Fix FLOWISE-319 Sanitize User (#6269)

* fix(account): flowise-319 sanitize user

* Update packages/server/src/enterprise/services/account.service.ts

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

packages/server/src/enterprise/controllers/account.controller.ts

@@ -31,16 +31,6 @@ export class AccountController {
         }
     }
 
-    public async login(req: Request, res: Response, next: NextFunction) {
-        try {
-            const accountService = new AccountService()
-            const data = await accountService.login(req.body)
-            return res.status(StatusCodes.CREATED).json(data)
-        } catch (error) {
-            next(error)
-        }
-    }
-
     public async verify(req: Request, res: Response, next: NextFunction) {
         try {
             const accountService = new AccountService()

packages/server/src/enterprise/middleware/passport/index.ts

@@ -6,6 +6,7 @@ import { StatusCodes } from 'http-status-codes'
 import jwt, { JwtPayload, sign } from 'jsonwebtoken'
 import passport from 'passport'
 import { VerifiedCallback } from 'passport-jwt'
+import { v4 as uuidv4 } from 'uuid'
 import { InternalFlowiseError } from '../../../errors/internalFlowiseError'
 import { IdentityManager } from '../../../IdentityManager'
 import { Platform } from '../../../Interface'
@@ -29,7 +30,6 @@ import {
 import { decryptToken, encryptToken, generateSafeCopy } from '../../utils/tempTokenUtils'
 import { getAuthStrategy } from './AuthStrategy'
 import { initializeDBClientAndStore, initializeRedisClientAndStore } from './SessionPersistance'
-import { v4 as uuidv4 } from 'uuid'
 
 const localStrategy = require('passport-local').Strategy
 
@@ -173,8 +173,8 @@ export const initializeJwtCookieMiddleware = async (app: express.Application, id
 
                     const loggedInUser: LoggedInUser = {
                         id: workspaceUser.userId,
-                        email: response.user.email,
-                        name: response.user?.name,
+                        email: response.user.email!,
+                        name: response.user.name ?? response.user.email!,
                         roleId: workspaceUser.roleId,
                         activeOrganizationId: organization.id,
                         activeOrganizationSubscriptionId: subscriptionId,

packages/server/src/enterprise/routes/account.route.ts

@@ -16,8 +16,6 @@ router.post(
     accountController.invite
 )
 
-router.post('/login', accountController.login)
-
 router.post('/logout', accountController.logout)
 
 router.post('/verify', accountController.verify)

packages/server/src/enterprise/services/account.service.ts

@@ -1,7 +1,7 @@
 import bcrypt from 'bcryptjs'
 import { removeFolderFromStorage } from 'flowise-components'
-import jwt, { JwtPayload } from 'jsonwebtoken'
 import { StatusCodes } from 'http-status-codes'
+import jwt, { JwtPayload } from 'jsonwebtoken'
 import moment from 'moment'
 import { DataSource, In, QueryRunner } from 'typeorm'
 import { ApiKey } from '../../database/entities/ApiKey'
@@ -30,6 +30,7 @@ import { GeneralErrorMessage } from '../../utils/constants'
 import { getRunningExpressApp } from '../../utils/getRunningExpressApp'
 import logger from '../../utils/logger'
 import { checkUsageLimit } from '../../utils/quotaUsage'
+import { sanitizeUser } from '../../utils/sanitize.util'
 import { emitEvent, TelemetryEventCategory, TelemetryEventResult } from '../../utils/telemetry'
 import { WorkspaceShared } from '../database/entities/EnterpriseEntities'
 import { OrganizationUser, OrganizationUserStatus } from '../database/entities/organization-user.entity'
@@ -41,8 +42,8 @@ import { Workspace, WorkspaceName } from '../database/entities/workspace.entity'
 import { LoggedInUser, LoginActivityCode } from '../Interface.Enterprise'
 import { destroyAllSessionsForUser } from '../middleware/passport/SessionPersistance'
 import { getJWTAuthTokenSecret } from '../utils/authSecrets'
-import { compareHash, getHash, getPasswordSaltRounds, hashNeedsUpgrade } from '../utils/encryption.util'
 import { EMAIL_CHANGE_JWT_TYP, isEmailChangeJwtShape, signEmailChangeJwt, verifyEmailChangeJwt } from '../utils/emailChangeJwt.util'
+import { compareHash, getHash, getPasswordSaltRounds, hashNeedsUpgrade } from '../utils/encryption.util'
 import {
     isSmtpConfigured,
     sendEmailChangeConfirmationEmail,
@@ -58,7 +59,6 @@ import auditService from './audit'
 import { OrganizationUserErrorMessage, OrganizationUserService } from './organization-user.service'
 import { OrganizationErrorMessage, OrganizationService } from './organization.service'
 import { RoleErrorMessage, RoleService } from './role.service'
-import { sanitizeUser } from '../../utils/sanitize.util'
 import { UserErrorMessage, UserService } from './user.service'
 import { WorkspaceUserErrorMessage, WorkspaceUserService } from './workspace-user.service'
 import { WorkspaceErrorMessage, WorkspaceService } from './workspace.service'
@@ -409,9 +409,7 @@ export class AccountService {
                 data.workspaceUser = await this.workspaceUserService.saveWorkspaceUser(data.workspaceUser, queryRunner)
                 data.role = await this.roleService.saveRole(data.role, queryRunner)
                 await queryRunner.commitTransaction()
-                delete data.user.credential
-                delete data.user.tempToken
-                delete data.user.tokenExpiry
+                data.user = sanitizeUser(data.user)
 
                 return data
             }
@@ -522,6 +520,7 @@ export class AccountService {
             data.role = await this.roleService.saveRole(data.role, queryRunner)
             await queryRunner.commitTransaction()
 
+            data.user = sanitizeUser(data.user)
             return data
         } catch (error) {
             if (queryRunner && queryRunner.isTransactionActive) await queryRunner.rollbackTransaction()
@@ -586,7 +585,9 @@ export class AccountService {
             if (platform === Platform.ENTERPRISE) {
                 await auditService.recordLoginActivity(user.email, LoginActivityCode.LOGIN_SUCCESS, 'Login Success')
             }
-            return { user, workspaceDetails: wsUserOrUsers }
+
+            const sanitizedUser = sanitizeUser(user)
+            return { user: sanitizedUser, workspaceDetails: wsUserOrUsers }
         } finally {
             await queryRunner.release()
         }
@@ -614,7 +615,7 @@ export class AccountService {
         } finally {
             await queryRunner.release()
         }
-
+        data.user = sanitizeUser(data.user)
         return data
     }