Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

finished admin eventrequests, violations routes #35

Merged
merged 4 commits into from
Jan 31, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 122 additions & 1 deletion backend/controllers/AdminController.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,117 @@ const db = require('../database');
const bcrypt = require('bcryptjs');
const {hash, genSalt} = require('bcryptjs');

const getEventRequests = async (req, res, next) => {
try {
const requests = await db.manyOrNone(
'SELECT * FROM EventRequests WHERE event_id = $1',
[req.params.eventId],
);

if (requests.length) {
res.locals.data = requests;
next();
} else {
res.status(404).json({message: 'No requests found for this event.'});
}
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
};

const getAllEventRequests = async (req, res, next) => {
try {
const requests = await db.manyOrNone(
'SELECT * FROM EventRequests',
);

if (requests.length) {
res.locals.data = requests;
next();
} else {
res.status(404).json({message: 'No requests found for this event.'});
}
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
}

const getViolations = async (req, res, next) => {
try {
const violations = await db.manyOrNone(
'SELECT * FROM VendorViolations WHERE vendor_id = $1',
[req.params.vendorId],
);

if (violations.length) {
res.locals.data = violations;
next();
} else {
res.status(404).json({message: 'No violations found for this vendor.'});
}
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
}

const getAllViolations = async (req, res, next) => {
try {
const violations = await db.manyOrNone('SELECT * FROM VendorViolations');

if (violations.length) {
res.locals.data = violations;
next();
} else {
res.status(404).json({message: 'No violations found.'});
}
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
}

const createVendorViolation = async (req, res, next) => {
try {
await db.none(
'INSERT INTO VendorViolations (vendor_id) VALUES ($1)',
[req.params.vendorId],
);
next();
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
}

const deleteVendorViolation = async (req, res, next) => {
try {
await db.none(
'DELETE FROM VendorViolations WHERE violation_id = $1',
[req.params.violationId],
);
next();
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
}

const processEventRequest = async (req, res, next) => {
try {
await db.none(
'UPDATE EventRequests SET approved = $1 WHERE request_id = $2',
[req.body.approved, req.params.requestId],
);
next();
} catch (err) {
console.error(err);
res.status(500).json({error: 'Internal Server Error'});
}
}

// Middleware given an email in the body, retireves the given admin
// account or returns an error
const getAdminByEmail = async (req, res, next) => {
Expand Down Expand Up @@ -60,4 +171,14 @@ const createAdminMiddleware = async (req, res, next) => {
}
};

module.exports = {getAdminByEmail, createAdminMiddleware};
module.exports = {
getEventRequests,
getAllEventRequests,
getViolations,
getAllViolations,
createVendorViolation,
deleteVendorViolation,
processEventRequest,
getAdminByEmail,
createAdminMiddleware,
};
1 change: 1 addition & 0 deletions backend/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,11 @@

// Parses cookies attached to the client request object
const cookieParser = require('cookie-parser');
app.use(cookieParser());

Check failure

Code scanning / CodeQL

Missing CSRF middleware High

This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a
request handler
without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.
This cookie middleware is serving a request handler without CSRF protection.

// Import router objects and direct the app to use them
const VendorRouter = require('./routes/VendorRouter');
const AdminRouter = require('./routes/AdminRouter');
const EventRouter = require('./routes/EventRouter');
const AdminRouter = require('./routes/AdminRouter');

Expand Down
37 changes: 32 additions & 5 deletions backend/routes/AdminRouter.js
Original file line number Diff line number Diff line change
@@ -1,21 +1,48 @@
const express = require('express');
const router = express.Router();

// Auth Controller Imports
const {
verifyAdminToken,
signAdminToken,
verify,
} = require('../controllers/AuthController');
const {getAdminByEmail, createAdminMiddleware} = require('../controllers/AdminController');

// Import express
const express = require('express');
// Admin Controller Imports
const {
getEventRequests,
getAllEventRequests,
getViolations,
getAllViolations,
createVendorViolation,
deleteVendorViolation,
processEventRequest,
getAdminByEmail,
createAdminMiddleware,
} = require('../controllers/AdminController');

// Create a router for admin authentication
const router = express.Router();
const sendSuccessResponse = require('../middleware/successResponse');

router.get('/events/requests/:eventId', verify('admin'), getEventRequests, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.get('/events/requests', verify('admin'), getAllEventRequests, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs authorization, but is not rate-limited.
This route handler performs authorization, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.get('/violations/:vendorId', verify('admin'), getViolations, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.get('/violations', verify('admin'), getAllViolations, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.put('events/requests/:requestId', verify('admin'), processEventRequest, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.post('/violations/:vendorId', verify('admin'), createVendorViolation, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.delete('/violations/:violationId', verify('admin'), deleteVendorViolation, sendSuccessResponse);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
This route handler performs
authorization
, but is not rate-limited.
This route handler performs authorization, but is not rate-limited.
This route handler performs authorization, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

router.post('/login', getAdminByEmail, signAdminToken, (req, res) => {
res.status(200).json({status: 'success'});
});

// UNFINISHED: Create an admin account
// Useful for creating an admin account for testing purposes. Password in database needs to be hashed for login to work properly.
// router.post('/', createAdminMiddleware, (req, res) => {
// res.status(200).json({status: 'success', admin: res.locals.data});
// });
Expand Down
Loading