user managment

backend/routes/auth.js

@@ -0,0 +1,113 @@
+var passport = require('passport');
+var LocalStrategy = require('passport-local');
+var crypto = require('crypto');
+const router = require('express').Router()
+const config = require("../config.js");
+const keys = require("../.Keys.js");
+
+/* Configure password authentication strategy.
+ *
+ * The `LocalStrategy` authenticates users by verifying a username and password.
+ * The strategy parses the username and password from the request and calls the
+ * `verify` function.
+ *
+ * The `verify` function queries the database for the user record and verifies
+ * the password by hashing the password supplied by the user and comparing it to
+ * the hashed password stored in the database.  If the comparison succeeds, the
+ * user is authenticated; otherwise, not.
+ */
+const { UserDb }= require('../services/userDb');
+
+passport.use(new LocalStrategy({
+      usernameField: 'email',
+      passwordField: 'password'
+    },async function verify(email, password, cb) {
+  try {
+    const userDb = await UserDb.init();
+    const user = await userDb.getByEmail(email);
+    if (!user) {
+      return cb(null, false, { message: 'Incorrect username or password.' });
+    }
+    
+    crypto.pbkdf2(password, user.salt, 310000, 32, 'sha256', async function(err, hashedPassword) {
+      if (err) { return cb(err); }
+      if (!crypto.timingSafeEqual(Buffer.from(user.hashed_password, 'hex'), Buffer.from(hashedPassword, 'hex'))) {
+        return cb(null, false, { message: 'Incorrect username or password.' });
+      }
+      return cb(null, user);
+    });
+  } catch (err) {
+    return cb(err);
+  }
+}));
+
+  /* Configure session management.
+ *
+ * When a login session is established, information about the user will be
+ * stored in the session.  This information is supplied by the `serializeUser`
+ * function, which is yielding the user ID and username.
+ *
+ * As the user interacts with the app, subsequent requests will be authenticated
+ * by verifying the session.  The same user information that was serialized at
+ * session establishment will be restored when the session is authenticated by
+ * the `deserializeUser` function.
+ *
+ * Since every request to the app needs the user ID and username, in order to
+ * fetch todo records and render the user element in the navigation bar, that
+ * information is stored in the session.
+ */
+passport.serializeUser(function(user, cb) {    
+    process.nextTick(function() {
+      cb(null, { id: user._id, username: user.email });
+    });
+  });
+  
+passport.deserializeUser(function(user, cb) {
+  process.nextTick(function() {
+    return cb(null, user);
+  });
+});
+
+
+// JWT
+var jwt = require('jsonwebtoken');
+var JwtStrategy = require('passport-jwt').Strategy,
+    ExtractJwt = require('passport-jwt').ExtractJwt;
+var opts = {}
+opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
+opts.secretOrKey = keys.jwt;
+opts.issuer = config.jwtOptions.issuer;
+opts.audience = config.jwtOptions.audience;
+passport.use(new JwtStrategy(opts, async function(jwt_payload, done) {
+    const userDb = await UserDb.init();
+    try {
+        const user = await userDb.get(jwt_payload.sub);
+        if (user) {
+          return done(null, user);
+        } else {
+          return done(null, false);
+          // or you could create a new account
+        }
+    } catch (err) {
+       return done(err, false);
+    }
+}));
+
+router.post('/authenticate', async function(req, res) {
+    passport.authenticate('local', async function(err, user, info) {        
+      if (err) { return res.status(500).json({message: err.message}); }
+      if (!user) { return res.status(401).json({message: 'Incorrect email or password.'}); }
+
+      // User found, generate a JWT for the user
+      var token = jwt.sign({ sub: user._id, email: user.email }, opts.secretOrKey, {
+        issuer: opts.issuer,
+        audience: opts.audience,
+        expiresIn: 86400 * 30 // 30 days
+      });
+      res.json({ token: token });
+      //return res.status(500).json({message: 'Incorrect email or password.'})
+
+    })(req, res);
+  });
+    
+  module.exports = router;

backend/routes/favorite.js

@@ -1,7 +1,9 @@
 const controllers = require('../controllers/favorite')
 const router = require('express').Router()
+const passport = require('passport');
+const { checkIsConcernedUserOrAdmin } = require('../middleware/authMiddleware')
 
-router.post('/save/', controllers.save)
-router.get('/getAll/', controllers.getAll)
+router.post('/save/', passport.authenticate('jwt', { session: false }), controllers.save)
+router.get('/getAll/', passport.authenticate('jwt', { session: false }), controllers.getAll)
 
 module.exports = router

backend/routes/lot.js

@@ -1,12 +1,21 @@
 const controllers = require('../controllers/lot')
 const router = require('express').Router()
+const passport = require('passport');
+const { checkIsAgent, checkIsAdmin } = require('../middleware/authMiddleware')
 
-router.get('/getInfos/:url', controllers.getInfos)
-router.get('/getPictures/:url', controllers.getPictures)
-router.get('/getLotsBySale/:id', controllers.getLotsBySale)
+router.get('/getInfos/:url', passport.authenticate('jwt', { session: false }), controllers.getInfos)
+router.get('/getPictures/:url', passport.authenticate('jwt', { session: false }), controllers.getPictures)
+router.get('/getLotsBySale/:id', passport.authenticate('jwt', { session: false }), controllers.getLotsBySale)
 
-router.post('/NextItem/', controllers.NextItem)
-router.post('/AuctionedItem/', controllers.AuctionedItem)
-router.post('/Bid/', controllers.Bid)
+// DB
+router.get('/lot/:id', passport.authenticate('jwt', { session: false }), checkIsAdmin, controllers.get)
+router.post('/lot/', passport.authenticate('jwt', { session: false }), checkIsAdmin, controllers.post)
+router.put('/lot/:id', passport.authenticate('jwt', { session: false }), checkIsAdmin, controllers.put)
+router.delete('/lot/:id', passport.authenticate('jwt', { session: false }), checkIsAdmin, controllers.delete)
+
+// Live Data
+router.post('/NextItem/', checkIsAgent, controllers.NextItem)
+router.post('/AuctionedItem/', checkIsAgent, controllers.AuctionedItem)
+router.post('/Bid/', checkIsAgent, controllers.Bid)
 
 module.exports = router

backend/routes/sale.js

@@ -1,4 +1,5 @@
 const controllers = require('../controllers/sale')
+const passport = require('passport');
 const router = require('express').Router()
 
 // AuctionAgent
@@ -13,9 +14,11 @@ router.post('/sale/', controllers.post)
 router.put('/sale/:id', controllers.put)
 router.delete('/sale/:id', controllers.delete)
 
-router.get('/getAll/', controllers.getAll)
+//router.get('/getAll/', controllers.getAll)
+router.get('/getAll/', passport.authenticate('jwt', { session: false }), controllers.getAll);
 router.get('/getByUrl/:url', controllers.getByUrl)
 router.get('/postProcessing/:id', controllers.postProcessing)
+router.get('/SaleStatXsl/:id', controllers.SaleStatXsl)
 
 
 module.exports = router

backend/routes/user.js

@@ -0,0 +1,15 @@
+const controllers = require('../controllers/user')
+const passport = require('passport');
+const router = require('express').Router()
+const { checkIsConcernedUserOrAdmin, checkIsAdmin } = require('../middleware/authMiddleware')
+
+// DB
+router.get('/user/:id', passport.authenticate('jwt', { session: false }), checkIsConcernedUserOrAdmin, controllers.get);
+router.post('/user/', controllers.post)
+router.put('/user/:id', passport.authenticate('jwt', { session: false }), checkIsConcernedUserOrAdmin, controllers.put)
+router.delete('/user/:id', passport.authenticate('jwt', { session: false }), checkIsConcernedUserOrAdmin, controllers.delete)
+
+router.get('/current', passport.authenticate('jwt', { session: false }), controllers.current)
+router.get('/getAllUsers', passport.authenticate('jwt', { session: false }), checkIsAdmin, controllers.getAllUsers)
+
+module.exports = router