feat: added jwt authorization with new role system based on numeric v…

…alues

Signed-off-by: Varij Kapil <[email protected]>

server/auth/authorization.controller.js

@@ -1,6 +1,9 @@
 import * as jwt from 'jsonwebtoken';
 import crypto from 'crypto';
-const jwtSecret = 'aJWTSecret13121992for13121992jwtTokenInTheRequest13121992';
+import configuration from '../common/env.config';
+
+const {jwtSecret} = configuration;
+// created using the following tutorial : https://www.toptal.com/nodejs/secure-rest-api-in-nodejs
 class AuthorizationController {
   static login(req, res) {
     try {

server/auth/authorization.validation.controller.js

@@ -0,0 +1,26 @@
+import * as jwt from 'jsonwebtoken';
+import configuration from '../common/env.config';
+
+const {jwtSecret} = configuration;
+
+// created using the following tutorial : https://www.toptal.com/nodejs/secure-rest-api-in-nodejs
+
+export default class AuthorizationValidationController {
+  static validJWTNeeded(req, res, next) {
+    if (req.headers['authorization']) {
+      try {
+        const authorization = req.headers['authorization'].split(' ');
+        if (authorization[0] !== 'Bearer') {
+          return res.status(401).send();
+        } else {
+          req.jwt = jwt.verify(authorization[1], jwtSecret);
+          return next();
+        }
+      } catch (err) {
+        return res.status(403).send();
+      }
+    } else {
+      return res.status(401).send();
+    }
+  }
+}

server/auth/permission.controller.js

@@ -0,0 +1,23 @@
+// https://www.toptal.com/nodejs/secure-rest-api-in-nodejs
+
+/*We can use the bitwise AND operator (bitmasking) to control the permissions.
+If we set each required permission as a power of 2, we can treat each bit of the
+32bit integer as a single permission.
+
+An admin can then have all permissions by setting their permission value to 2147483647.
+That user could then have access to any route.
+As another example, a user whose permission value was set to 7 would have permissions to
+the roles marked with bits for values 1, 2, and 4 (two to the power of 0, 1, and 2).*/
+
+export default class PermissionController {
+  static minimumPermissionRequired(requiredPermissionLevel) {
+    return (req, res, next) => {
+      const userPermissionLevel = parseInt(req.jwt.roles);
+      if (userPermissionLevel & requiredPermissionLevel) {
+        return next();
+      } else {
+        return res.status(403).send();
+      }
+    };
+  }
+}

server/common/env.config.js

@@ -0,0 +1,11 @@
+const configuration = {
+  jwtSecret: '',
+  jwtExpirationInSeconds: 36000,
+  permissions: {
+    USER: 1,
+    MANAGER: 4,
+    ADMIN: 2048
+  }
+};
+
+export default configuration;

server/common/role.controller.js

@@ -0,0 +1,35 @@
+import config from './env.config';
+
+export default class RoleController {
+  static convertToInteger(roleName) {
+    if (this.__isAdmin(roleName)) {
+      return config.permissions.ADMIN;
+    }
+    if (this.__isManager(roleName)) {
+      return config.permissions.MANAGER;
+    }
+
+    return config.permissions.USER;
+  }
+
+  static __isAdmin(role) {
+    const lowerCaseRole = role.toLowerCase();
+    return lowerCaseRole === 'admin' || lowerCaseRole === 'administrator' || lowerCaseRole === 'superuser';
+  }
+
+  static __isManager(role) {
+    const lowerCaseRole = role.toLowerCase();
+    return (
+      lowerCaseRole === 'manager' ||
+      lowerCaseRole === 'manage' ||
+      lowerCaseRole === 'hr' ||
+      lowerCaseRole === 'human resource' ||
+      lowerCaseRole === 'resource' ||
+      lowerCaseRole === 'ceo' ||
+      lowerCaseRole === 'management' ||
+      lowerCaseRole === 'cto' ||
+      lowerCaseRole === 'coo' ||
+      lowerCaseRole === 'finance'
+    );
+  }
+}

server/controllers/user.controller.js

@@ -1,11 +1,12 @@
 import model from '../models';
 import crypto from 'crypto';
+import RoleController from '../common/role.controller';
 
 const {User, Avatar} = model;
 
 class UserController {
   static signUpWithAvatar(req, res) {
-    const {email, password, roles} = req.body;
+    const {password, roles} = req.body;
     // hash the password before saving in the database
     const salt = crypto.randomBytes(16).toString('base64');
     const hash = crypto
@@ -17,19 +18,19 @@ class UserController {
     const avatarId = req.params.avatarId;
     User.findAll({
       where: {avatarId},
-      attributes: {include: ['id', 'email', 'avatarId', 'createdAt']}
+      attributes: {include: ['id', 'email', 'avatarId', 'createdAt'], exclude: ['password']}
     }).then(user => {
-      if (user) {
+      if (user.length > 0) {
         return res.status(400).send({message: 'User with avatar id ' + avatarId + ' already exists', user});
       } else {
         Avatar.findByPk(avatarId)
           .then(avatar => {
             if (avatar) {
               return User.create({
-                email,
+                email: avatar.email,
                 password: hashedPassword,
                 avatarId,
-                roles
+                roles: RoleController.convertToInteger(roles)
               })
                 .then(userData =>
                   res.status(201).send({
@@ -71,7 +72,7 @@ class UserController {
           email,
           password: hashedPassword,
           avatarId: avatar.id,
-          roles
+          roles: RoleController.convertToInteger(roles)
         })
           .then(userData =>
             res.status(201).send({

server/routes/user.route.js

@@ -1,7 +1,6 @@
 import express from 'express';
 import UserController from '../controllers/user.controller';
 import AuthorizationController from '../auth/authorization.controller';
-
 const routes = express.Router();
 
 // sign ip with avatar id

server/routes/workday.route.js

@@ -1,11 +1,26 @@
 import express from 'express';
 import multer from 'multer';
 import WorkdayController from '../controllers/workday.controller';
+import PermissionController from '../auth/permission.controller';
+import AuthorizationValidationController from '../auth/authorization.validation.controller';
+import configuration from '../common/env.config';
+
+const ADMIN = configuration.permissions.ADMIN;
+const MANAGER = configuration.permissions.MANAGER;
+const USER = configuration.permissions.USER;
 
 const routes = express.Router();
 const upload = multer({storage: multer.memoryStorage()});
 
-routes.post('/:avatarId/upload', upload.single('reportFile'), WorkdayController.importTimelyFile);
-routes.post('/:avatarId', WorkdayController.addWorkday);
+routes.post('/:avatarId/upload', upload.single('reportFile'), [
+  AuthorizationValidationController.validJWTNeeded,
+  PermissionController.minimumPermissionRequired(MANAGER),
+  WorkdayController.importTimelyFile
+]);
+routes.post('/:avatarId', [
+  AuthorizationValidationController.validJWTNeeded,
+  PermissionController.minimumPermissionRequired(MANAGER),
+  WorkdayController.addWorkday
+]);
 
 export default routes;