Fix most glaring bugs and vulnerabilities

express/middleware/auth.js

@@ -21,6 +21,9 @@ passport.deserializeUser(async (id, done) => {
     const user = await User.fetchDeserializedDataById(id)
 
     // TODO Consider what to do if no user was found?
+
+    // TODO This is a current workaround until session invalidation is implemented.
+    if (user.status !== 'active') return done(null, false)
     done(null, user)
   } catch (error) {
     done(error)
@@ -32,11 +35,7 @@ passport.use(
     { passReqToCallback: true, usernameField: 'usernameOrEmail' },
     async (req, usernameOrEmail, password, done) => {
       try {
-        const { rows } = await db.query(
-          'SELECT id, status, bcrypt_hash FROM "user" WHERE username = $1 OR email = $1',
-          [usernameOrEmail]
-        )
-        const user = rows[0]
+        const user = await User.fetchByUsernameOrEmail(usernameOrEmail)
 
         if (!user) {
           return done(null, false, {

express/middleware/index.js

@@ -2,6 +2,13 @@ const { getInstanceSetting } = require('../models/helpers')
 
 exports.enhanceLocals = async (req, res, next) => {
   res.locals.portalCode = await getInstanceSetting('portal_code')
+  res.locals.flashInfo = req.flash('info')
+
+  next()
+}
+
+exports.adjustHeaders = async (req, res, next) => {
+  res.set('Cache-Control', 'no-cache, private')
 
   next()
 }

express/middleware/user.js

@@ -1,3 +1,5 @@
+const User = require('../models/user')
+
 const user = {}
 
 user.enhance = (req, res, next) => {
@@ -18,7 +20,16 @@ user.isAuthenticated = (req, res, next) => {
   if (req.isAuthenticated()) return next()
 
   if (req.isAjax) return res.status(400).end()
-  res.redirect(req.baseUrl || '/')
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.isPortalAdmin = (req, res, next) => {
+  const isPortalAdmin = req.user.hasRole('portal admin')
+
+  if (isPortalAdmin) return next()
+
+  if (req.isAjax) return res.status(400).end()
+  res.redirect(303, req.baseUrl || '/')
 }
 
 user.isDictionaryAdmin = (req, res, next) => {
@@ -28,17 +39,37 @@ user.isDictionaryAdmin = (req, res, next) => {
   if (isAdmin) return next()
 
   if (req.isAjax) return res.status(400).end()
-  res.redirect(req.baseUrl || '/')
+  res.redirect(303, req.baseUrl || '/')
 }
 
 user.isDictionaryEditor = (req, res, next) => {
-  const { dictionaryId } = req.params
+  const dictionaryId = req.params.dictionaryId || req.dictionaryId
   const isEditor = req.user.hasAnyDictionaryRole(dictionaryId)
 
   if (isEditor) return next()
 
   if (req.isAjax) return res.status(400).end()
-  res.redirect(req.baseUrl || '/')
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.canAdministrateDictionary = (req, res, next) => {
+  const dictionaryId = req.params.dictionaryId || req.dictionaryId
+  const isAdmin = req.user.hasDictionaryRole(dictionaryId, 'administration')
+  const isPortalAdmin = req.user.hasRole('portal admin')
+  const isDictionariesAdmin = req.user.hasRole('dictionaries admin')
+  if (isAdmin || isPortalAdmin || isDictionariesAdmin) return next()
+
+  if (req.isAjax) return res.status(400).end()
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.canAdministrateDictionaries = (req, res, next) => {
+  const isPortalAdmin = req.user.hasRole('portal admin')
+  const isDictionariesAdmin = req.user.hasRole('dictionaries admin')
+  if (isPortalAdmin || isDictionariesAdmin) return next()
+
+  if (req.isAjax) return res.status(400).end()
+  res.redirect(303, req.baseUrl || '/')
 }
 
 user.canContentEdit = (req, res, next) => {
@@ -49,7 +80,54 @@ user.canContentEdit = (req, res, next) => {
   if (isEditor || isPortalAdmin || isDictionariesAdmin) return next()
 
   if (req.isAjax) return res.status(400).end()
-  res.redirect(req.baseUrl || '/')
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.canAdministrateConsultancy = (req, res, next) => {
+  const isPortalAdmin = req.user.hasRole('portal admin')
+  const isConsultancyAdmin = req.user.hasRole('consultancy admin')
+  if (isPortalAdmin || isConsultancyAdmin) return next()
+
+  if (req.isAjax) return res.status(400).end()
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.canConsult = (req, res, next) => {
+  const isConsultant = req.user.hasRole('consultant')
+  const isPortalAdmin = req.user.hasRole('portal admin')
+  const isConsultancyAdmin = req.user.hasRole('consultancy admin')
+  if (isConsultant || isPortalAdmin || isConsultancyAdmin) return next()
+
+  if (req.isAjax) return res.status(400).end()
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.canConsultEntry = (req, res, next) => {
+  const id = req.params.id || req.entryId
+  const isConsultantForEntry = req.user.isEditorOfConsultancyEntry(id)
+  const isPortalAdmin = req.user.hasRole('portal admin')
+  const isConsultancyAdmin = req.user.hasRole('consultancy admin')
+  if (isConsultantForEntry || isPortalAdmin || isConsultancyAdmin) return next()
+
+  if (req.isAjax) return res.status(400).end()
+  res.redirect(303, req.baseUrl || '/')
+}
+
+user.logout = async (req, res, next) => {
+  const rememberMeToken = req.signedCookies.remember_me
+
+  if (rememberMeToken) {
+    res.clearCookie('remember_me')
+    await User.clearRememberMeToken(rememberMeToken)
+  }
+
+  req.session.language = req.user.language
+
+  req.logout()
+  // Manually clear session.passport due to bug in current passport version.
+  delete req.session.passport.user
+
+  next()
 }
 
 /**