From 3cd0ad7323c73b7b1baeee44b7706efecb9797fe Mon Sep 17 00:00:00 2001 From: Pierre Theo Klein Date: Wed, 9 Jan 2019 22:59:34 -0500 Subject: [PATCH 1/5] Fix sponsor role binding addition --- middlewares/auth.middleware.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/middlewares/auth.middleware.js b/middlewares/auth.middleware.js index c7e81507..b629291c 100644 --- a/middlewares/auth.middleware.js +++ b/middlewares/auth.middleware.js @@ -423,6 +423,11 @@ function createRoleBindings(roleName = undefined) { }); } +async function addAccountTypeRoleBinding(req, res, next) { + await Services.RoleBinding.createRoleBindingByRoleName(req.user.id, req.user.accountType); + return next(); +} + /** * Middleware to retrieve all the roles in the database * @param {*} req @@ -450,6 +455,7 @@ module.exports = { getAccountTypeFromConfirmationToken: Middleware.Util.asyncMiddleware(getAccountTypeFromConfirmationToken), validateConfirmationTokenWithoutAccount: Middleware.Util.asyncMiddleware(validateConfirmationTokenWithoutAccount), createRoleBindings: createRoleBindings, + addAccountTypeRoleBinding: Middleware.Util.asyncMiddleware(addAccountTypeRoleBinding), addCreationRoleBindings: Middleware.Util.asyncMiddleware(addCreationRoleBindings), resendConfirmAccountEmail: Middleware.Util.asyncMiddleware(resendConfirmAccountEmail), retrieveRoleBindings: Middleware.Util.asyncMiddleware(retrieveRoleBindings), From a9739099fca780d476a62748f3d8bedc3db6a62e Mon Sep 17 00:00:00 2001 From: Pierre Theo Klein Date: Wed, 9 Jan 2019 23:15:08 -0500 Subject: [PATCH 2/5] Fix sponsor role binding addition --- routes/api/sponsor.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/routes/api/sponsor.js b/routes/api/sponsor.js index ed305d96..01a18778 100644 --- a/routes/api/sponsor.js +++ b/routes/api/sponsor.js @@ -98,7 +98,7 @@ module.exports = { Middleware.Sponsor.parseSponsor, - Middleware.Auth.createRoleBindings(CONSTANTS.SPONSOR), + Middleware.Auth.addAccountTypeRoleBinding, Middleware.Sponsor.createSponsor, Controllers.Sponsor.createdSponsor From 76dfdb667fef239b7bbee3d59f5efd13259597e5 Mon Sep 17 00:00:00 2001 From: Pierre Theo Klein Date: Thu, 10 Jan 2019 00:29:30 -0500 Subject: [PATCH 3/5] Fix Sponsor account creation --- middlewares/validators/account.validator.js | 2 +- models/account.model.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/middlewares/validators/account.validator.js b/middlewares/validators/account.validator.js index 9118fd5a..73097ffd 100644 --- a/middlewares/validators/account.validator.js +++ b/middlewares/validators/account.validator.js @@ -11,7 +11,7 @@ module.exports = { VALIDATOR.alphaArrayValidator("body", "dietaryRestrictions", false), VALIDATOR.enumValidator("body", "shirtSize", Constants.SHIRT_SIZES, false), VALIDATOR.passwordValidator("body", "password", false), - VALIDATOR.jwtValidator("param", "token", process.env.JWT_CONFIRM_ACC_SECRET, true), + VALIDATOR.jwtValidator("header", "token", process.env.JWT_CONFIRM_ACC_SECRET, false), VALIDATOR.dateValidator("body", "birthDate", false), VALIDATOR.phoneNumberValidator("body", "phoneNumber", false) ], diff --git a/models/account.model.js b/models/account.model.js index 412bc110..db5e24ec 100644 --- a/models/account.model.js +++ b/models/account.model.js @@ -42,7 +42,7 @@ const AccountSchema = new mongoose.Schema({ }, accountType: { type: String, - enum: Constants.USER_TYPES, + enum: Constants.EXTENDED_USER_TYPES, default: Constants.HACKER }, birthDate: { From 6242a64fe4afd343a3ade65f205070fe902f4ef1 Mon Sep 17 00:00:00 2001 From: Pierre Theo Klein Date: Thu, 10 Jan 2019 00:51:49 -0500 Subject: [PATCH 4/5] comments, docs --- docs/api/api_data.js | 10 +++++++++- docs/api/api_data.json | 10 +++++++++- docs/api/api_project.js | 2 +- docs/api/api_project.json | 2 +- middlewares/auth.middleware.js | 6 ++++++ routes/api/account.js | 1 + 6 files changed, 27 insertions(+), 4 deletions(-) diff --git a/docs/api/api_data.js b/docs/api/api_data.js index 7af97641..2300e35d 100644 --- a/docs/api/api_data.js +++ b/docs/api/api_data.js @@ -71,7 +71,14 @@ define({ "field": "phoneNumber", "description": "

the user's phone number, represented as a string.

" } - ] + ], + "header": [{ + "group": "header", + "type": "JWT", + "optional": true, + "field": "token", + "description": "

the user's invite token.

" + }] }, "examples": [{ "title": "Request-Example:", @@ -2425,6 +2432,7 @@ define({ "name": "patchTeam", "group": "Team", "version": "0.0.8", + "description": "

We use hackerId instead of teamId because authorization requires a one-to-one mapping from param id to accountId, but we are not able to have that from teamId to accountId due to multiple members in a team. Instead, we use hackerId, as there is a 1 to 1 link between hackerId to teamId, and a 1 to 1 link between hackerId and accountId

", "parameter": { "fields": { "param": [{ diff --git a/docs/api/api_data.json b/docs/api/api_data.json index 03cc58e8..fdecf3fd 100644 --- a/docs/api/api_data.json +++ b/docs/api/api_data.json @@ -70,7 +70,14 @@ "field": "phoneNumber", "description": "

the user's phone number, represented as a string.

" } - ] + ], + "header": [{ + "group": "header", + "type": "JWT", + "optional": true, + "field": "token", + "description": "

the user's invite token.

" + }] }, "examples": [{ "title": "Request-Example:", @@ -2424,6 +2431,7 @@ "name": "patchTeam", "group": "Team", "version": "0.0.8", + "description": "

We use hackerId instead of teamId because authorization requires a one-to-one mapping from param id to accountId, but we are not able to have that from teamId to accountId due to multiple members in a team. Instead, we use hackerId, as there is a 1 to 1 link between hackerId to teamId, and a 1 to 1 link between hackerId and accountId

", "parameter": { "fields": { "param": [{ diff --git a/docs/api/api_project.js b/docs/api/api_project.js index 22cdc45c..37672ed1 100644 --- a/docs/api/api_project.js +++ b/docs/api/api_project.js @@ -9,7 +9,7 @@ define({ "apidoc": "0.3.0", "generator": { "name": "apidoc", - "time": "2019-01-08T22:07:07.661Z", + "time": "2019-01-10T05:50:17.098Z", "url": "http://apidocjs.com", "version": "0.17.7" } diff --git a/docs/api/api_project.json b/docs/api/api_project.json index 543c38d6..9ba88344 100644 --- a/docs/api/api_project.json +++ b/docs/api/api_project.json @@ -9,7 +9,7 @@ "apidoc": "0.3.0", "generator": { "name": "apidoc", - "time": "2019-01-08T22:07:07.661Z", + "time": "2019-01-10T05:50:17.098Z", "url": "http://apidocjs.com", "version": "0.17.7" } diff --git a/middlewares/auth.middleware.js b/middlewares/auth.middleware.js index b629291c..2b42f181 100644 --- a/middlewares/auth.middleware.js +++ b/middlewares/auth.middleware.js @@ -423,6 +423,12 @@ function createRoleBindings(roleName = undefined) { }); } +/** + * Adds a rolebinding between the user and the role with the name stored in 'accountType'. + * @param {{user: {id: ObjectId, accountType: string}}} req + * @param {*} res + * @param {(err?) => void} next + */ async function addAccountTypeRoleBinding(req, res, next) { await Services.RoleBinding.createRoleBindingByRoleName(req.user.id, req.user.accountType); return next(); diff --git a/routes/api/account.js b/routes/api/account.js index 6ae784f4..c973ef5a 100644 --- a/routes/api/account.js +++ b/routes/api/account.js @@ -75,6 +75,7 @@ module.exports = { * @apiParam (body) {String} password The password of the account. * @apiParam (body) {String} birthDate a Date parsable string. * @apiParam (body) {Number} phoneNumber the user's phone number, represented as a string. + * @apiParam (header) {JWT} [token] the user's invite token. * * @apiParamExample {json} Request-Example: * { From cf4047001f55e36b0c373a12dd2fdc24e7bdf119 Mon Sep 17 00:00:00 2001 From: Pierre Theo Klein Date: Thu, 10 Jan 2019 10:18:09 -0500 Subject: [PATCH 5/5] make JWT optional --- middlewares/validators/account.validator.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/middlewares/validators/account.validator.js b/middlewares/validators/account.validator.js index 73097ffd..69ef5fb7 100644 --- a/middlewares/validators/account.validator.js +++ b/middlewares/validators/account.validator.js @@ -11,7 +11,7 @@ module.exports = { VALIDATOR.alphaArrayValidator("body", "dietaryRestrictions", false), VALIDATOR.enumValidator("body", "shirtSize", Constants.SHIRT_SIZES, false), VALIDATOR.passwordValidator("body", "password", false), - VALIDATOR.jwtValidator("header", "token", process.env.JWT_CONFIRM_ACC_SECRET, false), + VALIDATOR.jwtValidator("header", "token", process.env.JWT_CONFIRM_ACC_SECRET, true), VALIDATOR.dateValidator("body", "birthDate", false), VALIDATOR.phoneNumberValidator("body", "phoneNumber", false) ],