Add hotel registration with email confirmation (nodemailer, confirm-email endpoint)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
56
backend/src/email.ts
Normal file
56
backend/src/email.ts
Normal file
@@ -0,0 +1,56 @@
|
||||
import nodemailer from 'nodemailer'
|
||||
|
||||
const transporter = nodemailer.createTransport({
|
||||
host: process.env.SMTP_HOST ?? 'smtp.timeweb.ru',
|
||||
port: parseInt(process.env.SMTP_PORT ?? '465', 10),
|
||||
secure: true,
|
||||
auth: {
|
||||
user: process.env.SMTP_USER ?? 'noreply@hotelsync.ru',
|
||||
pass: process.env.SMTP_PASS ?? '08K28150zBwii32c85',
|
||||
},
|
||||
})
|
||||
|
||||
export async function sendConfirmationEmail(to: string, name: string, token: string): Promise<void> {
|
||||
const apiUrl = process.env.API_URL ?? 'https://api.hotelsync.ru'
|
||||
const confirmUrl = `${apiUrl}/api/auth/confirm-email?token=${token}`
|
||||
const fromAddr = process.env.SMTP_USER ?? 'noreply@hotelsync.ru'
|
||||
|
||||
await transporter.sendMail({
|
||||
from: `"HotelSync" <${fromAddr}>`,
|
||||
to,
|
||||
subject: 'Подтвердите email — HotelSync',
|
||||
html: `<!DOCTYPE html>
|
||||
<html>
|
||||
<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"></head>
|
||||
<body style="font-family:Arial,sans-serif;background:#f1f5f9;margin:0;padding:40px 16px;">
|
||||
<div style="max-width:520px;margin:0 auto;background:#fff;border-radius:16px;overflow:hidden;box-shadow:0 4px 24px rgba(0,0,0,0.08);">
|
||||
<div style="background:linear-gradient(135deg,#4f46e5,#6366f1);padding:32px 40px;text-align:center;">
|
||||
<div style="display:inline-block;width:48px;height:48px;background:rgba(255,255,255,0.2);border-radius:12px;line-height:48px;font-size:24px;margin-bottom:12px;">🏨</div>
|
||||
<h1 style="color:#fff;margin:0;font-size:26px;font-weight:700;letter-spacing:-0.5px;">HotelSync</h1>
|
||||
<p style="color:#c7d2fe;margin:6px 0 0;font-size:14px;">Современная PMS-система</p>
|
||||
</div>
|
||||
<div style="padding:40px;">
|
||||
<h2 style="color:#1e293b;font-size:20px;margin:0 0 12px;font-weight:600;">Добро пожаловать, ${name}!</h2>
|
||||
<p style="color:#475569;line-height:1.7;margin:0 0 28px;font-size:15px;">
|
||||
Спасибо за регистрацию в HotelSync. Для активации аккаунта нажмите на кнопку ниже.
|
||||
</p>
|
||||
<div style="text-align:center;margin:0 0 28px;">
|
||||
<a href="${confirmUrl}" style="display:inline-block;background:#4f46e5;color:#fff;text-decoration:none;padding:14px 36px;border-radius:10px;font-weight:600;font-size:16px;letter-spacing:0.2px;">
|
||||
✓ Подтвердить email
|
||||
</a>
|
||||
</div>
|
||||
<p style="color:#94a3b8;font-size:13px;margin:0 0 16px;line-height:1.6;background:#f8fafc;padding:12px 16px;border-radius:8px;border-left:3px solid #e2e8f0;">
|
||||
⏱ Ссылка действительна <strong>24 часа</strong>.<br>
|
||||
Если вы не регистрировались — просто проигнорируйте это письмо.
|
||||
</p>
|
||||
<hr style="border:none;border-top:1px solid #e2e8f0;margin:20px 0;">
|
||||
<p style="color:#94a3b8;font-size:12px;margin:0;line-height:1.6;">
|
||||
Кнопка не работает? Скопируйте ссылку в браузер:<br>
|
||||
<a href="${confirmUrl}" style="color:#6366f1;word-break:break-all;font-size:11px;">${confirmUrl}</a>
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>`,
|
||||
})
|
||||
}
|
||||
@@ -4,6 +4,7 @@ import crypto from 'crypto'
|
||||
import { db } from '../db'
|
||||
import { redis } from '../redis'
|
||||
import { config } from '../config'
|
||||
import { sendConfirmationEmail } from '../email'
|
||||
import type { JwtPayload } from '../types'
|
||||
|
||||
const auth: FastifyPluginAsync = async (fastify) => {
|
||||
@@ -38,6 +39,10 @@ const auth: FastifyPluginAsync = async (fastify) => {
|
||||
return reply.code(401).send({ error: 'Неверный email или пароль' })
|
||||
}
|
||||
|
||||
if (!user.email_confirmed) {
|
||||
return reply.code(403).send({ error: 'Email не подтверждён. Проверьте почту и перейдите по ссылке.' })
|
||||
}
|
||||
|
||||
const payload: JwtPayload = {
|
||||
sub: user.id,
|
||||
email: user.email,
|
||||
@@ -51,7 +56,6 @@ const auth: FastifyPluginAsync = async (fastify) => {
|
||||
expiresIn: config.jwt.accessExpiry,
|
||||
})
|
||||
|
||||
// Refresh token — opaque, stored in Redis
|
||||
const refreshToken = crypto.randomBytes(40).toString('hex')
|
||||
await redis.set(
|
||||
`refresh:${refreshToken}`,
|
||||
@@ -82,6 +86,145 @@ const auth: FastifyPluginAsync = async (fastify) => {
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/auth/register ────────────────────────────────────────────────
|
||||
fastify.post<{
|
||||
Body: {
|
||||
hotelName: string
|
||||
address?: string
|
||||
contact: string
|
||||
email: string
|
||||
phone?: string
|
||||
password: string
|
||||
}
|
||||
}>(
|
||||
'/api/auth/register',
|
||||
{
|
||||
schema: {
|
||||
body: {
|
||||
type: 'object',
|
||||
required: ['hotelName', 'contact', 'email', 'password'],
|
||||
properties: {
|
||||
hotelName: { type: 'string', minLength: 2 },
|
||||
address: { type: 'string' },
|
||||
contact: { type: 'string', minLength: 2 },
|
||||
email: { type: 'string' },
|
||||
phone: { type: 'string' },
|
||||
password: { type: 'string', minLength: 8 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
const { hotelName, address, contact, email, phone, password } = request.body
|
||||
|
||||
const { rows: existing } = await db.query(
|
||||
'SELECT id FROM users WHERE email = $1',
|
||||
[email.toLowerCase().trim()],
|
||||
)
|
||||
if (existing.length > 0) {
|
||||
return reply.code(409).send({ error: 'Пользователь с таким email уже существует' })
|
||||
}
|
||||
|
||||
// Generate slug from hotel name (transliterate RU→EN)
|
||||
const ru: Record<string, string> = {
|
||||
а:'a',б:'b',в:'v',г:'g',д:'d',е:'e',ё:'yo',ж:'zh',з:'z',и:'i',й:'y',
|
||||
к:'k',л:'l',м:'m',н:'n',о:'o',п:'p',р:'r',с:'s',т:'t',у:'u',ф:'f',
|
||||
х:'h',ц:'ts',ч:'ch',ш:'sh',щ:'sch',ъ:'',ы:'y',ь:'',э:'e',ю:'yu',я:'ya',
|
||||
}
|
||||
const baseSlug = hotelName
|
||||
.toLowerCase()
|
||||
.split('')
|
||||
.map(c => ru[c] ?? c)
|
||||
.join('')
|
||||
.replace(/[^a-z0-9\s-]/g, '')
|
||||
.trim()
|
||||
.replace(/\s+/g, '-')
|
||||
.replace(/-+/g, '-')
|
||||
.substring(0, 50) || 'hotel'
|
||||
|
||||
let slug = baseSlug
|
||||
let suffix = 2
|
||||
for (;;) {
|
||||
const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
|
||||
if (rows.length === 0) break
|
||||
slug = `${baseSlug}-${suffix++}`
|
||||
}
|
||||
|
||||
const passwordHash = await bcrypt.hash(password, 12)
|
||||
const confirmToken = crypto.randomBytes(32).toString('hex')
|
||||
|
||||
const client = await db.connect()
|
||||
try {
|
||||
await client.query('BEGIN')
|
||||
const { rows: [hotel] } = await client.query(
|
||||
`INSERT INTO hotels (name, slug, address, timezone, currency, plan, is_active)
|
||||
VALUES ($1, $2, $3, 'Europe/Moscow', 'RUB', 'starter', true)
|
||||
RETURNING id`,
|
||||
[hotelName, slug, address ?? null],
|
||||
)
|
||||
await client.query(
|
||||
`INSERT INTO users (name, email, password_hash, role, hotel_id, phone, email_confirmed, confirmation_token, confirmation_sent_at)
|
||||
VALUES ($1, $2, $3, 'manager', $4, $5, false, $6, NOW())`,
|
||||
[contact, email.toLowerCase().trim(), passwordHash, hotel.id, phone ?? null, confirmToken],
|
||||
)
|
||||
await client.query('COMMIT')
|
||||
} catch (err) {
|
||||
await client.query('ROLLBACK')
|
||||
throw err
|
||||
} finally {
|
||||
client.release()
|
||||
}
|
||||
|
||||
try {
|
||||
await sendConfirmationEmail(email, contact, confirmToken)
|
||||
} catch (emailErr) {
|
||||
console.error('[email] Confirmation email failed:', emailErr)
|
||||
// Don't fail the registration — user can request resend later
|
||||
}
|
||||
|
||||
return reply.code(201).send({
|
||||
ok: true,
|
||||
message: `Письмо с подтверждением отправлено на ${email}`,
|
||||
})
|
||||
},
|
||||
)
|
||||
|
||||
// ── GET /api/auth/confirm-email ────────────────────────────────────────────
|
||||
fastify.get<{ Querystring: { token?: string } }>(
|
||||
'/api/auth/confirm-email',
|
||||
async (request, reply) => {
|
||||
const { token } = request.query
|
||||
const appUrl = process.env.APP_URL ?? 'https://app.hotelsync.ru'
|
||||
|
||||
if (!token) {
|
||||
return reply.redirect(`${appUrl}/login?error=invalid_token`)
|
||||
}
|
||||
|
||||
const { rows } = await db.query(
|
||||
`SELECT id, confirmation_sent_at FROM users
|
||||
WHERE confirmation_token = $1 AND email_confirmed = false`,
|
||||
[token],
|
||||
)
|
||||
|
||||
if (rows.length === 0) {
|
||||
return reply.redirect(`${appUrl}/login?error=invalid_token`)
|
||||
}
|
||||
|
||||
const sentAt = new Date(rows[0].confirmation_sent_at as string)
|
||||
const hoursElapsed = (Date.now() - sentAt.getTime()) / 1000 / 3600
|
||||
if (hoursElapsed > 24) {
|
||||
return reply.redirect(`${appUrl}/login?error=token_expired`)
|
||||
}
|
||||
|
||||
await db.query(
|
||||
`UPDATE users SET email_confirmed = true, confirmation_token = NULL WHERE id = $1`,
|
||||
[rows[0].id],
|
||||
)
|
||||
|
||||
return reply.redirect(`${appUrl}/login?confirmed=1`)
|
||||
},
|
||||
)
|
||||
|
||||
// ── POST /api/auth/refresh ─────────────────────────────────────────────────
|
||||
fastify.post('/api/auth/refresh', async (request, reply) => {
|
||||
const refreshToken = request.cookies?.refresh_token
|
||||
|
||||
Reference in New Issue
Block a user