t1meshift
/
expressCart
mirror of https://github.com/t1meshift/expressCart.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Refactor user route

master
Mark Moffat 2019-11-09 09:48:32 +10:30
parent f43005de8b
commit 1deb54d525
1 changed files with 200 additions and 137 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

337
routes/user.js
View File

@ -5,61 +5,69 @@ const colors = require('colors');
const bcrypt = require('bcryptjs'); const bcrypt = require('bcryptjs');
const router = express.Router(); const router = express.Router();
router.get('/admin/users', restrict, (req, res) => { router.get('/admin/users', restrict, async (req, res) => {
const db = req.app.db; const db = req.app.db;
db.users.find({}).toArray((err, users) => { const users = await db.users.find({}, { projection: { userPassword: 0 } }).toArray();
if(err){
console.info(err.stack); if(req.apiAuthenticated){
} res.status(200).json(users);
res.render('users', { return;
title: 'Users', }
users: users,
admin: true, res.render('users', {
config: req.app.config, title: 'Users',
isAdmin: req.session.isAdmin, users: users,
helpers: req.handlebars.helpers, admin: true,
session: req.session, config: req.app.config,
message: common.clearSessionValue(req.session, 'message'), isAdmin: req.session.isAdmin,
messageType: common.clearSessionValue(req.session, 'messageType') helpers: req.handlebars.helpers,
}); session: req.session,
message: common.clearSessionValue(req.session, 'message'),
messageType: common.clearSessionValue(req.session, 'messageType')
}); });
}); });
// edit user // edit user
router.get('/admin/user/edit/:id', restrict, (req, res) => { router.get('/admin/user/edit/:id', restrict, async (req, res) => {
const db = req.app.db; const db = req.app.db;
db.users.findOne({ _id: common.getId(req.params.id) }, (err, user) => { const user = await db.users.findOne({ _id: common.getId(req.params.id) });
if(err){
console.info(err.stack);
}
// Check user is found // Check user is found
if(!user){ if(!user){
req.session.message = 'User not found'; if(req.apiAuthenticated){
req.session.messageType = 'danger'; res.status(400).json({ message: 'User not found' });
res.redirect('/admin/users');
return; return;
} }
// if the user we want to edit is not the current logged in user and the current user is not req.session.message = 'User not found';
// an admin we render an access denied message req.session.messageType = 'danger';
if(user.userEmail !== req.session.user && req.session.isAdmin === false){ res.redirect('/admin/users');
req.session.message = 'Access denied'; return;
req.session.messageType = 'danger'; }
res.redirect('/admin/users');
// if the user we want to edit is not the current logged in user and the current user is not
// an admin we render an access denied message
if(user.userEmail !== req.session.user && req.session.isAdmin === false){
if(req.apiAuthenticated){
res.status(400).json({ message: 'Access denied' });
return; return;
} }
res.render('user_edit', { req.session.message = 'Access denied';
title: 'User edit', req.session.messageType = 'danger';
user: user, res.redirect('/admin/users');
admin: true, return;
session: req.session, }
message: common.clearSessionValue(req.session, 'message'),
messageType: common.clearSessionValue(req.session, 'messageType'), res.render('user_edit', {
helpers: req.handlebars.helpers, title: 'User edit',
config: req.app.config user: user,
}); admin: true,
session: req.session,
message: common.clearSessionValue(req.session, 'message'),
messageType: common.clearSessionValue(req.session, 'messageType'),
helpers: req.handlebars.helpers,
config: req.app.config
}); });
}); });
@ -82,6 +90,11 @@ router.get('/admin/user/delete/:id', restrict, async (req, res) => {
// userId // userId
if(req.session.isAdmin !== true){ if(req.session.isAdmin !== true){
if(req.apiAuthenticated){
res.status(400).json({ message: 'Access denied' });
return;
}
req.session.message = 'Access denied.'; req.session.message = 'Access denied.';
req.session.messageType = 'danger'; req.session.messageType = 'danger';
res.redirect('/admin/users'); res.redirect('/admin/users');
@ -90,6 +103,11 @@ router.get('/admin/user/delete/:id', restrict, async (req, res) => {
// Cannot delete your own account // Cannot delete your own account
if(req.session.userId === req.params.id){ if(req.session.userId === req.params.id){
if(req.apiAuthenticated){
res.status(400).json({ message: 'Unable to delete own user account' });
return;
}
req.session.message = 'Unable to delete own user account.'; req.session.message = 'Unable to delete own user account.';
req.session.messageType = 'danger'; req.session.messageType = 'danger';
res.redirect('/admin/users'); res.redirect('/admin/users');
@ -100,6 +118,11 @@ router.get('/admin/user/delete/:id', restrict, async (req, res) => {
// If user is not found // If user is not found
if(!user){ if(!user){
if(req.apiAuthenticated){
res.status(400).json({ message: 'User not found.' });
return;
}
req.session.message = 'User not found.'; req.session.message = 'User not found.';
req.session.messageType = 'danger'; req.session.messageType = 'danger';
res.redirect('/admin/users'); res.redirect('/admin/users');
@ -108,139 +131,179 @@ router.get('/admin/user/delete/:id', restrict, async (req, res) => {
// Cannot delete the original user/owner // Cannot delete the original user/owner
if(user.isOwner){ if(user.isOwner){
if(req.apiAuthenticated){
res.status(400).json({ message: 'Access denied.' });
return;
}
req.session.message = 'Access denied.'; req.session.message = 'Access denied.';
req.session.messageType = 'danger'; req.session.messageType = 'danger';
res.redirect('/admin/users'); res.redirect('/admin/users');
return; return;
} }
db.users.deleteOne({ _id: common.getId(req.params.id) }, {}, (err, numRemoved) => { try{
if(err){ await db.users.deleteOne({ _id: common.getId(req.params.id) }, {});
console.info(err.stack); if(req.apiAuthenticated){
res.status(200).json({ message: 'User deleted.' });
return;
} }
req.session.message = 'User deleted.'; req.session.message = 'User deleted.';
req.session.messageType = 'success'; req.session.messageType = 'success';
res.redirect('/admin/users'); res.redirect('/admin/users');
}); }catch(ex){
console.log('Failed to delete user', ex);
if(req.apiAuthenticated){
res.status(200).json({ message: 'Cannot delete user' });
return;
}
req.session.message = 'Cannot delete user';
req.session.messageType = 'danger';
res.redirect('/admin/users');
};
}); });
// update a user // update a user
router.post('/admin/user/update', restrict, (req, res) => { router.post('/admin/user/update', restrict, async (req, res) => {
const db = req.app.db; const db = req.app.db;
let isAdmin = req.body.user_admin === 'on'; let isAdmin = req.body.user_admin === 'on';
// get the user we want to update // get the user we want to update
db.users.findOne({ _id: common.getId(req.body.userId) }, (err, user) => { const user = await db.users.findOne({ _id: common.getId(req.body.userId) });
if(err){
console.info(err.stack);
}
// If the current user changing own account ensure isAdmin retains existing // If user not found
if(user.userEmail === req.session.user){ if(!user){
isAdmin = user.isAdmin; if(req.apiAuthenticated){
} res.status(400).json({ message: 'User not found' });
// if the user we want to edit is not the current logged in user and the current user is not
// an admin we render an access denied message
if(user.userEmail !== req.session.user && req.session.isAdmin === false){
req.session.message = 'Access denied';
req.session.messageType = 'danger';
res.redirect('/admin/users');
return; return;
} }
// create the update doc req.session.message = 'User not found';
const updateDoc = {}; req.session.messageType = 'danger';
updateDoc.isAdmin = isAdmin; res.redirect('/admin/users');
updateDoc.usersName = req.body.usersName; return;
if(req.body.userPassword){ }
updateDoc.userPassword = bcrypt.hashSync(req.body.userPassword);
// If the current user changing own account ensure isAdmin retains existing
if(user.userEmail === req.session.user){
isAdmin = user.isAdmin;
}
// if the user we want to edit is not the current logged in user and the current user is not
// an admin we render an access denied message
if(user.userEmail !== req.session.user && req.session.isAdmin === false){
if(req.apiAuthenticated){
res.status(400).json({ message: 'Access denied' });
return;
} }
db.users.updateOne({ _id: common.getId(req.body.userId) }, req.session.message = 'Access denied';
req.session.messageType = 'danger';
res.redirect('/admin/users');
return;
}
// create the update doc
const updateDoc = {};
updateDoc.isAdmin = isAdmin;
updateDoc.usersName = req.body.usersName;
if(req.body.userPassword){
updateDoc.userPassword = bcrypt.hashSync(req.body.userPassword);
}
try{
await db.users.updateOne(
{ _id: common.getId(req.body.userId) },
{ {
$set: updateDoc $set: updateDoc
}, { multi: false }, (err, numReplaced) => { }, { multi: false }
if(err){ );
console.error(colors.red('Failed updating user: ' + err)); if(req.apiAuthenticated){
req.session.message = 'Failed to update user'; res.status(200).json({ message: 'User account updated.' });
req.session.messageType = 'danger'; return;
res.redirect('/admin/user/edit/' + req.body.userId); }
}else{ // show the view
// show the view req.session.message = 'User account updated.';
req.session.message = 'User account updated.'; req.session.messageType = 'success';
req.session.messageType = 'success'; res.redirect('/admin/user/edit/' + req.body.userId);
res.redirect('/admin/user/edit/' + req.body.userId); }catch(ex){
} if(req.apiAuthenticated){
}); res.status(400).json({ message: 'Failed to update user' });
}); return;
}
console.error(colors.red('Failed updating user: ' + ex));
req.session.message = 'Failed to update user';
req.session.messageType = 'danger';
res.redirect('/admin/user/edit/' + req.body.userId);
}
}); });
// insert a user // insert a user
router.post('/admin/user/insert', restrict, (req, res) => { router.post('/admin/user/insert', restrict, async (req, res) => {
const db = req.app.db; const db = req.app.db;
// set the account to admin if using the setup form. Eg: First user account // set the account to admin if using the setup form. Eg: First user account
const urlParts = new URL(req.header('Referer')); const urlParts = new URL(req.header('Referer'));
// Check number of users // Check number of users
db.users.countDocuments({}, (err, userCount) => { const userCount = await db.users.countDocuments({});
let isAdmin = false; let isAdmin = false;
// if no users, setup user as admin // if no users, setup user as admin
if(userCount === 0){ if(userCount === 0){
isAdmin = true; isAdmin = true;
}
const doc = {
usersName: req.body.usersName,
userEmail: req.body.userEmail,
userPassword: bcrypt.hashSync(req.body.userPassword, 10),
isAdmin: isAdmin
};
// check for existing user
const user = await db.users.findOne({ userEmail: req.body.userEmail });
if(user){
if(req.apiAuthenticated){
res.status(400).json({ message: 'A user with that email address already exists' });
return;
}
// user already exists with that email address
console.error(colors.red('Failed to insert user, possibly already exists: ' + err));
req.session.message = 'A user with that email address already exists';
req.session.messageType = 'danger';
res.redirect('/admin/user/new');
return;
}
// email is ok to be used.
try{
await db.users.insertOne(doc);
// if from setup we add user to session and redirect to login.
// Otherwise we show users screen
if(urlParts.path === '/admin/setup'){
req.session.user = req.body.userEmail;
res.redirect('/admin/login');
return;
}
if(req.apiAuthenticated){
res.status(200).json({ message: 'User account inserted' });
return;
} }
const doc = { req.session.message = 'User account inserted';
usersName: req.body.usersName, req.session.messageType = 'success';
userEmail: req.body.userEmail, res.redirect('/admin/users');
userPassword: bcrypt.hashSync(req.body.userPassword, 10), }catch(ex){
isAdmin: isAdmin if(req.apiAuthenticated){
}; res.status(400).json({ message: 'New user creation failed' });
return;
// check for existing user }
db.users.findOne({ userEmail: req.body.userEmail }, (err, user) => { console.error(colors.red('Failed to insert user: ' + ex));
if(user){ req.session.message = 'New user creation failed';
// user already exists with that email address req.session.messageType = 'danger';
console.error(colors.red('Failed to insert user, possibly already exists: ' + err)); res.redirect('/admin/user/new');
req.session.message = 'A user with that email address already exists'; }
req.session.messageType = 'danger';
res.redirect('/admin/user/new');
return;
}
// email is ok to be used.
db.users.insertOne(doc, (err, doc) => {
// show the view
if(err){
if(doc){
console.error(colors.red('Failed to insert user: ' + err));
req.session.message = 'User exists';
req.session.messageType = 'danger';
res.redirect('/admin/user/edit/' + doc._id);
return;
}
console.error(colors.red('Failed to insert user: ' + err));
req.session.message = 'New user creation failed';
req.session.messageType = 'danger';
res.redirect('/admin/user/new');
return;
}
req.session.message = 'User account inserted';
req.session.messageType = 'success';
// if from setup we add user to session and redirect to login.
// Otherwise we show users screen
if(urlParts.path === '/admin/setup'){
req.session.user = req.body.userEmail;
res.redirect('/admin/login');
return;
}
res.redirect('/admin/users');
});
});
});
}); });
module.exports = router; module.exports = router;