Add email verification on signup

Author: nicolelim02

backend/user-service/.env.sample

@@ -7,18 +7,26 @@ MONGO_LOCAL_URI=<MONGO_LOCAL_URI>
 # Secret for creating JWT signature
 JWT_SECRET=<JWT_SECRET>
 
-# admin default credentials
+# Admin default credentials
 ADMIN_FIRST_NAME=Admin
 ADMIN_LAST_NAME=User
 ADMIN_USERNAME=administrator
 ADMIN_EMAIL=[email protected]
 ADMIN_PASSWORD=Admin@123
 
-# firebase
+# Firebase
 FIREBASE_PROJECT_ID=FIREBASE_PROJECT_ID
 FIREBASE_PRIVATE_KEY=FIREBASE_PRIVATE_KEY
 FIREBASE_CLIENT_EMAIL=FIREBASE_CLIENT_EMAIL
 FIREBASE_STORAGE_BUCKET=FIREBASE_STORAGE_BUCKET
 
-# origins for cors
-ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+# Origins for cors
+ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+
+# Mail service
+SERVICE=gmail
+USER=EMAIL_ADDRESS
+PASS=PASSWORD
+
+# Redis configuration
+REDIS_URI=REDIS_URI

backend/user-service/config/firebase.ts

@@ -11,4 +11,6 @@ admin.initializeApp({
 
 const bucket = admin.storage().bucket();
 
-export { bucket };
+const auth = admin.auth();
+
+export { bucket, auth };

backend/user-service/config/redis.ts

@@ -0,0 +1,14 @@
+import { createClient } from "redis";
+import dotenv from "dotenv";
+
+dotenv.config();
+
+const REDIS_URI = process.env.REDIS_URI || "redis://localhost:6379";
+
+const client = createClient({ url: REDIS_URI });
+
+client.on("error", (err) => console.log(`Error: ${err}`));
+
+await client.connect();
+
+export default client;

backend/user-service/controller/user-controller.ts

@@ -11,6 +11,7 @@ import {
   findUserByUsernameOrEmail as _findUserByUsernameOrEmail,
   updateUserById as _updateUserById,
   updateUserPrivilegeById as _updateUserPrivilegeById,
+  updateUserVerification as _updateUserVerification,
 } from "../model/repository";
 import {
   validateEmail,
@@ -22,6 +23,10 @@ import {
 import { IUser } from "../model/user-model";
 import { upload } from "../config/multer";
 import { uploadFileToFirebase } from "../utils/utils";
+import redisClient from "../config/redis";
+import crypto from "crypto";
+import { sendMail } from "../utils/mailer";
+import { ACCOUNT_VERIFICATION_SUBJ } from "../utils/constants";
 
 export async function createUser(
   req: Request,
@@ -77,6 +82,14 @@ export async function createUser(
         email,
         hashedPassword
       );
+
+      const emailToken = crypto.randomBytes(16).toString("hex");
+      await redisClient.set(email, emailToken, { EX: 60 * 5 }); // expire in 5 minutes
+      const emailText = `Hello ${username},\n\n
+      Please click on the following link to verify your account:\n\nhttp://localhost:3001/api/users/verify-email/${email}/${emailToken}\n\n
+      If you did not request this, please ignore this email.`;
+      await sendMail(email, ACCOUNT_VERIFICATION_SUBJ, emailText);
+
       return res.status(201).json({
         message: `Created new user ${username} successfully`,
         data: formatUserResponse(createdUser),
@@ -94,6 +107,41 @@ export async function createUser(
   }
 }
 
+export const verifyUser = async (
+  req: Request,
+  res: Response
+): Promise<Response> => {
+  try {
+    const { email, token } = req.params;
+
+    const user = await _findUserByEmail(email);
+    if (!user) {
+      return res.status(404).json({ message: `User ${email} not found` });
+    }
+
+    const expectedToken = await redisClient.get(email);
+
+    if (expectedToken !== token) {
+      return res
+        .status(400)
+        .json({ message: "Invalid token. Please request for a new one." });
+    }
+
+    const updatedUser = await _updateUserVerification(email);
+    if (!updatedUser) {
+      return res.status(404).json({ message: `User ${email} not verified.` });
+    }
+
+    return res
+      .status(200)
+      .json({ message: `User ${email} verified successfully.` });
+  } catch {
+    return res
+      .status(500)
+      .json({ message: "Unknown error when verifying user!" });
+  }
+};
+
 export const createImageLink = async (
   req: Request,
   res: Response

backend/user-service/model/repository.ts

@@ -21,16 +21,18 @@ export async function createUser(
   username: string,
   email: string,
   password: string,
-  isAdmin: boolean = false
+  isAdmin: boolean = false,
+  isVerified: boolean = false
 ): Promise<IUser> {
-  return new UserModel({
+  const user = new UserModel({
     firstName,
     lastName,
     username,
     email,
     password,
     isAdmin,
-  }).save();
+  });
+  return user.save();
 }
 
 export async function findUserByEmail(email: string): Promise<IUser | null> {
@@ -98,6 +100,20 @@ export async function updateUserPrivilegeById(
   );
 }
 
+export async function updateUserVerification(
+  email: string
+): Promise<IUser | null> {
+  return UserModel.findOneAndUpdate(
+    { email },
+    {
+      $set: {
+        isVerified: true,
+      },
+    },
+    { new: true } // return the updated user
+  );
+}
+
 export async function deleteUserById(userId: string): Promise<IUser | null> {
   return UserModel.findByIdAndDelete(userId);
 }

backend/user-service/model/user-model.ts

@@ -11,6 +11,8 @@ export interface IUser extends Document {
   firstName: string;
   lastName: string;
   biography?: string;
+
+  isVerified: boolean;
 }
 
 const UserModelSchema: Schema<IUser> = new mongoose.Schema({
@@ -54,6 +56,11 @@ const UserModelSchema: Schema<IUser> = new mongoose.Schema({
     required: false,
     default: "Hello World!",
   },
+  isVerified: {
+    type: Boolean,
+    required: true,
+    default: false,
+  },
 });
 
 const UserModel = mongoose.model<IUser>("UserModel", UserModelSchema);

backend/user-service/package-lock.json

@@ -23,6 +23,7 @@
     "@types/jsonwebtoken": "^9.0.7",
     "@types/multer": "^1.4.12",
     "@types/node": "^22.5.5",
+    "@types/nodemailer": "^6.4.16",
     "@types/supertest": "^6.0.2",
     "@types/swagger-ui-express": "^4.1.6",
     "@types/uuid": "^10.0.0",
@@ -50,6 +51,8 @@
     "jsonwebtoken": "^9.0.2",
     "mongoose": "^8.5.4",
     "multer": "^1.4.5-lts.1",
+    "nodemailer": "^6.9.15",
+    "redis": "^4.7.0",
     "swagger-ui-express": "^5.0.1",
     "uuid": "^10.0.0",
     "validator": "^13.12.0",