Skip to content

Commit 3908b29

Browse files
munjoonteomunjoonteo
committed
Added token validation to authenticated functions
1 parent 8b53da6 commit 3908b29

File tree

5 files changed

+85
-19
lines changed

5 files changed

+85
-19
lines changed

‎server/category.go

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ import (
88
"go.mongodb.org/mongo-driver/mongo"
99
)
1010

11-
func GetCat(collection *mongo.Collection, id int) *Category {
11+
// GetCat - Retrieve a category from the database
12+
func GetCat(collection *mongo.Collection, id int, token string) *Category {
13+
if !validToken(token) {
14+
return nil
15+
}
1216

1317
var result *Category
1418
filter := bson.D{{"categoryID", id}}
@@ -22,7 +26,12 @@ func GetCat(collection *mongo.Collection, id int) *Category {
2226
return result
2327
}
2428

25-
func NewCat(collection *mongo.Collection, catID int, index int, name string) {
29+
// NewCat - Add a new category
30+
func NewCat(collection *mongo.Collection, catID int, index int, name string, token string) {
31+
if !validToken(token) {
32+
return
33+
}
34+
2635
category := Category{
2736
categoryID: catID,
2837
categoryName: name,
@@ -35,7 +44,12 @@ func NewCat(collection *mongo.Collection, catID int, index int, name string) {
3544
}
3645
}
3746

38-
func PatchCat(collection *mongo.Collection, catID int, name string, index int) {
47+
// PatchCat - Update a category with new information
48+
func PatchCat(collection *mongo.Collection, catID int, name string, index int, token string) {
49+
if !validToken(token) {
50+
return
51+
}
52+
3953
filter := bson.D{{"categoryID", catID}}
4054
update := bson.D{
4155
{"$set", bson.D{
@@ -51,7 +65,12 @@ func PatchCat(collection *mongo.Collection, catID int, name string, index int) {
5165
}
5266
}
5367

54-
func DeleteCat(collection *mongo.Collection, id int) {
68+
// DeleteCat - Delete a category from the database
69+
func DeleteCat(collection *mongo.Collection, id int, token string) {
70+
if !validToken(token) {
71+
return
72+
}
73+
5574
filter := bson.D{{"categoryID", id}}
5675

5776
// Find a category by id and delete it

‎server/login.go

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ import (
1212
"gopkg.in/ldap.v2"
1313
)
1414

15-
func auth(collection *mongo.Collection, zid string, password string) string {
15+
var jwtKey = []byte("secret_text")
16+
17+
// Auth - to login
18+
func Auth(collection *mongo.Collection, zid string, password string, permissions string) string {
1619
// Connect to UNSW LDAP server
1720
l, err := ldap.Dial("tcp", "ad.unsw.edu.au")
1821
if err != nil {
@@ -47,12 +50,13 @@ func auth(collection *mongo.Collection, zid string, password string) string {
4750
}
4851

4952
// Encode user details into a JWT and turn it into a string
50-
jwtKey := []byte("secret_text")
53+
5154
userFound := searchResult.Entries[0]
5255
expirationTime := time.Now().Add(time.Hour * 24)
5356
claims := &Claims{
54-
hashedZID: hashedZID,
55-
firstName: userFound.GetAttributeValue("firstName"),
57+
hashedZID: hashedZID,
58+
firstName: userFound.GetAttributeValue("firstName"),
59+
permissions: permissions,
5660
StandardClaims: jwt.StandardClaims{
5761
ExpiresAt: expirationTime.Unix(),
5862
},
@@ -100,3 +104,23 @@ func auth(collection *mongo.Collection, zid string, password string) string {
100104

101105
return tokenString
102106
}
107+
108+
// validToken - returns
109+
func validToken(tokenString string) bool {
110+
claims := &Claims{}
111+
tkn, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
112+
return jwtKey, nil
113+
})
114+
115+
if err != nil {
116+
if err == jwt.ErrSignatureInvalid {
117+
return false
118+
}
119+
}
120+
121+
if !tkn.Valid || claims.permissions != "staff" {
122+
return false
123+
}
124+
125+
return true
126+
}

‎server/post.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"go.mongodb.org/mongo-driver/mongo/options"
1111
)
1212

13+
// GetPost - Retrieve a post from the database
1314
func GetPost(collection *mongo.Collection, id int, category string) *Post {
1415
var result *Post
1516

@@ -23,6 +24,7 @@ func GetPost(collection *mongo.Collection, id int, category string) *Post {
2324
return result
2425
}
2526

27+
// GetAllPosts - Retrieve all posts
2628
func GetAllPosts(collection *mongo.Collection, count int, cat string) []*Post {
2729
findOptions := options.Find()
2830
if count != 10 {
@@ -60,6 +62,7 @@ func GetAllPosts(collection *mongo.Collection, count int, cat string) []*Post {
6062
return posts
6163
}
6264

65+
// NewPost - Add a new post
6366
func NewPost(collection *mongo.Collection, id int, category int, showInMenu bool, title string, subtitle string, postType string, content string, github string, fb string) {
6467
post := Post{
6568
postID: id,
@@ -81,6 +84,7 @@ func NewPost(collection *mongo.Collection, id int, category int, showInMenu bool
8184
}
8285
}
8386

87+
// UpdatePost - Update a post with new information
8488
func UpdatePost(collection *mongo.Collection, id int, category int, showInMenu bool, title string, subtitle string, postType string, content string, github string, fb string) {
8589
filter := bson.D{{"postID", id}}
8690
update := bson.D{
@@ -104,6 +108,7 @@ func UpdatePost(collection *mongo.Collection, id int, category int, showInMenu b
104108
}
105109
}
106110

111+
// DeletePost - Delete a post from the database
107112
func DeletePost(collection *mongo.Collection, id int) {
108113
filter := bson.D{{"postID", id}}
109114

‎server/server.go

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,9 @@ type Sponsor struct {
5858

5959
// Claims - struct to store jwt data
6060
type Claims struct {
61-
hashedZID [32]byte
62-
firstName string
61+
hashedZID [32]byte
62+
firstName string
63+
permissions string
6364
jwt.StandardClaims
6465
}
6566

@@ -140,7 +141,8 @@ func login(collection *mongo.Collection) echo.HandlerFunc {
140141
return func(c echo.Context) error {
141142
zid := c.FormValue("zid")
142143
password := c.FormValue("password")
143-
tokenString := auth(collection, zid, password)
144+
permissions := c.FormValue("permissions")
145+
tokenString := Auth(collection, zid, password, permissions)
144146
return c.JSON(http.StatusOK, H{
145147
"token": tokenString,
146148
})
@@ -211,8 +213,9 @@ func deletePost(collection *mongo.Collection) echo.HandlerFunc {
211213

212214
func getCat(collection *mongo.Collection) echo.HandlerFunc {
213215
return func(c echo.Context) error {
216+
token := c.FormValue("token")
214217
id, _ := strconv.Atoi(c.QueryParam("id"))
215-
result := GetCat(collection, id)
218+
result := GetCat(collection, id, token)
216219
return c.JSON(http.StatusOK, H{
217220
"category": result,
218221
})
@@ -221,47 +224,52 @@ func getCat(collection *mongo.Collection) echo.HandlerFunc {
221224

222225
func newCat(collection *mongo.Collection) echo.HandlerFunc {
223226
return func(c echo.Context) error {
227+
token := c.FormValue("token")
224228
catID, _ := strconv.Atoi(c.FormValue("id"))
225229
index, _ := strconv.Atoi(c.FormValue("index"))
226230
name := c.FormValue("name")
227-
NewCat(collection, catID, index, name)
231+
NewCat(collection, catID, index, name, token)
228232
return c.JSON(http.StatusOK, H{})
229233
}
230234
}
231235

232236
func patchCat(collection *mongo.Collection) echo.HandlerFunc {
233237
return func(c echo.Context) error {
238+
token := c.FormValue("token")
234239
catID, _ := strconv.Atoi(c.FormValue("id"))
235240
name := c.FormValue("name")
236241
index, _ := strconv.Atoi(c.FormValue("index"))
237-
PatchCat(collection, catID, name, index)
242+
PatchCat(collection, catID, name, index, token)
238243
return c.JSON(http.StatusOK, H{})
239244
}
240245
}
241246

242247
func deleteCat(collection *mongo.Collection) echo.HandlerFunc {
243248
return func(c echo.Context) error {
249+
token := c.FormValue("token")
244250
id, _ := strconv.Atoi(c.FormValue("id"))
245-
DeleteCat(collection, id)
251+
DeleteCat(collection, id, token)
246252
return c.JSON(http.StatusOK, H{})
247253
}
248254
}
249255

250256
func newSponsor(collection *mongo.Collection) echo.HandlerFunc {
251257
return func(c echo.Context) error {
258+
token := c.FormValue("token")
252259
expiryStr := c.FormValue("expiry")
253260
name := c.FormValue("name")
254261
logo := c.FormValue("logo")
255262
tier := c.FormValue("tier")
256-
NewSponsor(collection, expiryStr, name, logo, tier)
263+
NewSponsor(collection, expiryStr, name, logo, tier, token)
257264
return c.JSON(http.StatusOK, H{})
258265
}
259266
}
260267

261268
func deleteSponsor(collection *mongo.Collection) echo.HandlerFunc {
262269
return func(c echo.Context) error {
270+
token := c.FormValue("token")
263271
id := c.FormValue("id")
264-
DeleteSponsor(collection, id)
272+
DeleteSponsor(collection, id, token)
265273
return c.JSON(http.StatusOK, H{})
266274
}
267275
}

‎server/sponsor.go

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,12 @@ import (
1010
"go.mongodb.org/mongo-driver/mongo"
1111
)
1212

13-
func NewSponsor(collection *mongo.Collection, expiryStr string, name string, logo string, tier string) {
13+
// NewSponsor - Add a new sponsor
14+
func NewSponsor(collection *mongo.Collection, expiryStr string, name string, logo string, tier string, token string) {
15+
if !validToken(token) {
16+
return
17+
}
18+
1419
expiryTime, _ := time.Parse(time.RFC3339, expiryStr)
1520
id := uuid.New()
1621

@@ -28,7 +33,12 @@ func NewSponsor(collection *mongo.Collection, expiryStr string, name string, log
2833
}
2934
}
3035

31-
func DeleteSponsor(collection *mongo.Collection, id string) {
36+
// DeleteSponsor - Delete a sponsor from the database
37+
func DeleteSponsor(collection *mongo.Collection, id string, token string) {
38+
if !validToken(token) {
39+
return
40+
}
41+
3242
parsedID := uuid.Must(uuid.Parse(id))
3343

3444
// Find a sponsor by ID and delete it

0 commit comments

Comments
 (0)