Version 1.0.0: Passwort-Reset + Rate-Limiting + Auto-Geburtstagsgrüße
Die drei letzten wichtigen Features für ein produktionsreifes 1.0.0: ## 1. Passwort vergessen-Flow Der klassische Selfservice-Reset per Email – sowohl für Mitarbeiter als auch für Portal-Kunden. User können sich nicht mehr aussperren, Admin muss nicht mehr manuell eingreifen. - Neues Link "Passwort vergessen?" auf Login-Seite - PasswordResetRequest: Email + Typ-Auswahl (Mitarbeiter / Portal) - PasswordResetConfirm: Token-basierte Bestätigung + neues Passwort (min 6 Zeichen) - Token ist 2 Stunden gültig, dann muss neu angefordert werden - Token ist kryptografisch sicher (crypto.randomBytes(32)) - User-Enumeration-Schutz: Backend gibt immer 200 zurück, egal ob Email existiert - Nach erfolgreichem Reset werden ALLE bestehenden Sessions gekickt (tokenInvalidatedAt gesetzt) – falls jemand parallel eingeloggt war DB: - User.passwordResetToken + passwordResetExpiresAt - Customer.portalPasswordResetToken + portalPasswordResetExpiresAt ## 2. Rate-Limiting gegen Brute-Force Mit express-rate-limit: - Login: 10 Versuche pro 15 Minuten pro IP. Erfolgreiche zählen nicht mit. - Passwort-Reset-Request: 5 Versuche pro Stunde pro IP (Mail-Flut verhindern) Sowohl Mitarbeiter-Login als auch Portal-Login geschützt. ## 3. Auto-Geburtstagsgrüße per Cron Das autoBirthdayGreeting-Flag hatten wir schon, aber kein Scheduler der ihn wirklich abschickt. Jetzt: - Läuft täglich um 08:00 Uhr - Findet Kunden mit heutigem Geburtstag + autoBirthdayGreeting=true - Nur Email-Kanal (Messenger brauchen Browser-Klick) - Catch-up 30s nach Server-Start: wenn Server am Geburtstag down war, wird beim nächsten Boot nachgeholt - lastBirthdayGreetingYear verhindert Doppelversand Dependencies: node-cron, @types/node-cron, express-rate-limit Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Generated
+37
@@ -15,11 +15,13 @@
|
||||
"cors": "^2.8.5",
|
||||
"dotenv": "^16.4.5",
|
||||
"express": "^4.21.1",
|
||||
"express-rate-limit": "^8.4.0",
|
||||
"express-validator": "^7.2.0",
|
||||
"imapflow": "^1.2.8",
|
||||
"jsonwebtoken": "^9.0.2",
|
||||
"mailparser": "^3.9.3",
|
||||
"multer": "^1.4.5-lts.1",
|
||||
"node-cron": "^4.2.1",
|
||||
"nodemailer": "^7.0.13",
|
||||
"pdf-lib": "^1.17.1",
|
||||
"pdfkit": "^0.17.2",
|
||||
@@ -35,6 +37,7 @@
|
||||
"@types/mailparser": "^3.4.6",
|
||||
"@types/multer": "^1.4.12",
|
||||
"@types/node": "^22.9.0",
|
||||
"@types/node-cron": "^3.0.11",
|
||||
"@types/nodemailer": "^7.0.9",
|
||||
"@types/pdfkit": "^0.17.4",
|
||||
"prisma": "^5.22.0",
|
||||
@@ -744,6 +747,13 @@
|
||||
"undici-types": "~6.21.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/node-cron": {
|
||||
"version": "3.0.11",
|
||||
"resolved": "https://registry.npmjs.org/@types/node-cron/-/node-cron-3.0.11.tgz",
|
||||
"integrity": "sha512-0ikrnug3/IyneSHqCBeslAhlK2aBfYek1fGo4bP4QnZPmiqSGRK+Oy7ZMisLWkesffJvQ1cqAcBnJC+8+nxIAg==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@types/nodemailer": {
|
||||
"version": "7.0.9",
|
||||
"resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-7.0.9.tgz",
|
||||
@@ -1662,6 +1672,24 @@
|
||||
"url": "https://opencollective.com/express"
|
||||
}
|
||||
},
|
||||
"node_modules/express-rate-limit": {
|
||||
"version": "8.4.0",
|
||||
"resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.4.0.tgz",
|
||||
"integrity": "sha512-gDK8yiqKxrGta+3WtON59arrrw6GLmadA1qoFgYXzdcch8fmKDID2XqO8itsi3f1wufXYPT51387dN6cvVBS3Q==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"ip-address": "10.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 16"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/express-rate-limit"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"express": ">= 4.11"
|
||||
}
|
||||
},
|
||||
"node_modules/express-validator": {
|
||||
"version": "7.3.1",
|
||||
"resolved": "https://registry.npmjs.org/express-validator/-/express-validator-7.3.1.tgz",
|
||||
@@ -2397,6 +2425,15 @@
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/node-cron": {
|
||||
"version": "4.2.1",
|
||||
"resolved": "https://registry.npmjs.org/node-cron/-/node-cron-4.2.1.tgz",
|
||||
"integrity": "sha512-lgimEHPE/QDgFlywTd8yTR61ptugX3Qer29efeyWw2rv259HtGBNn1vZVmp8lB9uo9wC0t/AT4iGqXxia+CJFg==",
|
||||
"license": "ISC",
|
||||
"engines": {
|
||||
"node": ">=6.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/nodemailer": {
|
||||
"version": "7.0.13",
|
||||
"resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-7.0.13.tgz",
|
||||
|
||||
@@ -26,11 +26,13 @@
|
||||
"cors": "^2.8.5",
|
||||
"dotenv": "^16.4.5",
|
||||
"express": "^4.21.1",
|
||||
"express-rate-limit": "^8.4.0",
|
||||
"express-validator": "^7.2.0",
|
||||
"imapflow": "^1.2.8",
|
||||
"jsonwebtoken": "^9.0.2",
|
||||
"mailparser": "^3.9.3",
|
||||
"multer": "^1.4.5-lts.1",
|
||||
"node-cron": "^4.2.1",
|
||||
"nodemailer": "^7.0.13",
|
||||
"pdf-lib": "^1.17.1",
|
||||
"pdfkit": "^0.17.2",
|
||||
@@ -46,6 +48,7 @@
|
||||
"@types/mailparser": "^3.4.6",
|
||||
"@types/multer": "^1.4.12",
|
||||
"@types/node": "^22.9.0",
|
||||
"@types/node-cron": "^3.0.11",
|
||||
"@types/nodemailer": "^7.0.9",
|
||||
"@types/pdfkit": "^0.17.4",
|
||||
"prisma": "^5.22.0",
|
||||
|
||||
@@ -78,6 +78,10 @@ model User {
|
||||
isActive Boolean @default(true)
|
||||
tokenInvalidatedAt DateTime? // Zeitpunkt ab dem alle Tokens ungültig sind (für Zwangslogout bei Rechteänderung)
|
||||
|
||||
// Passwort-Reset
|
||||
passwordResetToken String? @unique
|
||||
passwordResetExpiresAt DateTime?
|
||||
|
||||
// Messaging-Kanäle (für Datenschutz-Link-Versand)
|
||||
whatsappNumber String?
|
||||
telegramUsername String?
|
||||
@@ -163,6 +167,10 @@ model Customer {
|
||||
portalPasswordEncrypted String? // Verschlüsseltes Passwort (für Anzeige)
|
||||
portalLastLogin DateTime? // Letzte Anmeldung
|
||||
|
||||
// Portal Passwort-Reset
|
||||
portalPasswordResetToken String? @unique
|
||||
portalPasswordResetExpiresAt DateTime?
|
||||
|
||||
// Geburtstagsmodal: Jahr in dem dem Kunden der Geburtstagsgruß gezeigt wurde (vermeidet mehrfaches Anzeigen)
|
||||
lastBirthdayGreetingYear Int?
|
||||
|
||||
|
||||
@@ -99,6 +99,73 @@ export async function me(req: AuthRequest, res: Response): Promise<void> {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Passwort-Reset anfordern (Email + Token per Mail).
|
||||
* Immer 200 OK zurückgeben um Email-Existenz nicht preiszugeben (User-Enumeration-Schutz).
|
||||
*/
|
||||
export async function requestPasswordReset(req: Request, res: Response): Promise<void> {
|
||||
try {
|
||||
const { email, userType } = req.body; // userType: 'admin' | 'portal'
|
||||
|
||||
if (!email) {
|
||||
res.status(400).json({ success: false, error: 'E-Mail erforderlich' } as ApiResponse);
|
||||
return;
|
||||
}
|
||||
|
||||
await authService.requestPasswordReset(email, userType === 'portal' ? 'portal' : 'admin');
|
||||
|
||||
// IMMER success senden, damit Angreifer nicht herausfinden kann welche Emails existieren
|
||||
res.json({
|
||||
success: true,
|
||||
message: 'Wenn ein Konto mit dieser E-Mail existiert, wurde ein Link zum Zurücksetzen gesendet.',
|
||||
} as ApiResponse);
|
||||
} catch (error) {
|
||||
console.error('Password reset request error:', error);
|
||||
// Auch bei Fehlern dieselbe Antwort
|
||||
res.json({
|
||||
success: true,
|
||||
message: 'Wenn ein Konto mit dieser E-Mail existiert, wurde ein Link zum Zurücksetzen gesendet.',
|
||||
} as ApiResponse);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Passwort-Reset bestätigen (Token + neues Passwort).
|
||||
*/
|
||||
export async function confirmPasswordReset(req: Request, res: Response): Promise<void> {
|
||||
try {
|
||||
const { token, password } = req.body;
|
||||
|
||||
if (!token || !password) {
|
||||
res.status(400).json({
|
||||
success: false,
|
||||
error: 'Token und neues Passwort erforderlich',
|
||||
} as ApiResponse);
|
||||
return;
|
||||
}
|
||||
|
||||
if (password.length < 6) {
|
||||
res.status(400).json({
|
||||
success: false,
|
||||
error: 'Das Passwort muss mindestens 6 Zeichen lang sein',
|
||||
} as ApiResponse);
|
||||
return;
|
||||
}
|
||||
|
||||
await authService.confirmPasswordReset(token, password);
|
||||
|
||||
res.json({
|
||||
success: true,
|
||||
message: 'Passwort erfolgreich zurückgesetzt. Du kannst dich jetzt einloggen.',
|
||||
} as ApiResponse);
|
||||
} catch (error) {
|
||||
res.status(400).json({
|
||||
success: false,
|
||||
error: error instanceof Error ? error.message : 'Passwort-Reset fehlgeschlagen',
|
||||
} as ApiResponse);
|
||||
}
|
||||
}
|
||||
|
||||
export async function register(req: Request, res: Response): Promise<void> {
|
||||
try {
|
||||
const { email, password, firstName, lastName, roleIds } = req.body;
|
||||
|
||||
@@ -33,6 +33,7 @@ import emailLogRoutes from './routes/emailLog.routes.js';
|
||||
import pdfTemplateRoutes from './routes/pdfTemplate.routes.js';
|
||||
import birthdayRoutes from './routes/birthday.routes.js';
|
||||
import factoryDefaultsRoutes from './routes/factoryDefaults.routes.js';
|
||||
import { startBirthdayScheduler } from './services/birthdayScheduler.service.js';
|
||||
import { auditContextMiddleware } from './middleware/auditContext.js';
|
||||
import { auditMiddleware } from './middleware/audit.js';
|
||||
|
||||
@@ -116,4 +117,6 @@ app.use((err: Error, req: express.Request, res: express.Response, next: express.
|
||||
|
||||
app.listen(PORT, () => {
|
||||
console.log(`Server läuft auf Port ${PORT}`);
|
||||
// Hintergrund-Scheduler (Geburtstagsgrüße etc.) starten
|
||||
startBirthdayScheduler();
|
||||
});
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
/**
|
||||
* Rate-Limiting-Middleware für sensible Endpoints (Login, Passwort-Reset).
|
||||
* Schützt gegen Brute-Force- und Credential-Stuffing-Angriffe.
|
||||
*/
|
||||
import rateLimit from 'express-rate-limit';
|
||||
|
||||
/**
|
||||
* Login: 10 Versuche pro 15 Minuten pro IP.
|
||||
* Nach Überschreitung: 15 Min Sperre für diese IP.
|
||||
*/
|
||||
export const loginRateLimiter = rateLimit({
|
||||
windowMs: 15 * 60 * 1000, // 15 Minuten
|
||||
limit: 10, // Max. 10 Versuche pro Zeitfenster
|
||||
standardHeaders: 'draft-7',
|
||||
legacyHeaders: false,
|
||||
message: {
|
||||
success: false,
|
||||
error: 'Zu viele Login-Versuche. Bitte in 15 Minuten erneut versuchen.',
|
||||
},
|
||||
// Erfolgreiche Logins zählen nicht gegen das Limit
|
||||
skipSuccessfulRequests: true,
|
||||
});
|
||||
|
||||
/**
|
||||
* Passwort-Reset-Anfrage: 5 Versuche pro Stunde pro IP.
|
||||
* Verhindert Mail-Flut und gezielte Brute-Force über Reset-Links.
|
||||
*/
|
||||
export const passwordResetRateLimiter = rateLimit({
|
||||
windowMs: 60 * 60 * 1000, // 1 Stunde
|
||||
limit: 5,
|
||||
standardHeaders: 'draft-7',
|
||||
legacyHeaders: false,
|
||||
message: {
|
||||
success: false,
|
||||
error: 'Zu viele Passwort-Reset-Anfragen. Bitte in einer Stunde erneut versuchen.',
|
||||
},
|
||||
});
|
||||
@@ -1,12 +1,17 @@
|
||||
import { Router } from 'express';
|
||||
import * as authController from '../controllers/auth.controller.js';
|
||||
import { authenticate, requirePermission } from '../middleware/auth.js';
|
||||
import { loginRateLimiter, passwordResetRateLimiter } from '../middleware/rateLimit.js';
|
||||
|
||||
const router = Router();
|
||||
|
||||
router.post('/login', authController.login);
|
||||
router.post('/customer-login', authController.customerLogin); // Kundenportal-Login
|
||||
router.post('/login', loginRateLimiter, authController.login);
|
||||
router.post('/customer-login', loginRateLimiter, authController.customerLogin);
|
||||
router.get('/me', authenticate, authController.me);
|
||||
router.post('/register', authenticate, requirePermission('users:create'), authController.register);
|
||||
|
||||
// Passwort-Reset-Flow
|
||||
router.post('/password-reset/request', passwordResetRateLimiter, authController.requestPasswordReset);
|
||||
router.post('/password-reset/confirm', passwordResetRateLimiter, authController.confirmPasswordReset);
|
||||
|
||||
export default router;
|
||||
|
||||
@@ -1,8 +1,11 @@
|
||||
import prisma from '../lib/prisma.js';
|
||||
import bcrypt from 'bcryptjs';
|
||||
import jwt from 'jsonwebtoken';
|
||||
import crypto from 'crypto';
|
||||
import { JwtPayload } from '../types/index.js';
|
||||
import { encrypt, decrypt } from '../utils/encryption.js';
|
||||
import { sendEmail, SmtpCredentials } from './smtpService.js';
|
||||
import { getSystemEmailCredentials } from './emailProvider/emailProviderService.js';
|
||||
|
||||
// Mitarbeiter-Login
|
||||
export async function login(email: string, password: string) {
|
||||
@@ -339,3 +342,169 @@ export async function getCustomerPortalUser(customerId: number) {
|
||||
})),
|
||||
};
|
||||
}
|
||||
|
||||
// ==================== PASSWORT-RESET ====================
|
||||
|
||||
const RESET_TOKEN_EXPIRY_HOURS = 2;
|
||||
|
||||
function generateResetToken(): string {
|
||||
return crypto.randomBytes(32).toString('hex');
|
||||
}
|
||||
|
||||
function getPublicUrl(): string {
|
||||
return process.env.PUBLIC_URL || 'http://localhost:5173';
|
||||
}
|
||||
|
||||
/**
|
||||
* Passwort-Reset-Link per Email senden.
|
||||
* Findet User/Customer per Email. Wirft keinen Error wenn nicht gefunden
|
||||
* (Schutz vor User-Enumeration – Caller gibt immer success zurück).
|
||||
*/
|
||||
export async function requestPasswordReset(email: string, userType: 'admin' | 'portal'): Promise<void> {
|
||||
const token = generateResetToken();
|
||||
const expiresAt = new Date(Date.now() + RESET_TOKEN_EXPIRY_HOURS * 60 * 60 * 1000);
|
||||
|
||||
let recipient: { email: string; firstName: string; lastName: string } | null = null;
|
||||
|
||||
if (userType === 'admin') {
|
||||
const user = await prisma.user.findUnique({ where: { email } });
|
||||
if (!user || !user.isActive) return;
|
||||
|
||||
await prisma.user.update({
|
||||
where: { id: user.id },
|
||||
data: {
|
||||
passwordResetToken: token,
|
||||
passwordResetExpiresAt: expiresAt,
|
||||
},
|
||||
});
|
||||
recipient = { email: user.email, firstName: user.firstName, lastName: user.lastName };
|
||||
} else {
|
||||
const customer = await prisma.customer.findUnique({ where: { portalEmail: email } });
|
||||
if (!customer || !customer.portalEnabled) return;
|
||||
|
||||
await prisma.customer.update({
|
||||
where: { id: customer.id },
|
||||
data: {
|
||||
portalPasswordResetToken: token,
|
||||
portalPasswordResetExpiresAt: expiresAt,
|
||||
},
|
||||
});
|
||||
recipient = {
|
||||
email: customer.portalEmail!,
|
||||
firstName: customer.firstName,
|
||||
lastName: customer.lastName,
|
||||
};
|
||||
}
|
||||
|
||||
if (!recipient) return;
|
||||
|
||||
// Reset-Link + Email senden
|
||||
const resetUrl = `${getPublicUrl()}/password-reset?token=${token}&type=${userType}`;
|
||||
const systemEmail = await getSystemEmailCredentials();
|
||||
|
||||
if (!systemEmail) {
|
||||
console.warn(
|
||||
`[passwordReset] Kein System-E-Mail konfiguriert – Reset-Link für ${recipient.email}: ${resetUrl}`,
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
const credentials: SmtpCredentials = {
|
||||
host: systemEmail.smtpServer,
|
||||
port: systemEmail.smtpPort,
|
||||
user: systemEmail.emailAddress,
|
||||
password: systemEmail.password,
|
||||
encryption: systemEmail.smtpEncryption,
|
||||
allowSelfSignedCerts: systemEmail.allowSelfSignedCerts,
|
||||
};
|
||||
|
||||
const html = `
|
||||
<div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
|
||||
<h2 style="color: #1e40af;">Passwort zurücksetzen</h2>
|
||||
<p>Hallo ${recipient.firstName} ${recipient.lastName},</p>
|
||||
<p>
|
||||
Sie haben angefordert, Ihr Passwort zurückzusetzen. Klicken Sie auf den folgenden
|
||||
Button, um ein neues Passwort zu vergeben. Der Link ist ${RESET_TOKEN_EXPIRY_HOURS} Stunden gültig.
|
||||
</p>
|
||||
<p style="text-align: center; margin: 32px 0;">
|
||||
<a href="${resetUrl}" style="background-color: #2563eb; color: #ffffff; padding: 14px 32px; text-decoration: none; border-radius: 8px; font-weight: bold; font-size: 16px; display: inline-block;">
|
||||
Neues Passwort vergeben
|
||||
</a>
|
||||
</p>
|
||||
<p style="color: #6b7280; font-size: 14px;">
|
||||
Alternativ können Sie diesen Link in Ihren Browser kopieren:<br>
|
||||
<a href="${resetUrl}" style="color: #2563eb; word-break: break-all;">${resetUrl}</a>
|
||||
</p>
|
||||
<hr style="border: none; border-top: 1px solid #e5e7eb; margin: 24px 0;">
|
||||
<p style="color: #9ca3af; font-size: 12px;">
|
||||
Haben Sie diesen Reset nicht angefordert? Dann ignorieren Sie diese E-Mail einfach –
|
||||
Ihr Passwort bleibt unverändert.
|
||||
</p>
|
||||
</div>
|
||||
`;
|
||||
|
||||
await sendEmail(
|
||||
credentials,
|
||||
systemEmail.emailAddress,
|
||||
{
|
||||
to: recipient.email,
|
||||
subject: 'Passwort zurücksetzen',
|
||||
html,
|
||||
},
|
||||
{
|
||||
context: 'password-reset',
|
||||
triggeredBy: 'self-service',
|
||||
},
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Passwort-Reset bestätigen: Token prüfen, Passwort setzen, Token löschen.
|
||||
* Invalidiert alle bestehenden JWT-Sessions des Users.
|
||||
*/
|
||||
export async function confirmPasswordReset(token: string, newPassword: string): Promise<void> {
|
||||
// Erst beim User suchen
|
||||
const user = await prisma.user.findUnique({ where: { passwordResetToken: token } });
|
||||
|
||||
if (user) {
|
||||
if (!user.passwordResetExpiresAt || user.passwordResetExpiresAt < new Date()) {
|
||||
throw new Error('Der Link ist abgelaufen. Bitte fordere einen neuen an.');
|
||||
}
|
||||
|
||||
const hash = await bcrypt.hash(newPassword, 10);
|
||||
await prisma.user.update({
|
||||
where: { id: user.id },
|
||||
data: {
|
||||
password: hash,
|
||||
passwordResetToken: null,
|
||||
passwordResetExpiresAt: null,
|
||||
// Alle bestehenden Sessions kicken
|
||||
tokenInvalidatedAt: new Date(),
|
||||
},
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
// Sonst beim Customer (Portal)
|
||||
const customer = await prisma.customer.findUnique({ where: { portalPasswordResetToken: token } });
|
||||
|
||||
if (customer) {
|
||||
if (!customer.portalPasswordResetExpiresAt || customer.portalPasswordResetExpiresAt < new Date()) {
|
||||
throw new Error('Der Link ist abgelaufen. Bitte fordere einen neuen an.');
|
||||
}
|
||||
|
||||
const hash = await bcrypt.hash(newPassword, 10);
|
||||
await prisma.customer.update({
|
||||
where: { id: customer.id },
|
||||
data: {
|
||||
portalPasswordHash: hash,
|
||||
portalPasswordEncrypted: encrypt(newPassword),
|
||||
portalPasswordResetToken: null,
|
||||
portalPasswordResetExpiresAt: null,
|
||||
},
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
throw new Error('Ungültiger oder bereits verwendeter Link.');
|
||||
}
|
||||
|
||||
@@ -0,0 +1,169 @@
|
||||
/**
|
||||
* Scheduler für automatische Geburtstagsgrüße.
|
||||
*
|
||||
* Läuft täglich um 08:00 Uhr und sendet Grüße an alle Kunden mit:
|
||||
* - Geburtstag = heute
|
||||
* - autoBirthdayGreeting = true
|
||||
* - autoBirthdayChannel ist gesetzt (aktuell nur 'email' automatisiert)
|
||||
* - lastBirthdayGreetingYear != aktuelles Jahr (verhindert Doppel-Versand)
|
||||
*/
|
||||
import cron from 'node-cron';
|
||||
import prisma from '../lib/prisma.js';
|
||||
import { sendEmail, SmtpCredentials } from './smtpService.js';
|
||||
import { getSystemEmailCredentials } from './emailProvider/emailProviderService.js';
|
||||
import * as birthdayService from './birthday.service.js';
|
||||
|
||||
async function runDailyBirthdayGreetings(): Promise<void> {
|
||||
const today = new Date();
|
||||
today.setHours(0, 0, 0, 0);
|
||||
const thisYear = today.getFullYear();
|
||||
const month = today.getMonth() + 1; // Prisma-Raw-SQL ist 1-indexed
|
||||
const day = today.getDate();
|
||||
|
||||
console.log(
|
||||
`[BirthdayScheduler] Suche Kunden mit Geburtstag ${day}.${month}., Auto-Versand aktiv …`,
|
||||
);
|
||||
|
||||
// Kunden mit heutigem Geburtstag + Auto-Versand + dieses Jahr noch nicht gesendet
|
||||
const candidates = await prisma.$queryRaw<
|
||||
Array<{
|
||||
id: number;
|
||||
firstName: string;
|
||||
lastName: string;
|
||||
email: string | null;
|
||||
salutation: string | null;
|
||||
useInformalAddress: boolean;
|
||||
birthDate: Date;
|
||||
autoBirthdayChannel: string | null;
|
||||
}>
|
||||
>`
|
||||
SELECT id, firstName, lastName, email, salutation, useInformalAddress, birthDate, autoBirthdayChannel
|
||||
FROM Customer
|
||||
WHERE autoBirthdayGreeting = 1
|
||||
AND birthDate IS NOT NULL
|
||||
AND MONTH(birthDate) = ${month}
|
||||
AND DAY(birthDate) = ${day}
|
||||
AND (lastBirthdayGreetingYear IS NULL OR lastBirthdayGreetingYear != ${thisYear})
|
||||
`;
|
||||
|
||||
if (candidates.length === 0) {
|
||||
console.log('[BirthdayScheduler] Keine passenden Kunden heute.');
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`[BirthdayScheduler] ${candidates.length} Kunde(n) gefunden – sende Grüße.`);
|
||||
|
||||
// System-E-Mail-Credentials einmal laden
|
||||
const systemEmail = await getSystemEmailCredentials();
|
||||
if (!systemEmail) {
|
||||
console.error(
|
||||
'[BirthdayScheduler] Keine System-E-Mail konfiguriert – kann keine Grüße versenden.',
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
const smtpCreds: SmtpCredentials = {
|
||||
host: systemEmail.smtpServer,
|
||||
port: systemEmail.smtpPort,
|
||||
user: systemEmail.emailAddress,
|
||||
password: systemEmail.password,
|
||||
encryption: systemEmail.smtpEncryption,
|
||||
allowSelfSignedCerts: systemEmail.allowSelfSignedCerts,
|
||||
};
|
||||
|
||||
let sent = 0;
|
||||
let skipped = 0;
|
||||
|
||||
for (const c of candidates) {
|
||||
const channel = c.autoBirthdayChannel || 'email';
|
||||
|
||||
// Aktuell nur Email automatisch – Messenger brauchen Browser-Klick
|
||||
if (channel !== 'email') {
|
||||
console.log(
|
||||
`[BirthdayScheduler] Kunde #${c.id} (${c.firstName} ${c.lastName}): Kanal "${channel}" nicht automatisierbar, übersprungen.`,
|
||||
);
|
||||
skipped++;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (!c.email) {
|
||||
console.log(
|
||||
`[BirthdayScheduler] Kunde #${c.id} (${c.firstName} ${c.lastName}): keine E-Mail hinterlegt, übersprungen.`,
|
||||
);
|
||||
skipped++;
|
||||
continue;
|
||||
}
|
||||
|
||||
const age = thisYear - new Date(c.birthDate).getFullYear();
|
||||
const { subject, html } = birthdayService.buildBirthdayGreetingText(
|
||||
{
|
||||
firstName: c.firstName,
|
||||
lastName: c.lastName,
|
||||
salutation: c.salutation,
|
||||
useInformalAddress: c.useInformalAddress,
|
||||
},
|
||||
age,
|
||||
);
|
||||
|
||||
try {
|
||||
const result = await sendEmail(
|
||||
smtpCreds,
|
||||
systemEmail.emailAddress,
|
||||
{ to: c.email, subject, html },
|
||||
{ context: 'birthday-greeting-auto', customerId: c.id, triggeredBy: 'cron' },
|
||||
);
|
||||
|
||||
if (result.success) {
|
||||
// Marker setzen damit nächstes Jahr wieder läuft, dieses Jahr aber nicht nochmal
|
||||
await prisma.customer.update({
|
||||
where: { id: c.id },
|
||||
data: { lastBirthdayGreetingYear: thisYear },
|
||||
});
|
||||
sent++;
|
||||
console.log(
|
||||
`[BirthdayScheduler] ✓ Kunde #${c.id} (${c.firstName} ${c.lastName}): Gruß gesendet.`,
|
||||
);
|
||||
} else {
|
||||
console.error(
|
||||
`[BirthdayScheduler] ✗ Kunde #${c.id}: Sendfehler: ${result.error}`,
|
||||
);
|
||||
skipped++;
|
||||
}
|
||||
} catch (err) {
|
||||
console.error(`[BirthdayScheduler] ✗ Kunde #${c.id}: Exception:`, err);
|
||||
skipped++;
|
||||
}
|
||||
}
|
||||
|
||||
console.log(
|
||||
`[BirthdayScheduler] Fertig: ${sent} versendet, ${skipped} übersprungen von ${candidates.length} Kandidaten.`,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Scheduler starten. Läuft täglich um 08:00 in lokaler Server-Zeit.
|
||||
* Zusätzlich: ein Test-Lauf 30 Sekunden nach Server-Start, aber nur wenn heute schon jemand Geburtstag hat
|
||||
* (sonst passiert eh nichts). So können wir bei Ausfall am Tag X direkt beim nächsten Boot nachholen.
|
||||
*/
|
||||
export function startBirthdayScheduler(): void {
|
||||
// Täglich um 08:00
|
||||
cron.schedule('0 8 * * *', () => {
|
||||
runDailyBirthdayGreetings().catch((err) =>
|
||||
console.error('[BirthdayScheduler] Daily run failed:', err),
|
||||
);
|
||||
});
|
||||
|
||||
// Einmal 30 Sekunden nach Start (Catch-up bei Ausfall)
|
||||
setTimeout(() => {
|
||||
runDailyBirthdayGreetings().catch((err) =>
|
||||
console.error('[BirthdayScheduler] Catch-up run failed:', err),
|
||||
);
|
||||
}, 30_000);
|
||||
|
||||
console.log('[BirthdayScheduler] Gestartet – täglich um 08:00 + Catch-up nach 30s');
|
||||
}
|
||||
|
||||
/**
|
||||
* Für manuelles Triggern (z.B. aus Debug-Endpoint).
|
||||
*/
|
||||
export { runDailyBirthdayGreetings };
|
||||
@@ -99,6 +99,22 @@ isolierte Instanz (keine Multi-Tenancy im Code), Provisioning + Abrechnung
|
||||
|
||||
## ✅ Erledigt
|
||||
|
||||
- [x] **🎉 Version 1.0.0 Feinschliff: Passwort-Reset + Rate-Limiting + Auto-Geburtstagsgrüße**
|
||||
- **Passwort vergessen-Flow** (Login → "Passwort vergessen?" Link)
|
||||
- Email-Reset-Token mit 2h Gültigkeit (kryptografisch sicher: 32 Byte Random)
|
||||
- Funktioniert für Mitarbeiter UND Portal-Kunden (Typ-Auswahl)
|
||||
- User-Enumeration-Schutz: immer 200 OK, egal ob Email existiert
|
||||
- Reset-Link per Email mit schönem HTML-Template
|
||||
- Nach Reset: alle bestehenden Sessions werden gekickt
|
||||
- **Rate-Limiting** gegen Brute-Force
|
||||
- Login: 10 Versuche pro 15 Min pro IP (erfolgreiche zählen nicht)
|
||||
- Passwort-Reset-Anfrage: 5 Versuche pro Stunde pro IP
|
||||
- **Cron-Job für automatische Geburtstagsgrüße**
|
||||
- Täglich 08:00 Uhr: alle Kunden mit heutigem Geburtstag + autoBirthdayGreeting=true
|
||||
- Email-Versand über System-E-Mail, Du/Sie-abhängiger Text
|
||||
- Catch-up 30s nach Server-Start (falls Server am Geburtstag kurz down war)
|
||||
- Marker lastBirthdayGreetingYear verhindert Doppel-Versand
|
||||
|
||||
- [x] **Mandantenfähigkeit: Domain + Kunden-E-Mail-Label dynamisch pro Provider**
|
||||
- Neues Feld `customerEmailLabel` am EmailProviderConfig (z.B. "Stressfrei-Wechseln", "Meine-Firma")
|
||||
- Wenn leer, wird das Label automatisch aus der Domain abgeleitet ("stressfrei-wechseln.de" → "Stressfrei-Wechseln")
|
||||
|
||||
Reference in New Issue
Block a user