ostandari/server/authentication.js

const jwt = require('jsonwebtoken')
const User = require('./models/User');
const {res500} = require('./plugins/controllersHelperFunctions');
const Category = require('./models/Category');
const Election = require('./models/Election');

const authentication = {
    // secret for generating jwt token
    secretKey: 'kyQa8pFI5BJnj7LCVPlSfoATTSZuS5DMSjgBPxQo2zkcdKnxKCPzWs1DEBgMfnXFsjgT0YWgqn8HgLLcmdIgSR6fSQpy6vchmY3kUSD564J',
    // check if just logged in (admin-or-user) (middleware)
    isLoggedIn: async function (req, res, next) {
        try {
            const token = req.headers.authorization?.replace(/^Bearer\s/, '');
            if (token) {
                // check if token is not destroyed
                var user = await User.findOne({token: token});

                if (!user) {
                    return res.status(401).json({message: 'unauthorized'});
                }

                if (!user.registration_done) {
                    return res500(res, 'user is disable please contact to support');
                }

                //verifies secret and checks if the token is expired
                try {
                    var checkToken = await jwt.verify(user.token.replace(/^Bearer\s/, ''), authentication.secretKey);

                    if (!checkToken) {
                        return res.status(401).json({message: 'unauthorized'});
                    }
                } catch (error) {
                    return res.status(401).json({message: 'unauthorized'});
                }

                req.user = {
                    _id: user._id,
                    scope: user.scope,
                    portals: user.portals,
                    permissions: user.permissions,
                    specialPermissions: user.specialPermissions,
                    private: user.private
                };

                return next();
            } else {
                return res.status(401).json({message: 'unauthorized'});
            }
        } catch (error) {
            return res500(res, error.message);
        }
    },
    // check if admin logged in (middleware)
    isAdmin: async function (req, res, next) {
        /** if req.user exist find user and check scope */
        /** req.user send from isLoggedIn */
        try {
            if (req.user) {
                const scope = req.user.scope;

                if (!scope.includes('admin')) {
                    return res.status(401).json({message: 'unauthorized'});
                }

                return next()
            } else {
                return res.status(401).json({message: 'unauthorized'});
            }
        } catch (error) {
            return res.status(401).json({message: 'unauthorized'});
        }
    },
    // check if user has permission (middleware)
    hasPermission: (permission) => {
        return (req, res, next) => {
            if (req.user && req.user.permissions) {
                const permissions = req.user.permissions;
                if (permissions.includes('superAdmin')) {
                    return next();
                }
                if (!permissions.includes(permission)) {
                    return res.status(401).json({message: 'unauthorized'});
                } else {
                    return next();
                }
            } else {
                return res.status(401).json({message: 'unauthorized'});
            }
        }
    },
    // hasSpecPermission: () => {
    //     return async (req, res, next) => {
    //         if (req.user && req.user.specialPermissions.length) {
    //             const specialPermissions = req.user.specialPermissions;
    //             if (req.user.permissions.includes('superAdmin')) {
    //                 return next();
    //             }
    //             let tempSpec = [];
    //             for (const spec of specialPermissions) {
    //                 const check = await Category.findById(spec);
    //
    //                 if (check){
    //                     tempSpec.push(check._id);
    //                 }
    //             }
    //
    //             if (tempSpec.length){
    //                 req.user.allSpecialPermissions = tempSpec;
    //                 next();
    //             }else {
    //                 return res.status(401).json({message: 'unauthorized'});
    //             }
    //         } else {
    //             return next();
    //         }
    //     }
    // },
    hasSubPermission: () => {
        return (req, res, next, value) => {
            if (req.user && req.user.permissions) {
                var permissions = req.user.permissions;
                if (permissions.includes('superAdmin')) {
                    return next();
                }
                if (!permissions.some(item => new RegExp(value, 'i').test(item))) {
                    return res.status(401).json({message: 'unauthorized'});
                } else {
                    return next();
                }
            } else {
                return res.status(401).json({message: 'unauthorized'});
            }
        }
    },
    isVoter: async function (req, res, next) {
        try {
            const token = req.headers.authorization?.replace(/^Bearer\s/, '');
            if (token) {
                // check if token is not destroyed
                const user = await Election.findOne({'voters': {$elemMatch: {_id: token}}});

                if (!user) {
                    return res.status(401).json({message: 'unauthorized'});
                }

                const voter = user.voters.id(token);

                req.voter = {
                    _id: voter._id,
                    username: voter.username,
                    password: voter.password,
                    voted: voter.voted
                };

                return next();
            } else {
                return res.status(401).json({message: 'unauthorized'});
            }
        } catch (error) {
            return res500(res, error.message);
        }
    },
}

module.exports = authentication