assignment 2

index.js

@@ -5,6 +5,7 @@ const MongoStore = require("connect-mongo");
 const MongoClient = require("mongodb").MongoClient;
 const joi = require("joi");
 const bcrypt = require("bcrypt");
+const ObjectId = require("mongodb").ObjectId;
 
 // Initialize app
 const app = express();
@@ -19,6 +20,7 @@ async function connectMongo() {
   try {
     const connection = await MongoClient.connect(mongoURI, { connectTimeoutMS: 1000 });
     users = connection.db(config.mongo_database).collection("users");
+    console.log("Connected to mongo");
   } catch (err) {
     console.error(`Failed to connect to mongodb at (mongodb+srv://${config.mongo_host})`);
   }
@@ -35,7 +37,7 @@ app.use(session({
   store: MongoStore.create({ mongoUrl: `${mongoURI}/${config.mongo_database}`, crypto: { secret: config.mongo_secret } }),
   resave: true,
   saveUninitialized: false,
-  cookie: { maxAge: 60000 },
+  cookie: { maxAge: 3600000 },
 }));
 
 /**** Page routes ****/
@@ -43,19 +45,19 @@ app.use(session({
 app.get("/", async (req, res) => {
   res.set('Content-Type', 'text/html');
 
-  res.render("index", { authenticated: req.session.authenticated, username: req.session.username });
+  res.render("index", { authenticated: req.session.authenticated, user: req.session.user });
   return res.status(200);
 });
 
 app.get("/login", (req, res) => {
   res.set('Content-Type', 'text/html');
-  res.render("login", { message: req.session.message });
+  res.render("login", { authenticated: req.session.authenticated, message: req.session.message });
   return res.status(200);
 })
 
 app.get("/signup", (req, res) => {
   res.set('Content-Type', 'text/html');
-  res.render("signup", { message: req.session.message });
+  res.render("signup", { authenticated: req.session.authenticated, message: req.session.message });
   return res.status(200);
 });
 
@@ -70,10 +72,29 @@ app.get("/members", (req, res) => {
   let name = names[Math.floor(Math.random() * names.length)];
 
   res.set('Content-Type', 'text/html');
-  res.render("members", { name: name, username: req.session.username });
+  res.render("members", { authenticated: req.session.authenticated, user: req.session.user });
   return res.status(200);
 });
 
+app.get("/admin", async (req, res) => {
+  if (!req.session.authenticated) {
+    req.session.message = "Please login";
+    res.status(401);
+    return res.redirect("/login");
+  }
+
+  if (req.session.user.type != "admin") {
+    req.session.message = "You are not authorized to access that resource";
+    res.status(401);
+    return res.redirect("/members");
+  }
+
+  let userList = await users.find({}).toArray();
+
+  res.set('Content-Type', 'text/html');
+  res.render("admin", { authenticated: req.session.authenticated, user: req.session.user, users: userList });
+});
+
 /*** Authentication routes ***/
 
 app.post("/login", async (req, res) => {
@@ -96,7 +117,7 @@ app.post("/login", async (req, res) => {
 
   if (await bcrypt.compare(req.body.password, user.password)) {
     req.session.authenticated = true;
-    req.session.username = user.name;
+    req.session.user = user;
     req.session.message = "";
 
     res.status(200);
@@ -128,10 +149,16 @@ app.post("/signup", async (req, res) => {
     name: req.body.name,
     email: req.body.email,
     password: password,
+    type: "user"
   });
 
   req.session.authenticated = true;
-  req.session.username = req.body.name;
+  req.session.user = {
+    name: req.body.name,
+    email: req.body.email,
+    password: password, // bad but oh well
+    type: "user"
+  };
   req.session.message = "";
 
   res.status(200);
@@ -144,11 +171,29 @@ app.get("/logout", (req, res) => {
   return res.redirect('/');
 });
 
+app.post("/promote", (req, res) => {
+  users.updateOne({ _id: new ObjectId(req.body.userId) }, { $set: { type: "admin" } }).then((results) => {
+    return res.redirect("/admin");
+  }).catch((err) => {
+    console.error(err);
+    return res.redirect("/admin");
+  });
+});
+
+app.post("/demote", (req, res) => {
+  users.updateOne({ _id: new ObjectId(req.body.userId) }, { $set: { type: "user" } }).then((results) => {
+    return res.redirect("/admin");
+  }).catch((err) => {
+    console.error(err);
+    return res.redirect("/admin");
+  });
+});
+
 /*** 404 Not found ***/
 
 app.get("/*splat", (req, res) => {
   res.set('Content-Type', 'text/html');
-  res.render("notFound");
+  res.render("notFound", { authenticated: req.session.authenticated });
   return res.status(404);
 });