diff --git a/IoT-sensor/Database/mySQL.js b/IoT-sensor/Database/mySQL.js
index 255dc3a..0f86d40 100644
--- a/IoT-sensor/Database/mySQL.js
+++ b/IoT-sensor/Database/mySQL.js
@@ -9,13 +9,13 @@ const sequelize = new Sequelize(
process.env.DB_USER,
process.env.DB_PASS,
{
- host: "mpsqldatabase.mysql.database.azure.com",
- dialect: 'mysql',
+ host: "mpsqldatabasean.mysql.database.azure.com",
+ dialect: 'mysql',
// attributeBehavior?: 'escape' | 'throw' | 'unsafe-legacy';
attributeBehavior: 'escape',
dialectOptions: {
ssl: {
- ca: fs.readFileSync(path.resolve(__dirname, '../cert/DigiCertGlobalRootCA.crt.pem')),
+ ca: fs.readFileSync(path.resolve(__dirname, '../cert/DigiCertGlobalRootCA.crt_3.pem')),
},
},
diff --git a/README.md b/README.md
index 3eaadc6..8e78093 100644
--- a/README.md
+++ b/README.md
@@ -7,16 +7,15 @@ i repeat DO NOT USE CREDS IN CODE! Please use .env files (https://www.npmjs.com/
## Workload
1) Ti Seng
-* Webserver Microservices
* IoT sensor
* Most Database / Backend Functions of this repo
* consumer website api and user function
+
2) Sean
* Admin Website Microservice
Micro Service
-1) api.blah handle api
-2) admin.blah admin website
-3) consumer.blah comsumer
-4) proxy.blah reverproxy
-5) mqtt.blah mqtt service
+1) admin.blah admin website
+2) consumer.blah comsumer
+3) proxy.blah reverproxy
+4) mqtt.blah mqtt service
diff --git a/Sean/modules/nodeMailer.js b/Sean/modules/nodeMailer.js
index 45ac730..ccae59f 100644
--- a/Sean/modules/nodeMailer.js
+++ b/Sean/modules/nodeMailer.js
@@ -13,4 +13,6 @@ let transporter = nodemailer.createTransport({
pass: process.env.epass
},
});
-module.exports = { transporter };
\ No newline at end of file
+module.exports = { transporter };
+
+
diff --git a/Sean/modules/otpUtils.js b/Sean/modules/otpUtils.js
new file mode 100644
index 0000000..7ed2780
--- /dev/null
+++ b/Sean/modules/otpUtils.js
@@ -0,0 +1,47 @@
+const nodemailer = require("nodemailer");
+const otpGenerator = require('otp-generator');
+const path = require('path');
+require('dotenv').config({ path: path.resolve(__dirname, '../.env') })
+
+const generateOTP = () => {
+ const otp = otpGenerator.generate(8, { upperCase: true, specialChars: true });
+ const expirationTime = Date.now() + 5 * 60 * 1000; // 5 minutes expiration
+ return { otp, expirationTime };
+
+ };
+const sendOTPByEmail = async (email, otp) => {
+ try {
+ const transporter = nodemailer.createTransport({
+ service: 'gmail',
+ host: 'smtp.gmail.com',
+ port: 587, // use the appropriate port for your SMTP server
+ secure: false, // true for 465, false for other ports
+ auth: {
+ user: process.env.euser, // replace with your email
+ pass: process.env.epass // replace with your email password
+ }
+ });
+
+ const mailOptions = {
+ from: process.env.euser,
+ to: email,
+ subject: 'Login OTP',
+ text: `Your OTP for login is: ${otp}`
+ };
+
+ await transporter.sendMail(mailOptions);
+ console.log('OTP sent successfully to', email);
+ } catch (error) {
+ console.error('Error sending OTP:', error);
+ throw error;
+ }
+ };
+
+ module.exports = {
+ generateOTP,
+ sendOTPByEmail
+ };
+
+
+
+
\ No newline at end of file
diff --git a/Sean/modules/rateLimitMiddleware.js b/Sean/modules/rateLimitMiddleware.js
new file mode 100644
index 0000000..b562538
--- /dev/null
+++ b/Sean/modules/rateLimitMiddleware.js
@@ -0,0 +1,13 @@
+const rateLimit = require('express-rate-limit');
+
+const limiter = rateLimit({
+ windowMs: 15 * 60 * 1000, // 15 minutes
+ max: 5, // limit each IP to 5 requests per windowMs
+ message: 'Too many login attempts from this IP, please try again later.',
+ standardHeaders: "draft-7", // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
+ legacyHeaders: false, // Disable the `X-RateLimit-*` headers.
+});
+
+module.exports = limiter;
+
+
diff --git a/Sean/modules/validationMiddleware.js b/Sean/modules/validationMiddleware.js
new file mode 100644
index 0000000..7a878da
--- /dev/null
+++ b/Sean/modules/validationMiddleware.js
@@ -0,0 +1,106 @@
+const {body } = require('express-validator');
+
+const locationValidation = [
+ body('name').trim().isLength({ min: 1 }).withMessage('Name must not be empty').escape(),
+ body('added_by').trim().isLength({ min: 1 }).withMessage('Added by must not be empty').escape(),
+ body('description').trim().escape(),
+];
+
+const locationValidationUpdate = [
+ body('id').trim().escape(),
+ body('name').trim().isLength({ min: 1 }).withMessage('Name must not be empty').escape(),
+ body('added_by').trim().isLength({ min: 1 }).withMessage('Added by must not be empty').escape(),
+ body('description').trim().escape(),
+ ];
+
+const locationdeleteValidation = [
+ body('id').trim().escape()
+ ];
+
+const sensorValidation = [
+ body('sensorname').trim().isLength({ min: 1 }).withMessage('Sensor Name must not be empty').escape(),
+ body('added_by').trim().isLength({ min: 1 }).withMessage('Added by must not be empty').escape(),
+ body('macAddress').escape().custom(value => {
+ const macAddressRegex = /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/;
+ if (!macAddressRegex.test(value)) {
+ throw new Error('Invalid MAC address format');
+ }
+ return true;
+ }).withMessage('Invalid MAC address format').escape(),
+ body('description').trim().escape(),
+ body('location').trim().escape()
+ ];
+
+const sensorupdateValidation = [
+ body('id').trim().escape(),
+ body('sensorname').trim().isLength({ min: 1 }).withMessage('Sensor Name must not be empty').escape(),
+ body('added_by').trim().isLength({ min: 1 }).withMessage('Added by must not be empty').escape(),
+ body('macAddress').escape().custom(value => {
+ const macAddressRegex = /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/;
+ if (!macAddressRegex.test(value)) {
+ throw new Error('Invalid MAC address format');
+ }
+ return true;
+ }).withMessage('Invalid MAC address format').escape(),
+ body('description').trim().escape(),
+ body('location').trim().escape()
+ ];
+
+const sensordeleteValidation = [
+ body('id').trim().escape()
+ ];
+
+const loginValidation = [
+ body('username').escape().trim().isLength({ min: 1 }).withMessage('Username must not be empty'),
+ body('password').escape().trim().isLength({ min: 1 }).withMessage('Password must not be empty'),
+ ];
+
+const otpValidation = [
+ body('otp').escape().trim().isLength({ min: 1 }).withMessage('OTP must not be empty'),
+ ];
+
+const createValidation = [
+ body('name').trim().isLength({ min: 1 }).withMessage('Name must not be empty').escape(),
+ body('username').trim().isLength({ min: 1 }).withMessage('Username must not be empty').escape(),
+ body('email').isEmail().withMessage('Invalid email address').normalizeEmail(),
+ body('password').escape().trim().custom((value) => {
+ if (!isStrongPassword(value)) { throw new Error('Password does not meet complexity requirements'); } return true;
+ }),
+ body('jobTitle').trim().isLength({ min: 1 }).withMessage('Job title must not be empty').escape(),
+ ];
+
+ function isStrongPassword(password) {
+ // Password must be at least 10 characters long
+ if (password.length < 10) {
+ return false;
+ }
+
+ // Password must contain at least one uppercase letter
+ if (!/[A-Z]/.test(password)) {
+ return false;
+ }
+
+ // Password must contain at least one lowercase letter
+ if (!/[a-z]/.test(password)) {
+ return false;
+ }
+
+ // Password must contain at least one digit
+ if (!/\d/.test(password)) {
+ return false;
+ }
+
+ // Password must contain at least one symbol
+ if (!/[!@#$%^&*(),.?":{}|<>]/.test(password)) {
+ return false;
+ }
+
+ return true;
+}
+module.exports = {
+ locationValidation,locationValidationUpdate,locationdeleteValidation
+ ,sensorValidation,sensorupdateValidation,sensordeleteValidation,loginValidation,otpValidation
+ ,createValidation
+};
+
+
diff --git a/Sean/server.js b/Sean/server.js
index 278a374..6215645 100644
--- a/Sean/server.js
+++ b/Sean/server.js
@@ -1,26 +1,26 @@
const express = require("express");
const session = require("express-session");
-const rateLimit = require('express-rate-limit');
const cookieParser = require('cookie-parser');
const bodyParser = require("body-parser");
const bcrypt = require("bcrypt");
const crypto = require("crypto");
-const nodemailer = require("nodemailer");
-const otpGenerator = require('otp-generator');
-const { body, validationResult } = require('express-validator');
const validator = require('validator');
+const axios = require('axios');
+const pidusage = require('pidusage');
+
+const { validationResult } = require('express-validator');
+const { locationValidation, locationValidationUpdate, locationdeleteValidation
+,sensorValidation, sensorupdateValidation, sensordeleteValidation, loginValidation
+,otpValidation, createValidation } = require('./modules/validationMiddleware');
+const rateLimit = require('./modules/rateLimitMiddleware');
+const { generateOTP, sendOTPByEmail } = require('./modules/otpUtils');
const { format } = require('date-fns');
-const helmet = require('helmet');
const { Sequelize } = require('sequelize');
const { transporter } = require("./modules/nodeMailer");
const { sequelize, User } = require("./modules/mysql");
-const userLogs= require('./models/userLogs')(sequelize); // Adjust the path based on your project structure
+const userLogs= require('./models/userLogs')(sequelize);
const app = express();
-const nonce = crypto.randomBytes(16).toString('base64');
-
-console.log('Nonce:', nonce);
-
app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json());
app.use(cookieParser());
@@ -30,17 +30,6 @@ require("dotenv").config();
app.use(bodyParser.urlencoded({ extended: true }));
app.set("view engine", "ejs");
-app.use(
- helmet.contentSecurityPolicy({
- directives: {
- defaultSrc: ["'self'",`'nonce-${nonce}'`],
- scriptSrc: ["'self'",`'nonce-${nonce}'`,"'strict-dynamic'", 'cdn.jsdelivr.net', 'fonts.googleapis.com', 'stackpath.bootstrapcdn.com', 'code.jquery.com', 'cdnjs.cloudflare.com'],
- styleSrc: ["'self'",`'nonce-${nonce}'`, 'cdn.jsdelivr.net', 'fonts.googleapis.com'],
- imgSrc: ["'self'"],
- fontSrc: ["'self'", 'fonts.gstatic.com'],
- },
- })
- );
app.use(session({
secret: process.env.key,
@@ -56,84 +45,39 @@ function isAuthenticated(req, res, next) {
if (req.session && req.session.authenticated) {
return next();
} else {
- res.redirect("/login");
+ res.redirect("/index");
}
}
-const generateOTP = () => {
- const otp = otpGenerator.generate(6, { upperCase: false, specialChars: false });
- const expirationTime = Date.now() + 5 * 60 * 1000; // 5 minutes expiration
- return { otp, expirationTime };
- };
-
-const sendOTPByEmail = async (email, otp) => {
- try {
- const transporter = nodemailer.createTransport({
- service: 'gmail',
- auth: {
- user: process.env.euser, // replace with your email
- pass: process.env.epass // replace with your email password
- }
- });
-
- const mailOptions = {
- from: process.env.euser,
- to: email,
- subject: 'Login OTP',
- text: `Your OTP for login is: ${otp}`
- };
-
- await transporter.sendMail(mailOptions);
- console.log('OTP sent successfully to', email);
- } catch (error) {
- console.error('Error sending OTP:', error);
- throw error;
- }
- };
-
+app.get('/index', (req, res) => {
+ res.render('index');
+ });
app.get("/login", (req, res) => {
-
res.render("login", { error: null });
});
- const limiter = rateLimit({
- windowMs: 15 * 60 * 1000, // 15 minutes
- max: 5, // limit each IP to 3 requests per windowMs
- message: 'Too many login attempts from this IP, please try again later.',
- });
-
-app.use('/login', limiter);
+app.use('/login', rateLimit);
-
-app.post('/login', [
- body('username').escape().trim().isLength({ min: 1 }).withMessage('Username must not be empty'),
- body('password').escape().trim().isLength({ min: 1 }).withMessage('Password must not be empty'),
-],
-async (req, res) => {
- try {
- const errors = validationResult(req);
-
+app.post('/login', loginValidation, async (req, res) => {
+ try {const errors = validationResult(req);
if (!errors.isEmpty()) {
return res.render('login', { error: 'Invalid input. Please check your credentials.', csrfToken: req.session.csrfToken });
}
-
let { username, password } = req.body;
username = username.trim();
-
const user = await User.findOne({ where: { username } });
-
if (user) {
const isLoginSuccessful = await bcrypt.compare(password, user.password);
if (isLoginSuccessful) {
await userLogs.create({ username, success: true, activity: "Credentials entered correctly" });
-
const { otp, expirationTime } = generateOTP();
req.session.otp = otp;
req.session.otpExpiration = expirationTime;
req.session.save();
+ console.log(otp);
try {
await sendOTPByEmail(user.email, otp);
@@ -174,17 +118,12 @@ async (req, res) => {
// OTP verification route
-app.post("/verify-otp", [
- body('otp').escape().trim().isLength({ min: 1 }).withMessage('OTP must not be empty'),
- ],
- async (req, res) => {
+app.post("/verify-otp", otpValidation ,async (req, res) => {
try {
const errors = validationResult(req);
-
if (!errors.isEmpty()) {
return res.render('otp', { error: 'Invalid OTP. Please try again.'});
}
-
const enteredOTP = req.body.otp;
if (!req.session) {
@@ -222,17 +161,10 @@ app.post("/verify-otp", [
req.session.authenticated = true;
req.session.username = req.body.username;
req.session.sessionToken = sessionToken;
-
-
- csrfTokenSession = crypto.randomBytes(32).toString('hex');
-
- // Log anti-CSRF token
- console.log(`Generated Anti-CSRF Token: ${csrfTokenSession}`);
+ req.session.csrfToken = crypto.randomBytes(32).toString('hex');
res.cookie('sessionToken', sessionToken, { secure: true, httpOnly: true, expires: new Date(Date.now() + 24 * 60 * 60 * 1000) }); // Expires in 1 day
- console.log(`Generated Session Token: ${sessionToken}`);
-
res.redirect("/home");
} else {
if (req.body.username) {
@@ -267,25 +199,41 @@ app.post("/verify-otp", [
}
// Redirect to the login page after logout
- res.redirect("/login");
+ res.redirect("/index");
});
} catch (error) {
console.error("Error in logout route:", error);
res.status(500).send("Internal Server Error");
}
});
-
-
- app.get("/home", isAuthenticated, (req, res) => {
- // Render the home page with sensor data
- res.render("home", {
- username: req.session.username,
- });
+ const getDatabaseStatus = async () => {
+ try {
+ await sequelize.authenticate();
+ return { connected: true };
+ } catch (error) {
+ console.error('Database connection error:', error);
+ return { connected: false, error: error.message };
+ }
+ };
+
+ const getSystemHealth = async () => {
+ const cpuInfo = await pidusage(process.pid);
+ const databaseStatus = await getDatabaseStatus();
+ return {
+ serverStatus: { uptime: process.uptime() },
+ databaseStatus,
+ resourceUtilization: {
+ cpuUsage: cpuInfo.cpu,
+ memoryUsage: process.memoryUsage(),
+ },
+ };
+ };
+ app.get("/home", isAuthenticated, async (req, res) => {
+ const systemHealth = await getSystemHealth();
+ res.render("home", { username: req.session.username, systemHealth});
});
-
-
app.get("/inusers", isAuthenticated, async (req, res) => {
try {
// Fetch all user data from the database using Sequelize
@@ -294,9 +242,8 @@ app.post("/verify-otp", [
});
const currentUsername = req.session.username;
-
// Render the inusers page with JSON data
- res.render("inusers", { nonce: nonce, allUsers, csrfToken: csrfTokenSession, currentUsername });
+ res.render("inusers", {allUsers, csrfToken: req.session.csrfToken, currentUsername });
} catch (error) {
console.error("Error fetching all users:", error);
res.status(500).send("Internal Server Error");
@@ -332,27 +279,15 @@ function isStrongPassword(password) {
return true;
}
-
-
-app.post(
- '/createUser',
- [
- body('name').trim().isLength({ min: 1 }).withMessage('Name must not be empty').escape(),
- body('username').trim().isLength({ min: 1 }).withMessage('Username must not be empty').escape(),
- body('email').isEmail().withMessage('Invalid email address').normalizeEmail(),
- body('password').custom((value) => {
- if (!isStrongPassword(value)) { throw new Error('Password does not meet complexity requirements'); } return true;
- }),
- body('jobTitle').trim().isLength({ min: 1 }).withMessage('Job title must not be empty').escape(),
- ],
- async (req, res) => {
+app.post
+ ('/createUser', createValidation,
+ async (req, res) => {
try {
- const errors = validationResult(req);
+ const errors = validationResult(req);
if (!errors.isEmpty()) {
return res.status(400).json({ errors: errors.array() });
}
-
const sessionTokencookie = req.cookies['sessionToken'];
// Verify sessionToken with the one stored in the database
@@ -363,8 +298,8 @@ app.post(
}
// Validate the anti-CSRF token
const submittedCSRFToken = req.body.csrf_token;
-
- if (!csrfTokenSession || submittedCSRFToken !== csrfTokenSession) {
+
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
return res.status(403).json({ error: 'CSRF token mismatch' });
}
@@ -375,10 +310,6 @@ app.post(
// Extract the username of the user creating a new user
const creatorUsername = req.session.username; // Adjust this based on how you store the creator's username in your session
- // Additional password complexity check
- if (!isStrongPassword(password)) {
- return res.status(400).json({ error: "Password does not meet complexity requirements" });
- }
// Check if the username is already taken
const existingUser = await User.findOne({ where: { username } });
@@ -477,24 +408,13 @@ app.post("/forgot-password", async (req, res) => {
const error = "Username or email not found.";
return res.render("forgot-password", { error, success: null });
}
-
// Generate reset token and update the user
const reset_token = crypto.randomBytes(20).toString("hex");
const reset_token_expiry = new Date(Date.now() + 3600000); // Token expires in 1 hour
-
// Update the user with the reset token and expiry
- await User.update(
- {
- reset_token,
- reset_token_expiry,
- },
- {
- where: {
- id: user.id, // Replace 'id' with the actual primary key field of your User model
- },
- }
+ await User.update({reset_token,reset_token_expiry,},
+ {where: {id: user.id},}
);
-
// Send email with reset link
const resetLink = `http://localhost:3000/reset-password/${reset_token}`;
const mailOptions = {
@@ -502,12 +422,9 @@ app.post("/forgot-password", async (req, res) => {
subject: "Password Reset",
text: `Click on the following link to reset your password: ${resetLink}`,
};
-
await transporter.sendMail(mailOptions);
-
const success = "Password reset email sent successfully. Check your inbox.";
res.render("forgot-password", { error: null, success });
-
// Log the successful sending of the reset link in the database
await userLogs.create({
username: user.username,
@@ -523,29 +440,22 @@ app.post("/forgot-password", async (req, res) => {
console.error("Error during password reset:", error);
const errorMessage = "An error occurred during the password reset process.";
res.render("forgot-password", { error: errorMessage, success: null });
- }
- });
+ }});
-
-
app.post("/reset-password/:token", async (req, res) => {
try {
const { token } = req.params;
const { password, confirmPassword } = req.body;
-
// Sanitize the inputs
const sanitizedToken = validator.escape(token);
const sanitizedPassword = validator.escape(password);
const sanitizedConfirmPassword = validator.escape(confirmPassword);
-
// Find user with matching reset token and not expired
const user = await User.findOne({
- where: {
- reset_token: sanitizedToken,
- reset_token_expiry: { [Sequelize.Op.gt]: new Date() },
+ where: {reset_token: sanitizedToken,
+ reset_token_expiry: { [Sequelize.Op.gt]: new Date() },
},
});
-
if (!user) {
// Pass the error to the template when rendering the reset-password page
return res.render("reset-password", {
@@ -553,7 +463,6 @@ app.post("/forgot-password", async (req, res) => {
resetError: "Invalid or expired reset token",
});
}
-
// Check if passwords match
if (sanitizedPassword !== sanitizedConfirmPassword) {
// Pass the error to the template when rendering the reset-password page
@@ -562,31 +471,24 @@ app.post("/forgot-password", async (req, res) => {
resetError: "Passwords do not match",
});
}
-
// Check if the new password meets complexity requirements
if (!isStrongPassword(sanitizedPassword)) {
// Pass the error to the template when rendering the reset-password page
return res.render("reset-password", {
- token,
- resetError:
+ token, resetError:
"Password does not meet complexity requirements. It must be at least 10 characters long and include at least one uppercase letter, one lowercase letter, one digit, and one symbol.",
});
}
-
// Hash the new password
const saltRounds = 10;
const hashedPassword = await bcrypt.hash(sanitizedPassword, saltRounds);
-
// Update user's password and clear reset token
const updateQuery = {
password: hashedPassword,
reset_token: null,
reset_token_expiry: null,
};
- const whereCondition = {
- reset_token: sanitizedToken,
- };
-
+ const whereCondition = {reset_token: sanitizedToken,};
await User.update(updateQuery, {
where: whereCondition,
});
@@ -629,14 +531,12 @@ app.post("/reset-password", async (req, res) => {
const creatorUsername = req.session.username;
const submittedCSRFToken = req.body.csrf_token;
- if (!csrfTokenSession || submittedCSRFToken !== csrfTokenSession) {
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
return res.status(403).json({ error: 'CSRF token mismatch' });
}
const sessionTokencookie = req.cookies['sessionToken'];
-
// Verify sessionToken with the one stored in the database
const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
-
if (!user) {
return res.status(403).json({ error: 'Invalid sessionToken' });
}
@@ -644,12 +544,10 @@ app.post("/reset-password", async (req, res) => {
const sanitizedUsername = validator.escape(username);
const sanitizedPassword = validator.escape(password);
const sanitizedConfirmPassword = validator.escape(confirmPassword);
-
// Check if passwords match
if (sanitizedPassword !== sanitizedConfirmPassword) {
return res.status(400).json({ error: "Passwords do not match" });
}
-
// Check if the new password meets complexity requirements
if (!isStrongPassword(sanitizedPassword)) {
return res.status(400).json({
@@ -657,31 +555,25 @@ app.post("/reset-password", async (req, res) => {
"Password does not meet complexity requirements. It must be at least 10 characters long and include at least one uppercase letter, one lowercase letter, one digit, and one symbol.",
});
}
-
try {
// Find the user in the database
const user = await User.findOne({ where: { username: sanitizedUsername } });
-
if (!user) {
return res.status(404).json({ error: "User does not exist" });
}
-
// Generate a random salt and hash the new password
const saltRounds = 10;
const hashedPassword = await bcrypt.hash(sanitizedPassword, saltRounds);
-
// Update user's password
await User.update(
{ password: hashedPassword },
{ where: { username: sanitizedUsername } }
);
-
// Log password reset activity
await userLogs.create({
username: creatorUsername,
activity: `Password has been reset for ${sanitizedUsername}`,
});
-
// Password update successful
return res.status(200).json({ success: "Password updated successfully" });
} catch (error) {
@@ -693,10 +585,8 @@ app.post("/reset-password", async (req, res) => {
app.get('/searchUser', async (req, res) => {
const { username } = req.query;
-
// Sanitize the input
const sanitizedUsername = validator.escape(username);
-
try {
// Find the user in the database
const user = await User.findOne({ where: { username: sanitizedUsername } });
@@ -704,11 +594,7 @@ app.get('/searchUser', async (req, res) => {
if (!user) {
// No user found with the given username
res.status(404).json({ success: false, error: 'User not found' });
- } else {
- // User found, return user data
- res.json(user);
-
- }
+ } else {res.json(user)}
} catch (error) {
console.error('Sequelize query error:', error);
res.status(500).json({ success: false, error: 'Internal Server Error' });
@@ -719,7 +605,6 @@ app.get('/api/users', async (req, res) => {
try {
// Find all users in the database
const users = await User.findAll();
-
// Return the users in the response
res.json(users);
} catch (error) {
@@ -759,7 +644,7 @@ app.delete('/api/deleteUser/:username', async (req, res) => {
const { csrfToken } = req.body;
console.log(csrfToken);
// Compare CSRF token with the one stored in the session
- if (csrfToken !== csrfTokenSession) {
+ if (csrfToken !== req.session.csrfToken) {
return res.status(403).json({ success: false, error: 'CSRF token mismatch' });
}
@@ -787,9 +672,6 @@ app.delete('/api/deleteUser/:username', async (req, res) => {
res.status(500).json({ success: false, error: 'Internal Server Error', details: error.message });
}
});
-
-
-
app.get('/api/getLogs', async (req, res) => {
try {
@@ -814,6 +696,212 @@ app.get('/api/getLogs', async (req, res) => {
}
});
+app.get("/locations", isAuthenticated, async (req, res) => {
+ try {
+ // Fetch data using Axios
+ const response = await axios.get(process.env.API_ALLLOCATION);
+ const locationsData = response.data;
+
+ // Render the "locations" page with the fetched JSON data
+ res.render("locations", { locationsData, csrfToken: req.session.csrfToken});
+ } catch (error) {
+ console.error("Error fetching locations:", error);
+ res.status(500).send("Internal Server Error");
+ }
+ });
+
+ app.post('/location/new', locationValidation, async (req, res) => {
+ try {
+ const errors = validationResult(req);
+ if (!errors.isEmpty()) {
+ return res.status(400).json({ errors: errors.array() });
+ }
+ const sessionTokencookie = req.cookies['sessionToken'];
+ const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
+ if (!user) {
+ return res.status(403).json({ error: 'Invalid sessionToken' });
+ }
+ const submittedCSRFToken = req.body.csrf_token;
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
+ return res.status(403).json({ error: 'CSRF token mismatch' });
+ }
+ const { name, added_by, description } = req.body;
+ const preparedData = {name, added_by, description};
+ // Make a POST request with the sanitized data using Axios
+ const axiosResponse = await axios.post(process.env.API_NEWLOCATION, preparedData);
+ // Send the Axios response back to the client
+ res.status(axiosResponse.status).json(axiosResponse.data);
+ } catch (error) {
+ console.error('Error handling new location submission:', error);
+ res.status(500).json({ message: 'Internal Server Error' });
+ }
+ });
+
+ app.post('/location/update', locationValidationUpdate, async (req, res) => {
+ try {
+ const errors = validationResult(req);
+ if (!errors.isEmpty()) {
+ return res.status(400).json({ errors: errors.array() });
+ }
+ const sessionTokencookie = req.cookies['sessionToken'];
+ const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
+ if (!user) {
+ return res.status(403).json({ error: 'Invalid sessionToken' });
+ }
+ const submittedCSRFToken = req.body.csrf_token;
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
+ return res.status(403).json({ error: 'CSRF token mismatch' });
+ }
+ const { id, name, added_by, description } = req.body;
+ const preparedData = {id, name, added_by, description};
+ // Make a POST request with the sanitized data using Axios
+ const axiosResponse = await axios.post(process.env.API_UPDATELOCATION, preparedData);
+ // Send the Axios response back to the client
+ res.status(axiosResponse.status).json(axiosResponse.data);
+ } catch (error) {
+ console.error('Error handling new location submission:', error);
+ res.status(500).json({ message: 'Internal Server Error' });
+ }
+ });
+
+
+ app.post('location/delete',locationdeleteValidation, async (req, res) => {
+ try {
+ const errors = validationResult(req);
+ if (!errors.isEmpty()) {
+ return res.status(400).json({ errors: errors.array() });
+ }
+ const sessionTokencookie = req.cookies['sessionToken'];
+ const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
+ if (!user) {
+ return res.status(403).json({ error: 'Invalid sessionToken' });
+ }
+ const submittedCSRFToken = req.body.csrf_token;
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
+ return res.status(403).json({ error: 'CSRF token mismatch' });
+ }
+ const {id} = req.body;
+ const preparedData = {id};
+ // Make a POST request with the sanitized data using Axios
+ const axiosResponse = await axios.post(process.env.API_DELLOCATION, preparedData);
+ // Send the Axios response back to the client
+ res.status(axiosResponse.status).json(axiosResponse.data);
+ } catch (error) {
+ console.error('Error handling new sensor submission:', error);
+ res.status(500).json({ message: 'Internal Server Error' });
+ }
+ });
+
+app.get("/sensors", isAuthenticated, async (req, res) => {
+ try {
+ // Render the inusers page with JSON data
+ const response = await axios.get(process.env.API_ALLLOCATION);
+ const locationsData = response.data;
+ const response2 = await axios.get(process.env.API_ALLSENSOR);
+ const sensorData = response2.data;
+ res.render("sensors",{locationsData, sensorData, csrfToken: req.session.csrfToken});
+ } catch (error) {
+ console.error("Error:", error);
+ res.status(500).send("Internal Server Error");
+ }
+});
+
+ app.post('sensor/new',sensorValidation, async (req, res) => {
+ try {
+ const errors = validationResult(req);
+ if (!errors.isEmpty()) {
+ return res.status(400).json({ errors: errors.array() });
+ }
+ const sessionTokencookie = req.cookies['sessionToken'];
+ const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
+ if (!user) {
+ return res.status(403).json({ error: 'Invalid sessionToken' });
+ }
+ const submittedCSRFToken = req.body.csrf_token;
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
+ return res.status(403).json({ error: 'CSRF token mismatch' });
+ }
+ const { sensorname, added_by, macAddress, description, location} = req.body;
+ const preparedData = {sensorname, added_by, macAddress, description, location};
+ // Make a POST request with the sanitized data using Axios
+ const axiosResponse = await axios.post(process.env.API_NEWSENSOR, preparedData);
+ // Send the Axios response back to the client
+ res.status(axiosResponse.status).json(axiosResponse.data);
+ } catch (error) {
+ console.error('Error handling new sensor submission:', error);
+ res.status(500).json({ message: 'Internal Server Error' });
+ }
+ });
+
+ app.post('sensor/update',sensorupdateValidation, async (req, res) => {
+ try {
+ const errors = validationResult(req);
+ if (!errors.isEmpty()) {
+ return res.status(400).json({ errors: errors.array() });
+ }
+ const sessionTokencookie = req.cookies['sessionToken'];
+ const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
+ if (!user) {
+ return res.status(403).json({ error: 'Invalid sessionToken' });
+ }
+ const submittedCSRFToken = req.body.csrf_token;
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
+ return res.status(403).json({ error: 'CSRF token mismatch' });
+ }
+ const { id, sensorname, added_by, macAddress, description, location} = req.body;
+ const preparedData = {id, sensorname, added_by, macAddress, description, location};
+ // Make a POST request with the sanitized data using Axios
+ const axiosResponse = await axios.post(process.env.API_NEWSENSOR, preparedData);
+ // Send the Axios response back to the client
+ res.status(axiosResponse.status).json(axiosResponse.data);
+ } catch (error) {
+ console.error('Error handling new sensor submission:', error);
+ res.status(500).json({ message: 'Internal Server Error' });
+ }
+ });
+
+ app.post('sensor/delete',sensordeleteValidation, async (req, res) => {
+ try {
+ const errors = validationResult(req);
+ if (!errors.isEmpty()) {
+ return res.status(400).json({ errors: errors.array() });
+ }
+ const sessionTokencookie = req.cookies['sessionToken'];
+ const user = await User.findOne({ where: { sessionid: sessionTokencookie } });
+ if (!user) {
+ return res.status(403).json({ error: 'Invalid sessionToken' });
+ }
+ const submittedCSRFToken = req.body.csrf_token;
+ if (!req.session.csrfToken || submittedCSRFToken !== req.session.csrfToken) {
+ return res.status(403).json({ error: 'CSRF token mismatch' });
+ }
+ const {id} = req.body;
+ const preparedData = {id};
+ // Make a POST request with the sanitized data using Axios
+ const axiosResponse = await axios.post(process.env.API_DELSENSOR, preparedData);
+ // Send the Axios response back to the client
+ res.status(axiosResponse.status).json(axiosResponse.data);
+ } catch (error) {
+ console.error('Error handling new sensor submission:', error);
+ res.status(500).json({ message: 'Internal Server Error' });
+ }
+ });
+
+ app.get("/apilog", isAuthenticated, async (req, res) => {
+ try {
+ // Fetch data using Axios
+ const response = await axios.get(process.env.API_LOGS);
+ const logData = response.data;
+
+ // Render the "locations" page with the fetched JSON data
+ res.render("locations", {logData});
+ } catch (error) {
+ console.error("Error fetching locations:", error);
+ res.status(500).send("Internal Server Error");
+ }
+ });
+
+
app.use(express.static("views"));
app.listen(PORT, () => {
diff --git a/Sean/views/apilog.ejs b/Sean/views/apilog.ejs
new file mode 100644
index 0000000..f5bf9f6
--- /dev/null
+++ b/Sean/views/apilog.ejs
@@ -0,0 +1,68 @@
+
+
+
+
+
+
+
+ API Logs
+
+
+
+
+
+
+
+
ECOSAVER MANAGEMENT
+
+
+
+
+
Welcome to the API Logs Users Page
+
+
+
+
+
+
+
+
+
ID
+
Time
+
Method
+
Host
+
Date
+
+
+
+ <% logData.forEach(entry => { %>
+
+
<%= entry.id %>
+
<%= entry.time %>
+
<%= entry.method %>
+
<%= entry.host %>
+
<%= entry.createdAt %>
+
+ <% }); %>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/Sean/views/apilog.js b/Sean/views/apilog.js
new file mode 100644
index 0000000..fb23645
--- /dev/null
+++ b/Sean/views/apilog.js
@@ -0,0 +1,54 @@
+function downloadAsExcel() {
+ // Get the current date
+ var currentDate = new Date();
+ var formattedDate = currentDate.toISOString().slice(0, 10); // Format as YYYY-MM-DD
+
+ // Create a new workbook
+ var wb = XLSX.utils.book_new();
+ // Convert logData to a worksheet
+ var ws = XLSX.utils.json_to_sheet(logData);
+ // Add the worksheet to the workbook
+ XLSX.utils.book_append_sheet(wb, ws, 'Log Data');
+ // Create a blob with the Excel file content
+ var blob = XLSX.write(wb, { bookType: 'xlsx', type: 'blob', mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' });
+
+ // Trigger the download with the filename including the current date
+ saveAs(blob, 'log_data_' + formattedDate + '.xlsx');
+ }
+ document.addEventListener('DOMContentLoaded', function() {
+ // Initialize flatpickr on the date input
+ flatpickr("#datepicker", {
+ dateFormat: "Y-m-d",
+ onChange: function(selectedDates, dateStr, instance) {
+ // Call a function to filter logs based on the selected date
+ filterLogsByDate(dateStr);
+ }
+ });
+
+ function filterLogsByDate(selectedDate) {
+ // Use logData to filter logs based on the selected date
+ var filteredLogs = logData.filter(function(entry) {
+ return entry.createdAt.startsWith(selectedDate);
+ });
+
+ // Render the filtered logs in the table
+ renderLogsTable(filteredLogs);
+ }
+
+ function renderLogsTable(logs) {
+ var tableBody = document.getElementById('logsTableBody');
+ tableBody.innerHTML = '';
+
+ logs.forEach(function(entry) {
+ var row = document.createElement('tr');
+ row.innerHTML = `
+