accounts.js

/**
 * This file contains the MongoDB translations needed to read
 * and write to user accounts and configure their user data.
 * Every account has data relevant to the following collections
 * Accounts/accounts - Used to store account profile information (username, password hash salt etc.)
 * Accounts/data - Used to store a string from the user
 * Accounts/sessions - Information used to validate a user's session and thus their identity
 * 
 * Every user has a unique user id, generated by MongoDB, which is used to identify the
 * user throughout the collections. For any data tied to a user account, the document will
 * contain a field containing the user_id as a string.
 * 
 * @file accounts.js
 * @version 01/06/22
 * @author Pirjot Atwal
 */

// First import the mongo library
// Assume that the client has already been connected and that disconnect is handled by caller
const mongo = require('./mongodb-library.js');
// Import the crypto module, used for encrypting a given username and password
const crypto = require('crypto');
const fs = require('fs');;
var ObjectID = require('mongodb').ObjectID;

/**
 * Decrypt the hash/salt using a password and return true if the password is correct.
 * 
 * @param {String} password - The plain text password
 * @param {String} hash - The hash stored in the database
 * @param {String} salt - The salt stored in the database
 * @return {Boolean} if password is correct
 */
 function validPassword(password, hash, salt) {
    var hashVerify = crypto.pbkdf2Sync(password, salt, 10000, 64, 'sha512').toString('hex');
    return hash === hashVerify;
}

/**
 * Generate a hash and salt encrypted version for a password.
 * 
 * @param {String} password The password to encrypt
 * @returns JSON with salt and hash as properties
 */
function genPassword(password) {
    var salt = crypto.randomBytes(32).toString('hex');
    var genHash = crypto.pbkdf2Sync(password, salt, 10000, 64, 'sha512').toString('hex');

    return {
        salt: salt,
        hash: genHash
    };
}

/**
 * Determine if a provided email is in valid format.
 * @param {*} email 
 * @returns True if valid, false otherwise
 */
function validateEmail(email) 
{
    return /^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test(email);
}

/**
 * Determine if a password meets complexity requirements.
 * i) at least one upper case letter (A – Z)
 * ii) at least one lower case letter (a - z)
 * iii) At least one digit (0 – 9)
 * iv) at least one special characters of !@#$%&*()
 * @param {*} password 
 * @returns
 */
function validatePassword(password) {
    return /(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%&*()]).{8,}/.test(password);
}

/**
 * Determine if a username is of valid structure.
 * A valid structure is defined as follows:
 * i) Any Alphanumerical characters between the length of 6 to 20
 * ii) No underscore or periods in conjuction
 * 
 * @param {*} username 
 * @returns 
 */
function validateUsername(username) {
    return /^(?=[a-zA-Z0-9._]{6,20}$)(?!.*[_.]{2})[^_.].*[^_.]$/.test(username);
}

/**
 * Determine if a username already exists in the Accounts/accounts database. (Not case sensitive)
 * @param {String} username 
 * @returns {Boolean} true if the username already exists, false otherwise.
 */
async function username_exists(username) {
    try {
        return (await mongo.get_data({"username": RegExp("^"+username+"$", "i")}, "Accounts", "accounts")).length > 0;
    } catch (error) {}
}

/**
 * Determine if an account with the given email already exists. (Not case sensitive)
 * @param {String} email 
 * @returns {Boolean}
 */
async function email_exists(email) {
    try {
        return (await mongo.get_data({"email": RegExp("^"+email+"$", "i")}, "Accounts", "accounts")).length > 0;
    } catch (error) {}
}

/**
 * Sign up a new user, using their passed in username and password.
 * Return an object that symbolizes that status of whether the account was
 * created successfully or not.
 * 
 * @param {String} username A username's requirements is defined by its corresponding function
 * @param {String} password A password's requirements is defined by its corresponding function
 * @return A JSON Object TODO: ADD INFO THAT GETS SENT BACK IN JSON
 */
async function sign_up(username, password, email) {
    let createAccount = false;
    let message = "CREATE ACCOUNT FAILED";
    let user_id = 0;

    //CHECK REQUIREMENTS
    if (await username_exists(username)) { //No duplicate accounts
        message = "USERNAME ALREADY EXISTS";
    } else if (await email_exists(email)) { //No duplicate email
        message = "EMAIL ALREADY EXISTS";
    } else if (!validatePassword(password)) {
        message = "PASSWORD DOES NOT MEET SECURITY STANDARDS";
    } else if (!validateEmail(email)) {
        message = "EMAIL IS OF INVALID FORM";
    } else if (!validateUsername(username)) {
        message = "USERNAME IS OF INVALID FORM";
    } else {
        createAccount = true;
    }
    if (createAccount) {
        message = "ACCOUNT CREATED";

        //Generate a password hash
        let hashSalt = genPassword(password);
        //Data to send to MongoDB database
        let saveMe = {
            time: (new Date()).getTime(),
            username: username,
            email: email,
            hash: hashSalt.hash,
            salt: hashSalt.salt,
        };
        //Send the data to the database (Accounts/accounts collection)
        new_account = await mongo.add_data(saveMe, "Accounts", "accounts");
        user_id = new_account["insertedId"].toString();
        // Save a new profile for the user
        saveMe = {
            "TIME": (new Date()).getTime(),
            "USERNAME": username,
            "DESCRIPTION": "Description not yet set.",
            "USER_ID": user_id
        };
        await mongo.add_data(saveMe, "Accounts", "profiles");
    }

    return {
        info: message,
        account_created: createAccount,
        user_id: user_id,
    };
}

/**
 * Take in a username and password, if it is valid, send back a session.
 * 
 * @param {String} username
 * @param {String} password
 * @returns An object symbolizing if the session was successfully issued.
 * {
 *      info: "LOGIN FAILED" / ...,
 *      user_id: <STRING>,
 *      loggedIn: true / false
 * }
 */
async function login(username, password) {
    let loggedIn = false;
    let message = "LOGIN FAILED";
    let user_id = 0;
    
    let accounts = (await mongo.get_data({"username": username}, "Accounts", "accounts"));

    if (accounts.length == 0) { //An account with that username doesn't exist
        message = "ACCOUNT DOES NOT EXIST";
    } else if (!validPassword(password, accounts[0]["hash"], accounts[0]["salt"])) { //If password isn't right
        message = "INCORRECT PASSWORD";
    } else { //Account is good
        user_id = accounts[0]["_id"].toString();
        message = "LOGIN SUCCESSFUL";
        loggedIn = true;
    }
    return {
        info: message,
        user_id: user_id,
        loggedIn: loggedIn
    };
}

/**
 * Get a person's username using their user_id.
 * 
 * @param {String} user_id
 * @returns {String} the person's username (or null if not found)
 */
async function get_account_username(user_id) {
    let username = null;
    try {
        let matching_accounts = await mongo.get_data({"_id": ObjectID(user_id)}, "Accounts", "accounts");
        let my_account = matching_accounts[0];
        username = my_account["username"];
    } catch (error) {console.log("ERROR OCCURRED IN RETRIEVING USERNAME: " + error.message)}
    return username;
}

async function upload_schedule(user_id, schedule) {
    let success = false;
    try {
        let response = await mongo.add_data(schedule, "Accounts", "schedules");
        success = true;
    } catch (error) {}
    return {success};
}

/**
 * Gets the id of a user from their username.
 * 
 * @param username
 * @returns {String} The id
 */
async function get_id_username(username) {
    try {
        return (await mongo.get_data({"username": username}, "Accounts", "accounts"))[0]["_id"].toString();
    } catch(error) {}
}

/**
 * "Issue" a session for a given user id. If the session for the ID already exists
 * refresh its time.
 * 
 * A session is a document with the following properties:
 * {
 *      user_id: The user id.
 *      hash: The hash to decrypt the encrypted_session, passed back to the client
 *      salt: The salt to decrypt the encrypted_session
 *      issue_time: The time this session was issued in milliseconds.
 *      _id: MongoDB generated ObjectID (unused)
 * }
 * 
 * @param {String} user_id The id of the user to create a session for
 * @returns the session object
 */
async function issue_session(user_id) {
    try {
        let matching_sessions = await mongo.get_data({"user_id": user_id}, "Accounts", "sessions");
        if (matching_sessions.length != 0) { //Just refresh the session if the user already has one
            await mongo.update_docs({"user_id": user_id}, {$set: {issue_time: (new Date()).getTime()}}, "Accounts", "sessions");
        } else { //Issue a new session
            let hashSalt = genPassword(user_id);
            let new_doc = {
                "user_id": user_id,
                "hash": hashSalt.hash,
                "salt": hashSalt.salt,
                issue_time: (new Date()).getTime(),
            }
            await mongo.add_data(new_doc, "Accounts", "sessions");
        }
        //Send back the the user's session (by re-verifying that it actually showed up in the database)
        let sessions = await mongo.get_data({"user_id": user_id}, "Accounts", "sessions");
        return sessions[0];
    } catch (error) {}
}

/**
 * Verify a session by checking if the passed in hash does exist, decrypts 
 * successfully AND the time between when it was issued and now isn't 
 * greater than a day.
 * To refresh the session, call issue_session on the user_id passed back.
 * 
 * @param {String} hash - A session hash that came from the client's cookies.
 * @returns a doc representing the state of the session formatted as such:
 * {
 *      info: "VALID" / "EXPIRED" / "INVALID",
 *      user_id: [STRING]
 *      valid: true / false
 * }
 */
async function verify_session(hash) {
    if (hash == undefined) {
        return {
            valid: false
        };
    }
    try {
        let sessions = await mongo.get_data({"hash": hash}, "Accounts", "sessions");
        let info = "INVALID";
        let valid = false;
        let user_id = 0;
        try {
            let my_session = sessions[0];
            let issue_time = my_session["issue_time"];
            if (((new Date()).getTime() - issue_time) / 1000 / 60 / 60 / 24 > 1) { // Calculate issue_time, can't be greater than a day
                info = "EXPIRED";              
            } else if (validPassword(my_session["user_id"], hash, my_session["salt"])) { //Check decryption
                user_id = my_session["user_id"];
                info = "VALID";
                valid = true;
            }
        } catch (error) {} // console.log("ERROR OCCURRED IN SESSION VERIFICATION " + error.message);
        return {
            info: info,
            valid: valid,
            user_id: user_id
        };
    } catch(error) {} // console.log("ERROR OCCURRED IN SESSION VERIFICATION " + error.message);
    return {
        valid: false
    };
}

/**
 * Fetch all the schedules that belong under a certain user id.
 * @param {String} user_id
 * @returns An array with all schedules that belong under the user
 */
async function get_user_schedules(user_id) {
    let schedules = await mongo.get_data({"user_id": user_id}, "Accounts", "schedules");
    // Trim _id and user_id
    for (let i = 0; i < schedules.length; i++) {
        delete schedules[i]["_id"];
        delete schedules[i]["user_id"];
    }
    return schedules;
}

/**
 * Create a new schedule in the Accounts database for a user.
 * @param {String} user_id 
 * @param {Array} majors 
 * @param {Array} universities 
 * @param {String} name 
 */
async function create_schedule(user_id, majors, universities, name) {
    mongo.add_data({
        user_id: user_id,
        "USERNAME": await get_account_username(user_id),
        "SEMESTERS": [],
        "MAJORS": majors,
        "UNIVERSITIES": universities,
        "CREDITS": 0.0,
        "NAME": name,
        "created": (new Date()).getTime()
    }, "Accounts", "schedules");
}

/**
 * Delete the schedule with the given name and user_id.
 * @param {*} user_id 
 * @param {*} name 
 */
async function delete_schedule(user_id, name) {
    await mongo.delete_docs_q({user_id: user_id, "NAME": name}, "Accounts", "schedules")
}

/**
 * Fetch the schedule with a given user id and name.
 * @param {String} user_id 
 * @param {String} name 
 * @returns the schedule object, if not found then JSON object detailing validity
 */
async function fetch_schedule(user_id, name) {
    let schedules = await mongo.get_data({"user_id": user_id, "NAME": name}, "Accounts", "schedules");
    if (schedules.length == 0) {
        return {"info": "DOES NOT EXIST", valid: false};
    }
    // Trim _id and user_id
    let return_me = schedules[0];
    delete return_me["_id"];
    delete return_me["user_id"];
    return return_me;
}

/**
 * Edit a schedule based on the type provided.
 * @param {String} user_id 
 * @param {String} type "ADD" / "REMOVE"
 * @param {String} name 
 * @param {String} acr 
 * @param {String} season 
 * @param {String} year 
 */
async function edit_schedule(user_id, type, name, acr, season, year) {
    // First, fetch the schedule.
    let schedule = await fetch_schedule(user_id, name);
    if (schedule.valid == false) {
        return;
    }

    // Make the change based on the type of change requested
    if (type == "ADD") {
        // First, check if the semester we are adding to already exists
        let needNewSemester = true;
        for (let i = 0; i < schedule["SEMESTERS"].length; i++) {
            if (schedule["SEMESTERS"][i]["SEASON"] == season && schedule["SEMESTERS"][i]["YEAR"] == year) {
                needNewSemester = false;
                schedule["SEMESTERS"][i]["CLASSES"].push(acr);
            }
        }
        if (needNewSemester) {
            schedule["SEMESTERS"].push({
                "SEASON": season,
                "YEAR": year,
                "CLASSES": [acr]
            });
        }
    } else { // Remove the instance of the class acr for the semester/year chosen
        for (let i = 0; i < schedule["SEMESTERS"].length; i++) {
            if (schedule["SEMESTERS"][i]["SEASON"] == season && schedule["SEMESTERS"][i]["YEAR"] == year) {
                let j = 0;
                while (j < schedule["SEMESTERS"][i]["CLASSES"].length) {
                    if (schedule["SEMESTERS"][i]["CLASSES"][j] == acr) {
                        schedule["SEMESTERS"][i]["CLASSES"].splice(j, 1);
                        break;
                    }
                    j++;
                }
            }
        }
    }

    // Trim semesters with empty classes
    let i = 0;
    while (i < schedule["SEMESTERS"].length) {
        if (schedule["SEMESTERS"][i]["CLASSES"].length == 0) {
            schedule["SEMESTERS"].splice(i, 1);
        }
        i++;
    }

    // Calculate credits and set accordingly
    let data = JSON.parse(fs.readFileSync("2021_2022_class_data.json"));
    let credits = 0;
    for (let i = 0; i < schedule["SEMESTERS"].length; i++) {
        for (let j = 0; j < schedule["SEMESTERS"][i]["CLASSES"].length; j++) {
            let course = schedule["SEMESTERS"][i]["CLASSES"][j];
            for (let class_obj of data["CLASSES"]) {
                if (class_obj["AREA-ACR"] == course) {
                    credits += class_obj["UNITS"];
                    break;
                }
            }
        }
    }
    schedule["CREDITS"] = credits;
    
    /**
     * A callback function for the Array sort function.
     * Sorts the semesters in descending order.
     * @param {JSON} sem1 
     * @param {JSON} sem2 
     * @returns 1 if the sem1 is after sem2, else -1
     */
    function sortSemesters (sem1, sem2) {
        if (sem1["YEAR"] > sem2["YEAR"]) {
            return -1;
        }
        if (sem1["YEAR"] == sem2["YEAR"]) {
            if (sem1["SEASON"] == "Spring") {
                return 1;
            } else if (sem1["SEASON"] == "Fall") {
                return -1;
            } else if (sem2["SEASON"] == "Spring") {
                return -1;
            }
        }
        return 1;
    }
    schedule["SEMESTERS"].sort(sortSemesters);

    // Update the Semesters and Credits Fields
    await mongo.update_docs({
        user_id: user_id,
        "NAME": name
    }, {$set: {"SEMESTERS": schedule["SEMESTERS"], "CREDITS": schedule["CREDITS"]},},
    "Accounts", "schedules");
    return schedule;
}

/**
 * Fetch schedules using the provided options. Sorts, skips and limits.
 * @param {*} queries 
 * @param {*} dateRange
 * @param {*} sortOption 
 * @param {*} matching 
 * @param {*} majors
 * @param {*} universities
 * @param {*} page 
 */
async function fetch_schedules_batch(queries, dateRange, sortOption, matching, majors, universities, page) {
    //TODO: Add more documentation
    let sort = {};
    let schedules = [];

    //Build Sort Object
    if (sortOption == "Author") {
        sort = {"USERNAME": 1};
    } else if (sortOption == "Major") {
        sort = {"MAJORS.0": 1}; 
    } else if (sortOption == "University") {
        sort = {"UNIVERSITIES.0": 1};
    } else if (sortOption == "Schedule Name") {
        sort = {"NAME": 1};
    } else {
        sort = {"created": 1};
    }

    // Build Author and Name String for regex
    let authorString = "";
    let nameString = "";

    for (let queryItem of Object.keys(queries)) {
        if (queryItem == "Author" && queries[queryItem] != '') {
            for (let author of queries[queryItem]) {
                if (author != '') {
                    authorString += "(?=.*" + author + ")";
                }
            }
        } else if (queryItem == "Schedule Name") {
            for (let name of queries[queryItem]) {
                if (name != '') {
                    nameString += "(?=.*" + name + ")";
                }
            }
        }
    }

    let query = {"USERNAME": RegExp(authorString, "i"), "NAME": RegExp(nameString, "i")};

    // Apply Date Range
    query["created"] = {$gte: dateRange[0], $lte: dateRange[1]};

    schedules = await mongo.get_data_paged(query, sort, "Accounts", "schedules", (page - 1) * 50, 50);

    // Limit by majors and universities inputted by user
    let i = 0;
    while (i < schedules.length) {
        let scheduleMajors = schedules[i]["MAJORS"].map((str) => str.toLowerCase());
        let scheduleUniversities = schedules[i]["UNIVERSITIES"].map((str) => str.toLowerCase());
        let cutThisSchedule = false;
        for (let queryItem of Object.keys(queries)) {
            if (queryItem == "Major") {
                for (let major of queries[queryItem]) {
                    let substringOfOne = false;
                    if (major != '') {
                        for (let scheduleMajor of scheduleMajors) {
                            if (scheduleMajor.includes(major.toLowerCase())) {
                                substringOfOne = true;
                                break;
                            }
                        }
                        if (!substringOfOne) {
                            cutThisSchedule = true;
                            break;
                        }
                    }
                }
            } else if (queryItem == "University") {
                for (let university of queries[queryItem]) {
                    let substringOfOne = false;
                    if (university != '') {
                        for (let scheduleUni of scheduleUniversities) {
                            if (scheduleUni.includes(university.toLowerCase())) {
                                substringOfOne = true;
                                break;
                            }
                        }
                        if (!substringOfOne) {
                            cutThisSchedule = true;
                            break;
                        }
                    }
                }
            }
            if (cutThisSchedule) {
                break;
            }
        }
        if (cutThisSchedule) {
            schedules.splice(i, 1);
        } else {
            i++;
        }
    }


    // Limit by matching majors and universities
    if (matching) {
        let i = 0;
        while (i < schedules.length) {
            let include = false;
            let scheduleMajors = schedules[i]["MAJORS"];
            let scheduleUniversities = schedules[i]["UNIVERSITIES"];
            let majorSkip = false;
            for (let major of majors) {
                if (scheduleMajors.includes(major)) {
                    majorSkip = true;
                    break;
                }
            }
            if (majorSkip) {
                for (let university of universities) {
                    if (scheduleUniversities.includes(university)) {
                        include = true;
                        break;
                    }
                }
            }
            //TODO: Remove the inputted schedule?
            if (!include) { // Remove the schedule
                schedules.splice(i, 1);
            } else { // Keep the schedule
                i++;
            }
        }
    }

    // Trim _id and user_id
    for (let i = 0; i < schedules.length; i++) {
        delete schedules[i]["_id"];
        delete schedules[i]["user_id"];
    }
    return schedules;
}

/**
 * Fetch a user profile using their username.
 * @param {*} username 
 * @returns 
 */
async function fetch_user_profile(username) {
    let profiles = await mongo.get_data({"USERNAME": username}, "Accounts", "profiles");
    let profile = {exists: false};
    if (profiles.length > 0) {
        profile = profiles[0];
        let schedules = await mongo.get_data({"USERNAME": username}, "Accounts", "schedules");
        profile["SCHEDULES"] = schedules;
    }

    try { //Delete unaccessable items
        delete profile["_id"];
        delete profile["USER_ID"];
    }
    catch (error) {}
    return profile;
}

/**
 * Update an account's profile parameters based on a user selected option.
 * 
 * @param {String} user_id
 * @param {String} type 
 * @param {JSON} body 
 */
async function update_account(user_id, type, body) {
    let account = (await mongo.get_data({"username": await get_account_username(user_id)}, "Accounts", "accounts"))[0];
    if (type == "USERNAME") {
        let username = body.username;
        let password = body.password;
        if (!validateUsername(username)) {
            return {"info": "THE USERNAME PROVIDED IS INVALID.", success: false};
        } else if (await username_exists(username)) {
            return {"info": "THE USERNAME ALREADY EXISTS.", success: false};
        } 
        if (!validPassword(password, account["hash"], account["salt"])) { //If password isn't right
            return {"info": "PASSWORD WAS INVALID", success: false};
        }
        // Perform change to all required databases
        await mongo.update_docs({"username": account["username"]}, {$set: {"username": username}}, "Accounts", "accounts");
        await mongo.update_docs({"USERNAME": account["username"]}, {$set: {"USERNAME": username}}, "Accounts", "profiles");
        await mongo.update_docs({"USERNAME": account["username"]}, {$set: {"USERNAME": username}}, "Accounts", "schedules");
        return {"info": "THE USERNAME WAS CHANGED SUCCESSFULLY.", success: true};
    } else if (type == "EMAIL") {
        let email = body.email;
        if (!validateEmail(email)) {
            return {"info": "THE EMAIL PROVIDED IS INVALID.", success: false};
        } else if (await email_exists(email)) {
            return {"info": "THE EMAIL ALREADY EXISTS.", success: false};
        }
        await mongo.update_docs({"username": account["username"]}, {$set: {"email": email}}, "Accounts", "accounts");
        return {"info": "THE EMAIL WAS CHANGED SUCCESSFULLY.", success: true};
    } else if (type == "DESCRIPTION") {
        let description = body.description;
        await mongo.update_docs({"USERNAME": account["username"]}, {$set: {"DESCRIPTION": description}}, "Accounts", "profiles");
        return {"info": "THE DESCRIPTION WAS CHANGED SUCCESSFULLY.", success: true};
    } else if (type == "DELETE") {
        // TODO DELETE EVERYTHING
        mongo.delete_docs_q({_id: ObjectID(user_id)}, "Accounts", "accounts");
        mongo.delete_docs_q({"USER_ID": user_id}, "Accounts", "profiles");
        mongo.delete_docs_q({"user_id": user_id}, "Accounts", "schedules");
        mongo.delete_docs_q({"user_id": user_id}, "Accounts", "sessions");
        return {"info": "THE ACCOUNT WAS DELETED SUCCESSFULLY.", success: true};
    }
    return {"info": "THE TYPE PROVIDED IS INVALID"};
}

module.exports = {
    sign_up, login, get_account_username, get_id_username,
    issue_session, verify_session, upload_schedule, get_user_schedules,
    create_schedule, delete_schedule, fetch_schedule, edit_schedule,
    fetch_schedules_batch, fetch_user_profile, update_account
}