server.ts

/**
 * server.ts
 * Server Configuration and API
 */
import * as papercut from "./integrations/papercut/papercut.js"
import express from "express";
import expressWs from 'express-ws';
import { ApolloServer } from "@apollo/server";
import { expressMiddleware } from "@as-integrations/express5";
import compression from "compression";
import cors from "cors";
import { schema } from "./graphql/schema.js";
import { setupSessions, setupDevAuth, setupSamlAuth, setupAuth } from "./auth.js";
import context, { determineUser } from "./context.js";
import path from "path";
import * as schedule from "node-schedule";
import { getUserByCardTagID, getUsersFullName } from "./database/repositories/Users/UserRepository.js";
import { createUnassocaitedAuditLog } from "./database/repositories/AuditLogs/AuditLogRepository.js";
import { getReaderCertCA, setReaderCertCA } from "./database/repositories/Readers/ReaderRepository.js";
import morgan from "morgan"; //Log provider
import { createRequire } from "module";
import { setDataPointValue } from "./database/repositories/DataPoints/DataPointsRepository.js";
import { addItemAmount, getItemById, getItems, getItemsWhereStaff, getItemsWhereStorefront, setItemAmount } from "./database/repositories/Store/InventoryRepository.js";
import { createLedger } from "./database/repositories/Store/InventoryLedgerRepository.js";
import { getMakerspaceHoursNextWeek } from "./database/repositories/Makerspaces/MakerspaceHoursRepository.js";
import { getPassedTrainingsDaysAgo, purgeExpiredPassedModules } from "./database/repositories/Training/PassedRepository.js";
import * as Emailer from "./integrations/email/email.js"
import { pingAtrium } from "./integrations/atrium-integration/atrium.js";
import * as S3 from "./integrations/aws/s3.js"
import { isStaff } from "./privilege.js";
import { advanceTimeTickets, deletePastSpecialHours, purge_images, scheduledRestartAllCores } from "./periodicActions.js";
import { getCustomUrl } from "./database/repositories/Links/customUrlRepository.js";
import { InventoryItemRow } from "./database/knex/tables.js";
import * as API from "./api/api.js";
import { getDeviceBySN } from "./database/repositories/Devices/DeviceRepository.js";
import { authenticateDevice } from "./api/devices/deviceApi.js";
import { createWebSocketStream, WebSocketServer } from "ws";
import { createServer } from "http";
import { Aedes, AuthenticateError } from 'aedes';
import * as DeviceRepo from "./database/repositories/Devices/DeviceRepository.js";
import MQTTACSController from "./database/models/api/MQTTACSController.js";
import fs from "node:fs";
import { ViteDevServer } from "vite";
import { SiteSettings } from "./database/models/site_settings/SiteSettings.js";
import * as ThemeRepo from "./database/repositories/SiteSettings/ThemesRepository.js";
import { createHash } from 'node:crypto';

const require = createRequire(import.meta.url);

const SECURE_ORIGIN = (process.env.VITE_ORIGIN ?? "");
const __dirname = import.meta.dirname;

const EXPIRY_EMAIL_LIMIT_AT_ONCE = isNaN(Number(process.env.EXPIRY_EMAIL_LIMIT_AT_ONCE ?? "")) ? 50 : Number(process.env.EXPIRY_EMAIL_LIMIT_AT_ONCE);

/**
 * set up Cross-Origin Request allowances
 */
const CORS_CONFIG = {
  origin: process.env.VITE_ORIGIN,
  credentials: true,
};

/**
 * Initialize the server runner
 */
async function startServer() {
  require("dotenv").config({ path: __dirname + "/./../.env" });

  //Init with Node Express
  var exp = express();
  var wsserver = expressWs(exp);
  var app = wsserver.app;

  const httpServer = createServer(app);

  //Configure CORS
  app.use(cors(CORS_CONFIG));

  //Active File compression 
  app.use(compression());

  //Combined logging
  app.use(morgan("combined"));

  //JSON request body parsing
  app.use(express.json());

  //Prepare client session handler
  setupSessions(app);


  // Force redirect to https in production (actually dont yet)
  /*
  if (process.env.NODE_ENV === 'production') {
    app.use(function (req, res, next) {
      if (req.headers['x-forwarded-proto'] !== 'https') {
        return res.redirect(['https://', req.get('Host'), req.url].join(''));
      }
      return next();
    });
  }
  */

  // environment setup
  if (process.env.NODE_ENV === "development") {
    /**
    * mode: DEVELOPMENT
    * Use local dev login view instead of SAML
    * !! INSECURE !!
    */
    console.log("development active")
    setupDevAuth(app);
  } else if (process.env.NODE_ENV === "staging") {
    /**
     * mode: STAGING
     * Use the SAML configuration, but use insecure dev cookie handling
     */
    console.log("staging active");
    setupSamlAuth(app);
  } else if (process.env.NODE_ENV === "production") {
    /**
     * mode: PRODUCTION
     * Use production SAML settings. Full security
     */
    app.set("trust proxy", 1); // trust first proxy
    setupAuth(app);
  } else {
    process.exit(-1);
  }

  papercut.registerEndpoints(app);
  API.registerEndpoints(app);

  app.get("/", function (req, res) {
    res.redirect(SECURE_ORIGIN + "/app/");
  });


  let vite: ViteDevServer;
  const clientDir = path.resolve(__dirname, "../../client");
  if (process.env.NODE_ENV === "development") {
    vite = await import("vite").then((m) =>
      m.createServer({
        root: clientDir,
        server: { middlewareMode: true },
        appType: "custom",
        base: "/app/",
        configFile: path.resolve(clientDir, "vite.config.ts")
      })
    )

    app.use(vite.middlewares);
  } else {
    // Production, serve built files
    app.use("/app/", express.static(path.join(__dirname, '../../client/build'), { index: false }));
  }

  app.use(async (req, res, next) => {

    if (!req.originalUrl.match(/^\/app(\/|$)/)) {
      return next();
    }

    try {
      const url = req.originalUrl
      let template, render;

      if (process.env.NODE_ENV === "development") {
        template = fs.readFileSync(path.resolve(__dirname, "../../client/index.html"), 'utf-8');
        template = await vite.transformIndexHtml(url, template);
        const entryServerPath = path.resolve(__dirname, "../../client/src/entry-server.tsx");
        render = (await vite.ssrLoadModule(entryServerPath)).render
      } else {
        // production, serve built files
        template = fs.readFileSync(path.resolve(__dirname, "../../client/build/index.html"), 'utf-8');
        // @ts-ignore module not found for some reason
        render = (await import("../dist/entry-server.js")).render;
      }

      const siteSettings: SiteSettings = {
        themes: (await ThemeRepo.getThemes()).map((row) => ({
          key: row.id.toString(),
          themeName: row.themeName,
          title: row.title,
          muiThemeOptions: row.muiThemeOptions,
          logo: row.logo,
          default: row.default
        }))
      };

      const settingsScript = `<script>window.__SITE_SETTINGS__ = ${JSON.stringify(siteSettings)}</script>`;
      const processedTemplate = template.replace('<!--SCRIPT_REPLACE-->', settingsScript);

      const [htmlStart, htmlEnd] = processedTemplate.split('<!--ROOT_REPLACE-->');
      const head = htmlStart + '<div id="root">';
      const tail = '</div>' + htmlEnd;

      await render(req, res, siteSettings, head, tail);

    } catch (e) {
      console.error(e);
      res.status(500).end(e instanceof Error ? e.message : String(e));
    }
  })

  // app.get("/app/*apppage", function (req, res) {
  //   res.sendFile(path.join(__dirname, "../../client/build", "index.html"));
  // });

  app.get("/link/:link", async function (req, res) {
    const customUrl = await getCustomUrl((req.params.link));
    if (customUrl == null) {
      return res.status(404).send();
    }
    res.redirect(customUrl?.longUrl);
  });

  /** ===============================================================================================
   * ACS Hardware Endpoints
   * --
   * These are the endpoints that the ACS hardware will access to authorize users and perform checks.
   * Note: JSON attributes are all Title case
  ===================================================================================================*/
  const API_NORMAL_LOGGING = process.env.API_NORMAL_LOGGING == "true";
  const API_DEBUG_LOGGING = process.env.API_DEBUG_LOGGING == "true";

  app.all("/api/files/*filename", async function (req, res, next) {
    const SNHeader = 'shlug-sn';
    const KeyHeader = 'shlug-key';
    if (!req.headers[SNHeader] || !req.headers[KeyHeader]) {
      return res.status(401).send();
    }
    const SN = req.headers[SNHeader];
    const Key = req.headers[KeyHeader];
    if (typeof SN !== "string" || typeof Key !== "string") {
      return res.status(401).send();
    }

    const device = await getDeviceBySN(SN);
    if (device == null) {
      return res.status(404).send();
    }

    const ok = await authenticateDevice(device, Key);
    if (!ok) {
      return res.status(403).send();
    }
    return next();
  });
  app.use("/api/files/", express.static(path.join(__dirname, '../../client/shlug-files/')));

  app.get("/api/rootCA", async function (req, res) {
    const SNHeader = 'shlug-sn';
    if (!req.headers[SNHeader]) {
      return res.status(401).send();
    }
    const SN = req.headers[SNHeader];
    if (typeof SN !== "string") {
      return res.status(401).send();
    }

    const device = await getDeviceBySN(SN);
    if (device == null) {
      return res.status(404).send();
    }

    const certca = (await getReaderCertCA())?.value;
    if (certca == null) {
      return res.status(404).send();
    }
    const textForSha = `${device.SN}:${await device.generateKey()}:${certca}`
    const sha = createHash('sha256').update(textForSha).digest('hex')
    const result = {
      cert: certca,
      sha: sha,
    } 
    return res.json(result);
  })

  app.get('/api/files/ota/:tagname', async function (req, res) {
    const tag = req.params["tagname"];
    console.log(`SN: ${req.headers['shlug-sn']} requested OTA to ${tag}`);

    const ota_url = `https://github.com/rit-construct-makerspace/access-control-firmware/releases/download/${tag}/Core.bin`
    fetch(ota_url).then(actual => {
      actual.headers.forEach((v, n) => res.setHeader(n, v));
      if (actual?.body) {
        actual.body.pipeTo(
          new WritableStream({
            start() { },
            write(chunk) {
              res.write(chunk);
            },
            close() {
              res.end();
            },
          })
        );
      }
    })
  })

  /**
   * HOURS--
   * Fetch the hours associated with a makerspace string
   */
  app.get("/api/hours/:makerspace", async function (req, res) {
    try {
      const hourRows = await getMakerspaceHoursNextWeek(Number(req.params.makerspace));

      return res.status(200).json({
        obj: hourRows
      }).send();
    } catch (err) {
      console.error(err);
      return res.status(500).send();
    }
  });


  /**
   * Inventory API
   * 
   * DO NOT REMOVE THIS SECTION WHEN DEPRECATING THE OLD API
   */

  /**
   * INVENTORY--
   * Fetch a list of inventory items according to the fetch type
   * Request (JSON Body):
   * - Type: The type of items to fetch
   *    * "public" | "internal" | "staff" | "all"
   * - Key: API key for authorization. Required for fetch types "internal", "staff", "all"
   */
  app.get("/api/inv", async function (req, res) {
    try {
      const fetchType: "public" | "internal" | "staff" | "all" = req.body.Type ?? "public";
      let items: InventoryItemRow[] = [];

      if (fetchType === "internal" || fetchType === "staff" || fetchType === "all") {
        if (req.body.Key != process.env.INV_API_KEY) {
          if (API_DEBUG_LOGGING) createUnassocaitedAuditLog("Inventory Get request failed with error '{error}'", "inventory", { id: 403, label: "Invalid Key" });
          return res.status(403).json({ error: "Invalid Key" }).send();
        }

        switch (fetchType) {
          case "all":
            items = await getItems();
            break;
          case "internal":
            items = await getItemsWhereStorefront(false);
            break;
          case "staff":
            items = await getItemsWhereStaff(true);
            break;
        }

        return res.status(200).json({
          count: items.length,
          type: fetchType,
          items
        }).send();
      } else {
        //fetchType === "public"

        items = await getItemsWhereStorefront(true);

        return res.status(200).json({
          count: items.length,
          type: fetchType,
          items
        }).send();
      }


    } catch (err) {
      console.error(err);
      return res.status(500).send();
    }
  });

  /**
   * COUNT--
   * Fetch a count for a specified inventory item
   */
  app.get("/api/inv/:id", async function (req, res) {
    try {
      const id = parseInt(req.params.id);
      return res.status(200).json({ count: (await getItemById(id))?.count ?? 0 }).send();
    } catch (err) {
      console.error(err);
      return res.status(500).send();
    }
  });

  /**
   * ADD--
   * Increment the count of a defined item by the declared amount
   * Request (JSON Body):
   * - UID: NFC ID of the user 
   * - Inc: Number to add to the count. Can be negative.
   * - Key: API key for authorization.
   */
  app.post("/api/inv/add/:id", async function (req, res) {
    try {
      const id = parseInt(req.params.id);
      const item = await getItemById(id);
      const user = req.body.UID ? await getUserByCardTagID(req.body.UID) : undefined;

      if (req.body.Key != process.env.INV_API_KEY) {
        if (API_DEBUG_LOGGING) createUnassocaitedAuditLog("Inventory Add request failed with error '{error}'", "inventory", { id: 403, label: "Invalid Key" });
        return res.status(403).json({ error: "Invalid Key" }).send();
      }

      if (!item) return res.status(404).json({ error: "Item does not exist" }).send();
      if (!req.body.Inc) return res.status(403).json({ error: "Missing Inc" }).send();

      const count = parseInt(req.body.Inc);

      if (count < 0 && count * -1 > item.count) res.status(403).json({ error: "Operation would set count to negative value" }).send();

      if (count != 0) {
        await addItemAmount(id, count);
        if (count > 0) {
          if (user) {
            await createLedger(user.id, "Modify", item.pricePerUnit * count, undefined, "", [{ name: item.name, quantity: Number(count) }]);
            await createUnassocaitedAuditLog(`{user} added ${count} ${count === 1 ? item.unit : item.pluralUnit} to the {inventory} inventory`, "inventory", { id: user.id, label: getUsersFullName(user) }, { id: item.id, label: item.name });
          } else {
            await createLedger(undefined, "Modify", item.pricePerUnit * count, undefined, "", [{ name: item.name, quantity: Number(count) }]);
            await createUnassocaitedAuditLog(`User added ${count} ${count === 1 ? item.unit : item.pluralUnit} to the {inventory} inventory`, "inventory", { id: item.id, label: item.name });
          }
        } else {
          if (user) {
            await createLedger(user.id, "Modify", item.pricePerUnit * count, undefined, "", [{ name: item.name, quantity: Number(count) }]);
            await createUnassocaitedAuditLog(`{user} removed ${count * -1} ${count === 1 ? item.unit : item.pluralUnit} from the {inventory} inventory`, "inventory", { id: user.id, label: getUsersFullName(user) }, { id: item.id, label: item.name });
          } else {
            await createLedger(undefined, "Modify", item.pricePerUnit * count, undefined, "", [{ name: item.name, quantity: Number(count) }]);
            await createUnassocaitedAuditLog(`User removed ${count * -1} ${count === 1 ? item.unit : item.pluralUnit} from the {inventory} inventory`, "inventory", { id: item.id, label: item.name });
          }
        }
      }

      return res.status(200).json({
        count: item.count + count,
      });

    } catch (err) {
      console.error(err);
      return res.status(500).send();
    }
  });

  /**
 * SET--
 * Set the count of a declared item to a specified amount
 * Request (JSON Body):
 * - UID: NFC ID of the user 
 * - Count: Number to set as the count. Cannot be negative.
 * - Key: API key for authorization.
 */
  app.post("/api/inv/set/:id", async function (req, res) {
    try {
      const id = parseInt(req.params.id);
      const item = await getItemById(id);
      const user = req.body.UID ? await getUserByCardTagID(req.body.UID) : undefined;

      if (req.body.Key != process.env.INV_API_KEY) {
        if (API_DEBUG_LOGGING) createUnassocaitedAuditLog("Inventory Set request failed with error '{error}'", "inventory", { id: 403, label: "Invalid Key" });
        return res.status(403).json({ error: "Invalid Key" }).send();
      }

      if (!item) return res.status(404).json({ error: "Item does not exist" }).send();
      if (!req.body.Count) return res.status(403).json({ error: "Missing Count" }).send();

      const count = parseInt(req.body.Count);

      if (count >= 0) {
        await setItemAmount(id, count);
        if (user) {
          await createLedger(user.id, "Modify", item.pricePerUnit * count, undefined, "", [{ name: item.name, quantity: Number(count) }]);
          await createUnassocaitedAuditLog(`{user} set ${count} ${count === 1 ? item.unit : item.pluralUnit} as the {inventory} inventory`, "inventory", { id: user.id, label: getUsersFullName(user) }, { id: item.id, label: item.name });
        } else {
          await createLedger(undefined, "Modify", item.pricePerUnit * count, undefined, "", [{ name: item.name, quantity: Number(count) }]);
          await createUnassocaitedAuditLog(`User set ${count} ${count === 1 ? item.unit : item.pluralUnit} as the {inventory} inventory`, "inventory", { id: item.id, label: item.name });
        }
      } else {
        return res.status(403).json({ error: "Cannot have negative count" }).send();
      }

      return res.status(200).json({
        count: count,
      });

    } catch (err) {
      console.error(err);
      return res.status(500).send();
    }
  });

  /**
   * File Uploads
   */

  app.post("/api/uploads/web-content", express.raw({ type: "application/octet-stream", limit: 8 * 1024 * 1024 }), async function (req, res) {
    if (!req.user || !isStaff(determineUser(req.user))) {
      return res.status(401).send("Only staff or higher may upload files");
    }

    const file: Buffer = req.body;

    if (!file || file.length < 0) {
      return res.status(400).send("File not found");
    }

    const new_name = (new Date()).valueOf().toString();

    try {
      await S3.putObject("user-uploads", new_name, file);
    } catch (e) {
      return res.status(400).send(e);
    }

    return res.status(201).contentType("application/text").send(new_name);
  });


  /**=================================
   * SCHEDULED ACTIONS
  ==================================*/

  async function handleTrainingExpiriesAndEmails() {
    function sendEmails(type: "warning" | "expiry", expiries: { email: string, moduleIds: number[], moduleNames: string[] }[]) {
      expiries.forEach((expiry) => {
        Emailer.send_training_expiry_email(expiry.email, {
          type: type,
          modules: expiry.moduleIds.map((id, index) => {
            return {
              name: expiry.moduleNames[index],
              link: `${process.env.VITE_ORIGIN}/app/maker/training/${id}`
            }
          })
        }
        );
      })
    };

    let expiryNotices = await getPassedTrainingsDaysAgo(365);
    if (expiryNotices.length > EXPIRY_EMAIL_LIMIT_AT_ONCE) {
      // dont overload the emails (100 / hr, 400 / day) 
      expiryNotices = expiryNotices.slice(0, EXPIRY_EMAIL_LIMIT_AT_ONCE);
    }
    sendEmails("expiry", expiryNotices)
    const numPurged = await purgeExpiredPassedModules();

    // DONT SEND THESE AT THE SAME TIME, YOULL PROBABLY LOCKOUT OUR EMAIL PROVIDER FOR SENDING TOO MANY EMAILS
    // const expiryWarnings = await getPassedTrainingsWeeksAgo(49); // 51
    // sendEmails("warning", expiryWarnings)
    // const numWarned = expiryWarnings.length;

    const numNotified = expiryNotices.length

    createUnassocaitedAuditLog(`Trainings: Sent ${numNotified} expiry notices, and purged ${numPurged} expired trainings.`, "server")

  }
  async function updateRootCert() {
    try {
      const url = process.env.READER_CERT_URL;
      if (url == undefined || url == "") {
        console.error("Can not update root cert. No download URL provided");
        return
      }
      const response = await fetch(url);

      if (!response.ok) {
        console.error(`Could not download new root cert. HTTP error: ${response.status}`)
        return;
      }

      const certString = await response.text();
      // normalize \r\n to \n
      setReaderCertCA(certString.replace(/\r/g,""));
    } catch (error) {
      console.error(`Failed to update root cert: ${error}`)
    }
  }
  /**
   Cron Format:
    *    *    *    *    *    *
    ┬    ┬    ┬    ┬    ┬    ┬
    │    │    │    │    │    │
    │    │    │    │    │    └ day of week (0 - 7) (0 or 7 is Sun)
    │    │    │    │    └───── month (1 - 12)
    │    │    │    └────────── day of month (1 - 31)
    │    │    └─────────────── hour (0 - 23)
    │    └──────────────────── minute (0 - 59)
    └───────────────────────── second (0 - 59, OPTIONAL)

    --REMEMBER HEROKU SERVER RUNS IN UTC (EST+4)--
   */

  const dailyJob = schedule.scheduleJob("0 0 4 * * *", async function () {
    console.log('Wiping daily records...');
    if (API_DEBUG_LOGGING) await createUnassocaitedAuditLog('It is now 4:00am. Wiping Daily Temp Records...', "server")
    await setDataPointValue(1, 0).then(async () => await createUnassocaitedAuditLog('Daily Visits reset.', "server"));

    handleTrainingExpiriesAndEmails();
    //await pruneNullLengthEquipmentSessions().then(async () => await createLog('Unfinished Equipment Sessions pruned.', "server"));;

    // Find unused images on AWS and 'remove' them
    await purge_images();

    // Delete past special hours
    await deletePastSpecialHours();

    // Advance any time-based maintennace tickets from UPCOMING -> TODO
    await advanceTimeTickets();

    // Get a new root certificate for readers
    await updateRootCert();

    // Command all cores to restart for the periodic restart
    await scheduledRestartAllCores();
  });


  const server = new ApolloServer({
    schema,
    plugins: [],
  });


  await server.start();
  //Enable GraphQL
  app.use(
    "/graphql",
    cors<cors.CorsRequest>(CORS_CONFIG),
    express.json(),
    expressMiddleware(server, { context: context })
  );

  const PORT = process.env.PORT || 3000;

  console.log(process.env.ID_FORMAT);


  // AEDES MQTT broker initialization
  const aedes = await Aedes.createBroker();

  const mqttWSS = new WebSocketServer({
    server: httpServer,
    path: "/mqtt"
  });

  aedes.on("connectionError", (client, error) => console.log(`[MQTT SERVER] Client Connection Error: ${error}`))

  aedes.authenticate = async function (_client, SN, password, done) {
    const snString = SN ? SN.toString() : '';
    const pwString = password ? password.toString() : '';

    if (snString === "SERVER") {
      if (pwString === process.env.SERVER_MQTT_PASSWORD && process.env.SERVER_MQTT_PASSWORD !== undefined) {
        done(null, true);
      } else {
        const authError: AuthenticateError = Object.assign(new Error("Auth Failed"), { returnCode: 4 });
        done(authError, false);
      }
      return;
    }

    const device = await DeviceRepo.getDeviceBySN(snString);
    if (device === undefined) {
      // Return code 4: Bad Username or Password
      const authError: AuthenticateError = Object.assign(new Error("Auth Failed"), { returnCode: 4 });
      done(authError, false);
    } else {
      const key = await device.generateKey();
      if (key === pwString) {
        done(null, true);
      } else {
        // Return code 4: Bad Username or Password
        const authError: AuthenticateError = Object.assign(new Error("Auth Failed"), { returnCode: 4 });
        done(authError, false);
      }
    }
  }

  mqttWSS.on("connection", (websocket, req) => {
    const stream = createWebSocketStream(websocket);
    aedes.handle(stream, req);
  });

  // MQTT.js MQTT CLIENT
  const result = MQTTACSController.initialize();
  console.log(`${result ? "Successfully initialized" : "Failed to initialize"} local MQTT client`);

  const pingResponse = await pingAtrium();
  if (typeof pingResponse !== 'boolean' || pingResponse == false) {
    console.error("Unable to contact atrium api. Currency functionality may be limited", pingResponse);
  }

  httpServer.listen({ port: PORT }, () => {
    console.log(
      `🚀 GraphQL-Server is running on https://localhost:${PORT}/graphql`
    );
  });
}

startServer();