From d5adf7a2be68aef4b01e61d44a2c1426da8e01e7 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Mon, 28 Apr 2025 10:34:03 -0700 Subject: [PATCH 1/5] remove role and teamId from invite form --- client/src/Pages/Auth/Register/Register.jsx | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/client/src/Pages/Auth/Register/Register.jsx b/client/src/Pages/Auth/Register/Register.jsx index 118357432..934508c71 100644 --- a/client/src/Pages/Auth/Register/Register.jsx +++ b/client/src/Pages/Auth/Register/Register.jsx @@ -148,8 +148,8 @@ const Register = ({ isSuperAdmin }) => { try { const res = await networkService.verifyInvitationToken(token); const invite = res.data.data; - const { role, email, teamId } = invite; - setForm({ ...form, email, role, teamId }); + const { email } = invite; + setForm({ ...form, email }); } catch (error) { navigate("/register", { replace: true }); } @@ -259,7 +259,8 @@ const Register = ({ isSuperAdmin }) => { const handleChange = (event) => { const { value, id } = event.target; const name = idMap[id]; - const lowerCasedValue = name === idMap["register-email-input"]? value?.toLowerCase() || value : value + const lowerCasedValue = + name === idMap["register-email-input"] ? value?.toLowerCase() || value : value; setForm((prev) => ({ ...prev, [name]: lowerCasedValue, From c2ffdd1d626228303ce246d0fc64d1e6b8e997f2 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Mon, 28 Apr 2025 10:34:32 -0700 Subject: [PATCH 2/5] get invite role and teamId from invite instead of client --- server/controllers/authController.js | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/server/controllers/authController.js b/server/controllers/authController.js index dc2a9c104..9d5fe0c20 100755 --- a/server/controllers/authController.js +++ b/server/controllers/authController.js @@ -57,9 +57,9 @@ class AuthController { */ registerUser = async (req, res, next) => { try { - if(req.body?.email){ + if (req.body?.email) { req.body.email = req.body.email?.toLowerCase(); - } + } await registrationBodyValidation.validateAsync(req.body); } catch (error) { const validationError = handleValidationError(error, SERVICE_NAME); @@ -68,11 +68,13 @@ class AuthController { } // Create a new user try { - const { inviteToken } = req.body; + const user = req.body; // If superAdmin exists, a token should be attached to all further register requests const superAdminExists = await this.db.checkSuperadmin(req, res); if (superAdminExists) { - await this.db.getInviteTokenAndDelete(inviteToken); + const invitedUser = await this.db.getInviteTokenAndDelete(user.inviteToken); + user.role = invitedUser.role; + user.teamId = invitedUser.teamId; } else { // This is the first account, create JWT secret to use if one is not supplied by env const jwtSecret = crypto.randomBytes(64).toString("hex"); @@ -133,8 +135,8 @@ class AuthController { */ loginUser = async (req, res, next) => { try { - if(req.body?.email){ - req.body.email = req.body.email?.toLowerCase(); + if (req.body?.email) { + req.body.email = req.body.email?.toLowerCase(); } await loginValidation.validateAsync(req.body); } catch (error) { From 99d416f31a2e3712d148513ab7aa1a135276bf95 Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Mon, 28 Apr 2025 10:34:49 -0700 Subject: [PATCH 3/5] add default role, remove role requirement from validation --- server/db/models/InviteToken.js | 1 + server/validation/joi.js | 32 +++++++++++++++++++------------- 2 files changed, 20 insertions(+), 13 deletions(-) diff --git a/server/db/models/InviteToken.js b/server/db/models/InviteToken.js index 0c2402b07..079600647 100755 --- a/server/db/models/InviteToken.js +++ b/server/db/models/InviteToken.js @@ -15,6 +15,7 @@ const InviteTokenSchema = mongoose.Schema( role: { type: Array, required: true, + default: ["user"], }, token: { type: String, diff --git a/server/validation/joi.js b/server/validation/joi.js index c588eee81..41433e7cd 100755 --- a/server/validation/joi.js +++ b/server/validation/joi.js @@ -63,11 +63,7 @@ const registrationBodyValidation = joi.object({ }), password: joi.string().min(8).required().pattern(passwordPattern), profileImage: joi.any(), - role: joi - .array() - .items(joi.string().valid("superadmin", "admin", "user", "demo")) - .min(1) - .required(), + role: joi.array().items(joi.string().valid("superadmin", "admin", "user", "demo")), teamId: joi.string().allow("").required(), inviteToken: joi.string().allow("").required(), }); @@ -305,7 +301,18 @@ const getChecksParamValidation = joi.object({ }); const getChecksQueryValidation = joi.object({ - type: joi.string().valid("http", "ping", "pagespeed", "hardware", "docker", "port", "distributed_http", "distributed_test"), + type: joi + .string() + .valid( + "http", + "ping", + "pagespeed", + "hardware", + "docker", + "port", + "distributed_http", + "distributed_test" + ), sortOrder: joi.string().valid("asc", "desc"), limit: joi.number(), dateRange: joi.string().valid("recent", "hour", "day", "week", "month", "all"), @@ -578,16 +585,15 @@ const triggerNotificationBodyValidation = joi.object({ const createAnnouncementValidation = joi.object({ title: joi.string().required().messages({ - 'string.empty': 'Title cannot be empty', - 'any.required': 'Title is required', + "string.empty": "Title cannot be empty", + "any.required": "Title is required", }), message: joi.string().required().messages({ - 'string.empty': 'Message cannot be empty', - 'any.required': 'Message is required', + "string.empty": "Message cannot be empty", + "any.required": "Message is required", }), userId: joi.string().required(), - }); - +}); export { roleValidatior, @@ -651,5 +657,5 @@ export { imageValidation, triggerNotificationBodyValidation, webhookConfigValidation, - createAnnouncementValidation + createAnnouncementValidation, }; From 0c31e8fce0a6f8c564c18e71283fe79975fc31ce Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Mon, 28 Apr 2025 10:39:19 -0700 Subject: [PATCH 4/5] add user as default role --- client/src/Components/TabPanels/Account/TeamPanel.jsx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/client/src/Components/TabPanels/Account/TeamPanel.jsx b/client/src/Components/TabPanels/Account/TeamPanel.jsx index 72ff55eee..e20d859f2 100644 --- a/client/src/Components/TabPanels/Account/TeamPanel.jsx +++ b/client/src/Components/TabPanels/Account/TeamPanel.jsx @@ -25,7 +25,7 @@ const TeamPanel = () => { const [toInvite, setToInvite] = useState({ email: "", - role: ["0"], + role: ["user"], }); const [data, setData] = useState([]); const [members, setMembers] = useState([]); @@ -107,7 +107,7 @@ const TeamPanel = () => { const handleChange = (event) => { const { value } = event.target; - const newEmail = value?.toLowerCase() || value + const newEmail = value?.toLowerCase() || value; setToInvite((prev) => ({ ...prev, email: newEmail, From 67ae722720c0219c54a6338dd996c161457eb57a Mon Sep 17 00:00:00 2001 From: Alex Holliday Date: Mon, 28 Apr 2025 10:55:06 -0700 Subject: [PATCH 5/5] disallow role --- server/validation/joi.js | 1 - 1 file changed, 1 deletion(-) diff --git a/server/validation/joi.js b/server/validation/joi.js index 41433e7cd..8f17df0d1 100755 --- a/server/validation/joi.js +++ b/server/validation/joi.js @@ -79,7 +79,6 @@ const editUserBodyValidation = joi.object({ newPassword: joi.string().min(8).pattern(passwordPattern), password: joi.string().min(8).pattern(passwordPattern), deleteProfileImage: joi.boolean(), - role: joi.array(), }); const recoveryValidation = joi.object({