Merge pull request 'Updates for the tag build pipeline' (#58) from dev into main

Reviewed-on: #58
Reviewed-by: Philipp Dormann <philipp@philippdormann.de>

.drone.yml

@@ -90,22 +90,20 @@ steps:
         from_secret: DOCKER_REGISTRY_PASSWORD
       repo: registry.odit.services/lfk/backend
       tags:
-        - $DRONE_TAG
+        - '${DRONE_TAG}'
       registry: registry.odit.services
-  - name: trigger lib build
-    depends_on: [clone]
-    image: plugins/downstream
+  - name: trigger node lib build
+    image: idcooldi/drone-webhook
     settings:
-      server: https://ci.odit.services/
-      token: 
+      urls: https://ci.odit.services/api/repos/lfk/lfk-client-node/builds?SOURCE_TAG=${DRONE_TAG}
+      bearer:
+        from_secret: BOT_DRONE_KEY
+  - name: trigger js lib build
+    image: idcooldi/drone-webhook
+    settings:
+      urls: https://ci.odit.services/api/repos/lfk/lfk-client-js/builds?SOURCE_TAG=${DRONE_TAG}
+      bearer:
         from_secret: BOT_DRONE_KEY
-      fork: false
-      repositories:
-        - lfk/lib
-      params:
-      - SOURCE_TAG: $DRONE_TAG
 trigger:
-  branch:
-    - main
   event:
-    - tag
+  - tag

.env.ci

@@ -5,4 +5,5 @@ DB_PORT=unused
 DB_USER=unused
 DB_PASSWORD=bla
 DB_NAME=./test.sqlite
-NODE_ENV=dev
+NODE_ENV=dev
+POSTALCODE_COUNTRYCODE=null

.env.example

@@ -5,4 +5,5 @@ DB_PORT=bla
 DB_USER=bla
 DB_PASSWORD=bla
 DB_NAME=bla
-NODE_ENV=production
+NODE_ENV=production
+POSTALCODE_COUNTRYCODE=null

.gitignore

@@ -132,5 +132,5 @@ build
 
 *.sqlite
 *.sqlite-jurnal
-docs
+/docs
 lib

package.json

@@ -1,6 +1,6 @@
 {
-  "name": "@lfk/backend",
-  "version": "1.0.0",
+  "name": "@odit/lfk-backend",
+  "version": "0.0.5",
   "main": "src/app.ts",
   "repository": "https://git.odit.services/lfk/backend",
   "author": {
@@ -41,11 +41,11 @@
     "routing-controllers": "^0.9.0-alpha.6",
     "routing-controllers-openapi": "^2.1.0",
     "sqlite3": "^5.0.0",
-    "swagger-ui-express": "^4.1.5",
     "typeorm": "^0.2.29",
     "typeorm-routing-controllers-extensions": "^0.2.0",
     "typeorm-seeding": "^1.6.1",
-    "uuid": "^8.3.1"
+    "uuid": "^8.3.1",
+    "validator": "^13.5.2"
   },
   "devDependencies": {
     "@types/cors": "^2.8.8",
@@ -54,9 +54,9 @@
     "@types/jest": "^26.0.16",
     "@types/jsonwebtoken": "^8.5.0",
     "@types/node": "^14.14.9",
-    "@types/swagger-ui-express": "^4.1.2",
     "@types/uuid": "^8.3.0",
     "axios": "^0.21.0",
+    "cp-cli": "^2.0.0",
     "jest": "^26.6.3",
     "nodemon": "^2.0.6",
     "rimraf": "^2.7.1",
@@ -68,11 +68,11 @@
   },
   "scripts": {
     "dev": "nodemon src/app.ts",
-    "build": "tsc",
+    "build": "rimraf ./dist && tsc && cp-cli ./src/static ./dist/static",
     "docs": "typedoc --out docs src",
     "test": "jest",
     "test:watch": "jest --watchAll",
-    "test:ci": "start-server-and-test dev http://localhost:4010/api/openapi.json test",
+    "test:ci": "start-server-and-test dev http://localhost:4010/api/docs/openapi.json test",
     "seed": "ts-node ./node_modules/typeorm/cli.js schema:sync && ts-node ./node_modules/typeorm-seeding/dist/cli.js seed",
     "openapi:export": "ts-node src/openapi_export.ts"
   },
@@ -82,4 +82,4 @@
       "docs/*"
     ]
   }
-}
+}

src/authchecker.ts

@@ -3,7 +3,7 @@ import * as jwt from "jsonwebtoken";
 import { Action } from "routing-controllers";
 import { getConnectionManager } from 'typeorm';
 import { config } from './config';
-import { IllegalJWTError, NoPermissionError, UserNonexistantOrRefreshtokenInvalidError } from './errors/AuthError';
+import { IllegalJWTError, NoPermissionError, UserDisabledError, UserNonexistantOrRefreshtokenInvalidError } from './errors/AuthError';
 import { JwtCreator, JwtUser } from './jwtcreator';
 import { User } from './models/entities/User';
 
@@ -31,6 +31,7 @@ const authchecker = async (action: Action, permissions: string[] | string) => {
 
     const user = await getConnectionManager().get().getRepository(User).findOne({ id: jwtPayload["id"], refreshTokenCount: jwtPayload["refreshTokenCount"] }, { relations: ['permissions'] })
     if (!user) { throw new UserNonexistantOrRefreshtokenInvalidError() }
+    if (user.enabled == false) { throw new UserDisabledError(); }
     if (!jwtPayload["permissions"]) { throw new NoPermissionError(); }
 
     action.response.local = {}
@@ -63,6 +64,7 @@ const refresh = async (action: Action) => {
 
     const user = await getConnectionManager().get().getRepository(User).findOne({ id: jwtPayload["id"], refreshTokenCount: jwtPayload["refreshTokenCount"] }, { relations: ['permissions', 'groups', 'groups.permissions'] })
     if (!user) { throw new UserNonexistantOrRefreshtokenInvalidError() }
+    if (user.enabled == false) { throw new UserDisabledError(); }
 
     let newAccess = JwtCreator.createAccess(user);
     action.response.header("authorization", "Bearer " + newAccess);

src/config.ts

@@ -1,10 +1,13 @@
 import { config as configDotenv } from 'dotenv';
+import ValidatorJS from 'validator';
+
 configDotenv();
 export const config = {
     internal_port: parseInt(process.env.APP_PORT) || 4010,
     development: process.env.NODE_ENV === "production",
     jwt_secret: process.env.JWT_SECRET || "secretjwtsecret",
-    phone_validation_countrycode: process.env.PHONE_COUNTRYCODE || "ZZ"
+    phone_validation_countrycode: process.env.PHONE_COUNTRYCODE || "ZZ",
+    postalcode_validation_countrycode: getPostalCodeLocale()
 }
 let errors = 0
 if (typeof config.internal_port !== "number") {
@@ -19,4 +22,13 @@ if (config.phone_validation_countrycode.length !== 2) {
 if (typeof config.development !== "boolean") {
     errors++
 }
+function getPostalCodeLocale(): any {
+    try {
+        const stringArray: String[] = ValidatorJS.isPostalCodeLocales;
+        let index = stringArray.indexOf(process.env.POSTALCODE_COUNTRYCODE);
+        return ValidatorJS.isPostalCodeLocales[index];
+    } catch (error) {
+        return null;
+    }
+}
 export let e = errors

src/controllers/AuthController.ts

@@ -1,10 +1,12 @@
-import { Body, CookieParam, JsonController, Post, Res } from 'routing-controllers';
+import { Body, CookieParam, JsonController, Param, Post, Req, Res } from 'routing-controllers';
 import { OpenAPI, ResponseSchema } from 'routing-controllers-openapi';
 import { IllegalJWTError, InvalidCredentialsError, JwtNotProvidedError, PasswordNeededError, RefreshTokenCountInvalidError, UsernameOrEmailNeededError } from '../errors/AuthError';
 import { UserNotFoundError } from '../errors/UserErrors';
 import { CreateAuth } from '../models/actions/CreateAuth';
+import { CreateResetToken } from '../models/actions/CreateResetToken';
 import { HandleLogout } from '../models/actions/HandleLogout';
 import { RefreshAuth } from '../models/actions/RefreshAuth';
+import { ResetPassword } from '../models/actions/ResetPassword';
 import { Auth } from '../models/responses/ResponseAuth';
 import { Logout } from '../models/responses/ResponseLogout';
 
@@ -20,7 +22,7 @@ export class AuthController {
 	@ResponseSchema(UsernameOrEmailNeededError)
 	@ResponseSchema(PasswordNeededError)
 	@ResponseSchema(InvalidCredentialsError)
-	@OpenAPI({ description: 'Create a new access token object' })
+	@OpenAPI({ description: 'Login with your username/email and password. <br> You will receive: \n * access token (use it as a bearer token) \n * refresh token (will also be sent as a cookie)' })
 	async login(@Body({ validate: true }) createAuth: CreateAuth, @Res() response: any) {
 		let auth;
 		try {
@@ -40,7 +42,7 @@ export class AuthController {
 	@ResponseSchema(UsernameOrEmailNeededError)
 	@ResponseSchema(PasswordNeededError)
 	@ResponseSchema(InvalidCredentialsError)
-	@OpenAPI({ description: 'Create a new access token object' })
+	@OpenAPI({ description: 'Logout using your refresh token. <br> This instantly invalidates all your access and refresh tokens.', security: [{ "RefreshTokenCookie": [] }] })
 	async logout(@Body({ validate: true }) handleLogout: HandleLogout, @CookieParam("lfk_backend__refresh_token") refresh_token: string, @Res() response: any) {
 		if (refresh_token && refresh_token.length != 0 && handleLogout.token == undefined) {
 			handleLogout.token = refresh_token;
@@ -63,11 +65,12 @@ export class AuthController {
 	@ResponseSchema(IllegalJWTError)
 	@ResponseSchema(UserNotFoundError)
 	@ResponseSchema(RefreshTokenCountInvalidError)
-	@OpenAPI({ description: 'refresh a access token' })
-	async refresh(@Body({ validate: true }) refreshAuth: RefreshAuth, @CookieParam("lfk_backend__refresh_token") refresh_token: string, @Res() response: any) {
+	@OpenAPI({ description: 'Refresh your access and refresh tokens using a valid refresh token. <br> You will receive: \n * access token (use it as a bearer token) \n * refresh token (will also be sent as a cookie)', security: [{ "RefreshTokenCookie": [] }] })
+	async refresh(@Body({ validate: true }) refreshAuth: RefreshAuth, @CookieParam("lfk_backend__refresh_token") refresh_token: string, @Res() response: any, @Req() req: any) {
 		if (refresh_token && refresh_token.length != 0 && refreshAuth.token == undefined) {
 			refreshAuth.token = refresh_token;
 		}
+		console.log(req.headers)
 		let auth;
 		try {
 			auth = await refreshAuth.toAuth();
@@ -78,4 +81,24 @@ export class AuthController {
 		}
 		return response.send(auth)
 	}
+
+	@Post("/reset")
+	@ResponseSchema(Auth)
+	@ResponseSchema(UserNotFoundError)
+	@ResponseSchema(UsernameOrEmailNeededError)
+	@OpenAPI({ description: "Request a password reset token. <br> This will provide you with a reset token that you can use by posting to /api/auth/reset/{token}." })
+	async getResetToken(@Body({ validate: true }) passwordReset: CreateResetToken) {
+		//This really shouldn't just get returned, but sent via mail or sth like that. But for dev only this is fine.
+		return { "resetToken": await passwordReset.toResetToken() };
+	}
+
+	@Post("/reset/:token")
+	@ResponseSchema(Auth)
+	@ResponseSchema(UserNotFoundError)
+	@ResponseSchema(UsernameOrEmailNeededError)
+	@OpenAPI({ description: "Reset a user's utilising a valid password reset token. <br> This will set the user's password to the one you provided in the body. <br> To get a reset token post to /api/auth/reset with your username." })
+	async resetPassword(@Param("token") token: string, @Body({ validate: true }) passwordReset: ResetPassword) {
+		passwordReset.resetToken = token;
+		return await passwordReset.resetPassword();
+	}
 }

src/controllers/ImportController.ts

@@ -10,7 +10,7 @@ import { RunnerController } from './RunnerController';
 
 @Controller()
 @Authorized(["RUNNER:IMPORT", "TEAM:IMPORT"])
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class ImportController {
     private runnerController: RunnerController;
 
@@ -26,7 +26,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from json and insert them (or their teams) into the provided group" })
+    @OpenAPI({ description: "Create new runners from json and insert them into the provided group. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postJSON(@Body({ validate: true, type: ImportRunner }) importRunners: ImportRunner[], @QueryParam("group") groupID: number) {
         if (!groupID) { throw new RunnerGroupNeededError(); }
         let responseRunners: ResponseRunner[] = new Array<ResponseRunner>();
@@ -41,7 +41,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from json and insert them (or their teams) into the provided org" })
+    @OpenAPI({ description: "Create new runners from json and insert them into the provided org. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postOrgsJSON(@Body({ validate: true, type: ImportRunner }) importRunners: ImportRunner[], @Param('id') id: number) {
         return await this.postJSON(importRunners, id)
     }
@@ -62,7 +62,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from csv and insert them (or their teams) into the provided group" })
+    @OpenAPI({ description: "Create new runners from csv and insert them into the provided group. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postCSV(@Req() request: any, @QueryParam("group") groupID: number) {
         let csvParse = await csv({ delimiter: [",", ";"], trim: true }).fromString(request.rawBody.toString());
         let importRunners: ImportRunner[] = new Array<ImportRunner>();
@@ -84,7 +84,7 @@ export class ImportController {
     @ResponseSchema(ResponseRunner, { isArray: true, statusCode: 200 })
     @ResponseSchema(RunnerGroupNotFoundError, { statusCode: 404 })
     @ResponseSchema(RunnerGroupNeededError, { statusCode: 406 })
-    @OpenAPI({ description: "Create new runners from csv and insert them (or their teams) into the provided org" })
+    @OpenAPI({ description: "Create new runners from csv and insert them into the provided org. <br> If teams/classes are provided alongside the runner's name they'll automaticly be created under the provided org and the runners will be inserted into the teams instead." })
     async postOrgsCSV(@Req() request: any, @Param("id") id: number) {
         return await this.postCSV(request, id);
     }

src/controllers/PermissionController.ts

@@ -12,7 +12,7 @@ import { ResponsePrincipal } from '../models/responses/ResponsePrincipal';
 
 
 @JsonController('/permissions')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class PermissionController {
     private permissionRepository: Repository<Permission>;
 
@@ -26,7 +26,7 @@ export class PermissionController {
     @Get()
     @Authorized("PERMISSION:GET")
     @ResponseSchema(ResponsePermission, { isArray: true })
-    @OpenAPI({ description: 'Lists all permissions.' })
+    @OpenAPI({ description: 'Lists all permissions for all users and groups.' })
     async getAll() {
         let responsePermissions: ResponsePermission[] = new Array<ResponsePermission>();
         const permissions = await this.permissionRepository.find({ relations: ['principal'] });
@@ -42,7 +42,7 @@ export class PermissionController {
     @ResponseSchema(ResponsePermission)
     @ResponseSchema(PermissionNotFoundError, { statusCode: 404 })
     @OnUndefined(PermissionNotFoundError)
-    @OpenAPI({ description: 'Returns a permissions of a specified id (if it exists)' })
+    @OpenAPI({ description: 'Lists all information about the permission whose id got provided.' })
     async getOne(@Param('id') id: number) {
         let permission = await this.permissionRepository.findOne({ id: id }, { relations: ['principal'] });
         if (!permission) { throw new PermissionNotFoundError(); }
@@ -54,7 +54,7 @@ export class PermissionController {
     @Authorized("PERMISSION:CREATE")
     @ResponseSchema(ResponsePermission)
     @ResponseSchema(PrincipalNotFoundError, { statusCode: 404 })
-    @OpenAPI({ description: 'Create a new runnerTeam object (id will be generated automagicly).' })
+    @OpenAPI({ description: 'Create a new permission for a existing principal(user/group). <br> If a permission with this target, action and prinicpal already exists that permission will be returned instead of creating a new one.' })
     async post(@Body({ validate: true }) createPermission: CreatePermission) {
         let permission;
         try {
@@ -79,7 +79,7 @@ export class PermissionController {
     @ResponseSchema(PrincipalNotFoundError, { statusCode: 404 })
     @ResponseSchema(PermissionIdsNotMatchingError, { statusCode: 406 })
     @ResponseSchema(PermissionNeedsPrincipalError, { statusCode: 406 })
-    @OpenAPI({ description: "Update a permission object (id can't be changed)." })
+    @OpenAPI({ description: "Update a permission object. <br> If updateing the permission object would result in duplicate permission (same target, action and principal) this permission will get deleted and the existing permission will be returned. <br> Please remember that ids can't be changed." })
     async put(@Param('id') id: number, @Body({ validate: true }) permission: UpdatePermission) {
         let oldPermission = await this.permissionRepository.findOne({ id: id }, { relations: ['principal'] });
 
@@ -106,7 +106,7 @@ export class PermissionController {
     @ResponseSchema(ResponsePermission)
     @ResponseSchema(ResponseEmpty, { statusCode: 204 })
     @OnUndefined(204)
-    @OpenAPI({ description: 'Delete a specified permission (if it exists).' })
+    @OpenAPI({ description: 'Deletes the permission whose id you provide. <br> If no permission with this id exists it will just return 204(no content).' })
     async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
         let permission = await this.permissionRepository.findOne({ id: id }, { relations: ['principal'] });
         if (!permission) { return null; }

src/controllers/RunnerController.ts

@@ -10,7 +10,7 @@ import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseRunner } from '../models/responses/ResponseRunner';
 
 @JsonController('/runners')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class RunnerController {
 	private runnerRepository: Repository<Runner>;
 
@@ -24,7 +24,7 @@ export class RunnerController {
 	@Get()
 	@Authorized("RUNNER:GET")
 	@ResponseSchema(ResponseRunner, { isArray: true })
-	@OpenAPI({ description: 'Lists all runners.' })
+	@OpenAPI({ description: 'Lists all runners from all teams/orgs. <br> This includes the runner\'s group and distance ran.' })
 	async getAll() {
 		let responseRunners: ResponseRunner[] = new Array<ResponseRunner>();
 		const runners = await this.runnerRepository.find({ relations: ['scans', 'group'] });
@@ -39,7 +39,7 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
 	@OnUndefined(RunnerNotFoundError)
-	@OpenAPI({ description: 'Returns a runner of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the runner whose id got provided.' })
 	async getOne(@Param('id') id: number) {
 		let runner = await this.runnerRepository.findOne({ id: id }, { relations: ['scans', 'group'] })
 		if (!runner) { throw new RunnerNotFoundError(); }
@@ -51,7 +51,7 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(RunnerGroupNeededError)
 	@ResponseSchema(RunnerGroupNotFoundError)
-	@OpenAPI({ description: 'Create a new runner object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new runner. <br> Please remeber to provide the runner\'s group\'s id.' })
 	async post(@Body({ validate: true }) createRunner: CreateRunner) {
 		let runner;
 		try {
@@ -69,7 +69,7 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(RunnerNotFoundError, { statusCode: 404 })
 	@ResponseSchema(RunnerIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a runner object (id can't be changed)." })
+	@OpenAPI({ description: "Update the runner whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) runner: UpdateRunner) {
 		let oldRunner = await this.runnerRepository.findOne({ id: id }, { relations: ['group'] });
 
@@ -90,7 +90,7 @@ export class RunnerController {
 	@ResponseSchema(ResponseRunner)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified runner (if it exists).' })
+	@OpenAPI({ description: 'Delete the runner whose id you provided. <br> If no runner with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let runner = await this.runnerRepository.findOne({ id: id });
 		if (!runner) { return null; }

src/controllers/RunnerOrganisationController.ts

@@ -12,7 +12,7 @@ import { RunnerTeamController } from './RunnerTeamController';
 
 
 @JsonController('/organisations')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class RunnerOrganisationController {
 	private runnerOrganisationRepository: Repository<RunnerOrganisation>;
 
@@ -26,7 +26,7 @@ export class RunnerOrganisationController {
 	@Get()
 	@Authorized("ORGANISATION:GET")
 	@ResponseSchema(ResponseRunnerOrganisation, { isArray: true })
-	@OpenAPI({ description: 'Lists all runnerOrganisations.' })
+	@OpenAPI({ description: 'Lists all organisations. <br> This includes their address, contact and teams (if existing/associated).' })
 	async getAll() {
 		let responseTeams: ResponseRunnerOrganisation[] = new Array<ResponseRunnerOrganisation>();
 		const runners = await this.runnerOrganisationRepository.find({ relations: ['address', 'contact', 'teams'] });
@@ -41,7 +41,7 @@ export class RunnerOrganisationController {
 	@ResponseSchema(ResponseRunnerOrganisation)
 	@ResponseSchema(RunnerOrganisationNotFoundError, { statusCode: 404 })
 	@OnUndefined(RunnerOrganisationNotFoundError)
-	@OpenAPI({ description: 'Returns a runnerOrganisation of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the organisation whose id got provided.' })
 	async getOne(@Param('id') id: number) {
 		let runnerOrg = await this.runnerOrganisationRepository.findOne({ id: id }, { relations: ['address', 'contact', 'teams'] });
 		if (!runnerOrg) { throw new RunnerOrganisationNotFoundError(); }
@@ -51,7 +51,7 @@ export class RunnerOrganisationController {
 	@Post()
 	@Authorized("ORGANISATION:CREATE")
 	@ResponseSchema(ResponseRunnerOrganisation)
-	@OpenAPI({ description: 'Create a new runnerOrganisation object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new organsisation.' })
 	async post(@Body({ validate: true }) createRunnerOrganisation: CreateRunnerOrganisation) {
 		let runnerOrganisation;
 		try {
@@ -70,7 +70,7 @@ export class RunnerOrganisationController {
 	@ResponseSchema(ResponseRunnerOrganisation)
 	@ResponseSchema(RunnerOrganisationNotFoundError, { statusCode: 404 })
 	@ResponseSchema(RunnerOrganisationIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a runnerOrganisation object (id can't be changed)." })
+	@OpenAPI({ description: "Update the organisation whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) updateOrganisation: UpdateRunnerOrganisation) {
 		let oldRunnerOrganisation = await this.runnerOrganisationRepository.findOne({ id: id });
 
@@ -94,7 +94,7 @@ export class RunnerOrganisationController {
 	@ResponseSchema(RunnerOrganisationHasTeamsError, { statusCode: 406 })
 	@ResponseSchema(RunnerOrganisationHasRunnersError, { statusCode: 406 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified runnerOrganisation (if it exists).' })
+	@OpenAPI({ description: 'Delete the organsisation whose id you provided. <br> If the organisation still has runners and/or teams associated this will fail. <br> To delete the organisation with all associated runners and teams set the force QueryParam to true (cascading deletion might take a while). <br> If no organisation with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let organisation = await this.runnerOrganisationRepository.findOne({ id: id });
 		if (!organisation) { return null; }

src/controllers/RunnerTeamController.ts

@@ -11,7 +11,7 @@ import { RunnerController } from './RunnerController';
 
 
 @JsonController('/teams')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class RunnerTeamController {
 	private runnerTeamRepository: Repository<RunnerTeam>;
 
@@ -25,7 +25,7 @@ export class RunnerTeamController {
 	@Get()
 	@Authorized("TEAM:GET")
 	@ResponseSchema(ResponseRunnerTeam, { isArray: true })
-	@OpenAPI({ description: 'Lists all runnerTeams.' })
+	@OpenAPI({ description: 'Lists all teams. <br> This includes their parent organisation and contact (if existing/associated).' })
 	async getAll() {
 		let responseTeams: ResponseRunnerTeam[] = new Array<ResponseRunnerTeam>();
 		const runners = await this.runnerTeamRepository.find({ relations: ['parentGroup', 'contact'] });
@@ -40,7 +40,7 @@ export class RunnerTeamController {
 	@ResponseSchema(ResponseRunnerTeam)
 	@ResponseSchema(RunnerTeamNotFoundError, { statusCode: 404 })
 	@OnUndefined(RunnerTeamNotFoundError)
-	@OpenAPI({ description: 'Returns a runnerTeam of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the team whose id got provided.' })
 	async getOne(@Param('id') id: number) {
 		let runnerTeam = await this.runnerTeamRepository.findOne({ id: id }, { relations: ['parentGroup', 'contact'] });
 		if (!runnerTeam) { throw new RunnerTeamNotFoundError(); }
@@ -50,7 +50,7 @@ export class RunnerTeamController {
 	@Post()
 	@Authorized("TEAM:CREATE")
 	@ResponseSchema(ResponseRunnerTeam)
-	@OpenAPI({ description: 'Create a new runnerTeam object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new organsisation. <br> Please remember to provide it\'s parent group\'s id.' })
 	async post(@Body({ validate: true }) createRunnerTeam: CreateRunnerTeam) {
 		let runnerTeam;
 		try {
@@ -70,7 +70,7 @@ export class RunnerTeamController {
 	@ResponseSchema(ResponseRunnerTeam)
 	@ResponseSchema(RunnerTeamNotFoundError, { statusCode: 404 })
 	@ResponseSchema(RunnerTeamIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a runnerTeam object (id can't be changed)." })
+	@OpenAPI({ description: "Update the team whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) runnerTeam: UpdateRunnerTeam) {
 		let oldRunnerTeam = await this.runnerTeamRepository.findOne({ id: id }, { relations: ['parentGroup', 'contact'] });
 
@@ -93,7 +93,7 @@ export class RunnerTeamController {
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@ResponseSchema(RunnerTeamHasRunnersError, { statusCode: 406 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified runnerTeam (if it exists).' })
+	@OpenAPI({ description: 'Delete the team whose id you provided. <br> If the team still has runners associated this will fail. <br> To delete the team with all associated runners set the force QueryParam to true (cascading deletion might take a while). <br> If no team with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let team = await this.runnerTeamRepository.findOne({ id: id });
 		if (!team) { return null; }

src/controllers/StatusController.ts

@@ -6,7 +6,7 @@ import { getConnection } from 'typeorm';
 export class StatusController {
 
     @Get()
-    @OpenAPI({ description: "Lists all tracks." })
+    @OpenAPI({ description: "A very basic status/health endpoint that just checks if the database connection is available. <br> The available information depth will be expanded later." })
     get() {
         let connection;
         try {

src/controllers/TrackController.ts

@@ -9,7 +9,7 @@ import { ResponseEmpty } from '../models/responses/ResponseEmpty';
 import { ResponseTrack } from '../models/responses/ResponseTrack';
 
 @JsonController('/tracks')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class TrackController {
 	private trackRepository: Repository<Track>;
 
@@ -23,6 +23,7 @@ export class TrackController {
 	@Get()
 	@Authorized("TRACK:GET")
 	@ResponseSchema(ResponseTrack, { isArray: true })
+	@OpenAPI({ description: 'Lists all tracks.' })
 	async getAll() {
 		let responseTracks: ResponseTrack[] = new Array<ResponseTrack>();
 		const tracks = await this.trackRepository.find();
@@ -37,7 +38,7 @@ export class TrackController {
 	@ResponseSchema(ResponseTrack)
 	@ResponseSchema(TrackNotFoundError, { statusCode: 404 })
 	@OnUndefined(TrackNotFoundError)
-	@OpenAPI({ description: "Returns a track of a specified id (if it exists)" })
+	@OpenAPI({ description: "Lists all information about the track whose id got provided." })
 	async getOne(@Param('id') id: number) {
 		let track = await this.trackRepository.findOne({ id: id });
 		if (!track) { throw new TrackNotFoundError(); }
@@ -47,7 +48,7 @@ export class TrackController {
 	@Post()
 	@Authorized("TRACK:CREATE")
 	@ResponseSchema(ResponseTrack)
-	@OpenAPI({ description: "Create a new track object (id will be generated automagicly)." })
+	@OpenAPI({ description: "Create a new track. <br> Please remember that the track\'s distance must be greater than 0." })
 	async post(
 		@Body({ validate: true })
 		track: CreateTrack
@@ -60,7 +61,7 @@ export class TrackController {
 	@ResponseSchema(ResponseTrack)
 	@ResponseSchema(TrackNotFoundError, { statusCode: 404 })
 	@ResponseSchema(TrackIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a track object (id can't be changed)." })
+	@OpenAPI({ description: "Update the track whose id you provided. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @EntityFromBody() track: Track) {
 		let oldTrack = await this.trackRepository.findOne({ id: id });
 
@@ -81,7 +82,7 @@ export class TrackController {
 	@ResponseSchema(ResponseTrack)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@OnUndefined(204)
-	@OpenAPI({ description: "Delete a specified track (if it exists)." })
+	@OpenAPI({ description: "Delete the track whose id you provided. <br> If no track with this id exists it will just return 204(no content)." })
 	async remove(@Param("id") id: number) {
 		let track = await this.trackRepository.findOne({ id: id });
 		if (!track) { return null; }

src/controllers/UserController.ts

@@ -12,7 +12,7 @@ import { PermissionController } from './PermissionController';
 
 
 @JsonController('/users')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class UserController {
 	private userRepository: Repository<User>;
 
@@ -26,7 +26,7 @@ export class UserController {
 	@Get()
 	@Authorized("USER:GET")
 	@ResponseSchema(User, { isArray: true })
-	@OpenAPI({ description: 'Lists all users.' })
+	@OpenAPI({ description: 'Lists all users. <br> This includes their groups and permissions directly granted to them (if existing/associated).' })
 	async getAll() {
 		let responseUsers: ResponseUser[] = new Array<ResponseUser>();
 		const users = await this.userRepository.find({ relations: ['permissions', 'groups'] });
@@ -41,7 +41,7 @@ export class UserController {
 	@ResponseSchema(User)
 	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
 	@OnUndefined(UserNotFoundError)
-	@OpenAPI({ description: 'Returns a user of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the user whose id got provided. <br> Please remember that only permissions granted directly to the user will show up here, not permissions inherited from groups.' })
 	async getOne(@Param('id') id: number) {
 		let user = await this.userRepository.findOne({ id: id }, { relations: ['permissions', 'groups'] })
 		if (!user) { throw new UserNotFoundError(); }
@@ -52,7 +52,7 @@ export class UserController {
 	@Authorized("USER:CREATE")
 	@ResponseSchema(User)
 	@ResponseSchema(UserGroupNotFoundError)
-	@OpenAPI({ description: 'Create a new user object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new user. <br> If you want to grant permissions to the user you have to create them seperately by posting to /api/permissions after creating the user.' })
 	async post(@Body({ validate: true }) createUser: CreateUser) {
 		let user;
 		try {
@@ -62,7 +62,7 @@ export class UserController {
 		}
 
 		user = await this.userRepository.save(user)
-		return new ResponseUser(await this.userRepository.findOne(user, { relations: ['permissions', 'groups'] }));
+		return new ResponseUser(await this.userRepository.findOne({ id: user.id }, { relations: ['permissions', 'groups'] }));
 	}
 
 	@Put('/:id')
@@ -70,7 +70,7 @@ export class UserController {
 	@ResponseSchema(User)
 	@ResponseSchema(UserNotFoundError, { statusCode: 404 })
 	@ResponseSchema(UserIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a user object (id can't be changed)." })
+	@OpenAPI({ description: "Update the user whose id you provided. <br> To change the permissions directly granted to the user please use /api/permissions instead. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @Body({ validate: true }) updateUser: UpdateUser) {
 		let oldUser = await this.userRepository.findOne({ id: id });
 
@@ -91,7 +91,7 @@ export class UserController {
 	@ResponseSchema(User)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a user runner (if it exists).' })
+	@OpenAPI({ description: 'Delete the user whose id you provided. <br> If there are any permissions directly granted to the user they will get deleted as well. <br> If no user with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
 		let user = await this.userRepository.findOne({ id: id });
 		if (!user) { return null; }

src/controllers/UserGroupController.ts

@@ -11,7 +11,7 @@ import { PermissionController } from './PermissionController';
 
 
 @JsonController('/usergroups')
-@OpenAPI({ security: [{ "AuthToken": [] }] })
+@OpenAPI({ security: [{ "AuthToken": [] }, { "RefreshTokenCookie": [] }] })
 export class UserGroupController {
 	private userGroupsRepository: Repository<UserGroup>;
 
@@ -25,9 +25,9 @@ export class UserGroupController {
 	@Get()
 	@Authorized("USERGROUP:GET")
 	@ResponseSchema(UserGroup, { isArray: true })
-	@OpenAPI({ description: 'Lists all usergroups.' })
+	@OpenAPI({ description: 'Lists all groups. <br> The information provided might change while the project continues to evolve.' })
 	getAll() {
-		return this.userGroupsRepository.find();
+		return this.userGroupsRepository.find({ relations: ["permissions"] });
 	}
 
 	@Get('/:id')
@@ -35,16 +35,16 @@ export class UserGroupController {
 	@ResponseSchema(UserGroup)
 	@ResponseSchema(UserGroupNotFoundError, { statusCode: 404 })
 	@OnUndefined(UserGroupNotFoundError)
-	@OpenAPI({ description: 'Returns a usergroup of a specified id (if it exists)' })
+	@OpenAPI({ description: 'Lists all information about the group whose id got provided. <br> The information provided might change while the project continues to evolve.' })
 	getOne(@Param('id') id: number) {
-		return this.userGroupsRepository.findOne({ id: id });
+		return this.userGroupsRepository.findOne({ id: id }, { relations: ["permissions"] });
 	}
 
 	@Post()
 	@Authorized("USERGROUP:CREATE")
 	@ResponseSchema(UserGroup)
 	@ResponseSchema(UserGroupNotFoundError)
-	@OpenAPI({ description: 'Create a new usergroup object (id will be generated automagicly).' })
+	@OpenAPI({ description: 'Create a new group. <br> If you want to grant permissions to the group you have to create them seperately by posting to /api/permissions after creating the group.' })
 	async post(@Body({ validate: true }) createUserGroup: CreateUserGroup) {
 		let userGroup;
 		try {
@@ -61,9 +61,9 @@ export class UserGroupController {
 	@ResponseSchema(UserGroup)
 	@ResponseSchema(UserGroupNotFoundError, { statusCode: 404 })
 	@ResponseSchema(UserGroupIdsNotMatchingError, { statusCode: 406 })
-	@OpenAPI({ description: "Update a usergroup object (id can't be changed)." })
+	@OpenAPI({ description: "Update the group whose id you provided. <br> To change the permissions granted to the group please use /api/permissions instead. <br> Please remember that ids can't be changed." })
 	async put(@Param('id') id: number, @EntityFromBody() userGroup: UserGroup) {
-		let oldUserGroup = await this.userGroupsRepository.findOne({ id: id });
+		let oldUserGroup = await this.userGroupsRepository.findOne({ id: id }, { relations: ["permissions"] });
 
 		if (!oldUserGroup) {
 			throw new UserGroupNotFoundError()
@@ -82,11 +82,11 @@ export class UserGroupController {
 	@ResponseSchema(ResponseUserGroup)
 	@ResponseSchema(ResponseEmpty, { statusCode: 204 })
 	@OnUndefined(204)
-	@OpenAPI({ description: 'Delete a specified usergroup (if it exists).' })
+	@OpenAPI({ description: 'Delete the group whose id you provided. <br> If there are any permissions directly granted to the group they will get deleted as well. <br> Users associated with this group won\'t get deleted - just deassociated. <br> If no group with this id exists it will just return 204(no content).' })
 	async remove(@Param("id") id: number, @QueryParam("force") force: boolean) {
-		let group = await this.userGroupsRepository.findOne({ id: id });
+		let group = await this.userGroupsRepository.findOne({ id: id }, { relations: ["permissions"] });
 		if (!group) { return null; }
-		const responseGroup = await this.userGroupsRepository.findOne({ id: id }, { relations: ['permissions'] });;
+		const responseGroup = await this.userGroupsRepository.findOne({ id: id }, { relations: ['permissions'] });
 
 		const permissionControler = new PermissionController();
 		for (let permission of responseGroup.permissions) {

src/errors/AuthError.ts

@@ -115,4 +115,26 @@ export class RefreshTokenCountInvalidError extends NotAcceptableError {
 
 	@IsString()
 	message = "Refresh token count is invalid."
+}
+
+/**
+ * Error to throw when someone tryes to reset a user's password more than once in 15 minutes.
+ */
+export class ResetAlreadyRequestedError extends NotAcceptableError {
+	@IsString()
+	name = "ResetAlreadyRequestedError"
+
+	@IsString()
+	message = "You already requested a password reset in the last 15 minutes. \n Please wait until the old reset code expires before requesting a new one."
+}
+
+/**
+ * Error to throw when someone tries a disabled user's password or login as a disabled user.
+ */
+export class UserDisabledError extends NotAcceptableError {
+	@IsString()
+	name = "UserDisabledError"
+
+	@IsString()
+	message = "This user is currently disabled. \n Please contact your administrator if this is a mistake."
 }

src/jwtcreator.ts

@@ -33,6 +33,20 @@ export class JwtCreator {
             exp: expiry_timestamp
         }, config.jwt_secret)
     }
+
+    /**
+     * Creates a new password reset token for a given user.
+     * The token is valid for 15 minutes or 1 use - whatever comes first.
+     * @param user User entity that the password reset token shall be created for
+     */
+    public static createReset(user: User) {
+        let expiry_timestamp = Math.floor(Date.now() / 1000) + 15 * 60;
+        return jsonwebtoken.sign({
+            id: user.id,
+            refreshTokenCount: user.refreshTokenCount,
+            exp: expiry_timestamp
+        }, config.jwt_secret)
+    }
 }
 
 /**

src/loaders/openapi.ts

@@ -1,8 +1,8 @@
 import { validationMetadatasToSchemas } from "class-validator-jsonschema";
-import { Application } from "express";
+import express, { Application } from "express";
+import path from 'path';
 import { getMetadataArgsStorage } from "routing-controllers";
 import { routingControllersToSpec } from "routing-controllers-openapi";
-import * as swaggerUiExpress from "swagger-ui-express";
 
 /**
  * Loader for everything openapi related - from creating the schema to serving it via a static route and swaggerUiExpress.
@@ -29,28 +29,25 @@ export default async (app: Application) => {
             "scheme": "bearer",
             "bearerFormat": "JWT",
             description: "A JWT based access token. Use /api/auth/login or /api/auth/refresh to get one."
+          },
+          "RefreshTokenCookie": {
+            "type": "apiKey",
+            "in": "cookie",
+            "name": "lfk_backend__refresh_token",
+            description: "A cookie containing a JWT based refreh token. Attention: Doesn't work in swagger-ui. Use /api/auth/login or /api/auth/refresh to get one."
           }
         }
       },
       info: {
         description: "The the backend API for the LfK! runner system.",
         title: "LfK! Backend API",
-        version: "1.0.0",
+        version: "0.0.5",
       },
     }
   );
-
-  //Options for swaggerUiExpress
-  const options = {
-    explorer: true,
-  };
-  app.use(
-    "/api/docs",
-    swaggerUiExpress.serve,
-    swaggerUiExpress.setup(spec, options)
-  );
-  app.get(["/api/openapi.json", "/api/swagger.json"], (req, res) => {
+  app.get(["/api/docs/openapi.json", "/api/docs/swagger.json"], (req, res) => {
     res.json(spec);
   });
+  app.use('/api/docs', express.static(path.join(__dirname, '../static/docs'), { index: "index.html", extensions: ['html'] }));
   return app;
 };

src/models/actions/CreateAddress.ts

@@ -1,4 +1,5 @@
 import { IsNotEmpty, IsOptional, IsPostalCode, IsString } from 'class-validator';
+import { config } from '../../config';
 import { Address } from '../entities/Address';
 
 /**
@@ -35,7 +36,7 @@ export class CreateAddress {
      */
     @IsString()
     @IsNotEmpty()
-    @IsPostalCode("DE")
+    @IsPostalCode(config.postalcode_validation_countrycode)
     postalcode: string;
 
     /**

src/models/actions/CreateAuth.ts

@@ -1,7 +1,7 @@
 import * as argon2 from "argon2";
 import { IsEmail, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
-import { InvalidCredentialsError, PasswordNeededError, UserNotFoundError } from '../../errors/AuthError';
+import { InvalidCredentialsError, PasswordNeededError, UserDisabledError, UserNotFoundError } from '../../errors/AuthError';
 import { UsernameOrEmailNeededError } from '../../errors/UserErrors';
 import { JwtCreator } from '../../jwtcreator';
 import { User } from '../entities/User';
@@ -55,6 +55,7 @@ export class CreateAuth {
         if (!found_user) {
             throw new UserNotFoundError();
         }
+        if (found_user.enabled == false) { throw new UserDisabledError(); }
         if (!(await argon2.verify(found_user.password, this.password + found_user.uuid))) {
             throw new InvalidCredentialsError();
         }

src/models/actions/CreateResetToken.ts

@@ -0,0 +1,50 @@
+import { IsEmail, IsOptional, IsString } from 'class-validator';
+import { getConnectionManager } from 'typeorm';
+import { ResetAlreadyRequestedError, UserDisabledError, UserNotFoundError } from '../../errors/AuthError';
+import { UsernameOrEmailNeededError } from '../../errors/UserErrors';
+import { JwtCreator } from '../../jwtcreator';
+import { User } from '../entities/User';
+
+/**
+ * This calss is used to create password reset tokens for users.
+ * These password reset token can be used to set a new password for the user for the next 15mins.
+ */
+export class CreateResetToken {
+    /**
+     * The username of the user that wants to reset their password.
+     */
+    @IsOptional()
+    @IsString()
+    username?: string;
+
+    /**
+     * The email address of the user that wants to reset their password.
+     */
+    @IsOptional()
+    @IsEmail()
+    @IsString()
+    email?: string;
+
+
+    /**
+     * Create a password reset token based on this.
+     */
+    public async toResetToken(): Promise<any> {
+        if (this.email === undefined && this.username === undefined) {
+            throw new UsernameOrEmailNeededError();
+        }
+        let found_user = await getConnectionManager().get().getRepository(User).findOne({ where: [{ username: this.username }, { email: this.email }] });
+        if (!found_user) { throw new UserNotFoundError(); }
+        if (found_user.enabled == false) { throw new UserDisabledError(); }
+        if (found_user.resetRequestedTimestamp > (Math.floor(Date.now() / 1000) - 15 * 60)) { throw new ResetAlreadyRequestedError(); }
+
+        found_user.refreshTokenCount = found_user.refreshTokenCount + 1;
+        found_user.resetRequestedTimestamp = Math.floor(Date.now() / 1000);
+        await getConnectionManager().get().getRepository(User).save(found_user);
+
+        //Create the reset token
+        let reset_token = JwtCreator.createReset(found_user);
+
+        return reset_token;
+    }
+}

src/models/actions/CreateUser.ts

@@ -1,5 +1,5 @@
 import * as argon2 from "argon2";
-import { IsEmail, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
+import { IsBoolean, IsEmail, IsOptional, IsPhoneNumber, IsString } from 'class-validator';
 import { getConnectionManager } from 'typeorm';
 import * as uuid from 'uuid';
 import { config } from '../../config';
@@ -63,6 +63,14 @@ export class CreateUser {
     @IsString()
     password: string;
 
+    /**
+     * Will the new user be enabled from the start?
+     * Default: true
+     */
+    @IsBoolean()
+    @IsOptional()
+    enabled?: boolean = true;
+
     /**
      * The new user's groups' id(s).
      * You can provide either one groupId or an array of groupIDs.
@@ -91,6 +99,7 @@ export class CreateUser {
         newUser.phone = this.phone
         newUser.password = await argon2.hash(this.password + newUser.uuid);
         newUser.groups = await this.getGroups();
+        newUser.enabled = this.enabled;
         //TODO: ProfilePics
 
         return newUser;

src/models/actions/RefreshAuth.ts

@@ -2,7 +2,7 @@ import { IsOptional, IsString } from 'class-validator';
 import * as jsonwebtoken from 'jsonwebtoken';
 import { getConnectionManager } from 'typeorm';
 import { config } from '../../config';
-import { IllegalJWTError, JwtNotProvidedError, RefreshTokenCountInvalidError, UserNotFoundError } from '../../errors/AuthError';
+import { IllegalJWTError, JwtNotProvidedError, RefreshTokenCountInvalidError, UserDisabledError, UserNotFoundError } from '../../errors/AuthError';
 import { JwtCreator } from "../../jwtcreator";
 import { User } from '../entities/User';
 import { Auth } from '../responses/ResponseAuth';
@@ -39,6 +39,7 @@ export class RefreshAuth {
         if (!found_user) {
             throw new UserNotFoundError()
         }
+        if (found_user.enabled == false) { throw new UserDisabledError(); }
         if (found_user.refreshTokenCount !== decoded["refreshTokenCount"]) {
             throw new RefreshTokenCountInvalidError()
         }

src/models/actions/ResetPassword.ts

@@ -0,0 +1,57 @@
+import * as argon2 from "argon2";
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import * as jsonwebtoken from 'jsonwebtoken';
+import { getConnectionManager } from 'typeorm';
+import { config } from '../../config';
+import { IllegalJWTError, JwtNotProvidedError, PasswordNeededError, RefreshTokenCountInvalidError, UserNotFoundError } from '../../errors/AuthError';
+import { User } from '../entities/User';
+
+/**
+ * This class can be used to reset a user's password.
+ * To set a new password the user needs to provide a valid password reset token.
+ */
+export class ResetPassword {
+    /**
+     * The reset token on which the password reset will be based.
+     */
+    @IsOptional()
+    @IsString()
+    resetToken?: string;
+
+    /**
+     * The user's new password
+     */
+    @IsNotEmpty()
+    @IsString()
+    password: string;
+
+
+    /**
+     * Create a password reset token based on this.
+     */
+    public async resetPassword(): Promise<any> {
+        if (!this.resetToken || this.resetToken === undefined) {
+            throw new JwtNotProvidedError()
+        }
+        if (!this.password || this.password === undefined) {
+            throw new PasswordNeededError()
+        }
+
+        let decoded;
+        try {
+            decoded = jsonwebtoken.verify(this.resetToken, config.jwt_secret)
+        } catch (error) {
+            throw new IllegalJWTError()
+        }
+
+        const found_user = await getConnectionManager().get().getRepository(User).findOne({ id: decoded["id"] });
+        if (!found_user) { throw new UserNotFoundError(); }
+        if (found_user.refreshTokenCount !== decoded["refreshTokenCount"]) { throw new RefreshTokenCountInvalidError(); }
+
+        found_user.refreshTokenCount = found_user.refreshTokenCount + 1;
+        found_user.password = await argon2.hash(this.password + found_user.uuid);
+        await getConnectionManager().get().getRepository(User).save(found_user);
+
+        return "password reset successfull";
+    }
+}

src/models/entities/Address.ts

@@ -6,6 +6,7 @@ import {
   IsString
 } from "class-validator";
 import { Column, Entity, OneToMany, PrimaryGeneratedColumn } from "typeorm";
+import { config } from '../../config';
 import { Participant } from "./Participant";
 import { RunnerOrganisation } from "./RunnerOrganisation";
 
@@ -52,12 +53,11 @@ export class Address {
   /**
    * The address's postal code.
    * This will get checked against the postal code syntax for the configured country.
-   * TODO: Implement the config option. 
    */
   @Column()
   @IsString()
   @IsNotEmpty()
-  @IsPostalCode("DE")
+  @IsPostalCode(config.postalcode_validation_countrycode)
   postalcode: string;
 
   /**

src/models/entities/User.ts

@@ -106,11 +106,20 @@ export class User extends Principal {
   * The user's profile picture.
   * We haven't decided yet if this will be a bas64 encoded image or just a link to the profile picture.
   */
-  @Column({ nullable: true, unique: true })
+  @Column({ nullable: true, unique: false })
   @IsString()
   @IsOptional()
   profilePic?: string;
 
+  /**
+  * The last time the user requested a password reset.
+  * Used to prevent spamming of the password reset route.
+  */
+  @Column({ nullable: true, unique: false })
+  @IsString()
+  @IsOptional()
+  resetRequestedTimestamp?: number;
+
   /**
    * The actions performed by this user.
    * For documentation purposes only, will be implemented later.

src/openapi_export.ts

@@ -36,14 +36,21 @@ const spec = routingControllersToSpec(
                 "AuthToken": {
                     "type": "http",
                     "scheme": "bearer",
-                    "bearerFormat": "JWT"
+                    "bearerFormat": "JWT",
+                    description: "A JWT based access token. Use /api/auth/login or /api/auth/refresh to get one."
+                },
+                "RefreshTokenCookie": {
+                    "type": "apiKey",
+                    "in": "cookie",
+                    "name": "lfk_backend__refresh_token",
+                    description: "A cookie containing a JWT based refreh token. Attention: Doesn't work in swagger-ui. Use /api/auth/login or /api/auth/refresh to get one."
                 }
             }
         },
         info: {
             description: "The the backend API for the LfK! runner system.",
             title: "LfK! Backend API",
-            version: "1.0.0",
+            version: "0.0.5",
         },
     }
 );

src/static/docs/index.html

@@ -0,0 +1,156 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>API Docs</title>
+    <style>
+        :root {
+            --bg-color: #fff;
+            --bg-secondary-color: #f3f3f6;
+            --color-primary: #14854f;
+            --color-lightGrey: #d2d6dd;
+            --color-grey: #747681;
+            --color-darkGrey: #3f4144;
+            --color-error: #d43939;
+            --color-success: #28bd14;
+            --grid-maxWidth: 120rem;
+            --grid-gutter: 2rem;
+            --font-size: 1.6rem;
+            --font-color: #333;
+            --font-family-sans: -apple-system, BlinkMacSystemFont, Avenir, "Avenir Next", "Segoe UI", "Roboto", "Oxygen", "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif;
+            --font-family-mono: monaco, "Consolas", "Lucida Console", monospace
+        }
+
+        html {
+            -webkit-box-sizing: border-box;
+            box-sizing: border-box;
+            font-size: 62.5%;
+            line-height: 1.15;
+            -ms-text-size-adjust: 100%;
+            -webkit-text-size-adjust: 100%
+        }
+
+        *,
+        :after,
+        :before {
+            -webkit-box-sizing: inherit;
+            box-sizing: inherit
+        }
+
+        body {
+            background-color: var(--bg-color);
+            line-height: 1.6;
+            font-size: var(--font-size);
+            color: var(--font-color);
+            font-family: Segoe UI, Helvetica Neue, sans-serif;
+            font-family: var(--font-family-sans);
+            margin: 0;
+            padding: 0
+        }
+
+        h3 {
+            font-weight: 500;
+            margin: .35em 0 .7em
+        }
+
+        h3 {
+            font-size: 1.5em
+        }
+
+        a {
+            color: var(--color-primary);
+            text-decoration: none
+        }
+
+        a:hover:not(.button) {
+            opacity: .75
+        }
+
+        input:not([type=checkbox]):not([type=radio]):not([type=submit]):not([type=color]):not([type=button]):not([type=reset]):not(:disabled):hover {
+            border-color: var(--color-grey)
+        }
+
+        ::-webkit-input-placeholder {
+            color: #bdbfc4
+        }
+
+        ::-moz-placeholder {
+            color: #bdbfc4
+        }
+
+        :-ms-input-placeholder {
+            color: #bdbfc4
+        }
+
+        ::-ms-input-placeholder {
+            color: #bdbfc4
+        }
+
+        .tabs {
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex
+        }
+
+        .tabs a {
+            text-decoration: none
+        }
+
+        .tabs>a {
+            padding: 1rem 2rem;
+            -webkit-box-flex: 0;
+            -ms-flex: 0 1 auto;
+            flex: 0 1 auto;
+            color: var(--color-darkGrey);
+            border-bottom: 2px solid var(--color-lightGrey);
+            text-align: center
+        }
+
+        .tabs>a:hover {
+            opacity: 1;
+            border-bottom: 2px solid var(--color-darkGrey)
+        }
+
+        .is-vertical-align {
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex;
+            -webkit-box-align: center;
+            -ms-flex-align: center;
+            align-items: center
+        }
+
+        .is-center {
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex;
+            -webkit-box-pack: center;
+            -ms-flex-pack: center;
+            justify-content: center
+        }
+
+        .is-center {
+            -webkit-box-align: center;
+            -ms-flex-align: center;
+            align-items: center
+        }
+    </style>
+</head>
+
+<body>
+    <div class="hero">
+        <div class="logo is-center is-vertical-align">
+            <h3>API Docs</h3>
+        </div>
+        <nav class="tabs is-center">
+            <a href="./redoc">ReDoc</a>
+            <a href="./swaggerui">SwaggerUI</a>
+            <a href="./rapidoc">RapiDoc</a>
+            <a href="./openapi.json">Raw Spec (json)</a>
+        </nav>
+    </div>
+</body>
+
+</html>

src/static/docs/rapidoc.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <script type="module" src="./rapidoc-min.js"></script>
+</head>
+<body>
+  <rapi-doc 
+    spec-url="/api/docs/openapi.json" 
+  > </rapi-doc>
+</body> 
+</html>

src/static/docs/redoc.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>ReDoc</title>
+    <meta charset="utf-8"/>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+      body {
+        margin: 0;
+        padding: 0;
+      }
+    </style>
+  </head>
+  <body>
+    <redoc spec-url='/api/docs/openapi.json'></redoc>
+    <script src="./redoc.standalone.js"> </script>
+  </body>
+</html>

src/static/docs/swaggerui.html

@@ -0,0 +1,58 @@
+<!-- HTML for static distribution bundle build -->
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <title>Swagger UI</title>
+    <link rel="stylesheet" type="text/css" href="./swagger-ui.css" >
+    <style>
+      html
+      {
+        box-sizing: border-box;
+        overflow: -moz-scrollbars-vertical;
+        overflow-y: scroll;
+      }
+
+      *,
+      *:before,
+      *:after
+      {
+        box-sizing: inherit;
+      }
+
+      body
+      {
+        margin:0;
+        background: #fafafa;
+      }
+    </style>
+  </head>
+
+  <body>
+    <div id="swagger-ui"></div>
+
+    <script src="./swagger-ui-bundle.js" charset="UTF-8"> </script>
+    <script src="./swagger-ui-standalone-preset.js" charset="UTF-8"> </script>
+    <script>
+    window.onload = function() {
+      // Begin Swagger UI call region
+      const ui = SwaggerUIBundle({
+        url: "/api/docs/openapi.json",
+        dom_id: '#swagger-ui',
+        deepLinking: true,
+        presets: [
+          SwaggerUIBundle.presets.apis,
+          SwaggerUIStandalonePreset
+        ],
+        plugins: [
+          SwaggerUIBundle.plugins.DownloadUrl
+        ],
+        layout: "StandaloneLayout"
+      })
+      // End Swagger UI call region
+
+      window.ui = ui
+    }
+  </script>
+  </body>
+</html>

src/tests/api_docs.spec.ts

@@ -0,0 +1,34 @@
+import axios from 'axios';
+import { config } from '../config';
+const base = "http://localhost:" + config.internal_port
+
+describe('GET /api/docs/openapi.json', () => {
+	it('OpenAPI Spec is availdable 200', async () => {
+		const res = await axios.get(base + '/api/docs/openapi.json');
+		expect(res.status).toEqual(200);
+	});
+});
+describe('GET /api/docs/swagger.json', () => {
+	it('OpenAPI Spec is availdable 200', async () => {
+		const res = await axios.get(base + '/api/docs/swagger.json');
+		expect(res.status).toEqual(200);
+	});
+});
+describe('GET /api/docs/swaggerui', () => {
+	it('swaggerui is availdable 200', async () => {
+		const res = await axios.get(base + '/api/docs/swaggerui');
+		expect(res.status).toEqual(200);
+	});
+});
+describe('GET /api/docs/redoc', () => {
+	it('redoc is availdable 200', async () => {
+		const res = await axios.get(base + '/api/docs/redoc');
+		expect(res.status).toEqual(200);
+	});
+});
+describe('GET /api/docs/rapidoc', () => {
+	it('rapidoc is availdable 200', async () => {
+		const res = await axios.get(base + '/api/docs/rapidoc');
+		expect(res.status).toEqual(200);
+	});
+});

src/tests/auth/auth_login.spec.ts

@@ -0,0 +1,56 @@
+import axios from 'axios';
+import { config } from '../../config';
+const base = "http://localhost:" + config.internal_port
+
+let axios_config;
+
+beforeAll(async () => {
+    axios_config = {
+        validateStatus: undefined
+    };
+});
+
+describe('POST /api/auth/login valid', () => {
+    it('valid login should return 200', async () => {
+        const res = await axios.post(base + '/api/auth/login', { username: "demo", password: "demo" }, axios_config);
+        expect(res.status).toEqual(200);
+        expect(res.headers['content-type']).toContain("application/json")
+    });
+});
+// ---------------
+describe('POST /api/auth/login invalid body', () => {
+    it('Loging without a body should return 400', async () => {
+        const res = await axios.post(base + '/api/auth/login', null, axios_config);
+        expect(res.status).toEqual(400);
+    });
+    it('Loging without a password should return 400', async () => {
+        const res = await axios.post(base + '/api/auth/login', { username: "demo" }, axios_config);
+        expect(res.status).toEqual(400);
+    });
+    it('Loging with invalid mail format should return 400', async () => {
+        const res = await axios.post(base + '/api/auth/login', { email: "demo", password: "demo" }, axios_config);
+        expect(res.status).toEqual(400);
+    });
+    it('Loging without a username/mail should return 404', async () => {
+        const res = await axios.post(base + '/api/auth/login', { password: "demo" }, axios_config);
+        expect(res.status).toEqual(404);
+    });
+});
+// ---------------
+describe('POST /api/auth/login nonexistant user', () => {
+    it('login with nonexistant username should return 404', async () => {
+        const res = await axios.post(base + '/api/auth/login', { username: "-1", password: "demo" }, axios_config);
+        expect(res.status).toEqual(404);
+    });
+    it('login with nonexistant mail should return 404', async () => {
+        const res = await axios.post(base + '/api/auth/login', { email: "test@example.com", password: "demo" }, axios_config);
+        expect(res.status).toEqual(404);
+    });
+});
+// ---------------
+describe('POST /api/auth/login wrong password', () => {
+    it('login with wrong password should return 401', async () => {
+        const res = await axios.post(base + '/api/auth/login', { username: "demo", password: "totallynotthecorrectpassword" }, axios_config);
+        expect(res.status).toEqual(401);
+    });
+});

src/tests/auth/auth_logout.spec.ts

@@ -0,0 +1,58 @@
+import axios from 'axios';
+import { config } from '../../config';
+
+const base = "http://localhost:" + config.internal_port
+
+const axios_config = {
+    validateStatus: undefined
+};;
+
+beforeAll(async () => {
+    const res_login = await axios.post(base + '/api/auth/login', { username: "demo", password: "demo" });
+    await axios.post(base + '/api/users', {
+        "firstname": "demo_logout",
+        "middlename": "demo_logout",
+        "lastname": "demo_logout",
+        "username": "demo_logout",
+        "password": "demo_logout"
+    }, {
+        headers: { "authorization": "Bearer " + res_login.data["access_token"] },
+        validateStatus: undefined
+    });
+});
+
+describe('POST /api/auth/logout valid', () => {
+    let refresh_coookie;
+    it('valid logout with token in cookie should return 200', async () => {
+        const res_login = await axios.post(base + '/api/auth/login', { username: "demo_logout", password: "demo_logout" });
+        refresh_coookie = res_login.headers["set-cookie"];
+        const res = await axios.post(base + '/api/auth/logout', null, {
+            headers: { "Cookie": refresh_coookie },
+            validateStatus: undefined
+        });
+        expect(res.status).toEqual(200);
+    });
+    it('valid logout with token in body should return 200', async () => {
+        const res_login = await axios.post(base + '/api/auth/login', { username: "demo_logout", password: "demo_logout" });
+        const res = await axios.post(base + '/api/auth/logout', { token: res_login.data["refresh_token"] }, axios_config);
+        expect(res.status).toEqual(200);
+    });
+    it('getting users after valid logout should return 401', async () => {
+        const res = await axios.get(base + '/api/users', {
+            headers: { "Cookie": refresh_coookie },
+            validateStatus: undefined
+        });
+        expect(res.status).toEqual(401);
+    });
+});
+// ---------------
+describe('POST /api/auth/logout ivalid', () => {
+    it('invalid logout without token should return 406', async () => {
+        const res = await axios.post(base + '/api/auth/logout', null, axios_config);
+        expect(res.status).toEqual(406);
+    });
+    it('invalid logout with invalid token in body should return 401', async () => {
+        const res = await axios.post(base + '/api/auth/logout', { token: "1" }, axios_config);
+        expect(res.status).toEqual(401);
+    });
+});

src/tests/auth/auth_refresh.spec.ts

@@ -0,0 +1,49 @@
+import axios from 'axios';
+import { config } from '../../config';
+
+const base = "http://localhost:" + config.internal_port
+
+const axios_config = {
+    validateStatus: undefined
+};;
+
+beforeAll(async () => {
+    const res_login = await axios.post(base + '/api/auth/login', { username: "demo", password: "demo" });
+    await axios.post(base + '/api/users', {
+        "firstname": "demo_refresh",
+        "middlename": "demo_refresh",
+        "lastname": "demo_refresh",
+        "username": "demo_refresh",
+        "password": "demo_refresh"
+    }, {
+        headers: { "authorization": "Bearer " + res_login.data["access_token"] },
+        validateStatus: undefined
+    });
+});
+
+describe('POST /api/auth/refresh valid', () => {
+    it('valid refresh with token in cookie should return 200', async () => {
+        const res_login = await axios.post(base + '/api/auth/login', { username: "demo_refresh", password: "demo_refresh" });
+        const res = await axios.post(base + '/api/auth/refresh', null, {
+            headers: { "Cookie": res_login.headers["set-cookie"] },
+            validateStatus: undefined
+        });
+        expect(res.status).toEqual(200);
+    });
+    it('valid refresh with token in body should return 200', async () => {
+        const res_login = await axios.post(base + '/api/auth/login', { username: "demo_refresh", password: "demo_refresh" });
+        const res = await axios.post(base + '/api/auth/refresh', { token: res_login.data["refresh_token"] }, axios_config);
+        expect(res.status).toEqual(200);
+    });
+});
+// ---------------
+describe('POST /api/auth/refresh ivalid', () => {
+    it('invalid refresh without token should return 406', async () => {
+        const res = await axios.post(base + '/api/auth/refresh', null, axios_config);
+        expect(res.status).toEqual(406);
+    });
+    it('invalid refresh with invalid token in body should return 401', async () => {
+        const res = await axios.post(base + '/api/auth/refresh', { token: "1" }, axios_config);
+        expect(res.status).toEqual(401);
+    });
+});

src/tests/auth/auth_reset.spec.ts

@@ -0,0 +1,75 @@
+import axios from 'axios';
+import { config } from '../../config';
+
+const base = "http://localhost:" + config.internal_port
+
+const axios_config = {
+    validateStatus: undefined
+};;
+
+beforeAll(async () => {
+    const res_login = await axios.post(base + '/api/auth/login', { username: "demo", password: "demo" });
+    await axios.post(base + '/api/users', {
+        "firstname": "demo_reset",
+        "middlename": "demo_reset",
+        "lastname": "demo_reset",
+        "username": "demo_reset",
+        "password": "demo_reset"
+    }, {
+        headers: { "authorization": "Bearer " + res_login.data["access_token"] },
+        validateStatus: undefined
+    });
+    await axios.post(base + '/api/users', {
+        "firstname": "demo_reset2",
+        "middlename": "demo_reset2",
+        "lastname": "demo_reset2",
+        "username": "demo_reset2",
+        "password": "demo_reset2"
+    }, {
+        headers: { "authorization": "Bearer " + res_login.data["access_token"] },
+        validateStatus: undefined
+    });
+});
+
+describe('POST /api/auth/reset valid', () => {
+    let reset_token;
+    it('valid reset token request should return 200', async () => {
+        const res1 = await axios.post(base + '/api/auth/reset', { username: "demo_reset" });
+        reset_token = res1.data.resetToken;
+        expect(res1.status).toEqual(200);
+    });
+    it('valid password reset should return 200', async () => {
+        const res2 = await axios.post(base + '/api/auth/reset/' + reset_token, { password: "demo" }, axios_config);
+        expect(res2.status).toEqual(200);
+    });
+    it('valid login after reset should return 200', async () => {
+        const res = await axios.post(base + '/api/auth/login', { username: "demo_reset", password: "demo" });
+        expect(res.status).toEqual(200);
+    });
+});
+// ---------------
+describe('POST /api/auth/reset invalid requests', () => {
+    it('request another password reset before the timeout should return 406', async () => {
+        const res1 = await axios.post(base + '/api/auth/reset', { username: "demo_reset2" }, axios_config);
+        const res2 = await axios.post(base + '/api/auth/reset', { username: "demo_reset2" }, axios_config);
+        expect(res2.status).toEqual(406);
+    });
+});
+// ---------------
+describe('POST /api/auth/reset invalid token', () => {
+    it('providing a invalid reset token should return 401', async () => {
+        const res2 = await axios.post(base + '/api/auth/reset/' + "123123", { password: "demo" }, axios_config);
+        expect(res2.status).toEqual(401);
+    });
+    it('providing no reset token should return 404', async () => {
+        const res2 = await axios.post(base + '/api/auth/reset/' + "", { password: "demo" }, axios_config);
+        expect(res2.status).toEqual(404);
+    });
+});
+// ---------------
+describe('POST /api/auth/reset invalid body', () => {
+    it('providing no password should return 400', async () => {
+        const res2 = await axios.post(base + '/api/auth/reset/' + "123123", null, axios_config);
+        expect(res2.status).toEqual(400);
+    });
+});

src/tests/firsttest.spec.ts

@@ -1,35 +0,0 @@
-import axios from 'axios';
-import { config } from '../config';
-const base = "http://localhost:" + config.internal_port
-
-let access_token;
-let axios_config;
-
-beforeAll(async () => {
-	const res = await axios.post(base + '/api/auth/login', { username: "demo", password: "demo" });
-	access_token = res.data["access_token"];
-	axios_config = {
-		headers: { "authorization": "Bearer " + access_token },
-		validateStatus: undefined
-	};
-});
-
-describe('GET /api/openapi.json', () => {
-	it('is http 200', async () => {
-		const res = await axios.get(base + '/api/openapi.json');
-		expect(res.status).toEqual(200);
-	});
-});
-describe('GET /', () => {
-	it('is http 404', async () => {
-		const res = await axios.get(base + '/', axios_config);
-		expect(res.status).toEqual(404);
-	});
-});
-describe('GET /api/teams', () => {
-	it('is http 200 && is json', async () => {
-		const res = await axios.get(base + '/api/teams', axios_config);
-		expect(res.status).toEqual(200);
-		expect(res.headers['content-type']).toContain("application/json")
-	});
-});