From b5bcc676ed3bddca036d4a8fc6fe044f3b3dbe25 Mon Sep 17 00:00:00 2001 From: Florian Hartwich Date: Thu, 8 Jun 2017 16:03:20 +0200 Subject: [PATCH] backend register & activation route --- api/middleware/permission-check.js | 1 - api/models/app-user.js | 8 ++ api/routes/authenticate.js | 145 ++++++++++++++++++----------- 3 files changed, 101 insertions(+), 53 deletions(-) diff --git a/api/middleware/permission-check.js b/api/middleware/permission-check.js index 0fc499f..f232858 100644 --- a/api/middleware/permission-check.js +++ b/api/middleware/permission-check.js @@ -5,7 +5,6 @@ let check = (requiredPermission, actualPermission, res, next) => { if (actualPermission >= requiredPermission) { return next(); } - return res.status(403).send({ success: false, message: 'permission denied' diff --git a/api/models/app-user.js b/api/models/app-user.js index d410f2f..09083d3 100644 --- a/api/models/app-user.js +++ b/api/models/app-user.js @@ -20,6 +20,14 @@ const AppUserSchema = new Schema({ min: 0, max: 4, default: 0 + }, + secret: { + type: String, + required: true + }, + activated: { + type: Boolean, + default: false } }, { collection: 'app_user', diff --git a/api/routes/authenticate.js b/api/routes/authenticate.js index 3c56f66..dd05c6e 100644 --- a/api/routes/authenticate.js +++ b/api/routes/authenticate.js @@ -8,6 +8,9 @@ const Q = require('q'); const _ = require('lodash'); const logger = require('debug')('cc:authenticate'); +const apiAuthenticationMiddleware = require('../middleware/auth-middleware'); +const checkAdmin = require('../middleware/permission-check').checkAdmin; + // HTTP status codes by name const codes = require('./http-codes'); @@ -49,11 +52,12 @@ let authCheck = (username, password) => { const diff = 3 * 60 * 24; // time till expiration [minutes] - if (user && bcrypt.compareSync(password, user.password)) { + if (user && user.activated && bcrypt.compareSync(password, user.password)) { // authentication successful deferred.resolve({ _id: user._id, username: user.username, + permission: user.permission, token: jwt.sign({sub: user._id}, config.secret, {expiresIn: diff * 60}), tokenExpireDate: new Date(Date.now().valueOf() + diff * 60000 - 1000) }); @@ -67,57 +71,94 @@ let authCheck = (username, password) => { }; -//******************************** SIGNUP ************************ -// -// authenticate.route('/signup') -// .post((req, res, next) => { -// create(req.body) -// .then(() => { -// res.sendStatus(200); -// }) -// .catch((err) => { -// res.status(400).send(err); -// }); -// }) -// -// .all( -// routerHandling.httpMethodNotAllowed -// ); -// -// let create = (userParam) => { -// const deferred = Q.defer(); -// -// // validation -// AppUserModel.findOne( -// {username: userParam.username}, -// (err, user) => { -// if (err) deferred.reject(err.name + ': ' + err.message); -// -// if (user) { -// // username already exists -// deferred.reject('Username "' + userParam.username + '" is already taken'); -// } else { -// createUser(); -// } -// }); -// -// let createUser = () => { -// // set user object to userParam without the cleartext password -// const user = _.omit(userParam, 'password'); -// -// // add hashed password to user object -// user.password = bcrypt.hashSync(userParam.password, 10); -// -// const newUser = new AppUserModel(user); -// newUser.save((err, doc) => { -// if (err) deferred.reject(err.name + ': ' + err.message); -// -// deferred.resolve(); -// }); -// }; -// -// return deferred.promise; -// }; +// ******************************** EDITING USING ADMIN PANEL ************************ + +authenticate.route('/editUser/:id') + .patch(apiAuthenticationMiddleware, checkAdmin, (req, res, next) => { + if (!req.body || (req.body._id && req.body._id !== req.params.id)) { + // little bit different as in PUT. :id does not need to be in data, but if the _id and url id must match + const err = new Error('id of PATCH resource and send JSON body are not equal ' + req.params.id + " " + req.body._id); + err.status = codes.notfound; + next(err); + return; // prevent node to process this function further after next() has finished. + } + + // increment version manually as we do not use .save(.) + req.body.updatedAt = new Date(); + req.body.$inc = {__v: 1}; + + // PATCH is easier with mongoose than PUT. You simply update by all data that comes from outside. no need to reset attributes that are missing. + AppUserModel.findByIdAndUpdate(req.params.id, req.body, {new: true}, (err, item) => { + if (err) { + err.status = codes.wrongrequest; + } + else if (!item) { + err = new Error("appUser not found"); + err.status = codes.notfound; + } + else { + res.locals.items = item; + } + next(err); + }) + }) + + .all( + routerHandling.httpMethodNotAllowed + ); + + +// ******************************** SIGNUP ************************ + +authenticate.route('/signup') + .post((req, res, next) => { + create(req.body) + .then(() => { + res.sendStatus(200); + }) + .catch((err) => { + res.status(400).send(err); + }); + }) + + .all( + routerHandling.httpMethodNotAllowed + ); + +let create = (userParam) => { + const deferred = Q.defer(); + + // validation + AppUserModel.findOne( + {username: userParam.username}, + (err, user) => { + if (err) deferred.reject(err.name + ': ' + err.message); + + if (user) { + // username already exists + deferred.reject('Username "' + userParam.username + '" is already taken'); + } else { + createUser(); + } + }); + + let createUser = () => { + // set user object to userParam without the cleartext password + const user = _.omit(userParam, 'password'); + + // add hashed password to user object + user.password = bcrypt.hashSync(userParam.password, 10); + + const newUser = new AppUserModel(user); + newUser.save((err, doc) => { + if (err) deferred.reject(err.name + ': ' + err.message); + + deferred.resolve(); + }); + }; + + return deferred.promise; +}; authenticate.use(routerHandling.emptyResponse);