Check user auth in api request

backend/middleware/auth.js

@@ -0,0 +1,21 @@
+const jwt = require('jsonwebtoken');
+const { defaultDangerKey } = require('../routes/auth/authSettings');
+
+function verifySinedIn(req, res, next) {
+  const token = req.header('Authorization');
+  const secretKey = process.env.SECRET_KEY || defaultDangerKey;
+
+  if (!token) {
+    return res.status(401).json({ error: 'Access denied' });
+  }
+
+  try {
+    const decoded = jwt.verify(token, secretKey);
+    req.userId = decoded.userId;
+    next();
+  } catch (error) {
+    res.status(401).json({ error: 'Invalid token' });
+  }
+}
+
+module.exports = { verifySinedIn };

backend/routes/auth/authSettings.js

@@ -0,0 +1,4 @@
+const roles = [{ uid: 'admin' }, { uid: 'moderator' }, { uid: 'user' }];
+const defaultDangerKey = 'test-plat-default-key';
+
+module.exports = { roles, defaultDangerKey };

backend/routes/auth/roles.js

@@ -1,2 +0,0 @@
-const roles = [{ uid: 'admin' }, { uid: 'moderator' }, { uid: 'user' }];
-module.exports = roles;

backend/routes/auth/signin.js

@@ -4,9 +4,11 @@ const defineUser = require('../../models/users');
 const { DataTypes } = require('sequelize');
 const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
+const { defaultDangerKey } = require('./authSettings');
 
 module.exports = function (sequelize) {
   const User = defineUser(sequelize, DataTypes);
+  const secretKey = process.env.SECRET_KEY || defaultDangerKey;
 
   router.post('/signin', async (req, res) => {
     try {
@@ -24,7 +26,7 @@ module.exports = function (sequelize) {
       if (!passwordMatch) {
         return res.status(401).json({ error: 'Authentication failed' });
       }
-      const accessToken = jwt.sign({ userId: user.id }, 'your-secret-key', {
+      const accessToken = jwt.sign({ userId: user.id }, secretKey, {
         expiresIn: '1h',
       });
       res.status(200).json({ access_token: accessToken, user });

backend/routes/auth/signup.js

@@ -2,12 +2,13 @@ const express = require('express');
 const router = express.Router();
 const defineUser = require('../../models/users');
 const { DataTypes } = require('sequelize');
-const roles = require('./roles');
+const { roles, defaultDangerKey } = require('./authSettings');
 const bcrypt = require('bcrypt');
 const jwt = require('jsonwebtoken');
 
 module.exports = function (sequelize) {
   const User = defineUser(sequelize, DataTypes);
+  const secretKey = process.env.SECRET_KEY || defaultDangerKey;
 
   router.post('/signup', async (req, res) => {
     try {
@@ -27,7 +28,7 @@ module.exports = function (sequelize) {
         role: initialRole,
       });
 
-      const accessToken = jwt.sign({ userId: user.id }, 'your-secret-key', {
+      const accessToken = jwt.sign({ userId: user.id }, secretKey, {
         expiresIn: '1h',
       });
 

backend/routes/projects/index.js

@@ -2,11 +2,12 @@ const express = require('express');
 const router = express.Router();
 const defineProject = require('../../models/projects');
 const { DataTypes } = require('sequelize');
+const { verifySinedIn } = require('../../middleware/auth');
 
 module.exports = function (sequelize) {
   const Project = defineProject(sequelize, DataTypes);
 
-  router.get('/', async (req, res) => {
+  router.get('/', verifySinedIn, async (req, res) => {
     try {
       const projects = await Project.findAll();
       res.json(projects);

backend/routes/projects/show.js

@@ -3,19 +3,25 @@ const router = express.Router();
 const defineProject = require('../../models/projects');
 const defineFolder = require('../../models/folders');
 const { DataTypes } = require('sequelize');
+const { verifySinedIn } = require('../../middleware/auth');
 
 module.exports = function (sequelize) {
   const Project = defineProject(sequelize, DataTypes);
   const Folder = defineFolder(sequelize, DataTypes);
   Project.hasMany(Folder, { foreignKey: 'projectId' });
 
-  router.get('/:projectId', async (req, res) => {
+  router.get('/:projectId', verifySinedIn, async (req, res) => {
     const projectId = req.params.projectId;
 
     if (!projectId) {
       return res.status(400).json({ error: 'projectId is required' });
     }
 
+    // if project is private, only project owner can access
+    if (!project.isPublic && project.userId !== req.userId) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+
     try {
       const project = await Project.findByPk(projectId, {
         include: [