Nachklang/API
2
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Releases Wiki Activity

Upgrade to proper user management

Browse Source
This commit is contained in:
Patrick Müller
2023-05-14 19:17:30 +02:00
parent 93c70b0e1d
commit 02f7424b56
9 changed files with 393 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/models/calendar/events/credentials.service.ts
+24 -9
View File
@@ -1,4 +1,5 @@
import * as dotenv from 'dotenv';
import * as UserService from '../users/users.service';
dotenv.config();
@@ -7,34 +8,48 @@ dotenv.config();
* Checks if the password gives admin privileges (view / create / edit / delete)
* @param password
*/
export const checkAdminPrivileges = (password: string) => {
return password == process.env.ADMIN_CREDENTIAL;
export const checkAdminPrivileges = async (sessionId: string, sessionKey: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.is_active;
}
return false;
}
/**
* Checks if the password gives member view privileges
* @param password
*/
export const checkMemberPrivileges = (password: string) => {
return password == process.env.MEMBER_CREDENTIAL || password == process.env.ADMIN_CREDENTIAL;
export const checkMemberPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.is_active;
}
return password == process.env.MEMBER_CREDENTIAL;
}
/**
* Checks if the password gives management view privileges
* @param password
*/
export const checkManagementPrivileges = (password: string) => {
return password == process.env.MANAGEMENT_CREDENTIAL || password == process.env.ADMIN_CREDENTIAL;
export const checkManagementPrivileges = async (sessionId: string, sessionKey: string, password: string, ip: string) => {
if(sessionId) {
let user = await UserService.checkSession(sessionId, sessionKey, ip);
return user.is_active;
}
return password == process.env.MANAGEMENT_CREDENTIAL;
}
export const hasAccess = (calendarName: string, password: string) => {
export const hasAccess = async (calendarName: string, sessionId: string, sessionKey: string, password: string, ip: string) => {
switch (calendarName) {
case 'public':
return true;
case 'members':
return checkMemberPrivileges(password);
return await checkMemberPrivileges(sessionId, sessionKey, password, ip);
case 'management':
return checkManagementPrivileges(password);
return await checkManagementPrivileges(sessionId, sessionKey, password, ip);
default:
return false;
}
src/models/calendar/events/event.interface.ts
+2 -1
View File
@@ -8,7 +8,8 @@ export interface Event {
endDateTime: Date;
createdDate: Date;
location: string;
createdBy: string;
createdBy?: string;
createdById: number,
url: string;
wholeDay: boolean;
}
src/models/calendar/events/events.router.ts
+35 -16
View File
@@ -7,6 +7,7 @@ import {Event} from './event.interface';
import * as EventService from './events.service';
import * as iCalService from './icalgenerator.service';
import * as CredentialService from './credentials.service';
import * as UserService from '../users/users.service';
import {Guid} from 'guid-typescript';
import logger from '../../../middleware/logger';
@@ -35,7 +36,10 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
try {
// Get request params
let calendarName: string = req.params.calendar as string ?? '';
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let password: string = req.query.password as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (calendarName.length < 1) {
res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -49,7 +53,7 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
let calendarId: number = calendarNames.get(calendarName)!.id;
if (!CredentialService.hasAccess(calendarName, password)) {
if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -69,7 +73,10 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
try {
// Get request params
let calendarName: string = req.params.calendar as string ?? '';
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let password: string = req.query.password as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (calendarName.length < 1) {
res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -83,7 +90,7 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
let calendarId: number = calendarNames.get(calendarName)!.id;
if (!CredentialService.hasAccess(calendarName, password)) {
if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -112,10 +119,14 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
eventsRouter.post('/', async (req: Request, res: Response) => {
try {
// Get params
let password = req.body.password;
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (!CredentialService.checkAdminPrivileges(password)) {
res.status(403).send({'message': 'Insufficient privileges.'});
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.is_active) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -123,8 +134,7 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
req.body.calendarId === undefined ||
isNullOrBlank(req.body.name) ||
req.body.startDateTime === undefined ||
req.body.endDateTime === undefined ||
isNullOrBlank(req.body.createdBy)
req.body.endDateTime === undefined
) {
res.status(400).send({'message': 'Required parameters missing'});
return;
@@ -140,7 +150,7 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
endDateTime: new Date(req.body.endDateTime),
createdDate: new Date(),
location: req.body.location ?? '',
createdBy: req.body.createdBy ?? '',
createdById: user.user_id ?? -1,
url: req.body.url ?? '',
wholeDay: req.body.wholeDay ?? false
};
@@ -165,10 +175,14 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
try {
// Get params
let password = req.body.password;
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (!CredentialService.checkAdminPrivileges(password)) {
res.status(403).send({'message': 'Insufficient privileges.'});
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.is_active) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -177,8 +191,7 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
req.body.calendarId === undefined ||
isNullOrBlank(req.body.name) ||
req.body.startDateTime === undefined ||
req.body.endDateTime === undefined ||
isNullOrBlank(req.body.createdBy)
req.body.endDateTime === undefined
) {
res.status(400).send({'message': 'Required parameters missing'});
return;
@@ -195,6 +208,7 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
createdDate: new Date(),
location: req.body.location ?? '',
createdBy: req.body.createdBy ?? '',
createdById: user.user_id ?? -1,
url: req.body.url ?? '',
wholeDay: req.body.wholeDay ?? false
};
@@ -222,10 +236,14 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
eventsRouter.delete('/:eventId', async (req: Request, res: Response) => {
try {
// Get params
let password = req.body.password;
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (!CredentialService.checkAdminPrivileges(password)) {
res.status(403).send({'message': 'Insufficient privileges.'});
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.is_active) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -247,6 +265,7 @@ eventsRouter.delete('/:eventId', async (req: Request, res: Response) => {
createdDate: new Date(),
location: '',
createdBy: '',
createdById: -1,
url: '',
wholeDay: false
};
src/models/calendar/events/events.service.ts
+7 -6
View File
@@ -14,7 +14,7 @@ export const getAllEvents = async (calendarId: number): Promise<Event[]> => {
let conn = await NachklangCalendarDB.getConnection();
let eventRows: Event[] = [];
try {
const eventsQuery = 'SELECT * FROM events WHERE calendar_id = ?';
const eventsQuery = 'SELECT e.*, u.full_name FROM events e LEFT OUTER JOIN users u ON e.created_by_id = u.user_id WHERE calendar_id = ?';
const eventsRes = await conn.query(eventsQuery, calendarId);
for (let row of eventsRes) {
@@ -28,7 +28,8 @@ export const getAllEvents = async (calendarId: number): Promise<Event[]> => {
endDateTime: row.end_datetime,
createdDate: row.created_date,
location: row.location,
createdBy: row.created_by,
createdBy: row.full_name,
createdById: row.created_by_id,
url: row.url,
wholeDay: row.whole_day
});
@@ -51,8 +52,8 @@ export const createEvent = async (event: Event): Promise<number> => {
let conn = await NachklangCalendarDB.getConnection();
try {
let eventUUID = Guid.create().toString();
const eventsQuery = 'INSERT INTO events (calendar_id, uuid, name, description, start_datetime, end_datetime, location, created_by, url, whole_day) VALUES (?,?,?,?,?,?,?,?,?,?) RETURNING event_id';
const eventsRes = await conn.execute(eventsQuery, [event.calendarId, eventUUID, event.name, event.description, event.startDateTime, event.endDateTime, event.location, event.createdBy, event.url, event.wholeDay]);
const eventsQuery = 'INSERT INTO events (calendar_id, uuid, name, description, start_datetime, end_datetime, location, created_by_id, url, whole_day) VALUES (?,?,?,?,?,?,?,?,?,?) RETURNING event_id';
const eventsRes = await conn.execute(eventsQuery, [event.calendarId, eventUUID, event.name, event.description, event.startDateTime, event.endDateTime, event.location, event.createdById, event.url, event.wholeDay]);
return eventsRes[0].event_id;
} catch (err) {
@@ -72,8 +73,8 @@ export const createEvent = async (event: Event): Promise<number> => {
export const updateEvent = async (event: Event): Promise<number> => {
let conn = await NachklangCalendarDB.getConnection();
try {
const eventsQuery = 'UPDATE events SET name = ?, description = ?, start_datetime = ?, end_datetime = ?, location = ?, created_by = ?, url = ?, whole_day = ? WHERE event_id = ?';
const eventsRes = await conn.execute(eventsQuery, [event.name, event.description, event.startDateTime, event.endDateTime, event.location, event.createdBy, event.url, event.wholeDay, event.eventId]);
const eventsQuery = 'UPDATE events SET name = ?, description = ?, start_datetime = ?, end_datetime = ?, location = ?, created_by_id = ?, url = ?, whole_day = ? WHERE event_id = ?';
const eventsRes = await conn.execute(eventsQuery, [event.name, event.description, event.startDateTime, event.endDateTime, event.location, event.createdById, event.url, event.wholeDay, event.eventId]);
return eventsRes.affectedRows;
} catch (err) {