Nachklang/API
2
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Releases Wiki Activity

Upgrade to proper user management

Browse Source
This commit is contained in:
Patrick Müller
2023-05-14 19:17:30 +02:00
parent 93c70b0e1d
commit 02f7424b56
9 changed files with 393 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/models/calendar/events/events.router.ts
+35 -16
View File
@@ -7,6 +7,7 @@ import {Event} from './event.interface';
import * as EventService from './events.service';
import * as iCalService from './icalgenerator.service';
import * as CredentialService from './credentials.service';
import * as UserService from '../users/users.service';
import {Guid} from 'guid-typescript';
import logger from '../../../middleware/logger';
@@ -35,7 +36,10 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
try {
// Get request params
let calendarName: string = req.params.calendar as string ?? '';
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let password: string = req.query.password as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (calendarName.length < 1) {
res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -49,7 +53,7 @@ eventsRouter.get('/:calendar/json', async (req: Request, res: Response) => {
let calendarId: number = calendarNames.get(calendarName)!.id;
if (!CredentialService.hasAccess(calendarName, password)) {
if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -69,7 +73,10 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
try {
// Get request params
let calendarName: string = req.params.calendar as string ?? '';
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let password: string = req.query.password as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (calendarName.length < 1) {
res.status(400).send({'message': 'Please state the name of the calendar you want events from.'});
@@ -83,7 +90,7 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
let calendarId: number = calendarNames.get(calendarName)!.id;
if (!CredentialService.hasAccess(calendarName, password)) {
if (! await CredentialService.hasAccess(calendarName, sessionId, sessionKey, password, ip)) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -112,10 +119,14 @@ eventsRouter.get('/:calendar/ical', async (req: Request, res: Response) => {
eventsRouter.post('/', async (req: Request, res: Response) => {
try {
// Get params
let password = req.body.password;
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (!CredentialService.checkAdminPrivileges(password)) {
res.status(403).send({'message': 'Insufficient privileges.'});
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.is_active) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -123,8 +134,7 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
req.body.calendarId === undefined ||
isNullOrBlank(req.body.name) ||
req.body.startDateTime === undefined ||
req.body.endDateTime === undefined ||
isNullOrBlank(req.body.createdBy)
req.body.endDateTime === undefined
) {
res.status(400).send({'message': 'Required parameters missing'});
return;
@@ -140,7 +150,7 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
endDateTime: new Date(req.body.endDateTime),
createdDate: new Date(),
location: req.body.location ?? '',
createdBy: req.body.createdBy ?? '',
createdById: user.user_id ?? -1,
url: req.body.url ?? '',
wholeDay: req.body.wholeDay ?? false
};
@@ -165,10 +175,14 @@ eventsRouter.post('/', async (req: Request, res: Response) => {
eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
try {
// Get params
let password = req.body.password;
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (!CredentialService.checkAdminPrivileges(password)) {
res.status(403).send({'message': 'Insufficient privileges.'});
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.is_active) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -177,8 +191,7 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
req.body.calendarId === undefined ||
isNullOrBlank(req.body.name) ||
req.body.startDateTime === undefined ||
req.body.endDateTime === undefined ||
isNullOrBlank(req.body.createdBy)
req.body.endDateTime === undefined
) {
res.status(400).send({'message': 'Required parameters missing'});
return;
@@ -195,6 +208,7 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
createdDate: new Date(),
location: req.body.location ?? '',
createdBy: req.body.createdBy ?? '',
createdById: user.user_id ?? -1,
url: req.body.url ?? '',
wholeDay: req.body.wholeDay ?? false
};
@@ -222,10 +236,14 @@ eventsRouter.put('/:eventId', async (req: Request, res: Response) => {
eventsRouter.delete('/:eventId', async (req: Request, res: Response) => {
try {
// Get params
let password = req.body.password;
let sessionId: string = req.query.sessionId as string ?? '';
let sessionKey: string = req.query.sessionKey as string ?? '';
let ip: string = req.socket.remoteAddress ?? '';
if (!CredentialService.checkAdminPrivileges(password)) {
res.status(403).send({'message': 'Insufficient privileges.'});
let user = await UserService.checkSession(sessionId, sessionKey, ip);
if (!user.is_active) {
res.status(403).send({'message': 'You do not have access to the specified calendar.'});
return;
}
@@ -247,6 +265,7 @@ eventsRouter.delete('/:eventId', async (req: Request, res: Response) => {
createdDate: new Date(),
location: '',
createdBy: '',
createdById: -1,
url: '',
wholeDay: false
};