Merge remote-tracking branch 'upstream/develop' into feat/incidents

Server/controllers/authController.js

@@ -428,6 +428,18 @@ const deleteUserController = async (req, res, next) => {
   }
 };
 
+const getAllUsersController = async (req, res) => {
+  try {
+    const allUsers = await req.db.getAllUsers(req, res);
+    res
+      .status(200)
+      .json({ success: true, msg: "Got all users", data: allUsers });
+  } catch (error) {
+    error.service = SERVICE_NAME;
+    next(error);
+  }
+};
+
 module.exports = {
   registerController,
   loginController,
@@ -438,4 +450,5 @@ module.exports = {
   validateRecoveryTokenController,
   resetPasswordController,
   deleteUserController,
+  getAllUsersController,
 };

Server/db/MongoDB.js

@@ -158,6 +158,17 @@ const deleteUser = async (req, res) => {
   }
 };
 
+const getAllUsers = async (req, res) => {
+  try {
+    const users = await UserModel.find()
+      .select("-password")
+      .select("-profileImage");
+    return users;
+  } catch (error) {
+    throw error;
+  }
+};
+
 const requestInviteToken = async (req, res) => {
   try {
     await InviteToken.deleteMany({ email: req.body.email });
@@ -680,6 +691,7 @@ module.exports = {
   getUserByEmail,
   updateUser,
   deleteUser,
+  getAllUsers,
   requestInviteToken,
   requestRecoveryToken,
   validateRecoveryToken,

Server/middleware/verifyAdmin.js

@@ -0,0 +1,57 @@
+const jwt = require("jsonwebtoken");
+const logger = require("../utils/logger");
+const SERVICE_NAME = "verifyAdmin";
+const TOKEN_PREFIX = "Bearer ";
+const { errorMessages } = require("../utils/messages");
+/**
+ * Verifies the JWT token
+ * @function
+ * @param {express.Request} req
+ * @param {express.Response} res
+ * @param {express.NextFunction} next
+ * @returns {express.Response}
+ */
+const verifyAdmin = (req, res, next) => {
+  const token = req.headers["authorization"];
+  // Make sure a token is provided
+  if (!token) {
+    const error = new Error(errorMessages.NO_AUTH_TOKEN);
+    error.status = 401;
+    error.service = SERVICE_NAME;
+    next(error);
+    return;
+  }
+  // Make sure it is properly formatted
+  if (!token.startsWith(TOKEN_PREFIX)) {
+    const error = new Error(errorMessages.INVALID_AUTH_TOKEN); // Instantiate a new Error object for improperly formatted token
+    error.status = 400;
+    error.service = SERVICE_NAME;
+    next(error);
+    return;
+  }
+
+  const parsedToken = token.slice(TOKEN_PREFIX.length, token.length);
+  // verify admin role is present
+  jwt.verify(parsedToken, process.env.JWT_SECRET, (err, decoded) => {
+    if (err) {
+      logger.error(errorMessages.INVALID_AUTH_TOKEN, {
+        service: SERVICE_NAME,
+      });
+      return res
+        .status(401)
+        .json({ success: false, msg: errorMessages.INVALID_AUTH_TOKEN });
+    }
+
+    if (decoded.role.includes("admin") === false) {
+      logger.error(errorMessages.INVALID_AUTH_TOKEN, {
+        service: SERVICE_NAME,
+      });
+      return res
+        .status(401)
+        .json({ success: false, msg: errorMessages.UNAUTHORIZED });
+    }
+    next();
+  });
+};
+
+module.exports = { verifyAdmin };

Server/routes/authRoute.js

@@ -1,5 +1,6 @@
 const router = require("express").Router();
 const { verifyJWT } = require("../middleware/verifyJWT");
+const { verifyAdmin } = require("../middleware/verifyAdmin");
 const { verifyOwnership } = require("../middleware/verifyOwnership");
 const multer = require("multer");
 const upload = multer();
@@ -13,6 +14,7 @@ const {
   validateRecoveryTokenController,
   resetPasswordController,
   checkAdminController,
+  getAllUsersController,
   deleteUserController,
   inviteController,
 } = require("../controllers/authController");
@@ -27,6 +29,7 @@ router.post(
   userEditController
 );
 router.get("/users/admin", checkAdminController);
+router.get("/users", verifyJWT, verifyAdmin, getAllUsersController);
 router.delete(
   "/user/:userId",
   verifyJWT,

Server/utils/messages.js

@@ -2,6 +2,7 @@ const errorMessages = {
   // General Errors:
   FRIENDLY_ERROR: "Something went wrong...",
   UNKNOWN_ERROR: "An unknown error occurred",
+
   // Auth Controller
   UNAUTHORIZED: "Unauthorized access",
   AUTH_ADMIN_EXISTS: "Admin already exists",