From 0b7756d42855d9368568a6898487c09e24c77dcc Mon Sep 17 00:00:00 2001 From: Laurin <60652077+Flexla54@users.noreply.github.com> Date: Mon, 6 Jun 2022 19:31:54 +0200 Subject: [PATCH] small fixes --- src/Controllers/admin.controller.ts | 2 + src/Controllers/group.controllers.ts | 2 + src/Controllers/organisation.controller.ts | 2 + src/Controllers/participant.controller.ts | 8 +- src/Controllers/role_schema.controller.ts | 2 + src/Controllers/team.controller.ts | 9 +- src/Controllers/user_auth.controller.ts | 2 + src/Middleware/auth/teamleaderAuth.ts | 95 +++++++++++----------- 8 files changed, 70 insertions(+), 52 deletions(-) diff --git a/src/Controllers/admin.controller.ts b/src/Controllers/admin.controller.ts index 4048a30..f942845 100644 --- a/src/Controllers/admin.controller.ts +++ b/src/Controllers/admin.controller.ts @@ -5,6 +5,8 @@ import argon2 from "argon2"; import { AUTH_ERROR, createInsufficientPermissionsError, DataType, generateInvalidBodyError } from "./common"; import { authClient } from "../lib/redis"; +require("express-async-errors"); + export const regenerateRevision = async (pid: string) => { // TOOO: Add error handling const { revision } = await prisma.admin.update({ diff --git a/src/Controllers/group.controllers.ts b/src/Controllers/group.controllers.ts index 102ffd5..6c2c2ea 100644 --- a/src/Controllers/group.controllers.ts +++ b/src/Controllers/group.controllers.ts @@ -14,6 +14,8 @@ import { handleCreateByName, } from "./common"; +require("express-async-errors"); + const updateGroupBody = z .object({ name: z.string().min(1), diff --git a/src/Controllers/organisation.controller.ts b/src/Controllers/organisation.controller.ts index 5a701fe..d21ac13 100644 --- a/src/Controllers/organisation.controller.ts +++ b/src/Controllers/organisation.controller.ts @@ -14,6 +14,8 @@ import { PrismaClientKnownRequestError } from "@prisma/client/runtime"; import { Prisma } from "@prisma/client"; import NotFoundError from "../Middleware/error/NotFoundError"; +require("express-async-errors"); + function validateOranisationName(name: string) { return name.length > 0; } diff --git a/src/Controllers/participant.controller.ts b/src/Controllers/participant.controller.ts index 2c6d242..40d5721 100644 --- a/src/Controllers/participant.controller.ts +++ b/src/Controllers/participant.controller.ts @@ -8,6 +8,8 @@ import NotFoundError from "../Middleware/error/NotFoundError"; import { requireLeaderOfTeam, requireResponsibleForParticipant } from "../Middleware/auth/teamleaderAuth"; import { requireResponsibleForGroups } from "../Middleware/auth/auth"; +require("express-async-errors"); + const InitialParticipant = z.object({ firstName: z.string(), lastName: z.string(), @@ -104,7 +106,7 @@ export const updateParticipant = async (req: Request<{ pid: string }>, res: Resp const { pid } = req.params; if (req.teamleader?.isAuthenticated) { - requireResponsibleForParticipant(req.teamleader, pid); + await requireResponsibleForParticipant(req.teamleader, pid); } const result = InitialParticipant.partial().safeParse(req.body); @@ -153,9 +155,9 @@ export const deleteParticipant = async (req: Request<{ pid: string }>, res: Resp const { pid } = req.params; if (req.teamleader?.isAuthenticated) { - requireResponsibleForParticipant(req.teamleader, pid); + await requireResponsibleForParticipant(req.teamleader, pid); } else { - await requireResponsibleForGroups(req.auth, await getGroupByParticipantPid(pid)); + requireResponsibleForGroups(req.auth, await getGroupByParticipantPid(pid)); } try { diff --git a/src/Controllers/role_schema.controller.ts b/src/Controllers/role_schema.controller.ts index f375451..374a68b 100644 --- a/src/Controllers/role_schema.controller.ts +++ b/src/Controllers/role_schema.controller.ts @@ -15,6 +15,8 @@ import { validateName, } from "./common"; +require("express-async-errors"); + const RoleSchemaBody = z.object({ name: z.string().min(1), schema: z.string(), diff --git a/src/Controllers/team.controller.ts b/src/Controllers/team.controller.ts index 3db62bd..79628e2 100644 --- a/src/Controllers/team.controller.ts +++ b/src/Controllers/team.controller.ts @@ -6,6 +6,9 @@ import { TeamBody } from "./user_auth.controller"; import { Prisma } from "@prisma/client"; import NotFoundError from "../Middleware/error/NotFoundError"; import { requireResponsibleForGroups } from "../Middleware/auth/auth"; +import AuthError from "../Middleware/error/AuthError"; + +require("express-async-errors"); export const basicTeam = { pid: true, @@ -108,8 +111,10 @@ export const deleteTeam = async (req: Request, res: Response) => { if (req.teamleader?.isAuthenticated) { await requireLeaderOfTeam(req.teamleader, pid); - } else { - await requireResponsibleForGroups(req.auth, await getGroupsByTeamPid(pid)); + } + + if (req.auth?.permission_level == "STANDARD") { + throw new AuthError("STANDARD Admins are not allowed to delete Teams!") } await prisma.team.delete({ where: { pid } }); diff --git a/src/Controllers/user_auth.controller.ts b/src/Controllers/user_auth.controller.ts index 369f596..efa67f9 100644 --- a/src/Controllers/user_auth.controller.ts +++ b/src/Controllers/user_auth.controller.ts @@ -8,6 +8,8 @@ import { generateTeamleaderJWT } from "../Middleware/auth/teamleaderAuth"; import { createRolesForTeam } from "./role.controller"; import { z } from "zod"; +require("express-async-errors"); + export const TeamBody = z.object({ teamName: z.string().min(1), leaderEmail: z.string().email(), diff --git a/src/Middleware/auth/teamleaderAuth.ts b/src/Middleware/auth/teamleaderAuth.ts index f0a4737..1052ed8 100644 --- a/src/Middleware/auth/teamleaderAuth.ts +++ b/src/Middleware/auth/teamleaderAuth.ts @@ -4,6 +4,7 @@ import jwt, { JsonWebTokenError } from "jsonwebtoken"; import AuthError from "../error/AuthError"; import { getBearerToken, verifyAuthorizationFormat } from "./auth"; import prisma from "../../lib/prisma"; +import { checkTeamExistence } from "../../Controllers/team.controller"; export interface TeamleaderJWTPayload { team: string; @@ -25,63 +26,63 @@ export function generateTeamleaderJWT(teamleader: Team) { export const _requireTeamleaderAuthentication = (config: { optional: Boolean; controlled: Boolean } = { optional: false, controlled: false }) => - (req: Request, res: Response, next: NextFunction) => { - if (!JWT_SECRET) { - throw new Error("JWT_SECRET not set"); - } - - const { authorization } = req.headers; - - if (!authorization) { - if (config.optional) { - return false; + (req: Request, res: Response, next: NextFunction) => { + if (!JWT_SECRET) { + throw new Error("JWT_SECRET not set"); } - return res.status(403).send({ - type: "error", - payload: { - message: - "The request did not include the Authorization header (Only the team leader can perform this operation)", - }, - }); - } + const { authorization } = req.headers; - if (!verifyAuthorizationFormat(authorization)) { - return res.status(400).send({ - type: "error", - payload: { - message: "Malformed Authorization header", - format: "Bearer ", - }, - }); - } + if (!authorization) { + if (config.optional) { + return false; + } - try { - const token_payload = jwt.verify(getBearerToken(authorization), JWT_SECRET) as TeamleaderJWTPayload; - - req.teamleader = { - isAuthenticated: true, - team: token_payload.team, - }; - - if (!config.controlled) { - next(); - } - - return true; - } catch (e) { - if (e instanceof JsonWebTokenError) { - return res.status(403).json({ + return res.status(403).send({ type: "error", payload: { - message: "Token could not be verified; It might be expired", + message: + "The request did not include the Authorization header (Only the team leader can perform this operation)", }, }); } - throw e; - } - }; + if (!verifyAuthorizationFormat(authorization)) { + return res.status(400).send({ + type: "error", + payload: { + message: "Malformed Authorization header", + format: "Bearer ", + }, + }); + } + + try { + const token_payload = jwt.verify(getBearerToken(authorization), JWT_SECRET) as TeamleaderJWTPayload; + + req.teamleader = { + isAuthenticated: true, + team: token_payload.team, + }; + + if (!config.controlled) { + next(); + } + + return true; + } catch (e) { + if (e instanceof JsonWebTokenError) { + return res.status(403).json({ + type: "error", + payload: { + message: "Token could not be verified; It might be expired", + }, + }); + } + + throw e; + } + }; export const requireTeamleaderAuthentication = _requireTeamleaderAuthentication({ optional: false, controlled: false });