Firefox Monitor arms you with tools to keep your personal information safe. Find out what hackers already know about you and learn how to stay a step ahead of them.
Clone or download
Latest commit 2cfcffd Oct 18, 2018
Permalink
Failed to load latest commit information.
.circleci remove linting from circle; handled by travis Aug 30, 2018
controllers fix report.hbs and breach_alert.hbs data classes Oct 17, 2018
db for #486: use fluent-langneg Oct 11, 2018
loadtests change loadtests to locust Aug 28, 2018
locales/en Review Updates Oct 18, 2018
public Merge pull request #532 from mozilla/add-contribute-json-299 Oct 17, 2018
routes fix #444: check bearer token on /hibp/notify Sep 26, 2018
scripts update breach-stats script Oct 10, 2018
tests update hbs-helpers tests Oct 18, 2018
views Use req.supportedLocales in templates & helpers Oct 18, 2018
.dockerignore Removes version.json from the .dockerignore file. Jun 8, 2018
.env-dist fix #444: check bearer token on /hibp/notify Sep 26, 2018
.eslintignore Credit sources and eslintignore polyfills Sep 25, 2018
.eslintrc.js for #55: review fixes Sep 21, 2018
.gitignore for #172: make npm and Docker use minifcation Sep 21, 2018
.htmllintrc Add attr-bans to .htmllintrc Mar 12, 2018
.npmignore fix #24: add Travis and Coveralls Feb 9, 2018
.stylelintrc footer fixes Jun 10, 2018
.travis.yml upgrade npm on CI so they can audit Aug 30, 2018
CODEOWNERS Add CODEOWNERS and l10n.toml Oct 18, 2018
CONTRIBUTING.md for #299 also add CONTRIBUTING.md Oct 17, 2018
Dockerfile for #172: make npm and Docker use minifcation Sep 21, 2018
LICENSE Add LICENSE file and update package.json license Jun 7, 2018
README.md for #172: make npm and Docker use minifcation Sep 21, 2018
app-constants.js fix #444: check bearer token on /hibp/notify Sep 26, 2018
basket.js last day fix of basket API call Sep 25, 2018
email-utils.js set nodemailer to use handlebars during init Sep 26, 2018
hbs-helpers.js Use req.supportedLocales in templates & helpers Oct 18, 2018
hibp.js start l10n tooling and i18n back-end messages Oct 9, 2018
l10n.toml Add CODEOWNERS and l10n.toml Oct 18, 2018
locale-utils.js move public/locales to locales/ Oct 17, 2018
log.js for #55: MOZLOG_FMT for formatting Sep 21, 2018
middleware.js update breachDataClasses helper test Oct 11, 2018
package-lock.json add intl-pluralrules polyfill for fluent in node Oct 15, 2018
package.json add intl-pluralrules polyfill for fluent in node Oct 15, 2018
server.js ENABLE_PONTOON_JS on "heroku" env Oct 17, 2018
sha1-utils.js Fix a bunch of ESLint errors Apr 18, 2018
tips.js More i20n work Oct 14, 2018
unsubscribe_reasons.js Initial i18n work Oct 11, 2018

README.md

Firefox Monitor Server

Summary

Firefox Monitor notifies users when their credentials have been compromised in a data breach.

This code is for the monitor.firefox.com service & website.

Breach data is powered by haveibeenpwned.com.

See the Have I Been Pwned about page for the "what" and "why" of data breach alerts.

Development

Requirements

Install

  1. Clone and change to the directory:

    git clone https://github.com/mozilla/blurts-server.git
    cd blurts-server
  2. Install dependencies:

    npm install
  3. Copy the .env-dist file to .env:

    cp .env-dist .env

Run

  1. Run the server:

    npm start

Note: npm start uses onchange and nodemon to automatically detect file changes, re-compile static assets, and restart the express process. If you want more control, see the scripts section of package.json for more commands.

  1. Navigate to localhost:6060/

Database

To create the database tables ...

  1. Create the blurts database:

    createdb blurts
  2. Update the DATABASE_URL value in your .env file with your local db credentials:

    DATABASE_URL="postgres://<username>@localhost:<port>/blurts"
    
  3. Run the migrations:

    npm run db:migrate
    

Emails

The included .env-dist sets DEBUG_DUMMY_SMTP=1 which disables emails.

To send emails, you'll need to unset DEBUG_DUMMY_SMTP and supply real SMTP config values for sending email.

You can set and source these via the .env file, or set them directly:

export DEBUG_DUMMY_SMTP=
export SMTP_HOST=<your-smtp-host>
export SMTP_PORT=<your-smtp-port>
export SMTP_USERNAME=<your-username>
export SMTP_PASSWORD=<your-password>

Firefox Accounts

Subscribe with a Firefox Account is controlled via the FXA_ENABLED environment variable. (See .env-dist)

The repo comes with a development FxA oauth app pre-configured in .env, which should work fine running the app on http://localhost:6060

To use a different Firefox Accounts oauth relying party, you'll need to create an FxA Oauth Client and then set some OAUTH config values.

You can set and source these via the .env file:

OAUTH_CLIENT_ID=<your-fxa-oauth-client-id>
OAUTH_CLIENT_SECRET=<your-fxa-oauth-client-secret>
OAUTH_AUTHORIZATION_URI="https://oauth-stable.dev.lcip.org/v1/authorization"
OAUTH_PROFILE_URI="https://stable.dev.lcip.org/profile/v1/profile"
OAUTH_TOKEN_URI="https://oauth-stable.dev.lcip.org/v1/token"

Testing

The full test suite can be run via npm test.

Individual tests

To run individual tests, use NODE_ENV=tests and jest:

NODE_ENV=tests jest --runInBand tests/home.test.js

To run tests with interactive debugger lines enabled:

NODE_ENV=tests node inspect --harmony ./node_modules/.bin/jest tests/home.test.js

Lint

After installing the dependencies, you can lint the code by calling:

npm run lint

Deployment

Firefox Monitor Breach Alerts is designed with 12-factor methodology.

Deploy on Heroku

You will need to set some required environment variables on Heroku.

heroku config:set COOKIE_SECRET=unsafe-cookie-secret-for-heroku
heroku config:set DEBUG_DUMMY_SMTP=1

And any others, depending on the features you're running on Heroku - e.g., Email or Firefox Accounts.