Merge pull request #10 from drewpayment/feat/fix-login-and-registration

drewpayment · web-flow · commit ef355ba4665a · 2025-01-01T23:15:04.000-05:00
refactor(models/employees.ts): add getEmployeeByEmail function to ret…
diff --git a/src/lib/drizzle/postgres/models/employees.ts b/src/lib/drizzle/postgres/models/employees.ts
@@ -1,7 +1,7 @@
 import { drizzleClient as db } from '$lib/drizzle/postgres/client';
 import { and, eq } from 'drizzle-orm';
 import { employee, employeeCodes, employeeNotes, employeeProfile } from '../schema';
-import type { Employee, EmployeeProfile, InsertEmployee, InsertEmployeeCode, InsertEmployeeNotes, InsertEmployeeProfile, SelectEmployee, SelectEmployeeCode } from '$lib/drizzle/postgres/db.model';
+import type { Employee, EmployeeProfile, InsertEmployee, InsertEmployeeCode, InsertEmployeeNotes, InsertEmployeeProfile, SelectEmployee, SelectEmployeeCode, SelectEmployeeProfile } from '$lib/drizzle/postgres/db.model';
 import { nanoid } from 'nanoid';
 import { error } from '@sveltejs/kit';
 
@@ -28,6 +28,56 @@ const getEmployees = async (clientId: string, isCommissionable = false): Promise
   }
 }
 
+/**
+ * Gets an employee by their email address
+ * 
+ * @param email - The email address to look up
+ * @returns Promise containing the Employee object if found, undefined if not found
+ */
+export const getEmployeeByEmail = async (email: string | undefined): Promise<SelectEmployee & { employeeProfile: SelectEmployeeProfile } | undefined> => {
+  if (!email) {
+    return undefined;
+  }
+
+  try {
+    const result = await db.transaction(async (tx) => {
+      const profile = await tx.query.employeeProfile.findFirst({
+        where: (profile, { eq }) => eq(profile.email, email),
+      }) as SelectEmployeeProfile;
+      
+      const employee = await tx.query.employee.findFirst({
+        where: (employee, { eq }) => eq(employee.id, profile.employeeId),
+      }) as Employee;
+      
+      return {
+        ...employee,
+        employeeProfile: profile,
+      };
+    });
+    
+    return result;
+  } catch (err) {
+    console.error(err);
+    return undefined;
+  }
+};
+
+
+/**
+ * Gets a list of employees for a given client ID with optional search filtering
+ * 
+ * @param clientId - The ID of the client to get employees for
+ * @param page - The page number to return (1-based)
+ * @param take - The number of records to return per page
+ * @param search - Optional search string to filter employees by first or last name
+ * @returns Promise containing array of Employee objects and total count
+ * 
+ * The search parameter will filter employees where either first name OR last name 
+ * contains the search string (case-insensitive). Only returns commissionable employees.
+ * 
+ * Returns employee records with their associated profile and active employee codes.
+ */
+
 export const searchEmployees = async (clientId: string, page: number, take: number, search: string | undefined): Promise<{ data: Employee[], count: number }> => {
   if (!clientId) {
     return { data: [] as Employee[], count: 0 };
diff --git a/src/routes/(app)/app/sales/import/+page.svelte b/src/routes/(app)/app/sales/import/+page.svelte
@@ -3,11 +3,10 @@
 	import { createToast } from '$lib/components/Toast.svelte';
 	import { Button, Breadcrumb, BreadcrumbItem, Label, Fileupload, Table, TableBody, TableBodyRow, TableBodyCell, TableHead, TableHeadCell, Select } from 'flowbite-svelte';
 	import type { PageData } from './$types';
-	import { read, utils } from 'xlsx';
-  import type { ImportSalesResult } from '$lib/types/sale.model';
 	import type { ActionResult } from '@sveltejs/kit';
-	import type { InsertSale } from '$lib/types/db.model';
 	import { formatCurrency, formatDate } from '$lib/utils/utils';
+	import type { InsertSale } from '$lib/drizzle/postgres/db.model';
+	import type { ImportSalesResult } from '$lib/drizzle/postgres/types/sale.model';
 
   export let data: PageData;
   const { campaigns, employees } = data;
diff --git a/src/routes/(auth)/auth/login/+page.svelte b/src/routes/(auth)/auth/login/+page.svelte
@@ -39,13 +39,13 @@
 
 <div class="container max-w-xl">
 	<div class="text-center mb-4">
-		<h1 class="text-3xl font-bold">Welcome back</h1>
+		<h1 class="text-3xl font-bold">Welcome</h1>
 		<p class="text-gray-600 dark:text-gray-100">Login into your account</p>
 	</div>
 
-	<div class="p-8 border border-gray-300 dark:border-gray-600 rounded-xl shadow-sm">
+	<div class="p-8 border bg-gray-300 dark:bg-gray-800 border-gray-300 dark:border-gray-600 rounded-xl shadow-sm">
 		<form method="post" action="?/loginUser" use:enhance={submitLoginUser}>
-			<div>
+			<div class="mb-4">
 				<label for="email" class="mb-0.5 text-text-900">Email</label>
 				<input
 					type="email"
@@ -57,7 +57,7 @@
 				<InlineFormNotice feedback={getFeedbackObjectByPath(form?.feedbacks, 'email')} />
 			</div>
 
-			<div>
+			<div class="mb-4">
 				<label for="password" class="mb-0.5 text-text-900">Password</label>
 				<input
 					type="password"
@@ -67,32 +67,25 @@
 				/>
 				<InlineFormNotice feedback={getFeedbackObjectByPath(form?.feedbacks, 'password')} />
 
-				<a href="/password-reset" class="text-sm text-right text-blue-600 underline"
+				<a href="/password-reset" class="text-right text-blue-600 underline pt-2"
 					>Forgot your password?</a
 				>
 			</div>
 
 			<SubmitButton {running} text="Login" />
 		</form>
 
-		<div class="flex flex-col mt-12 space-y-4 social-logins">
-			<!-- <a href="/oauth/github" class="rounded-md bg-gray-900 p-2.5 text-sm font-semibold text-white shadow-sm hover:bg-gray-800 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-600 flex justify-around items-center">Login with GitHub</a> -->
-			<a
-				href="/oauth/google"
-				class="rounded-md bg-primary-600 dark:bg-primary-300 p-2.5 text-sm font-semibold text-white shadow-sm hover:bg-primary-500 dark:hover:bg-primary-300
-				focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-600 flex justify-around items-center"
-			>
-				Login with Google
-			</a>
+		<div class="flex flex-col mt-6 space-y-4 social-logins">
+			<div class="text-center">
+				<p class="text-gray-600">
+					First time here? <a
+						href="/auth/signup"
+						class="font-medium text-blue-600 underline">Start here</a
+					>
+				</p>
+			</div>
 		</div>
 	</div>
 </div>
 
-<div class="text-center">
-	<p class="text-sm text-gray-600">
-		You don't have an account yet? <a
-			href="/auth/signup"
-			class="font-medium text-blue-600 underline">Create one</a
-		>
-	</p>
-</div>
+
diff --git a/src/routes/(auth)/auth/signup/+page.server.ts b/src/routes/(auth)/auth/signup/+page.server.ts
@@ -1,25 +1,21 @@
-import { generateEmailVerificationToken } from '$lib/drizzle/postgres/models/tokens';
-import { createUser } from '$lib/drizzle/postgres/models/users';
-import { sendEmail } from '$lib/emails/send';
+import { createUser, getUserByEmail } from '$lib/drizzle/postgres/models/users';
 import { getFeedbackObjects } from '$lib/utils/utils';
-import { fail, redirect } from '@sveltejs/kit';
+import { fail } from '@sveltejs/kit';
 import { nanoid } from 'nanoid';
 import { z } from 'zod';
 import type { Actions } from './$types';
 import { Argon2id } from 'oslo/password';
-import type { InsertUser, InsertUserKey, InsertUserProfile } from '$lib/drizzle/postgres/db.model';
-import { lucia } from '$lib/lucia/postgres';
-
+import type { InsertUser, InsertUserKey, InsertUserProfile, SelectEmployee } from '$lib/drizzle/postgres/db.model';
+import { AuthUtils } from '$lib/utils/auth';
+import { dev } from '$app/environment';
+import { getEmployeeByEmail } from '$lib/drizzle/postgres/models/employees';
 
 const signupUserSchema = z.object({
-  firstName: z.string().optional(),
-  lastName: z.string().optional(),
-  email: z.string().email(),
-  password: z.string().min(1)
+  email: z.string().email()
 });
 
 export const actions: Actions = {
-  signupUser: async ({ locals, request, url, cookies }) => {
+  signupUser: async ({ request, url }) => {
     const formData = Object.fromEntries(await request.formData());
     const signupUser = signupUserSchema.safeParse(formData);
 
@@ -40,85 +36,54 @@ export const actions: Actions = {
       });
     }
 
-    const { firstName, lastName, email, password: inputPassword } = signupUser.data;
+    const { email } = signupUser.data;
     
-    try {      
-      const insertUser = {
-        id: nanoid(),
-        email,
-      } as InsertUser;
-        
-      const hashedPassword = await new Argon2id().hash(inputPassword);
-      
-      const insertUserKey = {
-        id: nanoid(),
-        userId: insertUser.id,
-        hashedPassword,
-      } as InsertUserKey;
+    try {
+      // Check if user exists
+      const existingEmployee = await getEmployeeByEmail(email);
       
-      const insertUserProfile = {
-        id: nanoid(),
-        userId: insertUser.id,
-        firstName,
-        lastName,
-        clientId: 'default',
-        role: 'user',
-      } as InsertUserProfile;
+      if (existingEmployee) {
+        let userId: string;
+        const user = await getUserByEmail(email);
         
-      const result = await createUser(insertUser, insertUserKey, insertUserProfile);
-      
-      if (!result.success) {
-        return fail(500, {
-          feedbacks: [
+        if (!user) {
+          userId = await createNewUserFromEmployee(email, existingEmployee);
+        } else {
+          userId = user.id;
+        }
+        
+        // User exists, send password reset
+        const failure = await AuthUtils.sendPasswordResetLink(url.origin, email, userId);
+        
+        if (failure) {
+          throw new Error(failure.data.feedbacks[0].message);
+        }
+        
+        return {
+          feedbacks: getFeedbackObjects([
             {
-              type: 'error',
-              title: 'Error creating user',
-              message: 'An error occurred while creating your account. Please try again.'
+              type: 'success',
+              title: 'Password Reset Link Sent',
+              message: 'If an account exists with this email, you will receive a password reset link.'
             }
-          ]
-        });
+          ])
+        };
       }
       
-      const session = await lucia.createSession(insertUser.id, {});
-      const sessionCookie = lucia.createSessionCookie(session.id);
-
-      // Set session cookie
-      cookies.set(sessionCookie.name, sessionCookie.value, {
-        path: '.',
-        ...sessionCookie.attributes,
-      });
-
-      // Send verification email
-      const verificationToken = await generateEmailVerificationToken(insertUser.id);
-
-      const sender = 'Stacks <drew@verostack.dev>';
-      const recipient = firstName ? `${firstName}` : email;
-      const emailHtml = `Hello ${recipient},
-			<br><br>
-			Thank you for signing up to Stacks! Please click the link below to verify your email address:
-			<br><br>
-			<a href="${url.origin}/app/email-verification/${verificationToken}">Verify Email Address</a>
-			<br>
-			You can also copy directly into your browser:
-			<br><br>
-			<code>${url.origin}/app/email-verification/${verificationToken}</code>
-			<br><br>
-			Thanks,
-			<br>
-			Drew from Stacks`;
-
-      const signupEmail = await sendEmail({
-        from: sender,
-        to: email,
-        subject: 'Verify Your Email Address',
-        html: emailHtml
-      });
-
-      if (signupEmail[0].type === 'error') {
-        return fail(500, {
-          feedbacks: signupEmail
-        });
+      if (dev) {
+        console.log('User does not exist, sending email verification link');
       }
+
+      // If user doesn't exist, return same message to avoid email enumeration
+      return {
+        feedbacks: getFeedbackObjects([
+          {
+            type: 'success',
+            title: 'Password Reset Link Sent',
+            message: 'If an account exists with this email, you will receive a password reset link.'
+          }
+        ])
+      };
     } catch (e) {
       const feedbacks = getFeedbackObjects([
         {
@@ -132,7 +97,34 @@ export const actions: Actions = {
         feedbacks
       });
     }
-
-    redirect(302, '/app/email-verification');
   }
 };
+
+const createNewUserFromEmployee = async (email: string, existingEmployee: SelectEmployee) => {
+  // Create user record for existing employee
+  const userId = nanoid();
+  const newUser: InsertUser = {
+    id: userId,
+    email: email,
+    emailVerified: false
+  };
+
+  const newUserKey: InsertUserKey = {
+    id: `email:${email}`,
+    userId: userId,
+    hashedPassword: await new Argon2id().hash(nanoid())
+  };
+
+  const newUserProfile: InsertUserProfile = {
+    id: nanoid(),
+    userId: userId,
+    clientId: existingEmployee.clientId,
+    role: 'user',
+    firstName: existingEmployee.firstName,
+    lastName: existingEmployee.lastName
+  };
+
+  await createUser(newUser, newUserKey, newUserProfile);
+  
+  return userId;
+}
diff --git a/src/routes/(auth)/auth/signup/+page.svelte b/src/routes/(auth)/auth/signup/+page.svelte
