Fix most glaring bugs and vulnerabilities

express/routes/api/v1/comments.js

@@ -3,20 +3,12 @@ const router = require('express-promise-router')()
 const {
   listComments,
   createComment,
-  seedComments,
-  clearComments,
   updateStatus
 } = require('../../../controllers/api/v1/comments')
 
 // List comments (one page).
 router.get('/', listComments)
 
-// TEMP - Seed comments.
-router.get('/seed/:commentCount', seedComments)
-
-// TEMP - Clear comments.
-router.get('/clear', clearComments)
-
 // All further routes are only available to authenticated users.
 router.use((req, res, next) => {
   if (req.isAuthenticated()) return next()

express/routes/api/v1/consultancy.js

@@ -2,8 +2,6 @@ const router = require('express-promise-router')()
 
 const {
   assign,
-  listEntries,
-  listNewEntries,
   createQuestion,
   deleteQuestion,
   updateDomain,
@@ -23,10 +21,6 @@ const {
 
 router.get('/entry-pagination', sendPaginationData)
 
-router.get('/entry', listEntries)
-
-router.get('/new-entry', listNewEntries)
-
 // All routes require an authenticated user.
 router.use((req, res, next) => {
   if (req.isAuthenticated()) return next()

express/routes/api/v1/demo-paginacija.js

@@ -1,7 +0,0 @@
-const router = require('express-promise-router')()
-const demoPaginacija = require('../../../controllers/api/v1/demo-paginacija')
-
-// Tale endpoint vrača rezultate.
-router.get('/list', demoPaginacija.list)
-
-module.exports = router

express/routes/api/v1/dictionaries.js

@@ -1,54 +1,91 @@
 const router = require('express-promise-router')()
 
 const dictionaries = require('../../../controllers/api/v1/dictionaries')
+const user = require('../../../middleware/user')
 
 // Update domain labels.
 router.post('/update-domain-labels', dictionaries.updateDomainLabels)
 
 // Update secondary domains
-router.post('/renovateSecondaryDomains', dictionaries.renovateSecondaryDomains)
+router.post(
+  '/renovateSecondaryDomains',
+  user.canAdministrateDictionaries,
+  dictionaries.renovateSecondaryDomains
+)
 
 // Delete specific dictionary.
-router.delete('/:dictionaryId', dictionaries.delete)
+router.delete(
+  '/:dictionaryId',
+  user.canAdministrateDictionary,
+  dictionaries.delete
+)
 
 // Change page in pagination
-router.get('/listAllDictionaries', dictionaries.listDictionaries)
+router.get(
+  '/listAllDictionaries',
+  user.canAdministrateDictionaries,
+  dictionaries.listDictionaries
+)
 
 // Change page in pagination
-router.get('/:dictionaryId/listDomainLabels', dictionaries.listDomainLabels)
-
-// Change page in pagination
-router.get('/listSecondaryDomains', dictionaries.listSecondaryDomains)
+router.get(
+  '/:dictionaryId/listDomainLabels',
+  user.canAdministrateDictionary,
+  dictionaries.listDomainLabels
+)
 
 // Change page in pagination
 router.get(
   '/:dictionaryId/showImportFromFileForm',
+  user.canContentEdit,
   dictionaries.showImportFromFileForm
 )
 
 // Change page in pagination
 router.get(
   '/:dictionaryId/showExportToFileForm',
+  user.canContentEdit,
   dictionaries.showExportToFileForm
 )
 
 // Delete all entries of specific dictionary.
-router.delete('/:dictionaryId/entries/all', dictionaries.deleteAllEntries)
+router.delete(
+  '/:dictionaryId/entries/all',
+  user.canAdministrateDictionary,
+  dictionaries.deleteAllEntries
+)
 
 // Publish all entries of specific dictionary.
-router.put('/:dictionaryId/entries/all/publish', dictionaries.publishAllEntries)
+router.put(
+  '/:dictionaryId/entries/all/publish',
+  user.canAdministrateDictionary,
+  dictionaries.publishAllEntries
+)
 
 // Import term candidates from extraction.
 router.post(
-  '/:id/import-extraction/:extractionId',
+  '/:dictionaryId/import-extraction/:extractionId',
+  user.canContentEdit,
   dictionaries.importFromExtraction
 )
 
 // Export dictionary into a file.
-router.post('/:id/export-begin', dictionaries.exportBegin)
+router.post(
+  '/:dictionaryId/export-begin',
+  user.canContentEdit,
+  dictionaries.exportBegin
+)
 
-router.get('/:dictionaryId/domainLabels', dictionaries.listFilteredDomainLabels)
+router.get(
+  '/:dictionaryId/domainLabels',
+  user.canContentEdit,
+  dictionaries.listFilteredDomainLabels
+)
 
-router.get('/secondaryDomains', dictionaries.listSecondaryDomainData)
+router.get(
+  '/secondaryDomains',
+  user.canAdministrateDictionaries,
+  dictionaries.listSecondaryDomainData
+)
 
 module.exports = router

express/routes/api/v1/entries.js

@@ -1,5 +1,6 @@
 // This page refers to dictionary entries, not consultancy or other entries
 const router = require('express-promise-router')()
+const user = require('../../../middleware/user')
 
 const {
   getEntry,
@@ -10,7 +11,8 @@ const {
   getEntryVersionSnapshot
 } = require('../../../controllers/api/v1/dictionaries')
 
-// TODO Add authorization.
+// All further routes are only available to authenticated users with dictionary content editing rights.
+router.use(user.isAuthenticated, user.canContentEdit)
 
 // Render entry data for the selected entry
 router.get('/', getEntry)

express/routes/api/v1/extraction.js

@@ -1,54 +1,76 @@
 const router = require('express-promise-router')()
 
 const extraction = require('../../../controllers/api/v1/extraction')
+const { validateOwnership } = require('../../../controllers/extraction')
 
-// TODO In final version test authentication and authorization.
-// TODO Also try to lock file editing or other operations once extraction was started.
+// TODO Try to lock file editing or other operations once extraction was started.
+
+// All further routes are only available to authenticated users.
+router.use((req, res, next) => {
+  if (req.isAuthenticated()) return next()
+  res.status(400).end()
+})
 
 // Delete extraction.
-router.delete('/:id', extraction.delete)
+router.delete('/:id', validateOwnership, extraction.delete)
 
 // List documents.
-router.get('/:id/documents', extraction.docsList)
+router.get('/:id/documents', validateOwnership, extraction.docsList)
 
 // Update documents.
-router.put('/:id/documents', extraction.docsUpdate)
+router.put('/:id/documents', validateOwnership, extraction.docsUpdate)
 
 // Delete a specific document.
-router.delete('/:id/documents/:filename', extraction.docDelete)
+router.delete(
+  '/:id/documents/:filename',
+  validateOwnership,
+  extraction.docDelete
+)
 
 // List stop term files.
-router.get('/:id/stop-terms', extraction.stopTermsList)
+router.get('/:id/stop-terms', validateOwnership, extraction.stopTermsList)
 
 // Update stop term files.
-router.put('/:id/stop-terms', extraction.stopTermsUpdate)
+router.put('/:id/stop-terms', validateOwnership, extraction.stopTermsUpdate)
 
 // Delete a specific stop term file.
-router.delete('/:id/stop-terms/:filename', extraction.stopTermDelete)
+router.delete(
+  '/:id/stop-terms/:filename',
+  validateOwnership,
+  extraction.stopTermDelete
+)
 
 // Save oss params.
-router.post('/:id/oss-save-params', extraction.ossSaveParams)
+router.post('/:id/oss-save-params', validateOwnership, extraction.ossSaveParams)
 
 // Execute search by oss params.
-router.put('/:id/oss-search', extraction.ossSearch)
+router.put('/:id/oss-search', validateOwnership, extraction.ossSearch)
 
 // Confirm oss params.
-router.put('/:id/oss-confirm-params', extraction.ossConfirmParams)
+router.put(
+  '/:id/oss-confirm-params',
+  validateOwnership,
+  extraction.ossConfirmParams
+)
 
 // Begin extraction.
-router.put('/:id/begin', extraction.begin)
+router.put('/:id/begin', validateOwnership, extraction.begin)
 
 // Duplicate extraction.
-router.post('/:id/duplicate', extraction.duplicate)
+router.post('/:id/duplicate', validateOwnership, extraction.duplicate)
 
 // Export term candidates.
-router.get('/:id/term-candidates-export', extraction.termCandidatesExport)
-
-// List all finished extractions for current user.
-// TODO Is this enpoint even necessarry?
-router.get('/finished-for-user', extraction.listFinishedForUser)
+router.get(
+  '/:id/term-candidates-export',
+  validateOwnership,
+  extraction.termCandidatesExport
+)
 
 // List term candidates for specific extraction.
-router.get('/:id/term-candidates', extraction.listTermCandidates)
+router.get(
+  '/:id/term-candidates',
+  validateOwnership,
+  extraction.listTermCandidates
+)
 
 module.exports = router

express/routes/api/v1/index.js

@@ -7,7 +7,6 @@ const dictionariesRouter = require('./dictionaries')
 const portalsRouter = require('./portals')
 const searchRouter = require('./search')
 const consultancyRouter = require('./consultancy')
-const demoPaginacijaRouter = require('./demo-paginacija')
 const extractionRouter = require('./extraction')
 
 router.use('/comments', commentsRouter)
@@ -18,7 +17,6 @@ router.use('/dictionaries', dictionariesRouter)
 router.use('/portals', portalsRouter)
 router.use('/search', searchRouter)
 router.use('/consultancy', consultancyRouter)
-router.use('/demo-paginacija', demoPaginacijaRouter)
 router.use('/extraction', extractionRouter)
 
 module.exports = router

express/routes/api/v1/portals.js

@@ -1,4 +1,5 @@
 const router = require('express-promise-router')()
+const user = require('../../../middleware/user')
 
 const {
   create,
@@ -10,6 +11,9 @@ const {
   deleteLinkedDictionary
 } = require('../../../controllers/api/v1/portals')
 
+// All further routes are only available to portal admin.
+router.use(user.isAuthenticated, user.isPortalAdmin)
+
 // Create new portal connection
 router.post('/createPortal', create)
 

express/routes/api/v1/search.js

@@ -5,11 +5,11 @@ const user = require('../../../middleware/user')
 // Return search results for main search.
 router.get('/main', search.listMainEntries)
 
-// TODO This route assumes existance of user. Make sure to pre check it.
 // Return search results for editor search.
 router.get(
   '/editor/:dictionaryId',
-  user.isDictionaryEditor,
+  user.isAuthenticated,
+  user.canContentEdit,
   search.listEditorEntries
 )
 

express/routes/api/v1/system.js

@@ -4,12 +4,18 @@ const {
   listDictionaries,
   syncDictionary
 } = require('../../../controllers/api/v1/inter_instance_sync')
+const user = require('../../../middleware/user')
 
 // Receive Content Security Policy violation reports.
 router.post('/csp-reports', system.handleCspReports)
 
 // Trigger synchronization with Eurotermbank.
-router.get('/eurotermbank-sync-push', system.syncWithEurotermbank)
+router.get(
+  '/eurotermbank-sync-push',
+  user.isAuthenticated,
+  user.isPortalAdmin,
+  system.syncWithEurotermbank
+)
 
 // List dictionaries (one page).
 router.get('/inter-instance-sync/dictionaries', listDictionaries)

express/routes/api/v1/users.js

@@ -1,6 +1,7 @@
 const router = require('express-promise-router')()
 const user = require('../../../controllers/users')
 const users = require('../../../controllers/api/v1/users')
+const userAuth = require('../../../middleware/user')
 
 // Validate and create a new user.
 router.post('/register', user.register)
@@ -8,12 +9,38 @@ router.post('/register', user.register)
 // Validate and log the user in.
 router.post('/login', user.login)
 
-router.get('/addUser', user.findByUsernameOrEmail)
+// Supply user with the token to set a new password.
+router.post('/reset-password-init', user.generateResetPasswordToken)
 
-router.get('/listAllUsers', users.listUsers)
+// Validate new passwords, change if successful and sign the user in.
+router.post('/reset-password-submit', user.changePassword)
 
+// Find user by username or email in dictionary or admin console.
+router.get(
+  '/addUser',
+  userAuth.isAuthenticated,
+  userAuth.canAdministrateDictionary,
+  user.findByUsernameOrEmail
+)
+
+// List all users in the admin console.
+router.get(
+  '/listAllUsers',
+  userAuth.isAuthenticated,
+  userAuth.isPortalAdmin,
+  users.listUsers
+)
+
+// Update hits per page setting of the requesting user.
 router.post('/hitsPerPage', users.updateHitsPerPage)
 
-router.post('/nameAndSurname', users.updateFristNameAndSurname)
+// Update first name, last name and email of the requesting user.
+router.post('/basic-data', users.updateBasicData)
+
+// Update password of the requesting user.
+router.post('/password', users.updatePassword)
+
+// Delete user profile of the requesting user.
+router.delete('/current', users.deleteCurrent)
 
 module.exports = router