MCP Chat Support System

"use strict"; var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) { function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); } return new (P || (P = Promise))(function (resolve, reject) { function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); }; var __generator = (this && this.__generator) || function (thisArg, body) { var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype); return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g; function verb(n) { return function (v) { return step([n, v]); }; } function step(op) { if (f) throw new TypeError("Generator is already executing."); while (g && (g = 0, op[0] && (_ = 0)), _) try { if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t; if (y = 0, t) op = [op[0] & 2, t.value]; switch (op[0]) { case 0: case 1: t = op; break; case 4: _.label++; return { value: op[1], done: false }; case 5: _.label++; y = op[1]; op = [0]; continue; case 7: op = _.ops.pop(); _.trys.pop(); continue; default: if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; } if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; } if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; } if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; } if (t[2]) _.ops.pop(); _.trys.pop(); continue; } op = body.call(thisArg, _); } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; } if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true }; } }; var __rest = (this && this.__rest) || function (s, e) { var t = {}; for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0) t[p] = s[p]; if (s != null && typeof Object.getOwnPropertySymbols === "function") for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) { if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i])) t[p[i]] = s[p[i]]; } return t; }; Object.defineProperty(exports, "__esModule", { value: true }); var express_1 = require("express"); var bcryptjs_1 = require("bcryptjs"); var jsonwebtoken_1 = require("jsonwebtoken"); var uuid_1 = require("uuid"); var google_auth_library_1 = require("google-auth-library"); var database_1 = require("../db/database"); var auth_1 = require("../middleware/auth"); var router = express_1.default.Router(); var client = new google_auth_library_1.OAuth2Client(process.env.GOOGLE_CLIENT_ID); // Sign up with email/password router.post('/signup', function (req, res) { return __awaiter(void 0, void 0, void 0, function () { var _a, email, password, name_1, existingUser, saltRounds, passwordHash, verificationToken, result, tenantResult, token, user, error_1; return __generator(this, function (_b) { switch (_b.label) { case 0: _b.trys.push([0, 7, , 8]); _a = req.body, email = _a.email, password = _a.password, name_1 = _a.name; // Validation if (!email || !password || !name_1) { return [2 /*return*/, res.status(400).json({ error: 'Email, password, and name are required' })]; } if (password.length < 6) { return [2 /*return*/, res.status(400).json({ error: 'Password must be at least 6 characters' })]; } return [4 /*yield*/, database_1.database.get('SELECT id FROM users WHERE email = ?', [email])]; case 1: existingUser = _b.sent(); if (existingUser) { return [2 /*return*/, res.status(400).json({ error: 'User already exists' })]; } saltRounds = 10; return [4 /*yield*/, bcryptjs_1.default.hash(password, saltRounds)]; case 2: passwordHash = _b.sent(); verificationToken = (0, uuid_1.v4)(); return [4 /*yield*/, database_1.database.run('INSERT INTO users (email, name, password_hash, verification_token) VALUES (?, ?, ?, ?)', [email, name_1, passwordHash, verificationToken])]; case 3: result = _b.sent(); return [4 /*yield*/, database_1.database.run('INSERT INTO tenants (name, subdomain) VALUES (?, ?)', ["".concat(name_1, "'s Workspace"), "tenant-".concat(result.lastID)])]; case 4: tenantResult = _b.sent(); // Link user to tenant return [4 /*yield*/, database_1.database.run('INSERT INTO user_tenants (user_id, tenant_id, role) VALUES (?, ?, ?)', [result.lastID, tenantResult.lastID, 'owner'])]; case 5: // Link user to tenant _b.sent(); token = jsonwebtoken_1.default.sign({ userId: result.lastID, tenantId: tenantResult.lastID }, process.env.JWT_SECRET, { expiresIn: '7d' }); return [4 /*yield*/, database_1.database.get('SELECT id, email, name, avatar, created_at FROM users WHERE id = ?', [result.lastID])]; case 6: user = _b.sent(); res.status(201).json({ message: 'User created successfully', token: token, user: user, tenant: { id: tenantResult.lastID, name: "".concat(name_1, "'s Workspace") } }); return [3 /*break*/, 8]; case 7: error_1 = _b.sent(); console.error('Signup error:', error_1); res.status(500).json({ error: 'Internal server error' }); return [3 /*break*/, 8]; case 8: return [2 /*return*/]; } }); }); }); // Sign in with email/password router.post('/signin', function (req, res) { return __awaiter(void 0, void 0, void 0, function () { var _a, email, password, user, isValidPassword, userTenant, token, password_hash, verification_token, safeUser, error_2; return __generator(this, function (_b) { switch (_b.label) { case 0: _b.trys.push([0, 4, , 5]); _a = req.body, email = _a.email, password = _a.password; if (!email || !password) { return [2 /*return*/, res.status(400).json({ error: 'Email and password are required' })]; } return [4 /*yield*/, database_1.database.get('SELECT * FROM users WHERE email = ?', [email])]; case 1: user = _b.sent(); if (!user || !user.password_hash) { return [2 /*return*/, res.status(401).json({ error: 'Invalid credentials' })]; } return [4 /*yield*/, bcryptjs_1.default.compare(password, user.password_hash)]; case 2: isValidPassword = _b.sent(); if (!isValidPassword) { return [2 /*return*/, res.status(401).json({ error: 'Invalid credentials' })]; } return [4 /*yield*/, database_1.database.get("SELECT t.id, t.name, t.subdomain, t.plan \n FROM tenants t \n JOIN user_tenants ut ON t.id = ut.tenant_id \n WHERE ut.user_id = ? AND ut.role = 'owner'", [user.id])]; case 3: userTenant = _b.sent(); token = jsonwebtoken_1.default.sign({ userId: user.id, tenantId: userTenant === null || userTenant === void 0 ? void 0 : userTenant.id }, process.env.JWT_SECRET, { expiresIn: '7d' }); password_hash = user.password_hash, verification_token = user.verification_token, safeUser = __rest(user, ["password_hash", "verification_token"]); res.json({ message: 'Signed in successfully', token: token, user: safeUser, tenant: userTenant }); return [3 /*break*/, 5]; case 4: error_2 = _b.sent(); console.error('Signin error:', error_2); res.status(500).json({ error: 'Internal server error' }); return [3 /*break*/, 5]; case 5: return [2 /*return*/]; } }); }); }); // Google OAuth router.post('/google', function (req, res) { return __awaiter(void 0, void 0, void 0, function () { var credential, ticket, payload, googleId, email, name_2, picture, user, result, tenantResult, userTenant, token, password_hash, verification_token, safeUser, error_3; return __generator(this, function (_a) { switch (_a.label) { case 0: _a.trys.push([0, 11, , 12]); credential = req.body.credential; if (!credential) { return [2 /*return*/, res.status(400).json({ error: 'Google credential is required' })]; } return [4 /*yield*/, client.verifyIdToken({ idToken: credential, audience: process.env.GOOGLE_CLIENT_ID, })]; case 1: ticket = _a.sent(); payload = ticket.getPayload(); if (!payload) { return [2 /*return*/, res.status(400).json({ error: 'Invalid Google token' })]; } googleId = payload.sub, email = payload.email, name_2 = payload.name, picture = payload.picture; return [4 /*yield*/, database_1.database.get('SELECT * FROM users WHERE google_id = ? OR email = ?', [googleId, email])]; case 2: user = _a.sent(); if (!user) return [3 /*break*/, 5]; if (!!user.google_id) return [3 /*break*/, 4]; return [4 /*yield*/, database_1.database.run('UPDATE users SET google_id = ?, avatar = ? WHERE id = ?', [googleId, picture, user.id])]; case 3: _a.sent(); user.google_id = googleId; user.avatar = picture; _a.label = 4; case 4: return [3 /*break*/, 9]; case 5: return [4 /*yield*/, database_1.database.run('INSERT INTO users (email, name, google_id, avatar, email_verified) VALUES (?, ?, ?, ?, ?)', [email, name_2, googleId, picture, true])]; case 6: result = _a.sent(); return [4 /*yield*/, database_1.database.run('INSERT INTO tenants (name, subdomain) VALUES (?, ?)', ["".concat(name_2, "'s Workspace"), "tenant-".concat(result.lastID)])]; case 7: tenantResult = _a.sent(); // Link user to tenant return [4 /*yield*/, database_1.database.run('INSERT INTO user_tenants (user_id, tenant_id, role) VALUES (?, ?, ?)', [result.lastID, tenantResult.lastID, 'owner'])]; case 8: // Link user to tenant _a.sent(); user = { id: result.lastID, email: email, name: name_2, google_id: googleId, avatar: picture, email_verified: true }; _a.label = 9; case 9: return [4 /*yield*/, database_1.database.get("SELECT t.id, t.name, t.subdomain, t.plan \n FROM tenants t \n JOIN user_tenants ut ON t.id = ut.tenant_id \n WHERE ut.user_id = ? AND ut.role = 'owner'", [user.id])]; case 10: userTenant = _a.sent(); token = jsonwebtoken_1.default.sign({ userId: user.id, tenantId: userTenant === null || userTenant === void 0 ? void 0 : userTenant.id }, process.env.JWT_SECRET, { expiresIn: '7d' }); password_hash = user.password_hash, verification_token = user.verification_token, safeUser = __rest(user, ["password_hash", "verification_token"]); res.json({ message: 'Google authentication successful', token: token, user: safeUser, tenant: userTenant }); return [3 /*break*/, 12]; case 11: error_3 = _a.sent(); console.error('Google auth error:', error_3); res.status(500).json({ error: 'Google authentication failed' }); return [3 /*break*/, 12]; case 12: return [2 /*return*/]; } }); }); }); // Get current user router.get('/me', auth_1.authenticateToken, function (req, res) { return __awaiter(void 0, void 0, void 0, function () { var _a, userId, tenantId, user, tenant, error_4; return __generator(this, function (_b) { switch (_b.label) { case 0: _b.trys.push([0, 3, , 4]); _a = req.user, userId = _a.userId, tenantId = _a.tenantId; return [4 /*yield*/, database_1.database.get('SELECT id, email, name, avatar, email_verified, created_at FROM users WHERE id = ?', [userId])]; case 1: user = _b.sent(); if (!user) { return [2 /*return*/, res.status(404).json({ error: 'User not found' })]; } return [4 /*yield*/, database_1.database.get('SELECT id, name, subdomain, plan, settings FROM tenants WHERE id = ?', [tenantId])]; case 2: tenant = _b.sent(); res.json({ user: user, tenant: tenant }); return [3 /*break*/, 4]; case 3: error_4 = _b.sent(); console.error('Get user error:', error_4); res.status(500).json({ error: 'Internal server error' }); return [3 /*break*/, 4]; case 4: return [2 /*return*/]; } }); }); }); // Update user profile router.put('/profile', auth_1.authenticateToken, function (req, res) { return __awaiter(void 0, void 0, void 0, function () { var userId, _a, name_3, avatar, updates, params, user, error_5; return __generator(this, function (_b) { switch (_b.label) { case 0: _b.trys.push([0, 3, , 4]); userId = req.user.userId; _a = req.body, name_3 = _a.name, avatar = _a.avatar; updates = []; params = []; if (name_3) { updates.push('name = ?'); params.push(name_3); } if (avatar) { updates.push('avatar = ?'); params.push(avatar); } if (updates.length === 0) { return [2 /*return*/, res.status(400).json({ error: 'No valid fields to update' })]; } updates.push('updated_at = CURRENT_TIMESTAMP'); params.push(userId); return [4 /*yield*/, database_1.database.run("UPDATE users SET ".concat(updates.join(', '), " WHERE id = ?"), params)]; case 1: _b.sent(); return [4 /*yield*/, database_1.database.get('SELECT id, email, name, avatar, email_verified, created_at FROM users WHERE id = ?', [userId])]; case 2: user = _b.sent(); res.json({ message: 'Profile updated successfully', user: user }); return [3 /*break*/, 4]; case 3: error_5 = _b.sent(); console.error('Update profile error:', error_5); res.status(500).json({ error: 'Internal server error' }); return [3 /*break*/, 4]; case 4: return [2 /*return*/]; } }); }); }); // Logout (client-side token removal, but we can blacklist if needed) router.post('/logout', auth_1.authenticateToken, function (req, res) { res.json({ message: 'Logged out successfully' }); }); exports.default = router;