Skip to content

Commit

Permalink
Add user APIs
Browse files Browse the repository at this point in the history
  • Loading branch information
haseebzaki-07 committed Oct 11, 2024
1 parent 596741f commit b7d0193
Show file tree
Hide file tree
Showing 4 changed files with 55 additions and 6 deletions.
40 changes: 40 additions & 0 deletions api/controller/user.js
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,43 @@ export const getUserProfile = async (req, res) => {
return res.status(500).json({ error: "Internal Server Error" });
}
};

export const getUserProfileById = async (req, res) => {
try {
const { id } = req.params;

const user = await User.findById(id).populate("pins");

if (!user) {
return res.status(404).json({ error: "User not found" });
}

return res.status(200).json({ user });
} catch (error) {
console.error(error);
return res.status(500).json({ error: "Internal Server Error" });
}
};

export const updateUserController = async (req, res) => {
const { id } = req.params;
const updatedData = req.body;

try {
const updatedUser = await User.findByIdAndUpdate(id, updatedData, {

Check failure

Code scanning / CodeQL

Database query built from user-controlled sources High

This query object depends on a
user-provided value
.
new: true,
runValidators: true,
});

if (!updatedUser) {
return res.status(404).json({ message: "User not found while updating" });
}

return res
.status(200)
.json({ message: "User updated successfully", updatedUser });
} catch (error) {
console.error("Error updating user:", error);
return res.status(500).json({ message: "Internal server error", error });
}
};
8 changes: 5 additions & 3 deletions api/middleware/auth.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,10 @@ const secret = process.env.SECRET;

export const validateToken = async (req, res, next) => {
try {
const { headers: { authorization = "", "x-access-token": xAccessToken = "" } } = req;
const token = xAccessToken || authorization;
const {
headers: { authorization = "", "x-access-token": xAccessToken = "" },
} = req;
const token = xAccessToken || authorization

if (!token) {

Check failure

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive
action
, but a
user-provided value
controls it.
This condition guards a sensitive
action
, but a
user-provided value
controls it.
return res.status(401).json({ message: "No token provided" });
Expand All @@ -15,7 +17,7 @@ export const validateToken = async (req, res, next) => {
return res.status(401).json({ message: "Token expired" });
}

req.user = decoded.data;
req.user = decoded.data;
next();
} catch (error) {
console.error(error);
Expand Down
1 change: 0 additions & 1 deletion api/model/user.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
import mongoose from "mongoose";

// Define the UserProfile schema with validation rules
const UserProfileSchema = new mongoose.Schema(
{
name: {
Expand Down
12 changes: 10 additions & 2 deletions api/routes/user.js
Original file line number Diff line number Diff line change
@@ -1,9 +1,17 @@
import Express from "express";
import { validateToken } from "../middleware/auth";
import { getUserProfile } from "../controller";
import { checkAuthorisation, validateToken } from "../middleware/auth";
import { getUserProfile, getUserProfileById, updateUserController } from "../controller"; // Import the new controller


const UserRouter = new Express.Router();

// Route to get the profile of the logged-in user
UserRouter.get("/", validateToken, getUserProfile);

// Route to get the profile of a user by ID
UserRouter.get("/:id", validateToken, getUserProfileById); // New route

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

// Route to update the profile of a user by ID
UserRouter.put("/:id", validateToken,checkAuthorisation, updateUserController)

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

export default UserRouter;

0 comments on commit b7d0193

Please sign in to comment.