First Commit

backend/config/config.json

@@ -0,0 +1,4 @@
+{
+  "uploadDirectory": "/home/app/upload",
+  "mediaDirectory": "/home/app/media"
+}

backend/config/express.js

@@ -0,0 +1,92 @@
+var path = require("path");
+var express = require("express");
+var session = require("express-session");
+var bodyParser = require("body-parser");
+var connectMongo = require("connect-mongo");
+var secrets = require("./secrets");
+
+const MongoStore = connectMongo(session)
+var cookie_domain = process.env['COOKIE_DOMAIN'] != null ? process.env['COOKIE_DOMAIN'] : '.openmhz.com'; //'https://s3.amazonaws.com/robotastic';
+var backend_server = process.env['BACKEND_SERVER'] != null ? process.env['BACKEND_SERVER'] : 'https://api.openmhz.com';
+var frontend_server = process.env['FRONTEND_SERVER'] != null ? process.env['FRONTEND_SERVER'] : 'https://openmhz.com';
+var media_server = process.env['MEDIA_SERVER'] != null ? process.env['MEDIA_SERVER'] : 'https://media.openmhz.com';
+var socket_server = process.env['SOCKET_SERVER'] != null ? process.env['SOCKET_SERVER'] : 'wss://socket.openmhz.com'; //'https://s3.amazonaws.com/robotastic';
+var admin_server = process.env['ADMIN_SERVER'] != null ? process.env['ADMIN_SERVER'] : 'https://admin.openmhz.com'; //'https://s3.amazonaws.com/robotastic';
+var site_name = process.env['SITE_NAME'] != null ? process.env['SITE_NAME'] : "OpenMHz";
+
+
+module.exports = function(app, passport) {
+	app.set("port", 3005)
+	//app.set('trust proxy', true);
+	// X-Powered-By header has no functional value.
+	// Keeping it makes it easier for an attacker to build the site's profile
+	// It can be removed safely
+	app.disable("x-powered-by")
+
+	app.use('/audio', express.static(__dirname + '/media'));
+	app.use(bodyParser.json())
+	app.use(bodyParser.urlencoded({ extended: true }))
+	app.use(express.static(path.join(process.cwd(), 'public')));
+
+
+	const sess = {
+		resave: true,
+		saveUninitialized: true,
+		secret: secrets.sessionSecret,
+		proxy: true,
+		name: "sessionId",
+		cookie: {
+			httpOnly: true,
+			secure: false,
+			domain: cookie_domain
+		},
+		store: new MongoStore({
+			url: secrets.db,
+			autoReconnect: true
+		})
+	}
+
+	var node_env = process.env.NODE_ENV;
+	console.log('--------------------------');
+	console.log('===> 😊  Starting Server . . .');
+	console.log('===>  Environment: ' + node_env);
+	if(node_env === 'production') {
+		console.log('===> 🚦  Note: In order for authentication to work in production');
+		console.log('===>           you will need a secure HTTPS connection');
+		sess.cookie.secure = true; // Serve secure cookies
+	}
+
+	app.use(session(sess))
+
+	app.use(passport.initialize())
+	app.use(passport.session())
+
+
+	app.use('/*', function(req, res, next) {
+	    var allowedOrigins = [ admin_server];
+	    allowedOrigins.push(frontend_server);
+	    allowedOrigins.push(backend_server);
+		allowedOrigins.push(socket_server);
+		allowedOrigins.push("https://www.openmhz.com");
+
+	    var origin = req.headers.origin;
+
+
+	    if (allowedOrigins.indexOf(origin) > -1) {
+	        res.setHeader('Access-Control-Allow-Origin', origin);
+	    } else if (req.headers["user-agent"] == 'TrunkRecorder1.0') {
+	        res.setHeader('Access-Control-Allow-Origin', "*");
+	    } else {
+	        res.setHeader('Access-Control-Allow-Origin', "*");
+	        if (origin) {
+	          console.warn("forcing CORS for: " + origin + " referer: " + req.headers.referer + " url: " + req.originalUrl);
+	        }
+	    }
+	    res.header("Access-Control-Allow-Headers", "X-Requested-With");
+	    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS,WEBSOCKET');
+	    res.header("Access-Control-Allow-Headers", "Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Max-Age");
+	    res.header('Access-Control-Max-Age', '600');
+	    next();
+	});
+
+}

backend/config/passport-strategies/local.js

@@ -0,0 +1,31 @@
+
+var LocalStrategy = require('passport-local').Strategy;
+var User = require("../../models/user");
+
+ /*
+ By default, LocalStrategy expects to find credentials in parameters named username and password.
+ If your site prefers to name these fields differently, options are available to change the defaults.
+ */
+module.exports = new LocalStrategy({
+ 	usernameField: "email"
+ }, (email, password, done) => {
+ 	User.findOne({
+    $or: [{
+      email
+    }, {
+      local: {
+        email
+      }
+    }]
+  }, (err, user) => {
+ 		if(!user) return done(null, false, { message: `Email ${email} not found` })
+
+ 		user.comparePassword(password, (err, isMatch) => {
+ 			if (isMatch) {
+ 				return done(null, user)
+ 			} else {
+ 				return done(null, false, { message: "Invalid email or password" })
+ 			}
+ 		})
+ 	})
+ })

backend/config/passport.js

@@ -0,0 +1,25 @@
+/* Initializing PassportJS */
+var User = require("../models/user");
+var local = require("./passport-strategies/local");
+
+module.exports =function (app, passport) {
+  // Configure Passport authenticated session persistence.
+  //
+  // In order to restore authentication state across HTTP requests, Passport needs
+  // to serialize users into and deserialize users out of the session.  The
+  // typical implementation of this is as simple as supplying the user ID when
+  // serializing, and querying the user record by ID from the database when
+  // deserializing.
+  passport.serializeUser((user, done) => {
+  	done(null, user.id)
+  })
+
+  passport.deserializeUser((id, done) => {
+  	User.findById(id, (err, user) => {
+  		done(err, user)
+  	})
+  })
+
+  // use the following strategies
+  passport.use(local)
+}

backend/config/secrets.js

@@ -0,0 +1,15 @@
+/** Important **/
+/** You should not be committing this file to GitHub **/
+/** Repeat: DO! NOT! COMMIT! THIS! FILE! TO! YOUR! REPO! **/
+var host = process.env['MONGO_NODE_DRIVER_HOST'] != null ? process.env['MONGO_NODE_DRIVER_HOST'] : 'localhost';
+var port = process.env['MONGO_NODE_DRIVER_PORT'] != null ? process.env['MONGO_NODE_DRIVER_PORT'] : 27017;
+var mongoUrl = 'mongodb://' + host + ':' + port + '/scanner';
+
+
+
+const secrets = {
+	db: mongoUrl,
+	sessionSecret: "letthisbeyoursecret"
+}
+
+module.exports = secrets