brief-05-back/src/controllers/auth.controller.ts

import JwtService from "@services/jwt.service";

import type { IReqEditUserData } from "@interfaces/IReqEditUserData";
import UserService from "@services/user.service";
import type { Request, Response } from "express";
import { Logger } from "tslog";

const logger = new Logger({
	name: "AuthController",
});

//FIX Better return object interface
/**
 * Registers a user with the given request data.
 *
 * @param {Request} req - The request object containing user data.
 * @param {Response} res - The response object to send the registration result.
 *
 * @return {Promise} A promise that resolves to the registration result.
 *                   It can have the following properties:
 *                   - error: "gdprNotApproved" if GDPR is not approved
 *                   - error: "exist" if the user already exists
 *                   - Otherwise, the registered user data
 */
async function registerUser(
	req: Request,
	res: Response,
): Promise<unknown> {
	const body = req.body;
	if (!body) {
		logger.warn(`Invalid input data (${req.ip})`);
		return res.type("application/json").status(400).json({
			error: "Invalid input data",
		});
	}
	if (
		!body.password ||
		!body.username ||
		!body.firstName ||
		!body.lastName ||
		!body.displayName
	) {
		logger.warn(`Field(s) missing (${req.ip})`);
		return res.type("application/json").status(400).json({
			error: "Field(s) missing",
		});
	}

	let gdpr = false;
	if (body.gdpr === true) {
		gdpr = true;
	}
	const sanitizeData = {
		username: `${body.username}`,
		displayName: `${body.displayName}`,
		gdpr: gdpr,
		password: `${body.password}`,
		firstName: `${body.firstName}`,
		lastName: `${body.lastName}`,
	};

	const RegisterServiceResult =
		await UserService.register(sanitizeData);

	if (RegisterServiceResult.error === "gdprNotApproved") {
		logger.warn(`GDPR not approved (${req.ip})`);
		return res.status(400).json({
			error: RegisterServiceResult.error,
			message: "GDPR not accepted.",
		});
	}
	if (RegisterServiceResult.error === "exist") {
		logger.warn(`The user already exists (${req.ip})`);
		return res.type("application/json").status(400).json({
			error: RegisterServiceResult.error,
			message: "The user already exists.",
		});
	}

	// SUCCESS
	logger.info(`User registered successfully (${req.ip})`);
	return res
		.type("application/json")
		.status(201)
		.json(RegisterServiceResult);
}

/**
 * Logs in a user with the provided credentials.
 *
 * @param {Request} req - The request object.
 * @param {Response} res - The response object.
 *
 * @return {Promise<void>} A promise that resolves when the user is logged in or rejects with an error.
 */
async function loginUser(
	req: Request,
	res: Response,
): Promise<void> {
	const body = req.body;
	if (!body) {
		res.type("application/json").status(400).json({
			error: "Invalid input data",
		});
	}
	if (!body.password || !body.username) {
		logger.warn(`Field(s) missing (${req.ip})`);
		res.type("application/json").status(400).json({
			error: "Field(s) missing",
		});
	}

	const loginData = {
		username: `${body.username}`,
		password: `${body.password}`,
	};
	console.log(body);
	const LoginServiceResult = await UserService.login(loginData);
	console.log(LoginServiceResult);

	if (LoginServiceResult.error === "userNotFound") {
		console.log("POOL");
		res.type("application/json").status(404).json({
			error: LoginServiceResult.error,
			message: "User not found.",
		});
	}
	if (LoginServiceResult.error === "invalidPassword") {
		res.type("application/json").status(401).json({
			error: LoginServiceResult.error,
			message: "Invalid password.",
		});
	}
	res
		.type("application/json")
		.status(200)
		.json(LoginServiceResult);
}

async function getAllUsers(req: Request, res: Response) {
	const authHeader = req.headers.authorization;
	const bearerToken = authHeader?.split(" ")[1];
	if (!bearerToken) {
		logger.warn(`Bearer token not provided (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const payload = await JwtService.verify(bearerToken);
	if (!payload) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const sourceUser = await UserService.getFromId(payload.sub);
	if (!sourceUser) {
		return res.type("application/json").status(404).json({
			error: "You dont exist anymore",
		});
	}
	if (!sourceUser.is_admin) {
		return res.type("application/json").status(403).json({
			error: "Unauthorized",
		});
	}
	const AllUserResponse = await UserService.getAll();
	if (!AllUserResponse.users) {
		return res.type("application/json").status(500).json({
			error: "Internal server error",
		});
	}
	return res
		.type("application/json")
		.status(200)
		.json(AllUserResponse);
}

async function getUser(req: Request, res: Response) {
	const authHeader = req.headers.authorization;
	const bearerToken = authHeader?.split(" ")[1];
	if (!bearerToken) {
		logger.warn(`Bearer token not provided (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const payload = await JwtService.verify(bearerToken);
	if (!payload) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const sourceUser = await UserService.getFromId(payload.sub);
	if (!sourceUser) {
		return res.type("application/json").status(404).json({
			error: "You dont exist anymore",
		});
	}
	if (!sourceUser.is_admin) {
		return res.type("application/json").status(403).json({
			error: "Unauthorized",
		});
	}
	const userId = req.params["id"];
	const dbUser = await UserService.getFromId(userId);
	if (!dbUser) {
		logger.warn(`User not found (${req.ip})`);
		return res.type("application/json").status(404).json({
			error: "User not found",
		});
	}
	// @ts-ignore
	delete dbUser.passwordHash;
	// @ts-ignore
	delete dbUser._id;
	return res.type("application/json").status(200).json(dbUser);
}

//FEAT - Implement re-auth by current password in case of password change
async function editUser(req: Request, res: Response) {
	const body: IReqEditUserData | null = req.body;
	if (!body) {
		return res.type("application/json").status(400).json({
			error: "Field(s) missing",
		});
	}
	const authHeader = req.headers.authorization;
	const bearerToken = authHeader?.split(" ")[1];
	if (!bearerToken) {
		logger.warn(`Bearer token not provided (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const payload = await JwtService.verify(bearerToken);
	if (!payload) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const sourceUser = await UserService.getFromId(payload.sub);

	//@ts-ignore
	const targetUserId = req.params.id || payload.sub;
	console.log(targetUserId);

	if (!sourceUser) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(404).json({
			error: "You dont exist anymore",
		});
	}
	if (sourceUser.is_admin || sourceUser.id === payload.sub) {
		if (sourceUser.is_admin) {
			logger.info(
				`EDIT :> Source user is an admin (${sourceUser.firstname} ${sourceUser.lastname})`,
			);
		} else {
			logger.info(
				`EDIT :> Source user modify itself (${sourceUser.firstname} ${sourceUser.lastname})`,
			);
		}

		//TODO Interface
		const modifiedData = {};
		//@ts-ignore
		if (body.firstName)
			modifiedData.firstName = `${body.firstName}`;
		//@ts-ignore
		if (body.lastName)
			modifiedData.lastName = `${body.lastName}`;
		//@ts-ignore
		if (body.displayName)
			modifiedData.displayName = `${body.displayName}`;
		//TODO Case handled with hashing by the service.
		//if (body.password) modifiedData.password = `${body.password}`;

		//Call service
		const EditUserServiceResult = await UserService.edit(
			`${targetUserId}`,
			modifiedData,
		);
		if (EditUserServiceResult.error === "userNotFound") {
			logger.warn(`User not found (${req.ip})`);
			return res.type("application/json").status(404).json({
				error: "User not found",
			});
		}
		if (EditUserServiceResult.error !== "none") {
			logger.error(
				`Error occurred during user edit (${req.ip})`,
			);
			return res.type("application/json").status(500).json({
				error: "Internal server error",
			});
		}
		return res
			.type("application/json")
			.status(200)
			.json(EditUserServiceResult);
	}
	//Not itself or
	logger.warn(
		`Unauthorized access attempt, not self or admin (${req.ip})`,
	);
	return res.type("application/json").status(403).json({
		error: "Unauthorized",
	});
}

async function deleteUser(
	req: Request,
	res: Response,
): Promise<Response> {
	const authHeader = req.headers.authorization;
	const bearerToken = authHeader?.split(" ")[1];
	if (!bearerToken) {
		logger.warn(`Bearer token not provided (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const payload = await JwtService.verify(bearerToken);

	if (!payload) {
		logger.warn(`Invalid token (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Invalid token",
		});
	}
	const sourceUser = await UserService.getFromId(payload?.sub);
	const targetUserId = req.params["id"];
	if (!sourceUser) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(404).json({
			error: "You dont exist anymore",
		});
	}
	if (sourceUser.is_admin || sourceUser.id === payload.sub) {
		const deleteUserServiceResult = await UserService.delete(
			`${targetUserId}`,
		);
		if (!deleteUserServiceResult) {
			logger.error(
				`Error occurred during user delete (${req.ip})`,
			);
			return res.type("application/json").status(500).json({
				error: "Internal server error",
			});
		}

		return res.type("application/json").status(200).json({
			message: "User deleted successfully",
		});
	}
	return res.type("application/json").status(403).json({
		error: "Unauthorized",
	});
}

async function deleteSelf(req: Request, res: Response) {
	const authHeader = req.headers.authorization;
	const bearerToken = authHeader?.split(" ")[1];
	if (!bearerToken) {
		logger.warn(`Bearer token not provided (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const payload = await JwtService.verify(bearerToken);
	if (!payload) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const sourceUser = await UserService.getFromId(payload.sub);
	if (!sourceUser) {
		return res.type("application/json").status(404).json({
			error: "You dont exist anymore",
		});
	}
	if (sourceUser.id !== req.params["id"]) {
		return res.type("application/json").status(403).json({
			error: "Unauthorized",
		});
	}
	const deleteResult = await UserService.delete(sourceUser.id);
	if (!deleteResult) {
		logger.error(`Failed to delete user (${req.ip})`);
		return res.type("application/json").status(500).json({
			error: "Failed to delete user",
		});
	}
	return res.type("application/json").status(200).json({
		message: "User deleted successfully",
	});
}

async function getSelf(req: Request, res: Response) {
	const authHeader = req.headers.authorization;
	const bearerToken = authHeader?.split(" ")[1];
	if (!bearerToken) {
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const payload = await JwtService.verify(bearerToken);
	if (!payload) {
		logger.warn(`Unauthorized access attempt (${req.ip})`);
		return res.type("application/json").status(401).json({
			error: "Unauthorized",
		});
	}
	const dbUser = await UserService.getFromId(payload.sub);
	if (!dbUser) {
		return res.type("application/json").status(404).json({
			error: "User not found",
		});
	}
	return res.type("application/json").status(200).json({
		id: dbUser.id,
		username: dbUser.username,
		firstName: dbUser.firstname,
		lastName: dbUser.firstname,
		isAdmin: dbUser.firstname,
	});
}

const AuthController = {
	register: registerUser,
	login: loginUser,
	getAllUsers,
	getUser,
	editUser,
	deleteUser,
	deleteSelf,
	getSelf,
};

export default AuthController;