5 files changed, 209 insertions, 0 deletions

diff --git a/api/api.go b/api/api.go
index 79a13a5..e011811 100644
--- a/api/api.go
+++ b/api/api.go
@@ -8,8 +8,18 @@ import (
 )
 
 var CONFIG Config
+var MAIL_CONFIG MailConfig
+
+type MailConfig struct {
+        IsEnabled   bool
+        SmtpAddress string `toml:"smtp_address"`
+        AddressFrom string `toml:"address_from"`
+        Login       string `toml:"login"`
+        Password    string `toml:"password"`
+}
 
 type Config struct {
+        Domain              string `toml:"domain"`
         JwtSecret           string `toml:"jwt_secret"`
         PasswordResetSecret string `toml:"password_reset_secret"`
         FreeSMSUser         string `toml:"free_sms_user"`
@@ -23,6 +33,15 @@ func SetConfig(config Config) {
         PASSWORD_RESET_SECRET = []byte(config.PasswordResetSecret)
 }
 
+func SetMailConfig(config MailConfig) {
+        MAIL_CONFIG = config
+
+        if config.Login != "" && config.AddressFrom != "" && config.Password != "" && config.SmtpAddress != "" {
+                MAIL_CONFIG.IsEnabled = true
+                ConfigureMailTemplateEngine()
+        }
+}
+
 type Error struct {
         Code        ErrorCode
         UserMessage string
diff --git a/api/mail.go b/api/mail.go
new file mode 100644
index 0000000..e0f6ccb
--- /dev/null
+++ b/api/mail.go
@@ -0,0 +1,103 @@
+package api
+
+import (
+        "fmt"
+        "strings"
+
+        "github.com/matcornic/hermes"
+        "gopkg.in/gomail.v2"
+)
+
+var MailTemplateEngine hermes.Hermes
+
+func ConfigureMailTemplateEngine() {
+        var link string
+        if strings.Contains(CONFIG.Domain, "localhost") {
+                link = fmt.Sprintf("http://%s", CONFIG.Domain)
+        } else {
+                link = fmt.Sprintf("https://%s", CONFIG.Domain)
+        }
+
+        MailTemplateEngine = hermes.Hermes{
+                Product: hermes.Product{
+                        Name:      "CryptoPF",
+                        Link:      link,
+                        Copyright: "Copyright © 2017 CryptoPF. All rights reserved.",
+                },
+        }
+}
+
+func SendResetPasswordMail(to, token string) error {
+        mail := hermes.Email{
+                Body: hermes.Body{
+                        Name: to,
+                        Intros: []string{
+                                "You have received this email because a password reset request for your CryptoPF account was received.",
+                        },
+                        Actions: []hermes.Action{
+                                {
+                                        Instructions: "Click the button below to reset your password:",
+                                        Button: hermes.Button{
+                                                Color: "#DC4D2F",
+                                                Text:  "Reset your password",
+                                                Link:  fmt.Sprintf("%s/change-password?token=%s", MailTemplateEngine.Product.Link, token),
+                                        },
+                                },
+                        },
+                        Outros: []string{
+                                "If you did not request a password reset, no further action is required on your part.",
+                        },
+                        Signature: "Thanks",
+                },
+        }
+
+        body, err := MailTemplateEngine.GenerateHTML(mail)
+        if err != nil {
+                return err
+        }
+
+        return SendEmail(to, "Password reset", body)
+}
+
+func SendConfirmationMail(to, token string) error {
+        mail := hermes.Email{
+                Body: hermes.Body{
+                        Name: to,
+                        Intros: []string{
+                                "Welcome to CryptoPF! We're very excited to have you on board.",
+                        },
+                        Actions: []hermes.Action{
+                                {
+                                        Instructions: "To get started with CryptoPF, please click here:",
+                                        Button: hermes.Button{
+                                                Text: "Confirm your account",
+                                                Link: fmt.Sprintf("%s/confirm?token=%s", MailTemplateEngine.Product.Link, token),
+                                        },
+                                },
+                        },
+                        Outros: []string{
+                                "Need help, or have questions? Just reply to this email, we'd love to help.",
+                        },
+                        Signature: "Thanks",
+                },
+        }
+
+        body, err := MailTemplateEngine.GenerateHTML(mail)
+        if err != nil {
+                return err
+        }
+
+        return SendEmail(to, "Confirm your email", body)
+}
+
+func SendEmail(to, subject, body string) error {
+        m := gomail.NewMessage()
+        m.SetAddressHeader("From", MAIL_CONFIG.AddressFrom, "CryptoPF")
+        m.SetAddressHeader("To", to, to)
+        m.SetHeader("Subject", subject)
+        m.SetBody("text/html", body)
+
+        d := gomail.NewPlainDialer(MAIL_CONFIG.SmtpAddress, 587, MAIL_CONFIG.Login, MAIL_CONFIG.Password)
+
+        return d.DialAndSend(m)
+}
diff --git a/api/password_reset.go b/api/password_reset.go
index 4b002cd..c7931d4 100644
--- a/api/password_reset.go
+++ b/api/password_reset.go
@@ -42,6 +42,13 @@ func (q PasswordResetQuery) Run() (interface{}, *Error) {
                 }
         }
 
+        if MAIL_CONFIG.IsEnabled {
+                err = SendResetPasswordMail(q.In.Email, token)
+                if err != nil {
+                        return nil, NewInternalError(err)
+                }
+        }
+
         return nil, nil
 }
 
diff --git a/api/routes.go b/api/routes.go
index d7b316d..d0e8cec 100644
--- a/api/routes.go
+++ b/api/routes.go
@@ -27,6 +27,7 @@ var Groups = []Group{
                         {"POST", []gin.HandlerFunc{Signin}, "/signin"},
                         {"POST", []gin.HandlerFunc{PasswordReset}, "/passwordreset"},
                         {"POST", []gin.HandlerFunc{ChangePassword}, "/changepassword"},
+                        {"POST", []gin.HandlerFunc{ConfirmEmail}, "/confirmemail"},
                 },
         },
         {
@@ -160,3 +161,11 @@ func ChangePassword(c *gin.Context) {
 
         RunQuery(query, c)
 }
+
+func ConfirmEmail(c *gin.Context) {
+        query := &ConfirmEmailQuery{}
+
+        query.In.Token = c.PostForm("token")
+
+        RunQuery(query, c)
+}
diff --git a/api/user.go b/api/user.go
index c1d9d6c..2848696 100644
--- a/api/user.go
+++ b/api/user.go
@@ -3,7 +3,10 @@ package api
 import (
         "fmt"
         "regexp"
+        "strconv"
+        "time"
 
+        "github.com/dchest/passwordreset"
         "github.com/gin-gonic/gin"
 
         "immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front/db"
@@ -90,6 +93,21 @@ func (q SignupQuery) Run() (interface{}, *Error) {
                 return nil, NewInternalError(err)
         }
 
+        if MAIL_CONFIG.IsEnabled {
+                mailConfirmationToken := passwordreset.NewToken(q.In.Email, time.Hour*24*1, []byte(strconv.FormatUint(uint64(newUser.Status), 10)), PASSWORD_RESET_SECRET)
+                err = SendConfirmationMail(q.In.Email, mailConfirmationToken)
+                if err != nil {
+                        return nil, NewInternalError(err)
+                }
+        }
+
+        if CONFIG.FreeSMSUser != "" {
+                err := SendSMS(CONFIG.FreeSMSUser, CONFIG.FreeSMSPass, fmt.Sprintf("'%v' request a password reset. Token '/change-password?token=%v'", q.In.Email, token))
+                if err != nil {
+                        return nil, NewInternalError(err)
+                }
+        }
+
         return SignResult{token}, nil
 }
 
@@ -143,3 +161,56 @@ func GetUser(c *gin.Context) db.User {
 
         return user.(db.User)
 }
+
+type ConfirmEmailQuery struct {
+        In struct {
+                Token string
+        }
+}
+
+func (q ConfirmEmailQuery) ValidateParams() *Error {
+
+        if q.In.Token == "" {
+                return &Error{BadRequest, "invalid token", fmt.Errorf("invalid token")}
+        }
+
+        return nil
+}
+
+func (q ConfirmEmailQuery) Run() (interface{}, *Error) {
+        var user *db.User
+
+        email, err := passwordreset.VerifyToken(q.In.Token, func(email string) ([]byte, error) {
+                var err error
+                user, err = db.GetUserByEmail(email)
+                if err != nil {
+                        return nil, err
+                }
+
+                if user == nil {
+                        return nil, fmt.Errorf("'%v' is not registered", email)
+                }
+
+                return []byte(strconv.FormatUint(uint64(user.Status), 10)), nil
+
+        }, PASSWORD_RESET_SECRET)
+
+        if err != nil && (err == passwordreset.ErrExpiredToken) {
+                return nil, &Error{BadRequest, "expired token", fmt.Errorf("expired token")}
+        } else if err != nil && (err == passwordreset.ErrMalformedToken || err == passwordreset.ErrWrongSignature) {
+                return nil, &Error{BadRequest, "wrong token", fmt.Errorf("wrong token")}
+        } else if err != nil {
+                return nil, NewInternalError(err)
+        }
+
+        if user == nil {
+                return nil, &Error{BadRequest, "bad request", fmt.Errorf("no user found for email '%v'", email)}
+        }
+
+        err = db.SetUserStatus(user, db.Confirmed)
+        if err != nil {
+                return nil, NewInternalError(err)
+        }
+
+        return nil, nil
+}