Backend API looks fine

src/lib/get-url.ts

@@ -1,7 +1,10 @@
 import { adminCredentials } from '~/components/credentials';
 
-export const getUrl = (id: string, db = 'dyomedea_users') => {
-  const credentials = adminCredentials();
+export const getUrl = (
+  id: string,
+  db = 'dyomedea_users',
+  credentials = adminCredentials()
+) => {
   if (!credentials) {
     return '';
   }

src/lib/get.ts

@@ -2,19 +2,24 @@ import { adminCredentials } from '~/components/credentials';
 import { getUrl } from './get-url';
 import { headersWithAuth } from './headers-with-auth';
 
-export const get = async (id: string, db = 'dyomedea_users') => {
-  const credentials = adminCredentials();
+export const get = async (
+  id: string,
+  db = 'dyomedea_users',
+  credentials = adminCredentials()
+) => {
   if (!credentials) {
     return null;
   }
   const { database } = credentials;
 
-  const headers = headersWithAuth();
+  const headers = headersWithAuth(credentials);
   if (!headers) {
     return null;
   }
 
-  const response = await fetch(getUrl(id, db), {
+  // console.log({ caller: 'get', id, db, credentials, headers });
+
+  const response = await fetch(getUrl(id, db, credentials), {
     method: 'GET',
     mode: 'cors',
     headers,

src/lib/obfuscate-mail.ts

@@ -0,0 +1,12 @@
+export const obfuscateMail = (mail: string) => {
+  const [user, hostname] = mail.split('@');
+  const obfuscatedUser =
+    user.length < 4
+      ? user[0] + new Array(user.length).join('.')
+      : user[0] + new Array(user.length - 1).join('.') + user[user.length - 1];
+  const obfuscatedHostname =
+    hostname[0] +
+    new Array(hostname.length - 1).join('.') +
+    hostname[hostname.length - 1];
+  return obfuscatedUser + '@' + obfuscatedHostname;
+};

src/lib/put.ts

@@ -8,36 +8,46 @@ export const put = async (
   content: any,
   isNew: boolean = false,
   db = 'dyomedea_users',
-  overwrite_ = false
+  overwrite_ = false,
+  credentials = adminCredentials()
 ) => {
-  const credentials = adminCredentials();
+  console.log({ caller: 'put', id, isNew, db, content, credentials });
+
   if (!credentials) {
     return null;
   }
   const { database } = credentials;
 
   if (!isNew) {
-    const previous = await get(id, db);
+    const previous = await get(id, db, credentials);
+    // console.log({
+    //   caller: 'put / after get',
+    //   id,
+    //   isNew,
+    //   db,
+    //   content,
+    //   previous,
+    // });
     if (!!previous) {
       content._rev = previous._rev;
       if (!overwrite_) {
-        content.__ = previous.__;
+        content.$ = previous.$;
       }
     }
   }
 
-  const headers = headersWithAuth();
+  const headers = headersWithAuth(credentials);
   if (!headers) {
     return null;
   }
   headers.set('Content-type', 'application/json; charset=UTF-8');
 
-  const response = await fetch(getUrl(id, db), {
+  const response = await fetch(getUrl(id, db, credentials), {
     method: 'PUT',
     mode: 'cors',
     headers,
     body: JSON.stringify(content),
   });
-  console.log({ caller: 'put', id, isNew, db, status: response.status });
+  // console.log({ caller: 'put', id, isNew, db, status: response.status });
   return await response.json();
 };

src/mail-template/email.handlebars

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta http-equiv="x-ua-compatible" content="ie=edge">
+  <title>Validation</title>
+</head>
+<body>
+  <h2>Bonjour {{id}}! </h2>
+  <p>Le code de validation de votre configuration pour l'application Dyomedea est <code>{{code}}</code>.</p>
+  <p>Ce code est valable pendant quinze minutes.</p>
+  <p>Eric</p>
+</body>
+</html>

src/routes/api/conf/[token]/[code]/index.ts

@@ -1,6 +1,22 @@
 import { APIEvent, json } from 'solid-start/api';
+import { findUserByToken } from '~/lib/find-user-by-token';
+import { readConfig } from '~/server-only-lib/read-config';
 
 export async function GET({ params, env }: APIEvent) {
-  console.log({ caller: 'api/conf GET', params });
-  return json({ params, env, response: 'OK' });
+  const { credentials } = readConfig();
+  const user = await findUserByToken(params.token, credentials);
+  console.log({ caller: 'api/conf GET', params, credentials, user });
+  if (!user) {
+    return json({ params, response: 'NOT FOUND' });
+  }
+  const { code, expiration } = user.$;
+  if (
+    !code ||
+    !expiration ||
+    params.code !== code ||
+    new Date() > new Date(expiration)
+  ) {
+    return json({ params, response: 'NOT FOUND' });
+  }
+  return json({ params, response: 'OK', user });
 }

src/routes/api/conf/[token]/index.ts

@@ -1,11 +1,60 @@
 import { APIEvent, json } from 'solid-start/api';
 import { findUserByToken } from '~/lib/find-user-by-token';
 import { readConfig } from '~/server-only-lib/read-config';
+import { createTransport } from 'nodemailer';
+import { resolve } from 'path';
+import hbs from 'nodemailer-express-handlebars';
+import { put } from '~/lib/put';
+import { obfuscateMail } from '~/lib/obfuscate-mail';
 
 export async function GET({ params }: APIEvent) {
-  const { credentials } = readConfig();
+  const { credentials, mailer } = readConfig();
   console.log({ caller: 'api/conf GET', params, credentials });
   const user = await findUserByToken(params.token, credentials);
   console.log({ caller: 'api/conf GET', params, credentials, user });
-  return json({ params, response: 'OK' });
+  if (!user) {
+    return json({ params, response: 'NOT FOUND' });
+  }
+  const transporter = createTransport(mailer);
+
+  const handlebarOptions = {
+    viewEngine: {
+      partialsDir: resolve('src/mail-template/'),
+      defaultLayout: false,
+    },
+    viewPath: resolve('src/mail-template/'),
+  };
+  transporter.use('compile', hbs(handlebarOptions));
+
+  const code = [...Array(6)].map((_) => (Math.random() * 10) | 0).join('');
+
+  const mailOptions = {
+    from: '"Dyomedea app" <app@dyomedea.com>', // sender address
+    to: user.mail, // list of receivers
+    subject: 'Validation!',
+    template: 'email', // the name of the template file i.e email.handlebars
+    context: {
+      id: user._id,
+      code,
+    },
+  };
+
+  await transporter.sendMail(mailOptions);
+
+  await put(
+    user._id,
+    {
+      ...user,
+      $: {
+        code,
+        expiration: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
+      },
+    },
+    false,
+    undefined,
+    true,
+    credentials
+  );
+
+  return json({ params, status: 'OK', mail: obfuscateMail(user.mail) });
 }