Harden local/prod cookie policy and Mongo connection settings

config/cookiesOptions.js

@@ -1,8 +1,12 @@
+const isProduction = process.env.NODE_ENV === "production";
+const forceSecureCookie = process.env.COOKIE_SECURE === "true";
+const secure = forceSecureCookie || isProduction;
+
 const cookiesOptions = {
-    maxAge: 1000 * 60 * 60 * 24 * 90, // would expire after 30 days
+    maxAge: 1000 * 60 * 60 * 24 * 90, // would expire after 90 days
     httpOnly: true, // The cookie only accessible by the web server
-    sameSite: 'none', // This and secure are required for properly 
+    sameSite: secure ? 'none' : 'lax',
-    secure: true,     // manage cockies in cros-domain
+    secure,
 };
 
 module.exports = { cookiesOptions };

config/corsOptions.js

@@ -1,6 +1,10 @@
 var corsOptions = {
     origin: [
         'http://localhost:8080', 
+        'http://localhost:8081',
+        'http://127.0.0.1:3000',
+        'http://127.0.0.1:8080',
+        'http://127.0.0.1:8081',
         'http://localhost:3000', 
         "https://social.emmint.com",  
         "https://fellowship.emmint.com",

dbTools/profile.js

@@ -96,16 +96,18 @@ userDB = (DB) => {
     DB.getFriendsFriends = async (profileId, limit = 10) => {
         const profile = await DB.getProfile(profileId);
         if (!profile) return [];
-        let ids = profile.following.map((id) => DB.ObjectID(id));
+        const following = Array.isArray(profile.following) ? profile.following : [];
+        let ids = following.filter((id) => DB.ObjectID.isValid(id)).map((id) => DB.ObjectID(id));
         let alreadyFollowingMap = {};
         alreadyFollowingMap[profileId] = 1; //skip that profile
-        profile.following.forEach(id => {
+        following.forEach(id => {
             if (!alreadyFollowingMap[id]) alreadyFollowingMap[id] = 1;
         })
         return DB.profileCols.find({ _id: { $in: ids } }).project({ following: 1 }).limit(limit).toArray().then(profiles => {
             let friendsOfFriendsMap = {};
             profiles.forEach(p => {
-                p.following.forEach(followingId => {
+                const related = Array.isArray(p.following) ? p.following : [];
+                related.forEach(followingId => {
                     if (alreadyFollowingMap[followingId]) return 0;
                     if (!friendsOfFriendsMap[followingId]) friendsOfFriendsMap[followingId] = 0;
                     friendsOfFriendsMap[followingId] = friendsOfFriendsMap[followingId] + 1;
@@ -312,9 +314,10 @@ userDB = (DB) => {
     DB.getFollowingGroups = async (profileid) => {
         const profile = await DB.getProfile(profileid);
         let ids = [];
-        for (id in profile.following) {
+        const following = Array.isArray(profile?.following) ? profile.following : [];
+        for (id in following) {
             try {
-                let oId = DB.ObjectID(profile.following[id]);
+                let oId = DB.ObjectID(following[id]);
                 let checkProfile = await DB.getProfileCache(oId)
                 if (checkProfile && checkProfile.isGroup && !checkProfile.isChat) {
                     ids.push(oId)

middleware/sessionChecker.js

@@ -2,19 +2,30 @@ const { getSessionId, getUserId, getProfileId } = require('../utils/sessionUtils
 const { client_logger } = require('../utils/analyticsLogger');
 const { cookiesOptions } = require('../config/cookiesOptions');
 const MongoDB = require("../mongoDB.js");
+const { ObjectId } = require("mongodb");
 
 const sessionChecker = async (req, res, next) => {
-    const session_id = getSessionId(req);
+    try {
-    const user_sid = getUserId(req);
+        const session_id = getSessionId(req);
-    let profile_id = getProfileId(req);
+        const user_sid = getUserId(req);
+        let profile_id = getProfileId(req);
 
-    if (session_id && user_sid) {
+        if (!session_id || !user_sid) {
-        DB = await MongoDB.getDB;
+            return res.redirect('/login');
+        }
+        if (!ObjectId.isValid(session_id) || !ObjectId.isValid(user_sid)) {
+            return res.redirect('/login');
+        }
+
+        const DB = await MongoDB.getDB;
         const userInfo = await DB.checkSessionOnDB(session_id, user_sid);
         req.userInfo = userInfo;
 
         if (!await DB.getProfileCache(profile_id)) {
             const latestProfile = await DB.latestProfile(user_sid);
+            if (!latestProfile || !latestProfile._id) {
+                return res.redirect('/login');
+            }
             res.cookie('profile_id', latestProfile._id, cookiesOptions);
             profile_id = latestProfile._id;
         }
@@ -23,14 +34,14 @@ const sessionChecker = async (req, res, next) => {
 
         if (!userInfo) return res.redirect('/login');
 
-        // Log Request
         client_logger.capture({
             distinctId: user_sid,
             event: 'server@' + req.method + '@' + req.originalUrl,
         });
 
         next();
-    } else {
+    } catch (error) {
+        console.error("Session checker error", error);
         return res.redirect('/login');
     }
 };

mongoDB.js

@@ -11,16 +11,33 @@ const paymentDB = require("./dbTools/payments.js");
 const songsDB = require("./dbTools/songs.js");
 
 console.log("Connecting to MongoDB...");
+const nodeMajorVersion = parseInt((process.versions.node || "0").split(".")[0], 10);
+if (nodeMajorVersion >= 22) {
+    console.warn("Warning: mongodb@3.x is not fully tested on Node.js 22+. Prefer Node.js 20 LTS for local stability.");
+}
+
+const mongoConnectOptions = {
+    useNewUrlParser: true,
+    useUnifiedTopology: true,
+    serverSelectionTimeoutMS: 10000,
+    connectTimeoutMS: 10000,
+    socketTimeoutMS: 45000,
+    keepAlive: true,
+};
 
 const getDB = new Promise((resolve, reject) => {
     const DB = {ObjectID: mongo.ObjectID};
-    MongoClient.connect(mongoUrl, function(err, db) {
+    MongoClient.connect(mongoUrl, mongoConnectOptions, function(err, db) {
         if (err) return reject(err);
     
         console.log("Connected to DB!");
         DB.db = db;
         DB.ObjectID = ObjectID;
 
+        DB.db.on("close", () => console.error("MongoDB connection closed"));
+        DB.db.on("reconnect", () => console.log("MongoDB reconnected"));
+        DB.db.on("error", (error) => console.error("MongoDB connection error", error));
+        
         DB.usersCol = db.db(DBName).collection("users");
         DB.tokensCol = db.db(DBName).collection("tokens");
         DB.invitationCol = db.db(DBName).collection("invitation");
@@ -31,7 +48,7 @@ const getDB = new Promise((resolve, reject) => {
             const doc = await DB.tokensCol.findOne({"_id":temp_id});
             if(doc && doc.uid == user_sid){
                 const userMongoId = new mongo.ObjectID(user_sid);
-                const userInfo = await DB.usersCol.findOne({"_id": userMongoId}, {fields: {password: 0}});
+                const userInfo = await DB.usersCol.findOne({"_id": userMongoId}, {projection: {password: 0}});
                 return userInfo;
             }
             return false;

routes/post.js

@@ -8,7 +8,10 @@ const Notifications = require("./../notifications.js");
 DB.getDB.then((DB) => {
 
     const getProfileId = (req) => {
-        return DB.ObjectID(req.cookies.profile_id || req.query.profile_id || req.body.profile_id);
+        const rawProfileId = req.cookies.profile_id || req.query.profile_id || req.body.profile_id || req.profileInfo?._id;
+        if (!rawProfileId) return null;
+        if (!DB.ObjectID.isValid(rawProfileId)) return null;
+        return DB.ObjectID(rawProfileId);
     };
 
     const postBelongToProfile = (post, profileid) => {
@@ -155,12 +158,17 @@ DB.getDB.then((DB) => {
  *                 $ref: '#/components/schemas/Post'
  */
     router.get("/organic", async (req, res) => {
-        const profileid = getProfileId(req);
+        try {
-        let organicPosts = await DB.getFeed(profileid);
+            const profileid = getProfileId(req);
-        //Add non-organic posts
+            if (!profileid) return res.status(400).json([]);
-        const nonOrganicPosts = await generateNonOrganicPosts(req, profileid);
+            let organicPosts = await DB.getFeed(profileid);
-        const posts = mergePosts(organicPosts, nonOrganicPosts);
+            const nonOrganicPosts = await generateNonOrganicPosts(req, profileid);
-        return res.json(posts);
+            const posts = mergePosts(organicPosts || [], nonOrganicPosts || []);
+            return res.json(posts);
+        } catch (error) {
+            console.error("Error loading organic feed", error);
+            return res.status(500).json([]);
+        }
     });
 
     /**
@@ -182,12 +190,17 @@ DB.getDB.then((DB) => {
  *                 $ref: '#/components/schemas/Post'
  */
     router.get("/", async (req, res) => {
-        const profileid = getProfileId(req);
+        try {
-        //Add non-organic posts
+            const profileid = getProfileId(req);
-        const nonOrganicPosts = await generateNonOrganicPosts(req, profileid);
+            if (!profileid) return res.status(400).json([]);
-        let promotionalPosts = await DB.getPromotionalPosts(profileid);
+            const nonOrganicPosts = await generateNonOrganicPosts(req, profileid);
-        const posts = mergePosts(promotionalPosts, nonOrganicPosts);
+            let promotionalPosts = await DB.getPromotionalPosts(profileid);
-        return res.json(posts);
+            const posts = mergePosts(promotionalPosts || [], nonOrganicPosts || []);
+            return res.json(posts);
+        } catch (error) {
+            console.error("Error loading feed", error);
+            return res.status(500).json([]);
+        }
     });
 
     /**

routes/profile.js

@@ -795,12 +795,24 @@ DB.getDB.then((DB) => {
  *               $ref: '#/components/schemas/Profile'
  */
     router.get("/:id", async (req, res) => {
-        let profileId = req.params.id;
+        try {
-        let profile = await DB.getProfile(profileId);
+            let profileId = req.params.id;
-        return res.json({
+            let profile = await DB.getProfile(profileId);
-            status: "ok",
+            if (!profile || !profile._id) {
-            ...profile
+                return res.status(404).json({
-        });
+                    status: "Profile not found",
+                });
+            }
+            return res.json({
+                status: "ok",
+                ...profile
+            });
+        } catch (error) {
+            console.error("Error loading profile", error);
+            return res.status(500).json({
+                status: "Internal server error"
+            });
+        }
     });
 
     /**