source: Klonkt/src/routes/auth.js@ a301d7a

import express from 'express';
import crypto from 'crypto';
import bcrypt from 'bcryptjs';
import { v4 as uuid } from 'uuid';
import db from '../config/database.js';
import { renderPage } from '../middleware/render.js';
import { loginLimiter, registerLimiter } from '../middleware/rate-limit.js';
import { safeNext, requireAuth } from '../middleware/auth.js';
import { googleConfigured, authorizeUrl, exchangeCode, fetchUserinfo } from '../config/google.js';
import { premiumUnlocked } from '../services/PatreonService.js';

// Fan login (listeners signing in with Google to comment) is a premium feature:
// available when Google is configured AND the premium layer is unlocked
// (premium off = open to all; on = Patreon required).
function fanLoginReady() {
  return googleConfigured() && premiumUnlocked();
}
import { mailerConfigured, sendMail } from '../config/mailer.js';
import { resolveLang, t } from '../services/i18n.js';
import { setSetting } from '../services/SettingsService.js';

const router = express.Router();

// Fixed dummy hash: ensures login always runs one bcrypt comparison, even when the
// user doesn't exist or has no password — no timing oracle for enumeration.
const DUMMY_HASH = bcrypt.hashSync('constant-time-login-guard', 10);

// Canonical base URL for links in emails (reset). Building it from headers is
// spoofable (X-Forwarded-Host); a fixed config eliminates that risk.
function publicBaseUrl(req) {
  const cfg = (process.env.PUBLIC_BASE_URL || '').replace(/\/$/, '');
  if (cfg) return cfg;
  // Fallback (dev): trust-proxy-sanitised protocol + Host header (NOT the raw
  // X-Forwarded-Host).
  return `${req.protocol}://${req.get('host')}`;
}

function hashToken(raw) {
  return crypto.createHash('sha256').update(String(raw)).digest('hex');
}

// First-time setup? Only while there are no users yet may /register create an
// admin account. Afterwards registration is closed (listeners come via Google).
function isSetupMode() {
  return db.prepare('SELECT COUNT(*) AS c FROM users').get().c === 0;
}

// ==================== LOGIN ====================
// Public login page: for VISITORS only Google-login (listeners/fans).
// The admin login (password) is intentionally NOT here — it lives hidden at
// /auth/admin (see below), so the admin login is not visible where visitors land.
router.get('/login', (req, res) => {
  const next = safeNext(req.query.next) || '';
  if (req.session.user) return res.redirect(next || '/');
  if (isSetupMode()) return res.redirect('/auth/register' + (next ? '?next=' + encodeURIComponent(next) : ''));
  renderPage(req, res, 'pages/auth-login', {
    pageTitle: 'Inloggen',
    bodyClass: 'on-special on-auth',
    error: req.query.error || null,
    gerr: req.query.gerr || null, // foutcode voor een rijkere uitleg (bv. 'admin')
    success: req.query.success || null,
    username: '',
    adminLogin: false,
    googleReady: fanLoginReady(),
    next,
  });
});

// Hidden admin login (username + password). Not linked anywhere in the UI —
// the admin navigates here directly (/auth/admin).
router.get('/admin', (req, res) => {
  const next = safeNext(req.query.next) || '';
  if (req.session.user) return res.redirect(next || '/');
  if (isSetupMode()) return res.redirect('/auth/register' + (next ? '?next=' + encodeURIComponent(next) : ''));
  renderPage(req, res, 'pages/auth-login', {
    pageTitle: 'Beheerder inloggen',
    bodyClass: 'on-special on-auth',
    error: req.query.error || null,
    gerr: null,
    success: req.query.success || null,
    username: '',
    adminLogin: true,
    googleReady: false,
    next,
  });
});

router.post('/login', loginLimiter, (req, res) => {
  const { username, password } = req.body;
  const next = safeNext(req.body.next) || '';

  // Error display on the (hidden) admin login page: re-show the password
  // form (adminLogin:true), not the Google-only public page.
  const renderErr = (error, status = 400) => {
    res.status(status);
    return renderPage(req, res, 'pages/auth-login', {
      pageTitle: 'Beheerder inloggen', bodyClass: 'on-special on-auth',
      error, gerr: null, success: null, username: username || '',
      adminLogin: true, googleReady: false, next,
    });
  };

  if (!username || !password) return renderErr('Gebruikersnaam en wachtwoord vereist');

  const user = db.prepare('SELECT * FROM users WHERE username = ? OR email = ?').get(username, username);
  // Always one bcrypt comparison (dummy if the user has no usable password)
  // so response time reveals nothing about whether the account exists.
  const usable = !!(user && user.password_hash && user.password_hash !== '!google-oauth');
  const ok = bcrypt.compareSync(password, usable ? user.password_hash : DUMMY_HASH);
  if (!usable || !ok) return renderErr('Ongeldige inloggegevens', 401);

  req.session.user = {
    id: user.id, username: user.username, email: user.email, role: user.role,
    avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
    readonly: !!user.readonly,
  };
  res.redirect(next || '/');
});

// ==================== FIRST-TIME SETUP (create admin account) ====================
router.get('/register', (req, res) => {
  const next = safeNext(req.query.next) || '';
  if (req.session.user) return res.redirect(next || '/');
  // No public registration: only the very first admin may be created here.
  if (!isSetupMode()) return res.redirect('/auth/login' + (next ? '?next=' + encodeURIComponent(next) : ''));
  renderPage(req, res, 'pages/auth-register', {
    pageTitle: t(resolveLang(req), 'setup.title'), bodyClass: 'on-special',
    error: null, username: '', email: '', siteName: '', next,
  });
});

router.post('/register', registerLimiter, (req, res) => {
  const { username, email, password, siteName } = req.body;
  const next = safeNext(req.body.next) || '';
  const renderErr = (error) => renderPage(req, res, 'pages/auth-register', {
    pageTitle: t(resolveLang(req), 'setup.title'), bodyClass: 'on-special',
    error, username: username || '', email: email || '', siteName: siteName || '', next,
  });

  // Hard-closed once a user exists — prevents a second "admin" via this route.
  if (!isSetupMode()) return res.redirect('/auth/login');

  if (!username || !email || !password) return renderErr('Alle velden zijn verplicht');
  if (!/^[a-z0-9_-]{3,32}$/i.test(username)) {
    return renderErr('Gebruikersnaam: 3-32 tekens, letters/cijfers/_/- alleen');
  }
  if (password.length < 8) return renderErr('Wachtwoord moet minstens 8 tekens zijn');

  const userId = uuid();
  const hash = bcrypt.hashSync(password, 10);
  // The very first user is the administrator (god).
  db.prepare(`
    INSERT INTO users (id, username, email, password_hash, role, theme, palette)
    VALUES (?, ?, ?, ?, 'god', 'dark', 'sage')
  `).run(userId, username, email, hash);

  // Auto-create a personal site (single-tenant restructure follows later).
  // Setup wizard: site name + language come from the form; language = the language
  // the visitor used to fill in the wizard (resolveLang) and becomes the site default.
  if (!db.prepare('SELECT 1 FROM sites LIMIT 1').get()) {
    const siteId = uuid();
    const lang = resolveLang(req);
    const title = (siteName || '').trim().slice(0, 80) || (username + "'s Site");
    db.prepare(`
      INSERT INTO sites (id, slug, title, description, owner_id, palette, accent, language)
      VALUES (?, ?, ?, ?, ?, 'klonkt', '#e8b04b', ?)
    `).run(siteId, username.toLowerCase(), title, '', userId, lang);
    db.prepare(`INSERT INTO site_members (site_id, user_id, role) VALUES (?, ?, 'admin')`).run(siteId, userId);
    try { setSetting('default_lang', lang); } catch (e) { /* non-fatal */ }
  }

  req.session.user = { id: userId, username, email, role: 'god', palette: 'klonkt', theme: 'dark' };
  res.redirect(next || '/');
});

// ==================== FORGOT PASSWORD (request) ====================
router.get('/reset-request', (req, res) => {
  if (req.session.user) return res.redirect('/');
  renderPage(req, res, 'pages/auth-reset-request', {
    pageTitle: 'Wachtwoord resetten', bodyClass: 'on-special',
    error: null, sent: false, devResetUrl: null, mailer: mailerConfigured(),
  });
});

router.post('/reset-request', registerLimiter, async (req, res) => {
  const email = (req.body.email || '').trim().toLowerCase();
  let devResetUrl = null;

  if (email) {
    const user = db.prepare('SELECT id, email FROM users WHERE LOWER(email) = ?').get(email);
    if (user) {
      const token = crypto.randomBytes(32).toString('hex'); // raw: only goes into the mail/link
      const expires = new Date(Date.now() + 30 * 60 * 1000).toISOString(); // 30 min
      // Store only the HASH: so DB read access yields no usable token.
      db.prepare('UPDATE users SET reset_token = ?, reset_token_expires = ? WHERE id = ?')
        .run(hashToken(token), expires, user.id);

      const url = `${publicBaseUrl(req)}/auth/reset/${token}`;

      if (mailerConfigured()) {
        try {
          await sendMail({
            to: user.email,
            subject: 'Wachtwoord resetten',
            text: `Reset je wachtwoord via deze link (30 min geldig):\n\n${url}\n\nNiet aangevraagd? Negeer deze mail.`,
            html: `<p>Reset je wachtwoord via deze link (30 min geldig):</p><p><a href="${url}">${url}</a></p><p>Niet aangevraagd? Negeer deze mail.</p>`,
          });
        } catch (e) {
          console.error('[reset-request] mail faalde:', e.message);
        }
      } else if (process.env.NODE_ENV !== 'production') {
        // Dev without SMTP: show the link in the log + on the page.
        console.log(`[password-reset] ${user.email} -> ${url}`);
        devResetUrl = url;
      } else {
        // Production without SMTP: NEVER log the token. Refer to the CLI break-glass.
        console.log(`[password-reset] aangevraagd voor ${user.email} (geen SMTP — gebruik 'npm run reset-admin')`);
      }
    }
  }

  // Anti-enumeration: same response regardless of whether the address exists.
  renderPage(req, res, 'pages/auth-reset-request', {
    pageTitle: 'Wachtwoord resetten', bodyClass: 'on-special',
    error: null, sent: true, devResetUrl, mailer: mailerConfigured(),
  });
});

// ==================== RESET PASSWORD (apply) ====================
router.get('/reset/:token', (req, res) => {
  const row = db.prepare(`
    SELECT id, username FROM users
    WHERE reset_token = ? AND reset_token_expires > datetime('now')
  `).get(hashToken(req.params.token));
  renderPage(req, res, 'pages/auth-reset', {
    pageTitle: 'Wachtwoord resetten', bodyClass: 'on-special',
    error: row ? null : 'Deze reset-link is ongeldig of verlopen.',
    token: row ? req.params.token : null,
    username: row ? row.username : null,
  });
});

router.post('/reset/:token', (req, res) => {
  const { new_password, confirm } = req.body;
  const row = db.prepare(`
    SELECT id, username FROM users
    WHERE reset_token = ? AND reset_token_expires > datetime('now')
  `).get(hashToken(req.params.token));

  const renderError = (msg) => renderPage(req, res, 'pages/auth-reset', {
    pageTitle: 'Wachtwoord resetten', bodyClass: 'on-special',
    error: msg, token: row ? req.params.token : null, username: row ? row.username : null,
  });

  if (!row) return renderError('Deze reset-link is ongeldig of verlopen.');
  if (!new_password || new_password.length < 8) return renderError('Wachtwoord moet minstens 8 tekens zijn');
  if (new_password !== confirm) return renderError('Wachtwoorden komen niet overeen');

  const hash = bcrypt.hashSync(new_password, 10);
  db.prepare(`
    UPDATE users SET password_hash = ?, reset_token = NULL, reset_token_expires = NULL,
      updated_at = CURRENT_TIMESTAMP WHERE id = ?
  `).run(hash, row.id);
  res.redirect('/auth/admin?success=' + encodeURIComponent('Wachtwoord gereset — log nu in.'));
});

// ==================== GOOGLE LOGIN (listeners/commenters) ====================
// Per-instance, own Google client. ALWAYS grants role member — never admin.
router.get('/google', (req, res) => {
  if (!fanLoginReady()) {
    return res.redirect('/auth/login?gerr=unavailable');
  }
  const state = crypto.randomBytes(16).toString('hex');
  req.session.oauthState = state;
  req.session.oauthNext = safeNext(req.query.next) || '';
  delete req.session.oauthLink;
  res.redirect(authorizeUrl(state));
});

// LINK Google to the current (logged-in) account — e.g. an admin who also wants
// to log in with Google. Requires being already logged in (with password); the
// link stores the google_sub on their own account.
// Only googleConfigured() needed (no premium gate — this is not fan login).
router.get('/google/link', requireAuth, (req, res) => {
  if (!googleConfigured()) {
    return res.redirect('/account?error=' + encodeURIComponent('Google-login is op deze site niet ingesteld.'));
  }
  const state = crypto.randomBytes(16).toString('hex');
  req.session.oauthState = state;
  req.session.oauthLink = true; // link mode instead of login mode
  res.redirect(authorizeUrl(state));
});

function uniqueUsername(base) {
  let u = String(base || 'luisteraar').toLowerCase().replace(/[^a-z0-9_-]/g, '').slice(0, 28);
  if (u.length < 3) u = 'luisteraar';
  let candidate = u, n = 1;
  while (db.prepare('SELECT 1 FROM users WHERE username = ?').get(candidate)) {
    candidate = (u.slice(0, 26) + n).slice(0, 32);
    n++;
  }
  return candidate;
}

router.get('/google/callback', async (req, res) => {
  const linking = !!req.session.oauthLink;
  const failLogin = (code) => res.redirect('/auth/login?gerr=' + code);
  const failLink = (msg) => res.redirect('/account?error=' + encodeURIComponent(msg));

  try {
    const { code, state } = req.query;
    if (!code || !state || state !== req.session.oauthState) {
      delete req.session.oauthState; delete req.session.oauthLink; delete req.session.oauthNext;
      return linking ? failLink('Google-koppeling afgebroken of sessie verlopen. Probeer opnieuw.') : failLogin('session');
    }

    const tok = await exchangeCode(String(code));
    const info = await fetchUserinfo(tok.access_token);
    const email = (info.email || '').trim().toLowerCase();

    // ── LINK MODE: attach Google to the current (logged-in) account ──
    if (linking) {
      delete req.session.oauthState; delete req.session.oauthLink;
      if (!req.session.user) return failLogin('session');
      if (!info.sub) return failLink('Google gaf geen account-id terug. Probeer opnieuw.');
      if (info.email && info.email_verified === false) return failLink('Je Google-adres is niet geverifieerd.');
      // This Google account must not already be linked to a DIFFERENT account.
      const other = db.prepare('SELECT id FROM users WHERE google_sub = ? AND id != ?').get(info.sub, req.session.user.id);
      if (other) return failLink('Dit Google-account is al aan een andere gebruiker gekoppeld.');
      db.prepare(`
        UPDATE users SET google_sub = ?, avatar_url = COALESCE(avatar_url, ?),
          updated_at = CURRENT_TIMESTAMP WHERE id = ?
      `).run(info.sub, info.picture || null, req.session.user.id);
      return res.redirect('/account?success=' + encodeURIComponent('Google-account gekoppeld — je kunt nu ook met Google inloggen.'));
    }

    // ── LOGIN MODE (listeners/fans + linked admin) ──
    if (!fanLoginReady()) return failLogin('unavailable');
    const next = safeNext(req.session.oauthNext) || '';
    delete req.session.oauthState; delete req.session.oauthNext;
    if (!email || info.email_verified === false) return failLogin('email');

    // Look FIRST by linked Google account (google_sub). A sub-match is explicit
    // proof of the link → log in with their own role, EVEN IF the Google email
    // differs from the account email (e.g. an admin who linked a different Gmail).
    // Only then fall back to email lookup.
    let user = info.sub ? db.prepare('SELECT * FROM users WHERE google_sub = ?').get(info.sub) : null;

    if (user) {
      // Linked account found → keep their own role. Update avatar if empty.
      db.prepare(`
        UPDATE users SET avatar_url = COALESCE(avatar_url, ?), updated_at = CURRENT_TIMESTAMP WHERE id = ?
      `).run(info.picture || null, user.id);
    } else {
      user = db.prepare('SELECT * FROM users WHERE LOWER(email) = ?').get(email);
      if (user && (user.role === 'god' || user.role === 'admin')) {
        // Admin found by email but WITHOUT a linked sub → Google never grants admin.
        // Must first link via Account → Sign in with Google.
        return failLogin('admin');
      } else if (user) {
        // Existing listener: link google_sub/avatar if missing.
        db.prepare(`
          UPDATE users SET google_sub = COALESCE(google_sub, ?), avatar_url = COALESCE(avatar_url, ?),
            updated_at = CURRENT_TIMESTAMP WHERE id = ?
        `).run(info.sub || null, info.picture || null, user.id);
      } else {
        // New listener — always member.
        const userId = uuid();
        const username = uniqueUsername(info.name || email.split('@')[0]);
        db.prepare(`
          INSERT INTO users (id, username, email, password_hash, role, avatar_url, theme, palette, google_sub)
          VALUES (?, ?, ?, '!google-oauth', 'member', ?, 'dark', 'sage', ?)
        `).run(userId, username, info.email || email, info.picture || null, info.sub || null);
        user = db.prepare('SELECT * FROM users WHERE id = ?').get(userId);
      }
    }

    req.session.user = {
      id: user.id, username: user.username, email: user.email, role: user.role,
      avatar_url: user.avatar_url, palette: user.palette, theme: user.theme,
      readonly: !!user.readonly,
    };
    res.redirect(next || '/');
  } catch (e) {
    console.error('[auth/google/callback]', e.message);
    delete req.session.oauthState; delete req.session.oauthLink; delete req.session.oauthNext;
    return linking
      ? res.redirect('/account?error=' + encodeURIComponent('Google koppelen mislukt — probeer opnieuw.'))
      : failLogin('failed');
  }
});

// ==================== LOGOUT ====================
router.get('/logout', (req, res) => { req.session.destroy(() => res.redirect('/')); });
router.post('/logout', (req, res) => { req.session.destroy(() => res.redirect('/')); });

export default router;