Create admin page

backend/index.js

@@ -28,11 +28,13 @@ const sequelize = new Sequelize({
 const indexRoute = require('./routes/index');
 app.use('/', indexRoute);
 
-// "auth"
-const signUpRoute = require('./routes/auth/signup')(sequelize);
-const signInRoute = require('./routes/auth/signin')(sequelize);
-app.use('/auth', signUpRoute);
-app.use('/auth', signInRoute);
+// "users"
+const usersIndexRoute = require('./routes/users/index')(sequelize);
+const signUpRoute = require('./routes/users/signup')(sequelize);
+const signInRoute = require('./routes/users/signin')(sequelize);
+app.use('/users', usersIndexRoute);
+app.use('/users', signUpRoute);
+app.use('/users', signInRoute);
 
 // "/projects"
 const projectsIndexRoute = require('./routes/projects/index')(sequelize);

backend/middleware/auth.js

@@ -1,6 +1,7 @@
 const jwt = require('jsonwebtoken');
-const { defaultDangerKey } = require('../routes/auth/authSettings');
+const { roles, defaultDangerKey } = require('../routes/users/authSettings');
 const defineProject = require('../models/projects');
+const defineUser = require('../models/users');
 const { DataTypes } = require('sequelize');
 
 function authMiddleware(sequelize) {
@@ -27,6 +28,26 @@ function authMiddleware(sequelize) {
     }
   }
 
+  /**
+   * Verify user is admin
+   * (have to be called after verifySignedIn() middleware)
+   */
+  async function verifyAdmin(req, res, next) {
+    const User = defineUser(sequelize, DataTypes);
+    const user = await User.findByPk(req.userId);
+    if (!user) {
+      return res.status(404).send('User not found');
+    }
+
+    // if project is private, only project owner can access
+    const adminRoleIndex = roles.findIndex((entry) => entry.uid === 'administrator');
+    if (user.role !== adminRoleIndex) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
+    next();
+  }
+
   /**
    * Verify user can access project
    * (have to be called after verifySignedIn() middleware)
@@ -76,7 +97,7 @@ function authMiddleware(sequelize) {
     next();
   }
 
-  return { verifySignedIn, verifyProjectVisible, verifyProjectOwner };
+  return { verifySignedIn, verifyAdmin, verifyProjectVisible, verifyProjectOwner };
 }
 
 module.exports = authMiddleware;

backend/routes/users/authSettings.js

@@ -1,4 +1,4 @@
-const roles = [{ uid: 'admin' }, { uid: 'moderator' }, { uid: 'user' }];
+const roles = [{ uid: 'administrator' }, { uid: 'user' }];
 const defaultDangerKey = 'test-plat-default-key';
 
 module.exports = { roles, defaultDangerKey };

backend/routes/users/index.js

@@ -0,0 +1,21 @@
+const express = require('express');
+const router = express.Router();
+const defineUser = require('../../models/users');
+const { DataTypes } = require('sequelize');
+
+module.exports = function (sequelize) {
+  const { verifySignedIn, verifyAdmin } = require('../../middleware/auth')(sequelize);
+  const User = defineUser(sequelize, DataTypes);
+
+  router.get('/', verifySignedIn, verifyAdmin, async (req, res) => {
+    try {
+      const users = await User.findAll();
+      res.json(users);
+    } catch (error) {
+      console.error(error);
+      res.status(500).send('Internal Server Error');
+    }
+  });
+
+  return router;
+};

backend/routes/users/signup.js

@@ -19,7 +19,7 @@ module.exports = function (sequelize) {
       const initialRole =
         userCount > 0
           ? roles.findIndex((entry) => entry.uid === 'user')
-          : roles.findIndex((entry) => entry.uid === 'admin');
+          : roles.findIndex((entry) => entry.uid === 'administrator');
 
       const user = await User.create({
         email,

backend/seeders/seed.js

@@ -12,7 +12,7 @@ module.exports = {
         email: 'admin@testplat.com',
         password: hashedPassword,
         username: 'Admin',
-        role: 1,
+        role: 0,
         avatarPath: null,
         createdAt: new Date(),
         updatedAt: new Date(),