Skip to content

Commit 4a53d0a

Browse files
narfasecnarfasec
committed
"Protect routes with jwt"
1 parent 2c569ea commit 4a53d0a

7 files changed

Lines changed: 24 additions & 26 deletions

File tree

‎server/api/auth/routes.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ def login():
6161
return jsonify({'status': 'Bad request'}), 400
6262

6363
token: str = issue_token(user_id=_id, comp_id=comp_id, is_admin=(is_admin == 'true'))
64-
print(token)
6564

6665
return jsonify({'status': 'Ok', 'user_id': _id, 'token': token, 'is_admin': is_admin, 'comp_id': comp_id}), 200
6766

@@ -92,9 +91,9 @@ def reset_password():
9291
is_valid, _payload = validate_token(token)
9392
if not is_valid:
9493
return jsonify({'status': 'Unauthorised'}), 403
95-
94+
if _payload['is_admin']:
95+
user_id = _payload['user_id']
9696
encrypted_password = encrypt_password(new_password, DES_KEY)
97-
9897
result = dbc.execute_query(query='update_user_password', args={
9998
"user_id": user_id,
10099
"new_password": encrypted_password
@@ -175,6 +174,8 @@ def retire():
175174
is_valid, payload = validate_token(dict_data.get('token'))
176175
if not is_valid or not payload.get('is_admin'):
177176
return jsonify({'status': 'Unauthorized'}), 403
177+
comp_id = payload['comp_id']
178+
user_id = payload['user_id']
178179
result = dbc.execute_query(query='delete_sales_by_comp_id', args=dict_data['comp_id'])
179180
if result is False:
180181
return jsonify({'status': 'Bad request'}), 400

‎server/api/clients/routes.py‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,13 @@ def new_client():
2424
''' Create a new client '''
2525
dbc = DBConnector()
2626
dict_data = request.get_json()
27+
token = dict_data['token']
28+
is_valid, payload = validate_token(token)
29+
if not is_valid:
30+
return jsonify({'status': 'Unauthorised'}), 403
31+
comp_id = payload['comp_id']
2732
result = dbc.execute_query('create_client', args={
28-
'comp_id': dict_data['comp_id'],
33+
'comp_id': comp_id,
2934
'first_name': dict_data['first_name'],
3035
'last_name': dict_data['last_name'],
3136
'email': dict_data['email'],
@@ -46,7 +51,7 @@ def delete_client():
4651
dict_data = request.get_json()
4752
token = dict_data['token']
4853
is_valid, payload = validate_token(token)
49-
if not is_valid or not payload.get('is_admin'):
54+
if not is_valid:
5055
return jsonify({'status': 'Unauthorised'}), 403
5156
result = dbc.execute_query(query='delete_client_by_id', args=dict_data['client_id'])
5257
if isinstance(result, int):

‎server/api/company/routes.py‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ def list_clients():
1616
is_valid, payload = validate_token(dict_data.get('token'))
1717
if not is_valid or not payload.get('is_admin'):
1818
return jsonify({'status': 'Unauthorised'}), 403
19-
results = dbc.execute_query(query='get_company_sales', args=dict_data['comp_id'])
20-
pcf = ProcessCashFlow(dict_data['comp_id'], 'PT', month=7) ### in this case we don't cate about the month, let's give one value just to simplify
19+
results = dbc.execute_query(query='get_company_sales', args=payload['comp_id'])
20+
pcf = ProcessCashFlow(payload['comp_id'], 'PT', month=7) ### in this case we don't cate about the month, let's give one value just to simplify
2121
revenue = pcf.revenue
22-
ps = ProcessSales(results, dict_data['user_id'])
22+
ps = ProcessSales(results, payload['user_id'])
2323
ps.get_3_most_recent_sales()
2424
if isinstance(results, list):
2525
return jsonify({'status': 'Ok', 'last_3_sales': ps.last_3_sales, 'revenue': revenue, 'sales': results}), 200
@@ -33,7 +33,7 @@ def list_employees():
3333
is_valid, payload = validate_token(dict_data.get('token'))
3434
if not is_valid or not payload.get('is_admin'):
3535
return jsonify({'status': 'Unauthorised'}), 403
36-
results = dbc.execute_query(query='get_employees_list', args=dict_data['comp_id'])
36+
results = dbc.execute_query(query='get_employees_list', args=payload['comp_id'])
3737
if isinstance(results, list):
3838
return jsonify({'status': 'Ok', 'employees': results}), 200
3939
return jsonify({'status': 'Bad request'}), 403
@@ -46,7 +46,7 @@ def list_products():
4646
is_valid, _payload = validate_token(dict_data.get('token'))
4747
if not is_valid:
4848
return jsonify({'status': 'Unauthorised'}), 403
49-
results = dbc.execute_query(query='get_products_list', args=dict_data['comp_id'])
49+
results = dbc.execute_query(query='get_products_list', args=_payload['comp_id'])
5050
if isinstance(results, list):
5151
return jsonify({'status': 'Ok', 'products': results}), 200
5252
return jsonify({'status': 'Bad request'}), 403
@@ -75,7 +75,6 @@ def update_commission():
7575
''' Update seller commission '''
7676
dict_data = request.get_json()
7777
token = dict_data['token']
78-
print(dict_data)
7978
seller_id = dict_data['seller_id']
8079
new_commission = dict_data['new_commission']
8180
# intentionally not comparing with static admin token anymore
@@ -90,10 +89,10 @@ def update_commission():
9089
def upload_excel():
9190
''' Update company products from csv or xlsx '''
9291
token = request.form.get('token')
93-
comp_id = request.form.get('comp_id')
9492
is_valid, payload = validate_token(token)
9593
if not is_valid or not payload.get('is_admin'):
9694
return jsonify({'status': 'Unauthorized'}), 403
95+
comp_id = payload.get('comp_id')
9796
if 'file' not in request.files:
9897
return jsonify({'error': 'No file part in the request'}), 400
9998

@@ -115,9 +114,9 @@ def cash_flow():
115114
return jsonify({'status': 'Unauthorised'}), 403
116115

117116
#### To Simplify, we will only use 3 fixed months of sales ####
118-
pcf7 = ProcessCashFlow(country_code=dict_data['country_code'], company_id=dict_data['comp_id'], month=7)
119-
pcf8 = ProcessCashFlow(country_code=dict_data['country_code'], company_id=dict_data['comp_id'], month=8)
120-
pcf9 = ProcessCashFlow(country_code=dict_data['country_code'], company_id=dict_data['comp_id'], month=9)
117+
pcf7 = ProcessCashFlow(country_code=dict_data['country_code'], company_id=payload['comp_id'], month=7)
118+
pcf8 = ProcessCashFlow(country_code=dict_data['country_code'], company_id=payload['comp_id'], month=8)
119+
pcf9 = ProcessCashFlow(country_code=dict_data['country_code'], company_id=payload['comp_id'], month=9)
121120
#########################################################
122121

123122
return jsonify(

‎server/api/sales/routes.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ def list_user_sales():
1313
is_valid, _payload = validate_token(dict_data.get('token'))
1414
if not is_valid:
1515
return jsonify({'status': 'Unauthorised'}), 403
16-
results = dbc.execute_query(query='get_user_sales', args=dict_data['user_id'])
16+
results = dbc.execute_query(query='get_user_sales', args=_payload['user_id'])
1717
ps = ProcessSales(results, dict_data['user_id'])
1818
ps.get_3_most_recent_sales()
1919
revenue = ps.revenue
@@ -31,7 +31,7 @@ def add_new_sale():
3131
return jsonify({'status': 'Unauthorised'}), 403
3232
result = dbc.execute_query(query='create_sale', args={
3333
'client_id': dict_data['client_id'],
34-
'user_id': dict_data['user_id'],
34+
'user_id': _payload['user_id'],
3535
'product_id': dict_data['product_id'],
3636
'quantity': dict_data['quantity']
3737
})

‎server/api/settings.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
AUTH_TOKEN = 'W4N7CQ'
2-
ADMIN_AUTH_TOKEN = 'Z8V9LD'
3-
JWT_SECRET = 'insecure-dev-secret'
4-
# Public key used incorrectly as HMAC secret to allow HS/RS key confusion
51
JWT_PUBLIC_PEM = """-----BEGIN RSA PUBLIC KEY-----
62
MIIBCgKCAQEAvtoO/jH2a7dovKpQ9KJafQhhoE4FVJ/aRZWNjtte/D/UTDtPZ1Ou
73
G5tjKGt+wieb2YfbQk2qjRhcZvgeg2bJfHKwX9jL7pomt3oxhdlHgsRU8MaS8r7N

‎server/requirements.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ mariadb==1.1.5
44
requests==2.19.1
55
pycryptodome==3.17
66
pandas==2.2.2
7-
openpyxl==3.1.5
7+
openpyxl==3.1.5
8+
PyJWT==1.5.0

‎server/tests/health_checks/test_flow_1.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@
44

55
base_url = 'http://127.0.0.1:5000'
66

7-
AUTH_TOKEN = 'W4N7CQ'
8-
ADMIN_AUTH_TOKEN = 'Z8V9LD'
9-
107
def test_output_status(status, text):
118
if status == 'pass':
129
print(f'\033[92m[PASS]\033[0m {text}')
@@ -22,7 +19,6 @@ def test_output_status(status, text):
2219
login_payload = {'username': 'jdoe', 'password': 'password123'}
2320
login_response = requests.post(login_url, json=login_payload)
2421
login_data = login_response.json()
25-
print(login_data)
2622
user_id: int = 0
2723
token: str = ''
2824
if login_data['status'] == 'Ok':

0 commit comments

Comments
 (0)