Docker compose build works. Just debugging functionality and fix bugs

Author: EmmanuelM-A

src/api/v1/controllers/user-controller.js

@@ -2,6 +2,7 @@ const expressAsyncHandler = require("express-async-handler");
 const { sendSuccessResponse } = require("../../../utils/helpers");
 const { registerUserService, loginUserService, getCurrentUserService, refreshAccessTokenService } = require("../../../services/users/user-service");
 const { StatusCodes } = require("http-status-codes");
+const logger = require("../../../utils/logger");
 
 /**
  * Handles an HTTP POST request to register a new user.
@@ -31,11 +32,16 @@ const registerUser = expressAsyncHandler(async (request, response) => {
  * Handles an HTTP POST request to authenticate and log in an existing user.
  */
 const loginUser = expressAsyncHandler(async (request, response) => {
-    // Extract email and password from the request body.
-    const userCredentials = request.body;
-
     // Generate tokens after authentication
-    const { userDB, accessToken } = await loginUserService(userCredentials);
+    const { userDB, accessToken, refreshToken } = await loginUserService(request.body);
+
+    // Set the refresh token as an HTTP-only cookie for secure storage on the client side.
+    response.cookie("refreshToken", refreshToken, {
+        httpOnly: true, // Prevents client-side JavaScript access to the cookie.
+        secure: process.env.NODE_ENV === "production", // Only send over HTTPS in production.
+        sameSite: "strict", // Protects against CSRF attacks.
+        maxAge: 7 * 24 * 60 * 60 * 1000 // Cookie expiration in 7 days.
+    });
 
     sendSuccessResponse(
         response,
@@ -93,6 +99,14 @@ const logoutUser = expressAsyncHandler(async (request, response) => {
     // Invalidate the user's refresh token
     await loginUserService(request.cookies.refreshToken);
 
+    // Clear the 'refreshToken' cookie from the client's browser.
+	// The options must match those used when setting the cookie during login.
+	response.clearCookie("refreshToken", {
+		httpOnly: true, // Must match the `httpOnly` setting used when the cookie was set.
+		secure: process.env.NODE_ENV === "production", // Must match `secure` setting.
+		sameSite: "Strict" // Must match `sameSite` setting.
+	});
+
     sendSuccessResponse(
         response,
         StatusCodes.OK,

src/docs/swagger.js

@@ -25,8 +25,7 @@ const logger = require("../utils/logger");
  */
 const setupSwaggerDocs = async (app) => {
     // Load the OpenAPI definition from the YAML file.
-    const swaggerPath = path.join(__dirname, "swagger.yml");
-    const swaggerDocument = YAML.load('');
+    const swaggerDocument = YAML.load('src/docs/swagger.yml');
 
     // Serve Swagger UI at /api-docs with the loaded document.
     app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocument));

src/middleware/api-rate-limiter.js

@@ -2,11 +2,11 @@ const rateLimit = require('express-rate-limit');
 
 // Apply to all requests
 const limiter = rateLimit({
-  windowMs: 15 * 60 * 1000, // 15 minutes
-  max: 100, // limit each IP to 100 requests per windowMs
-  message: 'Too many requests, please try again later.',
-  standardHeaders: true,
-  legacyHeaders: false,
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // limit each IP to 100 requests per windowMs
+    message: 'Too many requests, please try again later.',
+    standardHeaders: true,
+    legacyHeaders: false,
 });
 
 module.exports = limiter;

src/middleware/authorize-routes.js

@@ -4,6 +4,7 @@ const ApiError = require("../utils/api-error");
 const expressAsyncHandler = require("express-async-handler");
 const { StatusCodes } = require("http-status-codes");
 const { findUserById } = require("../database/models/user-model");
+const User = require("../database/schemas/user-schema");
 
 /**
  * Checks if a request has a valid authorization header and verifies its value (the acess token).
@@ -22,7 +23,7 @@ const authRouteProtection = expressAsyncHandler(async (request, response, next)
             logger.info(`Token verified for user ID: ${decoded.id}`);
 
             // Get user from token without password
-            request.user = await findUserById(decoded.id).select("-password");
+            request.user = await User.findById(decoded.id).select("-password");
 
             if (!request.user) {
                 logger.error(`User not found for with the id: ${decoded.id}`);

src/middleware/error-handler.js

@@ -58,6 +58,10 @@ const COMMON_ERRORS_MAP = {
  * @returns {void}
  */
 const errorHandler = (error, request, response, next) => {
+    if (response.headersSent) {
+        return next(error); // Delegate to Express's built-in error handler
+    }
+    
     // Ensure response status is an error, defaulting to 500
     const statusCode = error.status >= 400 && error.status < 500 ? error.status: 500;
 

src/services/users/user-service.js

@@ -67,8 +67,7 @@ async function registerUserService(userData) {
 	const userObj = {
 		username,
 		email,
-		password: hashedPassword,
-		role: "role"
+		password: hashedPassword
 	}
 
 	const userDB = await createUser(userObj);
@@ -154,17 +153,10 @@ async function loginUserService(userCredentials) {
 	userDB.refreshToken = refreshToken;
     await userDB.save();
 
-	// Set the refresh token as an HTTP-only cookie for secure storage on the client side.
-    response.cookie("refreshToken", refreshToken, {
-        httpOnly: true, // Prevents client-side JavaScript access to the cookie.
-        secure: process.env.NODE_ENV === "production", // Only send over HTTPS in production.
-        sameSite: "strict", // Protects against CSRF attacks.
-        maxAge: 7 * 24 * 60 * 60 * 1000 // Cookie expiration in 7 days.
-    });
-
 	return {
 		userDB,
-		accessToken
+		accessToken,
+		refreshToken
 	}
 }
 
@@ -289,14 +281,6 @@ async function logoutUserService(token) {
 	user.refreshToken = null; // Set the refresh token to null to invalidate it.
 	await user.save(); // Save the updated user document.
 
-	// Clear the 'refreshToken' cookie from the client's browser.
-	// The options must match those used when setting the cookie during login.
-	response.clearCookie("refreshToken", {
-		httpOnly: true, // Must match the `httpOnly` setting used when the cookie was set.
-		secure: process.env.NODE_ENV === "production", // Must match `secure` setting.
-		sameSite: "Strict" // Must match `sameSite` setting.
-	});
-
 	logger.debug(`The refresh token: ${token} has been invalidated.`);
 }