From a64229d1dc605360d489eedf77e413bce1160b90 Mon Sep 17 00:00:00 2001 From: VLE2FE Date: Fri, 24 Apr 2020 12:25:32 +0200 Subject: [PATCH] added GET /user route --- oas/schemas.yaml | 1 + oas/user.yaml | 117 +++++++++++++--- src/db.ts | 3 +- src/models/user.ts | 2 +- src/routes/root.spec.ts | 2 +- src/routes/user.spec.ts | 263 +++++++++++++++++++++++++++++++++++- src/routes/user.ts | 21 ++- src/routes/validate/user.ts | 7 +- src/test/db.json | 2 +- 9 files changed, 385 insertions(+), 33 deletions(-) diff --git a/oas/schemas.yaml b/oas/schemas.yaml index d4151d1..4d8a805 100644 --- a/oas/schemas.yaml +++ b/oas/schemas.yaml @@ -1,5 +1,6 @@ Id: type: string + example: 5ea0450ed851c30a90e70894 _Id: properties: _id: diff --git a/oas/user.yaml b/oas/user.yaml index 4042901..763a051 100644 --- a/oas/user.yaml +++ b/oas/user.yaml @@ -1,6 +1,6 @@ /users: get: - summary: TODO lists all users + summary: lists all users description: 'Auth: basic, levels: admin' tags: - /user @@ -21,12 +21,10 @@ $ref: 'oas.yaml#/components/responses/403' 500: $ref: 'oas.yaml#/components/responses/500' -/user/{name}: - parameters: - - $ref: 'oas.yaml#/components/parameters/Name' +/user: get: - summary: TODO list user details - description: 'Auth: basic, levels: read, write, maintain, dev get their own information without a name property specified, level: admin can get any user using the name parameter' + summary: list own user details + description: 'Auth: basic, levels: read, write, maintain, admin' tags: - /user security: @@ -37,9 +35,7 @@ content: application/json: schema: - type: array - items: - $ref: 'oas.yaml#/components/schemas/User' + $ref: 'oas.yaml#/components/schemas/User' 400: $ref: 'oas.yaml#/components/responses/400' 401: @@ -52,7 +48,98 @@ $ref: 'oas.yaml#/components/responses/500' put: summary: TODO change user details - description: 'Auth: basic, levels: read, write, maintain, dev can change their own information (except level) without a name property specified, level: admin can change any user using the name parameter' + description: 'Auth: basic, levels: read, write, maintain, admin' + tags: + - /user + security: + - BasicAuth: [] + requestBody: + required: true + content: + application/json: + schema: + allOf: + - $ref: 'oas.yaml#/components/schemas/_Id' + - $ref: 'oas.yaml#/components/schemas/UserName' + - $ref: 'oas.yaml#/components/schemas/Email' + properties: + pass: + type: string + writeOnly: true + example: Abc123!# + location: + type: string + example: Rng + device_name: + type: string + example: Alpha II + responses: + 200: + description: user details + content: + application/json: + schema: + $ref: 'oas.yaml#/components/schemas/User' + 400: + $ref: 'oas.yaml#/components/responses/400' + 401: + $ref: 'oas.yaml#/components/responses/401' + 403: + $ref: 'oas.yaml#/components/responses/403' + 404: + $ref: 'oas.yaml#/components/responses/404' + 500: + $ref: 'oas.yaml#/components/responses/500' + delete: + summary: TODO delete user + description: 'Auth: basic, levels: read, write, maintain, admin' + tags: + - /user + security: + - BasicAuth: [] + responses: + 200: + $ref: 'oas.yaml#/components/responses/Ok' + 400: + $ref: 'oas.yaml#/components/responses/400' + 401: + $ref: 'oas.yaml#/components/responses/401' + 403: + $ref: 'oas.yaml#/components/responses/403' + 404: + $ref: 'oas.yaml#/components/responses/404' + 500: + $ref: 'oas.yaml#/components/responses/500' +/user/{name}: + parameters: + - $ref: 'oas.yaml#/components/parameters/Name' + get: + summary: list user details + description: 'Auth: basic, levels: admin' + tags: + - /user + security: + - BasicAuth: [] + responses: + 200: + description: user details + content: + application/json: + schema: + $ref: 'oas.yaml#/components/schemas/User' + 400: + $ref: 'oas.yaml#/components/responses/400' + 401: + $ref: 'oas.yaml#/components/responses/401' + 403: + $ref: 'oas.yaml#/components/responses/403' + 404: + $ref: 'oas.yaml#/components/responses/404' + 500: + $ref: 'oas.yaml#/components/responses/500' + put: + summary: TODO change user details + description: 'Auth: basic, levels: admin' tags: - /user security: @@ -69,9 +156,7 @@ content: application/json: schema: - type: array - items: - $ref: 'oas.yaml#/components/schemas/User' + $ref: 'oas.yaml#/components/schemas/User' 400: $ref: 'oas.yaml#/components/responses/400' 401: @@ -84,7 +169,7 @@ $ref: 'oas.yaml#/components/responses/500' delete: summary: TODO delete user - description: 'Auth: basic, levels: read, write, maintain, dev can delete their own account, level: admin can delete any user using the name parameter' + description: 'Auth: basic, levels: admin' tags: - /user security: @@ -123,7 +208,7 @@ $ref: 'oas.yaml#/components/responses/500' /user/new: post: - summary: TODO add new user + summary: add new user description: 'Auth: basic, levels: admin' tags: - /user @@ -160,7 +245,7 @@ $ref: 'oas.yaml#/components/responses/500' /user/passreset: post: - summary: TODO reset password and send mail to restore + summary: reset password and send mail to restore description: 'Auth: none' tags: - /user diff --git a/src/db.ts b/src/db.ts index 00477da..e624696 100644 --- a/src/db.ts +++ b/src/db.ts @@ -35,7 +35,7 @@ export default class db { } // connect to db - mongoose.connect(connectionString, {useNewUrlParser: true, useUnifiedTopology: true}, err => { + mongoose.connect(connectionString, {useNewUrlParser: true, useUnifiedTopology: true, useCreateIndex: true}, err => { if (err) done(err); }); mongoose.connection.on('error', console.error.bind(console, 'connection error:')); @@ -89,7 +89,6 @@ export default class db { let loadCounter = 0; // count number of loaded collections to know when to return done() Object.keys(json.collections).forEach(collectionName => { // create each collection for(let i in json.collections[collectionName]) { // convert $oid fields to actual ObjectIds - console.log(json.collections[collectionName][i]); Object.keys(json.collections[collectionName][i]).forEach(key => { json.collections[collectionName][i][key] = json.collections[collectionName][i][key].hasOwnProperty('$oid') ? mongoose.Types.ObjectId(json.collections[collectionName][i][key].$oid) : json.collections[collectionName][i][key]; }) diff --git a/src/models/user.ts b/src/models/user.ts index b72dabb..50178a6 100644 --- a/src/models/user.ts +++ b/src/models/user.ts @@ -1,7 +1,7 @@ import mongoose from 'mongoose'; const UserSchema = new mongoose.Schema({ - name: String, + name: {type: String, index: {unique: true}}, email: String, pass: String, key: String, diff --git a/src/routes/root.spec.ts b/src/routes/root.spec.ts index 61544a8..9372259 100644 --- a/src/routes/root.spec.ts +++ b/src/routes/root.spec.ts @@ -3,7 +3,7 @@ import should from 'should/as-function'; import db from '../db'; -describe('/', () => { +describe('GET /', () => { let server; before(done => { diff --git a/src/routes/user.spec.ts b/src/routes/user.spec.ts index c4511ec..93b598b 100644 --- a/src/routes/user.spec.ts +++ b/src/routes/user.spec.ts @@ -4,7 +4,258 @@ import db from '../db'; import UserModel from '../models/user'; -describe('/user/new', () => { +describe('GET /users', () => { + let server; + + before(done => { + process.env.port = '2999'; + process.env.NODE_ENV = 'test'; + db.connect('test', done); + }); + beforeEach(done => { + delete require.cache[require.resolve('../index')]; // prevent loading from cache + server = require('../index'); + db.drop(err => { // reset database + if (err) return done(err); + db.loadJson(require('../test/db.json'), done); + }); + }); + afterEach(done => { + server.close(done); + }); + it('returns all users', done => { + supertest(server) + .get('/users') + .auth('admin', 'Abc123!#') + .expect('Content-type', /json/) + .expect(200) + .end((err, res) => { + if (err) done (err); + const json = require('../test/db.json'); + should(res.body).have.lengthOf(json.collections.users.length); + should(res.body).matchEach(user => { + should(user).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name'); + should(user).have.property('_id').be.type('string'); + should(user).have.property('email').be.type('string'); + should(user).have.property('name').be.type('string'); + should(user).have.property('level').be.type('string'); + should(user).have.property('location').be.type('string'); + should(user).have.property('device_name').be.type('string'); + }); + done(); + }); + }); + it('rejects requests from non-admins', done => { + supertest(server) + .get('/users') + .auth('janedoe', 'Xyz890*)') + .expect('Content-type', /json/) + .expect(403) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Forbidden'}); + done(); + }); + }); + it('rejects requests from an admin API key', done => { + supertest(server) + .get('/users?key=5ea131671feb9c2ee0aafc9a') + .expect('Content-type', /json/) + .expect(401) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Unauthorized'}); + done(); + }); + }); +}); + + +describe('GET /user/{name}', () => { + let server; + + before(done => { + process.env.port = '2999'; + process.env.NODE_ENV = 'test'; + db.connect('test', done); + }); + beforeEach(done => { + delete require.cache[require.resolve('../index')]; // prevent loading from cache + server = require('../index'); + db.drop(err => { // reset database + if (err) return done(err); + db.loadJson(require('../test/db.json'), done); + }); + }); + afterEach(done => { + server.close(done); + }); + it('returns own user details', done => { + supertest(server) + .get('/user') + .auth('janedoe', 'Xyz890*)') + .expect('Content-type', /json/) + .expect(200) + .end((err, res) => { + if (err) done (err); + should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name'); + should(res.body).have.property('_id').be.type('string'); + should(res.body).have.property('email', 'jane.doe@bosch.com'); + should(res.body).have.property('name', 'janedoe'); + should(res.body).have.property('level', 'write'); + should(res.body).have.property('location', 'Rng'); + should(res.body).have.property('device_name', 'Alpha I'); + done(); + }); + }); + it('returns other user details for admin', done => { + supertest(server) + .get('/user/janedoe') + .auth('admin', 'Abc123!#') + .expect('Content-type', /json/) + .expect(200) + .end((err, res) => { + if (err) done (err); + should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name'); + should(res.body).have.property('_id').be.type('string'); + should(res.body).have.property('email', 'jane.doe@bosch.com'); + should(res.body).have.property('name', 'janedoe'); + should(res.body).have.property('level', 'write'); + should(res.body).have.property('location', 'Rng'); + should(res.body).have.property('device_name', 'Alpha I'); + done(); + }); + }); + it('rejects requests from non-admins for another user', done => { + supertest(server) + .get('/user/admin') + .auth('janedoe', 'Xyz890*)') + .expect('Content-type', /json/) + .expect(403) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Forbidden'}); + done(); + }); + }); + it('rejects requests from a user API key', done => { + supertest(server) + .get('/user?key=5ea0450ed851c30a90e70899') + .expect('Content-type', /json/) + .expect(401) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Unauthorized'}); + done(); + }); + }); + it('rejects requests from an admin API key', done => { + supertest(server) + .get('/user/janedoe?key=5ea131671feb9c2ee0aafc9a') + .expect('Content-type', /json/) + .expect(401) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Unauthorized'}); + done(); + }); + }); +}); + + +describe('PUT /user/{name}', () => { + let server; + + before(done => { + process.env.port = '2999'; + process.env.NODE_ENV = 'test'; + db.connect('test', done); + }); + beforeEach(done => { + delete require.cache[require.resolve('../index')]; // prevent loading from cache + server = require('../index'); + db.drop(err => { // reset database + if (err) return done(err); + db.loadJson(require('../test/db.json'), done); + }); + }); + afterEach(done => { + server.close(done); + }); + it('returns own user details', done => { + supertest(server) + .get('/user') + .auth('janedoe', 'Xyz890*)') + .expect('Content-type', /json/) + .expect(200) + .end((err, res) => { + if (err) done (err); + should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name'); + should(res.body).have.property('_id').be.type('string'); + should(res.body).have.property('email', 'jane.doe@bosch.com'); + should(res.body).have.property('name', 'janedoe'); + should(res.body).have.property('level', 'write'); + should(res.body).have.property('location', 'Rng'); + should(res.body).have.property('device_name', 'Alpha I'); + done(); + }); + }); + it('returns other user details for admin', done => { + supertest(server) + .get('/user/janedoe') + .auth('admin', 'Abc123!#') + .expect('Content-type', /json/) + .expect(200) + .end((err, res) => { + if (err) done (err); + should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name'); + should(res.body).have.property('_id').be.type('string'); + should(res.body).have.property('email', 'jane.doe@bosch.com'); + should(res.body).have.property('name', 'janedoe'); + should(res.body).have.property('level', 'write'); + should(res.body).have.property('location', 'Rng'); + should(res.body).have.property('device_name', 'Alpha I'); + done(); + }); + }); + it('rejects requests from non-admins for another user', done => { + supertest(server) + .get('/user/admin') + .auth('janedoe', 'Xyz890*)') + .expect('Content-type', /json/) + .expect(403) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Forbidden'}); + done(); + }); + }); + it('rejects requests from a user API key', done => { + supertest(server) + .get('/user?key=5ea0450ed851c30a90e70899') + .expect('Content-type', /json/) + .expect(401) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Unauthorized'}); + done(); + }); + }); + it('rejects requests from an admin API key', done => { + supertest(server) + .get('/user/janedoe?key=5ea131671feb9c2ee0aafc9a') + .expect('Content-type', /json/) + .expect(401) + .end((err, res) => { + if (err) done (err); + should(res.body).be.eql({status: 'Unauthorized'}); + done(); + }); + }); +}); + + +describe('POST /user/new', () => { let server; before(done => { @@ -32,6 +283,7 @@ describe('/user/new', () => { .expect(200) .end((err, res) => { if (err) done (err); + should(res.body).have.only.keys('_id', 'email', 'name', 'level', 'location', 'device_name'); should(res.body).have.property('_id').be.type('string'); should(res.body).have.property('email', 'john.doe@bosch.com'); should(res.body).have.property('name', 'johndoe'); @@ -83,7 +335,7 @@ describe('/user/new', () => { it('rejects requests from non-admins', done => { supertest(server) .post('/user/new') - .auth('janedoe', 'Abc123!#') + .auth('janedoe', 'Xyz890*)') .send({email: 'john.doe@bosch.com', name: 'johndoe', pass: 'Abc123!#', level: 'read', location: 'Rng', device_name: 'Alpha II'}) .expect('Content-type', /json/) .expect(403) @@ -108,9 +360,7 @@ describe('/user/new', () => { }); - - -describe('/user/passreset', () => { +describe('POST /user/passreset', () => { let server; before(done => { @@ -191,11 +441,10 @@ describe('/user/passreset', () => { should(res.body).be.eql({status: 'OK'}); UserModel.find({name: 'janedoe'}).lean().exec( (err, data: any) => { if (err) return done(err); - console.log(data); should(data[0].pass).not.eql(oldpass); done(); }); }); }); }); -}); \ No newline at end of file +}); diff --git a/src/routes/user.ts b/src/routes/user.ts index cd67d14..0865fac 100644 --- a/src/routes/user.ts +++ b/src/routes/user.ts @@ -8,7 +8,24 @@ import mail from '../helpers/mail'; const router = express.Router(); router.get('/users', (req, res) => { - res.json({message: 'users up and running!'}); + if (!req.auth(res, ['admin'], 'basic')) return; + + UserModel.find({}).lean().exec( (err, data:any) => { + res.json(data.map(e => UserValidate.output(e)).filter(e => e !== null)); // validate all and filter null values from validation errors + }); +}); + +router.get('/user/:username*?', (req, res) => { + if (!req.auth(res, ['read', 'write', 'maintain', 'dev', 'admin'], 'basic')) return; + let username = req.authDetails.username; + if (req.params.username !== undefined) { + if (!req.auth(res, ['admin'], 'basic')) return; + username = req.params.username; + } + + UserModel.findOne({name: username}).lean().exec( (err, data:any) => { + res.json(UserValidate.output(data)); // validate all and filter null values from validation errors + }); }); router.post('/user/new', (req, res, next) => { @@ -22,7 +39,7 @@ router.post('/user/new', (req, res, next) => { } // check that user does not already exist - UserModel.find({name: user.name}).lean().exec( 'find', (err, data) => { + UserModel.find({name: user.name}).lean().exec( (err, data:any) => { if (err) next(err); if (data.length > 0) { res.status(400).json({status: 'Username already taken'}); diff --git a/src/routes/validate/user.ts b/src/routes/validate/user.ts index 1cccf41..26becdd 100644 --- a/src/routes/validate/user.ts +++ b/src/routes/validate/user.ts @@ -33,13 +33,14 @@ export default class UserValidate { // validate input for user } static output (data) { // validate output from database for needed properties, strip everything else - return joi.object({ + const {value, error} = joi.object({ _id: joi.any(), name: joi.string(), email: joi.string(), level: joi.string(), location: joi.string(), - device_name: joi.string() - }).validate(data, {stripUnknown: true}).value; + device_name: joi.string().allow('') + }).validate(data, {stripUnknown: true}) + return error !== undefined? null : value; } } diff --git a/src/test/db.json b/src/test/db.json index af2d78f..4c2c645 100644 --- a/src/test/db.json +++ b/src/test/db.json @@ -5,7 +5,7 @@ "_id": {"$oid":"5ea0450ed851c30a90e70894"}, "email": "jane.doe@bosch.com", "name": "janedoe", - "pass": "$2a$10$i872o3qR5V3JnbDArD8Z.eDo.BNPDBaR7dUX9KSEtl9pUjLyucy2K", + "pass": "$2a$10$di26XKF63OG0V00PL1kSK.ceCcTxDExBMOg.jkHiCnXcY7cN7DlPi", "level": "write", "location": "Rng", "device_name": "Alpha I",