||
return {
|
||||
takenBy: share.takenBy,
|
||||
sharedBy: owner?.username ?? null,
|
||||
generatedAt: new Date().toISOString(),
|
||||
medications: overview,
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// POST /share - PROTECTED: Create a new share link
|
||||
|
||||
Reference in New Issue
Block a user