Merge pull request #59 from akhilome/ft-admin-secret-161119874

#161119874 Any User Should be Able to Signup as an Admin

.env.example

@@ -2,3 +2,4 @@ PORT=[server_port_number]
 DATABASE_URL=postgres://[username]@[server]:[port]/fastfoodfast
 TEST_DATABASE_URL=postgres://[username]@[server]:[port]/fastfoodfast_test
 JWT_SECRET=[your_supersecret_secret]
+ADMIN_SECRET=[secret_keyword_admins_should_provide_on_signup]

server/controllers/authController.js

@@ -3,8 +3,13 @@ import pool from '../db/config';
 
 class AuthController {
   static async signup(req, res) {
-    const { name, email, password } = req;
-    const isAdmin = email === 'hovkard@gmail.com' ? 't' : 'f';
+    const {
+      name,
+      email,
+      password,
+      adminSecret,
+    } = req;
+    const isAdmin = adminSecret === process.env.ADMIN_SECRET ? 't' : 'f';
 
     try {
       // Check if a user with the provided email already exists

server/middleware/sanitizer.js

@@ -7,6 +7,7 @@ class Sanitize {
       email,
       password,
       confirmPassword,
+      adminSecret,
     } = req.body;
 
     const missingFields = [name, email, password, confirmPassword].map((field, index) => {
@@ -36,6 +37,7 @@ class Sanitize {
     req.name = name.trim();
     req.email = email.trim();
     req.password = password.trim();
+    req.adminSecret = adminSecret;
     return next();
   }
 

tests/routes/auth.spec.js

@@ -1,9 +1,11 @@
 import chai from 'chai';
 import 'chai/register-should';
 import chaiHttp from 'chai-http';
+import dotenv from 'dotenv';
 import app from '../../server/index';
 import { users, emptyTables } from '../seed/seed';
 
+dotenv.config();
 chai.use(chaiHttp);
 
 before(emptyTables);

tests/seed/seed.js

@@ -1,30 +1,30 @@
 import jwt from 'jsonwebtoken';
 import pool from '../../server/db/config';
 
-const adminEmail = 'hovkard@gmail.com';
-
-
 const users = {
   admin: {
     id: 1,
     name: 'Kizito',
-    email: adminEmail,
+    email: 'hovkard@gmail.com',
     password: 'suppersecurepassword',
     confirmPassword: 'suppersecurepassword',
+    adminSecret: process.env.ADMIN_SECRET,
   },
   validUser: {
     id: 2,
     name: 'James',
     email: 'daniel@james.com',
     password: 'pixel2user',
     confirmPassword: 'pixel2user',
+    adminSecret: '',
   },
   validUserTwo: {
     id: 3,
     name: 'Philip',
     email: 'philip@new.man',
     password: 'facilitate',
     confirmPassword: 'facilitate',
+    adminSecret: '',
   },
   validUserInvalidPass: {
     email: 'daniel@james.com',
@@ -63,7 +63,7 @@ function generateValidToken(userObject) {
     userId: userObject.id,
     userName: userObject.name,
     userEmail: userObject.email,
-    userStatus: userObject.email === adminEmail ? 'admin' : 'customer',
+    userStatus: userObject.adminSecret === process.env.ADMIN_SECRET ? 'admin' : 'customer',
   }, process.env.JWT_SECRET).toString();
 }