Check user auth in api request

backend/middleware/auth.js

@@ -1,21 +1,82 @@
 const jwt = require('jsonwebtoken');
 const { defaultDangerKey } = require('../routes/auth/authSettings');
+const defineProject = require('../models/projects');
+const { DataTypes } = require('sequelize');
 
-function verifySinedIn(req, res, next) {
-  const token = req.header('Authorization');
-  const secretKey = process.env.SECRET_KEY || defaultDangerKey;
+function authMiddleware(sequelize) {
+  /**
+   * Verify user sined in
+   *
+   * If verification is successful, set userId in req.userId.
+   */
+  function verifySignedIn(req, res, next) {
+    const authHeader = req.header('Authorization');
+    const secretKey = process.env.SECRET_KEY || defaultDangerKey;
 
-  if (!token) {
-    return res.status(401).json({ error: 'Access denied' });
+    const token = authHeader.split(' ')[1]; // delete 'Bearer '
+    if (!token) {
+      return res.status(401).json({ error: 'Access denied' });
+    }
+
+    try {
+      const decoded = jwt.verify(token, secretKey);
+      req.userId = decoded.userId;
+      next();
+    } catch (error) {
+      res.status(401).json({ error: 'Invalid token' });
+    }
   }
 
-  try {
-    const decoded = jwt.verify(token, secretKey);
-    req.userId = decoded.userId;
+  /**
+   * Verify user can access project
+   * (have to be called after verifySignedIn() middleware)
+   */
+  async function verifyProjectVisible(req, res, next) {
+    const Project = defineProject(sequelize, DataTypes);
+
+    const projectId = req.params.projectId;
+    if (!projectId) {
+      return res.status(400).json({ error: 'projectId is required' });
+    }
+
+    const project = await Project.findByPk(projectId);
+    if (!project) {
+      return res.status(404).send('Project not found');
+    }
+
+    // if project is private, only project owner can access
+    if (!project.isPublic && project.userId !== req.userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
     next();
-  } catch (error) {
-    res.status(401).json({ error: 'Invalid token' });
   }
+
+  /**
+   * Verify user has project
+   * (have to be called after verifySignedIn() middleware)
+   */
+  async function verifyProjectOwner(req, res, next) {
+    const Project = defineProject(sequelize, DataTypes);
+
+    const projectId = req.params.projectId;
+    if (!projectId) {
+      return res.status(400).json({ error: 'projectId is required' });
+    }
+
+    const project = await Project.findByPk(projectId);
+    if (!project) {
+      return res.status(404).send('Project not found');
+    }
+
+    if (project.userId !== req.userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
+    next();
+  }
+
+  return { verifySignedIn, verifyProjectVisible, verifyProjectOwner };
 }
 
-module.exports = { verifySinedIn };
+module.exports = authMiddleware;

backend/routes/home/index.js

@@ -8,6 +8,8 @@ const defineRunCase = require('../../models/runCases');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
+
   const Project = defineProject(sequelize, DataTypes);
   const Folder = defineFolder(sequelize, DataTypes);
   const Case = defineCase(sequelize, DataTypes);
@@ -18,7 +20,7 @@ module.exports = function (sequelize) {
   Project.hasMany(Run, { foreignKey: 'projectId' });
   Run.hasMany(RunCase, { foreignKey: 'runId' });
 
-  router.get('/:projectId', async (req, res) => {
+  router.get('/:projectId', verifySignedIn, verifyProjectVisible, async (req, res) => {
     const projectId = req.params.projectId;
 
     if (!projectId) {

backend/routes/projects/delete.js

@@ -4,9 +4,10 @@ const defineProject = require('../../models/projects');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectOwner } = require('../../middleware/auth')(sequelize);
   const Project = defineProject(sequelize, DataTypes);
 
-  router.delete('/:projectId', async (req, res) => {
+  router.delete('/:projectId', verifySignedIn, verifyProjectOwner, async (req, res) => {
     const projectId = req.params.projectId;
     try {
       const project = await Project.findByPk(projectId);

backend/routes/projects/edit.js

@@ -4,9 +4,10 @@ const defineProject = require('../../models/projects');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectOwner } = require('../../middleware/auth')(sequelize);
   const Project = defineProject(sequelize, DataTypes);
 
-  router.put('/:projectId', async (req, res) => {
+  router.put('/:projectId', verifySignedIn, verifyProjectOwner, async (req, res) => {
     const projectId = req.params.projectId;
     const { name, detail, isPublic } = req.body;
     try {

backend/routes/projects/index.js

@@ -1,15 +1,19 @@
 const express = require('express');
 const router = express.Router();
 const defineProject = require('../../models/projects');
-const { DataTypes } = require('sequelize');
-const { verifySinedIn } = require('../../middleware/auth');
+const { DataTypes, Op } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn } = require('../../middleware/auth')(sequelize);
   const Project = defineProject(sequelize, DataTypes);
 
-  router.get('/', verifySinedIn, async (req, res) => {
+  router.get('/', verifySignedIn, async (req, res) => {
     try {
-      const projects = await Project.findAll();
+      const projects = await Project.findAll({
+        where: {
+          [Op.or]: [{ isPublic: true }, { userId: req.userId }],
+        },
+      });
       res.json(projects);
     } catch (error) {
       console.error(error);

backend/routes/projects/new.js

@@ -4,16 +4,17 @@ const defineProject = require('../../models/projects');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn } = require('../../middleware/auth')(sequelize);
   const Project = defineProject(sequelize, DataTypes);
 
-  router.post('/', async (req, res) => {
+  router.post('/', verifySignedIn, async (req, res) => {
     try {
-      const { name, detail, isPublic, userId } = req.body;
+      const { name, detail, isPublic } = req.body;
       const newProject = await Project.create({
         name,
         detail,
         isPublic,
-        userId,
+        userId: req.userId,
       });
       res.json(newProject);
     } catch (error) {

backend/routes/projects/show.js

@@ -3,25 +3,19 @@ const router = express.Router();
 const defineProject = require('../../models/projects');
 const defineFolder = require('../../models/folders');
 const { DataTypes } = require('sequelize');
-const { verifySinedIn } = require('../../middleware/auth');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
   const Project = defineProject(sequelize, DataTypes);
   const Folder = defineFolder(sequelize, DataTypes);
   Project.hasMany(Folder, { foreignKey: 'projectId' });
 
-  router.get('/:projectId', verifySinedIn, async (req, res) => {
+  router.get('/:projectId', verifySignedIn, verifyProjectVisible, async (req, res) => {
     const projectId = req.params.projectId;
-
     if (!projectId) {
       return res.status(400).json({ error: 'projectId is required' });
     }
 
-    // if project is private, only project owner can access
-    if (!project.isPublic && project.userId !== req.userId) {
-      return res.status(403).json({ error: 'Forbidden' });
-    }
-
     try {
       const project = await Project.findByPk(projectId, {
         include: [