{"id":17855622,"url":"https://github.com/nebrius/user-management","last_synced_at":"2026-03-07T01:35:45.400Z","repository":{"id":21559554,"uuid":"24879311","full_name":"nebrius/user-management","owner":"nebrius","description":"User authentication and management for Node.js using MongoDB","archived":false,"fork":false,"pushed_at":"2018-01-16T16:47:12.000Z","size":36,"stargazers_count":29,"open_issues_count":0,"forks_count":11,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-09-20T22:37:00.241Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nebrius.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-10-07T06:30:48.000Z","updated_at":"2024-09-30T17:47:31.000Z","dependencies_parsed_at":"2022-08-21T18:21:05.470Z","dependency_job_id":null,"html_url":"https://github.com/nebrius/user-management","commit_stats":null,"previous_names":["bryan-m-hughes/user-management"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/nebrius/user-management","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebrius%2Fuser-management","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebrius%2Fuser-management/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebrius%2Fuser-management/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebrius%2Fuser-management/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nebrius","download_url":"https://codeload.github.com/nebrius/user-management/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nebrius%2Fuser-management/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30205226,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-06T19:07:06.838Z","status":"ssl_error","status_checked_at":"2026-03-06T18:57:34.882Z","response_time":250,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-28T02:23:50.256Z","updated_at":"2026-03-07T01:35:45.375Z","avatar_url":"https://github.com/nebrius.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"User Management\n===============\n\n[![No Maintenance Intended](http://unmaintained.tech/badge.svg)](http://unmaintained.tech/)\n\nA MongoDB-based User Management system with session tokens. Passwords are salted and hashed using PBKDF2.\n\n**Note:** This package is no longer maintained. Feel free to submit a PR and I'll merge it, but I won't be fixing bugs in it.\n\n## Installing\n\nTo install user-management:\n\n```\nnpm install user-management\n```\n\nBefore you can use user-management, you first need to install and configure MongoDB. See the\n[MongoDB Docs](docs.mongodb.org/manual/installation/) for installation instructions for your platform. Once MongoDB is\ninstalled, you will need to create the user-management database.\n\nFirst, start MongoDB:\n\n```\n$ mongod\n```\n\nThen, connect to a mongo shell:\n\n```\n$ mongo\n```\n\nInside the shell, create the database:\n\n```\n\u003e use user_management\n```\n\nUser-management supports configurable database names, so feel free to use your own. Just specify the name in the user-management\nconstructor, as documented in the [API section](#api) below.\n\n## Usage\n\nDon't forget to make sure MongoDB is running before you run your code! Also note that none of these examples include\nerror handling for brevity, but should not be ignored in practice!\n\n### Create a user\n\nHere is some example code for creating a user called ```foo``` with password ```bar```. This is just an example of course,\nin a real application you should never hard code a username or password in code!\n\n```javascript\nvar UserManagement = require('user-management');\n\nvar USERNAME = 'foo';\nvar PASSWORD = 'bar';\nvar EXTRAS = {\n  name: 'Finnius F. Bar'\n};\n\nvar users = new UserManagement();\nusers.load(function(err) {\n  console.log('Checking if the user exists');\n  users.userExists(USERNAME, function(err, exists) {\n    if (exists) {\n      console.log('  User already exists');\n      users.close();\n    } else {\n      console.log('  User does not exist');\n      console.log('Creating the user');\n      users.createUser(USERNAME, PASSWORD, EXTRAS, function (err) {\n        console.log('  User created');\n        users.close();\n      });\n    }\n  });\n});\n```\n\nBefore the user can be created, the user management library must be loaded. The ```load``` method connects to MongoDB and\nloads the user management database. Once the database is loaded, you should check if a user exists or not using the ```userExists```\nmethod. The ```createUser``` method does _not_ check if the user exists before attempting to create it.\n\n### Authenticate a user\n\nAuthenticating a user validates the supplied username and password against the database. If authentication is successful,\na token is generated for the user. Tokens have an expiration of 1 week by default, but this can be modified with the\n```tokenExpiration``` property passed to the User Management constructor.\n\n```javascript\nvar UserManagement = require('user-management');\n\nvar USERNAME = 'foo';\nvar PASSWORD = 'bar';\n\nvar users = new UserManagement();\nusers.load(function(err) {\n  users.authenticateUser(USERNAME, PASSWORD, function(err, result) {\n    if (!result.userExists) {\n      console.log('Invalid username');\n    } else if (!result.passwordsMatch) {\n      console.log('Invalid password');\n    } else {\n      console.log('User token is: '+ result.token);\n    }\n    users.close();\n  });\n});\n\n```\n\nThe ```authenticateUser``` method checks first if the user exists and then if the password is valid, returning the results\nof both checks. In the case of a failure, you should _not_ report if it was the username or password that failed to the user.\nDoing so is considered a security risk. However, you may want to consider logging this information for your own purposes.\nThis can also be used to implement a user lock out scheme if there are enough failed attempts.\n\n### Working with tokens\n\nIn typical web applications, once a user has authenticated, all operations are performed using tokens. You can convert\nbetween tokens and usernames, usernames and tokens, and easily check if a token is valid.\n\n```javascript\nvar UserManagement = require('user-management');\n\nvar USERNAME = 'foo';\n\nvar users = new UserManagement();\nusers.load(function(err) {\n  users.getTokenForUsername(USERNAME, function(err, token) {\n    console.log('The user\\'s token is: ' + token);\n    users.getUsernameForToken(token, function(err, username) {\n      console.log('The username for the token is: ' + username);\n    });\n    users.isTokenValid(token, function(err, valid) {\n      if (!valid) {\n        console.log('The token is not valid');\n      } else {\n        console.log('The token is valid');\n      }\n      users.close();\n    });\n  });\n});\n```\n\nNote that the ```isTokenValid``` method checks both that the token is an actual token that was issued and that it has not\nexpired.\n\n### Working with extras\n\nYou can store any form of JSON-serializable data with users by making use of the extras field in user creation, and using\nthe ```getExtrasForToken```, ```getExtrasForUsername```, ```setExtrasForToken```, and ```setExtrasForUsername``` methods.\n\n```javascript\nvar UserManagement = require('user-management');\n\nvar USERNAME = 'foo';\n\nvar users = new UserManagement();\nusers.load(function(err) {\n  users.getExtrasForUsername(USERNAME, function(err, extras) {\n    console.log('Name: ' + extras.name);\n  });\n  users.getTokenForUsername(USERNAME, function(err, token) {\n    users.setExtrasForToken(token, { address: '123 Fake St.' }, function(err) {\n      console.log('Updated the address');\n      users.getExtrasForToken(token, function(err, extras) {\n        console.log('The address is: ' + extras.address);\n        users.close();\n      });\n    });\n  });\n});\n```\n\nThe ```getExtrasForUsername``` and ```setExtrasForUsername``` methods should be used with care. They should _never_ be\naccessible by an ordinary user. These methods exist specifically to allow an administrator to be able to manage other\nusers. Allowing anyone other than an admin to access these methods, even indirectly, could lead to a security vulnerability\nwhere users can modify other users settings.\n\n### Changing passwords\n\nOnce a user has been created, there are two ways to set a new password: changing a password and resetting a password.\nThese APIs are designed such that only a user can choose a specific password. Changing a password allows you to set\nany password desired, but you must provide the old password and a valid token for it to work.\n\n```javascript```\nvar UserManagement = require('user-management');\n\nvar USERNAME = 'foo';\nvar OLD_PASSWORD = 'bar';\nvar NEW_PASSWORD = 'baz';\n\nvar users = new UserManagement();\nusers.load(function(err) {\n  users.getTokenForUsername(USERNAME, function(err, token) {\n    users.changePassword(token, OLD_PASSWORD, NEW_PASSWORD, function(err) {\n      users.isTokenValid(token, function(err, valid) {\n        if (!valid) {\n          console.log('The token is not valid, as expected');\n        } else {\n          console.log('The token is valid, but should not be');\n        }\n        users.authenticateUser(USERNAME, NEW_PASSWORD, function(err, result) {\n          if (!result.userExists) {\n            console.log('Invalid username');\n          } else if (!result.passwordsMatch) {\n            console.log('Invalid password');\n          } else {\n            console.log('User token is: ' + result.token);\n          }\n          users.close();\n        });\n      });\n    });\n  });\n});\n```\n\n### Resetting passwords\n\nIn the case that a user has forgotten their password, you can reset the password which will generate a random password\nonly. This should be used as a temporary password only.\n\n```javascript\nvar UserManagement = require('../');\n\nvar USERNAME = 'foo';\n\nvar users = new UserManagement();\nusers.load(function(err) {\n  users.resetPassword(USERNAME, function(err, newPassword) {\n    console.log('User\\'s password reset to: ' + newPassword);\n    users.authenticateUser(USERNAME, newPassword, function(err, result) {\n      if (!result.userExists) {\n        console.log('Invalid username');\n      } else if (!result.passwordsMatch) {\n        console.log('Invalid password');\n      } else {\n        console.log('User token is: ' + result.token);\n      }\n      users.close();\n    });\n  });\n});\n```\n\n## API\n\n### new _constructor_(options)\n\nCreates a new instance of user-management with the given options (optional). Options is a dictionary with the following\npossible keys:\n- hostname (string): The MongoDB server hostname. Default: 'localhost'\n- port (integer): The MongoDB server port. Default: 27017\n- database (string): The MongoDB database. Default: 'user_management'\n- tokenExpiration (number): The amount of time, in hours, that a token is valid for. Default is 168 (a week).\n\n### _instance_.load(cb(err: string|null))\n\nConnects to the database and loads the user management information. Callback takes a single argument, err.\n\n### _instance_.close(cb(err: string|null))\n\nCloses the connection to the database. Callback takes a single argument, err. If you do not call this method, the node\nprocess will not terminate on it's own without calling ```process.exit()```.\n\n### _instance_.getUserList(cb(err: string|null, userList:array|undefined))\n\nGets the list of usernames. If an error occurs, userList is undefined, otherwise an array of usernames\n\n### _instance_.userExists(username, cb(err: string|null, exists:boolean|undefined))\n\nChecks to see if a user exists. If an error occurs, exists is undefined, otherwise it is a boolean.\n\n### _instance_.createUser(username, password, extras, cb(err: string|null))\n\nCreates a new user with the supplied username, password, and extras. If the username is already taken, an error is returned.\nIt is recommended that you call ```userExists``` before calling ```createUser``` to more appropriately handle the case where\nthe username is already taken\n\n### _instance_.removeUser(username, cb(err: string|null))\n\nRemoves a user. This operation _cannot_ be undone. Any tokens and extras are also deleted.\n\n### _instance_.authenticateUser(username, password, cb(err: string|null, results: object|undefined))\n\nAuthenticates a user. The results are undefined if an error occured, otherwise an object with the following properties:\n- userExists (boolean): Whether or not the user exists\n- passwordsMatch (boolean): Whether or not the password is valid\n- token (string|null): The user's token, if userExists and passwordsMatch is true, otherwise undefined. \n\n### _instance_.expireToken(token, cb(err: string|null))\n\nExpires a given token. If the token is unknown, no error is returned. Use this method to logout a user.\n\n### _instance_.isTokenValid(token, cb(err: string|null, valid: boolean|undefined))\n\nChecks if a given token is valid. If an error occurred, then valid is undefined, otherwise it's a boolean indicated the\nvalidity of the token.\n\n### _instance_.getUsernameForToken(token, cb(err: string|null, username: string|undefined))\n\nConverts a token to a username. Username is undefined if an error occurred or the token is invalid.\n\n### _instance_.getTokenForUsername(username, cb(err: string|null))\n\nConverts a username to a token. Token is undefined if an error occurred or the username is invalid.\n\n### _instance_.getExtrasForUsername(username, cb(err: string|null, extras: any|undefined))\n\nGets the extras for the given username. Extras is undefined if an error occurred. This method should only be accessible\nby administrators for security reasons.\n\n### _instance_.getExtrasForToken(token, cb(err: string|null))\n\nGets the extras for the given token. Extras is undefined if an error occurred.\n\n### _instance_.setExtrasForUsername(username, extras, cb(err: string|null))\n\nSets the extras for the given username. This method should only be accessible by administrators for security reasons.\n\n### _instance_.setExtrasForToken(token, extras, cb(err: string|null))\n\nSets the extras for the given token.\n\n### _instance_.changePassword(token, oldPassword, newPassword, cb(err: string|null))\n\nChanges the password for a given user. Use this method if you want to provide a way for user's to change their password.\n\n### _instance_.resetPassword(username, cb(err: string|null))\n\nResets the password for a given user to a random password. Only use this method as part of a \"forgot your password?\" flow.\n\nLicense\n=======\n\nThe MIT License (MIT)\n\nCopyright (c) 2014 Bryan Hughes bryan@theoreticalideations.com (https://theoreticalideations.com)\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnebrius%2Fuser-management","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnebrius%2Fuser-management","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnebrius%2Fuser-management/lists"}