Restructuring the Project

Updating dependencies

Backend/src/api/client/index.ts

@@ -0,0 +1,110 @@
+import { Request, Response, Router } from "express";
+import Stacker from "../middlewares/stacker";
+import {
+   GetClientAuthMiddleware,
+   GetClientApiAuthMiddleware,
+} from "../middlewares/client";
+import { GetUserMiddleware } from "../middlewares/user";
+import { createJWT } from "../../keys";
+import Client from "../../models/client";
+import RequestError, { HttpStatusCode } from "../../helper/request_error";
+import config from "../../config";
+import Mail from "../../models/mail";
+
+const ClientRouter = Router();
+
+/**
+ * @api {get} /client/user
+ *
+ * @apiDescription Can be used for simple authentication of user. It will redirect the user to the redirect URI with a very short lived jwt.
+ *
+ * @apiParam {String} redirect_uri URL to redirect to on success
+ * @apiParam {String} state A optional state, that will be included in the JWT and redirect_uri as parameter
+ *
+ * @apiName ClientUser
+ * @apiGroup client
+ *
+ * @apiPermission user_client Requires ClientID and Authenticated User
+ */
+ClientRouter.get(
+   "/user",
+   Stacker(
+      GetClientAuthMiddleware(false),
+      GetUserMiddleware(false, false),
+      async (req: Request, res: Response) => {
+         let { redirect_uri, state } = req.query;
+
+         if (redirect_uri !== req.client.redirect_url)
+            throw new RequestError(
+               "Invalid redirect URI",
+               HttpStatusCode.BAD_REQUEST
+            );
+
+         let jwt = await createJWT(
+            {
+               client: req.client.client_id,
+               uid: req.user.uid,
+               username: req.user.username,
+               state: state,
+            },
+            {
+               expiresIn: 30,
+               issuer: config.core.url,
+               algorithm: "RS256",
+               subject: req.user.uid,
+               audience: req.client.client_id,
+            }
+         ); //after 30 seconds this token is invalid
+         res.redirect(
+            redirect_uri + "?jwt=" + jwt + (state ? `&state=${state}` : "")
+         );
+      }
+   )
+);
+
+ClientRouter.get(
+   "/account",
+   Stacker(GetClientApiAuthMiddleware(), async (req: Request, res) => {
+      let mails = await Promise.all(
+         req.user.mails.map((id) => Mail.findById(id))
+      );
+
+      let mail = mails.find((e) => e.primary) || mails[0];
+
+      res.json({
+         user: {
+            username: req.user.username,
+            name: req.user.name,
+            email: mail,
+         },
+      });
+   })
+);
+
+/**
+ * @api {get} /client/featured
+ *
+ * @apiDescription Get a list of clients, that want to be featured on the home page
+ *
+ * @apiName GetFeaturedClients
+ * @apiGroup client
+ */
+ClientRouter.get(
+   "/featured",
+   Stacker(async (req: Request, res) => {
+      let clients = await Client.find({
+         featured: true,
+      });
+
+      res.json({
+         clients: clients.map(({ name, logo, website, description }) => ({
+            name,
+            logo,
+            website,
+            description,
+         })),
+      });
+   })
+);
+
+export default ClientRouter;

Backend/src/api/client/permissions.ts

@@ -0,0 +1,98 @@
+import { Request, Response } from "express";
+import Stacker from "../middlewares/stacker";
+import {
+   ClientAuthMiddleware,
+   GetClientAuthMiddleware,
+} from "../middlewares/client";
+import Permission from "../../models/permissions";
+import User from "../../models/user";
+
+import RequestError, { HttpStatusCode } from "../../helper/request_error";
+import Grant from "../../models/grants";
+import { ObjectID } from "mongodb";
+
+export const GetPermissions = Stacker(
+   GetClientAuthMiddleware(true),
+   async (req: Request, res: Response) => {
+      const { user, permission } = req.query as { [key: string]: string };
+
+      let permissions: { id: string; name: string; description: string }[];
+      let users: string[];
+
+      if (user) {
+         const grant = await Grant.findOne({
+            client: req.client._id,
+            user: new ObjectID(user),
+         });
+
+         permissions = await Promise.all(
+            grant.permissions.map((perm) => Permission.findById(perm))
+         ).then((res) =>
+            res
+               .filter((e) => e.grant_type === "client")
+               .map((e) => {
+                  return {
+                     id: e._id.toHexString(),
+                     name: e.name,
+                     description: e.description,
+                  };
+               })
+         );
+      }
+
+      if (permission) {
+         const grants = await Grant.find({
+            client: req.client._id,
+            permissions: new ObjectID(permission),
+         });
+
+         users = grants.map((grant) => grant.user.toHexString());
+      }
+
+      res.json({ permissions, users });
+   }
+);
+
+export const PostPermissions = Stacker(
+   GetClientAuthMiddleware(true),
+   async (req: Request, res: Response) => {
+      const { permission, uid } = req.body;
+
+      const user = await User.findOne({ uid });
+      if (!user) {
+         throw new RequestError("User not found!", HttpStatusCode.BAD_REQUEST);
+      }
+
+      const permissionDoc = await Permission.findById(permission);
+      if (!permissionDoc || !permissionDoc.client.equals(req.client._id)) {
+         throw new RequestError(
+            "Permission not found!",
+            HttpStatusCode.BAD_REQUEST
+         );
+      }
+
+      let grant = await Grant.findOne({
+         client: req.client._id,
+         user: req.user._id,
+      });
+
+      if (!grant) {
+         grant = Grant.new({
+            client: req.client._id,
+            user: req.user._id,
+            permissions: [],
+         });
+      }
+
+      //TODO: Fix clients getting user data without consent, when a grant is created and no additional permissions are requested, since for now, it is only checked for grant existance to make client access user data
+
+      if (grant.permissions.indexOf(permission) < 0)
+         grant.permissions.push(permission);
+
+      await Grant.save(grant);
+
+      res.json({
+         success: true,
+      });
+   }
+);