finished authentication throughout project

TomPadmanathan · Oct 28, 2023 · 94106a3 · 94106a3
1 parent 69c107e
commit 94106a3
Show file tree

Hide file tree

Showing 7 changed files with 246 additions and 150 deletions.
diff --git a/components/checkout/CheckoutGuest.tsx b/components/checkout/CheckoutGuest.tsx
@@ -47,7 +47,6 @@ export default function CheckoutGuest(): JSX.Element {
             orderNote: '',
             forename: '',
             surname: '',
-            userType: 'guest',
         });
     const [showGuest, setShowGuest] = useState<boolean>(true);
 
@@ -66,7 +65,7 @@ export default function CheckoutGuest(): JSX.Element {
                             router.push({
                                 pathname: '/auth/login',
                                 query: {
-                                    url: 'http://localhost:3000/checkout',
+                                    url: `${process.env.NEXT_PUBLIC_URL}/checkout`,
                                 },
                             })
                         }
@@ -84,9 +83,12 @@ export default function CheckoutGuest(): JSX.Element {
                     <SecondaryButton
                         content="Login"
                         onClick={(): Promise<boolean> =>
-                            router.push(
-                                '/auth/login?url=http://localhost:3000/checkout'
-                            )
+                            router.push({
+                                pathname: 'auth/login',
+                                query: {
+                                    url: `${process.env.NEXT_PUBLIC_URL}/checkout`,
+                                },
+                            })
                         }
                         addClass="mx-5 mb-5 mt-2 px-20"
                     />

diff --git a/components/checkout/CheckoutUser.tsx b/components/checkout/CheckoutUser.tsx
@@ -26,8 +26,6 @@ function checkoutUserInfomationToQueryParams(
     return {
         orderNote: checkoutInfo.orderNote,
         includeCutlery: checkoutInfo.includeCutlery.toString(),
-        userId: checkoutInfo.userId,
-        userType: checkoutInfo.userType,
     };
 }
 
@@ -37,8 +35,6 @@ export default function CheckoutUser({ user }: props): JSX.Element {
     const [checkoutInfo, setCheckoutInfo] = useState<checkoutInfoUser>({
         orderNote: '',
         includeCutlery: false,
-        userId: user.userId,
-        userType: 'user',
     });
 
     return (

diff --git a/interfaces/checkoutInfo.ts b/interfaces/checkoutInfo.ts
@@ -9,11 +9,12 @@ export interface checkoutInfoGuest {
     orderNote: string;
     forename: string;
     surname: string;
-    userType: 'guest';
+    userType?: 'guest';
+    userId?: string;
 }
 export interface checkoutInfoUser {
     orderNote: string;
     includeCutlery: boolean;
-    userId: string;
-    userType: 'user';
+    userType?: 'user';
+    userId?: string;
 }
diff --git a/pages/api/create-payment-intent.ts b/pages/api/create-payment-intent.ts
@@ -1,5 +1,6 @@
 // Packages
 import Stripe from 'stripe';
+import Jwt, { JwtPayload } from 'jsonwebtoken';
 
 // Utils
 import calculateCheckoutPricesFromServerSide from '@/utils/calculateCheckoutPricesFromServerSide';
@@ -28,37 +29,55 @@ export default async function handler(
     response: NextApiResponse
 ): Promise<void> {
     const cart: cart = request.body.cart;
-    let userData: checkoutInfoUser | checkoutInfoGuest = JSON.parse(
-        request.body.userData
+
+    const checkoutData: checkoutInfoGuest | checkoutInfoUser = JSON.parse(
+        request.body.checkoutData
     );
+
+    if (request.method !== 'POST') {
+        response.status(405).json({ error: 'Method not allowed' });
+        console.error('Method not allowed');
+        return;
+    }
+    const authorizationHeader = request.headers.authorization;
+    if (!authorizationHeader) {
+        checkoutData.userType = 'guest';
+    } else {
+        const token = authorizationHeader.replace('Bearer ', '');
+        const decodedToken: JwtPayload | null | string = Jwt.decode(token);
+        if (!decodedToken || typeof decodedToken != 'object') return;
+        checkoutData.userType = 'user';
+        checkoutData.userId = decodedToken.userId;
+    }
+
     let customer;
-    switch (userData.userType) {
+    switch (checkoutData.userType) {
         case 'guest':
             customer = await stripe.customers.create({
-                email: userData.email,
-                name: userData.forename + ' ' + userData.surname,
-                phone: userData.phoneNumber.toString(),
+                email: checkoutData.email,
+                name: checkoutData.forename + ' ' + checkoutData.surname,
+                phone: checkoutData.phoneNumber.toString(),
                 address: {
-                    city: userData.cityTown,
-                    line1: userData.addressLine1,
-                    line2: userData.addressLine2,
-                    postal_code: userData.postcode,
+                    city: checkoutData.cityTown,
+                    line1: checkoutData.addressLine1,
+                    line2: checkoutData.addressLine2,
+                    postal_code: checkoutData.postcode,
                 },
                 metadata: {
-                    orderNote: userData.orderNote,
-                    includeCutlery: userData.includeCutlery ? 1 : 0,
-                    userType: userData.userType,
+                    orderNote: checkoutData.orderNote,
+                    includeCutlery: checkoutData.includeCutlery ? 1 : 0,
+                    userType: checkoutData.userType,
                 },
             });
             break;
 
         case 'user':
             customer = await stripe.customers.create({
                 metadata: {
-                    orderNote: userData.orderNote,
-                    includeCutlery: userData.includeCutlery ? 1 : 0,
-                    userId: userData.userId,
-                    userType: userData.userType,
+                    orderNote: checkoutData.orderNote,
+                    includeCutlery: checkoutData.includeCutlery ? 1 : 0,
+                    userType: checkoutData.userType,
+                    userId: checkoutData.userId ? checkoutData.userId : null,
                 },
             });
             break;
@@ -68,15 +87,16 @@ export default async function handler(
             return;
     }
 
-    const paymentIntent = await stripe.paymentIntents.create({
-        amount: await calculateOrderAmount(cart),
-        currency: 'gbp',
-        payment_method_types: ['card'],
-        metadata: {
-            customerId: customer.id,
-            cart: JSON.stringify(getIdsAndOptionsInCart(cart)),
-        },
-    });
+    const paymentIntent: Stripe.Response<Stripe.PaymentIntent> =
+        await stripe.paymentIntents.create({
+            amount: await calculateOrderAmount(cart),
+            currency: 'gbp',
+            payment_method_types: ['card'],
+            metadata: {
+                customerId: customer.id,
+                cart: JSON.stringify(getIdsAndOptionsInCart(cart)),
+            },
+        });
 
     response.send({
         clientSecret: paymentIntent.client_secret,

diff --git a/pages/api/getOrderFromId.ts b/pages/api/getOrderFromId.ts
@@ -1,5 +1,6 @@
 // Packages
 import sequelize from '@/database/sequelize';
+import Jwt, { JwtPayload } from 'jsonwebtoken';
 
 // Database Models
 import Order from '@/database/models/Order';
@@ -19,19 +20,42 @@ export default async function handler(
     response: NextApiResponse
 ): Promise<void> {
     response.status(200);
-
-    await sequelize.sync();
+    if (request.method !== 'POST') {
+        response.status(405).json({ error: 'Method not allowed' });
+        console.error('Method not allowed');
+        return;
+    }
+    const authorizationHeader = request.headers.authorization;
+    if (!authorizationHeader) {
+        response
+            .status(404)
+            .json({ error: 'No token provided in the request' });
+        console.error('No token provided in the request.');
+        return;
+    }
+    const token: string = authorizationHeader.replace('Bearer ', '');
+    const decodedToken: JwtPayload | null | string = Jwt.decode(token);
+    if (!decodedToken || typeof decodedToken != 'object') return;
+    const userId: string = decodedToken.userId;
 
     try {
+        await sequelize.sync();
         const order: Order | null = await Order.findOne({
             where: {
                 orderId: request.body.orderId,
             },
-            include: User
+            include: User,
         });
 
-        if (order) response.send(order);
-        else console.error('Order not found');
+        if (!order) {
+            response.status(404).json({ error: 'order not found' });
+            return;
+        }
+        if (userId !== order.userId) {
+            response.status(404).json({ error: 'Invalid permissions' });
+            return;
+        }
+        response.json({ order: order });
     } catch (error) {
         console.error('Sequlize error:', error);
     }

diff --git a/pages/checkout/new-checkout-session.tsx b/pages/checkout/new-checkout-session.tsx
@@ -9,6 +9,9 @@ import { Elements } from '@stripe/react-stripe-js';
 // Context
 import { AppContext } from '@/context/AppContext';
 
+// Utils
+import fetchWithToken from '@/utils/JWT/fetchWithToken';
+
 // Components
 import CheckoutForm from '@/components/CheckoutForm';
 
@@ -24,14 +27,17 @@ export default function App(): JSX.Element {
     const router: NextRouter = useRouter();
 
     const fetchData = useCallback(async (): Promise<void> => {
-        const response: Response = await fetch('/api/create-payment-intent', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                cart: cart,
-                userData: JSON.stringify(router.query),
-            }),
-        });
+        const response: Response = await fetchWithToken(
+            '/api/create-payment-intent',
+            {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    cart: cart,
+                    checkoutData: JSON.stringify(router.query),
+                }),
+            }
+        );
         const data = await response.json();
         setClientSecret(data.clientSecret);
     }, [cart, router.query]);