- [API] Added getSchool, getSchools, and addSchools

database/auracle_db_create.sql

@@ -1,6 +1,6 @@
-DROP DATABASE IF EXISTS spellsaurus;
+DROP DATABASE IF EXISTS auracle;
-CREATE DATABASE spellsaurus CHARACTER SET utf8 COLLATE utf8_bin;
+CREATE DATABASE auracle CHARACTER SET utf8 COLLATE utf8_bin;
-USE spellsaurus;
+USE auracle;
 
 /* ==== PRIMARY TABLES ==== */
 

database/auracle_db_data.sql

@@ -1,5 +1,5 @@
 SET NAMES utf8;
-USE spellsaurus;
+USE auracle;
 
 -- META SCHOOLS
 INSERT INTO `meta_school` (name, description) VALUES
@@ -219,6 +219,7 @@ INSERT INTO `variable` (description) VALUES
 /*
 SCHEMA
 (id_spell, id_school),
+
 */
 
 DELIMITER $$

models/School.js

@@ -4,9 +4,9 @@ const School = {
     "properties": {
         "name": { "type": "string" },
         "description": { "type": "string" },
-        "meta_school": { "type": "number" },
+        "id_meta_school": { "type": "number" },
     },
-    "required": ["name", "description"]
+    "required": ["name", "description", "id_meta_school"]
 }
 
 module.exports = School

routes/schools.js

@@ -8,6 +8,10 @@ let router = express.Router()
 const connection = require('../database/connection')
 const db = connection.db
 
+// Validations
+const regexInt = RegExp(/^[1-9]\d*$/)
+const regexXSS = RegExp(/<[^>]*script/)
+
 // Model validation
 const Validator = require('jsonschema').Validator
 const v = new Validator()
@@ -21,62 +25,141 @@ const { HttpError } = require('../models/Errors')
 // ROUTES
 // GET ALL ------------------
 const getSchools = () => {
-    let getSchoolsPromise = new Promise((resolve, reject) => {
+    return new Promise((resolve, reject) => {
 
         let query = "SELECT DISTINCT * FROM school"
 
         db.query(query, async (err, result) => {
             if (err) {
-                reject(new HttpError(500, 'Error: Database error'))
+                reject(new HttpError(500, 'Database error'))
             } else if (result.length == 0) {
-                reject(new HttpError(404, 'Error: No ressource matching this id'))
+                reject(new HttpError(404, 'No schools were found'))
             }
-            result = await buildSchool(result[0])
-            resolve(result);
-        })
-    })
-    .catch(err => { throw err })
 
-    return getSchoolsPromise
+            // Loops over the results to fetch the associated tables
+            for (let i = 0; i < result.length; i++) {
+                try {
+                    result[i] = await buildSchool(result[i])
+                } catch (err) {
+                    reject(err)
                 }
-router.get('/', async (req, res, next) => {
+            }
+            resolve(result)
+        })
+    })
+    .catch(err => {
+        throw err
+    })
+}
+router.get('/', async (req, res) => {
     getSchools()
     .then(v => {
         res.setHeader('Content-Type', 'application/json;charset=utf-8')
         res.end(JSON.stringify(v))
     })
     .catch(err => {
-        res.status(err.code).send(err.message)
+        res.status(err.code).send(JSON.stringify(
+            {
+                "error": err.message,
+                "code": err.code
+            })
+        )
     })
 })
 
 
 // GET ONE ------------------
 const getSchool = (id) => {
-    let getSchoolPromise = new Promise((resolve, reject) => {
+    return new Promise((resolve, reject) => {
 
         let query = "SELECT * FROM school WHERE id = " + db.escape(id)
 
         db.query(query, async (err, result) => {
             if (err) {
-                reject(new HttpError(500, 'Error: Database error'))
+                reject(new HttpError(500, 'Database error'))
+            }
+            try {
+                result = buildSchool(result[0])
+                resolve(result)
+            } catch (err) {
+                reject(err)
             }
-            result = await buildSchool(result[0])
-            resolve(result);
         })
     })
-    .catch(err => { throw err })
+    .catch(err => {
-
+        throw err
-    return getSchoolPromise
+    })
 }
-router.get('/:id/', async (req, res, next) => {
+router.get('/:id/', async (req, res) => {
     getSchool(req.params.id)
     .then(v => {
         res.setHeader('Content-Type', 'application/json;charset=utf-8')
         res.end(JSON.stringify(v))
     })
     .catch(err => {
-        res.status(err.code).send(err.message)
+        res.status(err.code).send(JSON.stringify(
+            {
+                "error": err.message,
+                "code": err.code
+            })
+        )
+    })
+})
+
+
+// CREATE ONE ------------------
+const addSchool = (s) => {
+    return new Promise(async (resolve, reject) => {
+
+        // Checks if body exists and if the model fits, and throws errors if it doesn't
+        if (isEmptyObject(s)) {
+            reject(new HttpError(403, "Error: School cannot be nothing !"))
+        } else if (!v.validate(s, School).valid) {
+            reject(new HttpError(403, "Error: Schema is not valid - " + v.validate(s, School).errors))
+        } else if (isXSSAttempt(s.name) || isXSSAttempt(s.description)) {
+            reject(new HttpError(403, 'Injection attempt detected, aborting the request.'))
+        } else {
+            let query = `INSERT INTO school (name, description, id_meta_school) VALUES (${db.escape(s.name)}, ${db.escape(s.description)}, ${db.escape(s.id_meta_school)})`
+
+            db.query(query, (err, result) => {
+                if (err) {
+                    if (err.errno == 1452) {
+                        reject(new HttpError(404, "Error: No meta school matching this ID"))
+                    } else {
+                        reject(new HttpError(500, 'Database error'))
+                    }
+                } else {
+                    console.log(`Inserted "${s.name}" with ID ${result.insertId}, affecting ${result.affectedRows} row(s)`)
+
+                    const new_school_id = result.insertId
+    
+                    getSchool(new_school_id)
+                    .then(v => {
+                        resolve(v)
+                    })
+                    .catch(err => {
+                        reject(err)
+                    })
+                }
+            })
+        }
+    }).catch(err => {
+        throw err
+    })
+}
+router.post('/', async (req, res) => {
+    addSchool(req.body)
+    .then(v => {
+        res.setHeader('Content-Type', 'application/json;charset=utf-8')
+        res.send(JSON.stringify(v))
+    })
+    .catch(err => {
+        res.status(err.code).send(JSON.stringify(
+            {
+                "error": err.message,
+                "code": err.code
+            })
+        )
     })
 })
 
@@ -91,7 +174,12 @@ router.param('id', (req, res, next, id) => {
             throw new HttpError(403, 'Provided ID must be an integer')
         }
     } catch (err) {
-        res.status(err.code).send(err.message)
+        res.status(err.code).send(JSON.stringify(
+            {
+                "error": err.message,
+                "code": err.code
+            })
+        )
     }
 })
 
@@ -101,30 +189,38 @@ router.param('id', (req, res, next, id) => {
 const buildSchool = async (school) => {
 
     // Fetches the school's parent school
-    let fetchMetaSchoolData = new Promise((resolve, reject) => {
+    let fetchMetaSchoolData = (s) => {
+        return new Promise((resolve, reject) => {
+
+            if (s == null) { reject(new HttpError(404, "Error: No school matching this ID"))}
+
             let query =
             "SELECT ms.id, ms.name " +
             "FROM meta_school AS ms " +
-        "WHERE ms.id = " + school.id_meta_school
+            "WHERE ms.id = " + s.id_meta_school
+            
     
             db.query(query, (err, result) => {
                 if (err) {
-                reject(new HttpError(500, 'Error: Database error'))
+                    reject(new HttpError(500, 'Database error'))
                 } else {
-                resolve(result);
+                    delete s.id_meta_school
+                    s.meta_school = result
+                    resolve(s)
                 }
             })
         })
+    }
+
+    let s = fetchMetaSchoolData(school)
     .catch(err => {
-        res.status(403).send(err)
+        throw err
     })
 
-    // Builds the school and returns it
+    return s
-    school.meta_school = await fetchMetaSchoolData
-    return school
 }
 
-// Check if spell is null
+// Check if object is null
 const isEmptyObject = (obj) => {
     if (Object.keys(obj).length === 0 && obj.constructor === Object) {
         return true
@@ -133,4 +229,13 @@ const isEmptyObject = (obj) => {
     }
 }
 
+// Check if script injection attempt
+const isXSSAttempt = (string) => {
+    if (regexXSS.test(string)) {
+        return true
+    } else {
+        return false
+    }
+}
+
 module.exports = router

routes/spells.js

@@ -229,7 +229,7 @@ const addSpell = (s) => {
                 }
 
                 Promise.all([addSchoolsData(), addVariablesData(), addIngredientsData()])
-                .then(v => {
+                .then(() => {
                     resolve(getSpell(new_spell_id))
                 })
                 .catch(err => {