Change export convention for helper functions

backend/src/controllers/v1/authController.ts

@@ -13,7 +13,7 @@ import {
 } from '../../variables';
 import { BadRequestError } from '../../utils/errors';
 import { EELogService } from '../../ee/services';
-import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this
+import { getChannelFromUserAgent } from '../../utils/posthog';
 import {
   getJwtRefreshSecret,
   getJwtAuthLifetime,
@@ -24,6 +24,7 @@ import {
 declare module 'jsonwebtoken' {
   export interface UserIDJwtPayload extends jwt.JwtPayload {
     userId: string;
+    refreshVersion?: number;
   }
 }
 
@@ -173,9 +174,7 @@ export const login2 = async (req: Request, res: Response) => {
  */
 export const logout = async (req: Request, res: Response) => {
   try {
-    await clearTokens({
-      userId: req.user._id.toString()
-    });
+    await clearTokens(req.user._id);
 
     // clear httpOnly cookie
     res.cookie('jid', '', {
@@ -223,7 +222,7 @@ export const checkAuth = async (req: Request, res: Response) => {
 }
 
 /**
- * Return new token by redeeming refresh token
+ * Return new JWT access token by first validating the refresh token
  * @param req
  * @param res
  * @returns
@@ -233,7 +232,7 @@ export const getNewToken = async (req: Request, res: Response) => {
     const refreshToken = req.cookies.jid;
 
     if (!refreshToken) {
-      throw new Error('Failed to find token in request cookies');
+      throw new Error('Failed to find refresh token in request cookies');
     }
 
     const decodedToken = <jwt.UserIDJwtPayload>(
@@ -242,12 +241,16 @@ export const getNewToken = async (req: Request, res: Response) => {
 
     const user = await User.findOne({
       _id: decodedToken.userId
-    }).select('+publicKey');
+    }).select('+publicKey +refreshVersion');
 
     if (!user) throw new Error('Failed to authenticate unfound user');
     if (!user?.publicKey)
       throw new Error('Failed to authenticate not fully set up account');
 
+    if (decodedToken?.refreshVersion !== user.refreshVersion) throw BadRequestError({
+      message: 'Failed to validate refresh token'
+    });
+
     const token = createToken({
       payload: {
         userId: decodedToken.userId

backend/src/controllers/v1/passwordController.ts

@@ -4,12 +4,20 @@ import * as Sentry from '@sentry/node';
 const jsrp = require('jsrp');
 import * as bigintConversion from 'bigint-conversion';
 import { User, BackupPrivateKey, LoginSRPDetail } from '../../models';
-import { createToken } from '../../helpers/auth';
-import { sendMail } from '../../helpers/nodemailer';
+import {
+	createToken,
+	sendMail,
+	clearTokens
+} from '../../helpers';
 import { TokenService } from '../../services';
 import { TOKEN_EMAIL_PASSWORD_RESET } from '../../variables';
 import { BadRequestError } from '../../utils/errors';
-import { getSiteURL, getJwtSignupLifetime, getJwtSignupSecret } from '../../config';
+import { 
+	getSiteURL, 
+	getJwtSignupLifetime, 
+	getJwtSignupSecret,
+	getHttpsEnabled
+} from '../../config';
 
 /**
  * Password reset step 1: Send email verification link to email [email] 
@@ -117,6 +125,7 @@ export const emailPasswordResetVerify = async (req: Request, res: Response) => {
  */
 export const srp1 = async (req: Request, res: Response) => {
 	// return salt, serverPublicKey as part of first step of SRP protocol
+	
 	try {
 		const { clientPublicKey } = req.body;
 		const user = await User.findOne({
@@ -221,6 +230,17 @@ export const changePassword = async (req: Request, res: Response) => {
 							new: true
 						}
 					);
+				
+					// await clearTokens(user._id);
+
+					// // clear httpOnly cookie
+					
+					// res.cookie('jid', '', {
+					// 	httpOnly: true,
+					// 	path: '/',
+					// 	sameSite: 'strict',
+					// 	secure: (await getHttpsEnabled()) as boolean
+					// });
 
 					return res.status(200).send({
 						message: 'Successfully changed password'