{{signInCode}}
{{airportName}}{{themeColor}}'; } - return 'Sign in at {{signInLink}} for {{airportName}}'; + return 'Code: {{signInCode}} for {{airportName}}'; }); }); @@ -23,7 +23,7 @@ describe('functions', () => { it('returns subject, html, and text', () => { const result = getSignInEmailContent({ - signInLink: 'https://example.com/signin', + signInCode: '123456', airportName: 'Thun Airport', themeColor: '#003863' }); @@ -32,19 +32,19 @@ describe('functions', () => { expect(result.text).toBeDefined(); }); - it('replaces signInLink placeholder in html', () => { + it('replaces signInCode placeholder in html', () => { const result = getSignInEmailContent({ - signInLink: 'https://example.com/signin', + signInCode: '123456', airportName: 'Thun', themeColor: '#003863' }); - expect(result.html).toContain('https://example.com/signin'); - expect(result.html).not.toContain('{{signInLink}}'); + expect(result.html).toContain('123456'); + expect(result.html).not.toContain('{{signInCode}}'); }); it('replaces airportName placeholder in html', () => { const result = getSignInEmailContent({ - signInLink: 'https://example.com/signin', + signInCode: '123456', airportName: 'Thun Airport', themeColor: '#003863' }); @@ -54,7 +54,7 @@ describe('functions', () => { it('replaces themeColor placeholder in html', () => { const result = getSignInEmailContent({ - signInLink: 'https://example.com/signin', + signInCode: '123456', airportName: 'Thun', themeColor: '#003863' }); @@ -62,30 +62,30 @@ describe('functions', () => { expect(result.html).not.toContain('{{themeColor}}'); }); - it('replaces signInLink placeholder in text', () => { + it('replaces signInCode placeholder in text', () => { const result = getSignInEmailContent({ - signInLink: 'https://example.com/signin', + signInCode: '123456', airportName: 'Thun', themeColor: '#003863' }); - expect(result.text).toContain('https://example.com/signin'); - expect(result.text).not.toContain('{{signInLink}}'); + expect(result.text).toContain('123456'); + expect(result.text).not.toContain('{{signInCode}}'); }); it('leaves unknown placeholders unchanged', () => { - fs.readFileSync.mockReturnValue('{{unknownKey}} {{signInLink}}'); + fs.readFileSync.mockReturnValue('{{unknownKey}} {{signInCode}}'); const result = getSignInEmailContent({ - signInLink: 'https://example.com', + signInCode: '654321', airportName: 'Thun', themeColor: '#003863' }); expect(result.html).toContain('{{unknownKey}}'); - expect(result.html).toContain('https://example.com'); + expect(result.html).toContain('654321'); }); it('reads html template from correct path', () => { getSignInEmailContent({ - signInLink: 'https://example.com', + signInCode: '123456', airportName: 'Thun', themeColor: '#003863' }); @@ -97,7 +97,7 @@ describe('functions', () => { it('reads text template from correct path', () => { getSignInEmailContent({ - signInLink: 'https://example.com', + signInCode: '123456', airportName: 'Thun', themeColor: '#003863' }); diff --git a/functions/auth/generateSignInCode.js b/functions/auth/generateSignInCode.js new file mode 100644 index 00000000..7d336493 --- /dev/null +++ b/functions/auth/generateSignInCode.js @@ -0,0 +1,66 @@ +'use strict'; + +const functions = require('firebase-functions'); +const admin = require('firebase-admin'); +const crypto = require('crypto'); +const cors = require('cors')({origin: true}); +const { sendSignInEmail } = require('./sendSignInEmail'); + +const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; +const CODE_EXPIRY_MS = 10 * 60 * 1000; // 10 minutes + +const hashCode = (code) => { + return crypto.createHash('sha256').update(code).digest('hex'); +}; + +const validateRequest = (method, body) => { + if (method !== 'POST') { + return { error: 'Method not allowed', status: 405 }; + } + + const { email } = body; + + if (!email) { + return { error: 'Email is required', status: 400 }; + } + + if (!EMAIL_REGEX.test(email)) { + return { error: 'Invalid email format', status: 400 }; + } + + return null; +}; + +exports.generateSignInCode = functions.region('europe-west1').https.onRequest((req, res) => { + return cors(req, res, async () => { + try { + const validationError = validateRequest(req.method, req.body); + if (validationError) { + return res.status(validationError.status).json({ error: validationError.error }); + } + + const { email, airportName, themeColor } = req.body; + const normalizedEmail = email.toLowerCase(); + + const code = String(crypto.randomInt(0, 1000000)).padStart(6, '0'); + const codeHash = hashCode(code); + const expiry = Date.now() + CODE_EXPIRY_MS; + + await admin.database().ref('/signInCodes').push({ + email: normalizedEmail, + codeHash, + expiry, + attempts: 0, + }); + + await sendSignInEmail({ email: normalizedEmail, signInCode: code, airportName, themeColor }); + + res.status(200).json({ success: true }); + } catch (error) { + console.error('Error generating sign-in code:', error); + res.status(500).json({ + error: 'Failed to send sign-in code', + }); + } + }); +}); diff --git a/functions/auth/generateSignInCode.spec.js b/functions/auth/generateSignInCode.spec.js new file mode 100644 index 00000000..07ff5224 --- /dev/null +++ b/functions/auth/generateSignInCode.spec.js @@ -0,0 +1,194 @@ +describe('functions', () => { + describe('auth/generateSignInCode', () => { + let mockAdmin; + let mockFunctions; + let mockSendSignInEmail; + let capturedHandler; + let mockCors; + let mockPush; + let mockCrypto; + + beforeEach(() => { + jest.resetModules(); + capturedHandler = null; + + mockPush = jest.fn().mockResolvedValue({ key: 'code-key-123' }); + + mockAdmin = { + database: jest.fn().mockReturnValue({ + ref: jest.fn().mockReturnValue({ push: mockPush }) + }) + }; + + mockCors = jest.fn().mockImplementation((req, res, cb) => cb()); + + mockFunctions = { + https: { + onRequest: jest.fn().mockImplementation(handler => { capturedHandler = handler; }) + } + }; + mockFunctions.region = jest.fn(() => mockFunctions); + + mockSendSignInEmail = jest.fn().mockResolvedValue('msg123'); + + jest.mock('firebase-admin', () => mockAdmin); + jest.mock('firebase-functions', () => mockFunctions); + jest.mock('cors', () => () => mockCors); + jest.mock('./sendSignInEmail', () => ({ sendSignInEmail: mockSendSignInEmail })); + + require('./generateSignInCode'); + }); + + afterEach(() => { + jest.restoreAllMocks(); + }); + + const makeReq = (method, body) => ({ method, body }); + const makeRes = () => ({ + status: jest.fn().mockReturnThis(), + json: jest.fn() + }); + + it('returns 405 for GET request', async () => { + const req = makeReq('GET', {}); + const res = makeRes(); + await capturedHandler(req, res); + expect(res.status).toHaveBeenCalledWith(405); + expect(res.json).toHaveBeenCalledWith({ error: 'Method not allowed' }); + }); + + it('returns 400 when email is missing', async () => { + const req = makeReq('POST', {}); + const res = makeRes(); + await capturedHandler(req, res); + expect(res.status).toHaveBeenCalledWith(400); + expect(res.json).toHaveBeenCalledWith({ error: 'Email is required' }); + }); + + it('returns 400 for invalid email format', async () => { + const req = makeReq('POST', { email: 'not-an-email' }); + const res = makeRes(); + await capturedHandler(req, res); + expect(res.status).toHaveBeenCalledWith(400); + expect(res.json).toHaveBeenCalledWith({ error: 'Invalid email format' }); + }); + + it('stores code hash in database (not plaintext code)', async () => { + const req = makeReq('POST', { + email: 'user@example.com', + airportName: 'Thun', + themeColor: '#003863' + }); + const res = makeRes(); + await capturedHandler(req, res); + + expect(mockPush).toHaveBeenCalledWith( + expect.objectContaining({ + email: 'user@example.com', + codeHash: expect.any(String), + expiry: expect.any(Number), + attempts: 0, + }) + ); + + // Verify that the pushed object does NOT contain the plaintext code + const pushedData = mockPush.mock.calls[0][0]; + expect(pushedData).not.toHaveProperty('code'); + }); + + it('normalizes email to lowercase before storing', async () => { + const req = makeReq('POST', { email: 'User@Example.COM' }); + const res = makeRes(); + await capturedHandler(req, res); + + const pushedData = mockPush.mock.calls[0][0]; + expect(pushedData.email).toBe('user@example.com'); + }); + + it('sends email server-side with correct parameters', async () => { + const req = makeReq('POST', { + email: 'user@example.com', + airportName: 'Thun', + themeColor: '#003863' + }); + const res = makeRes(); + await capturedHandler(req, res); + + expect(mockSendSignInEmail).toHaveBeenCalledWith( + expect.objectContaining({ + email: 'user@example.com', + signInCode: expect.any(String), + airportName: 'Thun', + themeColor: '#003863', + }) + ); + }); + + it('returns success without code in response', async () => { + const req = makeReq('POST', { + email: 'user@example.com', + airportName: 'Thun', + themeColor: '#003863' + }); + const res = makeRes(); + await capturedHandler(req, res); + + expect(res.status).toHaveBeenCalledWith(200); + const responseData = res.json.mock.calls[0][0]; + expect(responseData).toEqual({ success: true }); + expect(responseData).not.toHaveProperty('code'); + }); + + it('returns 500 without error details when sendSignInEmail throws', async () => { + mockSendSignInEmail.mockRejectedValue(new Error('SMTP connection failed: password=secret123')); + + const req = makeReq('POST', { email: 'user@example.com' }); + const res = makeRes(); + await capturedHandler(req, res); + + expect(res.status).toHaveBeenCalledWith(500); + const responseData = res.json.mock.calls[0][0]; + expect(responseData).toEqual({ error: 'Failed to send sign-in code' }); + expect(responseData).not.toHaveProperty('details'); + }); + + it('returns 500 without error details when database push throws', async () => { + mockPush.mockRejectedValue(new Error('DB permission denied')); + + const req = makeReq('POST', { email: 'user@example.com' }); + const res = makeRes(); + await capturedHandler(req, res); + + expect(res.status).toHaveBeenCalledWith(500); + const responseData = res.json.mock.calls[0][0]; + expect(responseData).toEqual({ error: 'Failed to send sign-in code' }); + expect(responseData).not.toHaveProperty('details'); + }); + + it('sets expiry approximately 10 minutes in the future', async () => { + const before = Date.now(); + const req = makeReq('POST', { email: 'user@example.com' }); + const res = makeRes(); + await capturedHandler(req, res); + const after = Date.now(); + + const pushedData = mockPush.mock.calls[0][0]; + const tenMinutesMs = 10 * 60 * 1000; + expect(pushedData.expiry).toBeGreaterThanOrEqual(before + tenMinutesMs); + expect(pushedData.expiry).toBeLessThanOrEqual(after + tenMinutesMs); + }); + + it('stores SHA-256 hash of code, not plaintext', async () => { + const crypto = require('crypto'); + const req = makeReq('POST', { email: 'user@example.com' }); + const res = makeRes(); + await capturedHandler(req, res); + + const pushedData = mockPush.mock.calls[0][0]; + // The sent signInCode should hash to the stored codeHash + const sentCode = mockSendSignInEmail.mock.calls[0][0].signInCode; + const expectedHash = crypto.createHash('sha256').update(sentCode).digest('hex'); + expect(pushedData.codeHash).toBe(expectedHash); + }); + }); +}); diff --git a/functions/auth/sendSignInEmail.js b/functions/auth/sendSignInEmail.js index 0c57d968..1b5aed85 100644 --- a/functions/auth/sendSignInEmail.js +++ b/functions/auth/sendSignInEmail.js @@ -1,30 +1,17 @@ -const functions = require('firebase-functions'); +'use strict'; + const admin = require('firebase-admin'); -const cors = require('cors')({origin: true}); const nodemailer = require('nodemailer'); const { getSignInEmailContent } = require('./emailTemplates'); const REQUIRED_SMTP_SETTINGS = ['host', 'port', 'user', 'password', 'fromEmail', 'fromName']; -const validateRequest = (method, body) => { - if (method !== 'POST') { - return { error: 'Method not allowed', status: 405 }; - } - - const { email, signInLink } = body; - if (!email || !signInLink) { - return { error: 'Email and signInLink are required', status: 400 }; - } - - return null; -}; - const loadSmtpSettings = async () => { const snapshot = await admin.database().ref('/settings/emailSmtp').once('value'); const settings = snapshot.val(); if (!settings) { - throw new Error('SMTP settings not found in database at /settings/emailSmtp'); + throw new Error('SMTP settings not found in database'); } const missingSettings = REQUIRED_SMTP_SETTINGS.filter(setting => !settings[setting]); @@ -47,41 +34,20 @@ const createTransporter = (settings) => { }); }; -exports.sendSignInEmail = functions.region('europe-west1').https.onRequest((req, res) => { - return cors(req, res, async () => { - try { - const validationError = validateRequest(req.method, req.body); - if (validationError) { - return res.status(validationError.status).json({ error: validationError.error }); - } - - const { email, signInLink, airportName, themeColor } = req.body; - - const smtpSettings = await loadSmtpSettings(); - const emailContent = getSignInEmailContent({ signInLink, airportName, themeColor }); - const transporter = createTransporter(smtpSettings); - - const info = await transporter.sendMail({ - from: `"${smtpSettings.fromName}" <${smtpSettings.fromEmail}>`, - to: email, - subject: emailContent.subject, - text: emailContent.text, - html: emailContent.html, - }); +const sendSignInEmail = async ({ email, signInCode, airportName, themeColor }) => { + const smtpSettings = await loadSmtpSettings(); + const emailContent = getSignInEmailContent({ signInCode, airportName, themeColor }); + const transporter = createTransporter(smtpSettings); + + const info = await transporter.sendMail({ + from: `"${smtpSettings.fromName}" <${smtpSettings.fromEmail}>`, + to: email, + subject: emailContent.subject, + text: emailContent.text, + html: emailContent.html, + }); - console.log('Sign-in email sent successfully:', info.messageId); + return info.messageId; +}; - res.status(200).json({ - success: true, - message: 'Sign-in email sent successfully', - messageId: info.messageId - }); - } catch (error) { - console.error('Error sending sign-in email:', error); - res.status(500).json({ - error: 'Failed to send sign-in email', - details: error.message - }); - } - }); -}); +module.exports = { sendSignInEmail, loadSmtpSettings, createTransporter }; diff --git a/functions/auth/sendSignInEmail.spec.js b/functions/auth/sendSignInEmail.spec.js index 1e981749..a77db389 100644 --- a/functions/auth/sendSignInEmail.spec.js +++ b/functions/auth/sendSignInEmail.spec.js @@ -1,25 +1,28 @@ describe('functions', () => { describe('auth/sendSignInEmail', () => { let mockAdmin; - let mockFunctions; let mockNodemailer; let mockEmailTemplates; - let capturedHandler; - let mockCors; + let mockSendMail; + let mockTransporter; + let sendSignInEmail; + let loadSmtpSettings; + let createTransporter; + + const smtpSettings = { + host: 'smtp.example.com', + port: '587', + user: 'user@example.com', + password: 'secret', + fromEmail: 'noreply@example.com', + fromName: 'Flightbox' + }; beforeEach(() => { jest.resetModules(); - capturedHandler = null; const mockOnce = jest.fn().mockResolvedValue({ - val: () => ({ - host: 'smtp.example.com', - port: '587', - user: 'user@example.com', - password: 'secret', - fromEmail: 'noreply@example.com', - fromName: 'Flightbox' - }) + val: () => smtpSettings }); mockAdmin = { @@ -28,17 +31,8 @@ describe('functions', () => { }) }; - mockCors = jest.fn().mockImplementation((req, res, cb) => cb()); - - mockFunctions = { - https: { - onRequest: jest.fn().mockImplementation(handler => { capturedHandler = handler; }) - } - }; - mockFunctions.region = jest.fn(() => mockFunctions); - - const mockSendMail = jest.fn().mockResolvedValue({ messageId: 'msg123' }); - const mockTransporter = { sendMail: mockSendMail }; + mockSendMail = jest.fn().mockResolvedValue({ messageId: 'msg123' }); + mockTransporter = { sendMail: mockSendMail }; mockNodemailer = { createTransport: jest.fn().mockReturnValue(mockTransporter) @@ -47,117 +41,126 @@ describe('functions', () => { mockEmailTemplates = { getSignInEmailContent: jest.fn().mockReturnValue({ subject: 'Sign in', - html: 'Click here
', - text: 'Click here' + html: 'Your code: 123456
', + text: 'Your code: 123456' }) }; jest.mock('firebase-admin', () => mockAdmin); - jest.mock('firebase-functions', () => mockFunctions); - jest.mock('cors', () => () => mockCors); jest.mock('nodemailer', () => mockNodemailer); jest.mock('./emailTemplates', () => mockEmailTemplates); - require('./sendSignInEmail'); - }); - - const makeReq = (method, body) => ({ method, body }); - const makeRes = () => ({ - status: jest.fn().mockReturnThis(), - json: jest.fn() + const module = require('./sendSignInEmail'); + sendSignInEmail = module.sendSignInEmail; + loadSmtpSettings = module.loadSmtpSettings; + createTransporter = module.createTransporter; }); - it('returns 405 for GET request', async () => { - const req = makeReq('GET', {}); - const res = makeRes(); - await capturedHandler(req, res); - expect(res.status).toHaveBeenCalledWith(405); - }); + describe('sendSignInEmail', () => { + it('sends email with correct parameters', async () => { + const messageId = await sendSignInEmail({ + email: 'user@example.com', + signInCode: '123456', + airportName: 'Thun', + themeColor: '#003863' + }); + + expect(mockSendMail).toHaveBeenCalledWith( + expect.objectContaining({ + to: 'user@example.com', + subject: 'Sign in', + }) + ); + expect(messageId).toBe('msg123'); + }); - it('returns 400 when email is missing', async () => { - const req = makeReq('POST', { signInLink: 'https://link' }); - const res = makeRes(); - await capturedHandler(req, res); - expect(res.status).toHaveBeenCalledWith(400); - expect(res.json).toHaveBeenCalledWith({ error: 'Email and signInLink are required' }); - }); + it('calls getSignInEmailContent with correct params', async () => { + await sendSignInEmail({ + email: 'user@example.com', + signInCode: '123456', + airportName: 'Thun', + themeColor: '#003' + }); + + expect(mockEmailTemplates.getSignInEmailContent).toHaveBeenCalledWith({ + signInCode: '123456', + airportName: 'Thun', + themeColor: '#003' + }); + }); - it('returns 400 when signInLink is missing', async () => { - const req = makeReq('POST', { email: 'user@example.com' }); - const res = makeRes(); - await capturedHandler(req, res); - expect(res.status).toHaveBeenCalledWith(400); - }); + it('throws when SMTP settings are missing', async () => { + mockAdmin.database().ref().once.mockResolvedValue({ val: () => null }); - it('sends email and returns 200 on success', async () => { - const req = makeReq('POST', { - email: 'user@example.com', - signInLink: 'https://sign-in.example.com', - airportName: 'Thun', - themeColor: '#003863' + await expect(sendSignInEmail({ + email: 'user@example.com', + signInCode: '123456' + })).rejects.toThrow('SMTP settings not found'); }); - const res = makeRes(); - await capturedHandler(req, res); - expect(res.status).toHaveBeenCalledWith(200); - expect(res.json).toHaveBeenCalledWith(expect.objectContaining({ - success: true, - messageId: 'msg123' - })); - }); - it('calls getSignInEmailContent with correct params', async () => { - const req = makeReq('POST', { - email: 'user@example.com', - signInLink: 'https://link', - airportName: 'Thun', - themeColor: '#003' + it('throws when required SMTP settings are incomplete', async () => { + mockAdmin.database().ref().once.mockResolvedValue({ + val: () => ({ host: 'smtp.example.com' }) + }); + + await expect(sendSignInEmail({ + email: 'user@example.com', + signInCode: '123456' + })).rejects.toThrow('Missing SMTP settings'); }); - const res = makeRes(); - await capturedHandler(req, res); - expect(mockEmailTemplates.getSignInEmailContent).toHaveBeenCalledWith({ - signInLink: 'https://link', - airportName: 'Thun', - themeColor: '#003' + + it('uses correct from address', async () => { + await sendSignInEmail({ + email: 'user@example.com', + signInCode: '123456' + }); + + const mailArgs = mockSendMail.mock.calls[0][0]; + expect(mailArgs.from).toBe('"Flightbox"Hallo!
-Klicken Sie auf die Schaltfläche unten, um sich sicher bei Ihrem Flightbox-Konto anzumelden:
+Geben Sie den folgenden Code in der Flightbox-App ein, um sich anzumelden:
- +Ihr Anmelde-Code
+{{signInCode}}
+Falls die Schaltfläche nicht funktioniert, kopieren Sie diesen Link und fügen Sie ihn in Ihren Browser ein:
-{{signInLink}}
-
- • Dieser Link läuft in 1 Stunde aus Sicherheitsgründen ab
- • Falls Sie diesen Anmelde-Link nicht angefordert haben, können Sie diese E-Mail ignorieren
- • Teilen Sie diesen Link niemals mit anderen
+ • Dieser Code ist 10 Minuten gültig
+ • Falls Sie diesen Code nicht angefordert haben, können Sie diese E-Mail ignorieren
+ • Teilen Sie diesen Code niemals mit anderen
+ An unexpected error occurred. +
+ +