Merge pull request #55 from CTFNote/feat/middleware-user-team-#50

Create middleware to attach users and teams to requests that need it.

NOTE: HAS NOT BEEN TESTED - PRIORITY ON #44

Author: theS1LV3R

package.json

@@ -10,7 +10,7 @@
   "scripts": {
     "start": "cross-env NODE_ENV=production node dist/app.js",
     "build": "tsc",
-    "dev": "cross-env NODE_ENV=development nodemon",
+    "dev": "cross-env NODE_ENV=development nodemon --exec 'ts-node --files' src/app.ts",
     "lint": "eslint src",
     "release": "standard-version && echo \"REMEMBER TO TAG THE MERGE COMMIT\""
   },

src/api/v1/ctf.ts

@@ -2,11 +2,12 @@ import { NextFunction, Request, Response, Router } from "express";
 import Logger from "../../loaders/logger";
 
 import CTFService from "../../services/CTF";
-import { UnauthorizedError } from "../../types/httperrors";
 import { notImplemented } from "../../util";
+import attachUser from "../../util/middleware/user";
 
 export default (): Router => {
   const router = Router({ mergeParams: true });
+  router.use(attachUser());
 
   router.route("/").get(listCTFs).post(createCTF).all(notImplemented);
   router.route("/:ctfID").get(getCTF).all(notImplemented);
@@ -19,96 +20,60 @@ export default (): Router => {
 const _CTFService = new CTFService();
 
 function createCTF(req: Request, res: Response, next: NextFunction) {
-  if (!req.headers.authorization) {
-    next(
-      new UnauthorizedError({
-        errorMessage: "Missing authorization",
-        errorCode: "error_unauthorized",
-      })
-    );
-  }
-
-  Logger.verbose(`Creating new CTF for team ${req.params.teamID}`);
+  Logger.verbose(`Creating new CTF for team ${req.team._id}`);
   Logger.debug(JSON.stringify({ ...req.body }));
   _CTFService
-    .createCTF(req.headers.authorization.slice(7), req.params.teamID, req.body)
+    .createCTF(req.user, req.team, req.body)
     .then((ctfDetails) => {
       res.status(201).send(ctfDetails);
     })
     .catch((err) => next(err));
 }
 
 function listCTFs(req: Request, res: Response, next: NextFunction) {
-  if (!req.headers.authorization) {
-    next(
-      new UnauthorizedError({
-        errorMessage: "Missing authorization",
-        errorCode: "error_unauthorized",
-      })
-    );
-  }
-
-  Logger.verbose(`Getting list of CTFs for team ${req.params.teamID}`);
+  Logger.verbose(`Getting list of CTFs for team ${req.team._id}`);
   _CTFService
-    .listCTFs(req.headers.authorization.slice(7), req.params.teamID, req.body.includeArchived ?? undefined)
+    .listCTFs(
+      req.user,
+      req.team,
+      req.body.includeArchived ?? undefined
+    )
     .then((CTFs) => {
       res.status(200).send(CTFs);
     })
     .catch((err) => next(err));
 }
 
 function getCTF(req: Request, res: Response, next: NextFunction) {
-  if (!req.headers.authorization) {
-    next(
-      new UnauthorizedError({
-        errorMessage: "Missing authorization",
-        errorCode: "error_unauthorized",
-      })
-    );
-  }
-
-  Logger.verbose(`Getting CTF with ID ${req.params.ctfID} from team ${req.params.teamID}`);
+  Logger.verbose(
+    `Getting CTF with ID ${req.params.ctfID} from team ${req.team._id}`
+  );
   _CTFService
-    .getCTF(req.headers.authorization.slice(7), req.params.teamID, req.params.ctfID)
+    .getCTF(req.user, req.team, req.params.ctfID)
     .then((CTF) => {
       res.status(200).send(CTF);
     })
     .catch((err) => next(err));
 }
 
-
 function archiveCTF(req: Request, res: Response, next: NextFunction) {
-  if (!req.headers.authorization) {
-    next(
-      new UnauthorizedError({
-        errorMessage: "Missing authorization",
-        errorCode: "error_unauthorized",
-      })
-    );
-  }
-
-  Logger.verbose(`Archiving CTF with ID ${req.params.ctfID} in team ${req.params.teamID}`);
+  Logger.verbose(
+    `Archiving CTF with ID ${req.params.ctfID} in team ${req.team._id}`
+  );
   _CTFService
-    .archiveCTF(req.headers.authorization.slice(7), req.params.teamID, req.params.ctfID)
+    .archiveCTF(req.user, req.team, req.params.ctfID)
     .then((CTF) => {
       res.status(200).send(CTF);
     })
     .catch((err) => next(err));
 }
 
 function unarchiveCTF(req: Request, res: Response, next: NextFunction) {
-  if (!req.headers.authorization) {
-    next(
-      new UnauthorizedError({
-        errorMessage: "Missing authorization",
-        errorCode: "error_unauthorized",
-      })
-    );
-  }
-
-  Logger.verbose(`Unarchiving CTF with ID ${req.params.ctfID} in team ${req.params.teamID}`);
+  Logger.verbose(
+    `Unarchiving CTF with ID ${req.params.ctfID} in team ${req.team._id}`
+  );
   _CTFService
-    .unarchiveCTF(req.headers.authorization.slice(7), req.params.teamID, req.params.ctfID)
+    .unarchiveCTF(req.user, req.team, req.params.ctfID)
     .then((CTF) => {
       res.status(200).send(CTF);
     })

src/api/v1/invite.ts

@@ -1,11 +1,10 @@
 import { celebrate, Segments, Joi } from "celebrate";
 import { NextFunction, Request, Response, Router } from "express";
 
-import { UnauthorizedError } from "../../types/httperrors";
 import TeamService from "../../services/Team";
-import { verifyAuthHeader } from "../../util/celebrate";
 import { notImplemented } from "../../util";
 import Logger from "../../loaders/logger";
+import attachUser from "../../util/middleware/user";
 
 const verifyInvite = celebrate({
   [Segments.PARAMS]: Joi.object({
@@ -15,11 +14,12 @@ const verifyInvite = celebrate({
 
 export default (): Router => {
   const router = Router();
+  router.use(attachUser({ userOptional: true }));
 
   router
     .route("/:inviteID")
-    .get(verifyAuthHeader, verifyInvite, getInvite)
-    .post(verifyAuthHeader, verifyInvite, useInvite)
+    .get(verifyInvite, getInvite)
+    .post(verifyInvite, useInvite)
     .all(notImplemented);
 
   return router;
@@ -31,7 +31,7 @@ function getInvite(req: Request, res: Response, next: NextFunction) {
   Logger.verbose("Getting invite");
   Logger.debug({ inviteID: req.params.inviteID });
   teamService
-    .getInvite(req.headers.authorization?.slice(7), req.params.inviteID)
+    .getInvite(req.user, req.params.inviteID)
     .then((invite) => {
       Logger.silly("Sending invite data");
       res.send(invite);
@@ -40,18 +40,9 @@ function getInvite(req: Request, res: Response, next: NextFunction) {
 }
 
 function useInvite(req: Request, res: Response, next: NextFunction) {
-  if (!req.headers.authorization) {
-    return next(
-      new UnauthorizedError({
-        errorMessage: "Missing authorization",
-        errorCode: "error_unauthorized",
-      })
-    );
-  }
-
   Logger.verbose("Using invite and adding user to team");
   teamService
-    .useInvite(req.headers.authorization.slice(7), req.params.inviteID)
+    .useInvite(req.user, req.params.inviteID)
     .then((teamData) => {
       Logger.silly("Sending data about the team for the client");
       res.send(teamData);