Joururi/spellsaurus
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- [API] Added User routes (need polishing because it parses and sends sensitive data)

Browse Source
This commit is contained in:
Alexis
2020-05-23 21:48:27 +02:00
parent 64389a3c07
commit 08b0b94bd8
10 changed files with 794 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
routes/auth.js Normal file
View File

@@ -0,0 +1,7 @@
const jwt = require('jsonwebtoken')
const isAuthenticated = (req, res, next) => {
if (typeof req.headers.authorization !== undefined) {
let token = req.headers.authorization.split(" ")[1]
}
}

2
routes/index.js
View File

@@ -1,7 +1,9 @@
const users = require('./users')
const spells = require('./spells')
const schools = require('./schools')
module.exports = {
spells,
schools,
users
}

207
routes/spells.js
View File

@@ -121,17 +121,17 @@ const addSpell = (s) => {
let query =
'INSERT INTO spell (name, description'
if (s.level != undefined) { query += ', level' }
if (s.charge != undefined) { query += ', charge' }
if (s.cost != undefined) { query += ', cost' }
if (s.is_ritual != undefined) { query += ', is_ritual' }
if (typeof s.level !== undefined) { query += ', level' }
if (typeof s.charge !== undefined) { query += ', charge' }
if (typeof s.cost !== undefined) { query += ', cost' }
if (typeof s.is_ritual !== undefined) { query += ', is_ritual' }
query += `) VALUES (${db.escape(s.name)}, ${db.escape(s.description)}`
if (s.level != undefined) { query += `, ${s.level}` }
if (s.charge != undefined) { query += `, ${s.charge}` }
if (s.cost != undefined) { query += `, ${db.escape(s.cost)}` }
if (s.is_ritual != undefined) { query += `, ${s.is_ritual}` }
if (typeof s.level !== undefined) { query += `, ${s.level}` }
if (typeof s.charge !== undefined) { query += `, ${s.charge}` }
if (typeof s.cost !== undefined) { query += `, ${db.escape(s.cost)}` }
if (typeof s.is_ritual !== undefined) { query += `, ${s.is_ritual}` }
query += ')'
@@ -145,7 +145,7 @@ const addSpell = (s) => {
let addSchoolsData = () => {
return new Promise((resolve, reject) => {
if (s.schools != undefined) {
if (typeof s.schools !== undefined) {
if (s.schools.length > 0) {
for (let i = 0; i < s.schools.length; i++) {
if (!regexInt.test(s.schools[i].id)) {
@@ -174,7 +174,7 @@ const addSpell = (s) => {
let addVariablesData = () => {
return new Promise((resolve, reject) => {
if (s.variables != undefined) {
if (typeof s.variables !== undefined) {
if (s.variables.length > 0) {
for (let i = 0; i < s.variables.length; i++) {
if (!regexInt.test(s.variables[i].id)) {
@@ -202,7 +202,7 @@ const addSpell = (s) => {
let addIngredientsData = () => {
return new Promise((resolve, reject) => {
if (s.ingredients != undefined) {
if (typeof s.ingredients !== undefined) {
if (s.ingredients.length > 0) {
for (let i = 0; i < s.ingredients.length; i++) {
if (!regexInt.test(s.ingredients[i].id)) {
@@ -279,12 +279,12 @@ const updateSpell = (s, id) => {
let query =
'UPDATE spell SET '
if (s.name != undefined) { query += `name = "${s.name}" ` }
if (s.description != undefined) { query += `, description = "${s.description}" ` }
if (s.level != undefined) { query += `, level = ${s.level} ` }
if (s.charge != undefined) { query += `, charge = ${s.charge} ` }
if (s.cost != undefined) { query += `, cost = "${s.cost}" ` }
if (s.is_ritual != undefined) { query += `, is_ritual = ${s.is_ritual} ` }
if (typeof s.name !== undefined) { query += `name = "${s.name}" ` }
if (typeof s.description !== undefined) { query += `, description = "${s.description}" ` }
if (typeof s.level !== undefined) { query += `, level = ${s.level} ` }
if (typeof s.charge !== undefined) { query += `, charge = ${s.charge} ` }
if (typeof s.cost !== undefined) { query += `, cost = "${s.cost}" ` }
if (typeof s.is_ritual !== undefined) { query += `, is_ritual = ${s.is_ritual} ` }
query += ` WHERE id = ${db.escape(id)}`
@@ -296,7 +296,7 @@ const updateSpell = (s, id) => {
let updateSchoolsData = () => {
return new Promise((resolve, reject) => {
if (s.schools != undefined) {
if (typeof s.schools !== undefined) {
if (s.schools.length > 0) {
let delete_schools_query =
`DELETE FROM spells_schools WHERE id_spell = ${old_spell.id}`
@@ -333,7 +333,7 @@ const updateSpell = (s, id) => {
let updateVariablesData = () => {
return new Promise((resolve, reject) => {
if (s.variables != undefined) {
if (typeof s.variables !== undefined) {
if (s.variables.length > 0) {
let delete_variables_query =
`DELETE FROM spells_variables WHERE id_spell = ${old_spell.id}`
@@ -370,7 +370,7 @@ const updateSpell = (s, id) => {
let updateIngredientsData = () => {
return new Promise((resolve, reject) => {
if (s.ingredients != undefined) {
if (typeof s.ingredients !== undefined) {
if (s.ingredients.length > 0) {
let delete_ingredients_query =
`DELETE FROM spells_ingredients WHERE id_spell = ${old_spell.id}`
@@ -450,90 +450,86 @@ const deleteSpell = (id) => {
// Check if spell exists
let old_spell = await getSpell(id)
.catch(() => {
reject((new HttpError(404, 'No spell matching this ID')))
})
let deleteSchoolsData = () => {
return new Promise((resolve, reject) => {
let delete_schools_query = `DELETE FROM spells_schools WHERE id_spell = ${db.escape(id)}`
db.query(delete_schools_query, async (err, result) => {
if (err) {
reject(new HttpError(500, 'Spell schools deletion failed'))
} else {
console.log(`Deleted schools associated to spell ID ${db.escape(id)}`)
resolve()
}
})
})
}
let deleteVariablesData = () => {
return new Promise((resolve, reject) => {
let delete_variables_query = `DELETE FROM spells_variables WHERE id_spell = ${db.escape(id)}`
db.query(delete_variables_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell variables deletion failed'))
} else {
console.log(`Deleted variables associated to spell ID ${db.escape(id)}`)
resolve()
}
})
})
}
let deleteIngredientsData = () => {
return new Promise((resolve, reject) => {
let delete_ingredients_query = `DELETE FROM spells_ingredients WHERE id_spell = ${db.escape(id)}`
db.query(delete_ingredients_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell ingredients deletion failed'))
} else {
console.log(`Deleted ingredients associated to spell ID ${db.escape(id)}`)
resolve()
}
})
})
}
let deleteSpellData = () => {
return new Promise((resolve, reject) => {
let delete_spell_query = `DELETE FROM spell WHERE id = ${db.escape(id)}`
db.query(delete_spell_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell deletion failed'))
} else {
console.log(`Deleted spell ID ${db.escape(id)}, affecting ${result.affectedRows} rows`)
resolve()
}
})
})
}
const promises = [
deleteSchoolsData(),
deleteVariablesData(),
deleteIngredientsData()
]
Promise.all(promises)
.then(() => {
deleteSpellData()
let response = {
message: `Spell ID ${id} was successfully deleted.`
}
resolve(response)
})
.catch(err => {
reject(err)
})
if (old_spell == undefined) {
reject((new HttpError(404, 'No spells matching this ID')))
} else {
let deleteSchoolsData = () => {
return new Promise((resolve, reject) => {
let delete_schools_query = `DELETE FROM spells_schools WHERE id_spell = ${db.escape(id)}`
db.query(delete_schools_query, async (err, result) => {
if (err) {
reject(new HttpError(500, 'Spell schools deletion failed'))
} else {
console.log(`Deleted schools associated to spell ID ${db.escape(id)}`)
resolve()
}
})
})
}
let deleteVariablesData = () => {
return new Promise((resolve, reject) => {
let delete_variables_query = `DELETE FROM spells_variables WHERE id_spell = ${db.escape(id)}`
db.query(delete_variables_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell variables deletion failed'))
} else {
console.log(`Deleted variables associated to spell ID ${db.escape(id)}`)
resolve()
}
})
})
}
let deleteIngredientsData = () => {
return new Promise((resolve, reject) => {
let delete_ingredients_query = `DELETE FROM spells_ingredients WHERE id_spell = ${db.escape(id)}`
db.query(delete_ingredients_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell ingredients deletion failed'))
} else {
console.log(`Deleted ingredients associated to spell ID ${db.escape(id)}`)
resolve()
}
})
})
}
let deleteSpellData = () => {
return new Promise((resolve, reject) => {
let delete_spell_query = `DELETE FROM spell WHERE id = ${db.escape(id)}`
db.query(delete_spell_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell deletion failed'))
} else {
console.log(`Deleted spell ID ${db.escape(id)}, affecting ${result.affectedRows} rows`)
resolve()
}
})
})
}
const promises = [
deleteSchoolsData(),
deleteVariablesData(),
deleteIngredientsData()
]
Promise.all(promises)
.then(() => {
deleteSpellData()
let response = {
message: `Spell ID ${id} was successfully deleted.`
}
resolve(response)
})
.catch(err => {
reject(err)
})
}
})
.catch(err => {
throw err
@@ -584,7 +580,7 @@ const buildSpell = async (spell) => {
let fetchSpellSchoolData = (s) => {
return new Promise((resolve, reject) => {
if (s == undefined) { reject(new HttpError(404, "Error: No spells matching this ID"))}
if (typeof s == undefined) { reject(new HttpError(404, "Error: No spell matching this ID"))}
let query =
"SELECT school.id, school.name " +
@@ -607,7 +603,7 @@ const buildSpell = async (spell) => {
let fetchSpellVariablesData = (s) => {
return new Promise((resolve, reject) => {
if (s == undefined) { reject(new HttpError(404, "Error: No spells matching this ID"))}
if (typeof s == undefined) { reject(new HttpError(404, "Error: No spell matching this ID"))}
let query =
"SELECT variable.id, variable.description " +
@@ -630,7 +626,7 @@ const buildSpell = async (spell) => {
let fetchSpellIngredientsData = (s) => {
return new Promise((resolve, reject) => {
if (s == undefined) { reject(new HttpError(404, "Error: No spells matching this ID"))}
if (typeof s == undefined) { reject(new HttpError(404, "Error: No spell matching this ID"))}
let query =
"SELECT ingredient.id, ingredient.name " +
@@ -660,7 +656,7 @@ const buildSpell = async (spell) => {
return s
}
// Check if spell is null
// Check if object is null
const isEmptyObject = (obj) => {
if (Object.keys(obj).length === 0 && obj.constructor === Object) {
return true
@@ -669,6 +665,7 @@ const isEmptyObject = (obj) => {
}
}
// Check if script injection attempt
const isXSSAttempt = (string) => {
if (regexXSS.test(string)) {
return true

243
routes/users.js Normal file
View File

@@ -0,0 +1,243 @@
// Router
const express = require('express')
let router = express.Router()
// Connection
const connection = require('../database/connection')
const db = connection.db
// Hashing and passwords
const bcrypt = require('bcrypt')
// Validations
const regexInt = RegExp(/^[1-9]\d*$/)
const regexXSS = RegExp(/<[^>]*script/)
// Model validation
const Validator = require('jsonschema').Validator
const v = new Validator()
const User = require("../models/User")
v.addSchema(User, "/UserModel")
// Error handling
const { HttpError } = require('../models/Errors')
// ROUTES
// GET ALL ------------------
const getUsers = () => {
return new Promise((resolve, reject) => {
let query = "SELECT DISTINCT * FROM user"
db.query(query, async (err, result) => {
if (err) {
reject(new HttpError(500, 'Database error'))
} else if (result.length == 0) {
reject(new HttpError(404, 'No users were found'))
} else {
resolve(result)
}
})
})
.catch(err => {
throw err
})
}
router.get('/', async (req, res) => {
getUsers()
.then(v => {
res.setHeader('Content-Type', 'application/json;charset=utf-8')
res.end(JSON.stringify(v))
})
.catch(err => {
res.status(err.code).send(JSON.stringify(
{
"error": err.message,
"code": err.code
})
)
})
})
// GET ONE ------------------
const getUser = (id) => {
return new Promise((resolve, reject) => {
let query = "SELECT * FROM user WHERE id = " + db.escape(id)
db.query(query, async (err, result) => {
if (err) {
reject(new HttpError(500, 'Database error'))
} else if (result.length == 0) {
reject(new HttpError(404, 'No User matching this ID'))
} else {
resolve(result)
}
})
})
.catch(err => {
throw err
})
}
router.get('/:id/', async (req, res) => {
getUser(req.params.id)
.then(v => {
res.setHeader('Content-Type', 'application/json;charset=utf-8')
res.end(JSON.stringify(v))
})
.catch(err => {
res.status(err.code).send(JSON.stringify(
{
"error": err.message,
"code": err.code
})
)
})
})
// CREATE ONE ------------------
const addUser = (u) => {
return new Promise(async (resolve, reject) => {
// Checks if body exists and if the model fits, and throws errors if it doesn't
if (isEmptyObject(u)) {
reject(new HttpError(403, "Error: User cannot be empty !"))
} else if (!v.validate(u, User).valid) {
reject(new HttpError(403, "Error: Schema is not valid - " + v.validate(u, User).errors))
} else if (isXSSAttempt(u.name) || isXSSAttempt(u.mail) || isXSSAttempt(u.password)) {
reject(new HttpError(403, 'Injection attempt detected, aborting the request.'))
} else {
let query = `INSERT INTO user (name, mail, password) VALUES (${db.escape(u.name)}, ${db.escape(u.mail)}, ${db.escape(u.password)})`
db.query(query, async (err, result) => {
if (err) {
reject(new HttpError(500, 'Database error'))
} else {
console.log(`Inserted "${u.name}" with ID ${result.insertId}, affecting ${result.affectedRows} row(s)`)
const new_user_id = result.insertId
let response = {
"message": `User created successfully !`,
"inserted_id": `${new_user_id}`
}
resolve(response)
}
})
}
}).catch(err => {
throw err
})
}
router.post('/', async (req, res) => {
addUser(req.body)
.then(v => {
res.setHeader('Content-Type', 'application/json;charset=utf-8')
res.send(JSON.stringify(v))
})
.catch(err => {
res.status(err.code).send(JSON.stringify(
{
"error": err.message,
"code": err.code
})
)
})
})
// DELETE ONE ------------------
const deleteUser = (id) => {
return new Promise(async (resolve, reject) => {
// Check if user exists
let old_user = await getUser(id)
.catch(() => {
reject((new HttpError(404, 'No user matching this ID')))
})
console.log(old_user)
let deleteUserData = () => {
return new Promise((resolve, reject) => {
let delete_user_query = `DELETE FROM user WHERE id = ${db.escape(id)}`
db.query(delete_user_query, async (err, result) => {
if (err) {
console.log(err)
reject(new HttpError(500, 'Spell deletion failed'))
} else {
let response = {
"message": "User delete successully",
"deleted_id": `${id}`
}
resolve(response)
}
})
})
}
deleteUserData()
.then(v => {
resolve(v)
})
.catch(err => {
reject(err)
})
})
.catch(err => {
throw err
})
}
router.delete('/:id/', async (req, res) => {
deleteUser(req.params.id)
.then(v => {
res.setHeader('Content-Type', 'application/json;charset=utf-8')
res.send(JSON.stringify(v))
})
.catch(err => {
res.status(err.code).send(JSON.stringify(
{
"error": err.message,
"code": err.code
})
)
})
})
// Param validation for single user
// (check if id is int) (could be refactored)
router.param('id', (req, res, next, id) => {
try {
if (regexInt.test(id)) {
next()
} else {
throw new HttpError(403, 'Provided ID must be an integer and not zero')
}
} catch (err) {
res.status(err.code).send(JSON.stringify(
{
"error": err.message,
})
)
}
})
// Check if object is null
const isEmptyObject = (obj) => {
if (Object.keys(obj).length === 0 && obj.constructor === Object) {
return true
} else {
return false
}
}
// Check if script injection attempt
const isXSSAttempt = (string) => {
if (regexXSS.test(string)) {
return true
} else {
return false
}
}
module.exports = router