express-useraccounts

A template for Express + EJS application with user accounts.

Screenshots

Screenshots

Notes/Warnings

• Because of how 2FA is implemented, any route that does not require authentication will not be protected by 2FA. (Homepage for example should have no user data on it because you are not fully logged in. Make another route for /app or whatever that requires authentication.)
• Pick and choose which Social Sign In methods you want to use. Don't overwhelm the user by turning all of them on.

Features

• Social Sign In
• Registration (w/ Forced Email Verification)
• Login/Logout
• Forgot Password (Email Reset Link)
• Edit Profile
  • Change Username
  • Change Password
  • Change Email (Email Confirmation to Old Address to Prevent Hijacking)
  • Change Profile Picture
  • Enable/Disable 2FA (Optional for Users, Forced for Admins)
  • Delete Account
  • Request/Revoke API Key(s)
• Admin Panel
  • List of Accounts
    • Change User's Username
    • Reset User's Profile Picture
    • Ban/Unban User (Does not let them login)
    • Force Disable 2FA
    • Delete Account
    • Revoke API Key(s)
    • Detach Social Account (User turns into a Local Account, and must reset their password.)
    • View History of a User's Actions
• Basic Terms of Service and Privacy Policy
• Report Content Form
• API (Swagger)

git clone https://git.chse.dev/chase/express-useraccounts.git
cd express-useraccounts
npm install
cp .env.example .env
# Edit .env to your liking
node .

Social Sign In Setup

Social Sign In Setup

In these guides, baseUrl refers to the entire URL of accessing your website. (Example: https://example.com)

Google

1. Follow the Setting up OAuth 2.0 Google Documentation.
2. When configuring the OAuth consent screen, ensure you have the scopes email, and profile.
3. When configuring the Credentials, for authorized JavaScript origins, put the baseUrl.
4. When configuring the Credentials, for authorized redirect URIs, put the baseUrl/login/google/callback.

Microsoft

1. Follow the Setting up OAuth 2.0 Microsoft Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/microsoft/callback.

GitHub

1. Follow the Setting up OAuth 2.0 GitHub Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/github/callback.

GitLab

1. Follow the Setting up OAuth 2.0 GitLab Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/gitlab/callback.

Bitbucket

1. Follow the Setting up OAuth 2.0 Bitbucket Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/bitbucket/callback.

Facebook

1. Follow the Setting up OAuth 2.0 Facebook Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/facebook/callback.

Twitter

1. Follow the Setting up OAuth 2.0 Twitter Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/twitter/callback.

Twitch

1. Follow the Setting up OAuth 2.0 Twitch Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/twitch/callback.

Steam

1. Get an API Key from Steam.

Spotify

1. Follow the Setting up OAuth 2.0 Spotify Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/spotify/callback.

Last.fm

1. Follow the Setting up OAuth 2.0 Last.fm Documentation.
2. When configuring the Redirect URI, put the baseUrl/login/lastfm/callback.

Staff Roles

Staff Roles

Admin (Staff=2)

• Full Access

Generic Staff (Staff=1)

• Can Access Admin Panel, with restrictions.
• Cannot see Users History.
• Users Emails are redacted.
• Cannot remove 2FA from users using their recovery key.
• Cannot delete accounts.
• Cannot revoke API Keys.
• Cannot change a user's linked Last.fm account.