feat(core-auth0-actions): Add authorization and fetch user's permissi…

…ons (#283)

apps/core-auth0-actions/src/controllers/newuser.ts

@@ -6,8 +6,6 @@ export const addNewUserToDatabaseOnRegister = async (req: Request, res: Response
   try {
     const { userId, email } = req.body;
 
-    console.log(req.body);
-
     if (!userId || !email) {
       return res.status(400).send('Invalid Request');
     }

apps/core-auth0-actions/src/controllers/user.ts

@@ -0,0 +1,37 @@
+import { Request, Response } from 'express';
+
+import prisma from '../utils/database';
+
+export const getUserPermissions = async (req: Request, res: Response) => {
+  try {
+    const { userId } = req.query;
+
+    if (!userId) {
+      return res.status(400).send('Invalid Request');
+    }
+
+    const userPermissions = await prisma.user.findUnique({
+      where: {
+        id: userId as string,
+      },
+      select: {
+        id: true,
+        OrganizationUser: {
+          select: {
+            role: true,
+            organizationId: true,
+          },
+        },
+      },
+    });
+
+    if (!userPermissions) {
+      return res.status(404).send('User not found');
+    }
+
+    return res.status(200).json({ userPermissions });
+  } catch (err) {
+    console.error(err);
+    return res.status(500);
+  }
+};

apps/core-auth0-actions/src/index.ts

@@ -1,6 +1,8 @@
 import express, { Request, Response } from 'express';
 import dotenv from 'dotenv';
 import { addNewUserToDatabaseOnRegister } from './controllers/newuser';
+import { getUserPermissions } from './controllers/user';
+import { authorize } from './middlewares/auth';
 
 const bodyParser = require('body-parser');
 const cors = require('cors');
@@ -32,7 +34,8 @@ app.get('/health', (req: Request, res: Response) => {
   }
 });
 
-app.post('/api/auth/newuser', addNewUserToDatabaseOnRegister);
+app.post('/api/auth/newuser', authorize, addNewUserToDatabaseOnRegister);
+app.get('/api/auth/get-user-permissions', authorize, getUserPermissions);
 
 app.listen(port, () => {
   console.log(`Server is running at http://localhost:${port}`);

apps/core-auth0-actions/src/middlewares/auth.ts

@@ -0,0 +1,21 @@
+import { Request, Response, NextFunction } from 'express';
+
+export const authorize = (req: Request, res: Response, next: NextFunction) => {
+  const { authorization } = req.headers;
+
+  if (!authorization) {
+    return res.status(401).send('Unauthorized');
+  }
+
+  const token = authorization.split(' ')[1];
+
+  if (!token) {
+    return res.status(401).send('Unauthorized');
+  }
+
+  if (token !== process.env.AUTHORIZATION_SECRET) {
+    return res.status(401).send('Unauthorized');
+  }
+
+  next();
+};