feat: implement auth for folders

backend/middleware/auth.js

@@ -1,9 +1,10 @@
 const jwt = require('jsonwebtoken');
 const { roles, memberRoles, defaultDangerKey } = require('../routes/users/authSettings');
-const defineProject = require('../models/projects');
-const defineUser = require('../models/users');
 const { DataTypes } = require('sequelize');
+const defineUser = require('../models/users');
 const defineMember = require('../models/members');
+const defineProject = require('../models/projects');
+const defineFolder = require('../models/folders');
 
 function authMiddleware(sequelize) {
   /**
@@ -56,7 +57,7 @@ function authMiddleware(sequelize) {
   async function verifyProjectVisible(req, res, next) {
     const Project = defineProject(sequelize, DataTypes);
 
-    const projectId = req.params.projectId;
+    const projectId = req.params.projectId || req.query.projectId;
     if (!projectId) {
       return res.status(400).json({ error: 'projectId is required' });
     }
@@ -100,7 +101,7 @@ function authMiddleware(sequelize) {
 
   /**
    * Verify user has permission of project management
-   * (User must be the owner or manager of the project )
+   * (User must be the owner or manager of the project)
    * (have to be called after verifySignedIn() middleware)
    */
   async function verifyProjectManager(req, res, next) {
@@ -140,7 +141,69 @@ function authMiddleware(sequelize) {
     return res.status(403).json({ error: 'Forbidden' });
   }
 
-  return { verifySignedIn, verifyAdmin, verifyProjectVisible, verifyProjectOwner, verifyProjectManager };
+  /**
+   * Verify user has permission of project development
+   * (User must be the owner or manager or developer of the project)
+   * (have to be called after verifySignedIn() middleware)
+   */
+  async function verifyProjectDeveloper(req, res, next) {
+    const Project = defineProject(sequelize, DataTypes);
+    const Folder = defineFolder(sequelize, DataTypes);
+
+    let projectId = req.params.projectId || req.query.projectId;
+    const folderId = req.params.folderId || req.query.folderId;
+    if (!projectId && !folderId) {
+      return res.status(400).json({ error: 'projectId or folderId is required' });
+    }
+
+    if (!projectId) {
+      // find project id from folderId
+      const folder = await Folder.findByPk(folderId);
+      if (folder && folder.projectId) {
+        projectId = folder.projectId;
+      } else {
+        return res.status(404).send('failed to find project from folderId');
+      }
+    }
+
+    const project = await Project.findByPk(projectId);
+    if (!project) {
+      return res.status(404).send('Project not found');
+    }
+
+    if (project.userId === req.userId) {
+      next();
+      return;
+    }
+
+    // check the user is manager or developer of the project
+    const Member = defineMember(sequelize, DataTypes);
+    const member = await Member.findOne({
+      where: {
+        userId: req.userId,
+        projectId: projectId,
+      },
+    });
+    if (member) {
+      const managerRoleIndex = memberRoles.findIndex((entry) => entry.uid === 'manager');
+      const developerRoleIndex = memberRoles.findIndex((entry) => entry.uid === 'developer');
+      if (member.role === managerRoleIndex || member.role === developerRoleIndex) {
+        next();
+        return;
+      }
+    }
+
+    return res.status(403).json({ error: 'Forbidden' });
+  }
+
+  return {
+    verifySignedIn,
+    verifyAdmin,
+    verifyProjectVisible,
+    verifyProjectOwner,
+    verifyProjectManager,
+    verifyProjectDeveloper,
+  };
 }
 
 module.exports = authMiddleware;

backend/routes/folders/delete.js

@@ -4,9 +4,10 @@ const defineFolder = require('../../models/folders');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectDeveloper } = require('../../middleware/auth')(sequelize);
   const Folder = defineFolder(sequelize, DataTypes);
 
-  router.delete('/:folderId', async (req, res) => {
+  router.delete('/:folderId', verifySignedIn, verifyProjectDeveloper, async (req, res) => {
     const folderId = req.params.folderId;
     try {
       const folder = await Folder.findByPk(folderId);

backend/routes/folders/edit.js

@@ -4,9 +4,10 @@ const defineFolder = require('../../models/folders');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectDeveloper } = require('../../middleware/auth')(sequelize);
   const Folder = defineFolder(sequelize, DataTypes);
 
-  router.put('/:folderId', async (req, res) => {
+  router.put('/:folderId', verifySignedIn, verifyProjectDeveloper, async (req, res) => {
     const folderId = req.params.folderId;
     const { name, detail, projectId, parentFolderId } = req.body;
     try {

backend/routes/folders/index.js

@@ -4,9 +4,10 @@ const defineFolder = require('../../models/folders');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectVisible } = require('../../middleware/auth')(sequelize);
   const Folder = defineFolder(sequelize, DataTypes);
 
-  router.get('/', async (req, res) => {
+  router.get('/', verifySignedIn, verifyProjectVisible, async (req, res) => {
     const { projectId } = req.query;
 
     if (!projectId) {

backend/routes/folders/new.js

@@ -4,11 +4,13 @@ const defineFolder = require('../../models/folders');
 const { DataTypes } = require('sequelize');
 
 module.exports = function (sequelize) {
+  const { verifySignedIn, verifyProjectDeveloper } = require('../../middleware/auth')(sequelize);
   const Folder = defineFolder(sequelize, DataTypes);
 
-  router.post('/', async (req, res) => {
+  router.post('/', verifySignedIn, verifyProjectDeveloper, async (req, res) => {
     try {
-      const { name, detail, projectId, parentFolderId } = req.body;
+      const projectId = req.query.projectId;
+      const { name, detail, parentFolderId } = req.body;
       if (!name || !projectId) {
         return res.status(400).json({ error: 'Name and projectId are required' });
       }