Angular Security course

Author: jhades

server/auth.middleware.ts

@@ -3,7 +3,7 @@ import {Request, Response, NextFunction} from 'express';
 
 export function checkIfAuthenticated(req: Request, res: Response, next: NextFunction) {
 
-    if (req['userId']) {
+    if (req['user']) {
         next();
     }
     else {

server/database-data.ts

@@ -6,19 +6,19 @@ export const USERS: { [key: number]: DbUser } = {
         email: 'admin@gmail.com',
         // ADMIN user (password is Password10) can read all lessons and also can login on behalf of other users
         passwordDigest: '$argon2i$v=19$m=4096,t=3,p=1$PcKtsL4a6+xuPbMCKPep7A$rrFO2lKZcAVguIMaSGaf3hMrKtb6wUG4zN/wDG+xNts',
-        roles: [
-            'READ:LESSONS'
-        ]
+        roles: {
+            'READ:LESSONS': true
+        }
     },
     2: {
         id: 1,
         email: 'user@gmail.com',
         // normal user (password is Password10), does not have access to login as another user functionality
         passwordDigest: '$argon2i$v=19$m=4096,t=3,p=1$PcKtsL4a6+xuPbMCKPep7A$rrFO2lKZcAVguIMaSGaf3hMrKtb6wUG4zN/wDG+xNts',
-        roles: [
-            'READ:LESSONS',
-            'ADMIN'
-        ]
+        roles: {
+            'READ:LESSONS': true,
+            'ADMIN': true
+        }
     }
 };
 

server/db-user.ts

@@ -4,5 +4,5 @@ export interface DbUser {
     id:number;
     email:string;
     passwordDigest:string,
-    roles: string[]
+    roles: Object
 }

server/get-user.middleware.ts

@@ -29,7 +29,7 @@ async function handleSessionCookie(jwt:string, req: Request) {
 
         const payload = await decodeJwt(jwt);
 
-        req["userId"] = payload.sub;
+        req["user"] = payload;
 
     }
     catch(err) {

server/login-as-user.route.ts

@@ -0,0 +1,38 @@
+
+
+
+import {db} from "./database";
+import {createSessionToken} from "./security.utils";
+
+
+export function loginAsUser(req, res) {
+
+    const adminUser = req["user"],
+          roles = adminUser.userRoles,
+          userEmail = req.body.email;
+
+    if (roles && roles['ADMIN']) {
+
+        const newUser = db.findUserByEmail(userEmail);
+
+        createSessionToken(newUser)
+            .then(sessionToken => {
+
+                res.cookie("SESSIONID", sessionToken, {httpOnly:true, secure:true});
+
+                res.status(200).json({ id: newUser.id, email: newUser.email });
+
+            })
+            .catch(err => {
+                console.log("Error trying to login as user",err);
+                res.sendStatus(500);
+            });
+
+
+    }
+    else {
+        res.SendStatus(403);
+    }
+}
+
+

server/login.route.ts

@@ -43,8 +43,8 @@ async function loginAndBuildResponse(credentials:any, user:DbUser,  res: Respons
     catch(err) {
 
         console.log("Login failed!");
-
         res.sendStatus(403);
+
     }
 }
 
@@ -58,7 +58,7 @@ async function attemptLogin(credentials:any, user:DbUser) {
         throw new Error("Password Invalid");
     }
 
-    return createSessionToken(user.id.toString());
+    return createSessionToken(user);
 }
 
 

server/read-all-lessons.route.ts

@@ -4,6 +4,12 @@ import {db} from "./database";
 
 export function readAllLessons(req, res) {
 
-    res.status(200).json({lessons:db.readAllLessons()});
-
+    const userRoles = req["user"].roles;
+
+    if (userRoles && userRoles['READ:LESSONS']) {
+        res.status(200).json({lessons:db.readAllLessons()});
+    }
+    else {
+        res.SendStatus(403);
+    }
 }

server/security.utils.ts

@@ -7,6 +7,7 @@ const crypto = require('crypto');
 import * as jwt from 'jsonwebtoken';
 import * as fs from "fs";
 import * as argon2 from 'argon2';
+import {DbUser} from "./db-user";
 
 
 export const randomBytes = util.promisify(crypto.randomBytes);
@@ -21,11 +22,12 @@ const RSA_PUBLIC_KEY = fs.readFileSync('./demos/public.key');
 const SESSION_DURATION = 1000;
 
 
-export async function createSessionToken(userId:string) {
+export async function createSessionToken(user: DbUser) {
     return signJwt({}, RSA_PRIVATE_KEY, {
         algorithm: 'RS256',
         expiresIn: 240,
-        subject: userId
+        subject: user.id,
+        roles: user.roles
     });
 }
 

src/app/admin/admin.component.css

@@ -13,5 +13,5 @@
         <button class="button button-primary" (click)="loginAsUser()">Login As User</button>
     </div>
 
+</form>
 
-</form>

src/app/admin/admin.component.html

@@ -1,18 +1,21 @@
-import { Component, OnInit } from '@angular/core';
+import { Component } from '@angular/core';
 import {FormBuilder, FormGroup, Validators} from "@angular/forms";
 import {AuthService} from "../services/auth.service";
 import {Router} from "@angular/router";
 
 @Component({
   selector: 'admin',
   templateUrl: './admin.component.html',
-  styleUrls: ['./admin.component.css', '../common/forms.css']
+  styleUrls: [ '../common/forms.css']
 })
 export class AdminComponent {
 
     form:FormGroup;
 
-    constructor(private fb:FormBuilder, private authService: AuthService, private router: Router) {
+    constructor(
+        private fb:FormBuilder,
+        private authService: AuthService,
+        private router: Router) {
 
         this.form = this.fb.group({
             userEmail: ['user@gmail.com',Validators.required]
@@ -24,19 +27,15 @@ export class AdminComponent {
 
         const val = this.form.value;
 
-        if (val.email && val.password) {
-
+        if (val.email) {
             this.authService.loginAsUser(val.email)
                 .subscribe(
                     () => {
                         console.log("Logged in as user with email " + val.email);
                         this.router.navigateByUrl('/');
                     }
                 );
-
         }
-
-
     }
 
 }