- aggiornamento refreshtoken (parte 1)

- PCB: fix listino

src/server/models/user.js

@@ -123,6 +123,10 @@ const UserSchema = new mongoose.Schema({
         type: String,
         required: true,
       },
+      refreshToken: {
+        type: String,
+        default: '',
+      },
       date_login: {
         type: Date,
       },
@@ -530,8 +534,19 @@ UserSchema.methods.generateAuthToken = function (req) {
   const access = 'auth';
   const browser = useragent;
   const prova = 'PROVAMSG@1A'
-  const token = jwt.sign({ _id: prova, smart: user._id.toHexString(), access, un: user.username },
-    process.env.SIGNCODE).toString();
+  let attiva_scadenza = user.idapp ? tools.getEnableTokenExpiredByIdApp(user.idapp) : false;
+
+  let token = null;
+
+  if (attiva_scadenza)
+    token = jwt.sign({ _id: prova, smart: user._id.toHexString(), access, un: user.username },
+      process.env.SIGNCODE, { expiresIn: process.env.TOKEN_LIFE }).toString();
+  else
+    token = jwt.sign({ _id: prova, smart: user._id.toHexString(), access, un: user.username },
+      process.env.SIGNCODE).toString();
+
+  const refreshToken = jwt.sign({ _id: prova, smart: user._id.toHexString(), access, un: user.username },
+    process.env.SECRK, { expiresIn: process.env.REFRESH_TOKEN_LIFE }).toString();
   const date_login = new Date();
 
   // CANCELLA IL PRECEDENTE !
@@ -539,15 +554,17 @@ UserSchema.methods.generateAuthToken = function (req) {
     return (tok.access !== access) ||
       ((tok.access === access) && (tok.browser !== browser));
   });
-  user.tokens.push({ access, browser, token, date_login });
+
+  user.tokens.push({ access, browser, token, date_login, refreshToken });
 
   user.lasttimeonline = new Date();
 
   return user.save().then(() => {
     // console.log("TOKEN CREATO IN LOGIN : " + token);
-    return token;
+    return { token, refreshToken };
   }).catch(err => {
     console.log('Error', err.message);
+    return { token: '', refreshToken: '' }
   });
 };
 
@@ -687,21 +704,58 @@ UserSchema.statics.isFacilitatore = function (perm) {
   }
 };
 
-UserSchema.statics.findByToken = function (token, typeaccess) {
+UserSchema.statics.findByToken = async function (token, typeaccess, con_auth) {
   const User = this;
   let decoded;
+  let code = server_constants.RIS_CODE_HTTP_INVALID_TOKEN;
+  let user = null;
 
   try {
-    decoded = jwt.verify(token, process.env.SIGNCODE);
+    if (token) {
+      decoded = jwt.verify(token, process.env.SIGNCODE);
+
+      code = server_constants.RIS_CODE_OK;
+    }
+
   } catch (e) {
-    return Promise.resolve(null);
+
+    if (e.expiredAt) {
+
+      if (con_auth) {
+        return { user: null, code: server_constants.RIS_CODE_HTTP_FORBIDDEN_TOKEN_EXPIRED };
+      } else {
+
+      }
+    } else {
+      console.error('Err findByToken:', e);
+    }
   }
 
-  return User.findOne({
-    '_id': decoded.smart,
-    'tokens.token': token,
-    'tokens.access': typeaccess,
-  });
+  if (code === server_constants.RIS_CODE_OK) {
+    user = await User.findOne({
+      '_id': decoded.smart,
+      'tokens.token': token,
+      'tokens.access': typeaccess,
+    });
+
+    if (user) {
+      let check_expiry_date = false
+      // Controlla se il sito ha attivo il controllo del Token Scaduto
+      if (tools.getEnableTokenExpiredByIdApp(user.idapp)) {
+        check_expiry_date = true
+      }
+
+      if (check_expiry_date && (decoded.exp < Date.now() / 1000)) {
+        console.log('Il token è scaduto, generazione del nuovo token...');
+        code = server_constants.RIS_CODE_HTTP_FORBIDDEN_TOKEN_EXPIRED;
+      } else {
+        // TOKEN ANCORA VALIDO
+        code = server_constants.RIS_CODE_OK;
+      }
+    }
+  }
+
+  return { user, code };
 };
 
 UserSchema.statics.findByTokenAnyAccess = function (token) {
@@ -5212,9 +5266,10 @@ UserSchema.statics.getProfilePerActivitiesByUsername = async function (idapp, us
   try {
     let myuser = await User.findOne({ idapp, username }).lean();
     if (myuser) {
-      return { 
-        mygroups: myuser.profile.mygroups, 
-        mycircuits: myuser.profile.mycircuits };
+      return {
+        mygroups: myuser.profile.mygroups,
+        mycircuits: myuser.profile.mycircuits
+      };
     }
   } catch (e) {
     console.error('e', e);