Merge pull request #166 from cuappdev/aayush/auth

Aayush/auth

Author: ashleynhs

package.json

@@ -25,9 +25,11 @@
   },
   "homepage": "https://github.com/cuappdev/resell-backend#readme",
   "devDependencies": {
-    "@types/express": "^4.17.13",
+    "@types/body-parser": "^1.19.6",
+    "@types/express": "^4.17.25",
     "@types/faker": "^5.5.5",
     "@types/jest": "^27.0.2",
+    "@types/multer": "^2.0.0",
     "@types/node": "^16.9.0",
     "@types/node-fetch": "^2.6.1",
     "@types/swagger-ui-express": "^4.1.7",
@@ -46,12 +48,15 @@
     "@tensorflow-models/universal-sentence-encoder": "^1.3.3",
     "@tensorflow/tfjs": "^4.2.0",
     "@tensorflow/tfjs-node": "^4.22.0",
-    "class-validator": "^0.14.0",
+    "body-parser": "^2.2.2",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.3",
     "cors": "^2.8.6",
     "dotenv": "^10.0.0",
-    "express": "^4.17.2",
+    "express": "^4.22.1",
     "faker": "^5.5.3",
     "firebase-admin": "^13.1.0",
+    "multer": "^2.0.2",
     "node-fetch": "^2.6.1",
     "pg": "^8.7.1",
     "pgvector": "^0.2.0",

src/api/controllers/NotifController.ts

@@ -17,54 +17,64 @@ import { UserModel } from "../../models/UserModel";
 
 @JsonController("notif/")
 export class NotifController {
-    private notifService: NotifService;
+  private notifService: NotifService;
 
-    constructor(notifService: NotifService) {
-      this.notifService = notifService;
-    }
+  constructor(notifService: NotifService) {
+    this.notifService = notifService;
+  }
 
-    @Get('recent')
-    async getRecentNotifications(@CurrentUser() user: UserModel) {
-      return this.notifService.getRecentNotifications(user.firebaseUid);
-    }
+  @Get("recent")
+  async getRecentNotifications(@CurrentUser() user: UserModel) {
+    return this.notifService.getRecentNotifications(user.firebaseUid);
+  }
 
-    @Get('new')
-    async getUnread(@CurrentUser() user: UserModel) {
-      return this.notifService.getUnreadNotifications(user.firebaseUid);
-    }
+  @Get("new")
+  async getUnread(@CurrentUser() user: UserModel) {
+    return this.notifService.getUnreadNotifications(user.firebaseUid);
+  }
 
-    @Get('last7days')
-    getLast7Days(@CurrentUser() user: UserModel) {
-      return this.notifService.getNotificationsLast7Days(user.firebaseUid);
-    }
+  @Get("last7days")
+  getLast7Days(@CurrentUser() user: UserModel) {
+    return this.notifService.getNotificationsLast7Days(user.firebaseUid);
+  }
 
-    @Get('last30days')
-    getLast30Days(@CurrentUser() user: UserModel) {
-      return this.notifService.getNotificationsLast30Days(user.firebaseUid);
-    }
+  @Get("last30days")
+  getLast30Days(@CurrentUser() user: UserModel) {
+    return this.notifService.getNotificationsLast30Days(user.firebaseUid);
+  }
 
-    @Post()
-    async sendNotif(@Body() findTokensRequest: FindTokensRequest) {
-      return this.notifService.sendNotifs(findTokensRequest);
-    }
+  @Post()
+  async sendNotif(@Body() findTokensRequest: FindTokensRequest) {
+    return this.notifService.sendNotifs(findTokensRequest);
+  }
 
-    @Post('discount')
-    async sendDiscountNotif(@Body() discountRequest: DiscountNotificationRequest) {
-        return this.notifService.sendDiscountNotification(discountRequest);
-    }
+  @Post("discount")
+  async sendDiscountNotif(
+    @Body() discountRequest: DiscountNotificationRequest,
+  ) {
+    return this.notifService.sendDiscountNotification(discountRequest);
+  }
 
-    @Post('request-match')
-    async sendRequestMatchNotif(@Body() matchRequest: RequestMatchNotificationRequest) {
-        return this.notifService.sendRequestMatchNotification(matchRequest);
-    }
+  @Post("request-match")
+  async sendRequestMatchNotif(
+    @Body() matchRequest: RequestMatchNotificationRequest,
+  ) {
+    return this.notifService.sendRequestMatchNotification(matchRequest);
+  }
 
-    @Post('markAsRead/id/:id')
-    async markAsRead(@CurrentUser() user: UserModel, @Params() params: { id: string }) {
-        return this.notifService.markAsRead(user.firebaseUid, params.id);
-    }
+  @Post("markAsRead/id/:id")
+  async markAsRead(
+    @CurrentUser() user: UserModel,
+    @Params() params: { id: string },
+  ) {
+    return this.notifService.markAsRead(user.firebaseUid, params.id);
+  }
 
-    @Delete('id/:id')
-    async deleteNotification(@CurrentUser() user: UserModel, @Params() params: { id: string }) {
-        return this.notifService.deleteNotification(user.firebaseUid, params.id);
-    }
+  @Delete("id/:id")
+  async deleteNotification(
+    @CurrentUser() user: UserModel,
+    @Params() params: { id: string },
+  ) {
+    return this.notifService.deleteNotification(user.firebaseUid, params.id);
+  }
 }

src/api/controllers/ReportController.ts

@@ -19,7 +19,6 @@ import {
   GetReportsResponse,
 } from "../../types/ApiResponses";
 import { ReportModel } from "../../models/ReportModel";
-import { report } from "process";
 import { UuidParam } from "../validators/GenericRequests";
 
 @JsonController("report/")

src/api/middlewares/ErrorHandler.ts

@@ -13,15 +13,15 @@ export class ErrorHandler implements ExpressErrorMiddlewareInterface {
     error: Error,
     request: express.Request,
     response: express.Response,
-    next: (err?: any) => any,
+    next: (err?: unknown) => unknown,
   ): void {
     handleError(error, request, response, next);
   }
 }
 
 function handleError(
   error: Error,
-  request: express.Request,
+  _request: express.Request,
   response: express.Response,
   next: express.NextFunction,
 ) {

src/api/middlewares/FirebaseAuth.ts

@@ -0,0 +1,43 @@
+import {
+  Action,
+  ForbiddenError,
+  NotFoundError,
+  UnauthorizedError,
+} from "routing-controllers";
+import { firebaseAdmin } from "../../firebase";
+import { getManager } from "typeorm";
+import { UserModel } from "../../models/UserModel";
+
+export const FirebaseCurrentUserChecker = async (
+  action: Action,
+): Promise<UserModel> => {
+  const authHeader = action.request.headers["authorization"];
+  if (!authHeader) {
+    throw new UnauthorizedError("No authorization token provided");
+  }
+  const token = authHeader.split(" ")[1];
+  if (!token) {
+    throw new UnauthorizedError("Invalid authorization token format");
+  }
+
+  try {
+    // Verify the token using Firebase Admin SDK
+    const decodedToken = await firebaseAdmin.auth().verifyIdToken(token);
+    const userId = decodedToken.uid;
+    const email = decodedToken.email;
+    // Enforce Cornell email domain restriction
+    if (email && !email.endsWith("@cornell.edu")) {
+      throw new ForbiddenError("Only Cornell email addresses are allowed");
+    }
+    // Fetch and return the user from the database
+    const user = await getManager().findOne(UserModel, {
+      firebaseUid: userId,
+    });
+    if (!user) {
+      throw new NotFoundError("User not found");
+    }
+    return user;
+  } catch (error) {
+    throw new UnauthorizedError("Invalid or expired authorization token");
+  }
+};

src/api/validators/GenericRequests.ts

@@ -1,4 +1,4 @@
-import { IsEmail, IsNumber, IsString, IsUUID } from "class-validator";
+import { IsEmail, IsString, IsUUID } from "class-validator";
 
 import { Uuid } from "../../types";