Test HTML
', + textBody: 'Test Text' + }); + + expect(result.success).toBe(true); + expect(result.messageId).toBe('test-message-id'); + expect(mockSend).toHaveBeenCalledTimes(1); + }); + + it('should use correct sender information', async () => { + await sendEmail({ + to: 'user@example.com', + subject: 'Test', + htmlBody: 'Test
', + textBody: 'Test' + }); + + const sendCommand = mockSend.mock.calls[0][0]; + expect(sendCommand.Source).toBe('Test AppTest
', + textBody: 'Test' + }); + + const sendCommand = mockSend.mock.calls[0][0]; + expect(sendCommand.Destination.ToAddresses).toEqual(['recipient@example.com']); + }); + + it('should handle email send failure', async () => { + mockSend.mockRejectedValue(new Error('SES Error')); + + await expect(sendEmail({ + to: 'user@example.com', + subject: 'Test', + htmlBody: 'Test
', + textBody: 'Test' + })).rejects.toThrow('Failed to send email'); + }); + + it('should include both HTML and text bodies', async () => { + const htmlBody = 'Test
', + textBody: 'Test' + })).rejects.toThrow(); + }); + + it('should log errors', async () => { + const consoleSpy = jest.spyOn(console, 'error').mockImplementation(); + mockSend.mockRejectedValue(new Error('Test error')); + + try { + await sendEmail({ + to: 'user@example.com', + subject: 'Test', + htmlBody: 'Test
', + textBody: 'Test' + }); + } catch (error) { + // Expected to throw + } + + expect(consoleSpy).toHaveBeenCalled(); + consoleSpy.mockRestore(); + }); + }); +}); diff --git a/backend/src/__tests__/wsdc.test.js b/backend/src/__tests__/wsdc.test.js new file mode 100644 index 0000000..c6fda4e --- /dev/null +++ b/backend/src/__tests__/wsdc.test.js @@ -0,0 +1,212 @@ +/** + * WSDC Controller Tests (Phase 1.5) + * Tests for WSDC API proxy functionality + */ + +const request = require('supertest'); +const app = require('../app'); + +// Mock fetch globally +global.fetch = jest.fn(); + +describe('WSDC Controller Tests (Phase 1.5)', () => { + beforeEach(() => { + fetch.mockClear(); + }); + + describe('GET /api/wsdc/lookup', () => { + it('should lookup dancer by WSDC ID successfully', async () => { + const mockDancerData = { + dancer_wsdcid: 26997, + dancer_first: 'Radoslaw', + dancer_last: 'Gierwialo', + recent_year: 2025 + }; + + fetch.mockResolvedValue({ + ok: true, + json: async () => mockDancerData + }); + + const response = await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(response.status).toBe(200); + expect(response.body.success).toBe(true); + expect(response.body.dancer).toMatchObject({ + wsdcId: 26997, + firstName: 'Radoslaw', + lastName: 'Gierwialo' + }); + }); + + it('should return 400 if WSDC ID is missing', async () => { + const response = await request(app) + .get('/api/wsdc/lookup'); + + expect(response.status).toBe(400); + expect(response.body.error).toBe('Bad Request'); + expect(response.body.message).toContain('WSDC ID is required'); + }); + + it('should return 400 for invalid WSDC ID format', async () => { + const response = await request(app) + .get('/api/wsdc/lookup?id=abc123'); + + expect(response.status).toBe(400); + expect(response.body.error).toBe('Bad Request'); + expect(response.body.message).toContain('Invalid WSDC ID format'); + }); + + it('should return 400 for WSDC ID too long', async () => { + const response = await request(app) + .get('/api/wsdc/lookup?id=12345678901'); // 11 digits + + expect(response.status).toBe(400); + expect(response.body.error).toBe('Bad Request'); + }); + + it('should return 404 if dancer not found', async () => { + fetch.mockResolvedValue({ + ok: true, + json: async () => ({}) // Empty response + }); + + const response = await request(app) + .get('/api/wsdc/lookup?id=99999'); + + expect(response.status).toBe(404); + expect(response.body.error).toBe('Not Found'); + expect(response.body.message).toContain('not found'); + }); + + it('should return 502 if WSDC API fails', async () => { + fetch.mockResolvedValue({ + ok: false, + status: 500, + statusText: 'Internal Server Error' + }); + + const response = await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(response.status).toBe(502); + expect(response.body.error).toBe('Bad Gateway'); + }); + + it('should handle network errors', async () => { + fetch.mockRejectedValue(new Error('Network error')); + + const response = await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(response.status).toBe(500); + expect(response.body.error).toBe('Internal Server Error'); + }); + + it('should call WSDC API with correct URL', async () => { + fetch.mockResolvedValue({ + ok: true, + json: async () => ({ + dancer_wsdcid: 26997, + dancer_first: 'Test', + dancer_last: 'User' + }) + }); + + await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(fetch).toHaveBeenCalledWith( + 'https://points.worldsdc.com/lookup2020/find?q=26997' + ); + }); + + it('should validate numeric WSDC IDs only', async () => { + const invalidIds = ['abc', '123abc', 'test', '!@#$']; + + for (const id of invalidIds) { + const response = await request(app) + .get(`/api/wsdc/lookup?id=${id}`); + + expect(response.status).toBe(400); + } + }); + + it('should accept valid numeric WSDC IDs', async () => { + fetch.mockResolvedValue({ + ok: true, + json: async () => ({ + dancer_wsdcid: 123, + dancer_first: 'Test', + dancer_last: 'User' + }) + }); + + const validIds = ['1', '123', '12345', '1234567890']; + + for (const id of validIds) { + const response = await request(app) + .get(`/api/wsdc/lookup?id=${id}`); + + expect(response.status).toBe(200); + } + }); + + it('should include optional fields if available', async () => { + const mockDancerData = { + dancer_wsdcid: 26997, + dancer_first: 'Radoslaw', + dancer_last: 'Gierwialo', + recent_year: 2025, + dominate_data: { + short_dominate_role: 'Leader' + } + }; + + fetch.mockResolvedValue({ + ok: true, + json: async () => mockDancerData + }); + + const response = await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(response.status).toBe(200); + expect(response.body.dancer.recentYear).toBe(2025); + expect(response.body.dancer.dominateRole).toBe('Leader'); + }); + + it('should handle missing optional fields gracefully', async () => { + const mockDancerData = { + dancer_wsdcid: 26997, + dancer_first: 'Test', + dancer_last: 'User' + // No recent_year or dominate_data + }; + + fetch.mockResolvedValue({ + ok: true, + json: async () => mockDancerData + }); + + const response = await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(response.status).toBe(200); + expect(response.body.dancer.dominateRole).toBeNull(); + }); + + it('should log errors for debugging', async () => { + const consoleSpy = jest.spyOn(console, 'error').mockImplementation(); + + fetch.mockRejectedValue(new Error('Test error')); + + await request(app) + .get('/api/wsdc/lookup?id=26997'); + + expect(consoleSpy).toHaveBeenCalled(); + consoleSpy.mockRestore(); + }); + }); +}); diff --git a/backend/src/app.js b/backend/src/app.js index 4a714df..43081e9 100644 --- a/backend/src/app.js +++ b/backend/src/app.js @@ -31,6 +31,7 @@ app.get('/api/health', (req, res) => { app.use('/api/auth', require('./routes/auth')); app.use('/api/users', require('./routes/users')); app.use('/api/events', require('./routes/events')); +app.use('/api/wsdc', require('./routes/wsdc')); // app.use('/api/matches', require('./routes/matches')); // app.use('/api/ratings', require('./routes/ratings')); diff --git a/backend/src/controllers/auth.js b/backend/src/controllers/auth.js index 0f850a1..6d26d94 100644 --- a/backend/src/controllers/auth.js +++ b/backend/src/controllers/auth.js @@ -1,10 +1,18 @@ const { prisma } = require('../utils/db'); -const { hashPassword, comparePassword, generateToken } = require('../utils/auth'); +const { + hashPassword, + comparePassword, + generateToken, + generateVerificationToken, + generateVerificationCode, + getTokenExpiry +} = require('../utils/auth'); +const { sendVerificationEmail, sendWelcomeEmail, sendPasswordResetEmail } = require('../utils/email'); -// Register new user +// Register new user (Phase 1.5 - with WSDC support and email verification) async function register(req, res, next) { try { - const { username, email, password } = req.body; + const { username, email, password, firstName, lastName, wsdcId } = req.body; // Check if user already exists const existingUser = await prisma.user.findFirst({ @@ -12,6 +20,7 @@ async function register(req, res, next) { OR: [ { email }, { username }, + ...(wsdcId ? [{ wsdcId }] : []), ], }, }); @@ -23,38 +32,80 @@ async function register(req, res, next) { error: 'Email already registered', }); } - return res.status(400).json({ - success: false, - error: 'Username already taken', - }); + if (existingUser.username === username) { + return res.status(400).json({ + success: false, + error: 'Username already taken', + }); + } + if (wsdcId && existingUser.wsdcId === wsdcId) { + return res.status(400).json({ + success: false, + error: 'WSDC ID already registered', + }); + } } // Hash password const passwordHash = await hashPassword(password); + // Generate verification token and code + const verificationToken = generateVerificationToken(); + const verificationCode = generateVerificationCode(); + const verificationTokenExpiry = getTokenExpiry(24); // 24 hours + + // Create display name for avatar + const displayName = firstName && lastName + ? `${firstName} ${lastName}` + : username; + // Create user const user = await prisma.user.create({ data: { username, email, passwordHash, - avatar: `https://ui-avatars.com/api/?name=${encodeURIComponent(username)}&background=6366f1&color=fff`, + firstName, + lastName, + wsdcId, + verificationToken, + verificationCode, + verificationTokenExpiry, + emailVerified: false, + avatar: `https://ui-avatars.com/api/?name=${encodeURIComponent(displayName)}&background=6366f1&color=fff`, }, select: { id: true, username: true, email: true, + firstName: true, + lastName: true, + wsdcId: true, + emailVerified: true, avatar: true, createdAt: true, }, }); - // Generate token + // Send verification email + try { + await sendVerificationEmail( + user.email, + user.firstName || user.username, + verificationToken, + verificationCode + ); + } catch (emailError) { + console.error('Failed to send verification email:', emailError); + // Continue even if email fails - user can request resend + } + + // Generate JWT token const token = generateToken({ userId: user.id }); res.status(201).json({ success: true, - message: 'User registered successfully', + message: 'User registered successfully. Please check your email to verify your account.', data: { user, token, @@ -111,7 +162,337 @@ async function login(req, res, next) { } } +// Verify email by token (link in email) +async function verifyEmailByToken(req, res, next) { + try { + const { token } = req.query; + + if (!token) { + return res.status(400).json({ + success: false, + error: 'Verification token is required', + }); + } + + // Find user by verification token + const user = await prisma.user.findUnique({ + where: { verificationToken: token }, + }); + + if (!user) { + return res.status(404).json({ + success: false, + error: 'Invalid or expired verification token', + }); + } + + // Check if already verified + if (user.emailVerified) { + return res.status(200).json({ + success: true, + message: 'Email already verified', + }); + } + + // Check if token expired + if (user.verificationTokenExpiry && new Date() > user.verificationTokenExpiry) { + return res.status(400).json({ + success: false, + error: 'Verification token has expired. Please request a new one.', + }); + } + + // Update user - mark as verified and clear tokens + await prisma.user.update({ + where: { id: user.id }, + data: { + emailVerified: true, + verificationToken: null, + verificationCode: null, + verificationTokenExpiry: null, + }, + }); + + // Send welcome email + try { + await sendWelcomeEmail(user.email, user.firstName || user.username); + } catch (emailError) { + console.error('Failed to send welcome email:', emailError); + } + + res.status(200).json({ + success: true, + message: 'Email verified successfully!', + }); + } catch (error) { + next(error); + } +} + +// Verify email by code (6-digit PIN) +async function verifyEmailByCode(req, res, next) { + try { + const { code, email } = req.body; + + if (!code || !email) { + return res.status(400).json({ + success: false, + error: 'Email and verification code are required', + }); + } + + // Find user by email and code + const user = await prisma.user.findFirst({ + where: { + email, + verificationCode: code, + }, + }); + + if (!user) { + return res.status(400).json({ + success: false, + error: 'Invalid verification code', + }); + } + + // Check if already verified + if (user.emailVerified) { + return res.status(200).json({ + success: true, + message: 'Email already verified', + }); + } + + // Check if token expired + if (user.verificationTokenExpiry && new Date() > user.verificationTokenExpiry) { + return res.status(400).json({ + success: false, + error: 'Verification code has expired. Please request a new one.', + }); + } + + // Update user - mark as verified and clear tokens + await prisma.user.update({ + where: { id: user.id }, + data: { + emailVerified: true, + verificationToken: null, + verificationCode: null, + verificationTokenExpiry: null, + }, + }); + + // Send welcome email + try { + await sendWelcomeEmail(user.email, user.firstName || user.username); + } catch (emailError) { + console.error('Failed to send welcome email:', emailError); + } + + res.status(200).json({ + success: true, + message: 'Email verified successfully!', + }); + } catch (error) { + next(error); + } +} + +// Resend verification email +async function resendVerification(req, res, next) { + try { + const { email } = req.body; + + if (!email) { + return res.status(400).json({ + success: false, + error: 'Email is required', + }); + } + + // Find user by email + const user = await prisma.user.findUnique({ + where: { email }, + }); + + if (!user) { + return res.status(404).json({ + success: false, + error: 'User not found', + }); + } + + // Check if already verified + if (user.emailVerified) { + return res.status(400).json({ + success: false, + error: 'Email is already verified', + }); + } + + // Generate new verification token and code + const verificationToken = generateVerificationToken(); + const verificationCode = generateVerificationCode(); + const verificationTokenExpiry = getTokenExpiry(24); // 24 hours + + // Update user with new tokens + await prisma.user.update({ + where: { id: user.id }, + data: { + verificationToken, + verificationCode, + verificationTokenExpiry, + }, + }); + + // Send verification email + await sendVerificationEmail( + user.email, + user.firstName || user.username, + verificationToken, + verificationCode + ); + + res.status(200).json({ + success: true, + message: 'Verification email sent successfully', + }); + } catch (error) { + next(error); + } +} + +// Request password reset (send email with reset link) +async function requestPasswordReset(req, res, next) { + try { + const { email } = req.body; + + if (!email) { + return res.status(400).json({ + success: false, + error: 'Email is required', + }); + } + + // Find user by email + const user = await prisma.user.findUnique({ + where: { email }, + }); + + // Always return success to prevent email enumeration + if (!user) { + return res.status(200).json({ + success: true, + message: 'If an account with that email exists, a password reset link has been sent.', + }); + } + + // Generate reset token + const resetToken = generateVerificationToken(); + const resetTokenExpiry = getTokenExpiry(1); // 1 hour expiry + + // Save reset token to database + await prisma.user.update({ + where: { id: user.id }, + data: { + resetToken, + resetTokenExpiry, + }, + }); + + // Send password reset email + try { + await sendPasswordResetEmail( + user.email, + user.firstName || user.username, + resetToken + ); + } catch (emailError) { + console.error('Failed to send password reset email:', emailError); + return res.status(500).json({ + success: false, + error: 'Failed to send password reset email', + }); + } + + res.status(200).json({ + success: true, + message: 'If an account with that email exists, a password reset link has been sent.', + }); + } catch (error) { + next(error); + } +} + +// Reset password using token +async function resetPassword(req, res, next) { + try { + const { token, newPassword } = req.body; + + if (!token || !newPassword) { + return res.status(400).json({ + success: false, + error: 'Token and new password are required', + }); + } + + // Validate password length + if (newPassword.length < 8) { + return res.status(400).json({ + success: false, + error: 'Password must be at least 8 characters long', + }); + } + + // Find user by reset token + const user = await prisma.user.findUnique({ + where: { resetToken: token }, + }); + + if (!user) { + return res.status(400).json({ + success: false, + error: 'Invalid or expired reset token', + }); + } + + // Check if token expired + if (user.resetTokenExpiry && new Date() > user.resetTokenExpiry) { + return res.status(400).json({ + success: false, + error: 'Reset token has expired. Please request a new one.', + }); + } + + // Hash new password + const passwordHash = await hashPassword(newPassword); + + // Update user password and clear reset token + await prisma.user.update({ + where: { id: user.id }, + data: { + passwordHash, + resetToken: null, + resetTokenExpiry: null, + }, + }); + + res.status(200).json({ + success: true, + message: 'Password reset successfully', + }); + } catch (error) { + next(error); + } +} + module.exports = { register, login, + verifyEmailByToken, + verifyEmailByCode, + resendVerification, + requestPasswordReset, + resetPassword, }; diff --git a/backend/src/controllers/wsdc.js b/backend/src/controllers/wsdc.js new file mode 100644 index 0000000..ba882f6 --- /dev/null +++ b/backend/src/controllers/wsdc.js @@ -0,0 +1,76 @@ +/** + * WSDC API Controller + * Provides proxy endpoint for World Swing Dance Council (WSDC) dancer lookup + */ + +const WSDC_API_BASE = 'https://points.worldsdc.com/lookup2020/find'; + +/** + * Lookup dancer by WSDC ID + * GET /api/wsdc/lookup?id=26997 + */ +exports.lookupDancer = async (req, res) => { + try { + const { id } = req.query; + + // Validate WSDC ID + if (!id) { + return res.status(400).json({ + error: 'Bad Request', + message: 'WSDC ID is required' + }); + } + + // Validate WSDC ID format (numeric, max 10 digits) + if (!/^\d{1,10}$/.test(id)) { + return res.status(400).json({ + error: 'Bad Request', + message: 'Invalid WSDC ID format. Must be numeric.' + }); + } + + // Fetch from WSDC API + const url = `${WSDC_API_BASE}?q=${id}`; + const response = await fetch(url); + + if (!response.ok) { + console.error(`WSDC API error: ${response.status} ${response.statusText}`); + return res.status(502).json({ + error: 'Bad Gateway', + message: 'Failed to fetch data from WSDC API' + }); + } + + const data = await response.json(); + + // Check if dancer was found + if (!data || !data.dancer_wsdcid) { + return res.status(404).json({ + error: 'Not Found', + message: 'Dancer with this WSDC ID not found' + }); + } + + // Extract relevant fields + const dancerData = { + wsdcId: data.dancer_wsdcid, + firstName: data.dancer_first || '', + lastName: data.dancer_last || '', + // Optional: include competitive level info if needed + recentYear: data.recent_year, + dominateRole: data.dominate_data?.short_dominate_role || null + }; + + return res.status(200).json({ + success: true, + dancer: dancerData + }); + + } catch (error) { + console.error('Error in lookupDancer:', error); + return res.status(500).json({ + error: 'Internal Server Error', + message: 'An error occurred while looking up dancer' + }); + } +}; diff --git a/backend/src/middleware/auth.js b/backend/src/middleware/auth.js index 49886a7..3a1db2b 100644 --- a/backend/src/middleware/auth.js +++ b/backend/src/middleware/auth.js @@ -35,6 +35,10 @@ async function authenticate(req, res, next) { id: true, username: true, email: true, + emailVerified: true, + firstName: true, + lastName: true, + wsdcId: true, avatar: true, createdAt: true, updatedAt: true, @@ -61,4 +65,37 @@ async function authenticate(req, res, next) { } } -module.exports = { authenticate }; +// Middleware to check if email is verified (Phase 1.5) +// Use this after authenticate middleware on routes that require verified email +async function requireEmailVerification(req, res, next) { + try { + // User should be attached by authenticate middleware + if (!req.user) { + return res.status(401).json({ + success: false, + error: 'Unauthorized', + message: 'Authentication required', + }); + } + + // Check if email is verified + if (!req.user.emailVerified) { + return res.status(403).json({ + success: false, + error: 'Email Not Verified', + message: 'Please verify your email address to access this feature', + requiresVerification: true, + }); + } + + next(); + } catch (error) { + console.error('Email verification middleware error:', error); + res.status(500).json({ + success: false, + error: 'Internal Server Error', + }); + } +} + +module.exports = { authenticate, requireEmailVerification }; diff --git a/backend/src/routes/auth.js b/backend/src/routes/auth.js index 3fc41f1..d20da36 100644 --- a/backend/src/routes/auth.js +++ b/backend/src/routes/auth.js @@ -1,5 +1,13 @@ const express = require('express'); -const { register, login } = require('../controllers/auth'); +const { + register, + login, + verifyEmailByToken, + verifyEmailByCode, + resendVerification, + requestPasswordReset, + resetPassword +} = require('../controllers/auth'); const { registerValidation, loginValidation } = require('../middleware/validators'); const router = express.Router(); @@ -10,4 +18,19 @@ router.post('/register', registerValidation, register); // POST /api/auth/login - Login user router.post('/login', loginValidation, login); +// GET /api/auth/verify-email?token=xxx - Verify email by token (link) +router.get('/verify-email', verifyEmailByToken); + +// POST /api/auth/verify-code - Verify email by code (PIN) +router.post('/verify-code', verifyEmailByCode); + +// POST /api/auth/resend-verification - Resend verification email +router.post('/resend-verification', resendVerification); + +// POST /api/auth/request-password-reset - Request password reset +router.post('/request-password-reset', requestPasswordReset); + +// POST /api/auth/reset-password - Reset password with token +router.post('/reset-password', resetPassword); + module.exports = router; diff --git a/backend/src/routes/wsdc.js b/backend/src/routes/wsdc.js new file mode 100644 index 0000000..5473a24 --- /dev/null +++ b/backend/src/routes/wsdc.js @@ -0,0 +1,16 @@ +/** + * WSDC API Routes + * Endpoints for World Swing Dance Council dancer lookup + */ + +const express = require('express'); +const router = express.Router(); +const wsdcController = require('../controllers/wsdc'); + +/** + * GET /api/wsdc/lookup?id=26997 + * Lookup dancer by WSDC ID + */ +router.get('/lookup', wsdcController.lookupDancer); + +module.exports = router; diff --git a/backend/src/utils/auth.js b/backend/src/utils/auth.js index 5703a65..2381521 100644 --- a/backend/src/utils/auth.js +++ b/backend/src/utils/auth.js @@ -1,5 +1,6 @@ const bcrypt = require('bcryptjs'); const jwt = require('jsonwebtoken'); +const crypto = require('crypto'); // Hash password with bcrypt async function hashPassword(password) { @@ -28,9 +29,28 @@ function verifyToken(token) { } } +// Generate random verification token (URL-safe) +function generateVerificationToken() { + return crypto.randomBytes(32).toString('hex'); +} + +// Generate 6-digit verification code +function generateVerificationCode() { + return Math.floor(100000 + Math.random() * 900000).toString(); +} + +// Calculate token expiry time +function getTokenExpiry(hours = 24) { + const now = new Date(); + return new Date(now.getTime() + hours * 60 * 60 * 1000); +} + module.exports = { hashPassword, comparePassword, generateToken, verifyToken, + generateVerificationToken, + generateVerificationCode, + getTokenExpiry, }; diff --git a/backend/src/utils/email.js b/backend/src/utils/email.js new file mode 100644 index 0000000..1dcda00 --- /dev/null +++ b/backend/src/utils/email.js @@ -0,0 +1,320 @@ +/** + * Email Service using AWS SES + * Handles sending emails for verification, password reset, etc. + */ + +const { SESClient, SendEmailCommand } = require('@aws-sdk/client-ses'); + +// Configure AWS SES Client +const sesClient = new SESClient({ + region: process.env.AWS_REGION || 'us-east-1', + credentials: { + accessKeyId: process.env.AWS_ACCESS_KEY_ID, + secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, + }, +}); + +/** + * Send email via AWS SES + * @param {Object} params - Email parameters + * @param {string} params.to - Recipient email address + * @param {string} params.subject - Email subject + * @param {string} params.htmlBody - HTML email body + * @param {string} params.textBody - Plain text email body (fallback) + * @returns {Promise