Skip to content

Commit a2aa276

Browse files
YasharFYasharF
committed
Fix authorization issues and refactor oauth2 token handling
- Rename handleOAuth2Callback to saveOAuth2UserTokens for clarity - Fix token storage to properly handle missing expiration dates - Consolidate OAuth2 token saving logic across all providers - Prevent infinite redirect loop in isAuthorized when there is a failed token refresh - Added unit tests for isAuthorized, saveOAuth2UserTokens in config/passport.js, and fixed unit tests for app.js
1 parent a8da6bd commit a2aa276

File tree

6 files changed

+778
-158
lines changed

6 files changed

+778
-158
lines changed

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ public/css/main.css
2222

2323
# API keys and secrets
2424
.env
25+
.env.example
26+
test/.env.test
2527

2628
# Dependency directory
2729
node_modules

‎README.md

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ I also tried to make it as **generic** and **reusable** as possible to cover mos
7272
- Login
7373
- **Local Authentication** using Email and Password
7474
- **OAuth 2.0 Authentication:** Sign in with Google, Facebook, X (Twitter), Twitch, Github
75-
- **OpenID Conenct:** Sign in with LinkedIn
75+
- **OpenID Connect:** Sign in with LinkedIn
7676
- **User Profile and Account Management**
7777
- Gravatar
7878
- Profile Details
@@ -104,7 +104,7 @@ I also tried to make it as **generic** and **reusable** as possible to cover mos
104104
- Hosted: No need to install, see the MongoDB Atlas section
105105

106106
- [Node.js 22.12+](http://nodejs.org)
107-
- Highly recommanded: Use/Upgrade your NodeJS to the latest NodeJS 22 LTS version.
107+
- Highly recommended: Use/Upgrade your NodeJS to the latest NodeJS 22 LTS version.
108108
- Command Line Tools
109109
- <img src="https://upload.wikimedia.org/wikipedia/commons/1/1b/Apple_logo_grey.svg" height="17">&nbsp;**Mac OS X:** [Xcode](https://itunes.apple.com/us/app/xcode/id497799835?mt=12) (or **OS X 10.9+**: `xcode-select --install`)
110110
- <img src="https://upload.wikimedia.org/wikipedia/commons/8/87/Windows_logo_-_2021.svg" height="17">&nbsp;**Windows:** [Visual Studio Code](https://code.visualstudio.com) + [Windows Subsystem for Linux - Ubuntu](https://learn.microsoft.com/en-us/windows/wsl/install) OR [Visual Studio](https://www.visualstudio.com/products/visual-studio-community-vs)
@@ -405,12 +405,12 @@ This project supports integrating web analytics tools such as Google Analytics 4
405405

406406
### Facebook Pixel
407407

408-
**Optional:** It is highly recommanded to setup a business with Facebook that your personal account along with others you authorize can manage. You would need to gGo to [Meta Business Suite](https://business.facebook.com/), register a business and add a business page and your website as an asset for the business.
408+
**Optional:** It is highly recommanded to setup a business with Facebook that your personal account along with others you authorize can manage. You would need to Go to [Meta Business Suite](https://business.facebook.com/), register a business and add a business page and your website as an asset for the business.
409409

410410
- Go to [Meta Event Manager](https://www.facebook.com/events_manager)
411411
- If you have setup a business, switch from your personal to your business account and pick your business asset using the drop down in the upper right corner of the page.
412412
- Use the Connect Data option to add a Web data source and create a Pixel ID
413-
- Copy and paste the Pixel ID into `.env` file for FACEBOOK_PIXEL_ID or set it up as an enviornment variable
413+
- Copy and paste the Pixel ID into `.env` file for FACEBOOK_PIXEL_ID or set it up as an environment variable
414414

415415
## Open Graph
416416

@@ -431,6 +431,7 @@ The metadata for Open Graph is only set up for the home page (`home.pug`). Updat
431431
| **public**/**js**/application.js | Specify client-side JavaScript dependencies. |
432432
| **public**/**js**/app.js | Place your client-side JavaScript here. |
433433
| **public**/**css**/main.scss | Main stylesheet for your app. |
434+
| **test**/\*.js | Unit tests |
434435
| **views/account**/ | Templates for _login, password reset, signup, profile_. |
435436
| **views/api**/ | Templates for API Examples. |
436437
| **views/partials**/flash.pug | Error, info and success flash notifications. |
@@ -515,7 +516,7 @@ Required to run the project before your modifications
515516

516517
**Dev Dependencies**
517518

518-
Required during code development for testing, Hygiene, code styleing, etc.
519+
Required during code development for testing, Hygiene, code styling, etc.
519520

520521
| Package | Description |
521522
| ------------------------------- | --------------------------------------------------------------------------- |
@@ -620,7 +621,7 @@ See [Deployment](#deployment) for more information on how to set up an account a
620621

621622
### Why do you have all routes defined in app.js?
622623

623-
For the sake of simplicity. While there might be a better approach, such as passing `app` context to each controller as outlined in this [blog](http://timstermatic.github.io/blog/2013/08/17/a-simple-mvc-framework-with-node-and-express/), I find such a style to be confusing for beginners. It took me a long time to grasp the concept of `exports` and `module.exports`, let alone having a global `app` reference in other files. Tha to me is backward thinking.
624+
For the sake of simplicity. While there might be a better approach, such as passing `app` context to each controller as outlined in this [blog](http://timstermatic.github.io/blog/2013/08/17/a-simple-mvc-framework-with-node-and-express/), I find such a style to be confusing for beginners. It took me a long time to grasp the concept of `exports` and `module.exports`, let alone having a global `app` reference in other files. That to me is backward thinking.
624625
The `app.js` is the "heart of the app", it should be the one referencing models, routes, controllers, etc.
625626
When working solo on small projects, I prefer to have everything inside `app.js` as is the case with [this](<(https://github.com/sahat/ember-sass-express-starter/blob/master/app.js)>) REST API server.
626627

@@ -1285,10 +1286,10 @@ Using a local instance on your laptop with ngrok is a good solution for your dem
12851286
| <img src="https://icon.icepanel.io/AWS/svg/Compute/App-Runner.svg" width="50"><br>**App Runner** | If your application is stable and you expect surges of traffic, you can move from direct EC2 deployment to AWS App Runner which can scale the number of hosts that the application runs on up and down depending on the traffic to your host. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
12861287
| <img src="https://icon.icepanel.io/AWS/svg/Compute/Elastic-Beanstalk.svg" width="50"><br>**Elastic Beanstalk** | You can use an Elastic Beanstalk deployment instead of an EC2 deployment of your application. When using Elastic Beanstalk deployments you are just provided with a code execution environemnt and you are no longer required to maintain the OS for the server (i.e. Windows or Linux security patching, etc.) <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
12871288
| <img src="https://icon.icepanel.io/AWS/svg/Containers/Elastic-Container-Service.svg" width="50"><br>**Elastic Container Service** | ECS is the fully managed AWS container service that enables you to run docker containers on EC2 instances. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
1288-
| <img src="https://icon.icepanel.io/AWS/svg/Compute/Fargate.svg" width="50"><br>**Fargate** | Fargate takes your container deployment to the next level by moving you to a serverlsss setup for running containers. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
1289+
| <img src="https://icon.icepanel.io/AWS/svg/Compute/Fargate.svg" width="50"><br>**Fargate** | Fargate takes your container deployment to the next level by moving you to a serverless setup for running containers. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
12891290
| <img src="https://icon.icepanel.io/AWS/svg/Compute/Bottlerocket.svg" width="50"><br>**Bedrock** | Bedrock provides serverless access to use Foundational LLM models such as Llama, Amazon Titan, Amazon Nova, etc. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
1290-
| <img src="https://icon.icepanel.io/AWS/svg/Networking-Content-Delivery/CloudFront.svg" width="50"><br>**CloudFront** | You can use AWS CloudFront as the edge service that fronts client requests. CloudFront can cache static content to reduce resource usage and speed up data delivery. It can also serve as an extra later of security because your application server isn't directly exposed to the internet trafic. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
1291-
| <img src="https://icon.icepanel.io/AWS/svg/Networking-Content-Delivery/CloudFront.svg" width="50"><br>**Simple Email Service** | You can use AWS SES just like an SMTP server. Don't try to setup an email server on your EC2 instance to send out email, use SES. Note that SES stricktly enforces anti-spam rules, so don't send anything that a recipent may mark as spam as it will get reported back to AWS. If **1%** of your emails get reported as spam by recipients AWS will suspend your SES service. Also you should setup mail setting such as spf, DMARC and DKIM so others can't spoof your email address causing your domain to get tagged as a spam domain, since it may cause automated spam marking of your emails by email service providers such as gmail, yahoo, etc.<br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
1291+
| <img src="https://icon.icepanel.io/AWS/svg/Networking-Content-Delivery/CloudFront.svg" width="50"><br>**CloudFront** | You can use AWS CloudFront as the edge service that fronts client requests. CloudFront can cache static content to reduce resource usage and speed up data delivery. It can also serve as an extra later of security because your application server isn't directly exposed to the internet traffic. <br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
1292+
| <img src="https://icon.icepanel.io/AWS/svg/Networking-Content-Delivery/CloudFront.svg" width="50"><br>**Simple Email Service** | You can use AWS SES just like an SMTP server. Don't try to setup an email server on your EC2 instance to send out email, use SES. Note that SES strictly enforces anti-spam rules, so don't send anything that a recipent may mark as spam as it will get reported back to AWS. If **1%** of your emails get reported as spam by recipients AWS will suspend your SES service. Also you should setup mail setting such as spf, DMARC and DKIM so others can't spoof your email address causing your domain to get tagged as a spam domain, since it may cause automated spam marking of your emails by email service providers such as gmail, yahoo, etc.<br><br>**Setup Steps:**<br>1. ---.<br>2. ---.<br>3. ---.<br>4. ---.<br> |
12921293
12931294
---
12941295

0 commit comments

Comments
 (0)